Function at 0x14003a740
Capabilities:
Create thread
Encode data using xor
Enumerate process modules
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r14
push rbp
lea rbp, [rsp - 0xe0]
sub rsp, 0x1e0
mov rax, qword [0x140062010]
xor rax, rsp
mov qword [rbp + 0xd0], rax
lea rcx, [rbp - 0x60]
call fcn.140031900
lea rcx, [rbp - 0x60]
call fcn.14003afe0
mov byte [0x1401485cd], 1
mov byte [rbp - 0x70], 0x17
mov al, 0x27
xor ecx, ecx
mov r8b, 0x17
xor r8b, 0x24
mov byte [rbp - 0x6f], r8b
xor al, 0x17
mov byte [rbp - 0x6e], al
mov byte [rbp - 0x6d], cl
lea r9, [rbp - 0x6f]
mov ecx, 0x22
call fcn.14002ed00
mov r10, rax
cmp r8b, 0x30
jl 0x14003a7ec
cmp r8b, 0x39
jg 0x14003a7ec
mov ecx, 0xbb2
call fcn.14002ed00
imul eax, r10d
movsx r10d, r8b
add r10d, 0xffffffd0
add r10d, eax
inc r9
movzx r8d, byte [r9]
cmp r8b, 0x30
jge 0x14003a7c0
mov edx, r10d
lea rcx, [rsp + 0x30]
call fcn.140034ea0
mov r8, rax
cmp qword [rax + 0x18], 0x10
jb 0x14003a806
mov r8, qword [rax]
movdqa xmm0, xmmword [0x140059ba0]
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x140059fe0]
movdqu xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x14005a0e0]
movdqu xmmword [rsp + 0x70], xmm0
mov dword [rbp - 0x80], 0xbd93b487
mov dword [rbp - 0x7c], 0x918d9d
mov byte [rbp - 0x78], 1
xor r14d, r14d
mov ecx, r14d
nop dword [rax + rax]
lea eax, [rcx - 0x5b]
xor byte [rsp + rcx + 0x50], al
inc rcx
cmp rcx, 0x37
jb 0x14003a850
mov byte [rbp - 0x78], r14b
mov r9d, 0x30
lea rdx, [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rdx, qword [rsp + 0x48]
cmp rdx, 0x10
jb 0x14003a8b7
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003a8b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003a8b2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400462c8
mov dword [rbp - 0x70], 0xc6cec9f5
mov dword [rbp - 0x6c], 0xc0e98add
mov dword [rbp - 0x68], 0xc4c0cc
mov byte [rbp - 0x64], 1
mov rcx, r14
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x5b]
xor byte [rbp + rcx - 0x70], al
inc rcx
cmp rcx, 0xb
jb 0x14003a8e0
mov byte [rbp - 0x64], r14b
lea rdx, [rbp - 0x70]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14003a9a7
call fcn.14003af60
mov r11d, eax
call fcn.14003aef0
mov ecx, eax
mov edx, r11d
call fcn.140034d70
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.140034ea0
movdqa xmm0, xmmword [0x140059fd0]
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x1400588f0]
movdqu xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x14005a060]
movdqu xmmword [rsp + 0x70], xmm0
mov dword [rbp - 0x80], 0xb69ef69e
mov dword [rbp - 0x7c], 0xbeb496f9
mov dword [rbp - 0x78], 0x100a7bf
mov rcx, rax
call fcn.140041b10
mov r8, rax
lea rcx, [rsp + 0x50]
call fcn.14003aec0
mov rdx, rax
xor ecx, ecx
mov r9d, 0x40010
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rsp + 0x30]
call fcn.140041b20
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rbp - 0x60]
call fcn.140031900
lea rcx, [rbp - 0x60]
call fcn.14003afe0
mov dword [rbp - 0x70], 0xc6cec9f5
mov dword [rbp - 0x6c], 0xc0e98add
mov dword [rbp - 0x68], 0xc4c0cc
mov byte [rbp - 0x64], 1
mov rcx, r14
nop word [rax + rax]
lea eax, [rcx - 0x5b]
xor byte [rbp + rcx - 0x70], al
inc rcx
cmp rcx, 0xb
jb 0x14003a9e0
mov byte [rbp - 0x64], r14b
lea rdx, [rbp - 0x70]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov qword [0x1401487a8], rax
lea rdx, [0x140148754]
mov rcx, rax
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [rbp - 0x70], 0xc6cec9f5
mov dword [rbp - 0x6c], 0xcdc7e8dd
mov dword [rbp - 0x68], 0xd581c5c3
mov dword [rbp - 0x64], 0x100d7c9
mov rcx, r14
nop word [rax + rax]
lea eax, [rcx - 0x5b]
xor byte [rbp + rcx - 0x70], al
inc rcx
cmp rcx, 0xe
jb 0x14003aa40
mov byte [rbp - 0x61], r14b
mov edi, r14d
mov ebx, r14d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov dword [rbp - 0x60], 0x130
lea rdx, [rbp - 0x60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14003aabf
nop dword [rax]
lea rdx, [rbp - 0x70]
lea rcx, [rbp - 0x34]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbsicmp]
test eax, eax
jne 0x14003aaae
mov eax, dword [rbp - 0x44]
cmp eax, ebx
jle 0x14003aaae
mov ebx, eax
mov edi, dword [rbp - 0x58]
lea rdx, [rbp - 0x60]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14003aa90
mov dword [0x14014858c], edi
cmp byte [0x1401485cd], r14b
jne 0x14003aaf1
mov ecx, 0x10
call fcn.1400465e4
mov qword [rbp - 0x70], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov rcx, rax
call fcn.14002f7d0
nop
mov edi, dword [0x14014858c]
mov rsi, r14
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x14003ab6b
lea r9, [rbp - 0x70]
xor r8d, r8d
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x14003ab62
mov eax, dword [rbp - 0x70]
test eax, eax
je 0x14003ab62
mov edx, eax
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x14003ab62
lea r9, [rbp - 0x70]
mov r8d, dword [rbp - 0x70]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x14003ab59
mov rsi, qword [rbx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x140148598], rsi
lea rcx, [rbp - 0x60]
call fcn.140031900
lea rcx, [rbp - 0x60]
call fcn.14003afe0
mov r8d, dword [0x14014858c]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1401485a0], rax
lea rcx, [rbp - 0x60]
call fcn.140031900
lea rcx, [rbp - 0x60]
call fcn.14003afe0
lea rcx, [rbp - 0x60]
call fcn.140031900
lea rcx, [rbp - 0x60]
call fcn.14003afe0
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.1400348d0
lea rcx, [rbp - 0x60]
call fcn.140031900
lea rcx, [rbp - 0x60]
call fcn.14003afe0
mov ecx, 8
call fcn.1400465e4
lea rcx, [0x14003ff20]
mov qword [rax], rcx
mov qword [rbp - 0x70], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x140045b00]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14003aea2
cmp dword [rsp + 0x38], 0
jne 0x14003ac47
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp - 0x70], xmm0
lea rcx, [rbp - 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x14003ac68
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
mov ecx, 8
call fcn.1400465e4
lea rcx, [0x14003fd70]
mov qword [rax], rcx
mov qword [rbp - 0x70], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x140045b00]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14003ae91
cmp dword [rsp + 0x38], 0
jne 0x14003acc4
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp - 0x70], xmm0
lea rcx, [rbp - 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x14003ace5
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
mov ecx, 8
call fcn.1400465e4
lea rcx, [0x140039180]
mov qword [rax], rcx
mov qword [rbp - 0x70], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x140045b00]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14003ae80
cmp dword [rsp + 0x38], 0
jne 0x14003ad41
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp - 0x70], xmm0
lea rcx, [rbp - 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x14003ad62
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
mov ecx, 8
call fcn.1400465e4
lea rcx, [0x140039240]
mov qword [rax], rcx
mov qword [rbp - 0x70], rax
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r14d
mov r9, rax
lea r8, [0x140045b00]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14003ae6f
cmp dword [rsp + 0x38], 0
jne 0x14003adbe
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp - 0x70], xmm0
lea rcx, [rbp - 0x70]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
je 0x14003addf
mov ecx, eax
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_C_error_int_]
nop
lea rcx, [rbp - 0x60]
call fcn.140031900
lea rcx, [rbp - 0x60]
call fcn.14003afe0
call fcn.140035100
call fcn.140035440
call fcn.140038cc0
mov rcx, qword [0x1401485d0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x140148830]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x140148780]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [0x140148828]
call qword [sym.imp.USER32.dll_DestroyWindow]
xor edx, edx
lea rcx, str.fgers
call qword [sym.imp.USER32.dll_UnregisterClassA]
mov rcx, qword [rbp + 0xd0]
xor rcx, rsp
call fcn.140045d20
lea r11, [rsp + 0x1e0]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
mov rsp, r11
pop rbp
ret
mov dword [rsp + 0x38], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rsp + 0x38], r14d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3