Function at 0x140006f20
Capabilities:
Encode data using xor
Enumerate process modules

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x140039240]
xor rax, rsp
mov qword [rbp + 0x1b8], rax
mov rdi, rdx
mov r13, rcx
mov qword [rsp + 0x40], rdx
cmp dword [rcx + 0x10], 2
jne 0x140007253
mov eax, dword [rcx]
mov dword [rsp + 0x50], eax
cmp qword [rdx + 0x18], 0x10
jb 0x140006f7e
mov r12, qword [rdx]
mov rsi, r12
add r12, qword [rdx + 0x10]
jmp 0x140006f88
mov r12, qword [rdx + 0x10]
add r12, rdi
mov rsi, rdi
xorps xmm0, xmm0
movups xmmword [rbp + 0x190], xmm0
xor r15d, r15d
mov ebx, 7
mov qword [rbp + 0x1a0], r15
mov qword [rbp + 0x1a8], rbx
cmp rsi, r12
jne 0x140006fba
mov word [rbp + 0x190], r15w
jmp 0x140007085
mov rax, r12
sub rax, rsi
mov r14, r15
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
ja 0x140007328
cmp rax, 8
jb 0x140007025
mov rbx, rax
or rbx, 7
cmp rbx, rcx
jbe 0x140006fed
mov rbx, rcx
jmp 0x140006ff9
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
mov rdx, rbx
add rdx, 1
mov rax, 0xffffffffffffffff
cmovb rdx, rax
lea rcx, [rbp + 0x190]
call fcn.1400049f0
mov qword [rbp + 0x190], rax
mov qword [rbp + 0x1a8], rbx
lea rcx, [rbp + 0x190]
cmp rbx, 8
cmovae rcx, qword [rbp + 0x190]
movsx eax, byte [rsi]
mov word [rcx + r14*2], ax
mov r14, qword [rbp + 0x1a0]
inc r14
mov qword [rbp + 0x1a0], r14
inc rsi
cmp rsi, r12
je 0x140007062
mov rbx, qword [rbp + 0x1a8]
jmp 0x140007025
lea rax, [rbp + 0x190]
cmp qword [rbp + 0x1a8], 8
cmovae rax, qword [rbp + 0x190]
mov word [rax + r14*2], r15w
mov rbx, qword [rbp + 0x1a8]
xor edx, edx
mov r8d, 0x208
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x190]
mov rsi, qword [rbp + 0x190]
cmp rbx, 8
cmovae rcx, rsi
lea rdx, [rsp + 0x60]
sub rdx, rcx
nop word [rax + rax]
movzx eax, word [rcx]
mov word [rdx + rcx], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x1400070c0
mov dword [rbp + 0x1b0], r15d
mov dword [rbp + 0x190], 0x258025f
mov dword [rbp + 0x194], 0x25a022b
mov dword [rbp + 0x198], 0x2310263
mov dword [rbp + 0x19c], 0x23f0239
mov dword [rbp + 0x1a0], 0x23a0269
mov dword [rbp + 0x1a4], 0x23d023a
mov word [rbp + 0x1a8], r15w
mov byte [rbp + 0x1aa], 1
mov rcx, r15
mov edx, 0x203
nop word [rax + rax]
lea eax, [rdx + rcx]
xor word [rbp + rcx*2 + 0x190], ax
inc rcx
cmp rcx, 0xc
jb 0x140007130
mov byte [rbp + 0x1aa], 0
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 3]
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x140007215
mov qword [rsp + 0x38], r15
lea rax, [rbp + 0x1b0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x218
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0x218
lea r8, [rsp + 0x50]
mov edx, 0x222410
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, qword [rsp + 0x58]
cmp rbx, 8
jb 0x140007205
lea rbx, [rbx*2 + 2]
mov rdx, rsi
cmp rbx, 0x1000
jb 0x1400071f9
add rbx, 0x27
mov rsi, qword [rsi - 8]
sub rdx, rsi
add rdx, 0xfffffffffffffff8
cmp rdx, 0x1f
ja 0x140007244
mov rdx, rbx
mov rcx, rsi
call fcn.140008290
nop
mov rcx, rdi
call fcn.140004680
mov rax, r14
jmp 0x1400072fe
cmp rbx, 8
jb 0x140007253
lea rdx, [rbx*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14000724b
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000724b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140008290
cmp dword [r13 + 0x10], 1
ja 0x1400072f4
xor edx, edx
mov r8d, 0x234
lea rcx, [rsp + 0x54]
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0x50], 0x238
mov edx, dword [r13]
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400072f4
lea rdx, [rsp + 0x50]
mov rcx, rax
call sub.KERNEL32.dll_Module32First
test eax, eax
je 0x1400072ea
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x1400072ad
mov rdx, qword [rdi]
lea rcx, [rbp - 0x80]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
mov rcx, rbx
test eax, eax
je 0x1400072d2
mov dword [rsp + 0x50], 0x238
lea rdx, [rsp + 0x50]
call sub.KERNEL32.dll_Module32Next
jmp 0x14000729c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x78]
mov rcx, rdi
call fcn.140004680
mov rax, rbx
jmp 0x1400072fe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rcx, rdi
call fcn.140004680
xor eax, eax
mov rcx, qword [rbp + 0x1b8]
xor rcx, rsp
call fcn.140007f10
mov rbx, qword [rsp + 0x310]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140004530
nop
int3