Function at 0x140004ec0
Capabilities:
Contain obfuscated stackstrings
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x420]
sub rsp, 0x520
mov rax, qword [0x140076040]
xor rax, rsp
mov qword [rbp + 0x410], rax
mov edx, 0xc
mov dword [rbp + 0x270], 0x92cc89a0
lea rcx, [rbp + 0x270]
mov dword [rbp + 0x274], 0x88cee816
mov dword [rbp + 0x278], 0x58d0f381
call fcn.1400039e0
mov edx, 0xf
mov dword [rbp + 0x270], 0x9ccf89a0
lea rcx, [rbp + 0x270]
mov dword [rbp + 0x274], 0x9890e10b
mov rsi, rax
mov dword [rbp + 0x278], 0x13d1f7dd
mov word [rbp + 0x27c], 0x3b2f
mov byte [rbp + 0x27e], 0x2e
call fcn.1400039e0
mov edx, 0xa
mov dword [rbp + 0x2b8], 0x9ccf89a0
lea rcx, [rbp + 0x2b8]
mov dword [rbp + 0x2bc], 0x8993e10b
mov r14, rax
mov word [rbp + 0x2c0], 0xf3d7
call fcn.1400039e0
mov edx, 0x11
mov dword [rbp + 0x270], 0x88f9a380
lea rcx, [rbp + 0x270]
mov dword [rbp + 0x274], 0x89eeec0d
mov r15, rax
mov dword [rbp + 0x278], 0x5ec1e0dd
mov dword [rbp + 0x27c], 0xff2e6d2f
mov byte [rbp + 0x280], 0x67
call fcn.1400039e0
mov edx, 0xf
mov dword [rbp + 0x270], 0x998b89a0
lea rcx, [rbp + 0x270]
mov dword [rbp + 0x274], 0x9acfe10a
mov r12, rax
mov dword [rbp + 0x278], 0x13cdf5c6
mov word [rbp + 0x27c], 0x3b2f
mov byte [rbp + 0x27e], 0x2e
call fcn.1400039e0
mov edx, 0xe
mov dword [rbp + 0x270], 0x89ca8d80
lea rcx, [rbp + 0x270]
mov dword [rbp + 0x274], 0xaed1e50c
mov r13, rax
mov dword [rbp + 0x278], 0x5886eec0
mov word [rbp + 0x27c], 0x2632
call fcn.1400039e0
mov edx, 0xe
mov qword [rsp + 0x60], rax
lea rcx, [rbp + 0x270]
mov dword [rbp + 0x270], 0x85d7a680
mov dword [rbp + 0x274], 0x8dd3e534
mov dword [rbp + 0x278], 0x5886f3c8
mov word [rbp + 0x27c], 0x2632
call fcn.1400039e0
mov edx, 0x10
mov qword [rsp + 0x68], rax
lea rcx, [rbp + 0x270]
mov dword [rbp + 0x270], 0x89ca8d80
mov dword [rbp + 0x274], 0xaed1e50c
mov dword [rbp + 0x278], 0x70feeec0
mov dword [rbp + 0x27c], 0xe2332664
call fcn.1400039e0
mov edx, 0xc
mov qword [rsp + 0x70], rax
lea rcx, [rbp + 0x270]
mov dword [rbp + 0x270], 0x85d786a0
mov dword [rbp + 0x274], 0x95dcf60d
mov dword [rbp + 0x278], 0x58d0f381
call fcn.1400039e0
mov qword [rsp + 0x50], rax
mov edx, 0x1d
mov dword [rbp + 0x270], 0xb9eaa59e
mov dword [rbp + 0x274], 0xa9efc52e
mov dword [rbp + 0x278], 0x78eccaf3
mov dword [rbp + 0x27c], 0xce190019
mov dword [rbp + 0x280], 0x89f5e752
mov dword [rbp + 0x284], 0x5c4177e6
mov dword [rbp + 0x288], 0x7ac22770
mov byte [rbp + 0x28c], 0xe6
lea rcx, [rbp + 0x270]
call fcn.1400039e0
mov edx, 0x11
mov qword [rbp + 0x2b8], rax
lea rcx, [rbp + 0x270]
mov dword [rbp + 0x270], 0x89cb9d85
mov dword [rbp + 0x274], 0x85ffe91c
mov dword [rbp + 0x278], 0x58fee5c0
mov dword [rbp + 0x27c], 0xe8223038
mov byte [rbp + 0x280], 0x6c
call fcn.1400039e0
lea rcx, [rbp + 0x2d0]
mov qword [rsp + 0x48], rax
mov dword [rbp + 0x2a0], 0x9ccfa980
mov word [rbp + 0x2a4], 0xe10b
call fcn.140003690
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0x2d0]
call fcn.1400032a0
xor edx, edx
lea rax, [rbp + 0x2a0]
lea rbx, [rbp + 0x230]
sub rbx, rax
nop dword [rax]
cmp rdx, 6
jge 0x140005230
lea rax, [rbp + 0x2a0]
add rax, rdx
movzx ecx, byte [rbx + rax]
xor cl, byte [rax]
mov byte [rbp + rdx + 0x290], cl
inc rdx
cmp rdx, 0x40
jl 0x140005200
nop word [rax + rax]
movzx eax, byte [rbp + 0x290]
cmp al, 0xa
ja 0x14000523d
add al, 0x30
mov byte [rbp + 0x2b0], al
mov byte [rsp + 0x40], al
movzx eax, byte [rbp + 0x291]
cmp al, 0xa
ja 0x140005254
add al, 0x30
mov byte [rbp + 0x2b1], al
movzx eax, byte [rbp + 0x292]
cmp al, 0xa
ja 0x140005267
add al, 0x30
mov byte [rbp + 0x2b2], al
movzx eax, byte [rbp + 0x293]
cmp al, 0xa
ja 0x14000527a
add al, 0x30
mov byte [rbp + 0x2b3], al
movzx eax, byte [rbp + 0x294]
cmp al, 0xa
ja 0x14000528d
add al, 0x30
mov byte [rbp + 0x2b4], al
movzx eax, byte [rbp + 0x295]
cmp al, 0xa
ja 0x1400052a0
add al, 0x30
lea rcx, [rbp + 0x230]
mov byte [rbp + 0x2b5], al
mov byte [rbp + 0x2b6], 0
mov dword [rbp + 0x2a0], 0x89ca8d80
mov dword [rbp + 0x2a4], 0xaed1e50c
mov word [rbp + 0x2a8], 0xeec0
call fcn.140003690
lea rdx, [rbp + 0x2d0]
lea rcx, [rbp + 0x230]
call fcn.1400032a0
xor edx, edx
lea rax, [rbp + 0x2a0]
lea rbx, [rbp + 0x2d0]
sub rbx, rax
nop dword [rax]
cmp rdx, 0xa
jge 0x140005330
lea rax, [rbp + 0x2a0]
add rax, rdx
movzx ecx, byte [rbx + rax]
xor cl, byte [rax]
mov byte [rbp + rdx + 0x290], cl
inc rdx
cmp rdx, 0x40
jl 0x140005300
nop word [rax + rax]
movzx eax, byte [rbp + 0x290]
cmp al, 0xa
ja 0x14000533d
add al, 0x30
mov byte [rbp + 0x270], al
mov byte [rsp + 0x41], al
movzx eax, byte [rbp + 0x291]
cmp al, 0xa
ja 0x140005354
add al, 0x30
mov byte [rbp + 0x271], al
movzx eax, byte [rbp + 0x292]
cmp al, 0xa
ja 0x140005367
add al, 0x30
mov byte [rbp + 0x272], al
movzx eax, byte [rbp + 0x293]
cmp al, 0xa
ja 0x14000537a
add al, 0x30
mov byte [rbp + 0x273], al
movzx eax, byte [rbp + 0x294]
cmp al, 0xa
ja 0x14000538d
add al, 0x30
mov byte [rbp + 0x274], al
movzx eax, byte [rbp + 0x295]
cmp al, 0xa
ja 0x1400053a0
add al, 0x30
mov byte [rbp + 0x275], al
movzx eax, byte [rbp + 0x296]
cmp al, 0xa
ja 0x1400053b3
add al, 0x30
mov byte [rbp + 0x276], al
movzx eax, byte [rbp + 0x297]
cmp al, 0xa
ja 0x1400053c6
add al, 0x30
mov byte [rbp + 0x277], al
movzx eax, byte [rbp + 0x298]
cmp al, 0xa
ja 0x1400053d9
add al, 0x30
mov byte [rbp + 0x278], al
movzx eax, byte [rbp + 0x299]
cmp al, 0xa
ja 0x1400053ec
add al, 0x30
lea rcx, [rbp + 0x230]
mov byte [rbp + 0x279], al
mov byte [rbp + 0x27a], 0
mov dword [rbp + 0x290], 0xa8f5a187
call fcn.140003690
lea rdx, [rbp + 0x2d0]
lea rcx, [rbp + 0x230]
call fcn.1400032a0
xor edx, edx
lea rax, [rbp + 0x290]
lea rbx, [rbp + 0x2d0]
sub rbx, rax
cmp rdx, 5
jge 0x140005460
lea rax, [rbp + 0x290]
add rax, rdx
movzx ecx, byte [rbx + rax]
xor cl, byte [rax]
mov byte [rbp + rdx + 0x2a0], cl
inc rdx
cmp rdx, 0x40
jl 0x140005435
nop dword [rax + rax]
mov edi, dword [rbp + 0x2a0]
cmp dil, 0xa
ja 0x140005470
add dil, 0x30
movzx eax, byte [rbp + 0x2a1]
mov byte [rbp + 0x290], dil
cmp al, 0xa
ja 0x140005484
add al, 0x30
mov byte [rbp + 0x291], al
movzx eax, byte [rbp + 0x2a2]
cmp al, 0xa
ja 0x140005497
add al, 0x30
mov byte [rbp + 0x292], al
movzx eax, byte [rbp + 0x2a3]
cmp al, 0xa
ja 0x1400054aa
add al, 0x30
mov byte [rbp + 0x293], al
xor edx, edx
mov rax, qword [rsp + 0x60]
mov qword [rbp + 0x208], rax
mov rax, qword [rsp + 0x68]
mov qword [rbp + 0x210], rax
lea ecx, [rdx + 2]
mov rax, qword [rsp + 0x70]
mov qword [rbp + 0x218], rax
mov rax, qword [rsp + 0x50]
mov qword [rbp + 0x220], rax
mov byte [rbp + 0x294], 0
mov qword [rbp + 0x1e0], rsi
mov qword [rbp + 0x1e8], r14
mov qword [rbp + 0x1f0], r15
mov qword [rbp + 0x1f8], r13
mov qword [rbp + 0x200], r12
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x140005870
lea rdx, [rbp - 0x60]
mov dword [rbp - 0x60], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
nop word [rax + rax]
lea r8, [rbp + 0x1e0]
nop word [rax + rax]
mov rbx, qword [r8]
lea rax, [rbp - 0x34]
sub rbx, rax
nop word [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + rbx]
sub edx, ecx
jne 0x140005573
add rax, 2
test ecx, ecx
jne 0x140005560
test edx, edx
je 0x1400058e2
add r8, 8
lea rax, [rbp + 0x228]
cmp r8, rax
jne 0x140005550
lea rdx, [rbp - 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140005540
mov rcx, rsi
call qword [0x140079a68]
xor ecx, ecx
mov eax, 1
cpuid
sar ecx, 0x1f
test cl, 1
jne 0x1400058eb
mov r8, qword [rsp + 0x48]
lea rax, [rsp + 0x78]
mov rdx, qword [rbp + 0x2b8]
xor ebx, ebx
mov qword [rsp + 0x30], rax
mov rcx, 0xffffffff80000002
lea rax, [rbp + 0x310]
mov dword [rsp + 0x78], 0x100
mov qword [rsp + 0x28], rax
lea r9d, [rbx + 2]
mov qword [rsp + 0x20], rbx
call qword [0x140079a98]
test eax, eax
jne 0x140005870
xorps xmm0, xmm0
mov qword [rbp - 0x70], rbx
mov rsi, 0xffffffffffffffff
mov qword [rbp - 0x68], rbx
movups xmmword [rbp - 0x80], xmm0
mov r8, rsi
lea rax, [rbp + 0x310]
inc r8
cmp byte [rax + r8], bl
jne 0x140005624
lea rdx, [rbp + 0x310]
lea rcx, [rbp - 0x80]
call fcn.14000c590
lea rax, [rbp + 0x2b0]
mov r14, rsi
inc r14
cmp byte [rax + r14], bl
jne 0x140005647
mov r13, qword [rbp - 0x68]
lea rax, [rbp - 0x80]
mov r15, qword [rbp - 0x80]
cmp r13, 0xf
mov r12, qword [rbp - 0x70]
cmova rax, r15
mov qword [rsp + 0x48], rax
cmp r14, r12
ja 0x1400056f8
mov rcx, r12
sub rcx, r14
test r14, r14
je 0x1400058ab
movsx edx, byte [rsp + 0x40]
inc rcx
add rcx, rax
mov r8, rcx
mov qword [rbp + 0x2b8], rcx
sub r8, rax
mov rcx, rax
call fcn.14005e030
mov rbx, rax
test rax, rax
je 0x1400056f8
nop dword [rax]
mov r8, r14
lea rdx, [rbp + 0x2b0]
mov rcx, rbx
call fcn.14005e0d0
test eax, eax
je 0x1400056ea
mov r8, qword [rbp + 0x2b8]
inc rbx
movsx edx, byte [rsp + 0x40]
sub r8, rbx
mov rcx, rbx
call fcn.14005e030
mov rbx, rax
test rax, rax
jne 0x1400056b0
jmp 0x1400056f8
sub rbx, qword [rsp + 0x48]
cmp rbx, rsi
jne 0x1400058ab
lea rax, [rbp + 0x270]
mov r14, rsi
inc r14
cmp byte [rax + r14], 0
jne 0x140005702
cmp r13, 0xf
lea rax, [rbp - 0x80]
cmova rax, r15
mov qword [rsp + 0x48], rax
cmp r14, r12
ja 0x1400057a8
mov rcx, r12
sub rcx, r14
test r14, r14
je 0x1400058ab
movsx edx, byte [rsp + 0x41]
inc rcx
add rcx, rax
mov r8, rcx
mov qword [rbp + 0x2b8], rcx
sub r8, rax
mov rcx, rax
call fcn.14005e030
mov rbx, rax
test rax, rax
je 0x1400057a8
nop dword [rax]
mov r8, r14
lea rdx, [rbp + 0x270]
mov rcx, rbx
call fcn.14005e0d0
test eax, eax
je 0x14000579a
mov r8, qword [rbp + 0x2b8]
inc rbx
movsx edx, byte [rsp + 0x41]
sub r8, rbx
mov rcx, rbx
call fcn.14005e030
mov rbx, rax
test rax, rax
jne 0x140005760
jmp 0x1400057a8
sub rbx, qword [rsp + 0x48]
cmp rbx, rsi
jne 0x1400058ab
lea rax, [rbp + 0x290]
nop
inc rsi
cmp byte [rax + rsi], 0
jne 0x1400057b0
cmp r13, 0xf
lea r14, [rbp - 0x80]
cmova r14, r15
cmp rsi, r12
ja 0x140005839
sub r12, rsi
test rsi, rsi
je 0x1400058ab
lea r8, [r14 + 1]
movsx edi, dil
add r8, r12
mov edx, edi
sub r8, r14
mov rcx, r14
call fcn.14005e030
mov rbx, rax
test rax, rax
je 0x140005839
nop word [rax + rax]
mov r8, rsi
lea rdx, [rbp + 0x290]
mov rcx, rbx
call fcn.14005e0d0
test eax, eax
je 0x1400058a2
inc rbx
lea r8, [r14 + 1]
add r8, r12
mov edx, edi
sub r8, rbx
mov rcx, rbx
call fcn.14005e030
mov rbx, rax
test rax, rax
jne 0x140005800
cmp r13, 0xf
jbe 0x140005870
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140005868
mov r15, qword [r15 - 8]
add rdx, 0x27
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400058ef
mov rcx, r15
call fcn.140035ca0
xor al, al
mov rcx, qword [rbp + 0x410]
xor rcx, rsp
call fcn.140035c80
lea r11, [rsp + 0x520]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
sub rbx, r14
cmp rbx, 0xffffffffffffffff
je 0x140005839
cmp r13, 0xf
jbe 0x1400058eb
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x1400058d6
mov r15, qword [r15 - 8]
add rdx, 0x27
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400058ef
mov rcx, r15
call fcn.140035ca0
mov al, 1
jmp 0x140005872
mov rcx, rsi
call qword [0x140079a68]
mov al, 1
jmp 0x140005872
call fcn.14003ff80
int3