Function at 0x14006bc00
Capabilities:
Encode data using xor
Enumerate processes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x230
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1400dc100]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
xor ebx, ebx
mov rdi, qword [0x1400dfcc8]
movabs rax, 0x54c8a971d593aff9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0xfa16a74616d23073
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xe1a6ff36b3422e9b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0x80c86005b8130bba
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs r15, 0x54bca902d5e6afab
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs r12, 0xfa73a72f16be3030
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0xe1c3ff18b3362ef5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rax, 0x80c86005b8760bc2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x40]
vmovdqu ymmword [rbp + 0x20], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], rbx
mov qword [rbp + 0x58], rbx
lea rax, [rbp + 0x20]
mov r8, 0xffffffffffffffff
vzeroupper
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], bx
jne 0x14006bd30
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x40]
call fcn.140002c40
lea rdx, [rbp + 0x40]
mov rcx, rdi
call fcn.140001790
xor ecx, ecx
call fcn.140096ab8
mov ecx, eax
call fcn.14009550c
mov ecx, 1
call fcn.140083b80
mov qword [rbp], rax
lea rcx, [rbp + 0x18]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14007fda0]
xor edx, edx
xor ecx, ecx
call fcn.140095724
mov qword [rbp + 0x10], rax
test rax, rax
je 0x14006c6c4
mov qword [rbp], rbx
cmp dword [rbp + 0x18], 0
je 0x14006c6b9
movaps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x20], xmm0
lea rcx, [rbp + 0x20]
call fcn.14008376c
test eax, eax
jne 0x14006c6b9
xorps xmm0, xmm0
movaps xmmword [rbp + 0x20], xmm0
movdqa xmmword [rbp + 0x10], xmm0
mov ecx, 1
call fcn.140083b80
mov qword [rbp], rax
lea rcx, [rbp + 0x18]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14007fdc0]
xor edx, edx
xor ecx, ecx
call fcn.140095724
mov qword [rbp + 0x10], rax
test rax, rax
je 0x14006c6ab
mov qword [rbp], rbx
cmp dword [rbp + 0x18], 0
je 0x14006c6a0
movaps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x20], xmm0
lea rcx, [rbp + 0x20]
call fcn.14008376c
test eax, eax
jne 0x14006c6a0
xorps xmm0, xmm0
movaps xmmword [rbp + 0x20], xmm0
movdqa xmmword [rbp + 0x10], xmm0
mov ecx, 1
call fcn.140083b80
mov qword [rbp], rax
lea rcx, [rbp + 0x18]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14007fde0]
xor edx, edx
xor ecx, ecx
call fcn.140095724
mov qword [rbp + 0x10], rax
test rax, rax
je 0x14006c692
mov qword [rbp], rbx
cmp dword [rbp + 0x18], 0
je 0x14006c687
movaps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x20], xmm0
lea rcx, [rbp + 0x20]
call fcn.14008376c
test eax, eax
jne 0x14006c687
xorps xmm0, xmm0
movaps xmmword [rbp + 0x20], xmm0
movdqa xmmword [rbp + 0x10], xmm0
mov ecx, 1
call fcn.140083b80
mov qword [rbp], rax
lea rcx, [rbp + 0x18]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], ebx
mov r9, rax
lea r8, [0x14007fe00]
xor edx, edx
xor ecx, ecx
call fcn.140095724
mov qword [rbp + 0x10], rax
test rax, rax
je 0x14006c679
mov qword [rbp], rbx
cmp dword [rbp + 0x18], 0
je 0x14006c66e
movaps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x20], xmm0
lea rcx, [rbp + 0x20]
call fcn.14008376c
test eax, eax
jne 0x14006c66e
xorps xmm0, xmm0
movaps xmmword [rbp + 0x20], xmm0
movdqa xmmword [rbp + 0x10], xmm0
cmp byte [0x1400df9d9], al
jne 0x14006c38a
movabs r14, 0x31d5c541a195daf9
movabs r13, 0xfa73c2577390445e
nop dword [rax]
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rcx, rax
lea rdx, [rbp]
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov qword [rbp + 0x10], r14
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x10], r13
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x10], r15
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x10], r12
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x28], rax
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x40], xmm0
mov esi, ebx
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14006c009
mov dword [rbp + 0x80], 0x130
lea rdx, [rbp + 0x80]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14006c000
nop word [rax + rax]
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0xac]
call fcn.1400969e8
test eax, eax
je 0x14006bffa
lea rdx, [rbp + 0x80]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14006bfd0
jmp 0x14006c000
mov esi, dword [rbp + 0x88]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, dword [rbp]
je 0x14006c020
cmp byte [0x1400df9d9], 0
je 0x14006bf40
jmp 0x14006c38a
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov rsi, rax
mov r14d, 4
mov rcx, qword gs:[0x58]
mov rdi, qword [rcx]
mov ecx, dword [0x1400dffc8]
cmp ecx, dword [r14 + rdi]
jle 0x14006c0a0
lea rcx, [0x1400dffc8]
call fcn.140084018
mov ecx, dword [0x1400dffc8]
cmp ecx, 0xffffffff
jne 0x14006c0a0
mov qword [0x1400dfd48], rbx
xorps xmm0, xmm0
movdqu xmmword [0x1400dfd50], xmm0
mov qword [0x1400dfd60], rbx
mov qword [0x1400dfd68], 0
lea rcx, [0x1400b5a90]
call fcn.140083de4
lea rcx, [0x1400dffc8]
call fcn.140083fac
mov ecx, dword [0x1400dffc8]
mov qword [0x1400dfd48], rsi
cmp ecx, dword [r14 + rdi]
jle 0x14006c0fe
lea rcx, [0x1400dffc8]
call fcn.140084018
cmp dword [0x1400dffc8], 0xffffffff
jne 0x14006c0fe
mov qword [0x1400dfd48], rbx
xorps xmm0, xmm0
movdqu xmmword [0x1400dfd50], xmm0
mov qword [0x1400dfd60], rbx
mov qword [0x1400dfd68], 0
lea rcx, [0x1400b5a90]
call fcn.140083de4
lea rcx, [0x1400dffc8]
call fcn.140083fac
lea rdx, [rbp + 0x10]
mov rcx, qword [0x1400dfd48]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, dword [0x1400dffc8]
cmp ecx, dword [r14 + rdi]
jle 0x14006c174
lea rcx, [0x1400dffc8]
call fcn.140084018
mov ecx, dword [0x1400dffc8]
cmp ecx, 0xffffffff
jne 0x14006c174
mov qword [0x1400dfd48], rbx
xorps xmm0, xmm0
movdqu xmmword [0x1400dfd50], xmm0
mov qword [0x1400dfd60], rbx
mov qword [0x1400dfd68], 0
lea rcx, [0x1400b5a90]
call fcn.140083de4
lea rcx, [0x1400dffc8]
call fcn.140083fac
mov ecx, dword [0x1400dffc8]
mov eax, dword [rbp + 0x18]
sub eax, dword [rbp + 0x10]
mov dword [0x1400dfd54], eax
cmp ecx, dword [r14 + rdi]
jle 0x14006c1df
lea rcx, [0x1400dffc8]
call fcn.140084018
mov ecx, dword [0x1400dffc8]
cmp ecx, 0xffffffff
jne 0x14006c1df
mov qword [0x1400dfd48], rbx
xorps xmm0, xmm0
movdqu xmmword [0x1400dfd50], xmm0
mov qword [0x1400dfd60], rbx
mov qword [0x1400dfd68], 0
lea rcx, [0x1400b5a90]
call fcn.140083de4
lea rcx, [0x1400dffc8]
call fcn.140083fac
mov ecx, dword [0x1400dffc8]
mov eax, dword [rbp + 0x1c]
sub eax, dword [rbp + 0x14]
mov dword [0x1400dfd50], eax
cmp ecx, dword [r14 + rdi]
jle 0x14006c24a
lea rcx, [0x1400dffc8]
call fcn.140084018
mov ecx, dword [0x1400dffc8]
cmp ecx, 0xffffffff
jne 0x14006c24a
mov qword [0x1400dfd48], rbx
xorps xmm0, xmm0
movdqu xmmword [0x1400dfd50], xmm0
mov qword [0x1400dfd60], rbx
mov qword [0x1400dfd68], 0
lea rcx, [0x1400b5a90]
call fcn.140083de4
lea rcx, [0x1400dffc8]
call fcn.140083fac
mov ecx, dword [0x1400dffc8]
mov eax, dword [rbp + 0x10]
mov dword [0x1400dfd58], eax
cmp ecx, dword [r14 + rdi]
jle 0x14006c2b2
lea rcx, [0x1400dffc8]
call fcn.140084018
mov ecx, dword [0x1400dffc8]
cmp ecx, 0xffffffff
jne 0x14006c2b2
mov qword [0x1400dfd48], rbx
xorps xmm0, xmm0
movdqu xmmword [0x1400dfd50], xmm0
mov qword [0x1400dfd60], rbx
mov qword [0x1400dfd68], 0
lea rcx, [0x1400b5a90]
call fcn.140083de4
lea rcx, [0x1400dffc8]
call fcn.140083fac
mov ecx, dword [0x1400dffc8]
mov eax, dword [rbp + 0x18]
mov dword [0x1400dfd5c], eax
cmp ecx, dword [r14 + rdi]
jle 0x14006c31a
lea rcx, [0x1400dffc8]
call fcn.140084018
mov ecx, dword [0x1400dffc8]
cmp ecx, 0xffffffff
jne 0x14006c31a
mov qword [0x1400dfd48], rbx
xorps xmm0, xmm0
movdqu xmmword [0x1400dfd50], xmm0
mov qword [0x1400dfd60], rbx
mov qword [0x1400dfd68], 0
lea rcx, [0x1400b5a90]
call fcn.140083de4
lea rcx, [0x1400dffc8]
call fcn.140083fac
mov ecx, dword [0x1400dffc8]
mov eax, dword [rbp + 0x14]
mov dword [0x1400dfd60], eax
cmp ecx, dword [r14 + rdi]
jle 0x14006c37a
lea rcx, [0x1400dffc8]
call fcn.140084018
cmp dword [0x1400dffc8], 0xffffffff
jne 0x14006c37a
mov qword [0x1400dfd48], rbx
xorps xmm0, xmm0
movdqu xmmword [0x1400dfd50], xmm0
mov qword [0x1400dfd60], rbx
mov qword [0x1400dfd68], 0
lea rcx, [0x1400b5a90]
call fcn.140083de4
lea rcx, [0x1400dffc8]
call fcn.140083fac
mov eax, dword [rbp + 0x1c]
mov dword [0x1400dfd64], eax
mov byte [0x1400df9d9], 1
mov r8d, 0xb
lea rdi, str.codeine.wtf
mov rdx, rdi
lea rcx, [0x1400dcf28]
call fcn.1400727e0
mov qword [0x1400dfa58], rdi
call fcn.140042fa0
call fcn.140042a70
mov rdi, qword [0x1400df9e0]
mov rcx, qword [rdi + 0xa8]
call fcn.140023220
mov qword [0x1400dfae8], rax
mov rcx, qword [rdi + 0xa8]
movabs rax, 0x3bd8c76b82ba95e8
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x20], rax
movabs rax, 0x8907c94050e24347
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x28], rax
movabs rax, 0x85a19c71de594da9
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x30], rax
movabs rax, 0x80c86005de027fec
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x10], r15
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x10], r12
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x48], rax
movabs rax, 0xe1c3ff18b3362ef5
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x50], rax
movabs rax, 0x80c86005b8760bc2
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x58], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vmovss xmm2, dword [0x1400c9260]
lea rdx, [rbp + 0x20]
vzeroupper
call fcn.140023390
mov qword [0x1400dfae8], rax
movups xmm0, xmmword [0x1400c7e28]
movups xmmword [rbp + 0x40], xmm0
movups xmm1, xmmword [0x1400c7e38]
movups xmmword [rbp + 0x50], xmm1
movsd xmm0, qword [0x1400c7e48]
movsd qword [rbp + 0x60], xmm0
cmp dword [0x1400dc150], 2
jl 0x14006c5e9
movdqa xmm5, xmmword [0x1400c9600]
movdqa xmm4, xmmword [0x1400c9ac0]
movdqa xmm6, xmmword [0x1400c9630]
movdqa xmm0, xmmword [0x1400c96b0]
movdqa xmmword [rbp + 0x20], xmm0
lea rcx, [rbp + 0x40]
movdqa xmm7, xmmword [0x1400c9690]
mov edx, dword [rbp + 0x20]
movd xmm2, ebx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
andps xmm2, xmm7
packuswb xmm2, xmm2
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [rbx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, 5
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
andps xmm3, xmm7
packuswb xmm3, xmm3
packuswb xmm3, xmm3
movd xmm0, edx
paddb xmm3, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm3, xmm0
movd dword [rcx + 4], xmm3
add ebx, 8
lea rcx, [rcx + 8]
cmp ebx, 0x28
jl 0x14006c502
jmp 0x14006c61e
lea r8, [rbp + 0x40]
nop dword [rax]
mov eax, 0x92492493
imul ebx
add edx, ebx
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul edx, eax, 0x38
movzx eax, bl
sub al, dl
add al, 0x37
xor byte [r8], al
inc ebx
lea r8, [r8 + 1]
cmp ebx, 0x28
jl 0x14006c5f0
movss xmm2, dword [0x1400c9254]
lea rdx, [rbp + 0x40]
mov rcx, qword [rdi + 0xa8]
call fcn.140023390
mov qword [0x1400dfae0], rax
mov rcx, qword [rdi + 0xa8]
mov rax, qword [rcx + 0x478]
test rax, rax
jne 0x14006c665
lea rax, [0x140023af0]
mov qword [0x1400dfcd8], rax
lea rax, [0x1400dfcd8]
call qword [rax]
call fcn.140043500
jmp 0x14006c667
mov ecx, 1
call fcn.140082cb0
nop
mov dword [rbp + 0x18], ebx
mov ecx, 6
call fcn.140082cb0
nop
mov ecx, 1
call fcn.140082cb0
nop
mov dword [rbp + 0x18], ebx
mov ecx, 6
call fcn.140082cb0
nop
mov ecx, 1
call fcn.140082cb0
nop
mov dword [rbp + 0x18], ebx
mov ecx, 6
call fcn.140082cb0
nop
mov ecx, 1
call fcn.140082cb0
nop
mov dword [rbp + 0x18], ebx
mov ecx, 6
call fcn.140082cb0
int3