Function at 0x1400397b8
Capabilities:
Acquire debug privileges
Encode data using xor
Enumerate processes
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r14
push r15
lea rbp, [rax - 0x318]
sub rsp, 0x400
mov rax, qword [0x140116080]
xor rax, rsp
mov qword [rbp + 0x2f0], rax
mov rsi, rcx
xor edx, edx
lea rcx, [rbp - 0x4c]
mov r8d, 0x234
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov dword [rbp - 0x50], 0x238
lea r15d, [rdx + 2]
mov ecx, r15d
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor ebx, ebx
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14003994e
or edi, 0xffffffff
xorps xmm0, xmm0
mov qword [rbp - 0x80], rbx
movups xmmword [rbp - 0x68], xmm0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp - 0x80]
mov edx, Ordinal_41
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, 1
test eax, eax
je 0x140039898
lea r8, [rbp - 0x64]
mov dword [rbp - 0x68], esi
lea rdx, str.SeDebugPrivilege
mov dword [rbp - 0x5c], r15d
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x14003988e
mov rcx, qword [rbp - 0x80]
lea r8, [rbp - 0x68]
mov qword [rsp + 0x28], rbx
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
jne 0x140039a98
mov eax, dword [str.t_A_G6]
lea r9, [rbp - 0x78]
mov dword [rbp - 0x78], eax
mov r8d, ebx
movzx eax, word [0x140106c08]
mov edi, 0x51eb851f
mov word [rbp - 0x74], ax
mov r14b, Ordinal_50
mov eax, edi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
add r8d, esi
sub al, cl
add al, r14b
xor byte [r9], al
add r9, rsi
cmp r8d, 6
jl 0x1400398d7
movzx eax, word [0x140106d60]
lea r8, [rsp + 0x50]
movups xmm0, xmmword [str.BVZeDX_IH]
mov word [rsp + 0x60], ax
mov al, byte [0x140106d62]
mov byte [rsp + 0x62], al
movups xmmword [rsp + 0x50], xmm0
mov eax, edi
mul ebx
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, bl
add ebx, esi
sub al, cl
add al, r14b
xor byte [r8], al
add r8, rsi
cmp ebx, 0x13
jl 0x140039923
lea rdx, [rsp + 0x50]
jmp 0x140039a50
lea rdx, [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140039824
mov r14d, 0xff
lea r9, [rbp - 0x24]
mov qword [rsp + 0x20], r14
mov r8, r14
lea rdx, [rbp + 0x1f0]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_wcstombs_s]
mov rdx, rsi
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.KERNEL32.dll_lstrcmpA]
test eax, eax
je 0x140039a90
lea rdx, [rbp - 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140039969
or edi, 0xffffffff
test edi, edi
jne 0x140039827
mov eax, dword [str.t_A_G6]
lea r9, [rbp - 0x78]
mov dword [rbp - 0x78], eax
mov r8d, ebx
movzx eax, word [0x140106c08]
mov edi, 0x51eb851f
mov word [rbp - 0x74], ax
mov r14b, Ordinal_50
mov esi, 1
mov eax, edi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
add r8d, esi
sub al, cl
add al, r14b
xor byte [r9], al
add r9, rsi
cmp r8d, 6
jl 0x1400399e0
cmp byte [0x140106b59], bl
movups xmm0, xmmword [str.a_WPED]
movzx eax, word [0x140106b58]
mov word [rsp + 0x60], ax
movups xmmword [rsp + 0x50], xmm0
je 0x140039a4b
lea r8, [rsp + 0x50]
mov eax, edi
mul ebx
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, bl
add ebx, esi
sub al, cl
add al, r14b
xor byte [r8], al
add r8, rsi
cmp ebx, 0x12
jl 0x140039a2a
lea rdx, [rsp + 0x50]
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rbp - 0x78]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor al, al
mov rcx, qword [rbp + 0x2f0]
xor rcx, rsp
call fcn.1400a8aa0
lea r11, [rsp + 0x400]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rdi, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov edi, dword [rbp - 0x48]
jmp 0x1400399b0
lea rdx, [rbp - 0x78]
mov dword [rbp - 0x78], ebx
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov edi, 0x51eb851f
mov r14b, Ordinal_50
test eax, eax
jne 0x140039b2f
movups xmm0, xmmword [0x140106ce8]
movzx eax, word [0x140106d10]
mov r8d, ebx
movups xmm1, xmmword [0x140106cf8]
mov word [rsp + 0x78], ax
lea r9, [rsp + 0x50]
movups xmmword [rsp + 0x50], xmm0
movsd xmm0, qword [0x140106d08]
movsd qword [rsp + 0x70], xmm0
movups xmmword [rsp + 0x60], xmm1
mov eax, edi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
add r8d, esi
sub al, cl
add al, r14b
xor byte [r9], al
add r9, rsi
cmp r8d, 0x2a
jl 0x140039aee
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Error
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140039b51
mov dword [rbp - 0x70], ebx
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_IsWow64Process]
mov eax, dword [rbp - 0x70]
cmp dword [rbp - 0x78], eax
je 0x140039c0a
mov eax, dword [str.t_A_G6]
lea r9, [rbp - 0x78]
mov dword [rbp - 0x78], eax
mov r8d, ebx
movzx eax, word [0x140106c08]
mov word [rbp - 0x74], ax
mov eax, edi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
add r8d, esi
sub al, cl
add al, r14b
xor byte [r9], al
add r9, rsi
cmp r8d, 6
jl 0x140039b6c
movups xmm0, xmmword [str.xEUY_S]
mov eax, dword [0x140106ac8]
lea r8, [rsp + 0x50]
mov dword [rsp + 0x68], eax
mov al, byte [0x140106acc]
movups xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x6c], al
movsd xmm0, qword [0x140106ac0]
movsd qword [rsp + 0x60], xmm0
mov eax, edi
mul ebx
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, bl
add ebx, esi
sub al, cl
add al, r14b
xor byte [r8], al
add r8, rsi
cmp ebx, 0x1d
jl 0x140039bc4
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rbp - 0x78]
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140039a62
mov rcx, r15
call fcn.140036b60
mov rcx, r15
test al, al
jne 0x140039cb1
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [str.t_A_G6]
lea r9, [rbp - 0x78]
mov dword [rbp - 0x78], eax
mov r8d, ebx
movzx eax, word [0x140106c08]
mov word [rbp - 0x74], ax
mov eax, edi
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, r8b
add r8d, esi
sub al, cl
add al, r14b
xor byte [r9], al
add r9, rsi
cmp r8d, 6
jl 0x140039c3e
cmp byte [0x140106b0b], bl
movups xmm0, xmmword [str.t_A_G]
mov eax, dword [0x140106b08]
mov dword [rsp + 0x60], eax
movups xmmword [rsp + 0x50], xmm0
je 0x140039ca7
lea r8, [rsp + 0x50]
mov eax, edi
mul ebx
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x32
mov al, bl
add ebx, esi
sub al, cl
add al, r14b
xor byte [r8], al
add r8, rsi
cmp ebx, 0x14
jl 0x140039c86
lea rdx, [rsp + 0x50]
jmp 0x140039a50
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3