Function at 0x1400036a0
Capabilities:
Encode data using xor
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push rbp
push r12
lea rbp, [rsp - 0x1c8]
sub rsp, 0x2c8
mov rax, qword [0x14002f040]
xor rax, rsp
mov qword [rbp + 0x190], rax
call fcn.14001c0e0
cmp word [0x14001fcea], 0
mov r12d, 0x73
movups xmm0, xmmword [0x14001fcd8]
mov eax, dword [0x14001fce8]
mov dword [rsp + 0x30], eax
movups xmmword [rsp + 0x20], xmm0
je 0x14000372b
xor word [rsp + 0x22], 0x36
xor word [rsp + 0x24], 0x37
xor word [rsp + 0x26], 0x38
xor word [rsp + 0x28], 0x39
xor word [rsp + 0x2a], 0x3a
xor word [rsp + 0x2c], 0x3b
xor word [rsp + 0x2e], 0x3c
xor word [rsp + 0x30], 0x3d
xor word [rsp + 0x32], 0x3e
mov word [rsp + 0x20], r12w
lea rcx, [rsp + 0x20]
call fcn.14001c740
test eax, eax
je 0x140003af4
xor edx, edx
mov qword [rsp + 0x2f0], rdi
mov r8d, 0x234
lea rcx, [rsp + 0x54]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov dword [rsp + 0x50], 0x238
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rcx, rax
lea rdx, [rsp + 0x50]
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x140003ade
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x140003ade
mov qword [rsp + 0x2e0], rbx
mov qword [rsp + 0x2e8], rsi
mov esi, dword [0x14002f088]
mov qword [rsp + 0x2c0], r13
movabs r13, 0x7fffffffffffffff
mov qword [rsp + 0x2b8], r14
movabs r14, 0x4e94914effff
mov qword [rsp + 0x2b0], r15
movabs r15, 0x431bde82d7b634db
movaps xmmword [rsp + 0x2a0], xmm6
nop
cmp word [0x14001fcea], 0
movups xmm0, xmmword [0x14001fcd8]
mov eax, dword [0x14001fce8]
mov dword [rsp + 0x30], eax
movups xmmword [rsp + 0x20], xmm0
je 0x14000384c
xor word [rsp + 0x22], 0x36
xor word [rsp + 0x24], 0x37
xor word [rsp + 0x26], 0x38
xor word [rsp + 0x28], 0x39
xor word [rsp + 0x2a], 0x3a
xor word [rsp + 0x2c], 0x3b
xor word [rsp + 0x2e], 0x3c
xor word [rsp + 0x30], 0x3d
xor word [rsp + 0x32], 0x3e
mov word [rsp + 0x20], r12w
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
je 0x1400039cb
movups xmm3, xmmword [0x14001f8a8]
pextrw eax, xmm3, 7
movups xmmword [rsp + 0x20], xmm3
test ax, ax
je 0x1400039b3
cmp esi, 2
jl 0x14000396d
movdqa xmm2, xmmword [0x140029c80]
movdqa xmm4, xmmword [0x140029db0]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
pmuldq xmm1, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140029cd0]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
movq xmm1, xmm3
movdqa xmm3, xmmword [0x140029c90]
paddw xmm2, xmmword [0x140029d00]
movdqa xmm0, xmm3
xorps xmm2, xmm1
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movq qword [rsp + 0x20], xmm2
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140029cd0]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
movq xmm0, qword [rsp + 0x28]
pshufd xmm2, xmm1, 0xd8
paddw xmm2, xmmword [0x140029d00]
xorps xmm2, xmm0
movq qword [rsp + 0x28], xmm2
jmp 0x1400039b3
lea r8, [rsp + 0x20]
xor ecx, ecx
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x8fb823ef
lea r8, [r8 + 2]
imul ecx
add edx, ecx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movzx eax, dx
imul edx, eax, 0x39
movzx eax, cx
inc ecx
sub ax, dx
add ax, 0x35
xor word [r8 - 2], ax
cmp ecx, 8
jl 0x140003980
lea rdx, [rsp + 0x20]
lea rcx, [rsp + 0x7c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x140003a97
mov r8d, dword [rsp + 0x58]
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rcx, rax
xor edx, edx
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x38]
call fcn.140002850
mov rax, qword [rsp + 0x38]
movabs rcx, 0x7ffffffffa0a1efe
lea rbx, [rax + 0x5f5e100]
cmp rax, rcx
jle 0x140003a20
mov rbx, r13
nop word [rax + rax]
lea rcx, [rsp + 0x40]
call fcn.140002850
mov rax, qword [rsp + 0x40]
cmp rbx, rax
je 0x140003a79
jl 0x140003a79
mov rcx, rbx
sub rcx, rax
cmp rcx, r14
jg 0x140003a6d
mov rax, r15
imul rcx
sar rdx, 0x12
mov rax, rdx
shr rax, 0x3f
add rdx, rax
imul rax, rdx, 0xf4240
cmp rax, rcx
jge 0x140003a64
inc rdx
mov ecx, edx
call sub.KERNEL32.dll_Sleep
jmp 0x140003a20
mov ecx, 0x5265c00
call sub.KERNEL32.dll_Sleep
jmp 0x140003a20
mov edx, 0x190
lea ecx, [rdx - 0x64]
call fcn.140002930
mov eax, eax
lea rcx, [rsp + 0x20]
mov qword [rsp + 0x20], rax
call fcn.14000b0f0
lea rdx, [rsp + 0x50]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x1400037f0
movaps xmm6, xmmword [rsp + 0x2a0]
mov r15, qword [rsp + 0x2b0]
mov r14, qword [rsp + 0x2b8]
mov r13, qword [rsp + 0x2c0]
mov rsi, qword [rsp + 0x2e8]
mov rbx, qword [rsp + 0x2e0]
call fcn.14001c0e0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rsp + 0x2f0]
mov rcx, qword [rbp + 0x190]
xor rcx, rsp
call fcn.14001c890
add rsp, 0x2c8
pop r12
pop rbp
ret