Function at 0x140002620
Capabilities:
Encode data using xor
Enumerate process modules

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x14b0]
mov eax, 0x15b0
call fcn.1400156d0
sub rsp, rax
mov rax, qword [0x140021008]
xor rax, rsp
mov qword [rbp + 0x14a0], rax
xor r12d, r12d
mov r15d, 0xf6
mov qword [rbp + 0x210], r12
mov eax, 0x6d
mov dword [rbp + 0x218], r12d
mov r11d, 0x65
mov word [rsp + 0x20], r15w
mov r10d, 0xf3
mov word [rsp + 0x22], ax
mov r13d, 0xa
movzx eax, word [0x14001e3c6]
mov r9d, 0x63
add ax, 0x11
mov word [rsp + 0x24], r10w
xor ax, 0x33
mov word [rsp + 0x26], r13w
sub ax, 0x33
mov word [rsp + 0x28], r15w
xor ax, 0x77
mov word [rsp + 0x2a], r9w
mov ebx, 0xffae
mov edi, 0xf0
mov word [rsp + 0x2c], bx
mov esi, 0xff98
mov word [rsp + 0x2e], r11w
mov word [rsp + 0x30], di
mov word [rsp + 0x32], r11w
mov word [rsp + 0x34], si
mov word [rsp + 0x36], ax
movzx eax, word [str.tcpview.exe]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rsp + 0x38], ax
movzx eax, word [0x14001e3ca]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rsp + 0x3a], ax
movzx eax, word [0x14001e3cc]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rsp + 0x3c], ax
movzx eax, word [0x14001e3ce]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rsp + 0x3e], ax
movzx eax, word [0x14001e3d0]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rsp + 0x40], ax
movzx eax, word [0x14001e3d2]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rsp + 0x42], ax
movzx eax, word [0x14001e3d4]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rsp + 0x44], ax
movzx eax, word [0x14001e3d6]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rsp + 0x46], ax
movzx eax, word [0x14001e3d8]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
lea rcx, [rsp + 0x48]
mov word [rsp + 0x48], ax
mov r8d, 0x15
xor eax, eax
mov edx, r8d
mov word [rsp + 0x4a], ax
movzx eax, word [rsp + 0x20]
movzx eax, word [rcx]
lea rcx, [rcx - 2]
xor ax, 0x77
add ax, 0x33
xor ax, 0x33
sub ax, 0x11
mov word [rcx + 2], ax
sub rdx, 1
jne 0x140002811
mov word [rsp + 0x4a], r12w
lea rax, [rsp + 0x20]
mov qword [rbp + 0x220], rax
mov r14d, 8
mov eax, 0xf4
mov word [rbp - 0x50], ax
mov eax, 0x61
mov word [rbp - 0x4e], r9w
mov word [rbp - 0x4c], r14w
mov word [rbp - 0x4a], r15w
mov word [rbp - 0x48], ax
mov eax, 0xff
mov word [rbp - 0x46], r11w
mov word [rbp - 0x44], ax
movzx eax, word [str.wireshark.exe]
add ax, 0x11
mov word [rbp - 0x42], bx
xor ax, 0x33
mov word [rbp - 0x40], r11w
sub ax, 0x33
mov word [rbp - 0x3e], di
xor ax, 0x77
mov word [rbp - 0x3c], r11w
mov word [rbp - 0x3a], si
mov word [rbp - 0x38], ax
movzx eax, word [0x14001e3e2]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp - 0x36], ax
movzx eax, word [0x14001e3e4]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp - 0x34], ax
movzx eax, word [0x14001e3e6]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp - 0x32], ax
movzx eax, word [0x14001e3e8]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp - 0x30], ax
movzx eax, word [0x14001e3ea]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp - 0x2e], ax
movzx eax, word [0x14001e3ec]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp - 0x2c], ax
movzx eax, word [0x14001e3ee]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp - 0x2a], ax
movzx eax, word [0x14001e3f0]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp - 0x28], ax
movzx eax, word [0x14001e3f2]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp - 0x26], ax
movzx eax, word [0x14001e3f4]
add ax, 0x11
xor ax, 0x33
lea rcx, [rbp - 0x24]
sub ax, 0x33
mov r9d, 0x17
xor ax, 0x77
mov edx, r9d
mov word [rbp - 0x24], ax
xor eax, eax
mov word [rbp - 0x22], ax
movzx eax, word [rbp - 0x50]
nop
movzx eax, word [rcx]
lea rcx, [rcx - 2]
xor ax, 0x77
add ax, 0x33
xor ax, 0x33
sub ax, 0x11
mov word [rcx + 2], ax
sub rdx, 1
jne 0x1400029d0
mov word [rbp - 0x22], r12w
lea rax, [rbp - 0x50]
mov qword [rbp + 0x228], rax
mov eax, 0xff
mov word [rbp + 0xe0], ax
mov eax, 0x61
mov word [rbp + 0xe2], ax
mov eax, 0x60
mov word [rbp + 0xe4], r13w
mov word [rbp + 0xe6], r11w
mov word [rbp + 0xe8], r10w
mov word [rbp + 0xea], ax
mov eax, 0x79
mov word [rbp + 0xec], ax
mov eax, 0x6b
mov word [rbp + 0xee], r13w
mov word [rbp + 0xf0], ax
movzx eax, word [0x14001e3fc]
add ax, 0x11
mov word [rbp + 0xf2], bx
xor ax, 0x33
mov word [rbp + 0xf4], r11w
sub ax, 0x33
mov word [rbp + 0xf6], di
xor ax, 0x77
mov word [rbp + 0xf8], r11w
mov word [rbp + 0xfa], si
mov word [rbp + 0xfc], ax
movzx eax, word [0x14001e3fe]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0xfe], ax
movzx eax, word [str.fiddler.exe]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x100], ax
movzx eax, word [0x14001e402]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x102], ax
movzx eax, word [0x14001e404]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x104], ax
movzx eax, word [0x14001e406]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x106], ax
movzx eax, word [0x14001e408]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x108], ax
movzx eax, word [0x14001e40a]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x10a], ax
movzx eax, word [0x14001e40c]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x10c], ax
movzx eax, word [0x14001e40e]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x10e], ax
lea rcx, [rbp + 0x114]
movzx eax, word [0x14001e410]
mov r10d, 0x1b
add ax, 0x11
mov edx, r10d
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x110], ax
movzx eax, word [0x14001e412]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x112], ax
movzx eax, word [0x14001e414]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x114], ax
xor eax, eax
mov word [rbp + 0x116], ax
movzx eax, word [rbp + 0xe0]
nop dword [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx - 2]
xor ax, 0x77
add ax, 0x33
xor ax, 0x33
sub ax, 0x11
mov word [rcx + 2], ax
sub rdx, 1
jne 0x140002c30
mov word [rbp + 0x116], r12w
lea rax, [rbp + 0xe0]
mov qword [rbp + 0x230], rax
mov eax, 0x66
mov word [rbp - 0x20], ax
mov eax, 0x61
mov word [rbp - 0x1e], ax
mov eax, 0x64
mov word [rbp - 0x1c], ax
mov word [rbp - 0x1a], ax
mov eax, 0x6c
mov word [rbp - 0x18], ax
movzx eax, word [str.vmware.exe]
add ax, 0x11
mov word [rbp - 0x16], r11w
xor ax, 0x33
mov word [rbp - 0x14], r13w
sub ax, 0x33
mov word [rbp - 0x12], bx
xor ax, 0x77
mov word [rbp - 0x10], r11w
mov word [rbp - 0xe], di
mov word [rbp - 0xc], r11w
mov word [rbp - 0xa], si
mov word [rbp - 8], ax
movzx eax, word [0x14001e41a]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp - 6], ax
movzx eax, word [0x14001e41c]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp - 4], ax
movzx eax, word [0x14001e41e]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp - 2], ax
movzx eax, word [0x14001e420]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp], ax
movzx eax, word [0x14001e422]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 2], ax
movzx eax, word [0x14001e424]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 4], ax
movzx eax, word [0x14001e426]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 6], ax
movzx eax, word [0x14001e428]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 8], ax
movzx eax, word [0x14001e42a]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0xa], ax
movzx eax, word [0x14001e42c]
add ax, 0x11
xor ax, 0x33
lea rcx, [rbp + 0xc]
sub ax, 0x33
mov rdx, r9
xor ax, 0x77
mov word [rbp + 0xc], ax
xor eax, eax
mov word [rbp + 0xe], ax
movzx eax, word [rbp - 0x20]
nop dword [rax]
movzx eax, word [rcx]
lea rcx, [rcx - 2]
xor ax, 0x77
add ax, 0x33
xor ax, 0x33
sub ax, 0x11
mov word [rcx + 2], ax
sub rdx, 1
jne 0x140002df0
mov word [rbp + 0xe], r12w
lea rax, [rbp - 0x20]
mov qword [rbp + 0x238], rax
lea rcx, [rsp + 0x78]
mov word [rsp + 0x50], r15w
mov eax, 0x6d
mov word [rsp + 0x52], ax
mov eax, 0xff
mov word [rsp + 0x54], ax
mov eax, 0x79
mov word [rsp + 0x56], ax
movzx eax, word [0x14001e42e]
add ax, 0x11
mov word [rsp + 0x58], r13w
xor ax, 0x33
mov word [rsp + 0x5a], r11w
sub ax, 0x33
mov word [rsp + 0x5c], bx
xor ax, 0x77
mov word [rsp + 0x5e], r11w
mov word [rsp + 0x60], di
mov word [rsp + 0x62], r11w
mov word [rsp + 0x64], si
mov word [rsp + 0x66], ax
movzx eax, word [str.VirtualBox.exe]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rsp + 0x68], ax
movzx eax, word [0x14001e432]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rsp + 0x6a], ax
movzx eax, word [0x14001e434]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rsp + 0x6c], ax
movzx eax, word [0x14001e436]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rsp + 0x6e], ax
movzx eax, word [0x14001e438]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rsp + 0x70], ax
movzx eax, word [0x14001e43a]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rsp + 0x72], ax
movzx eax, word [0x14001e43c]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rsp + 0x74], ax
movzx eax, word [0x14001e43e]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rsp + 0x76], ax
movzx eax, word [0x14001e440]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rsp + 0x78], ax
xor eax, eax
mov word [rsp + 0x7a], ax
movzx eax, word [rsp + 0x50]
mov rdx, r8
nop dword [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx - 2]
xor ax, 0x77
add ax, 0x33
xor ax, 0x33
sub ax, 0x11
mov word [rcx + 2], ax
sub rdx, 1
jne 0x140002fa0
mov word [rsp + 0x7a], r12w
lea rax, [rsp + 0x50]
mov qword [rbp + 0x240], rax
mov eax, 0x56
mov word [rbp + 0x150], ax
mov eax, 0x61
mov word [rbp + 0x152], ax
mov eax, 0xf4
mov word [rbp + 0x154], r13w
mov word [rbp + 0x156], ax
mov eax, 0xf5
mov word [rbp + 0x158], ax
mov eax, 0x79
mov word [rbp + 0x15a], ax
mov eax, 0x6c
mov word [rbp + 0x15c], ax
mov eax, 0x5a
mov word [rbp + 0x15e], ax
mov eax, 0xf7
mov word [rbp + 0x160], ax
movzx eax, word [0x14001e44e]
add ax, 0x11
mov word [rbp + 0x162], di
xor ax, 0x33
mov word [rbp + 0x164], bx
sub ax, 0x33
mov word [rbp + 0x166], r11w
xor ax, 0x77
mov word [rbp + 0x168], di
mov word [rbp + 0x16a], r11w
mov word [rbp + 0x16c], si
mov word [rbp + 0x16e], ax
movzx eax, word [str.procexp.exe]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x170], ax
movzx eax, word [0x14001e452]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x172], ax
movzx eax, word [0x14001e454]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x174], ax
movzx eax, word [0x14001e456]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x176], ax
movzx eax, word [0x14001e458]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x178], ax
movzx eax, word [0x14001e45a]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x17a], ax
movzx eax, word [0x14001e45c]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x17c], ax
movzx eax, word [0x14001e45e]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x17e], ax
movzx eax, word [0x14001e460]
add ax, 0x11
lea rcx, [rbp + 0x188]
xor ax, 0x33
mov edx, 0x1d
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x180], ax
movzx eax, word [0x14001e462]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x182], ax
movzx eax, word [0x14001e464]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x184], ax
movzx eax, word [0x14001e466]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x186], ax
movzx eax, word [str.autoit.exe]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x188], ax
xor eax, eax
mov word [rbp + 0x18a], ax
movzx eax, word [rbp + 0x150]
nop word [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx - 2]
xor ax, 0x77
add ax, 0x33
xor ax, 0x33
sub ax, 0x11
mov word [rcx + 2], ax
sub rdx, 1
jne 0x140003230
mov word [rbp + 0x18a], r12w
lea rax, [rbp + 0x150]
mov qword [rbp + 0x248], rax
mov eax, 0xf7
mov word [rbp + 0x10], r14w
mov word [rbp + 0x12], r13w
mov word [rbp + 0x14], ax
mov eax, 0x63
mov word [rbp + 0x16], ax
movzx eax, word [str.autoit.exe]
add ax, 0x11
mov word [rbp + 0x18], r11w
xor ax, 0x33
mov word [rbp + 0x1a], di
sub ax, 0x33
mov word [rbp + 0x1c], r14w
xor ax, 0x77
mov word [rbp + 0x1e], bx
mov word [rbp + 0x20], r11w
mov word [rbp + 0x22], di
mov word [rbp + 0x24], r11w
mov word [rbp + 0x26], si
mov word [rbp + 0x28], ax
movzx eax, word [0x14001e46a]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x2a], ax
movzx eax, word [0x14001e46c]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x2c], ax
movzx eax, word [0x14001e46e]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x2e], ax
movzx eax, word [0x14001e470]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x30], ax
movzx eax, word [0x14001e472]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x32], ax
movzx eax, word [0x14001e474]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x34], ax
movzx eax, word [0x14001e476]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x36], ax
movzx eax, word [0x14001e478]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x38], ax
movzx eax, word [0x14001e47a]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x3a], ax
movzx eax, word [0x14001e47c]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
lea rcx, [rbp + 0x3c]
mov word [rbp + 0x3c], ax
mov rdx, r9
xor eax, eax
mov word [rbp + 0x3e], ax
movzx eax, word [rbp + 0x10]
movzx eax, word [rcx]
lea rcx, [rcx - 2]
xor ax, 0x77
add ax, 0x33
xor ax, 0x33
sub ax, 0x11
mov word [rcx + 2], ax
sub rdx, 1
jne 0x1400033e1
mov word [rbp + 0x3e], r12w
lea rax, [rbp + 0x10]
mov qword [rbp + 0x250], rax
mov edx, 0xf4
mov eax, 0x79
mov r14d, 0xf7
mov word [rbp - 0x80], ax
mov eax, 0xf5
mov word [rbp - 0x7e], ax
mov eax, 0x61
mov word [rbp - 0x7c], dx
mov word [rbp - 0x7a], r14w
mov word [rbp - 0x78], ax
movzx eax, word [0x14001e47e]
add ax, 0x11
mov word [rbp - 0x76], dx
xor ax, 0x33
mov word [rbp - 0x74], bx
sub ax, 0x33
mov word [rbp - 0x72], r11w
xor ax, 0x77
mov word [rbp - 0x70], di
mov word [rbp - 0x6e], r11w
mov word [rbp - 0x6c], si
mov word [rbp - 0x6a], ax
movzx eax, word [str.vboxtray.exe]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp - 0x68], ax
movzx eax, word [0x14001e482]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp - 0x66], ax
movzx eax, word [0x14001e484]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp - 0x64], ax
movzx eax, word [0x14001e486]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp - 0x62], ax
movzx eax, word [0x14001e488]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp - 0x60], ax
movzx eax, word [0x14001e48a]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp - 0x5e], ax
movzx eax, word [0x14001e48c]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp - 0x5c], ax
movzx eax, word [0x14001e48e]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp - 0x5a], ax
movzx eax, word [0x14001e490]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp - 0x58], ax
xor eax, eax
mov word [rbp - 0x56], ax
movzx eax, word [rbp - 0x80]
lea rcx, [rbp - 0x58]
nop word [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx - 2]
xor ax, 0x77
add ax, 0x33
xor ax, 0x33
sub ax, 0x11
mov word [rcx + 2], ax
sub r8, 1
jne 0x140003580
mov word [rbp - 0x56], r12w
lea rax, [rbp - 0x80]
mov qword [rbp + 0x258], rax
mov eax, 0x7a
mov word [rbp + 0x70], r15w
mov word [rbp + 0x72], ax
mov eax, 0x79
mov word [rbp + 0x74], r14w
mov r14d, 0xf1
mov word [rbp + 0x76], di
mov word [rbp + 0x78], dx
mov word [rbp + 0x7a], r13w
mov word [rbp + 0x7c], ax
movzx eax, word [0x14001e49a]
add ax, 0x11
mov word [rbp + 0x7e], r14w
xor ax, 0x33
mov word [rbp + 0x80], bx
sub ax, 0x33
mov word [rbp + 0x82], r11w
xor ax, 0x77
mov word [rbp + 0x84], di
mov word [rbp + 0x86], r11w
mov word [rbp + 0x88], si
mov word [rbp + 0x8a], ax
movzx eax, word [0x14001e49c]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x8c], ax
movzx eax, word [0x14001e49e]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x8e], ax
movzx eax, word [str.vmtoolsd.exe]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x90], ax
movzx eax, word [0x14001e4a2]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x92], ax
movzx eax, word [0x14001e4a4]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x94], ax
movzx eax, word [0x14001e4a6]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x96], ax
movzx eax, word [0x14001e4a8]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x98], ax
movzx eax, word [0x14001e4aa]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x9a], ax
movzx eax, word [0x14001e4ac]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x9c], ax
movzx eax, word [0x14001e4ae]
add ax, 0x11
xor ax, 0x33
lea rcx, [rbp + 0xa0]
sub ax, 0x33
mov edx, 0x19
xor ax, 0x77
mov r8d, edx
mov word [rbp + 0x9e], ax
movzx eax, word [0x14001e4b0]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0xa0], ax
xor eax, eax
mov word [rbp + 0xa2], ax
movzx eax, word [rbp + 0x70]
nop
movzx eax, word [rcx]
lea rcx, [rcx - 2]
xor ax, 0x77
add ax, 0x33
xor ax, 0x33
sub ax, 0x11
mov word [rcx + 2], ax
sub r8, 1
jne 0x140003790
mov word [rbp + 0xa2], r12w
lea rax, [rbp + 0x70]
mov qword [rbp + 0x260], rax
mov r8d, 0xf7
mov word [rbp + 0xa8], r15w
mov eax, 0x6d
mov word [rbp + 0xaa], ax
mov eax, 0xf4
mov word [rbp + 0xac], ax
mov eax, 0x6c
mov word [rbp + 0xae], r8w
mov word [rbp + 0xb0], r8w
mov word [rbp + 0xb2], ax
mov eax, 0xf3
mov word [rbp + 0xb4], ax
mov eax, 0x64
mov word [rbp + 0xb6], ax
movzx eax, word [0x14001e4ba]
add ax, 0x11
mov word [rbp + 0xb8], bx
xor ax, 0x33
mov word [rbp + 0xba], r11w
sub ax, 0x33
mov word [rbp + 0xbc], di
xor ax, 0x77
mov word [rbp + 0xbe], r11w
mov word [rbp + 0xc0], si
mov word [rbp + 0xc2], ax
movzx eax, word [0x14001e4bc]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0xc4], ax
movzx eax, word [0x14001e4be]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0xc6], ax
movzx eax, word [str.vmrawdsk.sys.]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0xc8], ax
movzx eax, word [0x14001e4c2]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0xca], ax
movzx eax, word [0x14001e4c4]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0xcc], ax
movzx eax, word [0x14001e4c6]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0xce], ax
movzx eax, word [0x14001e4c8]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0xd0], ax
movzx eax, word [0x14001e4ca]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0xd2], ax
movzx eax, word [0x14001e4cc]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0xd4], ax
lea rcx, [rbp + 0xd8]
movzx eax, word [0x14001e4ce]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0xd6], ax
movzx eax, word [0x14001e4d0]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0xd8], ax
xor eax, eax
mov word [rbp + 0xda], ax
movzx eax, word [rbp + 0xa8]
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx - 2]
xor ax, 0x77
add ax, 0x33
xor ax, 0x33
sub ax, 0x11
mov word [rcx + 2], ax
sub rdx, 1
jne 0x1400039d0
mov word [rbp + 0xda], r12w
lea rax, [rbp + 0xa8]
mov qword [rbp + 0x268], rax
mov edx, 0xf3
mov word [rbp + 0x118], r15w
mov eax, 0x6d
mov word [rbp + 0x11a], ax
mov eax, 0x79
mov word [rbp + 0x11c], r13w
mov word [rbp + 0x11e], ax
mov eax, 0xff
mov word [rbp + 0x120], ax
mov eax, 0x64
mov word [rbp + 0x122], ax
mov eax, 0x6b
mov word [rbp + 0x124], dx
mov word [rbp + 0x126], ax
movzx eax, word [0x14001e4dc]
add ax, 0x11
mov word [rbp + 0x128], bx
xor ax, 0x33
mov word [rbp + 0x12a], dx
sub ax, 0x33
mov word [rbp + 0x12c], r14w
xor ax, 0x77
mov word [rbp + 0x12e], dx
mov word [rbp + 0x130], bx
mov word [rbp + 0x132], si
mov word [rbp + 0x134], ax
movzx eax, word [0x14001e4de]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x136], ax
movzx eax, word [str.vmusbmouse.sys.]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x138], ax
movzx eax, word [0x14001e4e2]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x13a], ax
movzx eax, word [0x14001e4e4]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x13c], ax
movzx eax, word [0x14001e4e6]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x13e], ax
movzx eax, word [0x14001e4e8]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x140], ax
movzx eax, word [0x14001e4ea]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x142], ax
movzx eax, word [0x14001e4ec]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x144], ax
movzx eax, word [0x14001e4ee]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
lea rcx, [rbp + 0x14c]
mov word [rbp + 0x146], ax
movzx eax, word [0x14001e4f0]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x148], ax
movzx eax, word [0x14001e4f2]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x14a], ax
movzx eax, word [0x14001e4f4]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x14c], ax
xor eax, eax
mov word [rbp + 0x14e], ax
movzx eax, word [rbp + 0x118]
nop word [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx - 2]
xor ax, 0x77
add ax, 0x33
xor ax, 0x33
sub ax, 0x11
mov word [rcx + 2], ax
sub r10, 1
jne 0x140003c30
mov word [rbp + 0x14e], r12w
lea rax, [rbp + 0x118]
mov qword [rbp + 0x270], rax
mov ecx, 0x6d
mov word [rbp + 0x190], r15w
mov eax, 0xf5
mov word [rbp + 0x192], cx
mov r10d, 0x7a
mov word [rbp + 0x194], ax
mov word [rbp + 0x196], dx
mov word [rbp + 0x198], r10w
mov word [rbp + 0x19a], cx
mov word [rbp + 0x19c], r8w
mov word [rbp + 0x19e], ax
movzx eax, word [str.df5serv.exe]
add ax, 0x11
mov word [rbp + 0x1a0], dx
xor ax, 0x33
mov word [rbp + 0x1a2], r11w
sub ax, 0x33
mov word [rbp + 0x1a4], bx
xor ax, 0x77
mov word [rbp + 0x1a6], dx
mov word [rbp + 0x1a8], r14w
mov word [rbp + 0x1aa], dx
mov word [rbp + 0x1ac], bx
mov word [rbp + 0x1ae], si
mov word [rbp + 0x1b0], ax
movzx eax, word [0x14001e502]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x1b2], ax
movzx eax, word [0x14001e504]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x1b4], ax
movzx eax, word [0x14001e506]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x1b6], ax
movzx eax, word [0x14001e508]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x1b8], ax
movzx eax, word [0x14001e50a]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x1ba], ax
movzx eax, word [0x14001e50c]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x1bc], ax
movzx eax, word [0x14001e50e]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x1be], ax
movzx eax, word [0x14001e510]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x1c0], ax
movzx eax, word [0x14001e512]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x1c2], ax
lea rcx, [rbp + 0x1cc]
movzx eax, word [0x14001e514]
mov edx, 0x1f
add ax, 0x11
mov r8d, edx
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x1c4], ax
movzx eax, word [0x14001e516]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x1c6], ax
movzx eax, word [str.vboxservice.exe]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x1c8], ax
movzx eax, word [0x14001e51a]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x1ca], ax
movzx eax, word [0x14001e51c]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x1cc], ax
xor eax, eax
mov word [rbp + 0x1ce], ax
movzx eax, word [rbp + 0x190]
nop dword [rax]
movzx eax, word [rcx]
lea rcx, [rcx - 2]
xor ax, 0x77
add ax, 0x33
xor ax, 0x33
sub ax, 0x11
mov word [rcx + 2], ax
sub r8, 1
jne 0x140003ed0
mov word [rbp + 0x1ce], r12w
lea rax, [rbp + 0x190]
mov qword [rbp + 0x278], rax
mov r8d, 0xf3
mov eax, 0x64
mov word [rbp + 0x40], ax
mov eax, 0x66
mov word [rbp + 0x42], ax
mov eax, 0x35
mov word [rbp + 0x44], ax
movzx eax, word [str.vboxservice.exe]
add ax, 0x11
mov word [rbp + 0x46], r8w
xor ax, 0x33
mov word [rbp + 0x48], r11w
sub ax, 0x33
mov word [rbp + 0x4a], r13w
xor ax, 0x77
mov word [rbp + 0x4c], r15w
mov word [rbp + 0x4e], bx
mov word [rbp + 0x50], r11w
mov word [rbp + 0x52], di
mov word [rbp + 0x54], r11w
mov word [rbp + 0x56], si
mov word [rbp + 0x58], ax
movzx eax, word [0x14001e51a]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x5a], ax
movzx eax, word [0x14001e51c]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x5c], ax
movzx eax, word [0x14001e51e]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x5e], ax
movzx eax, word [0x14001e520]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x60], ax
movzx eax, word [0x14001e522]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x62], ax
movzx eax, word [0x14001e524]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x64], ax
movzx eax, word [0x14001e526]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x66], ax
movzx eax, word [0x14001e528]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x68], ax
movzx eax, word [0x14001e52a]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x6a], ax
movzx eax, word [0x14001e52c]
add ax, 0x11
xor ax, 0x33
lea rcx, [rbp + 0x6c]
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x6c], ax
xor eax, eax
mov word [rbp + 0x6e], ax
movzx eax, word [rbp + 0x40]
nop dword [rax]
movzx eax, word [rcx]
lea rcx, [rcx - 2]
xor ax, 0x77
add ax, 0x33
xor ax, 0x33
sub ax, 0x11
mov word [rcx + 2], ax
sub r9, 1
jne 0x140004090
mov word [rbp + 0x6e], r12w
lea rax, [rbp + 0x40]
mov qword [rbp + 0x280], rax
mov eax, 0xf7
mov word [rbp + 0x1d0], r15w
mov word [rbp + 0x1d2], r10w
mov word [rbp + 0x1d4], ax
mov eax, 0x61
mov word [rbp + 0x1d6], di
mov word [rbp + 0x1d8], r8w
mov word [rbp + 0x1da], r11w
mov word [rbp + 0x1dc], r13w
mov word [rbp + 0x1de], r15w
mov word [rbp + 0x1e0], ax
mov eax, 0x63
mov word [rbp + 0x1e2], ax
movzx eax, word [0x14001e538]
add ax, 0x11
mov word [rbp + 0x1e4], r11w
xor ax, 0x33
mov word [rbp + 0x1e6], bx
sub ax, 0x33
mov word [rbp + 0x1e8], r11w
xor ax, 0x77
mov word [rbp + 0x1ea], di
mov word [rbp + 0x1ec], r11w
mov word [rbp + 0x1ee], si
mov word [rbp + 0x1f0], ax
movzx eax, word [0x14001e53a]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x1f2], ax
movzx eax, word [0x14001e53c]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x1f4], ax
movzx eax, word [0x14001e53e]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x1f6], ax
movzx eax, word [0x14001e540]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x1f8], ax
movzx eax, word [0x14001e542]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x1fa], ax
movzx eax, word [0x14001e544]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x1fc], ax
movzx eax, word [0x14001e546]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x1fe], ax
movzx eax, word [0x14001e548]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x200], ax
movzx eax, word [0x14001e54a]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x202], ax
lea rcx, [rbp + 0x20c]
movzx eax, word [0x14001e54c]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x204], ax
movzx eax, word [0x14001e54e]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x206], ax
movzx eax, word [0x14001e550]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x208], ax
movzx eax, word [0x14001e552]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x20a], ax
movzx eax, word [0x14001e554]
add ax, 0x11
xor ax, 0x33
sub ax, 0x33
xor ax, 0x77
mov word [rbp + 0x20c], ax
xor eax, eax
mov word [rbp + 0x20e], ax
movzx eax, word [rbp + 0x1d0]
nop dword [rax]
nop word [rax + rax]
movzx eax, word [rcx]
lea rcx, [rcx - 2]
xor ax, 0x77
add ax, 0x33
xor ax, 0x33
sub ax, 0x11
mov word [rcx + 2], ax
sub rdx, 1
jne 0x140004330
lea rax, [rbp + 0x1d0]
mov word [rbp + 0x20e], r12w
lea r8, [rbp + 0x218]
mov qword [rbp + 0x288], rax
mov edx, 0x1000
lea rcx, [rbp + 0x290]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x140004462
mov r13d, dword [rbp + 0x218]
mov r14d, r12d
shr r13d, 2
test r13d, r13d
je 0x14000445f
lea r15, [rbp + 0x290]
nop word [rax + rax]
mov r8d, dword [r15]
test r8d, r8d
je 0x140004447
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
je 0x140004447
lea r9, [rbp + 0x218]
mov r8d, 8
lea rdx, [rbp + 0x210]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x14000443e
mov rdx, qword [rbp + 0x210]
lea r8, [rbp + 0x1290]
mov r9d, 0x104
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameW]
test eax, eax
je 0x14000443e
mov ebx, r12d
lea rdi, [rbp + 0x220]
nop dword [rax]
mov rdx, qword [rdi]
lea rcx, [rbp + 0x1290]
call fcn.140006aa4
test eax, eax
je 0x140004459
inc ebx
add rdi, 8
cmp ebx, 0xe
jb 0x140004420
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
inc r14d
add r15, 4
cmp r14d, r13d
jb 0x1400043b0
jmp 0x14000445f
mov r12d, 1
mov eax, r12d
mov rcx, qword [rbp + 0x14a0]
xor rcx, rsp
call fcn.140004b50
lea r11, [rsp + 0x15b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret