Function at 0x140038140
Capabilities:
Create thread
Encode data using xor
Enumerate process modules
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x14005e010]
xor rax, rsp
mov qword [rbp + 0xd0], rax
mov byte [0x1401445ca], 1
mov byte [rbp - 0x70], 0x25
mov al, 0x15
xor ecx, ecx
mov r8b, 0x25
xor r8b, 0x16
mov byte [rbp - 0x6f], r8b
xor al, 0x25
mov byte [rbp - 0x6e], al
mov byte [rbp - 0x6d], cl
lea r9, [rbp - 0x6f]
mov ecx, 3
call fcn.14002ed00
mov r10, rax
cmp r8b, 0x30
jl 0x1400381dc
nop
cmp r8b, 0x39
jg 0x1400381dc
mov ecx, 0x607
call fcn.14002ed00
imul eax, r10d
movsx r10d, r8b
add r10d, 0xffffffd0
add r10d, eax
inc r9
movzx r8d, byte [r9]
cmp r8b, 0x30
jge 0x1400381b0
mov edx, r10d
lea rcx, [rsp + 0x30]
call fcn.1400329f0
mov r8, rax
cmp qword [rax + 0x18], 0x10
jb 0x1400381f6
mov r8, qword [rax]
movdqa xmm0, xmmword [0x140056620]
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x140056100]
movdqu xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x1400560e0]
movdqu xmmword [rsp + 0x70], xmm0
mov dword [rbp - 0x80], 0x5f7d5a65
mov dword [rbp - 0x7c], 0x776b7f
mov byte [rbp - 0x78], 1
xor r14d, r14d
mov ecx, r14d
nop dword [rax + rax]
lea eax, [rcx + 7]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 0x37
jb 0x140038240
mov byte [rbp - 0x78], r14b
mov r9d, 0x30
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x1400382a7
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400382a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400382a2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140043618
mov dword [rbp - 0x70], 0x64606757
mov dword [rbp - 0x6c], 0x624f2c7f
mov dword [rbp - 0x68], 0x7a7e6e
mov byte [rbp - 0x64], 1
mov rcx, r14
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 7]
xor byte [rbp + rcx - 0x70], al
inc rcx
cmp rcx, 0xb
jb 0x1400382d0
mov byte [rbp - 0x64], r14b
lea rdx, [rbp - 0x70]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140038397
call fcn.1400388e0
mov r11d, eax
call fcn.140038870
mov ecx, eax
mov edx, r11d
call fcn.1400328c0
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.1400329f0
movdqa xmm0, xmmword [0x140054f00]
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x140056610]
movdqu xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x1400561c0]
movdqu xmmword [rsp + 0x70], xmm0
mov dword [rbp - 0x80], 0x5470187c
mov dword [rbp - 0x7c], 0x5c52701b
mov dword [rbp - 0x78], 0x100395d
mov rcx, rax
call fcn.14003ee60
mov r8, rax
lea rcx, [rsp + 0x50]
call fcn.140038840
mov rdx, rax
xor ecx, ecx
mov r9d, 0x40010
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rsp + 0x30]
call fcn.14003ee70
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rbp - 0x70], 0x64606757
mov dword [rbp - 0x6c], 0x624f2c7f
mov dword [rbp - 0x68], 0x7a7e6e
mov byte [rbp - 0x64], 1
mov rcx, r14
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 7]
xor byte [rbp + rcx - 0x70], al
inc rcx
cmp rcx, 0xb
jb 0x1400383c0
mov byte [rbp - 0x64], r14b
lea rdx, [rbp - 0x70]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x1401447a8], rax
lea rdx, [0x140144750]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rbp - 0x70], 0x64606757
mov dword [rbp - 0x6c], 0x6f614e7f
mov dword [rbp - 0x68], 0x773f7b61
mov dword [rbp - 0x64], 0x100716b
mov rcx, r14
nop word [rax + rax]
lea eax, [rcx + 7]
xor byte [rbp + rcx - 0x70], al
inc rcx
cmp rcx, 0xe
jb 0x140038420
mov byte [rbp - 0x61], r14b
mov edi, r14d
mov ebx, r14d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rbp - 0x60], 0x130
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14003849f
nop dword [rax]
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x14003848e
mov eax, dword [rbp - 0x44]
cmp eax, ebx
jle 0x14003848e
mov ebx, eax
mov edi, dword [rbp - 0x58]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140038470
mov dword [0x14014458c], edi
cmp byte [0x1401445ca], r14b
jne 0x1400384d1
mov ecx, 0x10
call fcn.140043934
mov qword [rbp - 0x70], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov rcx, rax
call fcn.14002f7d0
nop
mov edi, dword [0x14014458c]
mov rsi, r14
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14003854b
lea r9, [rbp - 0x70]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x140038542
mov eax, dword [rbp - 0x70]
test eax, eax
je 0x140038542
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x140038542
lea r9, [rbp - 0x70]
mov r8d, dword [rbp - 0x70]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x140038539
mov rsi, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140144598], rsi
mov r8d, dword [0x14014458c]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1401445a0], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.140032420
mov ecx, 8
call fcn.140043934
lea rcx, [0x14003d2a0]
mov qword [rax], rcx
mov qword [rbp - 0x70], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x140042e50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140038828
cmp dword [rsp + 0x38], 0
jne 0x1400385df
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp - 0x70], xmm0
lea rcx, [rbp - 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x140038600
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
mov ecx, 8
call fcn.140043934
lea rcx, [0x14003d0f0]
mov qword [rax], rcx
mov qword [rbp - 0x70], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x140042e50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140038817
cmp dword [rsp + 0x38], 0
jne 0x14003865c
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp - 0x70], xmm0
lea rcx, [rbp - 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x14003867d
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
mov ecx, 8
call fcn.140043934
lea rcx, [0x140036b80]
mov qword [rax], rcx
mov qword [rbp - 0x70], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x140042e50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140038806
cmp dword [rsp + 0x38], 0
jne 0x1400386d9
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp - 0x70], xmm0
lea rcx, [rbp - 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x1400386fa
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
mov ecx, 8
call fcn.140043934
lea rcx, [0x140036c40]
mov qword [rax], rcx
mov qword [rbp - 0x70], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x140042e50]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400387f5
cmp dword [rsp + 0x38], 0
jne 0x140038756
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp - 0x70], xmm0
lea rcx, [rbp - 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x140038777
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
call fcn.140032c50
call fcn.140032e40
call fcn.1400366c0
mov rcx, qword [0x1401445d0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x140144830]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x140144780]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x140144828]
call qword [sym.imp.USER32.dll_DestroyWindow]
xor edx, edx
lea rcx, str.fgers
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.140043070
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov dword [rsp + 0x38], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3