Function at 0x140003990
Capabilities:
Encode data using xor
Execute command
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movdqa xmm0, xmmword [0x1400847e0]
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x1008b95
mov ecx, ebx
nop word [rax + rax]
lea eax, [rcx - 0x23]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x12
jb 0x1400039e0
mov byte [rbp - 0x3d], bl
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x3e]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000cbd0
nop
lea rcx, [rbp - 0x20]
call fcn.140003580
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140003a53
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003a4e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003a4e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400717a0
test rdi, rdi
jne 0x140004585
movdqa xmm0, xmmword [0x1400847f0]
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x1008b95
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x23]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x12
jb 0x140003a80
mov byte [rbp - 0x3d], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x3e]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000cbd0
nop
lea rcx, [rbp - 0x20]
call fcn.140003580
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140003af4
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003aef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003aef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400717a0
test rdi, rdi
jne 0x140004585
movdqa xmm0, xmmword [0x140084820]
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x8a9688
mov byte [rbp - 0x3c], 1
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx - 0x23]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x13
jb 0x140003b20
mov byte [rbp - 0x3c], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x3d]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000cbd0
nop
lea rcx, [rbp - 0x20]
call fcn.140003580
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140003b94
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003b8f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400717a0
test rdi, rdi
jne 0x140004585
movdqa xmm0, xmmword [0x1400847c0]
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x888ac09a
mov word [rbp - 0x3c], __WSAFDIsSet
mov byte [rbp - 0x3a], 1
mov rcx, rbx
nop
lea eax, [rcx - 0x23]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x15
jb 0x140003bc0
mov byte [rbp - 0x3a], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x3b]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000cbd0
nop
lea rcx, [rbp - 0x20]
call fcn.140003580
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140003c34
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003c2f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003c2f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400717a0
test rdi, rdi
jne 0x140004585
movdqa xmm0, xmmword [0x140084800]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x40], 0x88
mov byte [rbp - 0x3e], 1
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx - 0x23]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x11
jb 0x140003c60
mov byte [rbp - 0x3e], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x3f]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000cbd0
nop
lea rcx, [rbp - 0x20]
call fcn.140003580
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140003cd4
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ccf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003ccf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400717a0
test rdi, rdi
jne 0x140004585
mov dword [rbp - 0x50], 0x83b0acad
mov dword [rbp - 0x4c], 0xca8d8d8c
mov dword [rbp - 0x48], 0x829e80
mov byte [rbp - 0x44], 1
mov rcx, rbx
nop dword [rax]
lea eax, [rcx - 0x23]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xb
jb 0x140003d00
mov byte [rbp - 0x44], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x45]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000cbd0
nop
lea rcx, [rbp - 0x20]
call fcn.140003580
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140003d74
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003d6f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400717a0
test rdi, rdi
jne 0x140004585
mov dword [rbp - 0x50], 0x91bebab4
mov dword [rbp - 0x4c], 0x819b87cf
mov word [rbp - 0x48], 0x100
mov rcx, rbx
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx - 0x23]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 8
jb 0x140003da0
mov byte [rbp - 0x47], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x48]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000cbd0
nop
lea rcx, [rbp - 0x20]
call fcn.140003580
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140003e14
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e0f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003e0f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400717a0
test rdi, rdi
jne 0x140004585
mov dword [rbp - 0x50], 0x91bebab4
mov dword [rbp - 0x4c], 0x81cdd6d7
mov dword [rbp - 0x48], 0x100839d
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx - 0x23]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xa
jb 0x140003e40
mov byte [rbp - 0x45], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x46]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000cbd0
nop
lea rcx, [rbp - 0x20]
call fcn.140003580
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140003eb4
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003eaf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003eaf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400717a0
test rdi, rdi
jne 0x140004585
mov dword [rbp - 0x50], 0x85adb78a
mov dword [rbp - 0x4c], 0x96828a92
mov dword [rbp - 0x48], 0x9082c88e
mov word [rbp - 0x44], Ordinal_143
mov byte [rbp - 0x42], 1
mov rcx, rbx
nop
lea eax, [rcx - 0x23]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xd
jb 0x140003ee0
mov byte [rbp - 0x42], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x43]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000cbd0
nop
lea rcx, [rbp - 0x20]
call fcn.140003580
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140003f54
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003f4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003f4f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400717a0
test rdi, rdi
jne 0x140004585
mov dword [rbp - 0x50], 0x84bbb79b
mov dword [rbp - 0x4c], 0xca91878d
mov dword [rbp - 0x48], 0x829e80
mov byte [rbp - 0x44], 1
mov rcx, rbx
nop dword [rax]
lea eax, [rcx - 0x23]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xb
jb 0x140003f80
mov byte [rbp - 0x44], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x45]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000cbd0
nop
lea rcx, [rbp - 0x20]
call fcn.140003580
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140003ff4
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003fef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003fef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400717a0
test rdi, rdi
jne 0x140004585
mov dword [rbp - 0x50], 0x8fb1bb85
mov dword [rbp - 0x4c], 0xcad7d492
mov dword [rbp - 0x48], 0x829e80
mov byte [rbp - 0x44], 1
mov rcx, rbx
nop dword [rax]
lea eax, [rcx - 0x23]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xb
jb 0x140004020
mov byte [rbp - 0x44], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x45]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000cbd0
nop
lea rcx, [rbp - 0x20]
call fcn.140003580
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140004094
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000408f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000408f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400717a0
test rdi, rdi
jne 0x140004585
movdqa xmm0, xmmword [0x1400847d0]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x40], 0x100
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x23]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x10
jb 0x1400040c0
mov byte [rbp - 0x3f], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000cbd0
nop
lea rcx, [rbp - 0x20]
call fcn.140003580
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140004134
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000412f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000412f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400717a0
test rdi, rdi
jne 0x140004585
movdqa xmm0, xmmword [0x1400847b0]
movdqu xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [0x140084830]
movdqu xmmword [rbp - 0x40], xmm1
mov dword [rbp - 0x30], 0x699ddecf
mov dword [rbp - 0x2c], 0x612d2b75
mov dword [rbp - 0x28], 0x100637d
mov rcx, rbx
nop
lea eax, [rcx - 0x23]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x2a
jb 0x140004170
mov byte [rbp - 0x25], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x26]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000cbd0
nop
lea rcx, [rbp - 0x20]
call fcn.140003580
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1400041e4
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400041df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400041df
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400717a0
test rdi, rdi
jne 0x140004585
mov dword [rbp - 0x50], 0x959bad96
mov dword [rbp - 0x4c], 0x9686928c
mov dword [rbp - 0x48], 0x8d9f83cb
mov word [rbp - 0x44], 0x100
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx - 0x23]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xc
jb 0x140004210
mov byte [rbp - 0x43], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x44]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000cbd0
nop
lea rcx, [rbp - 0x20]
call fcn.140003580
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140004284
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000427f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000427f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400717a0
test rdi, rdi
jne 0x140004585
mov dword [rbp - 0x50], 0x84ebe8a5
mov dword [rbp - 0x4c], 0x81cd8583
mov dword [rbp - 0x48], 0x100839d
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx - 0x23]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xa
jb 0x1400042b0
mov byte [rbp - 0x45], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x46]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000cbd0
nop
lea rcx, [rbp - 0x20]
call fcn.140003580
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140004324
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000431f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000431f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400717a0
test rdi, rdi
jne 0x140004585
movdqa xmm0, xmmword [0x140084800]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x40], 0x88
mov byte [rbp - 0x3e], 1
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx - 0x23]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x11
jb 0x140004350
mov byte [rbp - 0x3e], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x3f]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000cbd0
nop
lea rcx, [rbp - 0x20]
call fcn.140003580
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1400043c4
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400043bf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400043bf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400717a0
test rdi, rdi
jne 0x140004585
movdqa xmm0, xmmword [0x140084810]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x40], 0x100
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx - 0x23]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x10
jb 0x1400043f0
mov byte [rbp - 0x3f], 0
lea rdx, [rbp - 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140004585
mov dword [rbp - 0x50], 0x8fb2bb90
mov dword [rbp - 0x4c], 0xb2c39b93
mov dword [rbp - 0x48], 0x8d90838c
mov word [rbp - 0x44], 0x9b
mov byte [rbp - 0x42], 1
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx - 0x23]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xd
jb 0x140004440
mov byte [rbp - 0x42], 0
lea rdx, [rbp - 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140004585
mov dword [rbp - 0x50], 0x83b0ac8d
mov dword [rbp - 0x4c], 0xc4909184
mov dword [rbp - 0x48], 0x9c948fa9
mov word [rbp - 0x44], 0x100
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx - 0x23]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xc
jb 0x140004490
mov byte [rbp - 0x43], 0
lea rdx, [rbp - 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140004585
mov dword [rbp - 0x50], 0x959bad96
mov dword [rbp - 0x4c], 0x9686928c
mov word [rbp - 0x48], 0x100
mov rcx, rbx
lea eax, [rcx - 0x23]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 8
jb 0x1400044d0
mov byte [rbp - 0x47], 0
lea rdx, [rbp - 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140004585
mov dword [rbp - 0x50], 0xb08b8a95
mov dword [rbp - 0x4c], 0x8686a6c1
mov dword [rbp - 0x48], 0x8d808190
mov word [rbp - 0x44], 0x9b
mov byte [rbp - 0x42], 1
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx - 0x23]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xd
jb 0x140004520
mov byte [rbp - 0x42], 0
lea rdx, [rbp - 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140004585
mov dword [rbp - 0x50], 0x99b3b292
mov dword [rbp - 0x4c], 0x8480a5
mov byte [rbp - 0x48], 1
nop word [rax + rax]
lea eax, [rbx - 0x23]
xor byte [rbp + rbx - 0x50], al
inc rbx
cmp rbx, 7
jb 0x140004560
mov byte [rbp - 0x48], 0
lea rdx, [rbp - 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14000458a
call fcn.140003360
lea rdx, str.Resource_Monitor
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400045c4
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.taskkill__F__T__IM_perfmon.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.The_Wireshark_Network_Analyzer
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400045dd
call fcn.140003360
lea rdx, str.Progress_Telerik_Fiddler_Web_Debugger
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400045f6
call fcn.140003360
lea rdx, str.Fiddler
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14000460f
call fcn.140003360
lea rdx, str.HTTP_Debugger
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140004628
call fcn.140003360
lea rdx, str.x64dbg
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140004641
call fcn.140003360
lea rdx, str.dnSpy
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14000465a
call fcn.140003360
lea rdx, str.FolderChangesView
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140004673
call fcn.140003360
lea rdx, str.BinaryNinja
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14000468c
call fcn.140003360
lea rdx, [0x140083b8c]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400046a5
call fcn.140003360
lea rdx, str.Cheat_Engine_7.2
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400046be
call fcn.140003360
lea rdx, str.Cheat_Engine_7.1
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400046d7
call fcn.140003360
lea rdx, str.Cheat_Engine_7.0
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400046f0
call fcn.140003360
lea rdx, str.Cheat_Engine_6.9
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140004709
call fcn.140003360
lea rdx, str.Cheat_Engine_7.3
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140004722
call fcn.140003360
lea rdx, str.Cheat_Engine_7.4
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14000473b
call fcn.140003360
lea rdx, str.Cheat_Engine_7.5
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140004754
call fcn.140003360
lea rdx, str.Cheat_Engine_7.6
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14000476d
call fcn.140003360
lea rdx, [0x140083c4c]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140004786
call fcn.140003360
lea rdx, str.Ida_Pro
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14000479f
call fcn.140003360
lea rdx, str.Ida_Freeware
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400047b8
call fcn.140003360
lea rdx, str.HTTP_Debugger_Pro
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400047d1
call fcn.140003360
lea rdx, str.Process_Hacker
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400047ea
call fcn.140003360
lea rdx, str.Process_Hacker_2
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140004803
call fcn.140003360
lea rdx, str.OllyDbg
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14000481c
call fcn.140003360
mov qword [rbp + 0x10], 0x7d0
lea rcx, [rbp + 0x10]
call fcn.14000c2a0
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret