Function at 0x14003f100
Capabilities:
Encode data using xor
Enumerate processes
Execute command

Disassembly:
push rbp
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x140055040]
xor rax, rsp
mov qword [rbp + 0xc0], rax
mov qword [rsp + 0x200], rdi
call fcn.14003e980
call fcn.14003e980
test al, al
je 0x14003f14b
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.successfully_set_up_function_n
call fcn.140043420
xor edi, edi
mov dword [rsp + 0x50], 0xa6
xorps xmm0, xmm0
mov qword [rsp + 0x5c], rdi
mov dword [rsp + 0x64], edi
movdqu xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], rdi
mov dword [rsp + 0x54], 0x29a
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov qword [rsp + 0x28], rdi
lea rcx, [rsp + 0x50]
mov dword [rsp + 0x58], eax
xor r9d, r9d
lea rax, str.win32u.dll
mov qword [rsp + 0x20], rdi
xor r8d, r8d
mov qword [rsp + 0x68], rax
xor edx, edx
call qword [0x140055c50]
mov edx, edi
cmp qword [rsp + 0x60], rdi
jne 0x14003f20b
movdqa xmm0, xmmword [0x14004cea0]
movdqa xmm1, xmmword [0x14004ce30]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rbp - 0x80], 0x542430
movdqa xmm0, xmmword [0x14004ce40]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rbp - 0x7c], 1
movdqu xmmword [rsp + 0x60], xmm1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rdx + 0x2c]
xor byte [rsp + rdx + 0x50], al
inc rdx
cmp rdx, 0x33
jb 0x14003f1f0
mov byte [rbp - 0x7c], dil
lea rdx, [rsp + 0x50]
jmp 0x14003f25a
movdqa xmm0, xmmword [0x14004cec0]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x1f421d58
mov dword [rsp + 0x64], 0x27232e0c
mov dword [rsp + 0x68], 0x4c2121
mov byte [rsp + 0x6c], 1
nop word [rax + rax]
lea eax, [rdx + 0x2c]
xor byte [rsp + rdx + 0x50], al
inc rdx
cmp rdx, 0x1b
jb 0x14003f240
mov byte [rsp + 0x6c], dil
lea rdx, [rsp + 0x50]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140043420
movdqa xmm0, xmmword [0x14004ce80]
mov rdx, rdi
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x34494f
mov byte [rsp + 0x64], 1
nop dword [rax]
nop dword [rax + rax]
lea eax, [rdx + 0x2c]
xor byte [rsp + rdx + 0x50], al
inc rdx
cmp rdx, 0x13
jb 0x14003f290
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x50]
mov byte [rsp + 0x64], dil
call fcn.140043420
mov edx, dword [0x1400550b0]
test edx, edx
jne 0x14003f4cf
mov qword [rsp + 0x1f0], rbx
mov qword [rsp + 0x1f8], rsi
movabs rsi, 0x4e94914effff
mov qword [rsp + 0x208], r12
movabs r12, 0x7ffffffffff0bdbe
mov qword [rsp + 0x1d8], r14
movabs r14, 0x431bde82d7b634db
mov qword [rsp + 0x1d0], r15
movabs r15, 0x7fffffffffffffff
mov dword [rsp + 0x30], 0x5b5d587e
mov rcx, rdi
mov dword [rsp + 0x34], 0x565b5d73
mov dword [rsp + 0x38], 0x5218415a
mov dword [rsp + 0x3c], 0x1005c40
nop word [rax + rax]
lea eax, [rcx + 0x2c]
xor byte [rsp + rcx + 0x30], al
inc rcx
cmp rcx, 0xe
jb 0x14003f340
xor edx, edx
mov byte [rsp + 0x3f], dil
mov dword [rbp - 0x70], 0x130
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14003f411
lea rdx, [rbp - 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rax, [rbp - 0x44]
lea r8, [rsp + 0x30]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14003f3a3
inc rax
test ecx, ecx
jne 0x14003f390
mov rcx, rbx
test edx, edx
jne 0x14003f3b5
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp - 0x68]
jmp 0x14003f413
lea rdx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14003f408
nop dword [rax]
nop word [rax + rax]
lea rax, [rbp - 0x44]
lea r8, [rsp + 0x30]
sub r8, rax
nop dword [rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14003f3f3
inc rax
test ecx, ecx
jne 0x14003f3e0
mov rcx, rbx
test edx, edx
je 0x14003f3aa
lea rdx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14003f3d0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, edi
lea rcx, [rsp + 0x40]
mov dword [0x1400550b0], eax
call fcn.14003e880
mov rax, qword [rsp + 0x40]
lea rbx, [rax + 0xf4240]
cmp rax, r12
jle 0x14003f440
mov rbx, r15
nop word [rax + rax]
lea rcx, [rsp + 0x48]
call fcn.14003e880
mov rax, qword [rsp + 0x48]
cmp rbx, rax
je 0x14003f499
jl 0x14003f499
mov rcx, rbx
sub rcx, rax
cmp rcx, rsi
jg 0x14003f48d
mov rax, r14
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x14003f484
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x14003f440
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x14003f440
mov edx, dword [0x1400550b0]
test edx, edx
je 0x14003f314
mov r15, qword [rsp + 0x1d0]
mov r14, qword [rsp + 0x1d8]
mov r12, qword [rsp + 0x208]
mov rsi, qword [rsp + 0x1f8]
mov rbx, qword [rsp + 0x1f0]
movdqa xmm0, xmmword [0x14004ced0]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x354b181c
mov word [rsp + 0x64], 0x100
nop dword [rax]
lea eax, [rdi + 0x2c]
xor byte [rsp + rdi + 0x50], al
inc rdi
cmp rdi, 0x14
jb 0x14003f4f0
mov rdi, qword [rsp + 0x200]
lea rcx, [rsp + 0x50]
mov byte [rsp + 0x65], 0
call fcn.14003e560
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [0x14004c1d8]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [rbp + 0xc0]
xor rcx, rsp
call fcn.1400440a0
add rsp, 0x1e0
pop rbp
ret