Function at 0x140002a54
Capabilities:
Enumerate processes
Get common file path
Get disk information
Get memory capacity
Get system information on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x308]
sub rsp, 0x3e0
mov rax, qword [0x140025040]
xor rax, rsp
mov qword [rbp + 0x2d0], rax
xor r15d, r15d
lea rcx, [rsp + 0x50]
mov ebx, r15d
mov dword [rsp + 0x38], ebx
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x70], 2
lea r13d, [r15 + 1]
jb 0x140003697
lea rcx, [rbp + 0x160]
mov dword [rbp + 0x160], 0x40
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
cmp qword [rbp + 0x168], 0xffffffff80000000
jb 0x140003697
mov ecx, 0x2c0
mov dword [rsp + 0x38], ecx
call fcn.14000b808
lea rdx, [rsp + 0x38]
mov rcx, rax
mov rsi, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x140002b0f
mov rcx, rsi
call fcn.14000b7f4
mov ecx, dword [rsp + 0x38]
call fcn.14000b808
mov rsi, rax
lea rdx, [rsp + 0x38]
mov rcx, rsi
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
mov r12d, 0xf
mov r14d, 0x1000
test eax, eax
jne 0x1400031d6
mov r14, rsi
test rsi, rsi
je 0x1400031d0
mov eax, dword [str.VMware]
or ebx, r13d
mov rcx, qword [0x140026ad8]
or ebx, 6
mov qword [rbp - 0x70], 6
mov qword [rbp - 0x68], r12
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x80], eax
movzx eax, word [0x140019534]
mov word [rbp - 0x7c], ax
mov al, byte [0x140027f28]
mov byte [rsp + 0x30], al
mov byte [rbp - 0x7a], r15b
test rcx, rcx
je 0x140003a2c
mov rax, qword [rcx]
lea r9, [rsp + 0x30]
lea r8, [rbp - 0x80]
lea rdx, [rbp - 0x60]
call qword [rax + 0x10]
mov rcx, qword [0x140026b98]
test rcx, rcx
je 0x140003a26
mov rax, qword [rcx]
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0x20]
call qword [rax + 0x10]
cmp qword [rbp + 0x38], r12
lea rdx, [rbp + 0x20]
lea rdi, [r14 + 0x110]
cmova rdx, qword [rbp + 0x20]
mov rcx, rdi
call fcn.140008aa0
test rax, rax
jne 0x140002ddd
movzx eax, word [0x140019540]
or ebx, 0x38
mov rcx, qword [0x140026ad8]
mov qword [rbp - 0x30], 0xa
mov qword [rbp - 0x28], r12
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x38], ax
mov al, byte [0x140027f28]
mov byte [rsp + 0x30], al
mov byte [rbp - 0x36], r15b
vmovsd xmm0, qword [str.VirtualBox]
vmovsd qword [rbp - 0x40], xmm0
test rcx, rcx
je 0x140003a1a
mov rax, qword [rcx]
lea r9, [rsp + 0x30]
lea r8, [rbp - 0x40]
lea rdx, [rbp + 0x60]
call qword [rax + 0x10]
mov rcx, qword [0x140026b98]
test rcx, rcx
je 0x140003a26
mov rax, qword [rcx]
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0xe0]
call qword [rax + 0x10]
cmp qword [rbp + 0xf8], r12
lea rdx, [rbp + 0xe0]
mov rcx, rdi
cmova rdx, qword [rbp + 0xe0]
call fcn.140008aa0
test rax, rax
jne 0x140002ddd
mov rcx, qword [0x140026ad8]
movabs rax, 0x74656e7265687445
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x20], rax
or ebx, 0x1c0
mov al, byte [0x140027f28]
mov byte [rsp + 0x30], al
mov qword [rbp - 0x10], 8
mov qword [rbp - 8], r12
mov byte [rbp - 0x18], r15b
test rcx, rcx
je 0x140003a14
mov rax, qword [rcx]
lea r9, [rsp + 0x30]
lea r8, [rbp - 0x20]
lea rdx, [rbp + 0x40]
call qword [rax + 0x10]
mov rcx, qword [0x140026b98]
test rcx, rcx
je 0x140003a26
mov rax, qword [rcx]
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0xc0]
call qword [rax + 0x10]
cmp qword [rbp + 0xd8], r12
lea rdx, [rbp + 0xc0]
mov rcx, rdi
cmova rdx, qword [rbp + 0xc0]
call fcn.140008aa0
test rax, rax
jne 0x140002ddd
mov rax, qword [str.Hyper_V]
or ebx, 0xe00
mov rcx, qword [0x140026ad8]
mov dword [rbp], eax
movzx eax, word [0x14001956c]
mov word [rbp + 4], ax
mov al, byte [0x14001956e]
mov byte [rbp + 6], al
mov al, byte [0x140027f28]
mov byte [rsp + 0x30], al
mov qword [rbp + 8], r15
mov qword [rbp + 0x10], 7
mov qword [rbp + 0x18], r12
mov byte [rbp + 7], r15b
test rcx, rcx
je 0x140003a0e
mov rax, qword [rcx]
lea r9, [rsp + 0x30]
lea r8, [rbp]
lea rdx, [rbp + 0x80]
call qword [rax + 0x10]
mov rcx, qword [0x140026b98]
test rcx, rcx
je 0x140003a26
mov rax, qword [rcx]
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0xa0]
call qword [rax + 0x10]
cmp qword [rbp + 0xb8], r12
lea rdx, [rbp + 0xa0]
mov rcx, rdi
cmova rdx, qword [rbp + 0xa0]
call fcn.140008aa0
mov dil, r15b
test rax, rax
je 0x140002de0
mov dil, r13b
bt ebx, 0xb
jae 0x140002e3f
mov rdx, qword [rbp + 0xb8]
btr ebx, 0xb
cmp rdx, r12
jbe 0x140002e2a
mov rcx, qword [rbp + 0xa0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e25
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003a20
call fcn.140007bbc
mov qword [rbp + 0xb0], r15
mov qword [rbp + 0xb8], r12
mov byte [rbp + 0xa0], r15b
bt ebx, 0xa
jae 0x140002e9e
mov rdx, qword [rbp + 0x98]
btr ebx, 0xa
cmp rdx, r12
jbe 0x140002e89
mov rcx, qword [rbp + 0x80]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e84
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003a20
call fcn.140007bbc
mov qword [rbp + 0x90], r15
mov qword [rbp + 0x98], r12
mov byte [rbp + 0x80], r15b
bt ebx, 9
jae 0x140002eee
mov rdx, qword [rbp + 0x18]
btr ebx, 9
cmp rdx, r12
jbe 0x140002ee2
mov rcx, qword [rbp]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002edd
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003a20
call fcn.140007bbc
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], r12
mov byte [rbp], r15b
bt ebx, 8
jae 0x140002f4d
mov rdx, qword [rbp + 0xd8]
btr ebx, 8
cmp rdx, r12
jbe 0x140002f38
mov rcx, qword [rbp + 0xc0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f33
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003a20
call fcn.140007bbc
mov qword [rbp + 0xd0], r15
mov qword [rbp + 0xd8], r12
mov byte [rbp + 0xc0], r15b
test bl, bl
jns 0x140002f9b
mov rdx, qword [rbp + 0x58]
btr ebx, 7
cmp rdx, r12
jbe 0x140002f8f
mov rcx, qword [rbp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f8a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003a20
call fcn.140007bbc
mov qword [rbp + 0x50], r15
mov qword [rbp + 0x58], r12
mov byte [rbp + 0x40], r15b
test bl, 0x40
je 0x140002fe9
mov rdx, qword [rbp - 8]
and ebx, 0xffffffbf
cmp rdx, r12
jbe 0x140002fdd
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002fd8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003a20
call fcn.140007bbc
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], r12
mov byte [rbp - 0x20], r15b
test bl, 0x20
je 0x140003046
mov rdx, qword [rbp + 0xf8]
and ebx, 0xffffffdf
cmp rdx, r12
jbe 0x140003031
mov rcx, qword [rbp + 0xe0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000302c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003a20
call fcn.140007bbc
mov qword [rbp + 0xf0], r15
mov qword [rbp + 0xf8], r12
mov byte [rbp + 0xe0], r15b
test bl, 0x10
je 0x140003094
mov rdx, qword [rbp + 0x78]
and ebx, 0xffffffef
cmp rdx, r12
jbe 0x140003088
mov rcx, qword [rbp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003083
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003a20
call fcn.140007bbc
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x78], r12
mov byte [rbp + 0x60], r15b
test bl, 8
je 0x1400030e2
mov rdx, qword [rbp - 0x28]
and ebx, 0xfffffff7
cmp rdx, r12
jbe 0x1400030d6
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400030d1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003a20
call fcn.140007bbc
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], r12
mov byte [rbp - 0x40], r15b
mov rdx, qword [rbp + 0x38]
and ebx, 0xfffffffb
cmp rdx, r12
jbe 0x14000311f
mov rcx, qword [rbp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000311a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003a20
call fcn.140007bbc
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], r12
mov byte [rbp + 0x20], r15b
test bl, 2
je 0x140003179
mov rdx, qword [rbp - 0x48]
and ebx, 0xfffffffd
cmp rdx, r12
jbe 0x14000316d
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003168
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003a20
call fcn.140007bbc
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r12
mov byte [rbp - 0x60], r15b
test r13b, bl
je 0x1400031bb
mov rdx, qword [rbp - 0x68]
and ebx, 0xfffffffe
cmp rdx, r12
jbe 0x1400031bb
mov rcx, qword [rbp - 0x80]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400031b6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003a20
call fcn.140007bbc
test dil, dil
jne 0x14000368f
mov r14, qword [r14]
test r14, r14
jne 0x140002b3d
mov r14d, 0x1000
mov rcx, rsi
call fcn.14000b7f4
call qword [sym.imp.KERNEL32.dll_GetLogicalDrives]
test eax, eax
je 0x140003697
mov eax, dword [0x1400196e0]
mov rcx, qword [0x140026ad8]
vmovdqu xmm1, xmmword [0x140019a70]
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x20], xmm0
mov word [rbp + 0x20], ax
mov al, byte [0x1400196e2]
mov byte [rbp + 0x22], al
mov al, byte [0x140027f28]
mov byte [rsp + 0x30], al
mov byte [rbp + 0x23], r15b
vmovdqu xmmword [rbp + 0x30], xmm1
test rcx, rcx
je 0x140003a08
mov rax, qword [rcx]
lea r9, [rsp + 0x30]
lea r8, [rbp + 0x20]
lea rdx, [rbp - 0x60]
call qword [rax + 0x10]
mov rcx, qword [0x140026b98]
test rcx, rcx
je 0x140003a32
mov rax, qword [rcx]
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x80]
call qword [rax + 0x10]
cmp qword [rbp - 0x68], r12
lea rcx, [rbp - 0x80]
cmova rcx, qword [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov rdx, qword [rbp - 0x68]
mov ebx, eax
cmp rdx, r12
jbe 0x1400032af
mov rcx, qword [rbp - 0x80]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x1400032aa
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003a38
call fcn.140007bbc
mov rdx, qword [rbp - 0x48]
mov byte [rbp - 0x80], r15b
vmovdqu xmm0, xmmword [0x140019a60]
vmovdqu xmmword [rbp - 0x70], xmm0
cmp rdx, r12
jbe 0x1400032fe
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x1400032f1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003a38
call fcn.140007bbc
vmovdqu xmm0, xmmword [0x140019a60]
mov rdx, qword [rbp + 0x38]
mov byte [rbp - 0x60], r15b
vmovdqu xmmword [rbp - 0x50], xmm0
cmp rdx, r12
jbe 0x14000333d
mov rcx, qword [rbp + 0x20]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x140003338
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003a38
call fcn.140007bbc
cmp ebx, 2
je 0x140003697
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x140003363
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x140003697
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x140003380
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x140003697
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
jne 0x14000339d
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x140003697
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x1388
jb 0x140003697
vpxor xmm0, xmm0, xmm0
vpxor xmm1, xmm1, xmm1
mov r8d, 0xc
lea rdx, str.vmtoolsd.exe
lea rcx, [rbp + 0x40]
vmovups xmmword [rbp + 0x40], xmm0
vmovdqu xmmword [rbp + 0x50], xmm1
call fcn.14000207c
mov rcx, qword [0x140026ad8]
mov al, byte [0x140027f28]
mov byte [rsp + 0x30], al
test rcx, rcx
je 0x140003a3e
mov rax, qword [rcx]
lea r9, [rsp + 0x30]
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x20]
call qword [rax + 0x10]
mov rcx, qword [0x140026b98]
test rcx, rcx
je 0x140003a02
mov rax, qword [rcx]
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x100]
call qword [rax + 0x10]
mov r8, r12
lea rdx, str.vboxservice.exe
vpxor xmm0, xmm0, xmm0
vpxor xmm1, xmm1, xmm1
lea rcx, [rbp - 0x80]
vmovups xmmword [rbp - 0x80], xmm0
vmovdqu xmmword [rbp - 0x70], xmm1
call fcn.14000207c
mov rcx, qword [0x140026ad8]
mov al, byte [0x140027f28]
mov byte [rsp + 0x30], al
test rcx, rcx
je 0x140003a44
mov rax, qword [rcx]
lea r9, [rsp + 0x30]
lea r8, [rbp - 0x80]
lea rdx, [rbp + 0x80]
call qword [rax + 0x10]
mov rcx, qword [0x140026b98]
test rcx, rcx
je 0x140003a02
mov rax, qword [rcx]
lea r8, [rbp + 0x80]
lea rdx, [rbp + 0x120]
call qword [rax + 0x10]
mov r8d, 0xd
lea rdx, str.wireshark.exe
vpxor xmm0, xmm0, xmm0
vpxor xmm1, xmm1, xmm1
lea rcx, [rbp + 0x60]
vmovups xmmword [rbp + 0x60], xmm0
vmovdqu xmmword [rbp + 0x70], xmm1
call fcn.14000207c
mov rcx, qword [0x140026ad8]
mov al, byte [0x140027f28]
mov byte [rsp + 0x30], al
test rcx, rcx
je 0x140003a4a
mov rax, qword [rcx]
lea r9, [rsp + 0x30]
lea r8, [rbp + 0x60]
lea rdx, [rbp - 0x60]
call qword [rax + 0x10]
mov rcx, qword [0x140026b98]
test rcx, rcx
je 0x140003a02
mov rax, qword [rcx]
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0x140]
call qword [rax + 0x10]
lea rcx, [rbp + 0x100]
mov qword [rbp + 0x10], r15
mov qword [rsp + 0x48], rcx
lea rax, [rbp + 0x160]
vpxor xmm0, xmm0, xmm0
mov edi, 3
mov qword [rsp + 0x40], rax
lea rcx, [rbp]
mov edx, edi
lea r9, [rsp + 0x40]
lea r8, [rsp + 0x48]
vmovdqu xmmword [rbp], xmm0
call fcn.1400022e0
lea rbx, [rbp + 0x160]
lea rbx, [rbx - 0x20]
sub rdi, r13
mov rdx, qword [rbx + 0x18]
cmp rdx, r12
jbe 0x140003595
mov rcx, qword [rbx]
inc rdx
cmp rdx, r14
jb 0x140003590
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003a50
mov rcx, r8
call fcn.140007bbc
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], r12
mov byte [rbx], r15b
test rdi, rdi
jne 0x140003559
mov rdx, qword [rbp - 0x48]
cmp rdx, r12
jbe 0x1400035db
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x1400035d6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003a50
call fcn.140007bbc
vmovdqu xmm0, xmmword [0x140019a60]
lea rcx, [rbp + 0x60]
mov byte [rbp - 0x60], r15b
vmovdqu xmmword [rbp - 0x50], xmm0
call fcn.140002958
lea rcx, [rbp + 0x80]
call fcn.140002958
mov rdx, qword [rbp - 0x68]
cmp rdx, r12
jbe 0x140003637
mov rcx, qword [rbp - 0x80]
inc rdx
mov rax, rcx
cmp rdx, r14
jb 0x140003632
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003a50
call fcn.140007bbc
vmovdqu xmm0, xmmword [0x140019a60]
lea rcx, [rbp + 0x20]
mov byte [rbp - 0x80], r15b
vmovdqu xmmword [rbp - 0x70], xmm0
call fcn.140002958
lea rcx, [rbp + 0x40]
call fcn.140002958
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r14, rax
cmp rax, 0xffffffffffffffff
je 0x1400039e0
lea rdx, [rbp + 0x1a0]
mov dword [rbp + 0x1a0], 0x130
mov rcx, rax
call sub.KERNEL32.dll_Process32First
jmp 0x1400039cf
mov rcx, rsi
call fcn.14000b7f4
mov al, r13b
mov rcx, qword [rbp + 0x2d0]
xor rcx, rsp
call fcn.140007e90
lea r11, [rsp + 0x3e0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rbx, qword [rbp]
jmp 0x1400039b6
mov rdx, rbx
cmp qword [rbx + 0x18], r12
jbe 0x1400036df
mov rdx, qword [rbx]
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r15
or r8, 0xffffffffffffffff
mov qword [rbp + 0x58], r15
inc r8
cmp byte [rdx + r8], r15b
jne 0x1400036f4
lea rcx, [rbp + 0x40]
call fcn.14000207c
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r15
lea rax, [rbp + 0x1cc]
mov qword [rbp - 0x28], r15
or r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r15b
jne 0x140003722
lea rdx, [rbp + 0x1cc]
lea rcx, [rbp - 0x40]
call fcn.14000207c
mov rcx, qword [0x140026ad8]
mov al, byte [0x140027f28]
mov byte [rsp + 0x30], al
test rcx, rcx
je 0x1400039fc
mov rax, qword [rcx]
lea r9, [rsp + 0x30]
lea r8, [rbp + 0x40]
lea rdx, [rbp + 0x60]
call qword [rax + 0x10]
mov rcx, qword [0x140026958]
test rcx, rcx
je 0x140003a62
mov rax, qword [rcx]
lea r8, [rbp + 0x60]
lea rdx, [rbp - 0x20]
call qword [rax + 0x10]
mov rcx, qword [0x140026ad8]
mov al, byte [0x140027f28]
mov byte [rsp + 0x30], al
test rcx, rcx
je 0x140003a5c
mov rax, qword [rcx]
lea r9, [rsp + 0x30]
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x60]
call qword [rax + 0x10]
mov rcx, qword [0x140026958]
test rcx, rcx
je 0x140003a62
mov rax, qword [rcx]
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x80]
call qword [rax + 0x10]
mov rax, qword [rbp - 0x10]
lea r9, [rbp - 0x20]
mov rdi, qword [rbp - 8]
lea rcx, [rbp - 0x80]
mov r15, qword [rbp - 0x68]
cmp rdi, r12
mov rsi, qword [rbp - 0x80]
cmova r9, qword [rbp - 0x20]
cmp r15, r12
mov rdx, qword [rbp - 0x70]
cmova rcx, rsi
mov qword [rsp + 0x20], rax
xor r8d, r8d
call fcn.140002678
mov r12, rax
cmp r15, 0xf
jbe 0x140003847
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14000383b
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003a56
mov rcx, rsi
call fcn.140007bbc
mov rdi, qword [rbp - 8]
mov rdx, qword [rbp - 0x48]
xor r15d, r15d
mov qword [rbp - 0x70], r15
mov byte [rbp - 0x80], r15b
lea esi, [r15 + 0xf]
mov qword [rbp - 0x68], rsi
cmp rdx, rsi
jbe 0x140003898
mov rcx, qword [rbp - 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000388f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003a56
call fcn.140007bbc
mov rdi, qword [rbp - 8]
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], rsi
mov byte [rbp - 0x60], r15b
cmp rdi, rsi
jbe 0x1400038de
mov rcx, qword [rbp - 0x20]
lea rdx, [rdi + 1]
mov edi, 0x1000
mov rax, rcx
cmp rdx, rdi
jb 0x1400038d7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003a56
call fcn.140007bbc
jmp 0x1400038e3
mov edi, 0x1000
mov rdx, qword [rbp + 0x78]
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], rsi
mov byte [rbp - 0x20], r15b
cmp rdx, rsi
jbe 0x140003925
mov rcx, qword [rbp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, rdi
jb 0x140003920
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003a56
call fcn.140007bbc
mov rdx, qword [rbp - 0x28]
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x78], rsi
mov byte [rbp + 0x60], r15b
cmp rdx, rsi
jbe 0x140003967
mov rcx, qword [rbp - 0x40]
inc rdx
mov rax, rcx
cmp rdx, rdi
jb 0x140003962
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003a56
call fcn.140007bbc
mov rdx, qword [rbp + 0x58]
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], rsi
mov byte [rbp - 0x40], r15b
cmp rdx, rsi
jbe 0x1400039a9
mov rcx, qword [rbp + 0x40]
inc rdx
mov rax, rcx
cmp rdx, rdi
jb 0x1400039a4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003a56
call fcn.140007bbc
cmp r12, 0xffffffffffffffff
jne 0x1400039f1
add rbx, 0x20
mov r12, rsi
cmp rbx, qword [rbp + 8]
jne 0x1400036d3
lea rdx, [rbp + 0x1a0]
mov rcx, r14
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x1400036ca
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r13b, r15b
lea rcx, [rbp]
call fcn.140007448
jmp 0x140003697
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400039e3
call fcn.140007a20
int3
call fcn.140007a20
int3
call fcn.140007a20
int3
call fcn.140007a20
int3
call fcn.140007a20
int3
call fcn.140007a20
int3
call fcn.14000b77c
int3
call fcn.140007a20
int3
call fcn.140007a20
int3
call fcn.140007a20
int3
call fcn.14000b77c
int3
call fcn.140007a20
int3
call fcn.140007a20
int3
call fcn.140007a20
int3
call fcn.14000b77c
int3
call fcn.14000b77c
int3
call fcn.140007a20
int3
call fcn.140007a20
int3
add rcx, 8
jmp 0x140002a54