Function at 0x4df840
Capabilities:
Encode data using xor
Enumerate processes
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2e0
push ebx
mov ebx, ecx
mov dword [ebp - 0x1c], 0
push esi
push edi
mov dword [ebp - 0xc], ebx
cmp dword [ebx + 0x24], 0
jne 0x4df86a
mov eax, dword [ebx + 0x3c]
cmp eax, dword [ebx + 0x40]
je 0x4dfd31
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov edi, dword [ebp - 0x14]
mov ecx, edi
sub ecx, dword [ebx]
mov esi, dword [ebp - 0x10]
mov edx, esi
sbb edx, dword [ebx + 4]
call fcn.006d4970
mov edx, dword [ebx + 0xc]
mov ecx, dword [ebx + 8]
cvtsd2ss xmm0, xmm0
movss dword [ebp - 8], xmm0
call fcn.006d4970
movss xmm1, dword [ebp - 8]
xorps xmm2, xmm2
cvtsd2ss xmm0, xmm0
mov dword [ebx], edi
mov dword [ebx + 4], esi
divss xmm1, xmm0
movaps xmm0, xmm1
movss dword [ebp - 8], xmm1
addss xmm0, dword [ebx + 0x10]
movss dword [ebx + 0x10], xmm0
mov eax, dword [ebx + 0xb8]
mov esi, dword [eax]
cmp esi, eax
je 0x4df9b1
movss xmm0, dword [esi + 0x20]
subss xmm0, xmm1
comiss xmm2, xmm0
movss dword [esi + 0x20], xmm0
jb 0x4df9a3
cmp dword [esi + 0x1c], 7
lea ecx, [esi + 8]
mov edi, esi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x74], edi
mov dword [ebp - 0x18], ecx
jbe 0x4df903
mov eax, dword [ecx]
mov dword [ebp - 0x18], eax
mov eax, dword [ecx + 0x10]
mov edx, 0x811c9dc5
xor ecx, ecx
add eax, eax
mov dword [ebp - 0x6c], eax
je 0x4df937
mov ebx, dword [ebp - 0x18]
mov edi, eax
nop dword [eax]
movzx eax, byte [ebx + ecx]
inc ecx
xor eax, edx
imul edx, eax, 0x1000193
cmp ecx, edi
jb 0x4df920
mov edi, dword [ebp - 0x74]
mov ebx, dword [ebp - 0xc]
mov ecx, dword [ebx + 0xcc]
and ecx, edx
mov edx, dword [ebx + 0xc0]
mov eax, dword [edx + ecx*8]
cmp dword [edx + ecx*8 + 4], esi
jne 0x4df96a
cmp eax, esi
jne 0x4df961
mov eax, dword [ebx + 0xb8]
mov dword [edx + ecx*8], eax
mov dword [edx + ecx*8 + 4], eax
jmp 0x4df973
mov eax, dword [esi + 4]
mov dword [edx + ecx*8 + 4], eax
jmp 0x4df973
cmp eax, esi
jne 0x4df973
mov eax, dword [esi]
mov dword [edx + ecx*8], eax
mov esi, dword [edi]
dec dword [ebx + 0xbc]
mov eax, dword [edi + 4]
mov ecx, dword [ebp - 0x10]
mov dword [eax], esi
mov eax, dword [edi + 4]
mov dword [esi + 4], eax
call fcn.00413980
push 0x24
push edi
call fcn.005ab85c
movss xmm1, dword [ebp - 8]
add esp, 8
xorps xmm2, xmm2
jmp 0x4df9a5
mov esi, dword [esi]
cmp esi, dword [ebx + 0xb8]
jne 0x4df8d3
cmp byte [ebp + 8], 0
jne 0x4df9c9
movss xmm0, dword [0x7399b0]
comiss xmm0, dword [ebx + 0x10]
ja 0x4dfd31
lea eax, [ebx + 0x48]
mov dword [ebx + 0x10], 0
mov ecx, eax
mov dword [ebp + 8], eax
call fcn.004e0400
lea eax, [ebx + 0x88]
mov ecx, eax
mov dword [ebp - 0x10], eax
call fcn.0045f5a0
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
mov dword [ebp - 0xc], edi
cmp edi, 0xffffffff
je 0x4dfd31
push 0x228
lea eax, [ebp - 0x2d8]
push 0
push eax
call fcn.005c3040
add esp, 0xc
mov dword [ebp - 0x2dc], 0x22c
lea eax, [ebp - 0x2dc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x4dfd2a
mov ebx, dword [ebp - 0x1c]
nop
lea esi, [ebp - 0x2b8]
movzx eax, word [esi]
push eax
call fcn.005d8348
mov word [esi], ax
add esp, 4
add esi, 2
lea eax, [ebp - 0xb0]
cmp esi, eax
jne 0x4dfa46
lea ecx, [ebp - 0x2b8]
lea edx, [ecx + 2]
nop dword [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4dfa70
sub ecx, edx
mov dword [ebp - 0x40], 0
sar ecx, 1
lea eax, [ebp - 0x2b8]
push ecx
xorps xmm0, xmm0
mov dword [ebp - 0x3c], 0
push eax
lea ecx, [ebp - 0x50]
movups xmmword [ebp - 0x50], xmm0
call fcn.004134e0
mov edi, dword [ebp - 0x3c]
lea ecx, [ebp - 0x50]
mov eax, dword [ebp - 0x40]
cmp edi, 7
cmova ecx, dword [ebp - 0x50]
lea esi, [ecx + eax*2]
mov edx, esi
call fcn.0042de00
sub esi, eax
je 0x4dfb0d
mov eax, dword [ebp - 0x40]
lea ecx, [ebp - 0x50]
or ebx, 1
cmp edi, 7
cmova ecx, dword [ebp - 0x50]
lea esi, [ecx + eax*2]
mov edx, esi
call fcn.0042de00
sub esi, eax
mov dword [ebp - 0x80], 0
sar esi, 1
lea ecx, [ebp - 0x90]
push esi
xorps xmm0, xmm0
mov dword [ebp - 0x7c], 0
push eax
movups xmmword [ebp - 0x90], xmm0
call fcn.004134e0
lea eax, [ebp - 0x90]
jmp 0x4dfb3a
or ebx, 2
mov dword [ebp - 0x20], 0x720774
call fcn.005acf93
xorps xmm0, xmm0
mov dword [ebp - 0x28], 0
xor eax, eax
mov dword [ebp - 0x24], 7
movups xmmword [ebp - 0x38], xmm0
mov word [ebp - 0x38], ax
lea eax, [ebp - 0x38]
push eax
lea ecx, [ebp - 0xa8]
call fcn.004137f0
test bl, 2
je 0x4dfb9c
mov ecx, dword [ebp - 0x24]
and ebx, 0xfffffffd
cmp ecx, 7
jbe 0x4dfb88
mov edx, dword [ebp - 0x38]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4dfb7e
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4dfd3a
push ecx
push edx
call fcn.005ab85c
add esp, 8
xor eax, eax
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x24], 7
mov word [ebp - 0x38], ax
test bl, 1
je 0x4dfbe1
mov ecx, dword [ebp - 0x7c]
and ebx, 0xfffffffe
cmp ecx, 7
jbe 0x4dfbe1
mov edx, dword [ebp - 0x90]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4dfbd7
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4dfd3a
push ecx
push edx
call fcn.005ab85c
add esp, 8
cmp dword [ebp - 0x94], 7
lea edx, [ebp - 0xa8]
xorps xmm0, xmm0
mov dword [ebp - 0x58], 0
cmova edx, dword [ebp - 0xa8]
mov ecx, edx
mov dword [ebp - 0x54], 0
movups xmmword [ebp - 0x68], xmm0
lea esi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x4dfc10
sub ecx, esi
sar ecx, 1
push ecx
push edx
lea ecx, [ebp - 0x68]
call fcn.004134e0
lea ecx, [ebp - 0xa8]
call fcn.00413980
mov ecx, dword [ebp - 0x3c]
cmp ecx, 7
jbe 0x4dfc6e
mov edx, dword [ebp - 0x50]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4dfc64
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4dfd3a
push ecx
push edx
call fcn.005ab85c
add esp, 8
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x2d4]
push eax
lea eax, [ebp - 0x78]
push eax
call fcn.004e0f50
mov ecx, dword [eax]
lea eax, [ebp - 0x68]
add ecx, 0xc
cmp ecx, eax
je 0x4dfccb
cmp dword [ebp - 0x54], 7
mov esi, dword [ecx + 0x14]
cmova eax, dword [ebp - 0x68]
mov edx, dword [ebp - 0x58]
cmp edx, esi
ja 0x4dfcc1
mov edi, ecx
cmp esi, 7
jbe 0x4dfca8
mov edi, dword [ecx]
lea esi, [edx + edx]
mov dword [ecx + 0x10], edx
push esi
push eax
push edi
call fcn.005c3580
add esp, 0xc
xor eax, eax
mov word [edi + esi], ax
jmp 0x4dfccb
push eax
push dword [ebp + 8]
push edx
call fcn.00413de0
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x70]
push eax
call fcn.0045ef10
mov ecx, dword [ebp - 0x54]
cmp ecx, 7
jbe 0x4dfd11
mov edx, dword [ebp - 0x68]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x4dfd07
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x4dfd3a
push ecx
push edx
call fcn.005ab85c
add esp, 8
mov edi, dword [ebp - 0xc]
lea eax, [ebp - 0x2dc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x4dfa40
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
call fcn.005c695f
int3