Function at 0x1400038f0
Capabilities:
Encode data using xor
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
mov rax, qword [0x1400d59c0]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
mov edi, ecx
test ecx, ecx
je 0x140003972
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140003972
lea rdx, [rsp + 0x60]
mov dword [rsp + 0x60], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140003969
cmp dword [rsp + 0x68], edi
je 0x140003998
lea rdx, [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140003951
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.140075840
lea r11, [rsp + 0x2b0]
mov rbx, qword [r11 + 0x10]
mov rdi, qword [r11 + 0x18]
mov rsp, r11
pop rbp
ret
mov ecx, 0x68
xor edx, edx
call fcn.140001cd0
mov ecx, 0x61
mov word [rsp + 0x20], ax
mov edx, 1
call fcn.140001cd0
mov ecx, WSASetLastError
mov word [rsp + 0x22], ax
mov edx, 2
call fcn.140001cd0
mov ecx, 0x68
mov word [rsp + 0x24], ax
mov edx, 3
call fcn.140001cd0
mov ecx, 0x75
mov word [rsp + 0x26], ax
mov edx, 4
call fcn.140001cd0
mov ecx, 0x61
mov word [rsp + 0x28], ax
mov edx, 5
call fcn.140001cd0
mov ecx, 0x41
mov word [rsp + 0x2a], ax
mov edx, 6
call fcn.140001cd0
mov ecx, reloc.WS2_32.dll_WSASetLastError
mov word [rsp + 0x2c], ax
mov edx, 7
call fcn.140001cd0
mov edx, 8
mov word [rsp + 0x2e], ax
call fcn.140001cd0
mov ecx, 0x2e
mov word [rsp + 0x30], ax
mov edx, 9
call fcn.140001cd0
mov ecx, 0x65
mov word [rsp + 0x32], ax
mov edx, 0xa
call fcn.140001cd0
mov ecx, 0x78
mov word [rsp + 0x34], ax
mov edx, listen
call fcn.140001cd0
mov ecx, 0x65
mov word [rsp + 0x36], ax
mov edx, recv
call fcn.140001cd0
xor ecx, ecx
mov word [rsp + 0x38], ax
mov edx, reloc.WS2_32.dll_listen
call fcn.140001cd0
movzx ecx, word [0x1400c7ed4]
mov edx, select
mov word [rsp + 0x3a], ax
call fcn.140001cd0
movzx ecx, word [0x1400c7ed6]
mov edx, reloc.WS2_32.dll_ntohs
mov word [rsp + 0x3c], ax
call fcn.140001cd0
movzx ecx, word [str.vector_too_long]
mov edx, reloc.WS2_32.dll_recv
mov word [rsp + 0x3e], ax
call fcn.140001cd0
movzx ecx, word [0x1400c7eda]
mov edx, reloc.WS2_32.dll_recvfrom
mov word [rsp + 0x40], ax
call fcn.140001cd0
movzx ecx, word [0x1400c7edc]
mov edx, reloc.WS2_32.dll_select
mov word [rsp + 0x42], ax
call fcn.140001cd0
movzx ecx, word [0x1400c7ede]
mov edx, reloc.WS2_32.dll_send
mov word [rsp + 0x44], ax
call fcn.140001cd0
movzx ecx, word [0x1400c7ee0]
mov edx, reloc.WS2_32.dll_sendto
mov word [rsp + 0x46], ax
call fcn.140001cd0
movzx ecx, word [0x1400c7ee2]
mov edx, reloc.WS2_32.dll_setsockopt
mov word [rsp + 0x48], ax
call fcn.140001cd0
movzx ecx, word [0x1400c7ee4]
mov edx, socket
mov word [rsp + 0x4a], ax
call fcn.140001cd0
movzx ecx, word [0x1400c7ee6]
mov edx, reloc.WS2_32.dll_socket
mov word [rsp + 0x4c], ax
call fcn.140001cd0
movzx ecx, word [0x1400c7ee8]
mov edx, 0x18
mov word [rsp + 0x4e], ax
call fcn.140001cd0
movzx ecx, word [0x1400c7eea]
mov edx, 0x19
mov word [rsp + 0x50], ax
call fcn.140001cd0
movzx ecx, word [reloc.WS2_32.dll_accept]
mov edx, 0x1a
mov word [rsp + 0x52], ax
call fcn.140001cd0
movdqa xmm4, xmmword [0x1400c7f20]
movdqa xmm5, xmmword [0x1400c7f40]
mov word [rsp + 0x54], ax
xor eax, eax
mov word [rsp + 0x56], ax
xor r9d, r9d
nop dword [rax]
movsxd rdx, eax
lea ecx, [rax + 4]
movd xmm0, eax
movq xmm2, xmm5
pshufd xmm0, xmm0, 0
paddd xmm0, xmm4
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rsp + rdx*2 + 0x20]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movq xmm2, xmm5
xorps xmm3, xmm0
movd xmm0, ecx
movq qword [rsp + rdx*2 + 0x20], xmm3
lea ecx, [rax + 8]
pshufd xmm0, xmm0, 0
paddd xmm0, xmm4
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rsp + rdx*2 + 0x28]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movq xmm2, xmm5
xorps xmm3, xmm0
movd xmm0, ecx
movq qword [rsp + rdx*2 + 0x28], xmm3
lea ecx, [rax + 0xc]
pshufd xmm0, xmm0, 0
add eax, 0x10
paddd xmm0, xmm4
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rsp + rdx*2 + 0x30]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
movq xmm2, xmm5
xorps xmm3, xmm0
movd xmm0, ecx
movq qword [rsp + rdx*2 + 0x30], xmm3
pshufd xmm0, xmm0, 0
paddd xmm0, xmm4
pshufhw xmm0, xmm0, 0xd8
pshuflw xmm1, xmm0, 0xd8
movq xmm0, qword [rsp + rdx*2 + 0x38]
pshufd xmm3, xmm1, 0xd8
paddw xmm3, xmm2
xorps xmm3, xmm0
movq qword [rsp + rdx*2 + 0x38], xmm3
cmp eax, 0x10
jb 0x140003be0
cmp eax, 0x1b
jae 0x140003cea
mov r8d, 0x3e5
nop
movsxd rcx, eax
lea rdx, [rsp + 0x20]
lea rdx, [rdx + rcx*2]
lea ecx, [r8 + rax]
inc eax
xor word [rdx], cx
cmp eax, 0x1b
jb 0x140003cd0
lea rdx, [rsp + 0x20]
mov word [rsp + 0x56], r9w
lea rcx, [rbp - 0x74]
call fcn.14007b9a4
test eax, eax
jne 0x140003969
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
jmp 0x140003974