Function at 0x140003420
Capabilities:
Enumerate processes

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x2d8
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x250], 0xfffffffffffffffe
mov eax, 0x7d2a3783
mov r12, qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdi, [rbp - 0x60]
lea rbx, [rbp + 0x1d8]
lea r15, str.ccSvcHst
mov r14d, 0x7f6b42b8
mov dword [rbp + 0x230], ecx
jmp 0x14000349d
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x657939e5
mov ecx, 0xaa90ca98
nop dword [rax + rax]
cmove eax, ecx
cmp dword [0x14004acc8], 0xa
cmovl eax, ecx
cmp eax, 0xfc5e0c51
jle 0x140003520
cmp eax, 0x3f0afc53
jle 0x140003580
cmp eax, 0x657939e4
jg 0x140003630
cmp eax, 0x5b28ecc0
jg 0x140003776
cmp eax, 0x48ab3e9e
jle 0x140003993
cmp eax, 0x48ab3e9f
je 0x140003d14
cmp eax, 0x5588f2be
je 0x140003d32
cmp eax, 0x56bf99ab
jne 0x14000349d
mov rcx, rbx
call fcn.140004a10
mov rax, qword [rbp + 0x208]
mov eax, dword [rbp + 0x234]
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd4e50bf5
mov ecx, 0xe97104c9
jmp 0x140003490
cmp eax, 0xb5da99ee
jle 0x1400035d0
cmp eax, 0xe6c712c2
jg 0x14000368c
cmp eax, 0xc3026901
jg 0x1400037d2
cmp eax, 0xbee4414a
jle 0x1400039b3
cmp eax, 0xbee4414b
je 0x140003d50
cmp eax, 0xbfb8068d
je 0x140003d5a
cmp eax, 0xc2cb8cb1
jne 0x14000349d
mov eax, 0x686d3adf
jmp 0x14000349d
cmp eax, 0x22fa70b6
jle 0x1400036cd
cmp eax, 0x31b25bed
jg 0x14000381d
cmp eax, 0x268ec275
jle 0x1400039fc
cmp eax, 0x268ec276
je 0x140003d64
cmp eax, 0x2b23d44f
je 0x140003d82
cmp eax, 0x2cfd5ed7
jne 0x14000349d
mov eax, 0xfc5e0c52
jmp 0x14000349d
cmp eax, 0xa2ef3096
jle 0x14000370e
cmp eax, 0xa9cc1475
jg 0x140003875
cmp eax, 0xa623f9ae
jle 0x140003a30
cmp eax, 0xa623f9af
je 0x140003472
cmp eax, 0xa6e1bef1
je 0x140003da0
cmp eax, 0xa8c19377
jne 0x14000349d
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x80afd2b0
mov ecx, 0x7539ea14
jmp 0x140003490
cmp eax, 0x7539ea13
jg 0x1400038bf
cmp eax, 0x686d3ade
jle 0x140003a5a
cmp eax, 0x686d3adf
je 0x140003dca
cmp eax, 0x6a7e0138
je 0x140003de1
cmp eax, 0x6bde38ff
jne 0x14000349d
mov rax, qword [rbp + 0x200]
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xbee4414b
mov ecx, 0xb40e3c5b
jmp 0x140003490
cmp eax, 0xec7f3e27
jg 0x140003908
cmp eax, 0xe97104c8
jle 0x140003a8e
cmp eax, 0xe97104c9
je 0x14000419c
cmp eax, 0xeaefdd7e
je 0x1400041a6
cmp eax, 0xebbae390
jne 0x14000349d
mov eax, 0x9441bbfd
jmp 0x14000349d
cmp eax, 0x12a35a6a
jle 0x140003933
cmp eax, 0x1377976c
jle 0x140003ac2
cmp eax, 0x1377976d
je 0x1400041be
cmp eax, 0x1b3f8022
je 0x1400041dc
cmp eax, 0x22a1649f
jne 0x14000349d
mov eax, 0xe6c712c3
jmp 0x14000349d
cmp eax, 0x9027a704
jle 0x14000395e
cmp eax, 0x9441bbfc
jle 0x140003b02
cmp eax, 0x9441bbfd
je 0x1400041f5
cmp eax, 0x9a80af13
je 0x140004213
cmp eax, 0x9c98796e
jne 0x14000349d
cmp byte [rbp + 0x247], 0
mov eax, 0x899fbbaf
mov ecx, 0xa8c19377
cmovne eax, ecx
mov cl, byte [rbp + 0x24f]
mov byte [rbp + 0x24e], cl
mov ecx, dword [rbp + 0x234]
mov dword [rbp + 0x21c], ecx
jmp 0x14000349d
cmp eax, 0x62726057
jle 0x140003b4d
cmp eax, 0x62726058
je 0x14000421d
cmp eax, 0x652e8c8d
je 0x140004245
cmp eax, 0x65690dbf
jne 0x14000349d
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x62726058
mov ecx, 0x878eef8d
cmovne eax, ecx
cmp dword [0x14004acc8], 0xa
mov ecx, 0x62726058
cmovl eax, ecx
jmp 0x14000349d
cmp eax, 0xcf95ebcb
jle 0x140003b7c
cmp eax, 0xcf95ebcc
je 0x14000424f
cmp eax, 0xd3340510
je 0x140004280
cmp eax, 0xd4e50bf5
jne 0x14000349d
mov rcx, rbx
call fcn.140004a10
mov rax, qword [rbp + 0x208]
mov eax, dword [rbp + 0x234]
mov eax, 0x56bf99ab
jmp 0x14000349d
cmp eax, 0x3838e45c
jle 0x140003bdb
cmp eax, 0x3838e45d
je 0x14000429e
cmp eax, 0x3a7bb47f
je 0x1400042bc
cmp eax, 0x3b160fd4
jne 0x14000349d
cmp dword [rbp + 0x214], 0
sete byte [rbp + 0x245]
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa9cc1476
mov ecx, 0x8eccfe9e
jmp 0x140003490
cmp eax, 0xb18f3b47
jle 0x140003c02
cmp eax, 0xb18f3b48
je 0x1400042c6
cmp eax, 0xb31ff57c
je 0x1400042e4
cmp eax, 0xb40e3c5b
jne 0x14000349d
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xbee4414b
mov ecx, 0x31b25bee
jmp 0x140003490
cmp eax, 0x7bfd3468
jle 0x140003c57
cmp eax, 0x7bfd3469
je 0x140004302
cmp eax, 0x7f6b42b8
je 0x14000431d
cmp eax, 0x7d2a3783
jne 0x14000349d
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov qword [rbp + 0x238], rax
mov eax, 0xa623f9af
jmp 0x14000349d
cmp eax, 0xf0a531b7
jle 0x140003c77
cmp eax, 0xf0a531b8
je 0x14000432e
cmp eax, 0xfb35e9be
jne 0x1400045b1
mov eax, 0x12b26e1d
jmp 0x14000349d
cmp eax, 0xf96ae28
jg 0x140003cb9
cmp eax, 0xfc5e0c52
je 0x140004338
cmp eax, 0xff217018
jne 0x14000349d
mov eax, 0x7539ea14
jmp 0x14000349d
cmp eax, 0x899fbbae
jg 0x140003cd9
cmp eax, 0x80afd2b0
je 0x140004356
cmp eax, 0x878eef8d
jne 0x14000349d
mov rcx, qword [rbp + 0x238]
call r12
mov eax, 0x62726058
jmp 0x14000349d
cmp eax, 0x3f0afc54
je 0x140004374
cmp eax, 0x40378c35
jne 0x14000349d
mov eax, 0x1377976d
jmp 0x14000349d
cmp eax, 0xb5da99ef
je 0x140004392
cmp eax, 0xbe63e0ed
jne 0x14000349d
mov rcx, rbx
mov rdx, r15
xor r8d, r8d
call fcn.140004620
mov qword [rbp + 0x1f8], rax
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x9027a705
mov ecx, 0x652e8c8d
jmp 0x140003490
cmp eax, 0x22fa70b7
je 0x1400043cd
cmp eax, 0x239a0467
jne 0x14000349d
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf0a531b8
mov ecx, 0x7bfd3469
jmp 0x140003490
cmp eax, 0xa2ef3097
je 0x1400043eb
cmp eax, 0xa5589625
jne 0x14000349d
mov eax, 0xfa7255c3
mov dword [rbp + 0x230], 0
jmp 0x14000349d
cmp eax, 0x657939e5
je 0x140004418
cmp eax, 0x685a736e
jne 0x14000349d
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3a7bb47f
mov ecx, 0x9c98796e
jmp 0x140003490
cmp eax, 0xe6c712c3
je 0x140004429
cmp eax, 0xe79cdc3c
jne 0x14000349d
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x9027a705
mov ecx, 0xbe63e0ed
jmp 0x140003490
cmp eax, 0x12a35a6b
je 0x140004447
cmp eax, 0x12b26e1d
jne 0x14000349d
mov dword [rbp - 0x60], 0x238
mov rcx, qword [rbp + 0x238]
mov rdx, rdi
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
mov eax, 0x6a7e0138
mov ecx, 0xa6e1bef1
cmove eax, ecx
jmp 0x14000349d
cmp eax, 0x9027a705
je 0x140004460
cmp eax, 0x91232ac6
jne 0x14000349d
mov eax, dword [rbp + 0x218]
mov dword [rbp + 0x234], eax
mov eax, r13d
and al, 1
mov byte [rbp + 0x24f], al
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x268ec276
mov ecx, 0xb5da99ef
jmp 0x140003490
cmp eax, 0x5b28ecc1
je 0x14000447e
cmp eax, 0x5f9b2152
jne 0x14000349d
mov rcx, qword [rbp + 0x238]
mov rdx, rdi
call sub.KERNEL32.dll_Process32NextW
mov eax, 0xa2ef3097
jmp 0x14000349d
cmp eax, 0xc3026902
je 0x140004488
cmp eax, 0xc7f3246d
jne 0x14000349d
mov rax, qword [rbp + 0x1f8]
cmp rax, 0xffffffffffffffff
setne byte [rbp + 0x248]
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete cl
mov eax, 0x7f6b42b8
mov esi, 0xbfb8068d
cmove eax, esi
cmp dword [0x14004acc8], 0xa
cmovge eax, r14d
setge dl
xor dl, cl
cmove eax, esi
jmp 0x14000349d
cmp eax, 0x31b25bee
je 0x1400044b8
cmp eax, 0x372b17f8
jne 0x14000349d
mov qword [rbp + 0x200], rdi
mov eax, 0x6bde38ff
jmp 0x14000349d
cmp eax, 0xa9cc1476
je 0x1400044c2
cmp eax, 0xaa90ca98
jne 0x14000349d
cmp qword [rbp + 0x238], 0
setne byte [rbp + 0x249]
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xec7f3e28
mov ecx, 0x657939e5
cmovne eax, ecx
cmp dword [0x14004acc8], 0xa
mov ecx, 0xec7f3e28
cmovl eax, ecx
jmp 0x14000349d
cmp eax, 0x7539ea14
je 0x1400044d2
cmp eax, 0x7642c2f4
jne 0x14000349d
mov eax, 0xbe63e0ed
jmp 0x14000349d
cmp eax, 0xec7f3e28
je 0x140004508
cmp eax, 0xecb5444a
jne 0x14000349d
mov rcx, rbx
mov rdx, r15
xor r8d, r8d
call fcn.140004620
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xeaefdd7e
mov ecx, 0x7642c2f4
jmp 0x140003490
cmp eax, 0xf96ae29
je 0x140004512
cmp eax, 0x11b59242
jne 0x14000349d
mov eax, 0xc3026902
jmp 0x14000349d
cmp eax, 0x899fbbaf
je 0x14000453e
cmp eax, 0x8eccfe9e
jne 0x14000349d
cmp byte [rbp + 0x245], 0
mov eax, 0xfa7255c3
mov ecx, 0xa5589625
cmovne eax, ecx
mov cl, byte [rbp + 0x243]
mov dword [rbp + 0x230], ecx
jmp 0x14000349d
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x40378c35
mov ecx, 0x1377976d
jmp 0x140003490
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x48ab3e9f
mov ecx, 0xb18f3b48
jmp 0x140003490
mov eax, 0xb40e3c5b
jmp 0x14000349d
mov eax, 0x1b3f8022
jmp 0x14000349d
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd4e50bf5
mov ecx, 0x56bf99ab
jmp 0x140003490
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2cfd5ed7
mov ecx, 0xfc5e0c52
jmp 0x140003490
mov rcx, qword [rbp + 0x238]
call r12
mov eax, 0x899fbbaf
mov dword [rbp + 0x21c], 0
mov cl, byte [rbp + 0x24a]
mov byte [rbp + 0x24e], cl
jmp 0x14000349d
mov eax, 0x91232ac6
mov r13b, 1
mov dword [rbp + 0x218], 1
jmp 0x14000349d
mov r15, rdi
mov al, byte [rbp + 0x24b]
and al, 1
mov byte [rbp + 0x244], al
mov qword [rbp + 0x208], rbx
mov rax, qword [rbp + 0x208]
mov r14, rbx
mov rcx, rbx
call fcn.14001b6a0
mov eax, dword [0x14004accc]
mov ecx, dword [0x14004acd0]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
sete byte [rbp + 0x228]
cmp ecx, 0xa
setl cl
setl byte [rbp + 0x220]
or cl, al
mov edi, 0xe87845d8
mov eax, 0x17f35786
cmovne edi, eax
mov r8d, 0x76028410
mov eax, 0xb3ed64ad
cmovne r8d, eax
mov edx, 0x76028410
mov eax, 0x4dcc19d0
cmovne edx, eax
mov r9d, 0xe87845d8
mov eax, 0x8c35f15f
cmovne r9d, eax
mov r10d, 0xde6d8269
mov eax, 0xa03a2d11
cmovne r10d, eax
mov r11d, 0xde6d8269
mov eax, 0xa00812b6
cmovne r11d, eax
mov ecx, 0x1a7f06a8
mov eax, 0x7bcdebf8
cmovne ecx, eax
mov eax, 0x42c865ee
jmp 0x140003eb0
mov eax, 0x4dcc19d0
nop dword [rax + rax]
mov esi, eax
cmp eax, 0x1a7f06a7
jle 0x140003ef0
cmp esi, 0x42c865ed
jg 0x140003f20
cmp esi, 0x26d66037
jg 0x140003f82
cmp esi, 0x1a7f06a8
je 0x140003ffc
mov eax, esi
cmp esi, 0x1fdc140f
jne 0x140003eb0
mov eax, r9d
jmp 0x140003eb0
cmp esi, 0xb3ed64ac
jg 0x140003f50
cmp esi, 0xa03a2d10
jg 0x140003fca
mov eax, edx
cmp esi, 0x8c35f15f
je 0x140003eb0
mov eax, esi
cmp esi, 0xa00812b6
jne 0x140003eb0
mov eax, r10d
jmp 0x140003eb0
cmp esi, 0x7602840f
jg 0x140003fa6
cmp esi, 0x42c865ee
je 0x140004006
mov eax, esi
cmp esi, 0x4dcc19d0
jne 0x140003eb0
mov eax, r8d
jmp 0x140003eb0
cmp esi, 0xe87845d7
jg 0x140003fea
mov eax, edi
cmp esi, 0xb3ed64ad
je 0x140003eb0
mov eax, esi
cmp esi, 0xde6d8269
jne 0x140003eb0
mov eax, 0xa00812b6
jmp 0x140003eb0
mov eax, ecx
cmp esi, 0x26d66038
je 0x140003eb0
mov eax, esi
cmp esi, 0x2a8909b2
jne 0x140003eb0
mov eax, r11d
jmp 0x140003eb0
cmp esi, 0x76028410
je 0x140003ea3
mov eax, esi
cmp esi, 0x7bcdebf8
jne 0x140003eb0
mov eax, 0x2a8909b2
jmp 0x140003eb0
cmp esi, 0xa03a2d11
je 0x14000402f
mov eax, esi
cmp esi, 0xa5714340
jne 0x140003eb0
mov eax, 0x1fdc140f
jmp 0x140003eb0
cmp esi, 0xe87845d8
jne 0x140004039
mov eax, 0x8c35f15f
jmp 0x140003eb0
mov eax, 0x26d66038
jmp 0x140003eb0
movzx ebx, byte [rbp + 0x228]
cmp byte [rbp + 0x220], 0
mov esi, 0x26d66038
mov eax, 0x26d66038
jne 0x140004025
mov eax, 0x1a7f06a8
test bl, bl
cmovne eax, esi
jmp 0x140003eb0
mov eax, 0xa5714340
jmp 0x140003eb0
mov eax, esi
cmp esi, 0x17f35786
jne 0x140003eb0
mov eax, 0x9e5d7f6e
mov rdi, r15
lea r15, str.ccSvcHst
mov rbx, r14
mov r14d, 0x7f6b42b8
nop
cmp eax, 0x20a3231
jle 0x140004090
cmp eax, 0x20a3232
je 0x1400040d1
cmp eax, 0x26b5ed4
je 0x1400040df
cmp eax, 0x527c1790
jne 0x140004060
jmp 0x14000457d
cmp eax, 0x8a31d82e
je 0x14000410c
cmp eax, 0x9e5d7f6e
je 0x14000415f
cmp eax, 0xc398f874
jne 0x140004060
mov eax, dword [0x14004acd4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x26b5ed4
mov ecx, 0x8a31d82e
cmove eax, ecx
cmp dword [0x14004acd8], 0xa
cmovl eax, ecx
jmp 0x140004060
mov rax, qword [rbp + 0x220]
mov eax, 0xc398f874
jmp 0x140004060
mov word [rbp + 0x24c], 0
mov rcx, qword [rbp + 0x228]
lea rdx, [rbp + 0x24c]
call fcn.140019cc0
mov rax, qword [rbp + 0x220]
mov eax, 0x8a31d82e
jmp 0x140004060
mov word [rbp + 0x24c], 0
mov rcx, qword [rbp + 0x228]
lea rdx, [rbp + 0x24c]
call fcn.140019cc0
mov rax, qword [rbp + 0x220]
mov eax, dword [0x14004acd4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x527c1790
mov ecx, 0x26b5ed4
cmovne eax, ecx
cmp dword [0x14004acd8], 0xa
mov ecx, 0x527c1790
cmovl eax, ecx
jmp 0x140004060
mov qword [rbp + 0x228], rbx
mov rax, qword [rbp + 0x228]
mov qword [rax + 0x10], 0
mov rax, qword [rbp + 0x228]
mov qword [rax + 0x18], 7
lea rax, [rbp + 0x24c]
mov qword [rbp + 0x220], rax
mov eax, 0x20a3232
jmp 0x140004060
mov eax, 0xb5da99ef
jmp 0x14000349d
mov rcx, rbx
mov rdx, r15
xor r8d, r8d
call fcn.140004620
mov eax, 0xecb5444a
jmp 0x14000349d
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x40378c35
mov ecx, 0x9a80af13
jmp 0x140003490
cmp byte [rbp + 0x248], 0
mov eax, 0xb31ff57c
mov ecx, 0x65690dbf
cmovne eax, ecx
jmp 0x14000349d
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xebbae390
mov ecx, 0x22a1649f
jmp 0x140003490
mov eax, 0x22fa70b7
jmp 0x14000349d
mov rcx, qword [rbp + 0x238]
call r12
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x878eef8d
mov ecx, 0xc2cb8cb1
jmp 0x140003490
mov eax, 0xf96ae29
jmp 0x14000349d
cmp byte [rbp + 0x246], 0
mov eax, 0xa6e1bef1
mov ecx, 0x6a7e0138
cmovne eax, ecx
mov cl, byte [rbp + 0x24f]
mov byte [rbp + 0x24b], cl
mov cl, byte [rbp + 0x24f]
mov byte [rbp + 0x24a], cl
jmp 0x14000349d
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3a7bb47f
mov ecx, 0x685a736e
jmp 0x140003490
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5b28ecc1
mov ecx, 0xcf95ebcc
jmp 0x140003490
mov eax, 0x685a736e
jmp 0x14000349d
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5b28ecc1
mov ecx, 0x3838e45d
jmp 0x140003490
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf0a531b8
mov ecx, 0x239a0467
jmp 0x140003490
mov eax, 0x91232ac6
mov dword [rbp + 0x218], 0
mov r13b, byte [rbp + 0x244]
jmp 0x14000349d
mov rax, qword [rbp + 0x1f8]
mov eax, 0xc7f3246d
jmp 0x14000349d
mov eax, 0x239a0467
jmp 0x14000349d
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2cfd5ed7
mov ecx, 0x11b59242
jmp 0x140003490
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5f9b2152
mov ecx, 0xa2ef3097
jmp 0x140003490
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xebbae390
mov ecx, 0x9441bbfd
jmp 0x140003490
mov rcx, rbx
call fcn.140004a10
mov rax, qword [rbp + 0x208]
cmp dword [rbp + 0x234], 0
sete byte [rbp + 0x247]
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x268ec276
mov ecx, 0xd3340510
jmp 0x140003490
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2b23d44f
mov ecx, 0xc3026902
jmp 0x140003490
mov rcx, qword [rbp + 0x238]
mov rdx, rdi
call sub.KERNEL32.dll_Process32NextW
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5f9b2152
mov ecx, 0xff217018
jmp 0x140003490
mov rax, qword [rbp + 0x238]
mov eax, 0xaa90ca98
jmp 0x14000349d
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x48ab3e9f
mov ecx, 0x22fa70b7
jmp 0x140003490
cmp byte [rbp + 0x249], 0
mov eax, 0xa5589625
mov ecx, 0x372b17f8
cmovne eax, ecx
jmp 0x14000349d
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xeaefdd7e
mov ecx, 0xecb5444a
jmp 0x140003490
mov eax, 0x3838e45d
jmp 0x14000349d
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5588f2be
mov ecx, 0x2b23d44f
cmovne eax, ecx
cmp dword [0x14004acc8], 0xa
mov ecx, 0x5588f2be
cmovl eax, ecx
jmp 0x14000349d
mov eax, 0xfb35e9be
jmp 0x14000349d
mov eax, dword [rbp + 0x214]
mov eax, 0x3b160fd4
jmp 0x14000349d
mov rcx, qword [rbp + 0x238]
mov rdx, rdi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
setne byte [rbp + 0x246]
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x80afd2b0
mov ecx, 0x3f0afc54
jmp 0x140003490
mov eax, 0x12a35a6b
jmp 0x14000349d
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc7f3246d
cmovne eax, r14d
cmp dword [0x14004acc8], 0xa
mov ecx, 0xc7f3246d
cmovl eax, ecx
jmp 0x14000349d
mov eax, dword [rbp + 0x21c]
mov dword [rbp + 0x214], eax
mov al, byte [rbp + 0x24e]
and al, 1
mov byte [rbp + 0x243], al
mov rax, qword [rbp + 0x200]
mov eax, dword [0x14004acc4]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa9cc1476
mov ecx, 0x3b160fd4
jmp 0x140003490
mov rcx, rbx
lea rdx, [rbp - 0x34]
call fcn.14001b9d0
mov rcx, rbx
lea rdx, str.svchost
xor r8d, r8d
call fcn.140004620
cmp rax, 0xffffffffffffffff
mov eax, 0x65690dbf
mov ecx, 0xe79cdc3c
cmove eax, ecx
jmp 0x14000349d
cmp eax, 0xfa7255c3
jne 0x14000349d
mov eax, dword [rbp + 0x230]
and al, 1
add rsp, 0x2d8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret