Function at 0x140004454
Capabilities:
Encode data using xor
Enumerate process modules

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1068]
mov eax, 0x1140
call fcn.140012190
sub rsp, rax
mov rax, qword [0x140071010]
xor rax, rsp
mov qword [rbp + 0x1030], rax
mov qword [rsp + 0x70], rcx
xor ebx, ebx
mov dword [rsp + 0x20], ebx
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
mov edi, ebx
mov qword [rsp + 0x28], rbx
mov qword [rbp - 0x40], rbx
lea r12d, [rbx + 0x40]
mov dword [rsp + 0x20], r12d
lea r8, [rbp - 0x58]
mov edx, 0x1000
lea rcx, [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
je 0x140004525
mov eax, dword [rbp - 0x58]
shr eax, 2
test eax, eax
je 0x140004525
lea rbx, [rbp + 0x30]
mov r14d, eax
mov rsi, qword [rbp - 0x48]
mov eax, dword [rbx]
test eax, eax
je 0x140004512
cmp rsi, rdi
je 0x1400044fb
mov dword [rsi], eax
add rsi, 4
mov qword [rbp - 0x48], rsi
jmp 0x140004512
mov r8, rbx
mov rdx, rsi
lea rcx, [rbp - 0x50]
call fcn.14000f968
mov rdi, qword [rbp - 0x40]
mov rsi, qword [rbp - 0x48]
add rbx, 4
sub r14, 1
jne 0x1400044e4
mov qword [rsp + 0x28], rdi
xor ebx, ebx
jmp 0x140004529
mov rsi, qword [rbp - 0x48]
mov r14, qword [rbp - 0x50]
cmp r14, rsi
je 0x140004822
mov rax, qword gs:[0x58]
mov r13, qword [rax]
mov dword [rbp - 0x68], 0x823d7cbd
mov dword [rbp - 0x64], 0xb65ee34e
mov dword [rbp - 0x60], 0x82297cc7
mov r15d, 0xfd0
add r15, r13
mov edi, dword [rbp - 0x60]
mov edx, dword [r14]
lea rcx, [rbp + 8]
call fcn.140003750
nop
mov ecx, 0x65c
mov eax, dword [rcx + r13]
test al, 1
jne 0x1400045a6
or eax, 1
mov dword [rcx + r13], eax
mov word [r15 + 0xc], 0x129
movsd xmm0, qword [rbp - 0x68]
movsd qword [r15], xmm0
mov dword [r15 + 8], edi
lea rcx, [0x1400141bc]
call fcn.140011540
nop
cmp byte [r15 + 0xd], bl
je 0x1400045d5
mov rdx, rbx
mov cl, dl
and cl, 7
shl cl, 3
movabs rax, 0xdb3f9129e75119e9
shr rax, cl
xor byte [rdx + r15], al
inc rdx
cmp rdx, 0xd
jb 0x1400045af
mov byte [r15 + 0xd], bl
or r9, 0xffffffffffffffff
inc r9
cmp byte [r15 + r9], bl
jne 0x1400045d9
add r9, r15
mov r8, r15
lea rdx, [rsp + 0x30]
call fcn.14000d2f4
or r12d, 1
mov dword [rsp + 0x20], r12d
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 8]
call fcn.14000c800
mov rbx, rax
lea rcx, [rsp + 0x30]
call fcn.14000c8d4
cmp rbx, 0xffffffffffffffff
je 0x140004801
lea rdx, [rbp + 8]
cmp qword [rbp + 0x20], 8
cmovae rdx, qword [rbp + 8]
xor eax, eax
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov r8, qword [rbp + 0x18]
lea rcx, [rbp - 0x38]
call fcn.14000e37c
or r12d, 6
mov dword [rsp + 0x20], r12d
lea rcx, [rbp - 0x38]
call fcn.140001e70
mov dword [rbp - 0x70], 0x26e331bf
mov word [rbp - 0x6c], 0xd061
mov edx, 0x620
mov eax, dword [rdx + r13]
mov ecx, 0x1300
test al, 1
jne 0x1400046a7
or eax, 1
mov dword [rdx + r13], eax
lea rbx, [rcx + r13]
mov word [rbx + 6], 0x111
mov eax, dword [rbp - 0x70]
mov dword [rbx], eax
movzx eax, word [rbp - 0x6c]
mov word [rbx + 4], ax
lea rcx, [0x14001419c]
call fcn.140011540
nop
jmp 0x1400046ab
lea rbx, [rcx + r13]
xor r8d, r8d
cmp byte [rbx + 7], r8b
je 0x1400046dc
mov edx, r8d
mov cl, dl
and cl, 7
shl cl, 3
movabs rax, 0x7b11b115478745e3
shr rax, cl
xor byte [rdx + rbx], al
inc rdx
cmp rdx, 7
jb 0x1400046b7
mov byte [rbx + 7], r8b
or r9, 0xffffffffffffffff
inc r9
cmp byte [rbx + r9], r8b
jne 0x1400046e0
add r9, rbx
mov r8, rbx
lea rdx, [rsp + 0x50]
call fcn.14000d2f4
or r12d, 8
mov dword [rsp + 0x20], r12d
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x30]
call fcn.14000c96c
or r12d, 0x10
mov dword [rsp + 0x20], r12d
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x30]
lea rcx, [rbp - 0x18]
call fcn.14000f1d0
or r12d, 0x20
mov dword [rsp + 0x20], r12d
lea rcx, [rsp + 0x30]
call fcn.14000c8d4
nop
lea rcx, [rsp + 0x50]
call fcn.14000c8d4
xor ebx, ebx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], rbx
lea r8d, [rbx + 1]
lea rdx, [0x1400159c8]
lea rcx, [rsp + 0x30]
call fcn.14000e37c
nop
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbx
lea r8d, [rbx + 2]
lea rdx, [0x1400159cc]
lea rcx, [rsp + 0x50]
call fcn.14000e37c
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x18]
call fcn.1400036f0
nop
lea rcx, [rsp + 0x50]
call fcn.14000c8d4
nop
lea rcx, [rsp + 0x30]
call fcn.14000c8d4
lea rcx, [rbp - 0x18]
cmp qword [rbp], 8
cmovae rcx, qword [rbp - 0x18]
xor edx, edx
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll__waccess]
test eax, eax
jne 0x1400047ec
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x80]
mov rcx, qword [rsp + 0x70]
call fcn.14000df00
nop
lea rcx, [rbp - 0x18]
call fcn.14000c8d4
nop
lea rcx, [rbp - 0x38]
call fcn.14000c8d4
jmp 0x140004803
xor ebx, ebx
lea rcx, [rbp + 8]
call fcn.14000c8d4
add r14, 4
cmp r14, rsi
jne 0x140004563
mov rdi, qword [rsp + 0x28]
mov r14, qword [rbp - 0x50]
test r14, r14
je 0x140004861
sub rdi, r14
and rdi, 0xfffffffffffffffc
mov rax, r14
cmp rdi, 0x1000
jb 0x140004856
add rdi, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004856
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rdx, rdi
mov rcx, r14
call fcn.140011100
mov rcx, qword [rbp + 0x1030]
xor rcx, rsp
call fcn.1400110e0
lea r11, [rsp + 0x1140]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret