Function at 0x140082090
Capabilities:
Encode data using xor
Enumerate processes
Hash data using fnv
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x1a0
mov rax, qword [0x1403b8550]
xor rax, rsp
mov qword [rsp + 0x190], rax
mov r13, r8
mov r12, rdx
mov qword [rsp + 0x30], rdx
mov qword [rsp + 0x38], r8
xor al, al
mov byte [rsp + 0x20], al
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x28], rax
cmp rax, 0xffffffffffffffff
je 0x14008210c
mov dword [rsp + 0x40], 0x130
lea rdx, [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x140082124
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, r12
call fcn.14007bc70
nop
mov rcx, r13
call fcn.14007bc70
xor al, al
jmp 0x1400823ba
movabs rdi, 0x100000001b3
movabs rbp, 0xcbf29ce484222325
mov qword [rsp + 0x180], 0
mov qword [rsp + 0x188], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x170], 0
lea rax, [rsp + 0x6c]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x140082164
lea rdx, [rsp + 0x6c]
lea rcx, [rsp + 0x170]
call fcn.140011a50
mov r15, qword [rsp + 0x188]
mov rsi, qword [rsp + 0x180]
mov r14, qword [rsp + 0x170]
cmp qword [r12 + 0x10], 0
je 0x14008226f
mov rbx, qword [r12 + 8]
lea r8, [rsp + 0x170]
cmp r15, 0x10
cmovae r8, r14
mov rdx, rbp
xor ecx, ecx
test rsi, rsi
je 0x1400821e4
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + r8]
xor rdx, rax
imul rdx, rdi
inc rcx
cmp rcx, rsi
jb 0x1400821d0
mov rcx, qword [r12 + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [r12 + 0x18]
mov rdi, qword [rax + rcx*8 + 8]
cmp rdi, rbx
je 0x140082243
mov rbp, qword [rax + rcx*8]
lea rdx, [rdi + 0x10]
cmp qword [rdi + 0x28], 0x10
jb 0x140082211
mov rdx, qword [rdi + 0x10]
lea rcx, [rsp + 0x170]
cmp r15, 0x10
cmovae rcx, r14
cmp rsi, qword [rdi + 0x20]
jne 0x140082233
mov r8, rsi
call fcn.14026fc30
test eax, eax
je 0x14008223e
cmp rdi, rbp
je 0x140082243
mov rdi, qword [rdi + 8]
jmp 0x140082202
test rdi, rdi
jne 0x140082246
mov rdi, rbx
cmp rdi, rbx
je 0x14008225b
mov byte [rsp + 0x20], 1
cmp qword [r13 + 0x10], 0
je 0x1400823e5
movabs rbp, 0xcbf29ce484222325
movabs rdi, 0x100000001b3
cmp qword [r13 + 0x10], 0
je 0x140082348
mov rbx, qword [r13 + 8]
lea r8, [rsp + 0x170]
cmp r15, 0x10
cmovae r8, r14
mov rdx, rbp
xor ecx, ecx
test rsi, rsi
je 0x1400822b4
nop dword [rax + rax]
movzx eax, byte [rcx + r8]
xor rdx, rax
imul rdx, rdi
inc rcx
cmp rcx, rsi
jb 0x1400822a0
mov rcx, qword [r13 + 0x30]
and rcx, rdx
add rcx, rcx
mov rax, qword [r13 + 0x18]
mov rdi, qword [rax + rcx*8 + 8]
cmp rdi, rbx
je 0x140082311
mov rbp, qword [rax + rcx*8]
lea rdx, [rdi + 0x10]
cmp qword [rdi + 0x28], 0x10
jb 0x1400822df
mov rdx, qword [rdi + 0x10]
lea rcx, [rsp + 0x170]
cmp r15, 0x10
cmovae rcx, r14
cmp rsi, qword [rdi + 0x20]
jne 0x140082301
mov r8, rsi
call fcn.14026fc30
test eax, eax
je 0x14008230c
cmp rdi, rbp
je 0x140082311
mov rdi, qword [rdi + 8]
jmp 0x1400822d0
test rdi, rdi
jne 0x140082314
mov rdi, rbx
cmp rdi, rbx
je 0x140082348
mov r8d, dword [rsp + 0x48]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140082348
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r15, 0x10
jb 0x14008237f
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140082377
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140082439
mov rcx, r14
call fcn.140250e10
lea rdx, [rsp + 0x40]
mov rbx, qword [rsp + 0x28]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140082124
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, r12
call fcn.14007bc70
nop
mov rcx, r13
call fcn.14007bc70
movzx eax, byte [rsp + 0x20]
mov rcx, qword [rsp + 0x190]
xor rcx, rsp
call fcn.140250db0
mov rbx, qword [rsp + 0x1e0]
add rsp, 0x1a0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov rcx, qword [rsp + 0x28]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r15, 0x10
jb 0x140082424
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14008241b
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140082439
mov rcx, r14
call fcn.140250e10
nop
mov rcx, r12
call fcn.14007bc70
nop
mov rcx, r13
call fcn.14007bc70
mov al, 1
jmp 0x1400823ba
call fcn.14027fd34
int3