Function at 0x14001b2a0
Capabilities:
Encode data using xor
Enumerate processes
Hash data using fnv

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x202d0]
mov eax, 0x203d0
call fcn.140075160
sub rsp, rax
mov rax, qword [0x1400d0400]
xor rax, rsp
mov qword [rbp + 0x202c0], rax
mov rsi, rcx
mov qword [rbp - 0x78], rcx
mov qword [rbp - 0x58], rcx
xor edi, edi
mov dword [rsp + 0x30], edi
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x40], rdi
mov ecx, 0x48
call fcn.140074c98
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x48], rdi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], 7
mov qword [rsp + 0x68], 8
mov dword [rsp + 0x30], 0x3f800000
mov r8, rax
mov edx, 0x10
lea rcx, [rsp + 0x48]
call fcn.14001a970
nop
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r12, rax
mov qword [rbp - 0x50], rax
cmp rax, 0xffffffffffffffff
jne 0x14001b406
mov rcx, rsi
call fcn.1400195b0
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x14001b3be
mov rdx, qword [rsp + 0x58]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b3ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bc99
call fcn.140074cd4
mov qword [rsp + 0x48], rdi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x50], xmm0
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + 8]
mov qword [rax], rdi
mov rdi, qword [rcx]
test rdi, rdi
je 0x14001bc51
nop word [rax + rax]
mov rbx, qword [rdi]
lea rcx, [rdi + 0x10]
call fcn.140019f60
mov edx, 0x48
mov rcx, rdi
call fcn.140074cd4
mov rdi, rbx
test rbx, rbx
jne 0x14001b3e0
jmp 0x14001bc51
mov dword [rbp], 0x238
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
mov dword [rsp + 0x20], eax
lea rdx, [rbp]
mov rcx, r12
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14001baf7
nop dword [rax]
mov r8d, dword [rbp + 8]
cmp r8d, ebx
je 0x14001badf
xor edx, edx
mov ecx, 0x43a
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
mov qword [rbp - 0x48], rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x14001bac9
mov dword [rsp + 0x70], 0xffff
lea r9, [rsp + 0x70]
lea r8, [rbp + 0x2c0]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_QueryFullProcessImageNameW]
lea rdx, [rbp + 0x2c0]
lea rcx, [rbp + 0x240]
call fcn.140019460
nop
lea rdx, [rbp + 0x240]
lea rcx, [rbp - 0x20]
call fcn.14000a290
mov rdi, rax
mov qword [rsp + 0x78], rax
mov rsi, rax
cmp qword [rax + 0x18], 7
jbe 0x14001b4c1
mov rsi, qword [rax]
mov rcx, qword [rax + 0x10]
lea r14, [rsi + rcx*2]
jmp 0x14001b4ce
mov rax, qword [rax + 0x10]
lea r14, [rdi + rax*2]
mov rbx, rdi
jbe 0x14001b4d1
mov rbx, qword [rdi]
cmp rbx, r14
je 0x14001b4f5
sub rsi, rbx
nop dword [rax]
movzx ecx, word [rbx]
call fcn.1400869d4
mov word [rsi + rbx], ax
add rbx, 2
cmp rbx, r14
jne 0x14001b4e0
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0x260], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 0x270], xmm1
xor esi, esi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 7
mov word [rdi], si
lea r11, [rbp + 0x260]
movq r14, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq r15, xmm0
cmp r15, 7
cmova r11, r14
movq rbx, xmm1
cmp rbx, 0xa
jb 0x14001b5d8
lea r10, [rbx - 9]
lea r10, [r11 + r10*2]
mov rcx, r11
nop word [rax + rax]
mov rax, r10
sub rax, rcx
sar rax, 1
mov rdx, rsi
je 0x14001b58a
cmp word [rcx], 0x3a
je 0x14001b587
cmp rax, 1
je 0x14001b58a
dec rax
add rcx, 2
cmp word [rcx], 0x3a
jne 0x14001b574
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x14001b5d8
mov r8d, 0xa
lea rax, str.:windows_
mov rdx, rax
mov r9, rcx
sub r9, rax
nop dword [rax + rax]
movzx eax, word [rdx + r9]
cmp ax, word [rdx]
jne 0x14001b7cb
add rdx, 2
sub r8, 1
jne 0x14001b5b0
sub rcx, r11
sar rcx, 1
cmp rcx, 0xffffffffffffffff
jne 0x14001b718
lea r10, [rbp + 0x260]
cmp r15, 7
cmova r10, r14
cmp rbx, 0xa
jb 0x14001b678
lea r11, [rbx - 9]
lea r11, [r10 + r11*2]
mov rcx, r10
nop dword [rax]
mov rax, r11
sub rax, rcx
sar rax, 1
mov rdx, rsi
je 0x14001b62a
cmp word [rcx], 0x5c
je 0x14001b627
cmp rax, 1
je 0x14001b62a
dec rax
add rcx, 2
cmp word [rcx], 0x5c
jne 0x14001b614
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x14001b678
mov r8d, 0xa
lea rax, str.microsoft
mov rdx, rax
mov r9, rcx
sub r9, rax
nop dword [rax + rax]
movzx eax, word [rdx + r9]
cmp ax, word [rdx]
jne 0x14001b7d4
add rdx, 2
sub r8, 1
jne 0x14001b650
sub rcx, r10
sar rcx, 1
cmp rcx, 0xffffffffffffffff
jne 0x14001b718
lea r10, [rbp + 0x260]
cmp r15, 7
cmova r10, r14
cmp rbx, 0xc
jb 0x14001b7e6
lea r11, [rbx - 0xb]
lea r11, [r10 + r11*2]
mov rcx, r10
nop dword [rax]
mov rax, r11
sub rax, rcx
sar rax, 1
mov rdx, rsi
je 0x14001b6ca
cmp word [rcx], 0x5c
je 0x14001b6c7
cmp rax, 1
je 0x14001b6ca
dec rax
add rcx, 2
cmp word [rcx], 0x5c
jne 0x14001b6b4
mov rdx, rcx
mov rcx, rdx
test rdx, rdx
je 0x14001b7e6
mov r8d, 0xc
lea rax, str.windowsapps
mov rdx, rax
mov r9, rcx
sub r9, rax
nop dword [rax]
movzx eax, word [rdx + r9]
cmp ax, word [rdx]
jne 0x14001b7dd
add rdx, 2
sub r8, 1
jne 0x14001b6f0
sub rcx, r10
sar rcx, 1
cmp rcx, 0xffffffffffffffff
je 0x14001b7e6
cmp r15, 7
jbe 0x14001b754
lea rdx, [r15*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x14001b74b
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bcab
mov rcx, r14
call fcn.140074cd4
nop
mov rdx, qword [rbp + 0x258]
cmp rdx, 7
jbe 0x14001b79a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b795
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bc93
call fcn.140074cd4
mov qword [rbp + 0x250], rsi
mov qword [rbp + 0x258], 7
mov word [rbp + 0x240], si
mov rcx, r13
mov rax, qword [0x1400a7b70]
call rax
nop
mov ebx, dword [rsp + 0x20]
xor edi, edi
jmp 0x14001badf
add rcx, 2
jmp 0x14001b560
add rcx, 2
jmp 0x14001b600
add rcx, 2
jmp 0x14001b6a0
lea r8, [rbp + 0x240]
mov rbx, qword [rbp + 0x240]
mov rdi, qword [rbp + 0x258]
cmp rdi, 7
cmova r8, rbx
movabs rdx, 0xcbf29ce484222325
mov r10, qword [rbp + 0x250]
lea r9, [r10 + r10]
mov rcx, rsi
test r9, r9
je 0x14001b84b
movabs rdi, 0x100000001b3
nop word [rax + rax]
movzx eax, byte [r8 + rcx]
xor rdx, rax
imul rdx, rdi
inc rcx
cmp rcx, r9
jb 0x14001b830
mov rdi, qword [rbp + 0x258]
mov rax, qword [rsp + 0x60]
and rax, rdx
add rax, rax
mov rcx, qword [rsp + 0x48]
mov r9, qword [rcx + rax*8 + 8]
mov rsi, qword [rsp + 0x38]
cmp r9, rsi
je 0x14001b8c2
mov r11, qword [rcx + rax*8]
nop
lea rcx, [r9 + 0x10]
mov rax, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 7
jbe 0x14001b882
mov rcx, qword [rcx]
lea r8, [rbp + 0x240]
cmp rdi, 7
cmova r8, rbx
cmp r10, rax
jne 0x14001b8b7
mov rdx, r10
test r10, r10
je 0x14001b8c7
sub r8, rcx
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x14001b8b7
add rcx, 2
sub rdx, 1
jne 0x14001b8a1
jmp 0x14001b8c7
cmp r9, r11
je 0x14001b8c2
mov r9, qword [r9 + 8]
jmp 0x14001b870
xor edi, edi
mov r9d, edi
mov rax, rsi
test r9, r9
cmovne rax, r9
cmp rax, rsi
jne 0x14001b9d6
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x70], xmm0
xor esi, esi
mov qword [rbp - 0x60], rsi
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x280]
call fcn.14000a290
nop
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x2a0]
call fcn.140019630
nop
lea r8, [rbp + 0x280]
lea rdx, [rbp - 0x40]
lea rcx, [rsp + 0x30]
call fcn.140019120
nop
mov rcx, qword [rbp + 0x2a0]
test rcx, rcx
je 0x14001b981
mov rax, qword [rbp + 0x2b0]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b96a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bc9f
call fcn.140074cd4
mov qword [rbp + 0x2a0], rsi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2a8], xmm0
lea rcx, [rbp + 0x280]
call fcn.14000b6f0
nop
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x14001b9d8
mov rax, qword [rbp - 0x60]
sub rax, rcx
sar rax, 2
lea rdx, [rax*4]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b9cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bca5
call fcn.140074cd4
jmp 0x14001b9d8
xor esi, esi
lea r8, [rbp + 0x240]
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x30]
call fcn.140018bf0
mov rcx, qword [rax]
add rcx, 0x30
mov eax, dword [rbp + 8]
mov dword [rsp + 0x78], eax
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x14001ba0e
mov dword [rdx], eax
add qword [rcx + 8], 4
jmp 0x14001ba19
lea r8, [rsp + 0x78]
call fcn.140018980
nop
cmp r15, 7
jbe 0x14001ba55
lea rdx, [r15*2 + 2]
mov rax, r14
cmp rdx, 0x1000
jb 0x14001ba4c
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bcab
mov rcx, r14
call fcn.140074cd4
nop
mov rdx, qword [rbp + 0x258]
cmp rdx, 7
jbe 0x14001ba9b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ba96
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bc93
call fcn.140074cd4
mov qword [rbp + 0x250], rsi
mov qword [rbp + 0x258], 7
mov word [rbp + 0x240], si
mov rcx, r13
mov rax, qword [0x1400a7b70]
call rax
nop
mov ebx, dword [rsp + 0x20]
xor edi, edi
jmp 0x14001badf
dec rax
cmp rax, 0xfffffffffffffffd
ja 0x14001badf
mov rcx, r13
mov rax, qword [0x1400a7b70]
call rax
nop
lea rdx, [rbp]
mov rcx, r12
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14001b430
mov rsi, qword [rbp - 0x78]
mov eax, dword [rsp + 0x30]
mov dword [rsi], eax
mov qword [rsi + 8], rdi
mov qword [rsi + 0x10], rdi
mov ecx, 0x48
call fcn.140074c98
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsi + 8], rax
mov qword [rsi + 0x18], rdi
mov qword [rsi + 0x20], rdi
mov qword [rsi + 0x28], rdi
mov r8, qword [rsi + 8]
mov edx, 0x10
lea rcx, [rsi + 0x18]
call fcn.14001a970
mov rcx, qword [rsi + 8]
mov rax, qword [rsp + 0x38]
mov qword [rsi + 8], rax
mov qword [rsp + 0x38], rcx
mov rcx, qword [rsi + 0x10]
mov rax, qword [rsp + 0x40]
mov qword [rsi + 0x10], rax
mov qword [rsp + 0x40], rcx
mov r8, qword [rsi + 0x18]
mov rax, qword [rsp + 0x48]
mov qword [rsi + 0x18], rax
mov qword [rsp + 0x48], r8
mov rcx, qword [rsi + 0x20]
mov rax, qword [rsp + 0x50]
mov qword [rsi + 0x20], rax
mov qword [rsp + 0x50], rcx
mov rdx, qword [rsi + 0x28]
mov rax, qword [rsp + 0x58]
mov qword [rsi + 0x28], rax
mov qword [rsp + 0x58], rdx
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x60], 7
mov qword [rsi + 0x30], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x68], 8
mov qword [rsi + 0x38], rax
test r12, r12
je 0x14001bbd1
mov rcx, r12
mov rax, qword [0x1400a7b70]
call rax
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x48]
test r8, r8
je 0x14001bc18
sub rdx, r8
and rdx, 0xfffffffffffffff8
mov rax, r8
cmp rdx, 0x1000
jb 0x14001bc02
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001bc99
mov rcx, r8
call fcn.140074cd4
mov qword [rsp + 0x48], rdi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x50], xmm0
mov rcx, qword [rsp + 0x38]
mov rax, qword [rcx + 8]
mov qword [rax], rdi
mov rdi, qword [rcx]
test rdi, rdi
je 0x14001bc51
nop dword [rax]
mov rbx, qword [rdi]
lea rcx, [rdi + 0x10]
call fcn.140019f60
mov edx, 0x48
mov rcx, rdi
call fcn.140074cd4
mov rdi, rbx
test rbx, rbx
jne 0x14001bc30
mov edx, 0x48
mov rcx, qword [rsp + 0x38]
call fcn.140074cd4
mov rax, rsi
mov rcx, qword [rbp + 0x202c0]
xor rcx, rsp
call fcn.140074df0
lea r11, [rsp + 0x203d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14007b518
nop
call fcn.14007b518
nop
call fcn.14007b518
nop
call fcn.14007b518
nop
call fcn.14007b518
int3