Function at 0x1400132e0
Capabilities:
Encode data using xor
Enumerate processes

Disassembly:
push rbp
push rbx
push rdi
push r14
lea rbp, [rsp - 0x228]
sub rsp, 0x328
mov rax, qword [0x1401fec80]
xor rax, rsp
mov qword [rbp + 0x200], rax
xor r14d, r14d
mov ebx, r14d
mov dword [rsp + 0x20], ebx
call fcn.1400342e0
test al, al
jne 0x140013390
call fcn.1400342d0
test al, al
je 0x140013390
movzx eax, word [0x14003ebc0]
lea rcx, [rbp - 0x68]
mov word [rsp + 0x20], ax
movzx eax, byte [0x14003ebc2]
xor byte [rsp + 0x21], 0x32
xor al, 0x33
mov byte [rsp + 0x22], al
mov byte [rsp + 0x20], reloc.WS2_32.dll_WSAGetLastError
call fcn.1400378a0
mov rcx, rax
lea ebx, [r14 + 1]
mov rax, 0xffffffffffffffff
lea rdx, [rsp + 0x20]
inc rax
cmp byte [rdx + rax], r14b
jne 0x140013361
cmp qword [rcx + 0x18], 0xf
mov r8, qword [rcx + 0x10]
jbe 0x140013378
mov rcx, qword [rcx]
cmp r8, rax
jne 0x140013390
lea rdx, [rsp + 0x20]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140013390
movzx edi, bl
jmp 0x140013393
xor dil, dil
test bl, 1
je 0x1400133d6
mov rdx, qword [rbp - 0x50]
cmp rdx, 0xf
jbe 0x1400133d6
mov rcx, qword [rbp - 0x68]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400133d1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400133d1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140039fd0
mov qword [rsp + 0x350], rsi
mov qword [rsp + 0x358], r12
mov qword [rsp + 0x360], r13
mov qword [rsp + 0x320], r15
movaps xmmword [rsp + 0x310], xmm6
test dil, dil
je 0x1400138e3
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rbp - 0x40]
mov dword [rbp - 0x40], 0x238
mov rcx, rax
mov r15, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x1400138da
mov r12d, dword [0x1401fec30]
mov r13d, 0x47
nop dword [rax]
xorps xmm0, xmm0
mov qword [rsp + 0x68], r14
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x70], r14
lea rax, [rbp - 0x14]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140013460
lea rdx, [rbp - 0x14]
lea rcx, [rsp + 0x58]
call fcn.140001ad0
cmp word [0x14003ebde], 0
movups xmm3, xmmword [str.vSQeDX_IH_vfrdGYT_JI_]
movsd xmm0, qword [0x14003ebd8]
movups xmmword [rsp + 0x40], xmm3
movsd qword [rsp + 0x50], xmm0
je 0x1400135e8
mov r8d, r14d
cmp r12d, 2
jl 0x140013598
movdqa xmm2, xmmword [0x140040b80]
mov r8d, 8
movdqa xmm4, xmmword [0x140040c40]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140040ba0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movq xmm1, xmm3
movdqa xmm3, xmmword [0x140040b90]
paddw xmm2, xmmword [str.11111111]
movdqa xmm0, xmm3
xorps xmm2, xmm1
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movq qword [rsp + 0x40], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140040ba0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rsp + 0x48]
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmmword [str.11111111]
xorps xmm2, xmm0
movq qword [rsp + 0x48], xmm2
movsxd rax, r8d
lea r9, [rsp + 0x40]
lea r9, [r9 + rax*2]
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x8fb823ef
lea r9, [r9 + 2]
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul ecx, eax, 0x39
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x31
xor word [r9 - 2], ax
cmp r8d, 0xc
jl 0x1400135b0
lea rax, [rsp + 0x40]
mov r9, 0xffffffffffffffff
inc r9
cmp word [rax + r9*2], 0
jne 0x1400135f4
mov r14, qword [rsp + 0x70]
lea r11, [rsp + 0x58]
mov rdi, qword [rsp + 0x58]
cmp r14, 7
mov rax, qword [rsp + 0x68]
cmova r11, rdi
cmp r9, rax
ja 0x1400136c2
sub rax, r9
test r9, r9
jne 0x140013633
xor ebx, ebx
jmp 0x1400136c9
movzx r10d, word [rsp + 0x40]
lea rsi, [r11 + 2]
lea rsi, [rsi + rax*2]
mov rbx, r11
nop dword [rax]
nop dword [rax + rax]
mov rax, rsi
mov ecx, 0
sub rax, rbx
sar rax, 1
je 0x14001367c
cmp word [rbx], r10w
je 0x140013679
cmp rax, 1
je 0x14001367c
add rbx, 2
dec rax
cmp word [rbx], r10w
jne 0x140013666
mov rcx, rbx
mov rbx, rcx
test rcx, rcx
je 0x1400136c2
lea rcx, [rsp + 0x40]
mov rdx, r9
test r9, r9
je 0x1400136b4
lea rax, [rsp + 0x40]
mov r8, rbx
sub r8, rax
nop dword [rax]
movzx eax, word [r8 + rcx]
cmp ax, word [rcx]
jne 0x1400136bc
add rcx, 2
sub rdx, 1
jne 0x1400136a0
sub rbx, r11
sar rbx, 1
jmp 0x1400136c9
add rbx, 2
jmp 0x140013650
mov rbx, 0xffffffffffffffff
cmp r14, 7
jbe 0x140013704
lea rdx, [r14*2 + 2]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400136fc
mov rdi, qword [rdi - 8]
add rdx, 0x27
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013929
mov rcx, rdi
call fcn.140039fd0
cmp rbx, 0xffffffffffffffff
jne 0x140013930
xor r14d, r14d
lea rax, [rbp - 0x14]
xorps xmm0, xmm0
mov qword [rbp - 0x78], r14
movups xmmword [rsp + 0x78], xmm0
mov qword [rbp - 0x70], r14
mov r8, rbx
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], r14w
jne 0x140013730
lea rdx, [rbp - 0x14]
lea rcx, [rsp + 0x78]
call fcn.140001ad0
mov ecx, dword [0x14003ebf0]
mov r9, 0xffffffffffffffff
movzx eax, word [0x14003ebf4]
movups xmm0, xmmword [0x14003ebe0]
mov dword [rsp + 0x38], ecx
xor cx, 0x39
xor word [rsp + 0x3a], 0x3a
movups xmmword [rsp + 0x28], xmm0
xor word [rsp + 0x2a], 0x32
xor word [rsp + 0x2c], 0x33
xor word [rsp + 0x2e], 0x34
xor word [rsp + 0x30], 0x35
xor word [rsp + 0x32], 0x36
xor word [rsp + 0x34], 0x37
xor word [rsp + 0x36], 0x38
xor ax, 0x3b
mov word [rsp + 0x28], r13w
mov word [rsp + 0x3c], ax
lea rax, [rsp + 0x28]
mov word [rsp + 0x38], cx
nop dword [rax]
inc r9
cmp word [rax + r9*2], r14w
jne 0x1400137c0
mov rsi, qword [rbp - 0x70]
lea r10, [rsp + 0x78]
mov r11, qword [rsp + 0x78]
cmp rsi, 7
mov rax, qword [rbp - 0x78]
cmova r10, r11
cmp r9, rax
ja 0x140013882
sub rax, r9
test r9, r9
jne 0x1400137fd
mov rbx, r14
jmp 0x140013889
lea rdi, [r10 + 2]
mov rbx, r10
lea rdi, [rdi + rax*2]
nop dword [rax + rax]
mov rax, rdi
mov rcx, r14
sub rax, rbx
sar rax, 1
je 0x14001383a
cmp word [rbx], r13w
je 0x140013837
cmp rax, 1
je 0x14001383a
add rbx, 2
dec rax
cmp word [rbx], r13w
jne 0x140013824
mov rcx, rbx
mov rbx, rcx
test rcx, rcx
je 0x140013882
lea rcx, [rsp + 0x28]
mov rdx, r9
test r9, r9
je 0x140013874
lea rax, [rsp + 0x28]
mov r8, rbx
sub r8, rax
nop word [rax + rax]
movzx eax, word [rcx + r8]
cmp ax, word [rcx]
jne 0x14001387c
add rcx, 2
sub rdx, 1
jne 0x140013860
sub rbx, r10
sar rbx, 1
jmp 0x140013889
add rbx, 2
jmp 0x140013810
mov rbx, 0xffffffffffffffff
cmp rsi, 7
jbe 0x1400138c0
lea rdx, [rsi*2 + 2]
mov rax, r11
cmp rdx, 0x1000
jb 0x1400138b8
mov r11, qword [r11 - 8]
add rdx, 0x27
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140013929
mov rcx, r11
call fcn.140039fd0
cmp rbx, 0xffffffffffffffff
jne 0x140013930
lea rdx, [rbp - 0x40]
mov rcx, r15
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140013440
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov r15, qword [rsp + 0x320]
mov r13, qword [rsp + 0x360]
mov r12, qword [rsp + 0x358]
mov rsi, qword [rsp + 0x350]
movaps xmm6, xmmword [rsp + 0x310]
mov rcx, qword [rbp + 0x200]
xor rcx, rsp
call fcn.14003a390
add rsp, 0x328
pop r14
pop rdi
pop rbx
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp - 0x38]
jmp 0x1400138e5