Function at 0x140001260
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0xa0]
sub rsp, 0x1a0
mov rax, qword [0x140055010]
xor rax, rsp
mov qword [rbp + 0x90], rax
cmp byte [0x140055050], 1
jne 0x140001918
mov rax, qword [0x1400869e8]
mov dword [rax + 0x4114], 0x439b0000
mov dword [rax + 0x4118], 0x43be0000
mov dword [rax + 0x40f8], 1
or dword [rax + 0x40f0], 0x42
mov dword [rax + 0x4150], 0x3f800000
mov cl, 0x5e
mov dword [rsp + 0x20], 0x33702a5e
mov dword [rsp + 0x24], 0x6f1a713b
mov dword [rsp + 0x28], 0x31293c2d
mov word [rsp + 0x2c], 0x352c
xor eax, eax
mov byte [rsp + 0x2e], al
xor r14d, r14d
xor byte [rsp + rax + 0x21], cl
inc rax
cmp rax, 0xd
jae 0x140001315
movzx ecx, byte [rsp + 0x20]
jmp 0x140001301
mov byte [rsp + 0x2e], r14b
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x48], r14
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], r14b
lea rax, [rsp + 0x21]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], r14b
jne 0x140001340
lea rdx, [rsp + 0x21]
lea rcx, [rsp + 0x38]
call fcn.1400019b0
nop
lea rcx, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rcx, qword [rsp + 0x38]
mov r8d, 0x128
lea rdx, [0x140055050]
call fcn.140010fc0
mov cl, 5
mov dword [rsp + 0x20], 0x28414d05
mov dword [rsp + 0x24], 0x7c646955
mov dword [rsp + 0x28], 0x602b7760
mov word [rsp + 0x2c], 0x607d
xor eax, eax
mov byte [rsp + 0x2e], al
mov rax, r14
nop word [rax + rax]
xor byte [rsp + rax + 0x21], cl
inc rax
cmp rax, 0xd
jae 0x1400013c4
movzx ecx, byte [rsp + 0x20]
jmp 0x1400013b0
mov byte [rsp + 0x2e], 0
mov edi, r14d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140001884
mov dword [rsp + 0x60], 0x130
lea rdx, [rsp + 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140001425
lea rdx, [rsp + 0x21]
lea rcx, [rbp - 0x74]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140001421
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
jmp 0x1400013fa
mov edi, dword [rsp + 0x68]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x140086a1c], edi
test edi, edi
setne byte [0x140086a18]
test edi, edi
je 0x14000189f
movdqa xmm0, xmmword [0x14004dd50]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x26273621
mov word [rsp + 0x34], 0x63
mov rcx, r14
nop word [rax + rax]
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x21], al
inc rcx
cmp rcx, 0x14
jb 0x140001470
mov byte [rsp + 0x35], 0
lea rcx, [rsp + 0x21]
call fcn.14003df10
mov rcx, qword [0x1400869e8]
mov rax, qword [rcx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rcx + 0x3fe0]
cmp byte [rax + 0xd0], 0
jne 0x1400014d1
mov qword [rsp + 0x20], 0
movss xmm1, dword [0x14004dc88]
lea rcx, [rsp + 0x20]
call fcn.1400151c0
mov byte [rsp + 0x20], 0x10
mov al, 0x56
mov cl, 0x65
mov dl, 0x7e
mov r8b, 0x73
mov r9b, 0x64
mov r10b, 0x79
mov r11b, 0x7f
movzx ebx, dl
mov dil, 0x63
mov sil, 0x2a
xor r15d, r15d
xor al, 0x10
mov byte [rsp + 0x21], al
xor cl, 0x10
mov byte [rsp + 0x22], cl
xor dl, 0x10
mov byte [rsp + 0x23], dl
xor r8b, 0x10
mov byte [rsp + 0x24], r8b
xor r9b, 0x10
mov byte [rsp + 0x25], r9b
xor r10b, 0x10
mov byte [rsp + 0x26], r10b
xor r11b, 0x10
mov byte [rsp + 0x27], r11b
xor bl, 0x10
mov byte [rsp + 0x28], bl
xor dil, 0x10
mov byte [rsp + 0x29], dil
xor sil, 0x10
mov byte [rsp + 0x2a], sil
mov byte [rsp + 0x2b], r15b
lea rcx, [rsp + 0x21]
call fcn.14003df10
movdqa xmm0, xmmword [0x14004dd30]
movdqu xmmword [rsp + 0x20], xmm0
mov rcx, r14
nop word [rax + rax]
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x21], al
inc rcx
cmp rcx, 0xe
jb 0x140001570
mov byte [rsp + 0x2f], r15b
lea rdx, [0x140086a20]
lea rcx, [rsp + 0x21]
call fcn.14003f9d0
test al, al
je 0x1400015b1
cmp byte [0x140086a20], r15b
je 0x1400015ac
call fcn.140003580
jmp 0x1400015b1
call fcn.140003740
mov byte [rsp + 0x20], 0x21
mov al, 0x60
mov cl, 0x48
mov dl, 0x4c
mov r8b, 1
mov r9b, 0x6d
mov r10b, 0x44
mov r11b, 0x46
movzx ebx, cl
mov dil, 0x55
xor esi, esi
xor al, 0x21
mov byte [rsp + 0x21], al
xor cl, 0x21
mov byte [rsp + 0x22], cl
xor dl, 0x21
mov byte [rsp + 0x23], dl
xor r8b, 0x21
mov byte [rsp + 0x24], r8b
xor r9b, 0x21
mov byte [rsp + 0x25], r9b
xor r10b, 0x21
mov byte [rsp + 0x26], r10b
xor r11b, 0x21
mov byte [rsp + 0x27], r11b
xor bl, 0x21
mov byte [rsp + 0x28], bl
xor dil, 0x21
mov byte [rsp + 0x29], dil
mov byte [rsp + 0x2a], sil
lea rdx, [0x140086a21]
lea rcx, [rsp + 0x21]
call fcn.14003f9d0
test al, al
je 0x140001647
cmp byte [0x140086a21], sil
je 0x140001642
call fcn.140003240
jmp 0x140001647
call fcn.1400033e0
mov byte [rsp + 0x20], 0x37
mov al, 0x79
mov cl, 0x58
mov dl, 0x74
mov r8b, 0x5b
mov r9b, 0x5e
mov r10b, 0x47
xor al, 0x37
mov byte [rsp + 0x21], al
xor cl, 0x37
mov byte [rsp + 0x22], cl
xor dl, 0x37
mov byte [rsp + 0x23], dl
xor r8b, 0x37
mov byte [rsp + 0x24], r8b
xor r9b, 0x37
mov byte [rsp + 0x25], r9b
xor r10b, 0x37
mov byte [rsp + 0x26], r10b
mov byte [rsp + 0x27], sil
lea rdx, [0x140086a23]
lea rcx, [rsp + 0x21]
call fcn.14003f9d0
test al, al
je 0x1400016b9
cmp byte [0x140086a23], sil
je 0x1400016b4
call fcn.140002ee0
jmp 0x1400016b9
call fcn.140003090
mov byte [rsp + 0x20], 0x6d
mov al, 0x25
mov cl, 4
mov dl, 0xa
mov r8b, 5
mov r9b, 0x4d
mov r10b, 0x2b
mov r11b, 0x22
mov bl, 0x3b
xor al, 0x6d
mov byte [rsp + 0x21], al
xor cl, 0x6d
mov byte [rsp + 0x22], cl
xor dl, 0x6d
mov byte [rsp + 0x23], dl
xor r8b, 0x6d
mov byte [rsp + 0x24], r8b
xor r9b, 0x6d
mov byte [rsp + 0x25], r9b
xor r10b, 0x6d
mov byte [rsp + 0x26], r10b
xor r11b, 0x6d
mov byte [rsp + 0x27], r11b
xor bl, 0x6d
mov byte [rsp + 0x28], bl
mov byte [rsp + 0x29], sil
lea rdx, [0x140086a22]
lea rcx, [rsp + 0x21]
call fcn.14003f9d0
test al, al
je 0x140001740
cmp byte [0x140086a22], sil
je 0x14000173b
call fcn.1400024a0
jmp 0x140001740
call fcn.1400029e0
movdqa xmm0, xmmword [0x14004e040]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x287863
mov rcx, r14
nop dword [rax]
movzx eax, byte [rsp + 0x20]
xor byte [rsp + rcx + 0x21], al
inc rcx
cmp rcx, 0x12
jb 0x140001760
mov byte [rsp + 0x33], sil
lea rdx, [0x140086a19]
lea rcx, [rsp + 0x21]
call fcn.14003f9d0
test al, al
je 0x1400017a1
cmp byte [0x140086a19], sil
je 0x14000179c
call fcn.140002ba0
jmp 0x1400017a1
call fcn.140002d40
mov byte [rsp + 0x20], 0x48
mov al, 0xa
mov cl, 0x24
mov dl, 0x29
mov r8b, 0x2b
mov r9b, 0x23
mov r10b, 0x1b
movzx r11d, r9b
mov bl, 0x31
xor al, 0x48
mov byte [rsp + 0x21], al
xor cl, 0x48
mov byte [rsp + 0x22], cl
xor dl, 0x48
mov byte [rsp + 0x23], dl
xor r8b, 0x48
mov byte [rsp + 0x24], r8b
xor r9b, 0x48
mov byte [rsp + 0x25], r9b
xor r10b, 0x48
mov byte [rsp + 0x26], r10b
xor r11b, 0x48
mov byte [rsp + 0x27], r11b
xor bl, 0x48
mov byte [rsp + 0x28], bl
mov byte [rsp + 0x29], sil
lea rdx, [0x140086a1b]
lea rcx, [rsp + 0x21]
call fcn.14003f9d0
test al, al
je 0x140001829
cmp byte [0x140086a1b], sil
je 0x140001824
call fcn.140002140
jmp 0x140001829
call fcn.1400022f0
movdqa xmm0, xmmword [0x14004e030]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x45
nop
movzx eax, byte [rsp + 0x20]
xor byte [rsp + r14 + 0x21], al
inc r14
cmp r14, 0x10
jb 0x140001840
mov byte [rsp + 0x31], sil
lea rdx, [0x140086a1a]
lea rcx, [rsp + 0x21]
call fcn.14003f9d0
test al, al
je 0x1400018d2
cmp byte [0x140086a1a], sil
je 0x14000187d
call fcn.140002660
jmp 0x1400018d2
call fcn.140002820
jmp 0x1400018d2
mov rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x140086a1c], r14d
mov byte [0x140086a18], dil
movdqa xmm0, xmmword [0x14004dd20]
movdqu xmmword [rsp + 0x20], xmm0
nop dword [rax]
movzx eax, byte [rsp + 0x20]
xor byte [rsp + r14 + 0x21], al
inc r14
cmp r14, 0xe
jb 0x1400018b0
mov byte [rsp + 0x2f], 0
lea rcx, [rsp + 0x21]
call fcn.14003df10
call fcn.140013c90
nop
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x140001918
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001913
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001913
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004675c
mov rcx, qword [rbp + 0x90]
xor rcx, rsp
call fcn.1400464b0
lea r11, [rsp + 0x1a0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret