Function at 0x14004b3c0
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Enumerate processes

Disassembly:
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x610
xor r14d, r14d
mov r12d, r14d
mov dword [rsp + 0x650], r14d
mov esi, r14d
mov dword [rsp + 0x658], r14d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rsp + 0x660], rax
cmp rax, 0xffffffffffffffff
je 0x14004d505
mov dword [rsp + 0x4d0], 0x130
lea rdx, [rsp + 0x4d0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14004d4f7
mov edi, 0x3523
lea r15d, [rdi + 0x5c]
lea r13d, [rdi + 0x24]
nop word [rax + rax]
cmp byte [rsp + 0x4fc], 0
je 0x14004b87a
xorps xmm0, xmm0
movups xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], r14
mov qword [rsp + 0xd8], r14
lea rax, [rsp + 0x4fc]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14004b480
lea rdx, [rsp + 0x4fc]
lea rcx, [rsp + 0xc0]
call fcn.140041a00
nop
lea rsi, [rsp + 0xc0]
cmp qword [rsp + 0xd8], 0xf
seta cl
mov rbx, qword [rsp + 0xc0]
cmova rsi, rbx
lea rdx, [rsp + 0xc0]
mov rdi, qword [rsp + 0xd0]
test cl, cl
je 0x14004b4d9
add rdi, rbx
jmp 0x14004b4e4
add rdi, rdx
lea rbx, [rsp + 0xc0]
cmp rbx, rdi
je 0x14004b504
sub rsi, rbx
nop dword [rax]
movsx ecx, byte [rbx]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov byte [rbx + rsi], al
inc rbx
cmp rbx, rdi
jne 0x14004b4f0
mov rax, qword gs:[0x58]
mov rdi, qword [rax]
mov eax, 0x358
mov ecx, eax
mov eax, dword [rax + rdi]
mov ebx, 0x1f8
add rbx, rdi
test al, 1
jne 0x14004b556
or eax, 1
mov dword [rcx + rdi], eax
mov word [rbx + 0xb], 0x1ff
mov dword [rbx], 0x9ecabf7a
mov dword [rbx + 4], 0x5a65d89d
mov word [rbx + 8], 0xb970
mov byte [rbx + 0xa], 0xca
lea rcx, [0x140124810]
call fcn.14011f97c
nop
cmp byte [rbx + 0xc], 0
je 0x14004b58d
xor byte [rbx], 0x19
xor byte [rbx + 1], 0xd7
xor byte [rbx + 2], 0xaf
not byte [rbx + 3]
xor byte [rbx + 4], 0xe9
xor byte [rbx + 5], 0xbd
xor byte [rbx + 6], 0xb
xor byte [rbx + 7], 0x3d
xor byte [rbx + 8], 0x19
xor byte [rbx + 9], 0xd7
xor byte [rbx + 0xa], 0xaf
not byte [rbx + 0xb]
mov byte [rbx + 0xc], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x228], xmm0
mov qword [rsp + 0x238], r14
mov qword [rsp + 0x240], r14
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rbx + r8], 0
jne 0x14004b5b0
mov rdx, rbx
lea rcx, [rsp + 0x228]
call fcn.140041a00
nop
or r12d, 1
mov dword [rsp + 0x650], r12d
lea r9, [rsp + 0x228]
mov r15, qword [rsp + 0x228]
mov r13, qword [rsp + 0x240]
cmp r13, 0xf
cmova r9, r15
lea rcx, [rsp + 0xc0]
mov rsi, qword [rsp + 0xd8]
cmp rsi, 0xf
cmova rcx, qword [rsp + 0xc0]
mov rax, qword [rsp + 0x238]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, qword [rsp + 0xd0]
call fcn.140050d30
cmp rax, 0xffffffffffffffff
jne 0x14004b762
mov eax, 0x5a4
mov edx, eax
mov eax, dword [rax + rdi]
mov ecx, 0x4c8
test al, 1
jne 0x14004b684
or eax, 1
mov dword [rdx + rdi], eax
lea rbx, [rcx + rdi]
mov word [rbx + 0xb], 0x1ff
mov dword [rbx], 0x93ccb26b
mov dword [rbx + 4], 0x1378ce88
mov word [rbx + 8], 0xb277
mov byte [rbx + 0xa], 0xdb
lea rcx, [0x1401247f0]
call fcn.14011f97c
nop
jmp 0x14004b688
lea rbx, [rcx + rdi]
cmp byte [rbx + 0xc], 0
je 0x14004b6bf
xor byte [rbx], 0x19
xor byte [rbx + 1], 0xd7
xor byte [rbx + 2], 0xaf
not byte [rbx + 3]
xor byte [rbx + 4], 0xe9
xor byte [rbx + 5], 0xbd
xor byte [rbx + 6], 0xb
xor byte [rbx + 7], 0x3d
xor byte [rbx + 8], 0x19
xor byte [rbx + 9], 0xd7
xor byte [rbx + 0xa], 0xaf
not byte [rbx + 0xb]
mov byte [rbx + 0xc], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x88], r14
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rbx + r8], 0
jne 0x14004b6e0
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.140041a00
or r12d, 2
mov dword [rsp + 0x650], r12d
lea r9, [rsp + 0x70]
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x88]
cmp rdi, 0xf
cmova r9, rbx
lea rcx, [rsp + 0xc0]
mov rsi, qword [rsp + 0xd8]
cmp rsi, 0xf
cmova rcx, qword [rsp + 0xc0]
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov rdx, qword [rsp + 0xd0]
call fcn.140050d30
cmp rax, 0xffffffffffffffff
jne 0x14004b76f
xor r14b, r14b
jmp 0x14004b772
mov rdi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x70]
mov r14b, 1
test r12b, 2
je 0x14004b7c6
and r12d, 0xfffffffd
mov dword [rsp + 0x650], r12d
cmp rdi, 0xf
jbe 0x14004b7c6
lea rdx, [rdi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14004b7b6
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004b7b6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14011f7b8
mov rsi, qword [rsp + 0xd8]
test r12b, 1
je 0x14004b81a
and r12d, 0xfffffffe
mov dword [rsp + 0x650], r12d
cmp r13, 0xf
jbe 0x14004b81a
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x14004b80a
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004b80a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.14011f7b8
mov rsi, qword [rsp + 0xd8]
test r14b, r14b
jne 0x14004d518
cmp rsi, 0xf
jbe 0x14004b862
lea rdx, [rsi + 1]
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b85d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004b85d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
mov r13d, 0x3547
lea r15d, [r13 + 0x38]
mov esi, dword [rsp + 0x658]
lea edi, [r13 - 0x24]
xor r14d, r14d
mov edx, dword [rsp + 0x4d8]
lea rcx, [rsp + 0x70]
call fcn.1400491a0
nop
cmp qword [rsp + 0x80], 0
je 0x14004d46f
mov dword [rsp + 0xe0], 0x3540357f
mov dword [rsp + 0xe4], 0x35423516
mov dword [rsp + 0xe8], 0x3547354f
mov dword [rsp + 0xec], 0x35413546
mov dword [rsp + 0xf0], 0x35483505
mov dword [rsp + 0xf4], 0x35423541
mov word [rsp + 0xf8], r14w
mov byte [rsp + 0xfa], 1
mov rcx, r14
lea eax, [rdi + rcx]
xor word [rsp + rcx*2 + 0xe0], ax
inc rcx
cmp rcx, 0xc
jb 0x14004b8f1
mov byte [rsp + 0xfa], 0
lea r8, [rsp + 0xf8]
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x50]
call fcn.140050e00
bts r12d, 0xf
mov dword [rsp + 0x650], r12d
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x388]
call fcn.140050f60
bts r12d, 0xe
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x14004b995
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b990
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004b990
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r14w
or r12d, 4
mov dword [rsp + 0x650], r12d
lea rax, [rsp + 0x388]
cmp qword [rsp + 0x3a0], 7
cmova rax, qword [rsp + 0x388]
mov qword [rsp + 0x430], rax
mov rax, qword [rsp + 0x398]
mov qword [rsp + 0x438], rax
lea rdx, [rsp + 0x430]
lea rcx, [rsp + 0x30]
call fcn.140053600
bts r12d, 0x10
mov dword [rsp + 0x650], r12d
lea rcx, [rsp + 0x30]
call fcn.140040b90
movzx ebx, al
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x14004ba58
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ba53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004ba53
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
test bl, bl
je 0x14004be25
mov dword [rsp + 0x154], 0x3540357f
mov dword [rsp + 0x158], 0x35423516
mov dword [rsp + 0x15c], 0x3547354f
mov dword [rsp + 0x160], 0x35413546
mov dword [rsp + 0x164], 0x3518351d
mov dword [rsp + 0x168], 0x354a3503
mov dword [rsp + 0x16c], 0x355c3543
mov word [rsp + 0x170], r14w
mov byte [rsp + 0x172], 1
mov rcx, r14
lea eax, [rdi + rcx]
xor word [rsp + rcx*2 + 0x154], ax
inc rcx
cmp rcx, 0xe
jb 0x14004bac1
mov byte [rsp + 0x172], 0
lea r8, [rsp + 0x170]
lea rdx, [rsp + 0x154]
lea rcx, [rsp + 0x30]
call fcn.140050e00
bts r12d, 0x1b
mov dword [rsp + 0x650], r12d
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x228]
call fcn.140050f60
bts r12d, 0x1a
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x14004bb65
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004bb60
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004bb60
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r14w
or r12d, 8
mov dword [rsp + 0x650], r12d
lea rax, [rsp + 0x228]
cmp qword [rsp + 0x240], 7
cmova rax, qword [rsp + 0x228]
mov qword [rsp + 0x420], rax
mov rax, qword [rsp + 0x238]
mov qword [rsp + 0x428], rax
lea rdx, [rsp + 0x420]
lea rcx, [rsp + 0x50]
call fcn.140053600
bts r12d, 0x1c
mov dword [rsp + 0x650], r12d
lea rcx, [rsp + 0x50]
call fcn.140040b90
movzx ebx, al
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x14004bc28
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004bc23
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004bc23
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
test bl, bl
je 0x14004be25
mov dword [rsp + 0x194], 0x3547357f
mov dword [rsp + 0x198], 0x35423540
mov dword [rsp + 0x19c], 0x354c3514
mov dword [rsp + 0x1a0], 0x35423510
mov dword [rsp + 0x1a4], 0x35433544
mov dword [rsp + 0x1a8], 0x35003546
mov dword [rsp + 0x1ac], 0x355c354b
mov dword [rsp + 0x1b0], 0x355d
mov byte [rsp + 0x1b4], 1
mov rcx, r14
nop dword [rax]
nop word [rax + rax]
lea eax, [rdi + rcx]
xor word [rsp + rcx*2 + 0x194], ax
inc rcx
cmp rcx, 0xf
jb 0x14004bca0
mov byte [rsp + 0x1b4], 0
lea r8, [rsp + 0x1b2]
lea rdx, [rsp + 0x194]
lea rcx, [rsp + 0x3a8]
call fcn.140050e00
bts esi, 8
mov dword [rsp + 0x658], esi
lea r8, [rsp + 0x3a8]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x248]
call fcn.140050f60
bts esi, 7
mov dword [rsp + 0x658], esi
mov rdx, qword [rsp + 0x3c0]
cmp rdx, 7
jbe 0x14004bd54
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x3a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004bd4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004bd4f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
mov qword [rsp + 0x3b8], r14
mov qword [rsp + 0x3c0], 7
mov word [rsp + 0x3a8], r14w
or r12d, 0x10
mov dword [rsp + 0x650], r12d
lea rax, [rsp + 0x248]
cmp qword [rsp + 0x260], 7
cmova rax, qword [rsp + 0x248]
mov qword [rsp + 0x410], rax
mov rax, qword [rsp + 0x258]
mov qword [rsp + 0x418], rax
lea rdx, [rsp + 0x410]
lea rcx, [rsp + 0x30]
call fcn.140053600
or esi, 0x40
mov dword [rsp + 0x658], esi
lea rcx, [rsp + 0x30]
call fcn.140040b90
movzx ebx, al
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x14004be1d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004be18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004be18
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
test bl, bl
jne 0x14004cebe
mov dword [rsp + 0x174], 0x3548357f
mov dword [rsp + 0x178], 0x3544354c
mov dword [rsp + 0x17c], 0x3558354e
mov dword [rsp + 0x180], 0x3507355d
mov dword [rsp + 0x184], 0x351e3518
mov dword [rsp + 0x188], 0x354a3503
mov dword [rsp + 0x18c], 0x355c3543
mov word [rsp + 0x190], r14w
mov byte [rsp + 0x192], 1
mov rcx, r14
nop word [rax + rax]
lea eax, [rdi + rcx]
xor word [rsp + rcx*2 + 0x174], ax
inc rcx
cmp rcx, 0xe
jb 0x14004be90
mov byte [rsp + 0x192], 0
lea r8, [rsp + 0x190]
lea rdx, [rsp + 0x174]
lea rcx, [rsp + 0x30]
call fcn.140050e00
bts r12d, 0x13
mov dword [rsp + 0x650], r12d
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x268]
call fcn.140050f60
bts r12d, 0x12
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x14004bf34
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004bf2f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004bf2f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r14w
or r12d, 0x20
mov dword [rsp + 0x650], r12d
lea rax, [rsp + 0x268]
cmp qword [rsp + 0x280], 7
cmova rax, qword [rsp + 0x268]
mov qword [rsp + 0x4c0], rax
mov rax, qword [rsp + 0x278]
mov qword [rsp + 0x4c8], rax
lea rdx, [rsp + 0x4c0]
lea rcx, [rsp + 0x50]
call fcn.140053600
bts r12d, 0x11
mov dword [rsp + 0x650], r12d
lea rcx, [rsp + 0x50]
call fcn.140040b90
movzx ebx, al
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x14004bff7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004bff2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004bff2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
test bl, bl
je 0x14004c1f6
mov dword [rsp + 0x1b6], 0x3548357f
mov dword [rsp + 0x1ba], 0x3544354c
mov dword [rsp + 0x1be], 0x3541354a
mov dword [rsp + 0x1c2], 0x35473542
mov dword [rsp + 0x1c6], 0x35483544
mov dword [rsp + 0x1ca], 0x351c351e
mov dword [rsp + 0x1ce], 0x35543501
mov dword [rsp + 0x1d2], 0x355e355d
mov word [rsp + 0x1d6], r14w
mov byte [rsp + 0x1d8], 1
mov rcx, r14
nop dword [rax + rax]
lea eax, [rdi + rcx]
xor word [rsp + rcx*2 + 0x1b6], ax
inc rcx
cmp rcx, 0x10
jb 0x14004c070
mov byte [rsp + 0x1d8], 0
lea r8, [rsp + 0x1d6]
lea rdx, [rsp + 0x1b6]
lea rcx, [rsp + 0x3c8]
call fcn.140050e00
or r12d, 0x80000000
mov dword [rsp + 0x650], r12d
lea r8, [rsp + 0x3c8]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x288]
call fcn.140050f60
bts r12d, 0x1e
mov rdx, qword [rsp + 0x3e0]
cmp rdx, 7
jbe 0x14004c122
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x3c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c11d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004c11d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
mov qword [rsp + 0x3d8], r14
mov qword [rsp + 0x3e0], 7
mov word [rsp + 0x3c8], r14w
or r12d, 0x40
mov dword [rsp + 0x650], r12d
lea rax, [rsp + 0x288]
cmp qword [rsp + 0x2a0], 7
cmova rax, qword [rsp + 0x288]
mov qword [rsp + 0x4b0], rax
mov rax, qword [rsp + 0x298]
mov qword [rsp + 0x4b8], rax
lea rdx, [rsp + 0x4b0]
lea rcx, [rsp + 0x30]
call fcn.140053600
bts r12d, 0x1d
mov dword [rsp + 0x650], r12d
lea rcx, [rsp + 0x30]
call fcn.140040b90
movzx ebx, al
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x14004c1ee
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c1e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004c1e9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
test bl, bl
jne 0x14004cebe
mov dword [rsp + 0x90], 0x3549357f
mov dword [rsp + 0x94], 0x354f3544
mov dword [rsp + 0x98], 0x35063549
mov dword [rsp + 0x9c], 0x355f3545
mov dword [rsp + 0xa0], 0x354a
mov byte [rsp + 0xa4], 1
mov rcx, r14
nop dword [rax + rax]
lea eax, [rdi + rcx]
xor word [rsp + rcx*2 + 0x90], ax
inc rcx
cmp rcx, 9
jb 0x14004c240
mov byte [rsp + 0xa4], 0
lea r8, [rsp + 0xa2]
lea rdx, [rsp + 0x90]
lea rcx, [rsp + 0x30]
call fcn.140050e00
bts r12d, 0x16
mov dword [rsp + 0x650], r12d
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x2c8]
call fcn.140050f60
bts r12d, 0x15
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x14004c2e4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c2df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004c2df
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r14w
bts r12d, 7
mov dword [rsp + 0x650], r12d
lea rax, [rsp + 0x2c8]
cmp qword [rsp + 0x2e0], 7
cmova rax, qword [rsp + 0x2c8]
mov qword [rsp + 0x480], rax
mov rax, qword [rsp + 0x2d8]
mov qword [rsp + 0x488], rax
lea rdx, [rsp + 0x480]
lea rcx, [rsp + 0x50]
call fcn.140053600
bts r12d, 0x14
mov dword [rsp + 0x650], r12d
lea rcx, [rsp + 0x50]
call fcn.140040b90
movzx ebx, al
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x14004c3a8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c3a3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004c3a3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
test bl, bl
je 0x14004c937
mov dword [rsp + 0xa6], 0x3547357f
mov dword [rsp + 0xaa], 0x35473549
mov dword [rsp + 0xae], 0x355b3554
mov dword [rsp + 0xb2], 0x35463507
mov dword [rsp + 0xb6], 0x354d355e
mov word [rsp + 0xba], r14w
mov byte [rsp + 0xbc], 1
mov rcx, r14
nop dword [rax + rax]
lea eax, [rdi + rcx]
xor word [rsp + rcx*2 + 0xa6], ax
inc rcx
cmp rcx, 0xa
jb 0x14004c400
mov byte [rsp + 0xbc], 0
lea r8, [rsp + 0xba]
lea rdx, [rsp + 0xa6]
lea rcx, [rsp + 0x50]
call fcn.140050e00
or esi, 2
mov dword [rsp + 0x658], esi
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x2e8]
call fcn.140050f60
or esi, 1
mov dword [rsp + 0x658], esi
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x14004c4a6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c4a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004c4a1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r14w
bts r12d, 8
mov dword [rsp + 0x650], r12d
lea rax, [rsp + 0x2e8]
cmp qword [rsp + 0x300], 7
cmova rax, qword [rsp + 0x2e8]
mov qword [rsp + 0x4a0], rax
mov rax, qword [rsp + 0x2f8]
mov qword [rsp + 0x4a8], rax
lea rdx, [rsp + 0x4a0]
lea rcx, [rsp + 0x30]
call fcn.140053600
or esi, 4
mov dword [rsp + 0x658], esi
lea rcx, [rsp + 0x30]
call fcn.140040b90
movzx ebx, al
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x14004c567
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c562
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004c562
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
test bl, bl
je 0x14004c937
mov dword [rsp + 0x1fe], 0x3547357f
mov dword [rsp + 0x202], 0x35473549
mov dword [rsp + 0x206], 0x355b3554
mov dword [rsp + 0x20a], 0x3558355e
mov dword [rsp + 0x20e], 0x355c354a
mov dword [rsp + 0x212], 0x354b355d
mov dword [rsp + 0x216], 0x351e355d
mov dword [rsp + 0x21a], 0x3547355d
mov dword [rsp + 0x21e], 0x3552
mov byte [rsp + 0x222], 1
mov rcx, r14
nop dword [rax]
lea eax, [rdi + rcx]
xor word [rsp + rcx*2 + 0x1fe], ax
inc rcx
cmp rcx, 0x11
jb 0x14004c5e0
mov byte [rsp + 0x222], 0
lea r8, [rsp + 0x220]
lea rdx, [rsp + 0x1fe]
lea rcx, [rsp + 0x30]
call fcn.140050e00
bts esi, 0xa
mov dword [rsp + 0x658], esi
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x308]
call fcn.140050f60
bts esi, 9
mov dword [rsp + 0x658], esi
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x14004c688
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c683
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004c683
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r14w
bts r12d, 9
mov dword [rsp + 0x650], r12d
lea rax, [rsp + 0x308]
cmp qword [rsp + 0x320], 7
cmova rax, qword [rsp + 0x308]
mov qword [rsp + 0x490], rax
mov rax, qword [rsp + 0x318]
mov qword [rsp + 0x498], rax
lea rdx, [rsp + 0x490]
lea rcx, [rsp + 0x50]
call fcn.140053600
bts esi, 0xb
mov dword [rsp + 0x658], esi
lea rcx, [rsp + 0x50]
call fcn.140040b90
movzx ebx, al
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x14004c74a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c745
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004c745
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
test bl, bl
je 0x14004c937
mov dword [rsp + 0xfc], 0x3540357f
mov dword [rsp + 0x100], 0x35403540
mov dword [rsp + 0x104], 0x3546354e
mov dword [rsp + 0x108], 0x3559354c
mov dword [rsp + 0x10c], 0x35403505
mov dword [rsp + 0x110], 0x354f3558
mov word [rsp + 0x114], r14w
mov byte [rsp + 0x116], 1
mov rcx, r14
nop dword [rax + rax]
lea eax, [rdi + rcx]
xor word [rsp + rcx*2 + 0xfc], ax
inc rcx
cmp rcx, 0xc
jb 0x14004c7b0
mov byte [rsp + 0x116], 0
lea r8, [rsp + 0x114]
lea rdx, [rsp + 0xfc]
lea rcx, [rsp + 0x3e8]
call fcn.140050e00
bts esi, 0x10
mov dword [rsp + 0x658], esi
lea r8, [rsp + 0x3e8]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x328]
call fcn.140050f60
bts esi, 0xf
mov dword [rsp + 0x658], esi
mov rdx, qword [rsp + 0x400]
cmp rdx, 7
jbe 0x14004c864
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x3e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c85f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004c85f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
mov qword [rsp + 0x3f8], r14
mov qword [rsp + 0x400], 7
mov word [rsp + 0x3e8], r14w
bts r12d, 0xa
mov dword [rsp + 0x650], r12d
lea rax, [rsp + 0x328]
cmp qword [rsp + 0x340], 7
cmova rax, qword [rsp + 0x328]
mov qword [rsp + 0x470], rax
mov rax, qword [rsp + 0x338]
mov qword [rsp + 0x478], rax
lea rdx, [rsp + 0x470]
lea rcx, [rsp + 0x30]
call fcn.140053600
bts esi, 0x11
mov dword [rsp + 0x658], esi
lea rcx, [rsp + 0x30]
call fcn.140040b90
movzx ebx, al
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x14004c92f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004c92a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004c92a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
test bl, bl
jne 0x14004cebe
mov dword [rsp + 0x1da], 0x3567357f
mov dword [rsp + 0x1de], 0x3543354d
mov dword [rsp + 0x1e2], 0x355c3546
mov dword [rsp + 0x1e6], 0x3544356c
mov dword [rsp + 0x1ea], 0x3545354c
mov dword [rsp + 0x1ee], 0x354b3543
mov dword [rsp + 0x1f2], 0x35533501
mov dword [rsp + 0x1f6], 0x355f3559
mov word [rsp + 0x1fa], r14w
mov byte [rsp + 0x1fc], 1
mov rcx, r14
nop dword [rax]
nop word [rax + rax]
lea eax, [rdi + rcx]
xor word [rsp + rcx*2 + 0x1da], ax
inc rcx
cmp rcx, 0x10
jb 0x14004c9b0
mov byte [rsp + 0x1fc], 0
lea r8, [rsp + 0x1fa]
lea rdx, [rsp + 0x1da]
lea rcx, [rsp + 0x30]
call fcn.140050e00
bts r12d, 0x19
mov dword [rsp + 0x650], r12d
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x348]
call fcn.140050f60
bts r12d, 0x18
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x14004ca54
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ca4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004ca4f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r14w
bts r12d, 0xb
mov dword [rsp + 0x650], r12d
lea rax, [rsp + 0x348]
cmp qword [rsp + 0x360], 7
cmova rax, qword [rsp + 0x348]
mov qword [rsp + 0x460], rax
mov rax, qword [rsp + 0x358]
mov qword [rsp + 0x468], rax
lea rdx, [rsp + 0x460]
lea rcx, [rsp + 0x50]
call fcn.140053600
bts r12d, 0x17
mov dword [rsp + 0x650], r12d
lea rcx, [rsp + 0x50]
call fcn.140040b90
movzx ebx, al
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x14004cb18
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004cb13
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004cb13
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
test bl, bl
jne 0x14004cebe
mov dword [rsp + 0x118], 0x3548357f
mov dword [rsp + 0x11c], 0x35473550
mov dword [rsp + 0x120], 0x351b3512
mov dword [rsp + 0x124], 0x351c3504
mov dword [rsp + 0x128], 0x3502351f
mov dword [rsp + 0x12c], 0x35423549
mov dword [rsp + 0x130], 0x3543
mov byte [rsp + 0x134], 1
mov rcx, r14
nop dword [rax + rax]
lea eax, [rdi + rcx]
xor word [rsp + rcx*2 + 0x118], ax
inc rcx
cmp rcx, 0xd
jb 0x14004cb80
mov byte [rsp + 0x134], 0
lea r8, [rsp + 0x132]
lea rdx, [rsp + 0x118]
lea rcx, [rsp + 0x50]
call fcn.140050e00
or esi, 0x10
mov dword [rsp + 0x658], esi
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x368]
call fcn.140050f60
or esi, 8
mov dword [rsp + 0x658], esi
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x14004cc26
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004cc21
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004cc21
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r14w
bts r12d, 0xc
mov dword [rsp + 0x650], r12d
lea rax, [rsp + 0x368]
cmp qword [rsp + 0x380], 7
cmova rax, qword [rsp + 0x368]
mov qword [rsp + 0x450], rax
mov rax, qword [rsp + 0x378]
mov qword [rsp + 0x458], rax
lea rdx, [rsp + 0x450]
lea rcx, [rsp + 0x30]
call fcn.140053600
or esi, 0x20
mov dword [rsp + 0x658], esi
lea rcx, [rsp + 0x30]
call fcn.140040b90
movzx ebx, al
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x14004cce7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004cce2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004cce2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
test bl, bl
jne 0x14004cebe
mov dword [rsp + 0x136], 0x3548357f
mov dword [rsp + 0x13a], 0x35473550
mov dword [rsp + 0x13e], 0x351b3512
mov dword [rsp + 0x142], 0x35193504
mov dword [rsp + 0x146], 0x35023519
mov dword [rsp + 0x14a], 0x35423549
mov dword [rsp + 0x14e], 0x3543
mov byte [rsp + 0x152], 1
mov rcx, r14
nop word [rax + rax]
lea eax, [rdi + rcx]
xor word [rsp + rcx*2 + 0x136], ax
inc rcx
cmp rcx, 0xd
jb 0x14004cd50
mov byte [rsp + 0x152], 0
lea r8, [rsp + 0x150]
lea rdx, [rsp + 0x136]
lea rcx, [rsp + 0x30]
call fcn.140050e00
bts esi, 0xd
mov dword [rsp + 0x658], esi
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x2a8]
call fcn.140050f60
bts esi, 0xc
mov dword [rsp + 0x658], esi
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x14004cdf8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004cdf3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004cdf3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r14w
bts r12d, 0xd
mov dword [rsp + 0x650], r12d
lea rax, [rsp + 0x2a8]
cmp qword [rsp + 0x2c0], 7
cmova rax, qword [rsp + 0x2a8]
mov qword [rsp + 0x440], rax
mov rax, qword [rsp + 0x2b8]
mov qword [rsp + 0x448], rax
lea rdx, [rsp + 0x440]
lea rcx, [rsp + 0x50]
call fcn.140053600
bts esi, 0xe
mov dword [rsp + 0x658], esi
lea rcx, [rsp + 0x50]
call fcn.140040b90
movzx ebx, al
mov rdx, qword [rsp + 0x68]
cmp rdx, 7
jbe 0x14004ceba
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004ceb5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004ceb5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
test bl, bl
je 0x14004cec0
mov bl, 1
bt r12d, 0xd
jae 0x14004cf3c
btr r12d, 0xd
mov dword [rsp + 0x650], r12d
mov rdx, qword [rsp + 0x2c0]
cmp rdx, 7
jbe 0x14004cf1f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004cf1a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004cf1a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
mov qword [rsp + 0x2b8], r14
mov qword [rsp + 0x2c0], 7
mov word [rsp + 0x2a8], r14w
bt r12d, 0xc
jae 0x14004cfb8
btr r12d, 0xc
mov dword [rsp + 0x650], r12d
mov rdx, qword [rsp + 0x380]
cmp rdx, 7
jbe 0x14004cf9b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x368]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004cf96
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004cf96
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
mov qword [rsp + 0x378], r14
mov qword [rsp + 0x380], 7
mov word [rsp + 0x368], r14w
bt r12d, 0xb
jae 0x14004d034
btr r12d, 0xb
mov dword [rsp + 0x650], r12d
mov rdx, qword [rsp + 0x360]
cmp rdx, 7
jbe 0x14004d017
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x348]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d012
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004d012
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
mov qword [rsp + 0x358], r14
mov qword [rsp + 0x360], 7
mov word [rsp + 0x348], r14w
bt r12d, 0xa
jae 0x14004d0b0
btr r12d, 0xa
mov dword [rsp + 0x650], r12d
mov rdx, qword [rsp + 0x340]
cmp rdx, 7
jbe 0x14004d093
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x328]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d08e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004d08e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
mov qword [rsp + 0x338], r14
mov qword [rsp + 0x340], 7
mov word [rsp + 0x328], r14w
bt r12d, 9
jae 0x14004d12c
btr r12d, 9
mov dword [rsp + 0x650], r12d
mov rdx, qword [rsp + 0x320]
cmp rdx, 7
jbe 0x14004d10f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x308]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d10a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004d10a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
mov qword [rsp + 0x318], r14
mov qword [rsp + 0x320], 7
mov word [rsp + 0x308], r14w
bt r12d, 8
jae 0x14004d1a8
btr r12d, 8
mov dword [rsp + 0x650], r12d
mov rdx, qword [rsp + 0x300]
cmp rdx, 7
jbe 0x14004d18b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d186
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004d186
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
mov qword [rsp + 0x2f8], r14
mov qword [rsp + 0x300], 7
mov word [rsp + 0x2e8], r14w
test r12b, r12b
jns 0x14004d222
btr r12d, 7
mov dword [rsp + 0x650], r12d
mov rdx, qword [rsp + 0x2e0]
cmp rdx, 7
jbe 0x14004d205
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x2c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d200
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004d200
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
mov qword [rsp + 0x2d8], r14
mov qword [rsp + 0x2e0], 7
mov word [rsp + 0x2c8], r14w
test r12b, 0x40
je 0x14004d29c
and r12d, 0xffffffbf
mov dword [rsp + 0x650], r12d
mov rdx, qword [rsp + 0x2a0]
cmp rdx, 7
jbe 0x14004d27f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x288]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d27a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004d27a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
mov qword [rsp + 0x298], r14
mov qword [rsp + 0x2a0], 7
mov word [rsp + 0x288], r14w
test r12b, 0x20
je 0x14004d316
and r12d, 0xffffffdf
mov dword [rsp + 0x650], r12d
mov rdx, qword [rsp + 0x280]
cmp rdx, 7
jbe 0x14004d2f9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x268]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d2f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004d2f4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
mov qword [rsp + 0x278], r14
mov qword [rsp + 0x280], 7
mov word [rsp + 0x268], r14w
test r12b, 0x10
je 0x14004d390
and r12d, 0xffffffef
mov dword [rsp + 0x650], r12d
mov rdx, qword [rsp + 0x260]
cmp rdx, 7
jbe 0x14004d373
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d36e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004d36e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
mov qword [rsp + 0x258], r14
mov qword [rsp + 0x260], 7
mov word [rsp + 0x248], r14w
test r12b, 8
je 0x14004d40a
and r12d, 0xfffffff7
mov dword [rsp + 0x650], r12d
mov rdx, qword [rsp + 0x240]
cmp rdx, 7
jbe 0x14004d3ed
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x228]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d3e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004d3e8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
mov qword [rsp + 0x238], r14
mov qword [rsp + 0x240], 7
mov word [rsp + 0x228], r14w
test r12b, 4
je 0x14004d467
and r12d, 0xfffffffb
mov dword [rsp + 0x650], r12d
mov rdx, qword [rsp + 0x3a0]
cmp rdx, 7
jbe 0x14004d467
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x388]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d462
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004d462
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
test bl, bl
jne 0x14004d51e
mov rdx, qword [rsp + 0x88]
cmp rdx, 7
jbe 0x14004d4b8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004d4b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004d4b2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14011f7b8
nop
jmp 0x14004d4d2
lea rdx, [rsp + 0x4d0]
mov rcx, qword [rsp + 0x660]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
mov esi, dword [rsp + 0x658]
jne 0x14004b440
mov rcx, qword [rsp + 0x660]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x610
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
ret
call fcn.1400490b0
nop
call fcn.1400490b0
int3