Function at 0x140001ef0
Capabilities:
Encode data using xor
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x460]
sub rsp, 0x560
mov rax, qword [0x14018db80]
xor rax, rsp
mov qword [rbp + 0x450], rax
xor ecx, ecx
mov dword [rbp + 0x160], 0xfc39fc33
mov word [rbp + 0x18c], cx
mov edx, ecx
mov dword [rbp + 0x164], 0xfc32fc37
mov r8d, 0x3b0
mov dword [rbp + 0x168], 0xfc30fc20
mov dword [rbp + 0x16c], 0xfc30fc38
mov dword [rbp + 0x170], 0xfc37fc31
mov dword [rbp + 0x174], 0xfc76fc3f
mov dword [rbp + 0x178], 0xfc65fc24
mov dword [rbp + 0x17c], 0xfc00fc68
mov dword [rbp + 0x180], 0xfc55fc56
mov dword [rbp + 0x184], 0xfc06fc4c
mov dword [rbp + 0x188], 0xfc00fc1c
mov byte [rbp + 0x18e], 1
nop
movzx eax, dx
sub ax, r8w
xor word [rbp + rdx*2 + 0x160], ax
inc rdx
cmp rdx, 0x16
jb 0x140001fb0
lea rax, [rbp + 0x160]
mov dword [rbp + 0x160], 0xfc3dfc3f
mov qword [rbp + 0x3e0], rax
mov rdx, rcx
mov dword [rbp + 0x164], 0xfc2afc3e
mov dword [rbp + 0x168], 0xfc37fc30
mov dword [rbp + 0x16c], 0xfc79fc31
mov dword [rbp + 0x170], 0xfc21fc3d
mov dword [rbp + 0x174], 0xfc3f
mov byte [rbp + 0x178], 1
nop dword [rax]
movzx eax, dx
sub ax, r8w
xor word [rbp + rdx*2 + 0x160], ax
inc rdx
cmp rdx, 0xb
jb 0x140002020
lea rax, [rbp + 0x160]
mov dword [rbp + 0x160], 0xfc35fc39
mov qword [rbp + 0x3e8], rax
mov rdx, rcx
mov dword [rbp + 0x164], 0xfc7dfc33
mov dword [rbp + 0x168], 0xfc2dfc31
mov dword [rbp + 0x16c], 0xfc33
mov byte [rbp + 0x170], 1
nop dword [rax + rax]
movzx eax, dx
sub ax, r8w
xor word [rbp + rdx*2 + 0x160], ax
inc rdx
cmp rdx, 7
jb 0x140002080
lea rax, [rbp + 0x160]
mov dword [rbp + 0x160], 0xfc35fc39
mov qword [rbp + 0x3f0], rax
mov rdx, rcx
mov dword [rbp + 0x164], 0xfc65fc33
mov dword [rbp + 0x168], 0xfc7bfc60
mov dword [rbp + 0x16c], 0xfc2ffc33
mov dword [rbp + 0x170], 0xfc3d
mov byte [rbp + 0x174], 1
nop dword [rax]
nop word [rax + rax]
movzx eax, dx
sub ax, r8w
xor word [rbp + rdx*2 + 0x160], ax
inc rdx
cmp rdx, 9
jb 0x1400020f0
lea rax, [rbp + 0x160]
mov dword [rbp + 0x160], 0xfc30fc22
mov qword [rbp + 0x3f8], rax
mov rdx, rcx
mov dword [rbp + 0x164], 0xfc32fc36
mov dword [rbp + 0x168], 0xfc30fc26
mov dword [rbp + 0x16c], 0xfc79fc64
mov dword [rbp + 0x170], 0xfc21fc3d
mov dword [rbp + 0x174], 0xfc3f
mov byte [rbp + 0x178], 1
nop dword [rax]
movzx eax, dx
sub ax, r8w
xor word [rbp + rdx*2 + 0x160], ax
inc rdx
cmp rdx, 0xb
jb 0x140002160
lea rax, [rbp + 0x160]
mov dword [rbp + 0x160], 0xfc67fc28
mov qword [rbp + 0x400], rax
mov rdx, rcx
mov dword [rbp + 0x164], 0xfc37fc66
mov dword [rbp + 0x168], 0xfc32fc36
mov dword [rbp + 0x16c], 0xfc32fc78
mov dword [rbp + 0x170], 0xfc3cfc20
mov word [rbp + 0x174], cx
mov byte [rbp + 0x176], 1
nop dword [rax]
movzx eax, dx
sub ax, r8w
xor word [rbp + rdx*2 + 0x160], ax
inc rdx
cmp rdx, 0xa
jb 0x1400021d0
lea rax, [rbp + 0x160]
mov dword [rbp + 0x160], 0xfc39fc33
mov qword [rbp + 0x408], rax
mov rdx, rcx
mov dword [rbp + 0x164], 0xfc32fc37
mov dword [rbp + 0x168], 0xfc30fc20
mov dword [rbp + 0x16c], 0xfc30fc38
mov dword [rbp + 0x170], 0xfc37fc31
mov dword [rbp + 0x174], 0xfc76fc3f
mov dword [rbp + 0x178], 0xfc65fc24
mov dword [rbp + 0x17c], 0xfc00fc68
mov dword [rbp + 0x180], 0xfc55fc56
mov dword [rbp + 0x184], 0xfc30fc4f
mov dword [rbp + 0x188], 0xfc20fc37
mov dword [rbp + 0x18c], 0xfc4afc52
mov dword [rbp + 0x190], 0xfc3ffc29
mov dword [rbp + 0x194], 0xfc59fc32
mov word [rbp + 0x198], cx
mov byte [rbp + 0x19a], 1
nop dword [rax]
nop word [rax + rax]
movzx eax, dx
sub ax, r8w
xor word [rbp + rdx*2 + 0x160], ax
inc rdx
cmp rdx, 0x1c
jb 0x1400022a0
lea rax, [rbp + 0x160]
mov dword [rbp + 0x160], 0xfc1dfc1f
mov qword [rbp + 0x410], rax
mov rdx, rcx
mov dword [rbp + 0x164], 0xfc0afc1e
mov dword [rbp + 0x168], 0xfc17fc10
mov dword [rbp + 0x16c], 0xfc79fc11
mov dword [rbp + 0x170], 0xfc01fc1d
mov dword [rbp + 0x174], 0xfc1f
mov byte [rbp + 0x178], 1
nop dword [rax]
movzx eax, dx
sub ax, r8w
xor word [rbp + rdx*2 + 0x160], ax
inc rdx
cmp rdx, 0xb
jb 0x140002310
lea rax, [rbp + 0x160]
mov dword [rbp + 0x160], 0xfc39fc13
mov qword [rbp + 0x418], rax
mov rdx, rcx
mov dword [rbp + 0x164], 0xfc21fc33
mov dword [rbp + 0x168], 0xfc30fc38
mov dword [rbp + 0x16c], 0xfc79fc25
mov dword [rbp + 0x170], 0xfc21fc3d
mov dword [rbp + 0x174], 0xfc3f
mov byte [rbp + 0x178], 1
nop dword [rax]
movzx eax, dx
sub ax, r8w
xor word [rbp + rdx*2 + 0x160], ax
inc rdx
cmp rdx, 0xb
jb 0x140002380
lea rax, [rbp + 0x160]
mov dword [rbp + 0x160], 0xfc38fc07
mov qword [rbp + 0x420], rax
mov rdx, rcx
mov dword [rbp + 0x164], 0xfc36fc20
mov dword [rbp + 0x168], 0xfc3dfc27
mov dword [rbp + 0x16c], 0xfc25fc37
mov dword [rbp + 0x170], 0xfc77fc33
mov dword [rbp + 0x174], 0xfc23fc3f
mov dword [rbp + 0x178], 0xfc39
mov byte [rbp + 0x17c], 1
nop word [rax + rax]
movzx eax, dx
sub ax, r8w
xor word [rbp + rdx*2 + 0x160], ax
inc rdx
cmp rdx, 0xd
jb 0x140002400
lea rax, [rbp + 0x160]
mov dword [rbp + 0x160], 0xfc05fc18
mov qword [rbp + 0x428], rax
mov rdx, rcx
mov dword [rbp + 0x164], 0xfc03fc06
mov dword [rbp + 0x168], 0xfc30fc10
mov dword [rbp + 0x16c], 0xfc22fc34
mov dword [rbp + 0x170], 0xfc3efc3f
mov dword [rbp + 0x174], 0xfc29fc3f
mov dword [rbp + 0x178], 0xfc14fc09
mov dword [rbp + 0x17c], 0xfc3afc70
mov dword [rbp + 0x180], 0xfc04fc18
mov word [rbp + 0x184], cx
mov byte [rbp + 0x186], 1
movzx eax, dx
sub ax, r8w
xor word [rbp + rdx*2 + 0x160], ax
inc rdx
cmp rdx, 0x12
jb 0x140002491
lea rax, [rbp + 0x160]
mov dword [rbp + 0x160], 0xfc35fc39
mov qword [rbp + 0x430], rax
mov rdx, rcx
mov dword [rbp + 0x164], 0xfc65fc33
mov dword [rbp + 0x168], 0xfc7bfc60
mov dword [rbp + 0x16c], 0xfc2ffc33
mov dword [rbp + 0x170], 0xfc3d
mov byte [rbp + 0x174], 1
nop dword [rax]
nop word [rax + rax]
movzx eax, dx
sub ax, r8w
xor word [rbp + rdx*2 + 0x160], ax
inc rdx
cmp rdx, 9
jb 0x140002500
lea rax, [rbp + 0x160]
mov dword [rbp + 0x160], 0xfc22fc1b
mov qword [rbp + 0x438], rax
mov rdx, rcx
mov dword [rbp + 0x164], 0xfc26fc16
mov dword [rbp + 0x168], 0xfc25fc39
mov dword [rbp + 0x16c], 0xfc25fc33
mov dword [rbp + 0x170], 0xfc35fc1b
mov dword [rbp + 0x174], 0xfc3efc33
mov dword [rbp + 0x178], 0xfc29fc32
mov dword [rbp + 0x17c], 0xfc3afc70
mov dword [rbp + 0x180], 0xfc04fc18
mov word [rbp + 0x184], cx
mov byte [rbp + 0x186], 1
movzx eax, dx
sub ax, r8w
xor word [rbp + rdx*2 + 0x160], ax
inc rdx
cmp rdx, 0x12
jb 0x140002591
lea rax, [rbp + 0x160]
mov dword [rbp + 0x160], 0xfc23fc00
mov qword [rbp + 0x440], rax
mov dword [rbp + 0x164], 0xfc30fc3d
mov dword [rbp + 0x168], 0xfc26fc31
mov dword [rbp + 0x16c], 0xfc1ffc25
mov dword [rbp + 0x170], 0xfc3afc39
mov dword [rbp + 0x174], 0xfc3efc31
mov dword [rbp + 0x178], 0xfc73fc2e
mov dword [rbp + 0x17c], 0xfc27fc3b
mov dword [rbp + 0x180], 0xfc05
mov byte [rbp + 0x184], 1
nop dword [rax + rax]
movzx eax, cx
sub ax, r8w
xor word [rbp + rcx*2 + 0x160], ax
inc rcx
cmp rcx, 0x11
jb 0x140002620
lea rax, [rbp + 0x160]
xor edx, edx
mov r8d, 0x234
mov qword [rbp + 0x448], rax
lea rcx, [rbp + 0x1a4]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
xor edx, edx
mov dword [rsp + 0x20], 0x238
mov r8d, 0x234
lea rcx, [rsp + 0x24]
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x1a0]
mov edx, 4
lea rax, [rsp + 0x20]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140002692
movups xmm0, xmmword [rax]
lea rdx, [rbp + 0x1a0]
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x20]
mov rax, qword [rax + 0x30]
movups xmmword [rcx + 0x10], xmm1
movups xmmword [rcx + 0x20], xmm0
mov qword [rcx + 0x30], rax
mov rcx, rdi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x140002724
lea rcx, str._Warning__It_is_impossible_to_check_process_list.
call fcn.1400027c0
jmp 0x140002767
lea rbx, [rbp + 0x3e0]
nop dword [rax + rax]
mov rcx, qword [rbx]
lea rdx, [rbp + 0x1cc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400027a0
add rbx, 8
lea rax, [rbp + 0x450]
cmp rbx, rax
jne 0x140002730
lea rdx, [rbp + 0x1a0]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140002724
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x450]
xor rcx, rsp
call fcn.14012def0
lea r11, [rsp + 0x560]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov ecx, 0x1009
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3