Function at 0x140054fa0
Capabilities:
Enumerate processes
Get hostname

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x250
movaps xmmword [rax - 0x28], xmm6
movaps xmmword [rax - 0x38], xmm7
movaps xmmword [rax - 0x48], xmm8
movaps xmmword [rax - 0x58], xmm9
mov rax, qword [0x1400d8180]
xor rax, rsp
mov qword [rsp + 0x208], rax
xor ebx, ebx
lea rcx, [0x140100900]
call fcn.140005fc0
lea rcx, [0x1401003f0]
call fcn.140054030
mov rax, qword [0x1400ffcf0]
or dword [rax + 0x40f0], 2
movsd xmm0, qword [0x1401004b8]
movsd qword [rax + 0x4114], xmm0
mov dword [rax + 0x40f8], 2
mov byte [rsp + 0x50], reloc.WS2_32.dll_WSACleanup
mov al, 0x54
xor ecx, ecx
xor al, 0x74
mov byte [rsp + 0x51], al
mov byte [rsp + 0x52], cl
lea r8d, [rbx + 0x2a]
lea rdx, [0x140100651]
lea rcx, [rsp + 0x51]
call fcn.140017a30
cmp byte [0x1401003f1], bl
je 0x1400553a4
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_clock]
sub eax, dword [0x140100504]
cmp eax, dword [0x140100508]
jle 0x1400553a4
lea r15, [0x140100438]
mov rdx, r15
cmp qword [0x140100450], 0xf
cmova rdx, qword [0x140100438]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbx
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400550b0
lea rcx, [rsp + 0x58]
call fcn.140003090
mov r14d, ebx
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, rdi
je 0x14005514b
mov dword [rsp + 0xb0], 0x130
lea rdx, [rsp + 0xb0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140055142
nop word [rax + rax]
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0xf
cmova rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0xdc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14005513a
lea rdx, [rsp + 0xb0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140055100
jmp 0x140055142
mov r14d, dword [rsp + 0xb8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x1401004f8], r14d
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140055192
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005518d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005518d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a874c
mov rdx, r15
cmp qword [0x140100450], 0xf
cmova rdx, qword [0x140100438]
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rbx
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400551c0
lea rcx, [rsp + 0x58]
call fcn.140003090
mov r14d, ebx
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
cmp rax, rdi
je 0x14005525b
mov dword [rsp + 0xb0], 0x130
lea rdx, [rsp + 0xb0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140055252
nop word [rax + rax]
lea rdx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0xf
cmova rdx, qword [rsp + 0x58]
lea rcx, [rsp + 0xdc]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x14005524a
lea rdx, [rsp + 0xb0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140055210
jmp 0x140055252
mov r14d, dword [rsp + 0xb8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x14005529b
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055296
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140055296
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a874c
mov eax, ebx
test r14d, r14d
setne al
mov dword [0x140100514], eax
mov qword [rsp + 0x20], r15
mov r9d, dword [0x1401004f8]
lea r8, [0x140100514]
lea rdx, [rsp + 0x58]
lea rcx, [0x1401003f0]
call fcn.140055b70
mov rsi, rax
lea rax, [0x1401004d8]
cmp rax, rsi
je 0x140055356
mov rdx, qword [0x1401004f0]
cmp rdx, 0xf
jbe 0x140055319
mov rcx, qword [0x1401004d8]
inc rdx
cmp rdx, 0x1000
jb 0x140055314
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14005538a
mov rcx, r8
call fcn.1400a874c
mov qword [0x1401004e8], rbx
mov qword [0x1401004f0], 0xf
mov byte [0x1401004d8], 0
movups xmm0, xmmword [rsi]
movups xmmword [0x1401004d8], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [0x1401004e8], xmm1
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140055396
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140055391
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140055391
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a874c
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll_clock]
mov dword [0x140100504], eax
jmp 0x1400553ab
mov rdi, 0xffffffffffffffff
mov rcx, qword [0x1400ffcf0]
mov rax, qword [rcx + 0x3fe0]
movss xmm2, dword [rax + 0x118]
movss xmm3, dword [rax + 0x11c]
movss xmm0, dword [rax + 0x270]
movss xmm1, dword [rax + 0x274]
cmp qword [rax + 0x1c8], 0
jne 0x1400553ed
cmp qword [rcx + 0x44b8], 0
je 0x1400553f5
movss xmm0, dword [rax + 0x240]
subss xmm1, xmm3
movss xmm9, dword [0x1400bd088]
mulss xmm1, xmm9
addss xmm1, xmm3
subss xmm1, dword [0x1400bd178]
subss xmm0, xmm2
mulss xmm0, xmm9
addss xmm0, xmm2
lea rdx, [0x140100910]
cmp qword [0x140100928], 0xf
cmova rdx, qword [0x140100910]
unpcklps xmm0, xmm1
movq r8, xmm0
call fcn.140004590
mov rcx, qword [0x1400ffcf0]
mov rax, qword [rcx + 0x3fe0]
movss xmm0, dword [rax + 0x118]
movss xmm1, dword [rax + 0x11c]
movss xmm7, dword [rax + 0x270]
movss xmm6, dword [rax + 0x274]
cmp qword [rax + 0x1c8], 0
jne 0x140055486
cmp qword [rcx + 0x44b8], 0
je 0x14005548e
movss xmm7, dword [rax + 0x240]
subss xmm6, xmm1
mulss xmm6, xmm9
addss xmm6, xmm1
subss xmm6, dword [0x1400bd170]
subss xmm7, xmm0
mulss xmm7, xmm9
addss xmm7, xmm0
mov dword [rsp + 0xa0], reloc.WS2_32.dll_recv
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x1e0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameA]
xorps xmm0, xmm0
xorps xmm1, xmm1
mov r8, rdi
movups xmmword [rsp + 0x80], xmm0
movdqu xmmword [rsp + 0x90], xmm1
test eax, eax
jne 0x14005551e
mov word [rsp + 0x50], 0x24
mov byte [rsp + 0x51], al
lea rax, [rsp + 0x51]
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140055500
lea rdx, [rsp + 0x51]
lea rcx, [rsp + 0x80]
call fcn.140003090
jmp 0x140055545
lea rax, [rsp + 0x1e0]
inc r8
cmp byte [rax + r8], 0
jne 0x140055526
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x80]
call fcn.140003090
mov r14, qword [rsp + 0x80]
lea rax, [rsp + 0x80]
cmp qword [rsp + 0x98], 0xf
cmovbe r14, rax
mov rsi, qword [0x1400ffcf0]
mov rax, qword [rsi + 0x3fe0]
mov byte [rax + 0xcd], 1
mov r15, qword [rsi + 0x3fe0]
cmp byte [r15 + 0xd0], 0
jne 0x140055776
mov r12, qword [rsi + 0x3d48]
mov byte [r15 + 0xcd], 1
mov rax, qword [rsi + 0x3fe0]
mov dword [rax + 0x2b0], 0x3f8ccccd
movss xmm1, dword [rsi + 0x3d54]
mulss xmm1, dword [0x1400bd0d4]
mulss xmm1, dword [rax + 0x2b4]
mov rcx, qword [rax + 0x390]
test rcx, rcx
je 0x1400555d8
mulss xmm1, dword [rcx + 0x2b0]
movss dword [rsi + 0x3d68], xmm1
movss dword [rsi + 0x3d50], xmm1
test r14, r14
jne 0x1400555f2
xorps xmm0, xmm0
jmp 0x14005564a
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r14
movss xmm0, dword [0x1400bd1b8]
movss dword [rsp + 0x20], xmm0
movss xmm3, dword [0x1400bd1a8]
movaps xmm2, xmm1
lea rdx, [rsp + 0x78]
mov rcx, qword [rsi + 0x3d48]
call fcn.14003ec40
movss xmm0, dword [rsp + 0x78]
addss xmm0, dword [0x1400bd0c8]
cvttss2si eax, xmm0
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss xmm1, dword [rsp + 0x7c]
xorps xmm8, xmm8
addss xmm6, dword [0x1400bd148]
mulss xmm1, xmm9
subss xmm6, xmm1
mulss xmm0, xmm9
subss xmm7, xmm0
movss dword [rsp + 0x78], xmm7
movss dword [rsp + 0x7c], xmm6
mov r8, qword [r15 + 0x2c0]
movups xmm0, xmmword [rsi + 0x39e0]
movups xmmword [rsp + 0x58], xmm0
shufps xmm0, xmm0, 0xff
mulss xmm0, dword [rsi + 0x3908]
movss dword [rsp + 0x64], xmm0
lea rcx, [rsp + 0x58]
call fcn.14000c3a0
mov ecx, eax
test eax, 0xff000000
je 0x140055714
nop dword [rax]
inc rdi
cmp byte [r14 + rdi], 0
jne 0x1400556b0
add rdi, r14
cmp r14, rdi
je 0x140055714
mov rax, qword [r8 + 0x38]
movups xmm0, xmmword [r8 + 0x88]
movups xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
movss dword [rsp + 0x40], xmm8
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], r14
lea rdx, [rsp + 0x58]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], ecx
lea r9, [rsp + 0x78]
movss xmm2, dword [rax + 0x10]
mov rdx, r8
mov rcx, qword [rax + 8]
call fcn.14003f060
mov rsi, qword [0x1400ffcf0]
mov rax, qword [rsi + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rsi + 0x3fe0]
mov dword [rax + 0x2b0], 0x3f800000
movss xmm0, dword [rsi + 0x3d54]
mulss xmm0, dword [rax + 0x2b4]
mov rdx, qword [rax + 0x390]
test rdx, rdx
je 0x140055757
mulss xmm0, dword [rdx + 0x2b0]
movss dword [rsi + 0x3d68], xmm0
movss dword [rsi + 0x3d50], xmm0
mov rcx, r12
call fcn.14001ade0
mov rsi, qword [0x1400ffcf0]
mov rdx, qword [rsp + 0x98]
cmp rdx, 0xf
jbe 0x1400557c3
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400557b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400557b7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a874c
mov rsi, qword [0x1400ffcf0]
movdqa xmm0, xmmword [0x1400bd200]
movdqu xmmword [rsp + 0x90], xmm0
mov byte [rsp + 0x80], 0
mov rax, qword [rsi + 0x3fe0]
movss xmm0, dword [rax + 0x11c]
subss xmm0, dword [rax + 0x4c]
addss xmm0, dword [rax + 0x9c]
addss xmm0, dword [0x1400bd15c]
mov byte [rax + 0xcd], 1
mov rax, qword [rsi + 0x3fe0]
movss xmm1, dword [rax + 0x4c]
subss xmm1, dword [rax + 0x9c]
addss xmm1, xmm0
movss dword [rax + 0x11c], xmm1
movss xmm0, dword [rax + 0x134]
maxss xmm0, xmm1
movss dword [rax + 0x134], xmm0
mov qword [rsp + 0x78], 0
movdqa xmm1, xmmword [0x1400bd470]
movdqu xmmword [rsp + 0x1e0], xmm1
mov cl, 0x64
mov dl, 0x67
mov r8b, 0x7e
mov r9b, 0x66
mov r10b, 0x65
mov bl, 0x78
mov dil, 0x5f
mov sil, 0x6a
mov r14b, 0x69
mov r15b, 0x48
mov r12b, 0x63
mov r13b, 0x62
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r11d, xmm1
xor al, r11b
mov byte [rsp + 0x1e1], al
xor byte [rsp + 0x1e2], r11b
xor byte [rsp + 0x1e3], r11b
xor byte [rsp + 0x1e4], r11b
xor byte [rsp + 0x1e5], r11b
xor byte [rsp + 0x1e6], r11b
xor byte [rsp + 0x1e7], r11b
xor byte [rsp + 0x1e8], r11b
xor byte [rsp + 0x1e9], r11b
xor byte [rsp + 0x1ea], r11b
xor byte [rsp + 0x1eb], r11b
xor byte [rsp + 0x1ec], r11b
xor byte [rsp + 0x1ed], r11b
xor byte [rsp + 0x1ee], r11b
xor byte [rsp + 0x1ef], r11b
xor cl, r11b
mov byte [rsp + 0x1f0], cl
xor dl, r11b
mov byte [rsp + 0x1f1], dl
xor r8b, r11b
mov byte [rsp + 0x1f2], r8b
xor r9b, r11b
mov byte [rsp + 0x1f3], r9b
xor r10b, r11b
mov byte [rsp + 0x1f4], r10b
xor bl, r11b
mov byte [rsp + 0x1f5], bl
xor dil, r11b
mov byte [rsp + 0x1f6], dil
xor sil, r11b
mov byte [rsp + 0x1f7], sil
xor r14b, r11b
mov byte [rsp + 0x1f8], r14b
xor r15b, r11b
mov byte [rsp + 0x1f9], r15b
xor r12b, r11b
mov byte [rsp + 0x1fa], r12b
xor r13b, r11b
mov byte [rsp + 0x1fb], r13b
mov al, 0x67
xor al, r11b
mov byte [rsp + 0x1fc], al
mov al, reloc.WS2_32.dll_WSAGetLastError
xor al, r11b
mov byte [rsp + 0x1fd], al
mov byte [rsp + 0x1fe], 0
mov r9d, 0x40
lea rdx, [rsp + 0x78]
lea rcx, [rsp + 0x1e1]
call fcn.140014980
test al, al
je 0x140055b0f
movdqa xmm1, xmmword [0x1400bd300]
movdqu xmmword [rsp + 0x58], xmm1
mov dl, 0xc
mov r8b, reloc.WS2_32.dll_ntohs
mov r9b, reloc.WS2_32.dll_shutdown
mov r10b, recv
mov r11b, ntohs
mov bl, reloc.WS2_32.dll_recv
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x59], al
xor byte [rsp + 0x5a], cl
xor byte [rsp + 0x5b], cl
xor byte [rsp + 0x5c], cl
xor byte [rsp + 0x5d], cl
xor byte [rsp + 0x5e], cl
xor byte [rsp + 0x5f], cl
xor byte [rsp + 0x60], cl
xor byte [rsp + 0x61], cl
xor byte [rsp + 0x62], cl
xor byte [rsp + 0x63], cl
xor byte [rsp + 0x64], cl
xor byte [rsp + 0x65], cl
xor byte [rsp + 0x66], cl
xor byte [rsp + 0x67], cl
xor dl, cl
mov byte [rsp + 0x68], dl
xor r8b, cl
mov byte [rsp + 0x69], r8b
xor r9b, cl
mov byte [rsp + 0x6a], r9b
xor r10b, cl
mov byte [rsp + 0x6b], r10b
xor r11b, cl
mov byte [rsp + 0x6c], r11b
xor bl, cl
mov byte [rsp + 0x6d], bl
mov byte [rsp + 0x6e], 0
mov rcx, qword [0x1400ffcf0]
mov rax, qword [rcx + 0x3fe0]
mov byte [rax + 0xcd], 1
mov rax, qword [rcx + 0x3fe0]
mov rcx, qword [rax + 0x1c8]
test rcx, rcx
je 0x140055a9a
cmp dword [rcx + 0x10], 2
jne 0x140055a95
cmp dword [rcx + 4], 1
je 0x140055aaa
call fcn.140046950
mov r8d, 1
lea rcx, [rsp + 0x59]
call fcn.140045d90
xor ebx, ebx
nop dword [rax]
mov rax, qword [0x140100980]
mov rdx, qword [0x140100978]
sub rax, rdx
sar rax, 5
cmp rbx, rax
jae 0x140055b05
lea rcx, [rbx + 3]
shl rcx, 5
add rcx, rdx
lea r9, [rbx + 2]
shl r9, 5
add r9, rdx
mov rax, rbx
shl rax, 5
add rdx, rax
lea r8, [rdx + 0x20]
mov qword [rsp + 0x20], rcx
lea rcx, [0x1401003f0]
call fcn.140053560
add rbx, 4
jmp 0x140055ab0
call fcn.1400465f0
call fcn.140014a20
lea rdx, [0x140100651]
call fcn.1400067a0
call fcn.14001a7c0
nop
mov rcx, qword [rsp + 0x208]
xor rcx, rsp
call fcn.1400a86f0
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
ret