Function at 0x140004550
Capabilities:
Encode data using xor
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
push rbp
lea rbp, [rsp - 0xc0]
sub rsp, 0x1c0
mov rax, qword [0x1400bb088]
xor rax, rsp
mov qword [rbp + 0xb0], rax
movdqa xmm0, xmmword [0x1400ad130]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x85
mov byte [rsp + 0x32], 1
xor ebx, ebx
mov ecx, ebx
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x11
jb 0x1400045a0
mov byte [rsp + 0x32], bl
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140004e2b
mov dword [rsp + 0x20], 0x90a090a9
mov dword [rsp + 0x24], 0x9b8d978b
mov word [rsp + 0x28], 0x100
mov rcx, rbx
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 8
jb 0x1400045f0
mov byte [rsp + 0x29], bl
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140004e48
movdqa xmm0, xmmword [0x1400ad160]
movdqu xmmword [rsp + 0x20], xmm0
mov dword [rsp + 0x30], 0x879b8486
mov dword [rsp + 0x34], 0x97b9d79d
mov dword [rsp + 0x38], 0x8785979b
mov dword [rsp + 0x3c], 0x1008d9b
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x1e
jb 0x140004650
mov byte [rsp + 0x3f], bl
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140004e65
mov dword [rsp + 0x20], 0x868b91b2
mov dword [rsp + 0x24], 0xc99b9483
mov dword [rsp + 0x28], 0x868f8aa2
mov dword [rsp + 0x2c], 0x1009d8b
mov rcx, rbx
nop dword [rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0xe
jb 0x1400046a0
mov byte [rsp + 0x2f], bl
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140004e82
movdqa xmm0, xmmword [0x1400ad1e0]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400acee0]
movdqu xmmword [rsp + 0x30], xmm1
mov dword [rsp + 0x40], 0x77616465
mov word [rsp + 0x44], 0x100
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x24
jb 0x140004700
mov byte [rsp + 0x45], bl
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140004e9f
mov dword [rsp + 0x20], 0x818a8aa4
mov dword [rsp + 0x24], 0x9b8d8b82
mov word [rsp + 0x28], 0x100
mov rcx, rbx
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 8
jb 0x140004750
mov byte [rsp + 0x29], bl
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140004ebc
mov dword [rsp + 0x20], 0xb4d197b3
mov dword [rsp + 0x24], 0x8d868eb1
mov dword [rsp + 0x28], 0x8ea59c85
mov dword [rsp + 0x2c], 0x1008181
mov rcx, rbx
nop dword [rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0xe
jb 0x1400047a0
mov byte [rsp + 0x2f], bl
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140004ed9
mov dword [rsp + 0x20], 0xb5b0b7aa
mov dword [rsp + 0x24], 0x8b8da3c6
mov dword [rsp + 0x28], 0x888b8c9f
mov word [rsp + 0x2c], 0x9c
mov byte [rsp + 0x2e], 1
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0xd
jb 0x140004800
mov byte [rsp + 0x2e], bl
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140004ef6
mov dword [rsp + 0x20], 0x95b78d86
mov word [rsp + 0x24], 0x9f
mov byte [rsp + 0x26], 1
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 5
jb 0x140004850
mov byte [rsp + 0x26], bl
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140004f13
movdqa xmm0, xmmword [0x1400ad130]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x85
mov byte [rsp + 0x32], 1
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x11
jb 0x1400048a0
mov byte [rsp + 0x32], bl
xor edx, edx
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140004f30
mov dword [rsp + 0x20], 0xa09baa
mov byte [rsp + 0x24], 1
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 3
jb 0x1400048e0
mov byte [rsp + 0x24], bl
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140004f4d
movdqa xmm0, xmmword [0x1400ad3b0]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x100
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x10
jb 0x140004930
mov byte [rsp + 0x31], bl
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140004f6a
movdqa xmm0, xmmword [0x1400ad380]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x100
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x10
jb 0x140004980
mov byte [rsp + 0x31], bl
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140004f87
movdqa xmm0, xmmword [0x1400ad390]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x100
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x10
jb 0x1400049d0
mov byte [rsp + 0x31], bl
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140004fa4
movdqa xmm0, xmmword [0x1400ad3f0]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x100
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x10
jb 0x140004a20
mov byte [rsp + 0x31], bl
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140004fc1
movdqa xmm0, xmmword [0x1400ad400]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x100
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x10
jb 0x140004a70
mov byte [rsp + 0x31], bl
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140004fde
mov dword [rsp + 0x20], 0x8587ab
mov byte [rsp + 0x24], 1
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 3
jb 0x140004ab0
mov byte [rsp + 0x24], bl
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140004ffb
mov dword [rsp + 0x20], 0xc58587ab
mov dword [rsp + 0x24], 0x8795b6
mov byte [rsp + 0x28], 1
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 7
jb 0x140004b00
mov byte [rsp + 0x28], bl
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140005018
mov dword [rsp + 0x20], 0xc58587ab
mov dword [rsp + 0x24], 0x8c8d95a0
mov dword [rsp + 0x28], 0x889e8a9d
mov word [rsp + 0x2c], 0x100
mov rcx, rbx
nop dword [rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0xc
jb 0x140004b50
mov byte [rsp + 0x2d], bl
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140005035
movdqa xmm0, xmmword [0x1400ad060]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x9d
mov byte [rsp + 0x32], 1
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x11
jb 0x140004ba0
mov byte [rsp + 0x32], bl
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140005052
mov dword [rsp + 0x20], 0x868b91b2
mov dword [rsp + 0x24], 0xa19b9483
mov dword [rsp + 0x28], 0x8887888b
mov word [rsp + 0x2c], 0x9c
mov byte [rsp + 0x2e], 1
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0xd
jb 0x140004c00
mov byte [rsp + 0x2e], bl
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14000506f
movdqa xmm0, xmmword [0x1400ad3a0]
movdqu xmmword [rsp + 0x20], xmm0
mov word [rsp + 0x30], 0x100
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x10
jb 0x140004c50
mov byte [rsp + 0x31], bl
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14000508c
mov dword [rsp + 0x20], 0x9c888fad
mov dword [rsp + 0x24], 0x8f85a2
mov byte [rsp + 0x28], 1
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 7
jb 0x140004ca0
mov byte [rsp + 0x28], bl
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x1400050a9
movdqa xmm0, xmmword [0x1400ad0e0]
movdqu xmmword [rsp + 0x20], xmm0
movdqa xmm1, xmmword [0x1400ac630]
movdqu xmmword [rsp + 0x30], xmm1
movdqa xmm0, xmmword [0x1400ac730]
movdqu xmmword [rsp + 0x40], xmm0
mov dword [rsp + 0x50], 0x4a222b6a
mov dword [rsp + 0x54], 0x312320
mov byte [rsp + 0x58], 1
mov rcx, rbx
nop dword [rax]
lea eax, [rcx - 0x1e]
xor byte [rsp + rcx + 0x20], al
inc rcx
cmp rcx, 0x37
jb 0x140004d10
mov byte [rsp + 0x58], bl
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140004e0e
mov dword [rsp + 0x20], 0x8885818f
mov dword [rsp + 0x24], 0x8c9082c8
mov dword [rsp + 0x28], 0xcd9e84ca
mov word [rsp + 0x2c], 0x100
nop dword [rax]
lea eax, [rbx - 0x1e]
xor byte [rsp + rbx + 0x20], al
inc rbx
cmp rbx, 0xc
jb 0x140004d60
mov byte [rsp + 0x2d], 0
mov dword [rbp - 0x80], 0x130
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140004dee
lea rdx, [rbp - 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
cmp eax, 1
jne 0x140004de5
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
jne 0x140004de5
nop dword [rax]
nop dword [rax + rax]
lea rdx, [rsp + 0x20]
lea rcx, [rbp - 0x54]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140004de5
lea rdx, [rbp - 0x80]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
cmp eax, 1
je 0x140004dc0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0xb0]
xor rcx, rsp
call fcn.140080f30
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x1c0
pop rbp
ret
lea rdx, str.Detect_It_Easy_v3.07__Windows_10_Version_2009___x86_64_
lea rcx, [rsp + 0x60]
call fcn.140003560
nop
lea rcx, [rsp + 0x60]
call fcn.1400042e0
nop
lea rdx, str.FolderChangesView
lea rcx, [rsp + 0x60]
call fcn.140003560
nop
lea rcx, [rsp + 0x60]
call fcn.1400042e0
nop
lea rdx, str.KsDumper
lea rcx, [rsp + 0x60]
call fcn.140003560
nop
lea rcx, [rsp + 0x60]
call fcn.1400042e0
nop
lea rdx, str.The_Wireshark_Network_Analyzer
lea rcx, [rsp + 0x60]
call fcn.140003560
nop
lea rcx, [rsp + 0x60]
call fcn.1400042e0
nop
lea rdx, str.Process_Hacker
lea rcx, [rsp + 0x60]
call fcn.140003560
nop
lea rcx, [rsp + 0x60]
call fcn.1400042e0
nop
lea rdx, str.Progress_Telerik_Folder_Web_Debugger
lea rcx, [rsp + 0x60]
call fcn.140003560
nop
lea rcx, [rsp + 0x60]
call fcn.1400042e0
nop
lea rdx, str.Finddler
lea rcx, [rsp + 0x60]
call fcn.140003560
nop
lea rcx, [rsp + 0x60]
call fcn.1400042e0
nop
lea rdx, str.Vmprotect__X64dbg__Themida__3d_printing_software__close_all_softwares_with_a_gui
lea rcx, [rsp + 0x60]
call fcn.140003560
nop
lea rcx, [rsp + 0x60]
call fcn.1400042e0
nop
lea rdx, str.HTTP_Debugger
lea rcx, [rsp + 0x60]
call fcn.140003560
nop
lea rcx, [rsp + 0x60]
call fcn.1400042e0
nop
lea rdx, str.dnSpy
lea rcx, [rsp + 0x60]
call fcn.140003560
nop
lea rcx, [rsp + 0x60]
call fcn.1400042e0
nop
lea rdx, str.FolderChangesView
lea rcx, [rsp + 0x60]
call fcn.140003560
nop
lea rcx, [rsp + 0x60]
call fcn.1400042e0
nop
lea rdx, [0x140096d20]
lea rcx, [rsp + 0x60]
call fcn.140003560
nop
lea rcx, [rsp + 0x60]
call fcn.1400042e0
nop
lea rdx, str.Cheat_Engine_7.2
lea rcx, [rsp + 0x60]
call fcn.140003560
nop
lea rcx, [rsp + 0x60]
call fcn.1400042e0
nop
lea rdx, str.Cheat_Engine_7.1
lea rcx, [rsp + 0x60]
call fcn.140003560
nop
lea rcx, [rsp + 0x60]
call fcn.1400042e0
nop
lea rdx, str.Cheat_Engine_7.0
lea rcx, [rsp + 0x60]
call fcn.140003560
nop
lea rcx, [rsp + 0x60]
call fcn.1400042e0
nop
lea rdx, str.Cheat_Engine_6.9
lea rcx, [rsp + 0x60]
call fcn.140003560
nop
lea rcx, [rsp + 0x60]
call fcn.1400042e0
nop
lea rdx, str.Cheat_Engine_6.8
lea rcx, [rsp + 0x60]
call fcn.140003560
nop
lea rcx, [rsp + 0x60]
call fcn.1400042e0
nop
lea rdx, [0x140096d9c]
lea rcx, [rsp + 0x60]
call fcn.140003560
nop
lea rcx, [rsp + 0x60]
call fcn.1400042e0
nop
lea rdx, str.Ida_Pro
lea rcx, [rsp + 0x60]
call fcn.140003560
nop
lea rcx, [rsp + 0x60]
call fcn.1400042e0
nop
lea rdx, str.Ida_Freeware
lea rcx, [rsp + 0x60]
call fcn.140003560
nop
lea rcx, [rsp + 0x60]
call fcn.1400042e0
nop
lea rdx, str.HTTP_Debugger_Pro
lea rcx, [rsp + 0x60]
call fcn.140003560
nop
lea rcx, [rsp + 0x60]
call fcn.1400042e0
nop
lea rdx, str.ProcessHacker
lea rcx, [rsp + 0x60]
call fcn.140003560
nop
lea rcx, [rsp + 0x60]
call fcn.1400042e0
nop
lea rdx, str.Process_Hacker_2
lea rcx, [rsp + 0x60]
call fcn.140003560
nop
lea rcx, [rsp + 0x60]
call fcn.1400042e0
nop
lea rdx, str.OllyDbg
lea rcx, [rsp + 0x60]
call fcn.140003560
nop
lea rcx, [rsp + 0x60]
call fcn.1400042e0
int3