Function at 0x1401c3670
Capabilities:
Encode data using xor
Enumerate processes
Generate random numbers using a mersenne twister

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3c40]
mov eax, 0x3d40
call fcn.1402361c0
sub rsp, rax
mov rax, qword [0x140275028]
xor rax, rsp
mov qword [rbp + 0x3c30], rax
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x40], 0x238
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x1504], 0xffffffff
mov edx, 1
mov dword [rbp + 0x184], eax
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0x184], eax
inc rdx
cmp rdx, 0x270
jb 0x1401c36e0
mov dword [rbp + 0x180], 0x270
mov dword [rsp + 0x20], 0
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1401c3732
imul rax, rax, 0x64
jmp 0x1401c374d
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
lea r14, [rax + 0x5f5e100]
mov r13d, 0x80000000
mov r12d, 1
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1401c377e
imul rax, rax, 0x64
jmp 0x1401c3799
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r14
jge 0x1401c3955
mov esi, 0x186a0
nop word [rax + rax]
lea rcx, [rbp + 0x180]
call fcn.14021dbf0
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x63
ja 0x1401c37ea
nop word [rax + rax]
lea rcx, [rbp + 0x180]
call fcn.14021dbf0
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401c37d0
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
cmp ecx, r13d
lea eax, [rcx + r13]
lea ebx, [rcx - 0x80000000]
cmovae ebx, eax
lea rcx, [rbp + 0x180]
test ebx, ebx
cmove ebx, r12d
call fcn.14021dbf0
mov ecx, eax
mov edi, ebx
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x1401c384a
cmp eax, 0x64
jae 0x1401c384a
nop dword [rax]
lea rcx, [rbp + 0x180]
call fcn.14021dbf0
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401c3830
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
lea eax, [rcx + r13]
cmp ecx, r13d
lea edx, [rcx - 0x80000000]
cmovae edx, eax
lea rcx, [rbp + 0x180]
mov eax, dword [rsp + 0x20]
add edx, eax
mov dword [rsp + 0x20], edx
call fcn.14021dbf0
mov ecx, eax
mov ebx, edi
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x1401c38ab
cmp eax, 0x64
jae 0x1401c38ab
lea rcx, [rbp + 0x180]
call fcn.14021dbf0
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401c3891
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
lea eax, [rcx + r13]
cmp ecx, r13d
lea edx, [rcx - 0x80000000]
cmovae edx, eax
lea rcx, [rbp + 0x180]
mov eax, dword [rsp + 0x20]
imul edx, eax
mov dword [rsp + 0x20], edx
call fcn.14021dbf0
mov ecx, eax
mov edi, ebx
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x1401c390d
cmp eax, 0x64
jae 0x1401c390d
lea rcx, [rbp + 0x180]
call fcn.14021dbf0
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401c38f3
shr rax, 0x20
lea edx, [rax + 0x7fffff9c]
cmp edx, r13d
lea eax, [rdx + r13]
lea ecx, [rdx - 0x80000000]
cmovae ecx, eax
mov eax, dword [rsp + 0x20]
sub eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cdq
idiv edi
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cdq
idiv edi
mov dword [rsp + 0x20], edx
sub rsi, r12
jne 0x1401c37b0
jmp 0x1401c3760
mov eax, dword [rsp + 0x20]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r15, rax
mov qword [rsp + 0x30], rax
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x2894], 0xffffffff
mov rdx, r12
mov dword [rbp + 0x1514], eax
nop word [rax + rax]
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0x1514], eax
inc rdx
cmp rdx, 0x270
jb 0x1401c3990
mov dword [rbp + 0x1510], 0x270
mov dword [rsp + 0x20], 0
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1401c39e2
imul rax, rax, 0x64
jmp 0x1401c39fd
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
lea r14, [rax + 0x5f5e100]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1401c3a22
imul rax, rax, 0x64
jmp 0x1401c3a3d
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r14
jge 0x1401c3bf5
mov esi, 0x186a0
nop dword [rax + rax]
lea rcx, [rbp + 0x1510]
call fcn.14021dbf0
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x63
ja 0x1401c3a8a
nop word [rax + rax]
lea rcx, [rbp + 0x1510]
call fcn.14021dbf0
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401c3a70
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
cmp ecx, r13d
lea eax, [rcx + r13]
lea ebx, [rcx - 0x80000000]
cmovae ebx, eax
lea rcx, [rbp + 0x1510]
test ebx, ebx
cmove ebx, r12d
call fcn.14021dbf0
mov ecx, eax
mov edi, ebx
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x1401c3aea
cmp eax, 0x64
jae 0x1401c3aea
nop dword [rax]
lea rcx, [rbp + 0x1510]
call fcn.14021dbf0
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401c3ad0
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
lea eax, [rcx + r13]
cmp ecx, r13d
lea edx, [rcx - 0x80000000]
cmovae edx, eax
lea rcx, [rbp + 0x1510]
mov eax, dword [rsp + 0x20]
add edx, eax
mov dword [rsp + 0x20], edx
call fcn.14021dbf0
mov ecx, eax
mov ebx, edi
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x1401c3b4b
cmp eax, 0x64
jae 0x1401c3b4b
lea rcx, [rbp + 0x1510]
call fcn.14021dbf0
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401c3b31
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
lea eax, [rcx + r13]
cmp ecx, r13d
lea edx, [rcx - 0x80000000]
cmovae edx, eax
lea rcx, [rbp + 0x1510]
mov eax, dword [rsp + 0x20]
imul edx, eax
mov dword [rsp + 0x20], edx
call fcn.14021dbf0
mov ecx, eax
mov edi, ebx
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x1401c3bad
cmp eax, 0x64
jae 0x1401c3bad
lea rcx, [rbp + 0x1510]
call fcn.14021dbf0
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401c3b93
shr rax, 0x20
lea edx, [rax + 0x7fffff9c]
cmp edx, r13d
lea eax, [rdx + r13]
lea ecx, [rdx - 0x80000000]
cmovae ecx, eax
mov eax, dword [rsp + 0x20]
sub eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cdq
idiv edi
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cdq
idiv edi
mov dword [rsp + 0x20], edx
sub rsi, r12
jne 0x1401c3a50
jmp 0x1401c3a04
mov eax, dword [rsp + 0x20]
lea rdx, [rsp + 0x40]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, r12d
mov r12, qword [rsp + 0x28]
jne 0x1401c3c55
lea rdx, [rsp + 0x40]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
jne 0x1401c3c55
nop dword [rax]
nop dword [rax + rax]
mov rdx, r12
lea rcx, [rsp + 0x6c]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
mov rcx, r15
test eax, eax
je 0x1401c3cc2
lea rdx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x1401c3c30
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov dword [rbp + 0x3c24], 0xffffffff
mov edx, 1
mov dword [rbp + 0x28a4], eax
mov ecx, eax
shr ecx, 0x1e
xor ecx, eax
imul eax, ecx, 0x6c078965
add eax, edx
mov dword [rbp + rdx*4 + 0x28a4], eax
inc rdx
cmp rdx, 0x270
jb 0x1401c3c70
mov dword [rbp + 0x28a0], 0x270
mov dword [rsp + 0x20], 0
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1401c3cd1
imul rax, rax, 0x64
jmp 0x1401c3cec
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0x48]
jmp 0x1401c3f06
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
lea r14, [rax + 0x5f5e100]
mov r15d, 1
nop dword [rax]
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x1401c3d1e
imul rax, rax, 0x64
jmp 0x1401c3d39
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
cmp rax, r14
jge 0x1401c3ef5
mov esi, 0x186a0
nop word [rax + rax]
lea rcx, [rbp + 0x28a0]
call fcn.14021dbf0
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x63
ja 0x1401c3d8a
nop word [rax + rax]
lea rcx, [rbp + 0x28a0]
call fcn.14021dbf0
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401c3d70
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
cmp ecx, r13d
lea eax, [rcx + r13]
lea ebx, [rcx - 0x80000000]
cmovae ebx, eax
lea rcx, [rbp + 0x28a0]
test ebx, ebx
cmove ebx, r15d
call fcn.14021dbf0
mov ecx, eax
mov edi, ebx
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x1401c3dea
cmp eax, 0x64
jae 0x1401c3dea
nop dword [rax]
lea rcx, [rbp + 0x28a0]
call fcn.14021dbf0
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401c3dd0
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
lea eax, [rcx + r13]
cmp ecx, r13d
lea edx, [rcx - 0x80000000]
cmovae edx, eax
lea rcx, [rbp + 0x28a0]
mov eax, dword [rsp + 0x20]
add edx, eax
mov dword [rsp + 0x20], edx
call fcn.14021dbf0
mov ecx, eax
mov ebx, edi
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x1401c3e4b
cmp eax, 0x64
jae 0x1401c3e4b
lea rcx, [rbp + 0x28a0]
call fcn.14021dbf0
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401c3e31
shr rax, 0x20
lea ecx, [rax + 0x7fffff9c]
lea eax, [rcx + r13]
cmp ecx, r13d
lea edx, [rcx - 0x80000000]
cmovae edx, eax
lea rcx, [rbp + 0x28a0]
mov eax, dword [rsp + 0x20]
imul edx, eax
mov dword [rsp + 0x20], edx
call fcn.14021dbf0
mov ecx, eax
mov edi, ebx
imul rax, rcx, 0xc9
cmp eax, 0xc9
jae 0x1401c3ead
cmp eax, 0x64
jae 0x1401c3ead
lea rcx, [rbp + 0x28a0]
call fcn.14021dbf0
mov ecx, eax
imul rax, rcx, 0xc9
cmp eax, 0x64
jb 0x1401c3e93
shr rax, 0x20
lea edx, [rax + 0x7fffff9c]
cmp edx, r13d
lea eax, [rdx + r13]
lea ecx, [rdx - 0x80000000]
cmovae ecx, eax
mov eax, dword [rsp + 0x20]
sub eax, ecx
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cdq
idiv edi
mov dword [rsp + 0x20], eax
mov eax, dword [rsp + 0x20]
cdq
idiv edi
mov dword [rsp + 0x20], edx
sub rsi, r15
jne 0x1401c3d50
jmp 0x1401c3d00
mov eax, dword [rsp + 0x20]
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
mov rcx, qword [rbp + 0x3c30]
xor rcx, rsp
call fcn.140234e20
lea r11, [rsp + 0x3d40]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret