Function at 0x1401ed4a0
Capabilities:
Encode data using xor
Enumerate processes
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3c40]
mov eax, 0x3d40
call fcn.14026c7e0
sub rsp, rax
mov rax, qword [0x1402af028]
xor rax, rsp
mov qword [rbp + 0x3c30], rax
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x40], 0x238
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x1504], 0xffffffff
mov edx, 1
mov dword [rbp + 0x184], eax
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0x184], eax
inc rdx
cmp rdx, 0x270
jb 0x1401ed510
mov dword [rbp + 0x180], 0x270
mov dword [rsp + 0x20], 0
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1401ed562
imul rax, rax, 0x64
jmp 0x1401ed57d
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
lea r14, [rax + 0x5f5e100]
mov r13d, 0x80000000
mov r12d, 1
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1401ed5ae
imul rax, rax, 0x64
jmp 0x1401ed5c9
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r14
jge 0x1401ed785
mov esi, 0x186a0
nop word [rax + rax]
lea rcx, [rbp + 0x180]
call fcn.140251700
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x63
ja 0x1401ed61a
nop word [rax + rax]
lea rcx, [rbp + 0x180]
call fcn.140251700
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401ed600
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
cmp ecx, r13d
lea eax, [rcx + r13]
lea ebx, [rcx - 0x80000000]
cmovae ebx, eax
lea rcx, [rbp + 0x180]
test ebx, ebx
cmove ebx, r12d
call fcn.140251700
mov ecx, eax
mov edi, ebx
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x1401ed67a
cmp eax, 0x64
jae 0x1401ed67a
nop dword [rax]
lea rcx, [rbp + 0x180]
call fcn.140251700
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401ed660
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
lea eax, [rcx + r13]
cmp ecx, r13d
lea edx, [rcx - 0x80000000]
cmovae edx, eax
lea rcx, [rbp + 0x180]
mov eax, dword [rsp + 0x20]
add edx, eax
mov dword [rsp + 0x20], edx
call fcn.140251700
mov ecx, eax
mov ebx, edi
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x1401ed6db
cmp eax, 0x64
jae 0x1401ed6db
lea rcx, [rbp + 0x180]
call fcn.140251700
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401ed6c1
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
lea eax, [rcx + r13]
cmp ecx, r13d
lea edx, [rcx - 0x80000000]
cmovae edx, eax
lea rcx, [rbp + 0x180]
mov eax, dword [rsp + 0x20]
imul edx, eax
mov dword [rsp + 0x20], edx
call fcn.140251700
mov ecx, eax
mov edi, ebx
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x1401ed73d
cmp eax, 0x64
jae 0x1401ed73d
lea rcx, [rbp + 0x180]
call fcn.140251700
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401ed723
shr rax, 0x20
lea edx, [rax + 0x7fffff9c]
cmp edx, r13d
lea eax, [rdx + r13]
lea ecx, [rdx - 0x80000000]
cmovae ecx, eax
mov eax, dword [rsp + 0x20]
sub eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cdq
idiv edi
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cdq
idiv edi
mov dword [rsp + 0x20], edx
sub rsi, r12
jne 0x1401ed5e0
jmp 0x1401ed590
mov eax, dword [rsp + 0x20]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r15, rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x2894], 0xffffffff
mov rdx, r12
mov dword [rbp + 0x1514], eax
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0x1514], eax
inc rdx
cmp rdx, 0x270
jb 0x1401ed7c0
mov dword [rbp + 0x1510], 0x270
mov dword [rsp + 0x20], 0
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1401ed812
imul rax, rax, 0x64
jmp 0x1401ed82d
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
lea r14, [rax + 0x5f5e100]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1401ed852
imul rax, rax, 0x64
jmp 0x1401ed86d
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r14
jge 0x1401eda25
mov esi, 0x186a0
nop dword [rax + rax]
lea rcx, [rbp + 0x1510]
call fcn.140251700
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x63
ja 0x1401ed8ba
nop word [rax + rax]
lea rcx, [rbp + 0x1510]
call fcn.140251700
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401ed8a0
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
cmp ecx, r13d
lea eax, [rcx + r13]
lea ebx, [rcx - 0x80000000]
cmovae ebx, eax
lea rcx, [rbp + 0x1510]
test ebx, ebx
cmove ebx, r12d
call fcn.140251700
mov ecx, eax
mov edi, ebx
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x1401ed91a
cmp eax, 0x64
jae 0x1401ed91a
nop dword [rax]
lea rcx, [rbp + 0x1510]
call fcn.140251700
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401ed900
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
lea eax, [rcx + r13]
cmp ecx, r13d
lea edx, [rcx - 0x80000000]
cmovae edx, eax
lea rcx, [rbp + 0x1510]
mov eax, dword [rsp + 0x20]
add edx, eax
mov dword [rsp + 0x20], edx
call fcn.140251700
mov ecx, eax
mov ebx, edi
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x1401ed97b
cmp eax, 0x64
jae 0x1401ed97b
lea rcx, [rbp + 0x1510]
call fcn.140251700
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401ed961
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
lea eax, [rcx + r13]
cmp ecx, r13d
lea edx, [rcx - 0x80000000]
cmovae edx, eax
lea rcx, [rbp + 0x1510]
mov eax, dword [rsp + 0x20]
imul edx, eax
mov dword [rsp + 0x20], edx
call fcn.140251700
mov ecx, eax
mov edi, ebx
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x1401ed9dd
cmp eax, 0x64
jae 0x1401ed9dd
lea rcx, [rbp + 0x1510]
call fcn.140251700
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401ed9c3
shr rax, 0x20
lea edx, [rax + 0x7fffff9c]
cmp edx, r13d
lea eax, [rdx + r13]
lea ecx, [rdx - 0x80000000]
cmovae ecx, eax
mov eax, dword [rsp + 0x20]
sub eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cdq
idiv edi
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cdq
idiv edi
mov dword [rsp + 0x20], edx
sub rsi, r12
jne 0x1401ed880
jmp 0x1401ed834
mov eax, dword [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, r12d
mov r12, qword [rsp + 0x28]
jne 0x1401eda85
lea rdx, [rsp + 0x40]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x1401eda85
nop dword [rax]
nop dword [rax + rax]
mov rdx, r12
lea rcx, [rsp + 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, r15
test eax, eax
je 0x1401edaf2
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x1401eda60
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x3c24], 0xffffffff
mov edx, 1
mov dword [rbp + 0x28a4], eax
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0x28a4], eax
inc rdx
cmp rdx, 0x270
jb 0x1401edaa0
mov dword [rbp + 0x28a0], 0x270
mov dword [rsp + 0x20], 0
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1401edb01
imul rax, rax, 0x64
jmp 0x1401edb1c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x48]
jmp 0x1401edd36
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
lea r14, [rax + 0x5f5e100]
mov r15d, 1
nop dword [rax]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1401edb4e
imul rax, rax, 0x64
jmp 0x1401edb69
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r14
jge 0x1401edd25
mov esi, 0x186a0
nop word [rax + rax]
lea rcx, [rbp + 0x28a0]
call fcn.140251700
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x63
ja 0x1401edbba
nop word [rax + rax]
lea rcx, [rbp + 0x28a0]
call fcn.140251700
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401edba0
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
cmp ecx, r13d
lea eax, [rcx + r13]
lea ebx, [rcx - 0x80000000]
cmovae ebx, eax
lea rcx, [rbp + 0x28a0]
test ebx, ebx
cmove ebx, r15d
call fcn.140251700
mov ecx, eax
mov edi, ebx
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x1401edc1a
cmp eax, 0x64
jae 0x1401edc1a
nop dword [rax]
lea rcx, [rbp + 0x28a0]
call fcn.140251700
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401edc00
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
lea eax, [rcx + r13]
cmp ecx, r13d
lea edx, [rcx - 0x80000000]
cmovae edx, eax
lea rcx, [rbp + 0x28a0]
mov eax, dword [rsp + 0x20]
add edx, eax
mov dword [rsp + 0x20], edx
call fcn.140251700
mov ecx, eax
mov ebx, edi
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x1401edc7b
cmp eax, 0x64
jae 0x1401edc7b
lea rcx, [rbp + 0x28a0]
call fcn.140251700
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401edc61
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
lea eax, [rcx + r13]
cmp ecx, r13d
lea edx, [rcx - 0x80000000]
cmovae edx, eax
lea rcx, [rbp + 0x28a0]
mov eax, dword [rsp + 0x20]
imul edx, eax
mov dword [rsp + 0x20], edx
call fcn.140251700
mov ecx, eax
mov edi, ebx
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x1401edcdd
cmp eax, 0x64
jae 0x1401edcdd
lea rcx, [rbp + 0x28a0]
call fcn.140251700
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401edcc3
shr rax, 0x20
lea edx, [rax + 0x7fffff9c]
cmp edx, r13d
lea eax, [rdx + r13]
lea ecx, [rdx - 0x80000000]
cmovae ecx, eax
mov eax, dword [rsp + 0x20]
sub eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cdq
idiv edi
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cdq
idiv edi
mov dword [rsp + 0x20], edx
sub rsi, r15
jne 0x1401edb80
jmp 0x1401edb30
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0x3c30]
xor rcx, rsp
call fcn.14026b460
lea r11, [rsp + 0x3d40]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret