Function at 0x140026e30
Capabilities:
Encode data using xor
Enumerate processes

Disassembly:
push rbx
sub rsp, 0x340
mov rax, qword [0x14025e900]
xor rax, rsp
mov qword [rsp + 0x310], rax
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x140026e65
xor al, al
jmp 0x140027283
mov qword [rsp + 0x350], rdi
lea rdx, [rsp + 0xd0]
movaps xmmword [rsp + 0x330], xmm6
mov rcx, rbx
movaps xmmword [rsp + 0x320], xmm7
mov dword [rsp + 0xd0], 0x238
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140027260
mov edi, dword [0x14025e950]
movups xmm0, xmmword [0x14012f320]
xor r8d, r8d
movups xmm1, xmmword [0x14012f330]
mov eax, dword [0x14012f368]
movups xmmword [rsp + 0x20], xmm0
movups xmm0, xmmword [0x14012f340]
movups xmmword [rsp + 0x40], xmm0
movsd xmm0, qword [0x14012f360]
movups xmmword [rsp + 0x30], xmm1
movups xmm1, xmmword [0x14012f350]
movsd qword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x50], xmm1
mov dword [rsp + 0x68], eax
cmp edi, 2
jl 0x140027011
movdqa xmm5, xmmword [0x14012fd60]
lea rcx, [rsp + 0x20]
movdqa xmm4, xmmword [0x14012fef0]
movdqa xmm6, xmmword [0x14012fd80]
movdqa xmm7, xmmword [0x14012fd90]
nop
movd xmm2, r8d
lea eax, [r8 + 4]
pshufd xmm2, xmm2, 0
lea rcx, [rcx + 0x10]
paddd xmm2, xmm5
add r8d, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rcx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rcx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rcx - 8], xmm3
cmp r8d, 0x20
jl 0x140026f20
cmp r8d, 0x26
jge 0x140027055
movsxd rax, r8d
lea r9, [rsp + 0x20]
lea r9, [r9 + rax*2]
nop dword [rax]
mov eax, 0x51eb851f
lea r9, [r9 + 2]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x32
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x30
xor word [r9 - 2], ax
cmp r8d, 0x26
jl 0x140027020
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0xfc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14002729c
movups xmm0, xmmword [str.v_GZBRUSRI]
xor ecx, ecx
movups xmm1, xmmword [0x14012f380]
mov eax, dword [0x14012f3c0]
movups xmmword [rsp + 0x70], xmm0
movups xmm0, xmmword [0x14012f390]
movups xmmword [rsp + 0x90], xmm0
movups xmm0, xmmword [0x14012f3b0]
movups xmmword [rsp + 0x80], xmm1
movups xmm1, xmmword [0x14012f3a0]
movups xmmword [rsp + 0xb0], xmm0
movups xmmword [rsp + 0xa0], xmm1
mov dword [rsp + 0xc0], eax
cmp edi, 2
jl 0x1400271ec
movdqa xmm5, xmmword [0x14012fd60]
lea rdx, [rsp + 0x70]
movdqa xmm4, xmmword [0x14012fef0]
movdqa xmm6, xmmword [0x14012fd80]
movdqa xmm7, xmmword [0x14012fd90]
nop word [rax + rax]
movd xmm2, ecx
lea eax, [rcx + 4]
pshufd xmm2, xmm2, 0
lea rdx, [rdx + 0x10]
paddd xmm2, xmm5
add ecx, 8
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
punpckldq xmm1, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 0x10]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movd xmm2, eax
pshufd xmm2, xmm2, 0
xorps xmm3, xmm0
movq qword [rdx - 0x10], xmm3
paddd xmm2, xmm5
movdqa xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
movq xmm2, xmm7
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rdx - 8]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rdx - 8], xmm3
cmp ecx, 0x28
jl 0x140027100
cmp ecx, 0x2a
jge 0x140027231
movsxd rax, ecx
lea r8, [rsp + 0x70]
lea r8, [r8 + rax*2]
nop dword [rax + rax]
mov eax, 0x51eb851f
lea r8, [r8 + 2]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul edx, eax, 0x32
movzx eax, cx
inc ecx
sub ax, dx
add ax, 0x30
xor word [r8 - 2], ax
cmp ecx, 0x2a
jl 0x140027200
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0xfc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x14002729c
lea rdx, [rsp + 0xd0]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140026ea6
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
movaps xmm6, xmmword [rsp + 0x330]
mov rdi, qword [rsp + 0x350]
movaps xmm7, xmmword [rsp + 0x320]
mov rcx, qword [rsp + 0x310]
xor rcx, rsp
call fcn.14012a5c0
add rsp, 0x340
pop rbx
ret
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x14002726b