Function at 0x140004b10
Capabilities:
Access peb ldr_data
Enumerate processes
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x678
movaps xmmword [rsp + 0x640], xmm6
movaps xmmword [rsp + 0x650], xmm7
movaps xmmword [rsp + 0x660], xmm8
movzx eax, word [0x14016f7b0]
movdqa xmm0, xmmword [0x14016f7d0]
mov ecx, 0x20
movq xmm8, qword [0x14016f7a8]
mov byte [rsp + 0xe0], 0
lea rbp, [rsp + 0x2f0]
mov word [rsp + 0xa8], ax
mov rdi, rbp
movaps xmmword [rsp + 0xd0], xmm0
movq qword [rsp + 0xa0], xmm8
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rsi, qword [rax + 0x20]
lea rdx, [rax + 0x20]
xor eax, eax
rep stosq qword [rdi], rax
mov dword [rdi], 0
cmp rdx, rsi
je 0x140003c76
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x40], rdx
mov r13, qword [sym.imp.msvcrt.dll_strcpy_s]
lea rbx, [rsp + 0x1e0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x510]
mov r14, qword [sym.imp.msvcrt.dll__strlwr]
xor r15d, r15d
mov qword [rsp + 0x50], rax
lea r12, [rsp + 0x400]
nop
mov rax, r15
mov ecx, 0x20
mov rdi, rbx
xor edx, edx
rep stosq qword [rdi], rax
mov ecx, 0x20
mov r9d, 0xffffffff
mov dword [rdi], 0
mov rdi, rbp
rep stosq qword [rdi], rax
mov dword [rdi], 0
mov r8, qword [rsi + 0x40]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r8, qword [rsp + 0x48]
mov edx, 0x104
mov rcx, rbp
call r13
mov r8, rbp
mov edx, 0x104
mov rcx, r12
call r13
mov rdi, qword [rsp + 0x50]
mov edx, 0x104
mov r8, rbx
mov rcx, rdi
call r13
mov rcx, r12
call r14
mov rcx, rdi
call r14
mov rdx, r12
mov rcx, rdi
call sub.msvcrt.dll_strstr
test rax, rax
je 0x140003c68
mov r15, qword [rsi + 0x20]
movsxd rax, dword [r15 + 0x3c]
add rax, r15
mov ecx, dword [rax + 0x8c]
test ecx, ecx
je 0x140003c9a
mov edx, dword [rax + 0x88]
add rdx, r15
mov r8d, dword [rdx + 0x20]
mov edi, dword [rdx + 0x18]
add r8, r15
test edi, edi
je 0x140003c9a
mov eax, edi
xor edi, edi
mov qword [rsp + 0x40], rbp
lea rsi, [rsp + 0xd0]
mov qword [rsp + 0x58], rbx
mov rbp, rdi
mov rbx, r8
mov rdi, rax
mov qword [rsp + 0x60], rdx
jmp 0x140003991
add rbp, 1
add rbx, 4
cmp rdi, rbp
je 0x140003c90
mov ecx, dword [rbx]
mov rdx, rsi
add rcx, r15
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140003980
mov rdx, qword [rsp + 0x60]
mov rdi, rbp
mov rbx, qword [rsp + 0x58]
lea rcx, [r15 + rdi*2]
mov rbp, qword [rsp + 0x40]
mov eax, dword [rdx + 0x1c]
mov edx, dword [rdx + 0x24]
movzx edx, word [rcx + rdx]
lea rdx, [r15 + rdx*4]
mov eax, dword [rdx + rax]
add r15, rax
mov qword [rsp + 0x68], r15
je 0x140003c9a
pxor xmm0, xmm0
mov ecx, 0x20
mov rdi, rbp
movzx eax, word [0x14016f7b0]
movups xmmword [rsp + 0xe4], xmm0
movups xmmword [rsp + 0xd4], xmm0
movups xmmword [rsp + 0xf0], xmm0
movdqa xmm0, xmmword [str.NtCurrentProcessNtCreateSnapshotNtClose]
mov byte [rsp + 0xb0], 0
mov word [rsp + 0x98], ax
movaps xmmword [rsp + 0xa0], xmm0
movq qword [rsp + 0x90], xmm8
mov qword [rsp + 0x88], 0
mov rax, qword gs:[0x60]
mov dword [rsp + 0xd0], 0x30
mov rax, qword [rax + 0x18]
mov r10, qword [rax + 0x20]
lea rdx, [rax + 0x20]
xor eax, eax
rep stosq qword [rdi], rax
mov dword [rdi], 0
cmp rdx, r10
je 0x140003c76
lea rax, [rsp + 0x90]
mov qword [rsp + 0x40], rdx
mov r15, qword [rsp + 0x50]
xor r11d, r11d
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rsi
mov rsi, r10
nop
mov rax, r11
mov ecx, 0x20
mov rdi, rbx
xor edx, edx
rep stosq qword [rdi], rax
mov ecx, 0x20
mov r9d, 0xffffffff
mov dword [rdi], 0
mov rdi, rbp
rep stosq qword [rdi], rax
mov dword [rdi], 0
mov r8, qword [rsi + 0x40]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], r11
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r8, qword [rsp + 0x58]
mov edx, 0x104
mov rcx, rbp
call r13
mov r8, rbp
mov edx, 0x104
mov rcx, r12
call r13
mov r8, rbx
mov edx, 0x104
mov rcx, r15
call r13
mov rcx, r12
call r14
mov rcx, r15
call r14
mov rdx, r12
mov rcx, r15
call sub.msvcrt.dll_strstr
xor r11d, r11d
test rax, rax
je 0x140003c80
mov r10, rsi
mov rsi, qword [rsp + 0x60]
mov r15, qword [r10 + 0x20]
movsxd rax, dword [r15 + 0x3c]
add rax, r15
mov edx, dword [rax + 0x8c]
test edx, edx
je 0x14000473d
mov edx, dword [rax + 0x88]
add rdx, r15
mov r8d, dword [rdx + 0x20]
mov edi, dword [rdx + 0x18]
add r8, r15
test edi, edi
je 0x14000473d
mov eax, edi
xor edi, edi
mov qword [rsp + 0x40], rbp
mov rbp, qword [rsp + 0x48]
mov qword [rsp + 0x58], rbx
mov rbx, r8
mov qword [rsp + 0x60], rsi
mov rsi, rdi
mov rdi, rax
mov qword [rsp + 0x70], rdx
jmp 0x140003ba9
add rsi, 1
add rbx, 4
cmp rdi, rsi
je 0x14000472e
mov ecx, dword [rbx]
mov rdx, rbp
add rcx, r15
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140003b98
mov rdx, qword [rsp + 0x70]
mov rdi, rsi
mov rbp, qword [rsp + 0x40]
lea rcx, [r15 + rdi*2]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
mov eax, dword [rdx + 0x1c]
mov edx, dword [rdx + 0x24]
movzx edx, word [rcx + rdx]
lea rdx, [r15 + rdx*4]
mov eax, dword [rdx + rax]
add rax, r15
je 0x14000473d
call rax
mov rcx, rax
lea rax, [rsp + 0x88]
mov dword [rsp + 0x20], 0
mov r8, rsi
mov edx, 0x1fffff
mov qword [rsp + 0x28], rax
mov r9d, 2
mov rax, qword [rsp + 0x68]
call rax
test eax, eax
js 0x140003c9a
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x60], rax
cmp rax, 0xffffffffffffffff
jne 0x140003ca3
xor eax, eax
movaps xmm6, xmmword [rsp + 0x640]
movaps xmm7, xmmword [rsp + 0x650]
movaps xmm8, xmmword [rsp + 0x660]
add rsp, 0x678
pop rbx
pop rsi
pop rdi
pop rbp
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, qword [rsi]
cmp qword [rsp + 0x40], rsi
jne 0x140003880
mov eax, dword [0x3c]
ud2
mov rsi, qword [rsi]
cmp qword [rsp + 0x40], rsi
jne 0x140003a90
jmp 0x140003c76
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
mov qword [rsp + 0x60], 0
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
mov dword [rsp + 0x510], 0x130
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x14000415f
movdqa xmm6, xmmword [str.NtQueryInformationProcesntdll.dll]
movq xmm7, qword [0x14016f7a0]
nop dword [rax]
lea rcx, [0x14016f760]
mov esi, dword [rsp + 0x518]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
test rax, rax
je 0x140003d46
mov eax, 0x73
movaps xmmword [rsp + 0x400], xmm6
mov rdx, r12
mov word [rsp + 0x418], ax
movq qword [rsp + 0x410], xmm7
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rdi, rax
test rax, rax
je 0x140003d46
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
mov qword [rsp + 0x20], rbp
mov r8, r12
mov rcx, rax
mov r9d, 0x30
call rdi
test eax, eax
jns 0x140004308
xor eax, eax
cmp esi, eax
je 0x140004148
mov eax, dword [rsp + 0x518]
pxor xmm0, xmm0
mov ecx, 0x20
mov rdi, rbx
movups xmmword [rsp + 0xa8], xmm0
mov qword [rsp + 0x90], rax
movaps xmmword [rsp + 0xc0], xmm0
mov rax, qword gs:[0x60]
mov qword [rsp + 0x98], 0
mov rax, qword [rax + 0x18]
mov dword [rsp + 0xa0], 0x30
mov r15, qword [rax + 0x20]
lea rdx, [rax + 0x20]
xor eax, eax
mov dword [rsp + 0xb8], 0
rep stosq qword [rdi], rax
mov dword [rdi], 0
cmp rdx, r15
je 0x140003c76
mov qword [rsp + 0x40], rdx
lea rsi, [rsp + 0xd0]
xor r10d, r10d
nop word cs:[rax + rax]
mov rax, r10
mov ecx, 0x20
mov rdi, rsi
xor edx, edx
rep stosq qword [rdi], rax
mov ecx, 0x20
mov r9d, 0xffffffff
mov dword [rdi], 0
mov rdi, rbx
rep stosq qword [rdi], rax
mov dword [rdi], 0
mov r8, qword [r15 + 0x40]
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
lea r8, str.ntdll.dll
mov edx, 0x104
mov rcx, rbx
call r13
mov r8, rbx
mov edx, 0x104
mov rcx, rbp
call r13
mov r8, rsi
mov edx, 0x104
mov rcx, r12
call r13
mov rcx, rbp
call r14
mov rcx, r12
call r14
mov rdx, rbp
mov rcx, r12
call sub.msvcrt.dll_strstr
xor r10d, r10d
test rax, rax
je 0x140004318
mov r15, qword [r15 + 0x20]
movsxd rdx, dword [r15 + 0x3c]
add rdx, r15
mov eax, dword [rdx + 0x8c]
test eax, eax
je 0x140004148
mov edx, dword [rdx + 0x88]
add rdx, r15
mov r8d, dword [rdx + 0x20]
mov edi, dword [rdx + 0x18]
add r8, r15
test edi, edi
je 0x140004148
mov eax, edi
xor edi, edi
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x68], rsi
mov rbx, rdi
mov rsi, rax
mov rdi, r8
mov qword [rsp + 0x58], rdx
jmp 0x140003ee9
add rbx, 1
add rdi, 4
cmp rsi, rbx
je 0x140004360
mov ecx, dword [rdi]
lea rdx, str.NtOpenProcess
add rcx, r15
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140003ed8
mov rdx, qword [rsp + 0x58]
mov rdi, rbx
mov rsi, qword [rsp + 0x68]
lea r8, [r15 + rdi*2]
mov rbx, qword [rsp + 0x40]
mov ecx, dword [rdx + 0x1c]
mov edx, dword [rdx + 0x24]
movzx edx, word [r8 + rdx]
lea rdx, [r15 + rdx*4]
mov edx, dword [rdx + rcx]
mov rax, rdx
add rax, r15
je 0x140004148
lea rdx, [rsp + 0x90]
mov r8, qword [rsp + 0x48]
mov rcx, r12
mov qword [rsp + 0x58], rdx
mov r9, rdx
mov edx, 0x410
call rax
test eax, eax
js 0x140004148
mov rcx, qword [rsp + 0x400]
mov qword [rsp + 0x68], rcx
test rcx, rcx
je 0x140004148
lea rdx, [rsp + 0x88]
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x140003f92
cmp dword [rsp + 0x88], 0x103
je 0x140004379
mov rax, qword [0x14016f7e0]
mov ecx, 0x20
mov rdi, rbx
movq qword [rsp + 0xa0], xmm8
mov qword [rsp + 0x90], rax
movzx eax, word [0x14016f7b0]
mov word [rsp + 0xa8], ax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r15, qword [rax + 0x20]
lea rdx, [rax + 0x20]
xor eax, eax
rep stosq qword [rdi], rax
mov dword [rdi], 0
cmp rdx, r15
je 0x140003c76
mov qword [rsp + 0x40], rdx
xor r11d, r11d
nop dword [rax + rax]
mov rax, r11
mov ecx, 0x20
mov rdi, rsi
xor edx, edx
rep stosq qword [rdi], rax
mov ecx, 0x20
mov r9d, 0xffffffff
mov dword [rdi], 0
mov rdi, rbx
rep stosq qword [rdi], rax
mov dword [rdi], 0
mov r8, qword [r15 + 0x40]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], r11
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r8, qword [rsp + 0x48]
mov edx, 0x104
mov rcx, rbx
call r13
mov r8, rbx
mov edx, 0x104
mov rcx, rbp
call r13
mov r8, rsi
mov edx, 0x104
mov rcx, r12
call r13
mov rcx, rbp
call r14
mov rcx, r12
call r14
mov rdx, rbp
mov rcx, r12
call sub.msvcrt.dll_strstr
xor r11d, r11d
test rax, rax
je 0x140004330
mov rdi, qword [r15 + 0x20]
movsxd rax, dword [rdi + 0x3c]
add rax, rdi
mov ecx, dword [rax + 0x8c]
test ecx, ecx
je 0x140004148
mov edx, dword [rax + 0x88]
add rdx, rdi
mov r8d, dword [rdx + 0x20]
mov esi, dword [rdx + 0x18]
lea r15, [r8 + rdi]
test esi, esi
je 0x140004148
mov eax, esi
xor esi, esi
mov qword [rsp + 0x40], rbp
mov qword [rsp + 0x70], rbx
mov rbp, rsi
mov rbx, r15
mov rsi, rax
mov qword [rsp + 0x78], rdx
mov r15, qword [rsp + 0x58]
jmp 0x140004101
add rbp, 1
add rbx, 4
cmp rsi, rbp
je 0x14000436a
mov ecx, dword [rbx]
mov rdx, r15
add rcx, rdi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x1400040f0
mov rdx, qword [rsp + 0x78]
mov rsi, rbp
mov rbx, qword [rsp + 0x70]
lea rcx, [rdi + rsi*2]
mov rbp, qword [rsp + 0x40]
mov eax, dword [rdx + 0x1c]
mov edx, dword [rdx + 0x24]
movzx edx, word [rcx + rdx]
lea rdx, [rdi + rdx*4]
mov eax, dword [rdx + rax]
add rax, rdi
je 0x140004148
mov rcx, qword [rsp + 0x68]
call rax
nop dword [rax]
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x60]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x140003cd8
mov rax, qword [0x14016f7e0]
mov ecx, 0x20
mov rdi, rbx
movq qword [rsp + 0xa0], xmm8
mov qword [rsp + 0x90], rax
movzx eax, word [0x14016f7b0]
mov word [rsp + 0xa8], ax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r15, qword [rax + 0x20]
lea rdx, [rax + 0x20]
xor eax, eax
rep stosq qword [rdi], rax
mov dword [rdi], 0
cmp rdx, r15
je 0x140003c76
mov qword [rsp + 0x40], rdx
lea rsi, [rsp + 0xd0]
xor r10d, r10d
nop dword [rax + rax]
mov rax, r10
mov ecx, 0x20
mov rdi, rsi
xor edx, edx
rep stosq qword [rdi], rax
mov ecx, 0x20
mov r9d, 0xffffffff
mov dword [rdi], 0
mov rdi, rbx
rep stosq qword [rdi], rax
mov dword [rdi], 0
mov r8, qword [r15 + 0x40]
mov qword [rsp + 0x38], r10
mov qword [rsp + 0x30], r10
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r8, qword [rsp + 0x48]
mov edx, 0x104
mov rcx, rbx
call r13
mov r8, rbx
mov edx, 0x104
mov rcx, rbp
call r13
mov r8, rsi
mov edx, 0x104
mov rcx, r12
call r13
mov rcx, rbp
call r14
mov rcx, r12
call r14
mov rdx, rbp
mov rcx, r12
call sub.msvcrt.dll_strstr
xor r10d, r10d
test rax, rax
je 0x140004348
mov rbx, qword [r15 + 0x20]
movsxd rax, dword [rbx + 0x3c]
add rax, rbx
mov edx, dword [rax + 0x8c]
test edx, edx
je 0x140003c35
mov r12d, dword [rax + 0x88]
add r12, rbx
mov esi, dword [r12 + 0x20]
mov ebp, dword [r12 + 0x18]
add rsi, rbx
test ebp, ebp
je 0x140003c35
xor edi, edi
lea r13, [rsp + 0x90]
jmp 0x1400042c9
add rdi, 1
add rsi, 4
cmp rbp, rdi
je 0x140003c35
mov ecx, dword [rsi]
mov rdx, r13
add rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x1400042b8
mov edx, dword [r12 + 0x24]
lea rcx, [rbx + rdi*2]
mov eax, dword [r12 + 0x1c]
movzx edx, word [rcx + rdx]
lea rdx, [rbx + rdx*4]
mov eax, dword [rdx + rax]
add rax, rbx
je 0x140003c35
mov rcx, qword [rsp + 0x60]
call rax
jmp 0x140003c35
mov eax, dword [rsp + 0x420]
jmp 0x140003d48
mov r15, qword [r15]
cmp qword [rsp + 0x40], r15
jne 0x140003de0
jmp 0x140003c76
mov r15, qword [r15]
cmp qword [rsp + 0x40], r15
jne 0x140003ff8
jmp 0x140003c76
mov r15, qword [r15]
cmp qword [rsp + 0x40], r15
jne 0x1400041d0
jmp 0x140003c76
mov rbx, qword [rsp + 0x40]
jmp 0x140004148
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x70]
jmp 0x140004148
mov edi, dword [rsp + 0x530]
test edi, edi
je 0x140004790
lea rcx, [0x14016f760]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
test rax, rax
je 0x1400043f8
mov rax, qword [0x14016f7a0]
mov r10d, 0x73
movaps xmmword [rsp + 0x400], xmm6
mov rdx, r12
mov word [rsp + 0x418], r10w
mov qword [rsp + 0x410], rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r15, rax
test rax, rax
je 0x1400043f8
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
xor edx, edx
mov qword [rsp + 0x20], rbp
mov r8, r12
mov rcx, rax
mov r9d, 0x30
call r15
test eax, eax
jns 0x140004744
movzx eax, word [0x14016f7b0]
mov ecx, 0x20
mov rdi, rbx
movq xmm6, qword [0x14016f7e0]
movq qword [rsp + 0xa0], xmm8
mov word [rsp + 0xa8], ax
movq qword [rsp + 0x90], xmm6
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r10, qword [rax + 0x20]
lea rdx, [rax + 0x20]
xor eax, eax
rep stosq qword [rdi], rax
mov qword [rsp + 0x40], rdx
mov dword [rdi], 0
cmp rdx, r10
je 0x140003c76
xor r11d, r11d
mov r15, r10
mov rax, r11
mov ecx, 0x20
mov rdi, rsi
xor edx, edx
rep stosq qword [rdi], rax
mov ecx, 0x20
mov r9d, 0xffffffff
mov dword [rdi], 0
mov rdi, rbx
rep stosq qword [rdi], rax
mov dword [rdi], 0
mov r8, qword [r15 + 0x40]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], r11
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r8, qword [rsp + 0x48]
mov edx, 0x104
mov rcx, rbx
call r13
mov r8, rbx
mov edx, 0x104
mov rcx, rbp
call r13
mov r8, rsi
mov edx, 0x104
mov rcx, r12
call r13
mov rcx, rbp
call r14
mov rcx, r12
call r14
mov rdx, rbp
mov rcx, r12
call sub.msvcrt.dll_strstr
xor r11d, r11d
test rax, rax
je 0x140004778
mov r8, qword [r15 + 0x20]
movsxd rax, dword [r8 + 0x3c]
add rax, r8
mov r9d, dword [rax + 0x8c]
test r9d, r9d
je 0x1400045b5
mov eax, dword [rax + 0x88]
add rax, r8
mov r9d, dword [rax + 0x20]
mov edi, dword [rax + 0x18]
add r9, r8
test edi, edi
je 0x1400045b5
xor r10d, r10d
mov qword [rsp + 0x40], rbx
mov r15, r9
mov qword [rsp + 0x50], r12
mov rbx, r10
mov r12, rbp
mov rbp, rax
mov qword [rsp + 0x70], rsi
mov rsi, r8
jmp 0x140004565
add rbx, 1
add r15, 4
cmp rdi, rbx
je 0x140004af7
mov ecx, dword [r15]
mov rdx, qword [rsp + 0x58]
add rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140004554
mov rax, rbp
mov r8, rsi
mov r10, rbx
mov rbp, r12
mov edx, dword [rax + 0x1c]
mov eax, dword [rax + 0x24]
lea rcx, [r8 + r10*2]
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x50]
movzx eax, word [rcx + rax]
mov rsi, qword [rsp + 0x70]
lea rax, [r8 + rax*4]
mov eax, dword [rax + rdx]
add rax, r8
je 0x1400045b5
mov rcx, qword [rsp + 0x68]
call rax
movzx eax, word [0x14016f7b0]
mov ecx, 0x20
mov rdi, rbx
movq qword [rsp + 0x90], xmm6
movq qword [rsp + 0xa0], xmm8
mov word [rsp + 0xa8], ax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r10, qword [rax + 0x20]
lea rdx, [rax + 0x20]
xor eax, eax
rep stosq qword [rdi], rax
mov qword [rsp + 0x40], rdx
mov dword [rdi], 0
cmp rdx, r10
je 0x140003c76
xor r11d, r11d
mov r15, r10
mov rax, r11
mov ecx, 0x20
mov rdi, rsi
xor edx, edx
rep stosq qword [rdi], rax
mov ecx, 0x20
mov r9d, 0xffffffff
mov dword [rdi], 0
mov rdi, rbx
rep stosq qword [rdi], rax
mov dword [rdi], 0
mov r8, qword [r15 + 0x40]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], r11
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r8, qword [rsp + 0x48]
mov edx, 0x104
mov rcx, rbx
call r13
mov r8, rbx
mov edx, 0x104
mov rcx, rbp
call r13
mov r8, rsi
mov edx, 0x104
mov rcx, r12
call r13
mov rcx, rbp
call r14
mov rcx, r12
call r14
mov rdx, rbp
mov rcx, r12
call sub.msvcrt.dll_strstr
xor r11d, r11d
test rax, rax
je 0x140004760
mov rbx, qword [r15 + 0x20]
movsxd rax, dword [rbx + 0x3c]
add rax, rbx
mov r8d, dword [rax + 0x8c]
test r8d, r8d
je 0x140004724
mov esi, dword [rax + 0x88]
add rsi, rbx
mov edi, dword [rsi + 0x20]
mov r12d, dword [rsi + 0x18]
add rdi, rbx
test r12d, r12d
je 0x140004724
xor ebp, ebp
jmp 0x1400046f0
add rbp, 1
add rdi, 4
cmp r12, rbp
je 0x140004724
mov ecx, dword [rdi]
mov rdx, qword [rsp + 0x58]
add rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x1400046e3
mov edx, dword [rsi + 0x24]
lea rcx, [rbx + rbp*2]
mov eax, dword [rsi + 0x1c]
movzx edx, word [rcx + rdx]
lea rdx, [rbx + rdx*4]
mov eax, dword [rdx + rax]
add rax, rbx
je 0x140004724
mov rcx, qword [rsp + 0x60]
call rax
mov eax, 1
jmp 0x140003c37
mov rbp, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x58]
mov rsi, qword [rsp + 0x60]
xor ecx, ecx
jmp 0x140003bf4
cmp edi, dword [rsp + 0x420]
je 0x140003f92
jmp 0x1400043f8
mov r15, qword [r15]
cmp qword [rsp + 0x40], r15
jne 0x140004613
jmp 0x140003c76
mov r15, qword [r15]
cmp qword [rsp + 0x40], r15
jne 0x14000445e
jmp 0x140003c76
movzx eax, word [0x14016f7b0]
mov ecx, 0x20
mov rdi, rbx
movq xmm6, qword [0x14016f7e0]
movq qword [rsp + 0xa0], xmm8
mov word [rsp + 0xa8], ax
movq qword [rsp + 0x90], xmm6
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r10, qword [rax + 0x20]
lea rdx, [rax + 0x20]
xor eax, eax
rep stosq qword [rdi], rax
mov qword [rsp + 0x40], rdx
mov dword [rdi], 0
cmp rdx, r10
je 0x140003c76
xor r11d, r11d
mov r15, r10
mov rax, r11
mov ecx, 0x20
mov rdi, rsi
xor edx, edx
rep stosq qword [rdi], rax
mov ecx, 0x20
mov r9d, 0xffffffff
mov dword [rdi], 0
mov rdi, rbx
rep stosq qword [rdi], rax
mov dword [rdi], 0
mov r8, qword [r15 + 0x40]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], r11
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r8, qword [rsp + 0x48]
mov edx, 0x104
mov rcx, rbx
call r13
mov r8, rbx
mov edx, 0x104
mov rcx, rbp
call r13
mov r8, rsi
mov edx, 0x104
mov rcx, r12
call r13
mov rcx, rbp
call r14
mov rcx, r12
call r14
mov rdx, rbp
mov rcx, r12
call sub.msvcrt.dll_strstr
xor r11d, r11d
test rax, rax
je 0x140004ab0
mov r8, qword [r15 + 0x20]
movsxd rax, dword [r8 + 0x3c]
add rax, r8
mov edi, dword [rax + 0x8c]
test edi, edi
je 0x14000494b
mov eax, dword [rax + 0x88]
add rax, r8
mov r9d, dword [rax + 0x20]
mov edi, dword [rax + 0x18]
add r9, r8
test edi, edi
je 0x14000494b
xor r10d, r10d
mov qword [rsp + 0x40], rbx
mov r15, r9
mov qword [rsp + 0x50], r12
mov rbx, r10
mov r12, rbp
mov rbp, rax
mov qword [rsp + 0x70], rsi
mov rsi, r8
jmp 0x1400048fb
add rbx, 1
add r15, 4
cmp rdi, rbx
je 0x140004ae0
mov ecx, dword [r15]
mov rdx, qword [rsp + 0x58]
add rcx, rsi
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x1400048ea
mov rax, rbp
mov r8, rsi
mov r10, rbx
mov rbp, r12
mov edx, dword [rax + 0x1c]
mov eax, dword [rax + 0x24]
lea rcx, [r8 + r10*2]
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x50]
movzx eax, word [rcx + rax]
mov rsi, qword [rsp + 0x70]
lea rax, [r8 + rax*4]
mov eax, dword [rax + rdx]
add rax, r8
je 0x14000494b
mov rcx, qword [rsp + 0x68]
call rax
movzx eax, word [0x14016f7b0]
mov ecx, 0x20
mov rdi, rbx
movq qword [rsp + 0x90], xmm6
movq qword [rsp + 0xa0], xmm8
mov word [rsp + 0xa8], ax
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov r10, qword [rax + 0x20]
lea rdx, [rax + 0x20]
xor eax, eax
rep stosq qword [rdi], rax
mov qword [rsp + 0x40], rdx
mov dword [rdi], 0
cmp rdx, r10
je 0x140003c76
xor r11d, r11d
mov r15, r10
mov rax, r11
mov ecx, 0x20
mov rdi, rsi
xor edx, edx
rep stosq qword [rdi], rax
mov ecx, 0x20
mov r9d, 0xffffffff
mov dword [rdi], 0
mov rdi, rbx
rep stosq qword [rdi], rax
mov dword [rdi], 0
mov r8, qword [r15 + 0x40]
mov qword [rsp + 0x38], r11
mov qword [rsp + 0x30], r11
mov dword [rsp + 0x28], 0x104
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
mov r8, qword [rsp + 0x48]
mov edx, 0x104
mov rcx, rbx
call r13
mov r8, rbx
mov edx, 0x104
mov rcx, rbp
call r13
mov r8, rsi
mov edx, 0x104
mov rcx, r12
call r13
mov rcx, rbp
call r14
mov rcx, r12
call r14
mov rdx, rbp
mov rcx, r12
call sub.msvcrt.dll_strstr
xor r11d, r11d
test rax, rax
je 0x140004ac8
mov rbx, qword [r15 + 0x20]
movsxd rax, dword [rbx + 0x3c]
add rax, rbx
mov r11d, dword [rax + 0x8c]
test r11d, r11d
je 0x140004724
mov esi, dword [rax + 0x88]
add rsi, rbx
mov edi, dword [rsi + 0x20]
mov r12d, dword [rsi + 0x18]
add rdi, rbx
test r12d, r12d
je 0x140004724
xor ebp, ebp
jmp 0x140004a92
add rbp, 1
add rdi, 4
cmp r12, rbp
je 0x140004724
mov ecx, dword [rdi]
mov rdx, qword [rsp + 0x58]
add rcx, rbx
call sub.msvcrt.dll_strcmp
test eax, eax
jne 0x140004a81
jmp 0x140004703
mov r15, qword [r15]
cmp qword [rsp + 0x40], r15
jne 0x1400047f6
jmp 0x140003c76
mov r15, qword [r15]
cmp qword [rsp + 0x40], r15
jne 0x1400049a9
jmp 0x140003c76
mov rbp, r12
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x70]
jmp 0x14000494b
mov rbp, r12
mov rbx, qword [rsp + 0x40]
mov r12, qword [rsp + 0x50]
mov rsi, qword [rsp + 0x70]
jmp 0x1400045b5
push rbx
sub rsp, 0x20
mov rbx, rcx
call fcn.140003590
test al, al
jne 0x140004b30
xor eax, eax
add rsp, 0x20
pop rbx
ret
mov rcx, rbx
add rsp, 0x20
pop rbx
jmp 0x1400037a0