Function at 0x1400914b0
Capabilities:
Encode data using xor
Enumerate process modules
Enumerate processes
Hash data using fnv

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x26c0]
mov eax, 0x27c0
call fcn.140095c10
sub rsp, rax
mov rax, qword [0x1403687c8]
xor rax, rsp
mov qword [rbp + 0x26b0], rax
movzx r13d, r8b
mov r14, rdx
mov qword [rsp + 0x58], rdx
mov r15, rcx
mov qword [rsp + 0x68], rdx
mov rbx, qword [rcx]
mov rdi, qword [rcx + 8]
cmp rbx, rdi
je 0x14009151e
mov rcx, rbx
call fcn.140090f70
add rbx, 0x38
cmp rbx, rdi
jne 0x140091506
mov rax, qword [r15]
mov qword [r15 + 8], rax
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x474]
call fcn.140097f00
mov dword [rbp + 0x470], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r12, rax
lea rdx, [rbp + 0x470]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
xor esi, esi
lea rbx, [rsi - 1]
movabs rcx, 0x7ffffffffffffffe
lea edx, [rsi + 0xa]
test eax, eax
je 0x1400918ad
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d8], xmm0
mov qword [rbp + 0x3e8], rsi
mov qword [rbp + 0x3f0], rsi
lea rax, [rbp + 0x49c]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140091592
cmp rbx, rcx
ja 0x140091f96
mov qword [rbp + 0x3f0], 7
cmp rbx, 8
jae 0x1400915e0
mov qword [rbp + 0x3e8], rbx
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x49c]
lea rcx, [rbp + 0x3d8]
call fcn.140097850
mov word [rbp + rbx + 0x3d8], si
jmp 0x14009163c
mov rsi, rbx
or rsi, 7
cmp rsi, rcx
jbe 0x1400915f1
mov rsi, rcx
jmp 0x1400915f9
cmp rsi, 0xa
cmovb rsi, rdx
lea rdx, [rsi + 1]
lea rcx, [rbp + 0x3d8]
call fcn.140092490
mov rdi, rax
mov qword [rbp + 0x3d8], rax
mov qword [rbp + 0x3e8], rbx
mov qword [rbp + 0x3f0], rsi
add rbx, rbx
mov r8, rbx
lea rdx, [rbp + 0x49c]
mov rcx, rax
call fcn.140097850
xor esi, esi
mov word [rbx + rdi], si
lea rcx, [rbp + 0x3d8]
mov r9, qword [rbp + 0x3f0]
cmp r9, 8
setae dl
mov r8, qword [rbp + 0x3d8]
cmovae rcx, r8
mov rax, qword [rbp + 0x3e8]
lea r14, [rcx + rax*2]
lea rdi, [rbp + 0x3d8]
test dl, dl
cmovne rdi, r8
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], rsi
cmp rdi, r14
jne 0x14009169b
mov r10d, recv
mov qword [rsp + 0x50], r10
mov byte [rsp + 0x38], 0
jmp 0x14009176c
mov rax, r14
sub rax, rdi
sar rax, 1
mov ebx, recv
mov qword [rsp + 0x50], rbx
movabs rcx, 0x7fffffffffffffff
cmp rax, rcx
ja 0x140091f90
cmp rax, 0x10
jb 0x140091710
mov rbx, rax
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400916d8
mov rbx, rcx
jmp 0x1400916e5
cmp rbx, 0x16
mov eax, socket
cmovb rbx, rax
mov rdx, rbx
add rdx, 1
mov rax, 0xffffffffffffffff
cmovb rdx, rax
lea rcx, [rsp + 0x38]
call fcn.14006be50
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x50], rbx
nop dword [rax + rax]
lea rcx, [rsp + 0x38]
cmp rbx, 0x10
cmovae rcx, qword [rsp + 0x38]
movzx eax, byte [rdi]
mov byte [rcx + rsi], al
mov rsi, qword [rsp + 0x48]
inc rsi
mov qword [rsp + 0x48], rsi
add rdi, 2
cmp rdi, r14
je 0x140091742
mov rbx, qword [rsp + 0x50]
jmp 0x140091710
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x50], 0x10
cmovae rax, qword [rsp + 0x38]
mov byte [rsi + rax], 0
mov r9, qword [rbp + 0x3f0]
mov r8, qword [rbp + 0x3d8]
mov r10, qword [rsp + 0x50]
xor esi, esi
mov r14, qword [rsp + 0x58]
mov rdx, r14
cmp qword [r14 + 0x18], 0x10
jb 0x14009177e
mov rdx, qword [r14]
lea rax, [rsp + 0x38]
cmp r10, 0x10
setae dil
mov r11, qword [rsp + 0x38]
cmovae rax, r11
sub rdx, rax
nop word [rax + rax]
movzx ebx, byte [rax]
movzx ecx, byte [rax + rdx]
sub ebx, ecx
jne 0x1400917b2
inc rax
test ecx, ecx
jne 0x1400917a0
test dil, dil
je 0x1400917f6
lea rdx, [r10 + 1]
mov rax, r11
cmp rdx, 0x1000
jb 0x1400917e0
add rdx, 0x27
mov r11, qword [r11 - 8]
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140091f84
mov rcx, r11
call fcn.140095600
mov r9, qword [rbp + 0x3f0]
mov r8, qword [rbp + 0x3d8]
test ebx, ebx
je 0x140091861
cmp r9, 8
jb 0x140091835
lea rdx, [r9*2 + 2]
mov rax, r8
cmp rdx, 0x1000
jb 0x14009182d
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140091f8a
mov rcx, r8
call fcn.140095600
lea rdx, [rbp + 0x470]
mov rcx, r12
call sub.KERNEL32.dll_Process32NextW
mov rbx, 0xffffffffffffffff
test eax, eax
je 0x1400918ad
movabs rcx, 0x7ffffffffffffffe
lea edx, [rbx + 0xb]
jmp 0x140091573
mov eax, dword [rbp + 0x478]
mov dword [r15 + 0x20], eax
cmp r9, 8
jb 0x1400918a6
lea rdx, [r9*2 + 2]
mov rax, r8
cmp rdx, 0x1000
jb 0x14009189e
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140091f8a
mov rcx, r8
call fcn.140095600
mov rbx, 0xffffffffffffffff
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [r15 + 0x20], 0
je 0x140091f4a
mov rcx, r15
call fcn.140091fc0
test al, al
je 0x140091f4a
mov rcx, qword [r15 + 0x18]
lea rax, [rcx - 1]
cmp rax, 0xfffffffffffffffd
ja 0x140091f4a
test r13b, r13b
jne 0x140091d3b
xor edx, edx
mov r8d, 0x434
lea rcx, [rsp + 0x74]
call fcn.140097f00
mov dword [rsp + 0x70], 0x438
mov edx, dword [r15 + 0x20]
mov ecx, 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Module32FirstW
cmp rdi, 0xffffffffffffffff
jne 0x140091980
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x140091969
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x140091964
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140091fae
mov rcx, r8
call fcn.140095600
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], recv
mov byte [r14], 0
jmp 0x140091f52
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x430], xmm0
movups xmmword [rbp + 0x450], xmm0
mov qword [rbp + 0x460], rax
movups xmmword [rbp + 0x440], xmm0
mov qword [rbp + 0x450], rsi
mov r14d, recv
mov qword [rbp + 0x458], r14
mov byte [rbp + 0x440], al
mov r12, qword [rbp - 0x78]
mov qword [rbp + 0x430], r12
mov r13d, dword [rsp + 0x70]
mov qword [rbp + 0x438], r13
movups xmmword [rbp + 0x3b8], xmm0
mov qword [rbp + 0x3c8], rsi
mov qword [rbp + 0x3d0], rsi
lea rax, [rbp - 0x60]
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x1400919f0
movabs rax, 0x7ffffffffffffffe
cmp rbx, rax
ja 0x140091fb4
mov qword [rbp + 0x3d0], 7
cmp rbx, 8
jae 0x140091a45
mov qword [rbp + 0x3c8], rbx
add rbx, rbx
mov r8, rbx
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x3b8]
call fcn.140097850
mov word [rbp + rbx + 0x3b8], si
jmp 0x140091aa8
mov rsi, rbx
or rsi, 7
cmp rsi, rax
jbe 0x140091a56
mov rsi, rax
jmp 0x140091a63
cmp rsi, 0xa
mov eax, 0xa
cmovb rsi, rax
lea rdx, [rsi + 1]
lea rcx, [rbp + 0x3b8]
call fcn.140092490
mov rdi, rax
mov qword [rbp + 0x3b8], rax
mov qword [rbp + 0x3c8], rbx
mov qword [rbp + 0x3d0], rsi
add rbx, rbx
mov r8, rbx
lea rdx, [rbp - 0x60]
mov rcx, rax
call fcn.140097850
xor esi, esi
mov word [rdi + rbx], si
mov rdi, qword [rsp + 0x60]
lea rdx, [rbp + 0x3b8]
cmp qword [rbp + 0x3d0], 8
setae r9b
cmovae rdx, qword [rbp + 0x3b8]
mov rax, qword [rbp + 0x3c8]
lea r8, [rdx + rax*2]
lea rdx, [rbp + 0x3b8]
test r9b, r9b
cmovne rdx, qword [rbp + 0x3b8]
lea r9, [rsp + 0x30]
lea rcx, [rbp + 0x3f8]
call fcn.140090740
lea rcx, [rbp + 0x440]
cmp rcx, rax
je 0x140091b2b
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x440], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x450], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], recv
mov byte [rax], 0
psrldq xmm1, 8
movq r14, xmm1
mov rdx, qword [rbp + 0x410]
cmp rdx, 0x10
jb 0x140091b6c
inc rdx
mov rcx, qword [rbp + 0x3f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140091b67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140091f9c
call fcn.140095600
lea rcx, [rbp + 0x440]
cmp r14, 0x10
setae r9b
mov rdx, qword [rbp + 0x440]
cmovae rcx, rdx
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140091b90
lea r8, [rbp + 0x440]
test r9b, r9b
cmovne r8, rdx
mov edx, 0x811c9dc5
mov r9d, eax
mov rcx, rsi
test eax, eax
je 0x140091bd5
nop word [rax + rax]
movzx eax, byte [rcx + r8]
xor eax, edx
imul edx, eax, 0x1000193
inc rcx
cmp rcx, r9
jb 0x140091bc0
mov dword [rbp + 0x460], edx
mov rbx, qword [r15 + 8]
cmp rbx, qword [r15 + 0x10]
je 0x140091c0c
mov qword [rbx], r12
mov qword [rbx + 8], r13
lea rcx, [rbx + 0x10]
lea rdx, [rbp + 0x440]
call fcn.14006afd0
mov eax, dword [rbp + 0x460]
mov dword [rbx + 0x30], eax
add qword [r15 + 8], 0x38
jmp 0x140091c1f
lea r8, [rbp + 0x430]
mov rdx, rbx
mov rcx, r15
call fcn.140090880
nop
mov rdx, qword [rbp + 0x3d0]
cmp rdx, 8
jb 0x140091c65
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x3b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140091c60
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140091fa2
call fcn.140095600
mov qword [rbp + 0x3c8], rsi
mov qword [rbp + 0x3d0], 7
mov word [rbp + 0x3b8], si
mov rdx, qword [rbp + 0x458]
cmp rdx, 0x10
jb 0x140091cbf
inc rdx
mov rcx, qword [rbp + 0x440]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140091cba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140091fa8
call fcn.140095600
lea rdx, [rsp + 0x70]
mov rcx, rdi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
je 0x140091cdc
mov rbx, 0xffffffffffffffff
jmp 0x140091980
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rbx, qword [rsp + 0x58]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x140091d25
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x140091d20
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140091fae
mov rcx, r8
call fcn.140095600
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], recv
mov byte [rbx], 0
mov al, 1
jmp 0x140091f54
mov dword [rbp + 0x3b0], esi
mov dword [rsp + 0x20], 3
lea r9, [rbp + 0x3b0]
mov r8d, 0x2000
lea rdx, [rbp + 0x6b0]
call sub.KERNEL32.dll_K32EnumProcessModulesEx
test eax, eax
je 0x140091f3e
mov eax, dword [rbp + 0x3b0]
test rax, 0xfffffffffffffff8
jbe 0x140091f3e
lea rdi, [rbp + 0x6b0]
xor r12d, r12d
nop word [rax + rax]
mov r9d, 0x82
lea r8, [rsp + 0x70]
mov rdx, qword [rdi]
mov rcx, qword [r15 + 0x18]
call sub.KERNEL32.dll_K32GetModuleFileNameExA
test eax, eax
je 0x140091f1a
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x3f8], xmm0
movups xmmword [rbp + 0x418], xmm0
mov qword [rbp + 0x428], rax
movups xmmword [rbp + 0x408], xmm0
mov qword [rbp + 0x418], r12
mov qword [rbp + 0x420], recv
mov byte [rbp + 0x408], al
mov rax, qword [rdi]
mov qword [rbp + 0x3f8], rax
mov qword [rbp + 0x400], rbx
lea rax, [rsp + 0x70]
mov r8, rbx
inc r8
cmp byte [rax + r8], 0
jne 0x140091e01
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x408]
call fcn.14007f860
lea rcx, [rbp + 0x408]
cmp qword [rbp + 0x420], 0x10
setae r9b
mov rdx, qword [rbp + 0x408]
cmovae rcx, rdx
mov rax, rbx
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140091e40
lea r8, [rbp + 0x408]
test r9b, r9b
cmovne r8, rdx
mov edx, 0x811c9dc5
mov r9d, eax
mov rcx, r12
test eax, eax
je 0x140091e85
nop word [rax + rax]
movzx eax, byte [rcx + r8]
xor eax, edx
imul edx, eax, 0x1000193
inc rcx
cmp rcx, r9
jb 0x140091e70
mov dword [rbp + 0x428], edx
mov rbx, qword [r15 + 8]
cmp rbx, qword [r15 + 0x10]
je 0x140091eca
mov rax, qword [rbp + 0x3f8]
mov qword [rbx], rax
mov rax, qword [rbp + 0x400]
mov qword [rbx + 8], rax
lea rcx, [rbx + 0x10]
lea rdx, [rbp + 0x408]
call fcn.14006afd0
mov eax, dword [rbp + 0x428]
mov dword [rbx + 0x30], eax
add qword [r15 + 8], 0x38
jmp 0x140091edd
lea r8, [rbp + 0x3f8]
mov rdx, rbx
mov rcx, r15
call fcn.140090880
nop
mov rdx, qword [rbp + 0x420]
cmp rdx, 0x10
jb 0x140091f1a
inc rdx
mov rcx, qword [rbp + 0x408]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140091f15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140091f7e
call fcn.140095600
inc esi
add rdi, 8
mov ecx, dword [rbp + 0x3b0]
shr rcx, 3
movsxd rax, esi
cmp rax, rcx
jae 0x140091f3e
mov rbx, 0xffffffffffffffff
jmp 0x140091d90
mov rcx, r14
call fcn.14006b250
mov al, 1
jmp 0x140091f54
mov rcx, r14
call fcn.14006b250
xor al, al
mov rcx, qword [rbp + 0x26b0]
xor rcx, rsp
call fcn.140095720
mov rbx, qword [rsp + 0x2810]
add rsp, 0x27c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400aa2d0
nop
call fcn.1400aa2d0
nop
call fcn.1400aa2d0
nop
call fcn.14006be30
nop
call fcn.14006be30
nop
call fcn.1400aa2d0
nop
call fcn.1400aa2d0
nop
call fcn.1400aa2d0
nop
call fcn.1400aa2d0
nop
call fcn.14006be30
int3