Function at 0x14003e680
Capabilities:
Enumerate pe sections
Enumerate processes

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x158]
sub rsp, 0x258
mov rsi, r9
mov r13, r8
mov r12, rdx
mov r14, rcx
lea rbx, [0x1400c9d90]
cmp qword [r9 + 0x10], 0
jne 0x14003e6e2
cmp rbx, rdx
je 0x14003e6e2
cmp qword [rdx + 0x18], 0x10
jb 0x14003e6d8
mov rdx, qword [rdx]
mov r8, qword [r12 + 0x10]
call fcn.140041360
cmp rbx, rsi
je 0x14003e6fd
mov rdx, rsi
cmp qword [rsi + 0x18], 0x10
jb 0x14003e6f4
mov rdx, qword [rsi]
mov r8, qword [rsi + 0x10]
call fcn.140041360
lea rdi, [r14 + 8]
mov r15, rdi
mov qword [rbp], rdi
nop dword [rax + rax]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp + 0x20], 0x130
xor edx, edx
mov r8d, 0x12c
lea rcx, [rbp + 0x24]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32First]
lea rdx, [rbp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x14003e7a3
mov r8, r12
cmp qword [r12 + 0x18], 0x10
jb 0x14003e763
mov r8, qword [r12]
lea rax, [rbp + 0x4c]
sub r8, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x14003e783
inc rax
test ecx, ecx
jne 0x14003e770
test edx, edx
je 0x14003e79a
lea rdx, [rbp + 0x20]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14003e754
jmp 0x14003e7a3
mov eax, dword [rbp + 0x28]
mov dword [r15], eax
mov rdi, r15
cmp dword [rdi], 0
jne 0x14003e7c8
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
test rbx, rbx
je 0x14003e7c3
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x14003e710
test rbx, rbx
je 0x14003e7d7
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov ecx, dword [r15]
test ecx, ecx
jne 0x14003e8dd
mov rdx, qword [r12 + 0x18]
cmp rdx, 0x10
jb 0x14003e81e
mov rcx, qword [r12]
inc rdx
cmp rdx, 0x1000
jb 0x14003e819
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003f670
mov rcx, r8
call fcn.140063c10
xor edi, edi
mov byte [r12], dil
mov qword [r12 + 0x18], 0xf
mov qword [r12 + 0x10], rdi
mov rdx, qword [r13 + 0x18]
cmp rdx, 0x10
jb 0x14003e86d
inc rdx
mov rcx, qword [r13]
cmp rdx, 0x1000
jb 0x14003e868
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003f677
mov rcx, r8
call fcn.140063c10
mov qword [r13 + 0x10], rdi
mov qword [r13 + 0x18], 0xf
mov byte [r13], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0x10
jb 0x14003e8b8
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x14003e8b3
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003f67e
mov rcx, r8
call fcn.140063c10
mov byte [rsi], 0
mov qword [rsi + 0x18], 0xf
mov qword [rsi + 0x10], rdi
xor al, al
add rsp, 0x258
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov rax, qword [r14 + 0x10]
movsxd r15, dword [rax + 0x3c]
add r15, rax
mov eax, dword [r15 + 0x50]
mov dword [rsp + 0x40], ecx
mov ecx, 0x3000
mov dword [rsp + 0x44], ecx
mov dword [rsp + 0x48], 0x40
xor edi, edi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x20
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 0x20]
lea r8, [rsp + 0x40]
mov edx, 0x23dc14
mov rcx, qword [r14]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x14003e960
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x14003e960
mov ecx, dword [r15 + 0x28]
add rcx, rax
mov qword [rbp + 0x10], rcx
jne 0x14003e9a6
mov rdx, qword [r12 + 0x18]
cmp rdx, 0x10
jb 0x14003e99c
inc rdx
cmp rdx, 0x1000
mov rcx, qword [r12]
jb 0x14003e997
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003f670
mov rcx, r8
call fcn.140063c10
mov byte [r12], 0
jmp 0x14003e824
mov r9d, dword [r15 + 0x90]
mov r8, rdi
movzx edx, word [r15 + 0x14]
add rdx, 0x18
add rdx, r15
movzx eax, word [r15 + 6]
cmp di, ax
jae 0x14003ea0b
mov r10d, eax
nop dword [rax]
mov eax, dword [rdx + 8]
test eax, eax
jne 0x14003e9da
mov eax, dword [rdx + 0x10]
mov ecx, dword [rdx + 0xc]
cmp r9, rcx
jb 0x14003e9eb
add ecx, eax
cmp r9, rcx
cmovb r8, rdx
add rdx, 0x28
sub r10, 1
jne 0x14003e9d0
test r8, r8
je 0x14003ea0b
mov ecx, dword [r8 + 0xc]
sub ecx, dword [r8 + 0x14]
sub r9, rcx
add r9, qword [r14 + 0x10]
jmp 0x14003ea0e
mov r9, rdi
lea r13, [r9 + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10d, dword [r13 - 4]
mov r8, rdi
movzx r11d, word [r15 + 0x14]
add r11, 0x18
add r11, r15
mov rdx, r11
movzx ebx, word [r15 + 6]
cmp di, bx
jae 0x14003ec67
mov r9d, ebx
mov eax, dword [rdx + 8]
test eax, eax
jne 0x14003ea51
mov eax, dword [rdx + 0x10]
mov ecx, dword [rdx + 0xc]
cmp r10, rcx
jb 0x14003ea62
add ecx, eax
cmp r10, rcx
cmovb r8, rdx
add rdx, 0x28
sub r9, 1
jne 0x14003ea47
test r8, r8
je 0x14003ec50
mov ecx, dword [r8 + 0xc]
sub ecx, dword [r8 + 0x14]
mov rsi, qword [r14 + 0x10]
sub rsi, rcx
add rsi, r10
je 0x14003ec67
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov r10d, dword [r13]
mov r8, rdi
movzx edx, word [r15 + 0x14]
add rdx, 0x18
add rdx, r15
movzx eax, word [r15 + 6]
cmp di, ax
jae 0x14003eafb
mov r9d, eax
mov eax, dword [rdx + 8]
test eax, eax
jne 0x14003eac0
mov eax, dword [rdx + 0x10]
mov ecx, dword [rdx + 0xc]
cmp r10, rcx
jb 0x14003ead1
add ecx, eax
cmp r10, rcx
cmovb r8, rdx
add rdx, 0x28
sub r9, 1
jne 0x14003eab6
test r8, r8
je 0x14003eafb
mov ecx, dword [r8 + 0xc]
sub ecx, dword [r8 + 0x14]
mov r11, qword [rbp + 0x1a0]
mov r14, qword [r11 + 0x10]
sub r14, rcx
add r14, r10
jmp 0x14003eb05
mov r14, rdi
mov r11, qword [rbp + 0x1a0]
mov r9, qword [r14]
test r9, r9
je 0x14003ec39
jmp 0x14003eb27
mov r11, qword [rbp + 0x1a0]
mov r8, rdi
movzx edx, word [r15 + 0x14]
add rdx, 0x18
add rdx, r15
movzx eax, word [r15 + 6]
cmp di, ax
jae 0x14003eb81
mov r10d, eax
mov eax, dword [rdx + 8]
test eax, eax
jne 0x14003eb4d
mov eax, dword [rdx + 0x10]
mov ecx, dword [rdx + 0xc]
cmp r9, rcx
jb 0x14003eb5e
add ecx, eax
cmp r9, rcx
cmovb r8, rdx
add rdx, 0x28
sub r10, 1
jne 0x14003eb43
test r8, r8
je 0x14003eb81
mov ecx, dword [r8 + 0xc]
sub ecx, dword [r8 + 0x14]
mov rbx, qword [r11 + 0x10]
sub rbx, rcx
add rbx, r9
jmp 0x14003eb84
mov rbx, rdi
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rdi
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rsi + r8], 0
jne 0x14003eba0
mov rdx, rsi
lea rcx, [rbp - 0x20]
call fcn.1400417c0
nop
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [rbx + 2]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
sub rbx, rax
lea rdx, [rbp - 0x20]
mov rcx, qword [rbp + 0x1a0]
call fcn.14003fb20
add rbx, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x14003ec26
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003ec21
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003ec49
call fcn.140063c10
mov qword [r14], rbx
add r14, 8
mov r9, qword [r14]
test r9, r9
jne 0x14003eb20
add r13, 0x14
mov r14, qword [rbp + 0x1a0]
jmp 0x14003ea20
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r13, qword [rbp + 0x1a0]
mov r10, qword [r13 + 0x10]
mov r8d, dword [r15 + 0xb0]
mov rdx, rdi
jmp 0x14003ec81
mov r13, qword [rbp + 0x1a0]
mov r10, qword [r13 + 0x10]
mov r8d, dword [r15 + 0xb0]
mov rdx, rdi
cmp di, bx
jae 0x14003ecbf
mov r9, rbx
mov eax, dword [r11 + 8]
test eax, eax
jne 0x14003ec90
mov eax, dword [r11 + 0x10]
mov ecx, dword [r11 + 0xc]
cmp r8, rcx
jb 0x14003eca2
add ecx, eax
cmp r8, rcx
cmovb rdx, r11
add r11, 0x28
sub r9, 1
jne 0x14003ec84
test rdx, rdx
je 0x14003ecbf
mov ecx, dword [rdx + 0xc]
sub ecx, dword [rdx + 0x14]
sub r8, rcx
add r8, r10
jmp 0x14003ecc2
mov r8, rdi
mov ebx, edi
mov rsi, qword [rsp + 0x50]
cmp dword [r15 + 0xb4], edi
jbe 0x14003ed8c
mov r14d, 0x3000
nop dword [rax]
mov r10d, dword [r8]
mov r9, rdi
movzx edx, word [r15 + 0x14]
add rdx, 0x18
add rdx, r15
movzx eax, word [r15 + 6]
cmp di, ax
jae 0x14003ed3b
mov r11d, eax
nop
mov eax, dword [rdx + 8]
test eax, eax
jne 0x14003ed0a
mov eax, dword [rdx + 0x10]
mov ecx, dword [rdx + 0xc]
cmp r10, rcx
jb 0x14003ed1b
add ecx, eax
cmp r10, rcx
cmovb r9, rdx
add rdx, 0x28
sub r11, 1
jne 0x14003ed00
test r9, r9
je 0x14003ed3b
mov ecx, dword [r9 + 0xc]
sub ecx, dword [r9 + 0x14]
sub r10, rcx
add r10, qword [r13 + 0x10]
jmp 0x14003ed3e
mov r10, rdi
lea r11, [r8 + 4]
mov r9d, dword [r11]
sub r9, 8
shr r9, 1
lea r8, [r8 + 8]
mov edx, edi
je 0x14003ed7c
movzx ecx, word [r8]
test r14w, cx
je 0x14003ed6f
and ecx, 0xfff
mov rax, rsi
sub rax, qword [r15 + 0x30]
add qword [rcx + r10], rax
add r8, 2
inc edx
mov eax, edx
cmp rax, r9
jb 0x14003ed54
add ebx, dword [r11]
cmp ebx, dword [r15 + 0xb4]
jb 0x14003ece0
mov rcx, r13
call fcn.14003f690
test al, al
jne 0x14003ee47
mov rdx, qword [r12 + 0x18]
cmp rdx, 0x10
jb 0x14003edd8
mov rcx, qword [r12]
inc rdx
cmp rdx, 0x1000
jb 0x14003edd3
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003f670
mov rcx, r8
call fcn.140063c10
mov qword [r12 + 0x10], rdi
mov qword [r12 + 0x18], 0xf
mov byte [r12], 0
mov rbx, qword [rbp + 0x1b0]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14003ee2c
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rbx]
jb 0x14003ee27
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003f677
mov rcx, r8
call fcn.140063c10
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rsi, qword [rbp + 0x1b8]
jmp 0x14003e87e
lea rcx, [r13 + 0x28]
mov rbx, qword [rbp + 0x1b0]
mov r8, rbx
lea rdx, [rbp - 0x20]
call fcn.140041600
mov rcx, qword [rax]
mov r14, qword [rcx + 0x40]
mov qword [rsp + 0x60], r14
test r14, r14
jne 0x14003eec3
mov rdx, qword [r12 + 0x18]
cmp rdx, 0x10
jb 0x14003eeab
mov rcx, qword [r12]
inc rdx
cmp rdx, 0x1000
jb 0x14003eea6
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003f670
mov rcx, r8
call fcn.140063c10
mov qword [r12 + 0x10], rdi
mov qword [r12 + 0x18], 0xf
mov byte [r12], 0
jmp 0x14003edf2
mov rbx, qword [rbp]
mov eax, dword [rbx]
mov dword [rbp - 0x40], eax
mov qword [rbp - 0x38], r14
lea rax, [rbp - 0x20]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 8
mov qword [rsp + 0x38], rdi
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0x20
lea r8, [rbp - 0x40]
mov edx, 0x23dc24
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
movzx edx, word [r15 + 0x14]
add rdx, 0x18
mov rcx, qword [r13 + 0x10]
mov eax, dword [rbx]
mov dword [rbp - 0x40], eax
mov qword [rbp - 0x38], rcx
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], rdx
mov qword [rsp + 0x38], rdi
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0x20
lea r8, [rbp - 0x40]
mov edx, 0x23dc20
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
movzx ebx, word [r15 + 0x14]
add rbx, 0x24
mov rsi, rdi
cmp word [r15 + 6], di
je 0x14003f00c
add rbx, r15
mov r12, qword [rsp + 0x50]
mov r14, qword [rbp]
mov eax, dword [r15 + 0x50]
cmp rsi, rax
jae 0x14003f000
mov eax, dword [rbx]
test eax, eax
je 0x14003eff8
mov r8d, dword [rbx + 4]
mov edx, dword [rbx + 8]
add rdx, qword [r13 + 0x10]
lea rcx, [r12 + rax]
mov eax, dword [r14]
mov dword [rbp - 0x40], eax
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x30], rcx
mov qword [rbp - 0x28], r8
mov qword [rsp + 0x38], rdi
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0x20
lea r8, [rbp - 0x40]
mov edx, 0x23dc20
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [rbx]
add rbx, 0x28
mov ecx, dword [rbx]
sub rcx, rax
add rsi, rcx
cmp word [r15 + 6], 0
jne 0x14003ef87
mov r14, qword [rsp + 0x60]
mov r12, qword [rbp + 0x1a8]
mov word [rsp + 0x70], 0x4800
mov byte [rsp + 0x72], 0xb8
mov qword [rsp + 0x7b], 0xba48
mov dword [rbp - 0x7d], 0x89480000
mov dword [rbp - 0x79], 0xec834810
mov qword [rbp - 0x75], 0x1ba4828
mov dword [rbp - 0x6d], 0xff000000
mov dword [rbp - 0x69], 0x215
mov qword [rbp - 0x65], 0x8eb00
mov dword [rbp - 0x5d], 0x48000000
mov dword [rbp - 0x59], 0x4828c483
mov dword [rbp - 0x55], 0x580c031
mov dword [rbp - 0x51], 0xffffffbc
mov word [rbp - 0x4d], 0x9001
mov byte [rbp - 0x4b], 0xc3
mov qword [rsp + 0x73], r14
mov r15, qword [rbp]
mov eax, dword [r15]
mov dword [rbp - 0x40], eax
mov qword [rbp - 0x38], r14
lea rax, [rsp + 0x7d]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 8
mov qword [rsp + 0x38], rdi
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0x20
lea r8, [rbp - 0x40]
mov edx, 0x23dc24
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rbp + 0x10]
mov qword [rbp - 0x62], rax
mov eax, dword [r15]
mov dword [rsp + 0x40], eax
mov eax, 0x3000
mov dword [rsp + 0x44], eax
mov dword [rsp + 0x48], 0x40
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x58], 0x46
mov qword [rsp + 0x38], rdi
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x20
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
lea r8, [rsp + 0x40]
mov edx, 0x23dc14
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x14003f584
mov rbx, qword [rsp + 0x50]
test rbx, rbx
je 0x14003f584
mov eax, dword [r15]
mov dword [rbp - 0x40], eax
lea rax, [rsp + 0x70]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], 0x46
mov qword [rsp + 0x38], rdi
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0x20
lea r8, [rbp - 0x40]
mov edx, 0x23dc20
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [r15]
mov dword [rbp - 0x20], eax
mov dword [rbp - 0x1c], 4
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], 8
mov qword [rsp + 0x38], rdi
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x18
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 0x18
lea r8, [rbp - 0x20]
mov edx, 0x23dc18
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
neg eax
sbb esi, esi
and esi, 4
lea rax, [rbx + 1]
mov qword [rbp + 8], rax
mov eax, dword [r15]
mov dword [rbp - 0x40], eax
lea rax, [rbp + 8]
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], 8
mov qword [rsp + 0x38], rdi
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0x20
lea r8, [rbp - 0x40]
mov edx, 0x23dc20
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov qword [rsp + 0x60], rdi
mov eax, dword [r15]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x48], r14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 8
mov qword [rsp + 0x38], rdi
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0x20
lea r8, [rsp + 0x40]
mov edx, 0x23dc24
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rbp + 8]
cmp qword [rsp + 0x60], rax
jne 0x14003f319
nop dword [rax]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [r15]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x48], r14
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 8
mov qword [rsp + 0x38], rdi
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0x20
lea r8, [rsp + 0x40]
mov edx, 0x23dc24
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rbp + 8]
cmp qword [rsp + 0x60], rax
je 0x14003f2b0
mov eax, dword [r15]
mov dword [rbp - 0x20], eax
mov dword [rbp - 0x1c], esi
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], 8
mov qword [rsp + 0x38], rdi
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x18
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 0x18
lea r8, [rbp - 0x20]
mov edx, 0x23dc18
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov byte [rbp + 0x1a0], 0
mov eax, dword [r15]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x48], rbx
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0x20
lea r8, [rsp + 0x40]
mov edx, 0x23dc24
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp byte [rbp + 0x1a0], 0
jne 0x14003f437
nop dword [rax]
mov ecx, 0x32
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [r15]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x48], rbx
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 1
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x60]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], rdi
mov r9d, 0x20
lea r8, [rsp + 0x40]
mov edx, 0x23dc24
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
cmp byte [rbp + 0x1a0], 0
je 0x14003f3d0
mov eax, dword [r15]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x48], rbx
mov qword [rsp + 0x50], rdi
mov dword [rsp + 0x58], 0x8000
mov qword [rsp + 0x38], rdi
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x20
lea rax, [rsp + 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
lea r8, [rsp + 0x40]
mov edx, 0x23dc10
mov rcx, qword [r13]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
nop
mov rdx, qword [r12 + 0x18]
cmp rdx, 0x10
jb 0x14003f4ca
mov rcx, qword [r12]
inc rdx
cmp rdx, 0x1000
jb 0x14003f4c5
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003f670
mov rcx, r8
call fcn.140063c10
mov qword [r12 + 0x10], rdi
mov qword [r12 + 0x18], 0xf
mov byte [r12], 0
mov rbx, qword [rbp + 0x1b0]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14003f51e
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14003f519
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003f677
mov rcx, r8
call fcn.140063c10
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rbx, qword [rbp + 0x1b8]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14003f56e
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14003f569
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003f67e
mov rcx, r8
call fcn.140063c10
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov al, 1
jmp 0x14003e8c9
mov rdx, qword [r12 + 0x18]
cmp rdx, 0x10
jb 0x14003f5c0
mov rcx, qword [r12]
inc rdx
cmp rdx, 0x1000
jb 0x14003f5bb
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003f670
mov rcx, r8
call fcn.140063c10
mov qword [r12 + 0x10], rdi
mov qword [r12 + 0x18], 0xf
mov byte [r12], 0
mov rbx, qword [rbp + 0x1b0]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14003f610
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14003f60b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003f677
mov rcx, r8
call fcn.140063c10
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rbx, qword [rbp + 0x1b8]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14003f65c
inc rdx
mov rcx, qword [rbx]
cmp rdx, 0x1000
jb 0x14003f657
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14003f67e
mov rcx, r8
call fcn.140063c10
mov qword [rbx + 0x10], rdi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
jmp 0x14003e8c7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3