Function at 0x14008ec50
Capabilities:
Encode data using xor
Enumerate processes

Disassembly:
push rbp
lea rbp, [rsp - 0x1b0]
sub rsp, 0x2b0
lea rcx, [0x140706b90]
call fcn.140084230
test al, al
je 0x14008ef54
mov ecx, 0x4129
mov qword [rsp + 0x2c0], rbx
mov r9d, 0x413c
mov qword [rsp + 0x2c8], rdi
mov edx, 0x4108
mov eax, 0x4106
mov word [rsp + 0x20], ax
mov r8d, 0x4161
mov eax, 0x412e
xor ebx, ebx
mov word [rsp + 0x22], ax
mov r11d, 0xf
mov eax, 0x4135
lea edi, [rdx + 0x3c]
mov word [rsp + 0x24], ax
movabs r10, 0xdc04d387f22f4144
mov eax, 0x4137
mov word [rsp + 0x26], ax
mov eax, 0x4122
mov word [rsp + 0x28], cx
mov word [rsp + 0x2a], ax
mov eax, 0x4121
mov word [rsp + 0x2c], r9w
mov word [rsp + 0x2e], ax
mov eax, 0x4124
mov word [rsp + 0x30], dx
mov word [rsp + 0x32], cx
mov ecx, 0x4125
mov word [rsp + 0x34], ax
mov eax, 0x4127
mov word [rsp + 0x36], ax
mov eax, 0x413a
mov word [rsp + 0x38], ax
mov eax, 0x4173
mov word [rsp + 0x3a], cx
mov word [rsp + 0x3c], ax
mov eax, 0x4109
mov word [rsp + 0x3e], ax
mov eax, 0x4139
mov word [rsp + 0x40], ax
mov eax, 0x413f
mov word [rsp + 0x42], ax
mov eax, 0x4167
mov word [rsp + 0x44], r8w
mov word [rsp + 0x46], ax
mov eax, 0x417a
mov word [rsp + 0x48], ax
mov eax, 0x4130
mov word [rsp + 0x4a], dx
mov word [rsp + 0x4c], ax
mov eax, 0x413d
mov word [rsp + 0x4e], ax
mov eax, 0x412b
mov word [rsp + 0x50], ax
mov eax, 0x4134
mov word [rsp + 0x52], cx
mov word [rsp + 0x54], ax
mov eax, 0x4103
mov word [rsp + 0x56], r9w
mov r9d, ebx
mov word [rsp + 0x58], ax
mov eax, 0x414f
mov word [rsp + 0x5a], ax
mov eax, 0x410b
mov word [rsp + 0x5c], ax
mov eax, 0x4116
mov word [rsp + 0x5e], ax
mov eax, 0x4105
mov word [rsp + 0x60], ax
mov word [rsp + 0x62], r8w
movzx eax, word [rsp + 0x20]
nop dword [rax]
nop word [rax + rax]
movzx r8d, word [rsp + r9*2 + 0x20]
lea eax, [rdi + r9]
mov rcx, r9
mov rdx, r10
and ecx, r11d
cmp rcx, r11
cmovae rcx, r11
shl cl, 2
shr rdx, cl
and dx, r11w
xor dx, ax
xor dx, r8w
mov word [rsp + r9*2 + 0x20], dx
inc r9
cmp r9, 0x22
jb 0x14008edf0
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14008eed0
xor edx, edx
lea rcx, [rsp + 0x74]
mov r8d, 0x234
call sub.VCRUNTIME140.dll_memset
lea rdx, [rsp + 0x70]
mov dword [rsp + 0x70], 0x238
mov rcx, rdi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x14008eec7
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14008ee85
mov ebx, dword [rsp + 0x78]
jmp 0x14008eec7
lea rdx, [rsp + 0x70]
mov rcx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x14008eec7
nop word [rax + rax]
lea rdx, [rbp - 0x64]
lea rcx, [rsp + 0x20]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
lea rdx, [rsp + 0x70]
mov rcx, rdi
test eax, eax
cmove ebx, dword [rsp + 0x78]
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x14008eea0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, ebx
mov dword [0x140706b98], ebx
lea rcx, [0x140706b90]
call fcn.1400844c0
mov rdi, qword [rsp + 0x2c8]
mov rbx, qword [rsp + 0x2c0]
test al, al
je 0x14008ef56
xor edx, edx
lea rcx, [0x140706b90]
call fcn.1400843b0
mov qword [0x140706ba0], rax
mov rdx, rax
test rax, rax
jne 0x14008ef2c
lea rcx, str.invalid_base_address:_0x_llx._n
call fcn.140033850
xor al, al
add rsp, 0x2b0
pop rbp
ret
lea rcx, str.m_base:_0x_llx._n
call fcn.140033850
lea rcx, [0x140706b90]
call fcn.140084570
test al, al
jne 0x14008ef56
lea rcx, str.failed_to_get_dtb._n
call fcn.140033850
xor al, al
add rsp, 0x2b0
pop rbp
ret