Function at 0x140082ee0
Capabilities:
Encode data using xor
Enumerate process modules
Enumerate processes
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x640]
sub rsp, 0x740
mov rax, qword [0x14011c358]
xor rax, rsp
mov qword [rbp + 0x630], rax
mov r15, rdx
mov r13, rcx
lea rsi, [rcx + 0xa8]
mov qword [rsp + 0x28], rsi
mov rbx, qword [rsi]
mov rdi, qword [rsi + 8]
cmp rbx, rdi
je 0x140082f4e
mov rcx, rbx
call fcn.14007e9f0
add rbx, 0x38
cmp rbx, rdi
jne 0x140082f36
mov rax, qword [rsi]
mov qword [rsi + 8], rax
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x3f4]
call fcn.14009caf0
mov dword [rbp + 0x3f0], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r12, rax
lea rdx, [rbp + 0x3f0]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
xor esi, esi
lea rbx, [rsi - 1]
movabs rdi, 0x7ffffffffffffffe
lea ecx, [rsi + 0xa]
test eax, eax
je 0x1400832fa
xorps xmm0, xmm0
movups xmmword [rbp + 0x390], xmm0
mov qword [rbp + 0x3a0], rsi
mov qword [rbp + 0x3a8], rsi
lea rax, [rbp + 0x41c]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140082fc2
cmp rbx, rdi
ja 0x14008372a
mov qword [rbp + 0x3a8], 7
cmp rbx, 8
jae 0x140083006
mov qword [rbp + 0x3a0], rbx
lea r8, [rbx + rbx]
lea rdx, [rbp + 0x41c]
lea rcx, [rbp + 0x390]
call fcn.14009c440
jmp 0x140083062
mov rsi, rbx
or rsi, 7
cmp rsi, rdi
jbe 0x140083017
mov rsi, rdi
jmp 0x14008301f
cmp rsi, 0xa
cmovb rsi, rcx
lea rdx, [rsi + 1]
lea rcx, [rbp + 0x390]
call fcn.14008a1b0
mov rdi, rax
mov qword [rbp + 0x390], rax
mov qword [rbp + 0x3a0], rbx
mov qword [rbp + 0x3a8], rsi
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x41c]
mov rcx, rax
call fcn.14009c440
xor esi, esi
mov word [rdi + rbx], si
lea rcx, [rbp + 0x390]
mov r9, qword [rbp + 0x3a8]
cmp r9, 8
setae dl
mov r8, qword [rbp + 0x390]
cmovae rcx, r8
mov rax, qword [rbp + 0x3a0]
lea r14, [rcx + rax*2]
lea rdi, [rbp + 0x390]
test dl, dl
cmovne rdi, r8
xorps xmm0, xmm0
movups xmmword [rbp + 0x370], xmm0
mov qword [rbp + 0x380], rsi
cmp rdi, r14
jne 0x1400830c9
mov r10d, recv
mov qword [rbp + 0x388], r10
mov byte [rbp + 0x370], 0
jmp 0x1400831af
mov rax, r14
sub rax, rdi
sar rax, 1
mov ebx, recv
mov qword [rbp + 0x388], rbx
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x140083724
cmp rax, 0x10
jb 0x140083141
mov rbx, rax
or rbx, 0xf
cmp rbx, rcx
jbe 0x140083108
mov rbx, rcx
jmp 0x140083115
cmp rbx, 0x16
mov eax, socket
cmovb rbx, rax
mov rdx, rbx
add rdx, 1
mov rax, 0xffffffffffffffff
cmovb rdx, rax
lea rcx, [rbp + 0x370]
call fcn.140069810
mov qword [rbp + 0x370], rax
mov qword [rbp + 0x388], rbx
lea rcx, [rbp + 0x370]
cmp rbx, 0x10
cmovae rcx, qword [rbp + 0x370]
movzx eax, byte [rdi]
mov byte [rsi + rcx], al
mov rsi, qword [rbp + 0x380]
inc rsi
mov qword [rbp + 0x380], rsi
add rdi, 2
cmp rdi, r14
je 0x14008317d
mov rbx, qword [rbp + 0x388]
jmp 0x140083141
lea rax, [rbp + 0x370]
cmp qword [rbp + 0x388], 0x10
cmovae rax, qword [rbp + 0x370]
mov byte [rax + rsi], 0
mov r9, qword [rbp + 0x3a8]
mov r8, qword [rbp + 0x390]
mov r10, qword [rbp + 0x388]
xor esi, esi
mov rdx, r15
cmp qword [r15 + 0x18], 0x10
jb 0x1400831bc
mov rdx, qword [r15]
lea rax, [rbp + 0x370]
cmp r10, 0x10
setae dil
mov r11, qword [rbp + 0x370]
cmovae rax, r11
sub rdx, rax
nop dword [rax]
movzx ebx, byte [rax]
movzx ecx, byte [rax + rdx]
sub ebx, ecx
jne 0x1400831f2
inc rax
test ecx, ecx
jne 0x1400831e0
test dil, dil
je 0x140083236
lea rdx, [r10 + 1]
mov rax, r11
cmp rdx, 0x1000
jb 0x140083220
add rdx, 0x27
mov r11, qword [r11 - 8]
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140083718
mov rcx, r11
call fcn.14009a20c
mov r9, qword [rbp + 0x3a8]
mov r8, qword [rbp + 0x390]
test ebx, ebx
je 0x1400832a1
cmp r9, 8
jb 0x140083275
lea rdx, [r9*2 + 2]
mov rax, r8
cmp rdx, 0x1000
jb 0x14008326d
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008371e
mov rcx, r8
call fcn.14009a20c
lea rdx, [rbp + 0x3f0]
mov rcx, r12
call sub.KERNEL32.dll_Process32NextW
movabs rdi, 0x7ffffffffffffffe
mov rbx, 0xffffffffffffffff
test eax, eax
je 0x1400832fa
lea ecx, [rbx + 0xb]
jmp 0x140082fa3
mov eax, dword [rbp + 0x3f8]
mov dword [r13 + 0xc0], eax
cmp r9, 8
jb 0x1400832e9
lea rdx, [r9*2 + 2]
mov rax, r8
cmp rdx, 0x1000
jb 0x1400832e1
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008371e
mov rcx, r8
call fcn.14009a20c
mov rbx, 0xffffffffffffffff
movabs rdi, 0x7ffffffffffffffe
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [r13 + 0xc0]
test r8d, r8d
je 0x1400836e0
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [r13 + 0xa0], rax
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x1400836e0
xor edx, edx
mov r8d, 0x434
lea rcx, [rsp + 0x34]
call fcn.14009caf0
mov dword [rsp + 0x30], 0x438
mov edx, dword [r13 + 0xc0]
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r13, rax
lea rdx, [rsp + 0x30]
mov rcx, rax
call sub.KERNEL32.dll_Module32FirstW
cmp r13, 0xffffffffffffffff
je 0x1400836e0
nop dword [rax]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x3b0], xmm0
movups xmmword [rbp + 0x3d0], xmm0
mov qword [rbp + 0x3e0], rax
movups xmmword [rbp + 0x3c0], xmm0
mov qword [rbp + 0x3d0], rsi
mov r14d, recv
mov qword [rbp + 0x3d8], r14
mov byte [rbp + 0x3c0], al
mov r15, qword [rsp + 0x48]
mov qword [rbp + 0x3b0], r15
mov r12d, dword [rsp + 0x30]
mov qword [rbp + 0x3b8], r12
movups xmmword [rbp + 0x370], xmm0
mov qword [rbp + 0x380], rsi
mov qword [rbp + 0x388], rsi
lea rax, [rsp + 0x60]
nop dword [rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400833f0
cmp rbx, rdi
ja 0x140083712
mov qword [rbp + 0x388], 7
cmp rbx, 8
jae 0x140083432
mov qword [rbp + 0x380], rbx
lea r8, [rbx + rbx]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x370]
call fcn.14009c440
jmp 0x14008349b
mov rsi, rbx
or rsi, 7
cmp rsi, rdi
jbe 0x140083443
mov rsi, rdi
jmp 0x140083450
cmp rsi, 0xa
mov eax, 0xa
cmovb rsi, rax
lea rdx, [rsi + 1]
lea rcx, [rbp + 0x370]
call fcn.14008a1b0
mov rdi, rax
mov qword [rbp + 0x370], rax
mov qword [rbp + 0x380], rbx
mov qword [rbp + 0x388], rsi
add rbx, rbx
mov r8, rbx
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.14009c440
xor esi, esi
mov word [rdi + rbx], si
movabs rdi, 0x7ffffffffffffffe
lea rdx, [rbp + 0x370]
cmp qword [rbp + 0x388], 8
setae r9b
cmovae rdx, qword [rbp + 0x370]
mov rax, qword [rbp + 0x380]
lea r8, [rdx + rax*2]
lea rdx, [rbp + 0x370]
test r9b, r9b
cmovne rdx, qword [rbp + 0x370]
lea r9, [rsp + 0x20]
lea rcx, [rbp + 0x390]
call fcn.14006ae30
lea rcx, [rbp + 0x3c0]
cmp rcx, rax
je 0x14008351e
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x3c0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x3d0], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], recv
mov byte [rax], 0
psrldq xmm1, 8
movq r14, xmm1
mov rdx, qword [rbp + 0x3a8]
cmp rdx, 0x10
jb 0x14008355f
inc rdx
mov rcx, qword [rbp + 0x390]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14008355a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140083730
call fcn.14009a20c
lea rcx, [rbp + 0x3c0]
cmp r14, 0x10
setae r9b
mov rdx, qword [rbp + 0x3c0]
cmovae rcx, rdx
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140083580
lea r8, [rbp + 0x3c0]
test r9b, r9b
cmovne r8, rdx
mov edx, 0x811c9dc5
mov r9d, eax
mov rcx, rsi
test eax, eax
je 0x1400835c5
nop word [rax + rax]
movzx eax, byte [rcx + r8]
xor eax, edx
imul edx, eax, 0x1000193
inc rcx
cmp rcx, r9
jb 0x1400835b0
mov dword [rbp + 0x3e0], edx
mov rsi, qword [rsp + 0x28]
mov rbx, qword [rsi + 8]
cmp rbx, qword [rsi + 0x10]
je 0x140083601
mov qword [rbx], r15
mov qword [rbx + 8], r12
lea rcx, [rbx + 0x10]
lea rdx, [rbp + 0x3c0]
call fcn.140069f20
mov eax, dword [rbp + 0x3e0]
mov dword [rbx + 0x30], eax
add qword [rsi + 8], 0x38
jmp 0x140083614
lea r8, [rbp + 0x3b0]
mov rdx, rbx
mov rcx, rsi
call fcn.14006c890
nop
mov rdx, qword [rbp + 0x388]
cmp rdx, 8
jb 0x14008365a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x370]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140083655
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140083736
call fcn.14009a20c
xor esi, esi
mov qword [rbp + 0x380], rsi
mov qword [rbp + 0x388], 7
mov word [rbp + 0x370], si
mov rdx, qword [rbp + 0x3d8]
cmp rdx, 0x10
jb 0x1400836b6
inc rdx
mov rcx, qword [rbp + 0x3c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400836b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14008373c
call fcn.14009a20c
lea rdx, [rsp + 0x30]
mov rcx, r13
call sub.KERNEL32.dll_Module32NextW
test eax, eax
je 0x1400836d3
mov rbx, 0xffffffffffffffff
jmp 0x140083380
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x1400836e2
xor al, al
mov rcx, qword [rbp + 0x630]
xor rcx, rsp
call fcn.14009a320
lea r11, [rsp + 0x740]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14006abc0
nop
call fcn.1400aedac
nop
call fcn.1400aedac
nop
call fcn.14006abc0
nop
call fcn.14006abc0
nop
call fcn.1400aedac
nop
call fcn.1400aedac
nop
call fcn.1400aedac
int3