Function at 0x18005f320
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xb68]
sub rsp, 0xc40
mov qword [rbp + 0x28], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
mov rax, qword [0x180168908]
xor rax, rsp
mov qword [rbp + 0xb30], rax
mov r12d, edx
mov r13, rcx
mov qword [rbp - 0x80], rcx
xor ebx, ebx
mov dword [rsp + 0x40], ebx
xor edx, edx
lea ecx, [rbx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r14, rax
cmp rax, 0xffffffffffffffff
jne 0x18005f563
call fcn.18007dd60
mov r8, qword [rax]
lea edx, [rbx + 1]
mov rcx, rax
call qword [r8 + 0x10]
cmp al, 1
jne 0x18005f533
movdqa xmm0, xmmword [0x1801106e0]
movdqu xmmword [rbp + 0x828], xmm0
mov byte [rbp + 0x818], bl
lea r8d, [rbx + 0x6b]
lea rdx, str.d:jenkins.jenkinsworkspacelib_commoncomputerz12_grab_versionhookhomepage_1145_bro_mon_filemonitor.cpp
lea rcx, [rbp + 0x818]
call fcn.18000a3d0
nop
movdqa xmm0, xmmword [0x1801106e0]
movdqu xmmword [rbp + 0x6c8], xmm0
mov byte [rbp + 0x6b8], bl
lea r8d, [rbx + 3]
lea rdx, [0x180112978]
lea rcx, [rbp + 0x6b8]
call fcn.18000a3d0
nop
call fcn.18007dd60
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.CreateToolhelp32Snapshot_failed__error__d
lea edx, [rbx + 1]
lea rcx, [rbp - 0x38]
call fcn.18007d7e0
nop
mov r9d, 0x197
lea r8, [rbp + 0x818]
lea rdx, [rbp + 0x6b8]
lea rcx, [rbp + 0x1b0]
call fcn.18000dda0
mov rbx, rax
mov rcx, qword [rbp - 0x38]
lea rdx, [0x1801126b0]
test rcx, rcx
cmovne rdx, rcx
mov rcx, rax
call fcn.18000c590
mov r8, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [r8 + 0x38]
nop
lea rcx, [rbp + 0x1b0]
call fcn.18000f5c0
nop
mov rdx, qword [rbp - 0x38]
add rdx, 0xffffffffffffffe8
mov r15, r14
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg 0x18005f49a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x6d0]
cmp rdx, 0x10
jb 0x18005f4db
inc rdx
mov rcx, qword [rbp + 0x6b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005f4d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18006099d
call fcn.1800a4c5c
movdqa xmm0, xmmword [0x1801106e0]
movdqu xmmword [rbp + 0x6c8], xmm0
mov byte [rbp + 0x6b8], 0
mov rdx, qword [rbp + 0x830]
cmp rdx, 0x10
jb 0x18005f533
inc rdx
mov rcx, qword [rbp + 0x818]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005f52e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800609a3
call fcn.1800a4c5c
mov rcx, qword [rbp + 0xb30]
xor rcx, rsp
call fcn.1800a5130
lea r11, [rsp + 0xc40]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x884]
call fcn.1800d4600
mov dword [rbp + 0x880], 0x238
lea rdx, [rbp + 0x880]
mov rcx, r14
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
jne 0x18005f760
call fcn.18007dd60
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8 + 0x10]
cmp al, 1
jne 0x18005f752
movdqa xmm0, xmmword [0x1801106e0]
movdqu xmmword [rbp + 0x848], xmm0
mov byte [rbp + 0x838], bl
mov r8d, 0x6b
lea rdx, str.d:jenkins.jenkinsworkspacelib_commoncomputerz12_grab_versionhookhomepage_1145_bro_mon_filemonitor.cpp
lea rcx, [rbp + 0x838]
call fcn.18000a3d0
nop
movdqa xmm0, xmmword [0x1801106e0]
movdqu xmmword [rbp + 0x6e8], xmm0
mov byte [rbp + 0x6d8], 0
mov r8d, 3
lea rdx, [0x180112978]
lea rcx, [rbp + 0x6d8]
call fcn.18000a3d0
nop
call fcn.18007dd60
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r9d, eax
lea r8, str.Process32First_failed__error__d
mov edx, 1
lea rcx, [rbp - 0x30]
call fcn.18007d7e0
nop
mov r9d, 0x19e
lea r8, [rbp + 0x838]
lea rdx, [rbp + 0x6d8]
lea rcx, [rbp + 0x298]
call fcn.18000dda0
mov rbx, rax
mov rcx, qword [rbp - 0x30]
lea rdx, [0x1801126b0]
test rcx, rcx
cmovne rdx, rcx
mov rcx, rax
call fcn.18000c590
mov r8, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [r8 + 0x38]
nop
lea rcx, [rbp + 0x298]
call fcn.18000f5c0
nop
mov rdx, qword [rbp - 0x30]
add rdx, 0xffffffffffffffe8
mov r15, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], r15d
sub r15d, 1
jg 0x18005f6b9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x6f0]
cmp rdx, 0x10
jb 0x18005f6fa
inc rdx
mov rcx, qword [rbp + 0x6d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005f6f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800609a9
call fcn.1800a4c5c
movdqa xmm0, xmmword [0x1801106e0]
movdqu xmmword [rbp + 0x6e8], xmm0
mov byte [rbp + 0x6d8], 0
mov rdx, qword [rbp + 0x850]
cmp rdx, 0x10
jb 0x18005f752
inc rdx
mov rcx, qword [rbp + 0x838]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005f74d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800609af
call fcn.1800a4c5c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x18005f533
mov rcx, qword [0x180177448]
test rcx, rcx
jne 0x18005f7c2
lea rcx, [0x180168178]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [0x180177448], rbx
jne 0x18005f7ae
mov ecx, 0x58
call fcn.1800a5060
mov qword [rbp - 0x18], rax
test rax, rax
je 0x18005f79f
mov rcx, rax
call fcn.18002f8e0
jmp 0x18005f7a2
mov rax, rbx
lock or dword [rsp], 0
mov qword [0x180177448], rax
lea rcx, [0x180168178]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [0x180177448]
call fcn.180030a80
call fcn.180010330
mov rcx, rax
lea rdx, [rbp + 0x7f8]
call fcn.1800683d0
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
lea rcx, [rsp + 0x48]
call fcn.180060eb0
mov qword [rsp + 0x48], rax
mov r15, 0xffffffffffffffff
lea rdi, str.9Dbu2YyzFGj6INfApshB5g
mov qword [rbp - 0x60], 0
mov dword [rbp - 0x58], r15d
mov dword [rbp - 0x54], 1
call fcn.180009090
mov rcx, rax
test rax, rax
je 0x180060992
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rbx
mov dword [rbp - 0x40], ebx
mov eax, dword [rbp + 0x888]
mov dword [rbp - 0x60], eax
mov eax, dword [rbp + 0x8a0]
mov dword [rbp - 0x5c], eax
lea rcx, [rbp + 0x8ac]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
test rax, rax
jne 0x18005f863
mov ecx, ebx
jmp 0x18005f870
mov rcx, r15
inc rcx
cmp word [rax + rcx*2], 0
jne 0x18005f866
mov r8d, ecx
mov rdx, rax
lea rcx, [rbp - 0x50]
call fcn.180009210
mov rsi, qword [rbp - 0x50]
nop dword [rax]
nop word [rax + rax]
mov rdx, qword [rdi]
lea rcx, [rbp + 0x6f8]
call fcn.18006e420
lea rdx, [rbp + 0x6f8]
cmp qword [rbp + 0x710], 8
cmovae rdx, qword [rbp + 0x6f8]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
je 0x18005f91a
mov rdx, qword [rbp + 0x710]
cmp rdx, 8
jb 0x18005f909
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x6f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005f904
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800609b5
call fcn.1800a4c5c
inc ebx
add rdi, 0x18
cmp ebx, 0x14
jb 0x18005f890
jmp 0x18005f96e
mov dword [rbp - 0x58], ebx
xor ecx, ecx
call fcn.1800dd750
mov qword [rbp - 0x48], rax
mov rdx, qword [rbp + 0x710]
cmp rdx, 8
jb 0x18005f96e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x6f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005f969
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800609bb
call fcn.1800a4c5c
mov eax, dword [rbp - 0x60]
mov dword [rbp + 0x48], eax
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x50]
call fcn.18005e980
or dword [rsp + 0x40], 4
lea rdx, [rbp + 0x48]
lea rcx, [rsp + 0x48]
call fcn.18005df80
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0xb8]
lea rcx, [rsp + 0x48]
call fcn.18005e360
nop
mov rdx, qword [rbp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18005f9d1
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18005f9ef
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rdx, [rbp + 0x880]
mov rcx, r14
call sub.KERNEL32.dll_Process32NextW
test eax, eax
je 0x18005fa09
xor ebx, ebx
jmp 0x18005f7fb
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test r12d, r12d
je 0x18005ff0c
lea rdx, [r13 + 0x68]
mov qword [rsp + 0x60], rdx
lea rax, [rsp + 0x48]
cmp rdx, rax
je 0x18005fa58
mov rcx, qword [rdx]
mov qword [rbp + 0x38], rcx
mov rax, qword [rsp + 0x48]
mov qword [rdx], rax
mov qword [rsp + 0x48], rcx
mov rcx, qword [rdx + 8]
mov qword [rbp + 0x40], rcx
mov rax, qword [rsp + 0x50]
mov qword [rdx + 8], rax
mov qword [rsp + 0x50], rcx
mov rax, qword [rdx]
mov rbx, qword [rax]
cmp rbx, rax
je 0x180060934
cmp dword [rbx + 0x30], 0
jl 0x18005feaf
call fcn.18007dd60
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8 + 0x10]
cmp al, 1
jne 0x18005feaa
xor edi, edi
mov qword [rbp + 0x688], rdi
mov qword [rbp + 0x690], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x678], dil
lea r8d, [rdi + 0x6b]
lea rdx, str.d:jenkins.jenkinsworkspacelib_commoncomputerz12_grab_versionhookhomepage_1145_bro_mon_filemonitor.cpp
lea rcx, [rbp + 0x678]
call fcn.18000a3d0
nop
mov qword [rbp + 0x668], rdi
mov qword [rbp + 0x670], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x658], dil
lea r8d, [rdi + 3]
lea rdx, [0x180112978]
lea rcx, [rbp + 0x658]
call fcn.18000a3d0
nop
call fcn.18007dd60
mov qword [rbp - 0x80], rax
mov rcx, qword [rbx + 0x38]
sub rcx, 0x18
call fcn.180008df0
lea rcx, [rax + 0x18]
mov qword [rbp - 0x78], rcx
lea rax, [rbp - 0x78]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x20], rcx
mov r9d, dword [rbx + 0x20]
lea r8, str.process_init__d__s_
lea edx, [rdi + 2]
lea rcx, [rbp - 0x10]
call fcn.18007d7e0
mov qword [rsp + 0x68], rax
or dword [rsp + 0x40], 8
mov rdx, qword [rbp - 0x78]
add rdx, 0xffffffffffffffe8
mov ecx, r15d
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x18005fb5d
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov edx, 2
lea r8d, [rdx - 1]
lea rcx, [rbp + 0xc8]
call fcn.18000d950
nop
lea rdx, [rbp + 0x678]
mov r12, qword [rbp + 0x678]
mov r13, qword [rbp + 0x690]
cmp r13, 0x10
cmovae rdx, r12
mov r14, qword [rbp + 0x688]
cmp r14, 1
jb 0x18005fbda
lea rax, [r14 - 1]
mov rsi, r15
cmp rax, r15
cmovb rsi, rax
add rsi, rdx
movzx eax, word [0x1801126c0]
cmp byte [rsi], 0x5c
jne 0x18005fbcb
cmp byte [rsi], al
jne 0x18005fbc2
mov ecx, edi
jmp 0x18005fbc7
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x18005fbd5
cmp rsi, rdx
je 0x18005fbda
dec rsi
jmp 0x18005fbb5
sub rsi, rdx
jmp 0x18005fbdd
mov rsi, r15
lea rdx, [rbp + 0x678]
cmp r13, 0x10
cmovae rdx, r12
cmp r14, 1
jb 0x18005fc35
lea rax, [r14 - 1]
mov rdi, r15
cmp rax, r15
cmovb rdi, rax
add rdi, rdx
movzx eax, word [0x1801126c4]
nop word [rax + rax]
cmp byte [rdi], 0x2e
jne 0x18005fc26
cmp byte [rdi], al
jne 0x18005fc1d
xor ecx, ecx
jmp 0x18005fc22
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x18005fc30
cmp rdi, rdx
je 0x18005fc35
dec rdi
jmp 0x18005fc10
sub rdi, rdx
jmp 0x18005fc38
mov rdi, r15
xor edx, edx
lea r8d, [rdx + 0x64]
lea rcx, [rbp + 0xac0]
call fcn.1800d4600
cmp rdi, 0xffffffffffffffff
je 0x18005fd53
lea rax, [rdi - 1]
cmp rsi, rax
jae 0x18005fd53
lea rcx, [rsi + 1]
mov qword [rbp + 0x648], 0
mov qword [rbp + 0x650], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x638], 0
cmp r14, rcx
jb 0x1800609c7
sub rdi, rsi
lea r8, [rdi - 1]
sub r14, rcx
cmp r14, r8
cmovb r8, r14
lea rdx, [rbp + 0x678]
cmp r13, 0x10
cmovae rdx, r12
add rdx, rcx
lea rcx, [rbp + 0x638]
call fcn.18000a3d0
mov edi, dword [rsp + 0x40]
or edi, 0x10
mov dword [rsp + 0x40], edi
lea r9, [rbp + 0x638]
cmp qword [rbp + 0x650], 0x10
cmovae r9, qword [rbp + 0x638]
mov r8d, 0x1bd
lea rdx, str.__4d___s_
lea rcx, [rbp + 0xac0]
call fcn.18000d270
mov rdx, qword [rbp + 0x650]
cmp rdx, 0x10
jb 0x18005fd36
inc rdx
mov rcx, qword [rbp + 0x638]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005fd31
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800609c1
call fcn.1800a4c5c
xor esi, esi
mov qword [rbp + 0x648], rsi
mov qword [rbp + 0x650], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x638], sil
jmp 0x18005fd72
mov r8d, 0x1bd
lea rdx, str.__4d_
lea rcx, [rbp + 0xac0]
call fcn.18000d270
mov edi, dword [rsp + 0x40]
xor esi, esi
lea rdx, [rbp + 0x658]
cmp qword [rbp + 0x670], 0x10
cmovae rdx, qword [rbp + 0x658]
lea rcx, [rbp + 0xc8]
call fcn.18000f150
lea rdx, [rbp + 0xac0]
lea rcx, [rbp + 0xc8]
call fcn.18000f150
nop
mov rax, qword [rsp + 0x68]
mov rax, qword [rax]
lea rdx, [0x1801126b0]
test rax, rax
cmovne rdx, rax
lea rcx, [rbp + 0xc8]
call fcn.18000c590
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
lea rdx, [rbp + 0xc8]
call qword [rax + 0x38]
nop
lea rcx, [rbp + 0xc8]
call fcn.18000f5c0
and edi, 0xfffffff7
mov dword [rsp + 0x40], edi
mov rdx, qword [rbp - 0x10]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18005fe0f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x670]
cmp rdx, 0x10
jb 0x18005fe50
inc rdx
mov rcx, qword [rbp + 0x658]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005fe4b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800609cd
call fcn.1800a4c5c
mov qword [rbp + 0x668], rsi
mov qword [rbp + 0x670], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x658], 0
mov rdx, qword [rbp + 0x690]
cmp rdx, 0x10
jb 0x18005feaa
inc rdx
mov rcx, qword [rbp + 0x678]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18005fea5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800609d3
call fcn.1800a4c5c
mov rdx, qword [rsp + 0x60]
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x18005fee5
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x18005fed6
cmp rbx, qword [rax + 0x10]
jne 0x18005fed6
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x18005fec3
mov rbx, rax
mov rax, qword [rdx]
mov qword [rbp + 0x18], rax
jmp 0x18005fa5e
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x18005ff00
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x18005fef1
mov rax, qword [rdx]
mov qword [rbp + 0x18], rax
jmp 0x18005fa5e
lea r14, [r13 + 0x68]
mov qword [rsp + 0x60], r14
mov rax, qword [r14]
mov rbx, qword [rax]
mov qword [rsp + 0x70], rbx
lea rsi, [0x1801126b0]
cmp rbx, rax
je 0x1800601df
xor r12d, r12d
nop dword [rax]
nop word [rax + rax]
mov esi, dword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov rax, r8
mov rcx, qword [r8 + 8]
cmp byte [rcx + 0x19], 0
jne 0x18005ff81
mov edx, dword [rbx + 0x20]
nop dword [rax]
cmp dword [rcx + 0x20], edx
jge 0x18005ff6b
mov rcx, qword [rcx + 0x10]
jmp 0x18005ff71
mov rax, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x18005ff60
cmp rax, r8
je 0x18005ff81
cmp edx, dword [rax + 0x20]
jge 0x18005ff84
mov rax, r8
cmp r8, rax
jne 0x1800601b5
call fcn.18007dd60
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8 + 0x10]
cmp al, 1
jne 0x18006019b
mov qword [rbp + 0x748], r12
mov qword [rbp + 0x750], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x738], 0
mov r8d, 0x6b
lea rdx, str.d:jenkins.jenkinsworkspacelib_commoncomputerz12_grab_versionhookhomepage_1145_bro_mon_filemonitor.cpp
lea rcx, [rbp + 0x738]
call fcn.18000a3d0
nop
mov qword [rbp + 0x6a8], r12
mov qword [rbp + 0x6b0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x698], 0
mov r8d, 3
lea rdx, [0x180112978]
lea rcx, [rbp + 0x698]
call fcn.18000a3d0
nop
call fcn.18007dd60
mov rdi, rax
mov rcx, qword [rbx + 0x38]
sub rcx, 0x18
call fcn.180008df0
lea rcx, [rax + 0x18]
mov qword [rbp - 0x70], rcx
lea rax, [rbp - 0x70]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x20], rcx
mov r9d, dword [rbx + 0x20]
lea r8, str.process_exit__d__s_
mov edx, 2
lea rcx, [rbp - 8]
call fcn.18007d7e0
mov r14, rax
or dword [rsp + 0x40], 0x20
mov rdx, qword [rbp - 0x70]
add rdx, 0xffffffffffffffe8
mov ecx, r15d
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x18006007a
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
mov r9d, 0x1c6
lea r8, [rbp + 0x738]
lea rdx, [rbp + 0x698]
lea rcx, [rbp + 0x380]
call fcn.18000dda0
mov rbx, rax
mov rcx, qword [r14]
lea rdx, [0x1801126b0]
test rcx, rcx
cmovne rdx, rcx
mov rcx, rax
call fcn.18000c590
mov r8, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [r8 + 0x38]
nop
lea rcx, [rbp + 0x380]
call fcn.18000f5c0
and esi, 0xffffffdf
mov dword [rsp + 0x40], esi
mov rdx, qword [rbp - 8]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1800600f6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rbp + 0x6b0]
cmp rdx, 0x10
jb 0x180060137
inc rdx
mov rcx, qword [rbp + 0x698]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180060132
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800609d9
call fcn.1800a4c5c
mov qword [rbp + 0x6a8], r12
mov qword [rbp + 0x6b0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x698], 0
mov rdx, qword [rbp + 0x750]
cmp rdx, 0x10
jb 0x180060191
inc rdx
mov rcx, qword [rbp + 0x738]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18006018c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800609df
call fcn.1800a4c5c
mov r14, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
mov r8, rbx
lea rdx, [rbp]
mov rcx, r14
call fcn.180061130
mov rbx, qword [rbp]
mov qword [rsp + 0x70], rbx
jmp 0x1800601c8
mov dword [rax + 0x34], r12d
lea rcx, [rsp + 0x70]
call fcn.1800229b0
mov rbx, qword [rsp + 0x70]
mov rax, qword [r14]
mov qword [rbp + 0x20], rax
cmp rbx, rax
jne 0x18005ff40
lea rsi, [0x1801126b0]
mov rbx, qword [rsp + 0x48]
mov rdi, qword [rbx]
mov qword [rbp - 0x20], rdi
cmp rdi, rbx
je 0x180060934
mov r13d, dword [rsp + 0x40]
movsxd r12, dword [rdi + 0x30]
test r12d, r12d
js 0x180060914
cmp dword [rdi + 0x34], 0
je 0x180060914
cmp r12d, 0x14
jb 0x18006034c
call fcn.18007dd60
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8 + 0x10]
cmp al, 1
jne 0x180060914
xor ebx, ebx
mov qword [rbp + 0x768], rbx
mov qword [rbp + 0x770], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x758], bl
lea r8d, [rbx + 0x6b]
lea rdx, str.d:jenkins.jenkinsworkspacelib_commoncomputerz12_grab_versionhookhomepage_1145_bro_mon_filemonitor.cpp
lea rcx, [rbp + 0x758]
call fcn.18000a3d0
nop
mov qword [rbp + 0x868], rbx
mov qword [rbp + 0x870], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x858], bl
lea r8d, [rbx + 3]
lea rdx, [0x180112978]
lea rcx, [rbp + 0x858]
call fcn.18000a3d0
nop
call fcn.18007dd60
mov rdi, rax
mov r9d, r12d
lea r8, str.error_idx:_d
lea edx, [rbx + 1]
lea rcx, [rbp - 0x28]
call fcn.18007d7e0
or dword [rsp + 0x40], 0x40
mov r9d, 0x1d6
lea r8, [rbp + 0x758]
lea rdx, [rbp + 0x858]
lea rcx, [rbp + 0x468]
call fcn.18000dda0
mov rbx, rax
mov rcx, qword [rbp - 0x28]
mov rdx, rsi
test rcx, rcx
cmovne rdx, rcx
mov rcx, rax
call fcn.18000c590
mov r8, qword [rdi]
mov rdx, rbx
mov rcx, rdi
call qword [r8 + 0x38]
nop
lea rcx, [rbp + 0x468]
call fcn.18000f5c0
nop
mov rdx, qword [rbp - 0x28]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18006032e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rbp + 0x858]
call fcn.180008ad0
nop
lea rcx, [rbp + 0x758]
call fcn.180008ad0
jmp 0x180060914
call fcn.180009090
mov rcx, rax
test rax, rax
je 0x180060987
mov rax, qword [rax]
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0x58], rbx
mov edx, dword [rdi + 0x2c]
mov r8, qword [rsp + 0x48]
mov rax, r8
mov rcx, qword [r8 + 8]
cmp byte [rcx + 0x19], 0
jne 0x1800603a2
cmp dword [rcx + 0x20], edx
jge 0x18006038c
mov rcx, qword [rcx + 0x10]
jmp 0x180060392
mov rax, rcx
mov rcx, qword [rcx]
cmp byte [rcx + 0x19], 0
je 0x180060381
cmp rax, r8
je 0x1800603a2
cmp edx, dword [rax + 0x20]
jge 0x1800603a5
mov rax, r8
cmp r8, rax
je 0x180060409
mov rdx, qword [rax + 0x38]
lea rcx, [rdx - 0x18]
lea rsi, [rbx - 0x18]
cmp rcx, rsi
je 0x180060409
cmp dword [rsi + 0x10], 0
jl 0x1800603f6
mov rax, qword [rsi]
cmp qword [rcx], rax
jne 0x1800603f6
call fcn.180008df0
mov rbx, rax
mov ecx, r15d
lock xadd dword [rsi + 0x10], ecx
sub ecx, 1
jg 0x1800603eb
mov rcx, qword [rsi]
mov r8, qword [rcx]
mov rdx, rsi
call qword [r8 + 8]
add rbx, 0x18
mov qword [rsp + 0x58], rbx
jmp 0x180060409
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.180009210
mov rbx, qword [rsp + 0x58]
cmp dword [rbx - 0x10], 0
jne 0x1800604a2
mov r8d, dword [rdi + 0x2c]
lea rdx, [rbp + 8]
mov rcx, qword [rbp - 0x80]
call fcn.1800611f0
nop
mov rdx, qword [rax]
lea rcx, [rdx - 0x18]
add rbx, 0xffffffffffffffe8
cmp rcx, rbx
je 0x18006047f
cmp dword [rbx + 0x10], 0
jl 0x180060470
mov rax, qword [rbx]
cmp qword [rcx], rax
jne 0x180060470
call fcn.180008df0
mov rsi, rax
mov ecx, r15d
lock xadd dword [rbx + 0x10], ecx
sub ecx, 1
jg 0x180060465
mov rcx, qword [rbx]
mov r8, qword [rcx]
mov rdx, rbx
call qword [r8 + 8]
lea rax, [rsi + 0x18]
mov qword [rsp + 0x58], rax
jmp 0x18006047f
mov r8d, dword [rdx - 0x10]
lea rcx, [rsp + 0x58]
call fcn.180009210
nop
mov rdx, qword [rbp + 8]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x18006049d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov rbx, qword [rsp + 0x58]
call fcn.18007dd60
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8 + 0x10]
cmp al, 1
jne 0x180060688
lea rax, [rsp + 0x78]
mov qword [rsp + 0x68], rax
xor esi, esi
mov qword [rbp + 0x7a8], rsi
mov qword [rbp + 0x7b0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x798], sil
lea r8d, [rsi + 0x6b]
lea rdx, str.d:jenkins.jenkinsworkspacelib_commoncomputerz12_grab_versionhookhomepage_1145_bro_mon_filemonitor.cpp
lea rcx, [rbp + 0x798]
call fcn.18000a3d0
nop
mov qword [rbp + 0x788], rsi
mov qword [rbp + 0x790], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x778], sil
lea r8d, [rsi + 3]
lea rdx, [0x180112978]
lea rcx, [rbp + 0x778]
call fcn.18000a3d0
nop
call fcn.18007dd60
mov rsi, rax
lea rcx, [rbx - 0x18]
call fcn.180008df0
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rax, [rsp + 0x78]
mov qword [rbp + 0x10], rax
mov rcx, qword [rdi + 0x38]
sub rcx, 0x18
call fcn.180008df0
add rax, 0x18
mov qword [rbp - 0x68], rax
lea rcx, [rbp - 0x68]
mov qword [rsp + 0x68], rcx
mov edx, dword [rdi + 0x2c]
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rax
mov r9d, dword [rdi + 0x20]
lea r8, str.process_create__d__s___parent__d__s_
mov edx, 4
lea rcx, [rbp - 0x18]
call fcn.18007d7e0
mov r14, rax
or dword [rsp + 0x40], 0x80
mov rdx, qword [rbp - 0x68]
add rdx, 0xffffffffffffffe8
mov ecx, r15d
lock xadd dword [rdx + 0x10], ecx
sub ecx, 1
jg 0x1800605c7
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [r8 + 8]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1800605e6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov r9d, 0x1e3
lea r8, [rbp + 0x798]
lea rdx, [rbp + 0x778]
lea rcx, [rbp + 0x550]
call fcn.18000dda0
mov rbx, rax
mov rcx, qword [r14]
lea rdx, [0x1801126b0]
test rcx, rcx
cmovne rdx, rcx
mov rcx, rax
call fcn.18000c590
mov r8, qword [rsi]
mov rdx, rbx
mov rcx, rsi
call qword [r8 + 0x38]
nop
lea rcx, [rbp + 0x550]
call fcn.18000f5c0
btr r13d, 7
mov dword [rsp + 0x40], r13d
mov rdx, qword [rbp - 0x18]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180060665
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rbp + 0x778]
call fcn.180008ad0
nop
lea rcx, [rbp + 0x798]
call fcn.180008ad0
mov rbx, qword [rsp + 0x58]
mov r14, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [rdi + 0x2c], eax
je 0x18006088d
mov rdx, qword [rdi + 0x38]
test rdx, rdx
je 0x1800609e5
mov rcx, rbx
call fcn.1800dce44
test eax, eax
je 0x180060886
xor r13d, r13d
mov qword [rbp + 0x728], r13
mov qword [rbp + 0x730], 7
mov word [rbp + 0x718], r13w
lea r8d, [r13 + 0xd]
lea rdx, str.ex_ary_bro_
lea rcx, [rbp + 0x718]
call fcn.180019aa0
lea rdx, [r12 + r12*2]
lea rcx, str.9Dbu2YyzFGj6INfApshB5g
mov rdx, qword [rcx + rdx*8 + 0x10]
mov r8, r15
nop dword [rax + rax]
inc r8
cmp word [rdx + r8*2], 0
jne 0x180060700
mov rcx, rax
call fcn.180019aa0
mov r8d, ntohs
lea rdx, str.ex_ary_pro_
lea rcx, [rbp + 0x718]
call fcn.180019aa0
mov r8, r15
nop
inc r8
cmp word [rbx + r8*2], 0
jne 0x180060730
mov rdx, rbx
mov rcx, rax
call fcn.180019aa0
lea rdx, [rbp + 0x7f8]
cmp qword [rbp + 0x810], 8
cmovae rdx, qword [rbp + 0x7f8]
mov r8, qword [rbp + 0x808]
lea rcx, [rbp + 0x718]
call fcn.180019aa0
mov qword [rbp + 0x7e8], r13
mov qword [rbp + 0x7f0], 7
mov word [rbp + 0x7d8], r13w
mov r8d, ntohs
lea rdx, str.browser_parent
lea rcx, [rbp + 0x7d8]
call fcn.180019da0
nop
mov qword [rbp + 0x7c8], r13
mov qword [rbp + 0x7d0], 7
mov word [rbp + 0x7b8], r13w
mov r8d, 3
lea rdx, [0x180112c68]
lea rcx, [rbp + 0x7b8]
call fcn.180019da0
nop
mov rcx, qword [0x180176b40]
test rcx, rcx
jne 0x18006083b
lea rcx, [0x180167e08]
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp qword [0x180176b40], 0
jne 0x180060827
mov ecx, 0xb8
call fcn.1800a5060
mov qword [rbp + 0x30], rax
test rax, rax
je 0x180060818
mov rcx, rax
call fcn.1800675b0
jmp 0x18006081b
mov rax, r13
lock or dword [rsp], 0
mov qword [0x180176b40], rax
lea rcx, [0x180167e08]
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov rcx, qword [0x180176b40]
mov dword [rsp + 0x20], 1
lea r9, [rbp + 0x718]
lea r8, [rbp + 0x7d8]
lea rdx, [rbp + 0x7b8]
call fcn.180068da0
nop
lea rcx, [rbp + 0x7b8]
call fcn.1800198f0
nop
lea rcx, [rbp + 0x7d8]
call fcn.1800198f0
nop
lea rcx, [rbp + 0x718]
call fcn.1800198f0
jmp 0x18006088d
mov dword [rdi + 0x48], 1
lea rdx, [rdi + 0x28]
mov eax, dword [rdi + 0x20]
mov dword [rbp + 0x78], eax
lea rcx, [rbp + 0x80]
call fcn.18005e980
or dword [rsp + 0x40], 0x100
lea rdx, [rbp + 0x78]
mov rcx, r14
call fcn.18005df80
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea rdx, [rbp + 0xa8]
mov rcx, r14
call fcn.18005e360
nop
mov rdx, qword [rbp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1800608f5
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r15d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x180060914
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea rcx, [rbp - 0x20]
call fcn.1800229b0
mov rdi, qword [rbp - 0x20]
cmp rdi, qword [rsp + 0x48]
je 0x180060934
lea rsi, [0x1801126b0]
jmp 0x1800601f4
mov rbx, qword [rsp + 0x48]
mov rdx, qword [rbx + 8]
lea rcx, [rsp + 0x48]
call fcn.180061000
mov rax, qword [rsp + 0x48]
mov qword [rax + 8], rbx
mov rax, qword [rsp + 0x48]
mov qword [rax], rbx
mov rax, qword [rsp + 0x48]
mov qword [rax + 0x10], rbx
xor eax, eax
mov qword [rsp + 0x50], rax
lea edx, [rax + 0x50]
mov rcx, qword [rsp + 0x48]
call fcn.1800a4c5c
nop
lea rcx, [rbp + 0x7f8]
call fcn.1800198f0
jmp 0x18005f533
mov ecx, 0x80004005
call fcn.180008c20
int3
mov ecx, 0x80004005
call fcn.180008c20
nop
call fcn.1800d79f8
nop
call fcn.1800d79f8
nop
call fcn.1800d79f8
nop
call fcn.1800d79f8
nop
call fcn.1800d79f8
int3
call fcn.1800d79f8
nop
call fcn.1800d79f8
int3
call fcn.180019980
nop
call fcn.1800d79f8
nop
call fcn.1800d79f8
nop
call fcn.1800d79f8
nop
call fcn.1800d79f8
nop
mov ecx, 0x80004005
call fcn.180008c20
int3