Function at 0x140025e50
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x4f0
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
xor r15d, r15d
movabs rax, 0xc1bb62b97c83fc1f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
movabs rax, 0x871bcd12b049868d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
movabs rax, 0xf11473abd861e44d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
movabs rax, 0x5decf31877260b5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
movabs rax, 0xd5ba3d839f360465
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
movabs rax, 0xf3af819b008af06a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
movabs r14, 0xf88e56c220ada043
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
movabs rsi, 0xe629fd27d57fb3b8
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
movabs rdi, 0x95764b98f500d075
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x210], rax
movabs rbx, 0x35ebf805bf110182
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x218], rax
movabs rax, 0xb3dc0de6a8543d07
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
movabs rax, 0xf3af819b008a8d0c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x228], rax
vmovdqu ymm0, ymmword [rbp + 0x180]
vpxor ymm1, ymm0, ymmword [rbp + 0x200]
vmovdqa ymmword [rbp + 0x180], ymm1
vmovdqa xmm0, xmmword [rbp + 0x1a0]
vxorps xmm0, xmm0, xmmword [rbp + 0x220]
vmovdqa xmmword [rbp + 0x1a0], xmm0
lea rax, [rbp + 0x180]
mov qword [rbp + 0x140], rax
lea rcx, [rbp + 0x180]
mov r13, 0xffffffffffffffff
mov rax, r13
vzeroupper
nop dword [rax]
inc rax
cmp byte [rcx + rax], r15b
jne 0x140026000
mov qword [rbp + 0x148], rax
xor r8d, r8d
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x2a8]
call fcn.14002aab0
nop
lea rdx, [rbp + 0x2a8]
lea rcx, [rbp + 0x258]
call fcn.1400285d0
lea rcx, [rbp + 0x258]
cmp qword [rbp + 0x270], 8
cmovae rcx, qword [rbp + 0x258]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1402e2570], rax
lea rcx, [rbp + 0x258]
call fcn.140028d40
nop
lea rcx, [rbp + 0x2a8]
call fcn.140028d40
movabs rax, 0x94de2ead4ccfcf11
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x120], rax
movabs rax, 0x875d9865a71acad9
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x128], rax
movabs rax, 0x95764b989078b55b
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x130], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x138], rax
mov qword [rbp + 8], r14
mov rax, qword [rbp + 8]
mov qword [rbp + 0x280], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x288], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x290], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x298], rax
vmovdqu ymm0, ymmword [rbp + 0x120]
vpxor ymm1, ymm0, ymmword [rbp + 0x280]
vmovdqa ymmword [rbp + 0x120], ymm1
xor edx, edx
lea ecx, [rdx + 2]
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp + 0x360], pe_nt_image_headers64
lea rdx, [rbp + 0x360]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400261ab
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x38c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x14002619c
lea rdx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_Process32Next]
jmp 0x14002616e
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rbp + 0x368]
jmp 0x1400261b7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, r15d
mov dword [0x1402e2578], r8d
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [0x1402e2580], rax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x40], 0x7248caa3
mov dword [rbp + 0x44], 0x6766fa27
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x48], xmm0
mov word [rbp + 0x58], ax
mov byte [rbp + 0x5a], al
movabs r12, 0xc5e666b691872ed0
mov rsi, qword [0x1402ea378]
mov r14, qword [0x1402ea380]
movzx r8d, byte [rbp + 0x18]
nop dword [rax + rax]
mov rax, r14
mov r9, rsi
nop word [rax + rax]
mov rbx, r15
cmp rbx, 0x1b
jae 0x140026d84
movzx r10d, byte [rbp + rbx + 0x40]
movzx r11d, bl
nop word [rax + rax]
movzx edi, r11b
cmp rax, rbx
ja 0x140026d7b
lea rcx, [r9 + 1]
cmp rax, rcx
jae 0x140026280
lea rdx, [rbx + r12]
mov rcx, rdx
and rcx, r10
imul r8, rcx, 0xfffffffffffffffe
add r8, rdx
add r8, r10
add r8b, 0x50
jmp 0x1400262ad
je 0x140026d0d
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x140026c90
lea rcx, [r9 + 2]
cmp rax, rcx
je 0x140026c5c
lea rcx, [r9 + 7]
cmp rax, rcx
je 0x140026c39
movzx r11d, bl
cmp r9, rbx
ja 0x140026d72
lea rcx, [r9 + 0x20]
cmp rax, rcx
jae 0x1400262db
lea edx, [r11 + 0x10]
movzx ecx, dl
and cl, r10b
add cl, cl
sub dl, cl
lea r8d, [r10 + rdx]
sub r8b, 0x70
jmp 0x140026320
lea rcx, [r9 + 1]
cmp rax, rcx
je 0x140026bf1
inc rcx
cmp rax, rcx
je 0x140026bcb
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x140026ba4
lea rcx, [r9 + 5]
cmp rax, rcx
je 0x140026b87
lea rcx, [r9 + 9]
cmp rax, rcx
je 0x140026b58
nop dword [rax + rax]
lea rcx, [r9 + rax]
cmp rcx, rbx
jbe 0x140026861
nop dword [rax]
lea rcx, [r9 + 0x7a]
cmp rax, rcx
je 0x140026853
lea rcx, [r9 + 1]
cmp rax, rcx
je 0x140026835
lea rcx, [r9 + 0x42]
cmp rax, rcx
je 0x140026812
lea rcx, [r9 + 0x3e8]
cmp rax, rcx
je 0x140026912
lea rcx, [r9 + 6]
cmp rax, rcx
je 0x1400267f5
lea rcx, [r9 + 0x10]
cmp rax, rcx
je 0x1400267c8
lea rcx, [r9 + 0x41]
cmp rax, rcx
je 0x1400267a7
lea rcx, [r9 + 0x20]
cmp rax, rcx
je 0x1400268bf
lea rcx, [r9 + 0x64]
cmp rax, rcx
je 0x140026778
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x140026330
lea rax, [r9 + 0x40]
lea r9, [rax + 8]
lea rdx, [r9 + 1]
cmp rax, rdx
jb 0x140026d55
lea rcx, [r9 + 0x42]
cmp rax, rcx
jb 0x140026d38
lea rcx, [r9 + 0x3e8]
cmp rax, rcx
jb 0x14002651a
lea rcx, [r9 + 6]
cmp rax, rcx
jb 0x1400264fb
lea rcx, [r9 + 0x10]
cmp rax, rcx
jb 0x1400264dc
lea rcx, [r9 + 0x41]
cmp rax, rcx
jb 0x140026727
lea rcx, [r9 + 2]
cmp rax, rcx
jb 0x1400266da
lea rcx, [r9 + 0x64]
cmp rax, rcx
jb 0x140026697
lea rcx, [r9 + 0x400]
cmp rax, rcx
jb 0x140026672
lea rcx, [r9 + 8]
cmp rax, rcx
jb 0x140026330
mov rax, rdx
lea r9, [rdx + 0x20]
lea rdx, [r9 + 5]
cmp rax, rdx
ja 0x140026647
lea rcx, [r9 + 0x3e8]
cmp rax, rcx
ja 0x140026626
lea rcx, [r9 + 0x7a]
cmp rax, rcx
ja 0x140026606
lea rcx, [r9 + 0x10]
cmp rax, rcx
ja 0x1400265d5
lea rcx, [r9 + 0x42]
cmp rax, rcx
ja 0x1400265c0
lea rcx, [r9 + 2]
cmp rax, rcx
ja 0x1400265a3
lea rcx, [r9 + 0x64]
cmp rax, rcx
ja 0x14002657c
lea rcx, [r9 + 0x400]
cmp rax, rcx
ja 0x140026556
lea rcx, [r9 + 8]
cmp rax, rcx
ja 0x140026539
lea rcx, [r9 + 0x20]
cmp rax, rcx
ja 0x140026330
mov rax, rdx
lea r9, [rdx + 0x5a]
jmp 0x140026330
lea r8d, [r11 - 0x10]
movzx ecx, r10b
and cl, r8b
mov edx, Ordinal_60
sub dl, cl
add dl, dl
add dl, r10b
add r8b, dl
jmp 0x140026320
lea r8d, [r11 + 0x50]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx edx, r10b
sub dl, cl
sub r8b, 0x30
add r8b, dl
jmp 0x1400262b1
lea r8d, [r11 - 0x50]
movzx ecx, r10b
and cl, r8b
mov edx, Ordinal_26
sub dl, cl
add dl, dl
add dl, r10b
add r8b, dl
jmp 0x140026250
add r11b, 0x80
movzx ecx, r10b
and cl, r11b
add cl, cl
movzx r8d, r10b
sub r8b, cl
add r8b, 0x80
jmp 0x140026c0a
sub r11b, 0x20
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r8d, [r11 + r10]
sub r8b, 0x20
inc r9
dec rbx
inc rbx
jmp 0x140026233
add r11b, 0x40
movzx ecx, r10b
and cl, r11b
mov edx, reloc.WLDAP32.dll_Ordinal_32
sub dl, cl
lea r8d, [rdx + rdx]
add r8b, r10b
add r8b, r11b
dec rbx
inc rbx
jmp 0x140026233
sub r11b, 0x60
movzx ecx, r10b
and cl, r11b
add cl, cl
movzx r8d, r10b
sub r8b, cl
sub r8b, 0x60
jmp 0x140026b13
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r8d, [r11 + r10]
jmp 0x140026c78
add r11b, 0x60
movzx ecx, r10b
and cl, r11b
mov edx, Ordinal_50
sub dl, cl
lea r8d, [rdx + rdx]
add r8b, r10b
add r8b, r11b
movzx ecx, r8b
mov rdx, r13
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140026233
sub r11b, 0x40
movzx ecx, r10b
and cl, r11b
add cl, cl
movzx r8d, r10b
sub r8b, cl
sub r8b, 0x40
add r8b, r11b
jmp 0x140026caa
add r11b, 0x20
movzx ecx, r10b
and cl, r11b
mov edx, reloc.WS2_32.dll_recv
sub dl, cl
lea r8d, [rdx + rdx]
add r8b, r10b
add r8b, r11b
jmp 0x140026cd4
add r11b, 0x80
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r8d, [r11 + r10]
add r8b, 0x80
movzx ecx, byte [rbp + rbx + 0x40]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x140026233
add r11b, 0x70
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r8d, [r11 + r10]
sub r8b, 0x10
mov byte [rbp + rbx + 0x40], r8b
inc rbx
jmp 0x140026233
lea r8d, [r11 - 0x30]
movzx ecx, r10b
and cl, r8b
mov edx, Ordinal_41
sub dl, cl
add dl, dl
add dl, r10b
add r8b, dl
cmp r9, 0x40
jb 0x14002668a
sub r11b, 0x20
movzx ecx, r10b
and cl, r11b
add cl, cl
movzx edx, r10b
sub dl, cl
add dl, r11b
lea r8d, [rdx*2 - 0x40]
jmp 0x140026c0d
lea r8d, [r11 + 0x30]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx edx, r10b
sub dl, cl
sub r8b, 0x50
add r8b, dl
cmp rax, 0x2a
jae 0x140026afa
lea rcx, [r9 + 0x400]
cmp rax, rcx
jbe 0x140026a25
lea r8d, [r11 - 0x60]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx edx, r10b
sub dl, cl
sub r8b, 0x60
jmp 0x1400266ae
lea r8d, [r11 - 0x70]
movzx ecx, r10b
and cl, r8b
mov edx, 8
sub dl, cl
add dl, dl
add dl, r10b
add r8b, dl
lea rcx, [r9 + rax]
cmp rcx, 0x61
je 0x140026b3a
lea rcx, [r9 + 0x64]
cmp rax, rcx
jbe 0x14002694b
lea r8d, [r11 - 0x70]
movzx ecx, r10b
and cl, r8b
mov edx, 8
sub dl, cl
add dl, dl
add dl, r10b
jmp 0x1400266f1
add r11b, 0x60
movzx ecx, r10b
and cl, r11b
mov edx, Ordinal_50
sub dl, cl
lea r8d, [rdx + rdx]
add r8b, r10b
add r8b, r11b
movzx ecx, byte [rbp + rbx + 0x40]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x140026233
add r11b, 0x20
movzx ecx, r10b
and cl, r11b
mov edx, reloc.WS2_32.dll_recv
sub dl, cl
lea r8d, [rdx + rdx]
add r8b, r10b
add r8b, r11b
jmp 0x140026caa
add r11b, 0x80
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r8d, [r11 + r10]
add r8b, 0x80
movzx ecx, r8b
mov rdx, r13
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140026233
sub r11b, 0x20
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r8d, [r11 + r10]
sub r8b, 0x20
jmp 0x140026c78
sub r11b, 0x60
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r8d, [r11 + r10]
sub r8b, 0x60
dec rbx
inc rbx
jmp 0x140026233
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r8d, [r11 + r10]
inc r9
dec rbx
inc rbx
jmp 0x140026233
add r11b, 0x60
mov edx, Ordinal_50
jmp 0x140026bfa
lea rcx, [r9 + 0x61]
cmp rax, rcx
jae 0x14002687f
lea r8d, [r11 - 0x30]
movzx ecx, r10b
and cl, r8b
mov edx, Ordinal_41
jmp 0x140026737
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x1400268b7
add r11b, 0x20
movzx ecx, r10b
and cl, r11b
mov edx, reloc.WS2_32.dll_recv
sub dl, cl
lea r8d, [rdx + rdx]
add r8b, r10b
add r8b, r11b
movzx ecx, byte [rbp + rbx + 0x40]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x140026233
inc rcx
cmp rax, rcx
jne 0x1400268df
sub r11b, 0x40
movzx ecx, r10b
and cl, r11b
add cl, cl
movzx r8d, r10b
sub r8b, cl
sub r8b, 0x40
add r8b, r11b
jmp 0x140026cd4
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x140026909
add r11b, 0x60
movzx ecx, r10b
and cl, r11b
mov edx, Ordinal_50
sub dl, cl
lea r8d, [rdx + rdx]
add r8b, r10b
add r8b, r11b
jmp 0x140026caa
lea rcx, [r9 + 5]
cmp rax, rcx
jne 0x140026930
add r11b, 0x40
movzx ecx, r10b
and cl, r11b
mov edx, reloc.WLDAP32.dll_Ordinal_32
sub dl, cl
lea r8d, [rdx + rdx]
add r8b, r10b
jmp 0x140026b13
lea rcx, [r9 + 9]
cmp rax, rcx
jne 0x140026741
add r11b, 0x20
mov edx, reloc.WS2_32.dll_recv
jmp 0x140026bfa
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x140026971
add r11b, 0x30
movzx ecx, r10b
and cl, r11b
add cl, cl
movzx r8d, r10b
sub r8b, cl
sub r8b, 0x50
jmp 0x140026c0a
lea rcx, [r9 + 2]
cmp rax, rcx
jne 0x14002699d
add r11b, 0x70
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r8d, [r11 + r10]
sub r8b, 0x10
dec rbx
inc rbx
jmp 0x140026233
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x1400269c3
add r11b, 0x10
movzx ecx, r11b
and cl, r10b
add cl, cl
sub r11b, cl
lea r8d, [r10 + r11]
sub r8b, 0x70
jmp 0x140026b16
lea rcx, [r9 + 5]
cmp rax, rcx
jne 0x1400269ed
sub r11b, 0x10
movzx ecx, r10b
and cl, r11b
mov edx, Ordinal_60
sub dl, cl
lea r8d, [rdx + rdx]
add r8b, r10b
add r8b, r11b
jmp 0x140026caa
lea rcx, [r9 + 8]
cmp rax, rcx
jne 0x1400266f4
add r11b, 0x30
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r8d, [r11 + r10]
sub r8b, 0x50
movzx ecx, byte [rbp + rbx + 0x40]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x140026233
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x140026a5d
add r11b, 0x40
movzx ecx, r10b
and cl, r11b
mov edx, reloc.WLDAP32.dll_Ordinal_32
sub dl, cl
lea r8d, [rdx + rdx]
add r8b, r10b
add r8b, r11b
movzx ecx, byte [rbp + rbx + 0x40]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x140026233
lea rcx, [r9 + 4]
cmp rax, rcx
jne 0x140026a97
add r11b, 0x20
movzx ecx, r10b
and cl, r11b
mov edx, reloc.WS2_32.dll_recv
sub dl, cl
lea r8d, [rdx + rdx]
add r8b, r10b
add r8b, r11b
movzx ecx, r8b
mov rdx, r13
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140026233
lea rcx, [r9 + 5]
cmp rax, rcx
jne 0x140026abb
add r11b, 0x60
movzx ecx, r10b
and cl, r11b
mov edx, Ordinal_50
sub dl, cl
lea r8d, [rdx + rdx]
add r8b, r10b
jmp 0x140026b13
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x140026adf
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r8d, [r11 + r10]
dec rbx
inc rbx
jmp 0x140026233
lea rcx, [r9 + 7]
cmp rax, rcx
jne 0x1400266b1
add r11b, 0x40
mov edx, reloc.WLDAP32.dll_Ordinal_32
jmp 0x140026bfa
add r11b, 0x80
movzx ecx, r10b
and cl, r11b
movzx edx, r10b
sub dl, cl
lea r8d, [rdx*2 + 0x80]
add r8b, r11b
add dil, 0x50
movzx ecx, r10b
and cl, dil
add cl, cl
sub r10b, cl
sub r10b, 0x30
add r10b, r8b
add r10b, dil
mov byte [rbp + rbx + 0x40], r10b
jmp 0x140026c78
add r11b, 0x20
movzx ecx, r10b
and cl, r11b
mov edx, reloc.WS2_32.dll_recv
sub dl, cl
lea r8d, [rdx + rdx]
add r8b, r11b
jmp 0x140026caa
sub r11b, 0x50
movzx ecx, r10b
and cl, r11b
mov edx, Ordinal_26
sub dl, cl
lea r8d, [rdx + rdx]
add r8b, r10b
add r8b, r11b
movzx ecx, byte [rbp + rbx + 0x40]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x140026233
add r11b, 0x30
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r8d, [r11 + r10]
sub r8b, 0x50
jmp 0x140026c78
sub r11b, 0x10
movzx ecx, r10b
and cl, r11b
mov edx, Ordinal_60
sub dl, cl
lea r8d, [rdx + rdx]
add r8b, r10b
add r8b, r11b
dec rbx
inc rbx
jmp 0x140026233
add r11b, 0x50
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea r8d, [r11 + r10]
sub r8b, 0x30
inc r9
dec rbx
inc rbx
jmp 0x140026233
sub r11b, 0x50
mov edx, Ordinal_26
movzx ecx, r10b
and cl, r11b
sub dl, cl
lea r8d, [rdx + rdx]
add r8b, r10b
add r8b, r11b
sub dil, 0x50
movzx ecx, r10b
and cl, dil
mov edx, Ordinal_26
sub dl, cl
add dl, dl
add dl, r10b
add dl, dil
mov byte [rbp + rbx + 0x40], dl
inc r9
dec rbx
inc rbx
jmp 0x140026233
add dil, 0x30
movzx ecx, r10b
and cl, dil
add cl, cl
sub r10b, cl
lea r8d, [rdi + r10]
sub r8b, 0x50
dec rbx
inc rbx
jmp 0x140026233
sub dil, 0x10
movzx ecx, r10b
and cl, dil
mov edx, Ordinal_60
sub dl, cl
lea r8d, [rdx + rdx]
add r8b, r10b
add r8b, dil
add rax, r9
movzx ecx, r8b
mov rdx, r13
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140026233
lea r8d, [rdi - 0x50]
movzx ecx, r10b
and cl, r8b
mov edx, Ordinal_26
sub dl, cl
add dl, dl
add dl, r10b
add r8b, dl
sub dil, 0x10
movzx ecx, r10b
and cl, dil
mov edx, Ordinal_60
sub dl, cl
add dl, dl
add dl, r10b
add dl, dil
movzx ecx, dl
mov byte [rbp + rbx + 0x40], cl
inc r9
add rcx, r9
sub rbx, rcx
lea edx, [rbx - 0x40]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
sub r10b, 0x40
add r10b, dl
mov byte [rbp + rbx + 0x40], r10b
inc rax
mov rcx, r13
sub rcx, rax
add rbx, rcx
movzx ecx, byte [rbp + rbx + 0x40]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x140026233
add dil, 0x70
movzx ecx, r10b
and cl, dil
add cl, cl
sub r10b, cl
lea r8d, [rdi + r10]
sub r8b, 0x10
movzx ecx, byte [rbp + rbx + 0x40]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x140026233
add r11b, 0x10
movzx ecx, r11b
and cl, r10b
add cl, cl
sub r11b, cl
lea r8d, [r10 + r11]
sub r8b, 0x70
jmp 0x140026230
add r11b, 0x70
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea r8d, [r11 + r10]
sub r8b, 0x10
jmp 0x140026220
mov rax, qword [rbp + 0x1537400]
jmp 0x140026d88
mov rax, qword [rbp + 0x5aa2d0]
jmp 0x140026d88
mov rax, qword [rbp + 0x40]
cmp qword [0x1402e73f0], rax
je 0x140026d9d
call r15
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140022f90
lea rdx, [rax + 0x118]
mov qword [rbp + 8], r15
lea rcx, [rbp + 0x2c8]
mov qword [rsp + 0x20], rcx
mov r9d, 8
lea r8, [rbp + 8]
mov rcx, qword [0x1402e2580]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call fcn.14004a1a0
mov r14, rax
mov qword [rbp + 0x68], r15
mov rdx, qword [rbp + 8]
add rdx, 0x1a8
lea rax, [rbp + 0x2a0]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 0x68]
mov rcx, qword [0x1402e2580]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x60], rax
movabs rax, 0x9bef26b14bdfcf14
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0xa0], rax
movabs rax, 0xe629fd27d57fb3dd
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0xa8], rax
movabs rax, 0xf88e56c220ada043
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x150], rax
movabs rax, 0xe629fd27d57fb3b8
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x158], rax
movdqa xmm0, xmmword [rbp + 0xa0]
xorps xmm0, xmmword [rbp + 0x150]
movdqa xmmword [rbp + 0xa0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0xe8], r15
lea rax, [rbp + 0xa0]
mov r8, r13
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140026eb0
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0xd0]
call fcn.140020ef0
lea rax, [rbp + 0xd0]
mov qword [rbp + 0x10], rax
mov rdi, r15
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x60]
call fcn.140024d30
nop
mov rbx, qword [rbp + 0x1c0]
mov rsi, qword [rbp + 0x1c8]
cmp rbx, rsi
je 0x140026f69
lea rdx, [rbp + 0x2d8]
mov rcx, rbx
call fcn.140024be0
lea rdx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0x10
cmovae rdx, qword [rbp + 0xd0]
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x140026f33
mov rax, qword [rax]
cmp r8, qword [rbp + 0xe0]
jne 0x140026f48
mov rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140026f5a
lea rcx, [rbp + 0x2d8]
call fcn.140020e70
add rbx, 8
jmp 0x140026efa
lea rcx, [rbp + 0x2d8]
call fcn.140020e70
mov rdi, qword [rbx]
lea rcx, [rbp + 0x1c0]
call fcn.1400273e0
nop
lea rcx, [rbp + 0xd0]
call fcn.140020e70
lea rdx, [rdi + 0x418]
mov qword [rbp + 0x90], r15
lea rax, [rbp + 0x2d0]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 0x90]
mov rcx, qword [0x1402e2580]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
mov qword [rbp + 0x80], recvfrom
mov qword [rbp + 0x88], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.MouseService]
movsd qword [rbp + 0x70], xmm0
mov eax, dword [0x14016fd90]
mov dword [rbp + 0x78], eax
mov byte [rbp + 0x7c], 0
lea rax, [rbp + 0x70]
mov qword [rbp + 0x10], rax
mov rbx, r15
lea rdx, [rbp + 0x1d8]
lea rcx, [rbp + 0x60]
call fcn.140024d30
nop
mov rsi, qword [rbp + 0x1d8]
mov r12, qword [rbp + 0x1e0]
cmp rsi, r12
je 0x140027080
lea rdx, [rbp + 0x2f8]
mov rcx, rsi
call fcn.140024a70
lea rdx, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae rdx, qword [rbp + 0x70]
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x14002704a
mov rax, qword [rax]
cmp r8, qword [rbp + 0x80]
jne 0x14002705f
mov rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140027071
lea rcx, [rbp + 0x2f8]
call fcn.140020e70
add rsi, 8
jmp 0x140027017
lea rcx, [rbp + 0x2f8]
call fcn.140020e70
mov rbx, qword [rsi]
lea rcx, [rbp + 0x1d8]
call fcn.1400273e0
nop
lea rcx, [rbp + 0x70]
call fcn.140020e70
lea rdx, [rbx + 0xf0]
mov qword [rbp + 0x10], r15
lea rax, [rbp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 8
lea r8, [rbp + 0x10]
mov rcx, qword [0x1402e2580]
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
call fcn.140023b20
mov rsi, rax
movabs rax, 0xf8fd24a759cccc13
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rcx, 0xe629fd27d57fb3b8
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0xf88e56c220ada043
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
movdqa xmm0, xmmword [rbp + 0xb0]
xorps xmm0, xmmword [rbp + 0x160]
movdqa xmmword [rbp + 0xb0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], r15
lea rax, [rbp + 0xb0]
mov r8, r13
inc r8
cmp byte [rax + r8], 0
jne 0x140027156
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x20]
call fcn.140020ef0
lea rax, [rbp + 0x20]
mov qword [rbp], rax
mov rbx, r15
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x60]
call fcn.140024d30
nop
mov r12, qword [rbp + 0x240]
mov r13, qword [rbp + 0x248]
cmp r12, r13
je 0x1400271fe
lea rdx, [rbp + 0x318]
mov rcx, r12
call fcn.140024be0
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae rdx, qword [rbp + 0x20]
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x1400271ca
mov rax, qword [rax]
cmp r8, qword [rbp + 0x30]
jne 0x1400271dc
mov rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400271ee
lea rcx, [rbp + 0x318]
call fcn.140020e70
add r12, 8
jmp 0x14002719a
lea rcx, [rbp + 0x318]
call fcn.140020e70
mov rbx, qword [r12]
lea rcx, [rbp + 0x240]
call fcn.1400273e0
nop
lea rcx, [rbp + 0x20]
call fcn.140020e70
movabs rax, 0x9fe03fb648cac90f
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc0], rax
movabs rcx, 0xe629fd27d57fb3b8
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc8], rax
movabs rax, 0xf88e56c220ada043
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xf0], rax
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0xf8], rax
movdqa xmm0, xmmword [rbp + 0xc0]
xorps xmm0, xmmword [rbp + 0xf0]
movdqa xmmword [rbp + 0xc0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], r15
lea rax, [rbp + 0xc0]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400272a2
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x20]
call fcn.140020ef0
lea rax, [rbp + 0x20]
mov qword [rbp + 0x98], rax
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x60]
call fcn.140024d30
nop
mov r12, qword [rbp + 0xf0]
mov r13, qword [rbp + 0xf8]
cmp r12, r13
je 0x14002734a
lea rdx, [rbp + 0x338]
mov rcx, r12
call fcn.140024be0
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae rdx, qword [rbp + 0x20]
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x140027316
mov rax, qword [rax]
cmp r8, qword [rbp + 0x30]
jne 0x140027328
mov rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14002733a
lea rcx, [rbp + 0x338]
call fcn.140020e70
add r12, 8
jmp 0x1400272e6
lea rcx, [rbp + 0x338]
call fcn.140020e70
mov r15, qword [r12]
lea rcx, [rbp + 0xf0]
call fcn.1400273e0
nop
lea rcx, [rbp + 0x20]
call fcn.140020e70
mov qword [0x1402e9e98], r15
mov rax, qword [rbp + 0x10]
mov qword [0x1402e9e78], rax
mov rax, qword [rbp + 0x68]
mov qword [0x1402e9ec8], rax
mov qword [0x1402e9ec0], rdi
mov rax, qword [rbp + 0x90]
mov qword [0x1402e9ed0], rax
mov qword [0x1402e9eb8], rbx
mov qword [0x1402e9ed8], rsi
mov qword [0x1402e9ea8], r14
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret