Function at 0x140026c20
Capabilities:
Encode data using xor
Enumerate processes
Terminate process

Disassembly:
push rdi
sub rsp, 0x280
mov rax, qword [0x14008c020]
xor rax, rsp
mov qword [rsp + 0x270], rax
xor edx, edx
mov dword [rsp + 0x20], 0x7bf480
lea ecx, [rdx + 0xf]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], 0x238
mov rcx, rax
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
mov r8d, eax
test eax, eax
je 0x140026cd0
mov qword [rsp + 0x290], rbx
lea rcx, [rsp + 0x5c]
call fcn.1400195c0
test eax, eax
jne 0x140026cb3
mov r8d, dword [rsp + 0x38]
lea ecx, [rax + 1]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140026cb3
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x30]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
mov r8d, eax
test eax, eax
jne 0x140026c76
mov rbx, qword [rsp + 0x290]
mov dword [rsp + 0x20], 0x7bf480
mov eax, 0x55555556
mov ecx, dword [rsp + 0x20]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x140026d45
mov ecx, dword [rsp + 0x20]
add ecx, 2
add ecx, r8d
mov dword [rsp + 0x20], ecx
mov eax, dword [rsp + 0x20]
and eax, 0x80000003
jge 0x140026d11
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
jne 0x1400273a1
nop dword [rax]
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 0x80000003
jge 0x140026d3c
dec eax
or eax, 0xfffffffc
inc eax
test eax, eax
je 0x140026d20
jmp 0x1400273a1
mov eax, dword [rsp + 0x20]
and eax, 0x80000001
mov eax, dword [rsp + 0x20]
je 0x140026da8
mov ecx, 2
sub ecx, r8d
add ecx, eax
mov eax, 0x55555556
mov dword [rsp + 0x20], ecx
mov ecx, dword [rsp + 0x20]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
jne 0x1400273a1
nop
mov eax, dword [rsp + 0x20]
inc eax
mov dword [rsp + 0x20], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x20]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x140026d80
jmp 0x1400273a1
mov ecx, dword [rsp + 0x20]
and eax, 0x80000003
je 0x140026e24
add ecx, 2
lea eax, [r8 + 3]
imul ecx, eax
mov dword [rsp + 0x20], ecx
mov eax, dword [rsp + 0x20]
and eax, 0x80000001
jge 0x140026dd3
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x1400273a1
nop dword [rax + rax]
mov ecx, dword [rsp + 0x20]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
cmp ecx, eax
mov eax, dword [rsp + 0x20]
je 0x140026e03
dec eax
jmp 0x140026e05
inc eax
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 0x80000001
jge 0x140026e1b
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
je 0x140026de0
jmp 0x1400273a1
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
cmp ecx, eax
je 0x140026eb7
mov eax, dword [rsp + 0x20]
lea ecx, [r8 + 0x17]
add eax, 0xb
cdq
idiv ecx
mov dword [rsp + 0x20], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x20]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
jne 0x1400273a1
nop word [rax + rax]
mov ecx, dword [rsp + 0x20]
mov eax, 0x66666667
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*4]
cmp ecx, eax
mov eax, dword [rsp + 0x20]
je 0x140026e93
inc eax
jmp 0x140026e95
dec eax
mov dword [rsp + 0x20], eax
mov eax, 0x55555556
mov ecx, dword [rsp + 0x20]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
cmp ecx, eax
je 0x140026e70
jmp 0x1400273a1
mov ecx, dword [rsp + 0x20]
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 7
cmp ecx, eax
je 0x140026f11
mov eax, dword [rsp + 0x20]
or r8d, 1
xor r8d, eax
mov dword [rsp + 0x20], r8d
mov eax, dword [rsp + 0x20]
test al, 1
jne 0x1400273a1
mov ecx, dword [rsp + 0x20]
mov eax, dword [rsp + 0x20]
add ecx, ecx
or ecx, 3
xor eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
test al, 1
je 0x140026ef1
jmp 0x1400273a1
mov ecx, dword [rsp + 0x20]
mov eax, 0x2e8ba2e9
imul ecx
sar edx, 1
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xb
cmp ecx, eax
je 0x140026fbf
movd xmm0, dword [rsp + 0x20]
mov eax, 0xaaaaaaab
mul r8d
cvtdq2ps xmm0, xmm0
mov eax, 0x2aaaaaab
shr edx, 1
mulss xmm0, dword [0x1400864bc]
cvttss2si ecx, xmm0
sub edx, ecx
mov dword [rsp + 0x20], edx
mov ecx, dword [rsp + 0x20]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
cmp ecx, 2
je 0x1400273a1
movss xmm1, dword [0x1400864b8]
nop
movd xmm0, dword [rsp + 0x20]
mov ecx, 7
cvtdq2ps xmm0, xmm0
divss xmm0, xmm1
cvttss2si eax, xmm0
sub ecx, eax
mov eax, 0x2aaaaaab
mov dword [rsp + 0x20], ecx
mov ecx, dword [rsp + 0x20]
imul ecx
mov eax, edx
shr eax, 0x1f
add edx, eax
lea eax, [rdx + rdx*2]
add eax, eax
sub ecx, eax
cmp ecx, 2
jne 0x140026f80
jmp 0x1400273a1
mov ecx, dword [rsp + 0x20]
mov eax, 0x4ec4ec4f
imul ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0xd
cmp ecx, eax
mov ecx, dword [rsp + 0x20]
je 0x140027028
imul ecx, r8d
mov r8d, dword [rsp + 0x20]
or r8d, 3
mov eax, ecx
and eax, 7
xor r8d, eax
lea eax, [r8*4]
xor eax, ecx
mov ecx, 0xffffffff
mov dword [rsp + 0x20], eax
lea edx, [rcx + 6]
nop word [rax + rax]
mov eax, dword [rsp + 0x20]
add eax, ecx
add ecx, r8d
mov dword [rsp + 0x20], eax
sub rdx, 1
jne 0x140027010
jmp 0x1400273a1
mov eax, 0x8d3dcb09
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x1d
cmp ecx, eax
je 0x140027089
mov eax, 0x24924925
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 2
imul eax, eax, 7
sub r8d, eax
mov eax, dword [rsp + 0x20]
imul r8d, eax
xor ecx, ecx
mov dword [rsp + 0x20], r8d
nop dword [rax + rax]
mov eax, dword [rsp + 0x20]
add eax, eax
xor eax, ecx
add ecx, 0x1d
mov dword [rsp + 0x20], eax
cmp ecx, 0x57
jl 0x140027070
jmp 0x1400273a1
mov ecx, dword [rsp + 0x20]
mov eax, 0x84210843
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x1f
cmp ecx, eax
mov ecx, dword [rsp + 0x20]
je 0x1400270de
mov eax, dword [rsp + 0x20]
not eax
add eax, 0x1f
add eax, r8d
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
and eax, 0x80000001
jge 0x1400270cd
dec eax
or eax, 0xfffffffe
inc eax
test eax, eax
jne 0x1400273a1
mov dword [rsp + 0x20], ecx
jmp 0x1400273a1
mov eax, 0xdd67c8a7
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x25
cmp ecx, eax
mov ecx, dword [rsp + 0x20]
je 0x14002713f
mov eax, dword [rsp + 0x20]
add ecx, 0x25
add eax, 0x25
add ecx, r8d
xor eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cmp eax, 0x3fffffff
jge 0x1400273a1
nop
mov eax, dword [rsp + 0x20]
lea eax, [rax*2 - 0x25]
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cmp eax, 0x3fffffff
jl 0x140027120
jmp 0x1400273a1
mov eax, 0x63e7063f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x29
cmp ecx, eax
je 0x1400271be
mov eax, 0xc7ce0c7d
mul r8d
shr edx, 5
imul eax, edx, 0x29
sub r8d, eax
mov eax, dword [rsp + 0x20]
add r8d, eax
mov eax, 0x63e7063f
mov dword [rsp + 0x20], r8d
mov ecx, dword [rsp + 0x20]
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x29
cmp ecx, eax
je 0x1400271a0
mov eax, dword [rsp + 0x20]
imul edx, eax, 0x29
mov dword [rsp + 0x20], edx
jmp 0x1400273a1
mov ecx, dword [rsp + 0x20]
mov eax, 0x63e7063f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
mov dword [rsp + 0x20], edx
jmp 0x1400273a1
mov ecx, dword [rsp + 0x20]
mov eax, 0x2fa0be83
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x2b
cmp ecx, eax
je 0x140027237
mov eax, dword [rsp + 0x20]
add eax, 0x2b
mov dword [rsp + 0x20], eax
mov eax, 0xcccccccd
mul r8d
shr edx, 2
lea eax, [rdx + rdx*4]
sub r8d, eax
mov eax, dword [rsp + 0x20]
inc r8d
cdq
idiv r8d
test edx, edx
je 0x1400273a1
nop dword [rax]
mov eax, dword [rsp + 0x20]
cdq
idiv r8d
mov eax, dword [rsp + 0x20]
imul edx, r8d
add eax, edx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cdq
idiv r8d
test edx, edx
jne 0x140027210
jmp 0x1400273a1
mov ecx, dword [rsp + 0x20]
mov eax, 0x4d4873ed
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x35
cmp ecx, eax
je 0x1400272ac
mov eax, dword [rsp + 0x20]
dec eax
mov dword [rsp + 0x20], eax
mov eax, 0x3521cfb3
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
imul eax, eax, 0x35
sub r8d, eax
mov eax, dword [rsp + 0x20]
inc r8d
cdq
idiv r8d
test edx, edx
je 0x1400273a1
nop word [rax + rax]
mov eax, dword [rsp + 0x20]
sub eax, 0x35
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cdq
idiv r8d
test edx, edx
jne 0x140027290
jmp 0x1400273a1
mov r8d, dword [rsp + 0x20]
mov eax, 0x6bca1af3
imul r8d
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
imul ecx, edx, 0x13
cmp r8d, ecx
je 0x1400273a1
mov r8d, dword [rsp + 0x20]
mov eax, 0x55555556
imul r8d
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*2]
cmp r8d, ecx
jne 0x140027312
call fcn.140063afc
mov r8d, eax
mov eax, 0x66666667
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
sub r8d, ecx
mov ecx, dword [rsp + 0x20]
inc ecx
jmp 0x140027338
call fcn.140063afc
mov r8d, eax
mov eax, 0x66666667
imul r8d
sar edx, 1
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
sub r8d, ecx
mov ecx, dword [rsp + 0x20]
not r8d
add ecx, r8d
mov eax, 0x92492493
mov dword [rsp + 0x20], ecx
mov ecx, dword [rsp + 0x20]
imul ecx
add edx, ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 7
sub ecx, eax
cmp ecx, 4
je 0x1400273a1
mov ecx, dword [rsp + 0x20]
mov eax, 0x6bca1af3
add ecx, ecx
imul ecx
sar edx, 3
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x13
sub ecx, eax
mov eax, 0x92492493
mov dword [rsp + 0x20], ecx
mov ecx, dword [rsp + 0x20]
imul ecx
add edx, ecx
sar edx, 2
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 7
sub ecx, eax
cmp ecx, 4
jne 0x140027360
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x270]
xor rcx, rsp
call fcn.14005b090
add rsp, 0x280
pop rdi
ret