Function at 0x140071cc0
Capabilities:
Encode data using xor
Enumerate processes
Hash data using fnv

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x498]
sub rsp, 0x560
movaps xmmword [rax - 0x48], xmm6
movaps xmmword [rax - 0x58], xmm7
movaps xmmword [rax - 0x68], xmm8
movaps xmmword [rax - 0x78], xmm9
xor r13d, r13d
mov r14d, r13d
mov dword [rbp + 0x4a0], r13d
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x140072d2e
mov dword [rbp + 0x2f0], 0x130
lea rdx, [rbp + 0x2f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140072d25
mov esi, 0xc56b
mov r12d, 0x3ac9
movdqa xmm7, xmmword [0x140109010]
movdqa xmm8, xmmword [0x140109000]
movdqa xmm9, xmmword [0x140108ff0]
movdqa xmm6, xmmword [0x140108fe0]
movabs r8, 0xcbf29ce484222325
movabs rdx, 0x100000001b3
movzx ecx, byte [rbp + 0x2f8]
xor rcx, r8
imul rcx, rdx
movzx eax, byte [rbp + 0x2f9]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [rbp + 0x2fa]
xor rcx, rax
imul rcx, rdx
movzx eax, byte [rbp + 0x2fb]
xor rcx, rax
imul rdx, rcx
and rdx, qword [0x1401b74a0]
add rdx, rdx
mov rax, qword [0x1401b7488]
mov rcx, qword [rax + rdx*8 + 8]
mov r8, qword [0x1401b7478]
cmp rcx, r8
je 0x140071df5
mov rdx, qword [rax + rdx*8]
mov eax, dword [rbp + 0x2f8]
cmp eax, dword [rcx + 0x10]
je 0x140071df8
cmp rcx, rdx
je 0x140071df5
mov rcx, qword [rcx + 8]
cmp eax, dword [rcx + 0x10]
jne 0x140071de5
jmp 0x140071df8
mov rcx, r13
mov rax, r8
test rcx, rcx
cmovne rax, rcx
cmp rax, r8
jne 0x140072d0d
lea r8, [rbp + 0x2f8]
lea rdx, [rbp + 0x140]
call fcn.14007b390
mov r8d, dword [rbp + 0x2f8]
xor edx, edx
mov ecx, 0x1000
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140072d0d
mov dword [rbp + 0x4a0], r13d
lea rdx, [rbp + 0x4a0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcessPriorityBoost]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x140072d0d
cmp dword [rbp + 0x4a0], 0
jne 0x140072d0d
mov edx, dword [rbp + 0x2f8]
lea rcx, [rbp + 0x110]
call fcn.1400719f0
nop
cmp qword [rbp + 0x120], 0
je 0x140072d01
mov dword [rsp + 0x38], 0xc55cc56b
mov dword [rsp + 0x3c], 0xc55ec50a
mov dword [rsp + 0x40], 0xc553c553
mov dword [rsp + 0x44], 0xc555c552
mov dword [rsp + 0x48], 0xc524c511
mov dword [rsp + 0x4c], 0xc52ec52d
mov word [rsp + 0x50], r13w
mov byte [rsp + 0x52], 1
movd xmm1, dword [rsp + 0x38]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm1, xmm6
pshufd xmm0, xmm1, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + 0x38], xmm1
movd xmm1, dword [rsp + 0x3c]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm1, xmm9
pshufd xmm0, xmm1, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + 0x3c], xmm1
movd xmm1, dword [rsp + 0x40]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm1, xmm8
pshufd xmm0, xmm1, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + 0x40], xmm1
movd xmm1, dword [rsp + 0x44]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm1, xmm7
pshufd xmm0, xmm1, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + 0x44], xmm1
mov ecx, 8
nop dword [rax + rax]
movzx eax, cx
sub ax, r12w
xor word [rsp + rcx*2 + 0x38], ax
inc rcx
cmp rcx, 0xc
jb 0x140071f70
mov byte [rsp + 0x52], 0
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x38]
lea rcx, [rbp + 0x170]
call fcn.14007b230
or r14d, 0x300000
mov dword [rbp - 0x54], 0xc55cc56b
mov dword [rbp - 0x50], 0xc55ec50a
mov dword [rbp - 0x4c], 0xc553c553
mov dword [rbp - 0x48], 0xc555c552
mov dword [rbp - 0x44], 0xc574c509
mov dword [rbp - 0x40], 0xc526c56f
mov dword [rbp - 0x3c], 0xc528c52f
mov word [rbp - 0x38], r13w
mov byte [rbp - 0x36], 1
movd xmm1, dword [rbp - 0x54]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm1, xmm6
pshufd xmm0, xmm1, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp - 0x54], xmm1
movd xmm2, dword [rbp - 0x50]
xorps xmm0, xmm0
punpcklwd xmm2, xmm0
punpckldq xmm2, xmm0
xorps xmm2, xmm9
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp - 0x50], xmm1
movd xmm2, dword [rbp - 0x4c]
xorps xmm0, xmm0
punpcklwd xmm2, xmm0
punpckldq xmm2, xmm0
xorps xmm2, xmm8
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp - 0x4c], xmm1
movd xmm2, dword [rbp - 0x48]
xorps xmm0, xmm0
punpcklwd xmm2, xmm0
punpckldq xmm2, xmm0
xorps xmm2, xmm7
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp - 0x48], xmm1
mov ecx, 8
movzx eax, cx
sub ax, r12w
xor word [rbp + rcx*2 - 0x54], ax
inc rcx
cmp rcx, 0xe
jb 0x140072070
mov byte [rbp - 0x36], 0
lea r8, [rbp - 0x38]
lea rdx, [rbp - 0x54]
lea rcx, [rbp + 0x190]
call fcn.14007b230
nop
mov dword [rbp - 0x14], 0xc55bc56b
mov dword [rbp - 0x10], 0xc55ec55c
mov dword [rbp - 0xc], 0xc558c508
mov dword [rbp - 8], 0xc556c504
mov dword [rbp - 4], 0xc52fc550
mov dword [rbp], 0xc56cc52a
mov dword [rbp + 4], 0xc528c527
mov dword [rbp + 8], 0xc529
mov byte [rbp + 0xc], 1
movd xmm1, dword [rbp - 0x14]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm1, xmm6
pshufd xmm0, xmm1, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp - 0x14], xmm1
movd xmm2, dword [rbp - 0x10]
xorps xmm0, xmm0
punpcklwd xmm2, xmm0
punpckldq xmm2, xmm0
xorps xmm2, xmm9
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp - 0x10], xmm1
movd xmm2, dword [rbp - 0xc]
xorps xmm0, xmm0
punpcklwd xmm2, xmm0
punpckldq xmm2, xmm0
xorps xmm2, xmm8
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp - 0xc], xmm1
movd xmm2, dword [rbp - 8]
xorps xmm0, xmm0
punpcklwd xmm2, xmm0
punpckldq xmm2, xmm0
xorps xmm2, xmm7
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp - 8], xmm1
mov ecx, 8
nop dword [rax]
movzx eax, cx
sub ax, r12w
xor word [rbp + rcx*2 - 0x14], ax
inc rcx
cmp rcx, 0xf
jb 0x140072170
mov byte [rbp + 0xc], 0
lea r8, [rbp + 0xa]
lea rdx, [rbp - 0x14]
lea rcx, [rbp + 0x1b0]
call fcn.14007b230
nop
mov dword [rbp - 0x34], 0xc554c56b
mov dword [rbp - 0x30], 0xc558c550
mov dword [rbp - 0x2c], 0xc54cc552
mov dword [rbp - 0x28], 0xc513c549
mov dword [rbp - 0x24], 0xc572c50c
mov dword [rbp - 0x20], 0xc526c56f
mov dword [rbp - 0x1c], 0xc528c52f
mov word [rbp - 0x18], r13w
mov byte [rbp - 0x16], 1
movd xmm1, dword [rbp - 0x34]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm1, xmm6
pshufd xmm0, xmm1, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp - 0x34], xmm1
movd xmm2, dword [rbp - 0x30]
xorps xmm0, xmm0
punpcklwd xmm2, xmm0
punpckldq xmm2, xmm0
xorps xmm2, xmm9
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp - 0x30], xmm1
movd xmm2, dword [rbp - 0x2c]
xorps xmm0, xmm0
punpcklwd xmm2, xmm0
punpckldq xmm2, xmm0
xorps xmm2, xmm8
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp - 0x2c], xmm1
movd xmm2, dword [rbp - 0x28]
xorps xmm0, xmm0
punpcklwd xmm2, xmm0
punpckldq xmm2, xmm0
xorps xmm2, xmm7
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp - 0x28], xmm1
mov ecx, 8
nop word [rax + rax]
movzx eax, cx
sub ax, r12w
xor word [rbp + rcx*2 - 0x34], ax
inc rcx
cmp rcx, 0xe
jb 0x140072270
mov byte [rbp - 0x16], 0
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0x34]
lea rcx, [rbp + 0x1d0]
call fcn.14007b230
nop
mov dword [rbp + 0x34], 0xc554c56b
mov dword [rbp + 0x38], 0xc558c550
mov dword [rbp + 0x3c], 0xc555c556
mov dword [rbp + 0x40], 0xc553c556
mov dword [rbp + 0x44], 0xc524c550
mov dword [rbp + 0x48], 0xc570c572
mov dword [rbp + 0x4c], 0xc520c56d
mov dword [rbp + 0x50], 0xc52ac529
mov word [rbp + 0x54], r13w
mov byte [rbp + 0x56], 1
mov edx, 0xc53e
lea r8, [rbp + 0x38]
nop dword [rax + rax]
lea rax, [rdx - 0xc53e]
movq xmm2, rax
punpcklqdq xmm2, xmm2
paddq xmm2, xmm6
movd xmm1, dword [r8 - 4]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8 - 4], xmm1
lea rax, [rdx - 4]
lea rcx, [rdx - 5]
movq xmm0, rax
movq xmm2, rcx
punpcklqdq xmm2, xmm0
movd xmm1, dword [r8]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8], xmm1
lea rax, [rdx - 2]
lea rcx, [rdx - 3]
movq xmm0, rax
movq xmm2, rcx
punpcklqdq xmm2, xmm0
movd xmm1, dword [r8 + 4]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8 + 4], xmm1
lea rax, [rdx - 1]
movq xmm0, rdx
movq xmm2, rax
punpcklqdq xmm2, xmm0
movd xmm1, dword [r8 + 8]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8 + 8], xmm1
add rdx, 8
lea r8, [r8 + 0x10]
lea rax, [rdx - 0xc53e]
cmp rax, 0x10
jb 0x1400722f0
mov byte [rbp + 0x56], 0
lea r8, [rbp + 0x54]
lea rdx, [rbp + 0x34]
lea rcx, [rbp + 0x1f0]
call fcn.14007b230
nop
mov dword [rbp + 0x8c], 0x61
mov dword [rbp + 0x7c], 0x6d005c
mov dword [rbp + 0x80], 0x690061
mov dword [rbp + 0x84], 0x2e006e
mov dword [rbp + 0x88], 0x75006c
mov byte [rbp + 0x90], 0
lea r8, [rbp + 0x8e]
lea rdx, [rbp + 0x7c]
lea rcx, [rbp + 0x210]
call fcn.14007b230
nop
mov dword [rsp + 0x20], 0xc55bc56b
mov dword [rsp + 0x24], 0xc55bc555
mov dword [rsp + 0x28], 0xc54fc548
mov dword [rsp + 0x2c], 0xc552c513
mov dword [rsp + 0x30], 0xc521c54a
mov word [rsp + 0x34], r13w
mov byte [rsp + 0x36], 1
movd xmm1, dword [rsp + 0x20]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm1, xmm6
pshufd xmm0, xmm1, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + 0x20], xmm1
movd xmm2, dword [rsp + 0x24]
xorps xmm0, xmm0
punpcklwd xmm2, xmm0
punpckldq xmm2, xmm0
xorps xmm2, xmm9
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + 0x24], xmm1
movd xmm2, dword [rsp + 0x28]
xorps xmm0, xmm0
punpcklwd xmm2, xmm0
punpckldq xmm2, xmm0
xorps xmm2, xmm8
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + 0x28], xmm1
movd xmm2, dword [rsp + 0x2c]
xorps xmm0, xmm0
punpcklwd xmm2, xmm0
punpckldq xmm2, xmm0
xorps xmm2, xmm7
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + 0x2c], xmm1
mov ecx, 8
nop word [rax + rax]
movzx eax, cx
sub ax, r12w
xor word [rsp + rcx*2 + 0x20], ax
inc rcx
cmp rcx, 0xa
jb 0x140072520
mov byte [rsp + 0x36], 0
lea r8, [rsp + 0x34]
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x230]
call fcn.14007b230
nop
mov dword [rbp + 0xe], 0xc55bc56b
mov dword [rbp + 0x12], 0xc55bc555
mov dword [rbp + 0x16], 0xc54fc548
mov dword [rbp + 0x1a], 0xc54cc54a
mov dword [rbp + 0x1e], 0xc530c55e
mov dword [rbp + 0x22], 0xc527c531
mov dword [rbp + 0x26], 0xc56ac531
mov dword [rbp + 0x2a], 0xc533c529
mov dword [rbp + 0x2e], 0xc526
mov byte [rbp + 0x32], 1
mov rdx, r13
mov r8d, 0xc53e
nop dword [rax]
movq xmm2, rdx
punpcklqdq xmm2, xmm2
paddq xmm2, xmm6
movd xmm1, dword [rbp + rdx*2 + 0xe]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + rdx*2 + 0xe], xmm1
lea rax, [r8 - 4]
lea rcx, [r8 - 5]
movq xmm0, rax
movq xmm2, rcx
punpcklqdq xmm2, xmm0
movd xmm1, dword [rbp + rdx*2 + 0x12]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + rdx*2 + 0x12], xmm1
lea rax, [r8 - 2]
lea rcx, [r8 - 3]
movq xmm0, rax
movq xmm2, rcx
punpcklqdq xmm2, xmm0
movd xmm1, dword [rbp + rdx*2 + 0x16]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + rdx*2 + 0x16], xmm1
lea rax, [r8 - 1]
movq xmm0, r8
movq xmm2, rax
punpcklqdq xmm2, xmm0
movd xmm1, dword [rbp + rdx*2 + 0x1a]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp + rdx*2 + 0x1a], xmm1
add rdx, 8
add r8, 8
cmp r8, 0xc54e
jb 0x1400725a0
cmp rdx, 0x11
jae 0x1400726b5
nop word [rax + rax]
movzx eax, dx
sub ax, r12w
xor word [rbp + rdx*2 + 0xe], ax
inc rdx
cmp rdx, 0x11
jb 0x1400726a0
mov byte [rbp + 0x32], 0
lea r8, [rbp + 0x30]
lea rdx, [rbp + 0xe]
lea rcx, [rbp + 0x250]
call fcn.14007b230
nop
mov dword [rsp + 0x54], 0xc55cc56b
mov dword [rsp + 0x58], 0xc55cc55c
mov dword [rsp + 0x5c], 0xc552c552
mov dword [rsp + 0x60], 0xc54dc558
mov dword [rsp + 0x64], 0xc52cc511
mov dword [rsp + 0x68], 0xc523c534
mov word [rsp + 0x6c], r13w
mov byte [rsp + 0x6e], 1
movd xmm1, dword [rsp + 0x54]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm1, xmm6
pshufd xmm0, xmm1, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + 0x54], xmm1
movd xmm2, dword [rsp + 0x58]
xorps xmm0, xmm0
punpcklwd xmm2, xmm0
punpckldq xmm2, xmm0
xorps xmm2, xmm9
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + 0x58], xmm1
movd xmm2, dword [rsp + 0x5c]
xorps xmm0, xmm0
punpcklwd xmm2, xmm0
punpckldq xmm2, xmm0
xorps xmm2, xmm8
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + 0x5c], xmm1
movd xmm2, dword [rsp + 0x60]
xorps xmm0, xmm0
punpcklwd xmm2, xmm0
punpckldq xmm2, xmm0
xorps xmm2, xmm7
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + 0x60], xmm1
mov ecx, 8
movzx eax, cx
sub ax, r12w
xor word [rsp + rcx*2 + 0x54], ax
inc rcx
cmp rcx, 0xc
jb 0x1400727a0
mov byte [rsp + 0x6e], 0
lea r8, [rsp + 0x6c]
lea rdx, [rsp + 0x54]
lea rcx, [rbp + 0x270]
call fcn.14007b230
nop
mov dword [rbp + 0x58], 0xc57bc56b
mov dword [rbp + 0x5c], 0xc55fc551
mov dword [rbp + 0x60], 0xc548c55a
mov dword [rbp + 0x64], 0xc550c578
mov dword [rbp + 0x68], 0xc529c558
mov dword [rbp + 0x6c], 0xc527c52f
mov dword [rbp + 0x70], 0xc527c56d
mov dword [rbp + 0x74], 0xc52bc52d
mov word [rbp + 0x78], r13w
mov byte [rbp + 0x7a], 1
mov edx, 0xc53e
lea r8, [rbp + 0x5c]
nop dword [rax + rax]
lea rax, [rdx - 0xc53e]
movq xmm2, rax
punpcklqdq xmm2, xmm2
paddq xmm2, xmm6
movd xmm1, dword [r8 - 4]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8 - 4], xmm1
lea rax, [rdx - 4]
lea rcx, [rdx - 5]
movq xmm0, rax
movq xmm2, rcx
punpcklqdq xmm2, xmm0
movd xmm1, dword [r8]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8], xmm1
lea rax, [rdx - 2]
lea rcx, [rdx - 3]
movq xmm0, rax
movq xmm2, rcx
punpcklqdq xmm2, xmm0
movd xmm1, dword [r8 + 4]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8 + 4], xmm1
lea rax, [rdx - 1]
movq xmm0, rdx
movq xmm2, rax
punpcklqdq xmm2, xmm0
movd xmm1, dword [r8 + 8]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm2, xmm1
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [r8 + 8], xmm1
add rdx, 8
lea r8, [r8 + 0x10]
lea rax, [rdx - 0xc53e]
cmp rax, 0x10
jb 0x140072820
mov byte [rbp + 0x7a], 0
lea r8, [rbp + 0x78]
lea rdx, [rbp + 0x58]
lea rcx, [rbp + 0x290]
call fcn.14007b230
nop
mov dword [rsp + 0x70], 0xc554c56b
mov dword [rsp + 0x74], 0xc55bc54c
mov dword [rsp + 0x78], 0xc50fc50e
mov dword [rsp + 0x7c], 0xc508c510
mov dword [rbp - 0x80], 0xc56ec50b
mov dword [rbp - 0x7c], 0xc52ec525
mov dword [rbp - 0x78], 0xc52f
mov byte [rbp - 0x74], 1
movd xmm1, dword [rsp + 0x70]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm1, xmm6
pshufd xmm0, xmm1, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + 0x70], xmm1
movd xmm2, dword [rsp + 0x74]
xorps xmm0, xmm0
punpcklwd xmm2, xmm0
punpckldq xmm2, xmm0
xorps xmm2, xmm9
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + 0x74], xmm1
movd xmm2, dword [rsp + 0x78]
xorps xmm0, xmm0
punpcklwd xmm2, xmm0
punpckldq xmm2, xmm0
xorps xmm2, xmm8
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + 0x78], xmm1
movd xmm2, dword [rsp + 0x7c]
xorps xmm0, xmm0
punpcklwd xmm2, xmm0
punpckldq xmm2, xmm0
xorps xmm2, xmm7
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rsp + 0x7c], xmm1
mov ecx, 8
nop dword [rax]
nop word [rax + rax]
movzx eax, cx
sub ax, r12w
xor word [rsp + rcx*2 + 0x70], ax
inc rcx
cmp rcx, 0xd
jb 0x140072a10
mov byte [rbp - 0x74], 0
lea r8, [rbp - 0x76]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x2b0]
call fcn.14007b230
nop
mov dword [rbp - 0x72], 0xc554c56b
mov dword [rbp - 0x6e], 0xc55bc54c
mov dword [rbp - 0x6a], 0xc50fc50e
mov dword [rbp - 0x66], 0xc50dc510
mov dword [rbp - 0x62], 0xc56ec50d
mov dword [rbp - 0x5e], 0xc52ec525
mov dword [rbp - 0x5a], 0xc52f
mov byte [rbp - 0x56], 1
movd xmm1, dword [rbp - 0x72]
xorps xmm0, xmm0
punpcklwd xmm1, xmm0
punpckldq xmm1, xmm0
xorps xmm1, xmm6
pshufd xmm0, xmm1, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp - 0x72], xmm1
movd xmm2, dword [rbp - 0x6e]
xorps xmm0, xmm0
punpcklwd xmm2, xmm0
punpckldq xmm2, xmm0
xorps xmm2, xmm9
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp - 0x6e], xmm1
movd xmm2, dword [rbp - 0x6a]
xorps xmm0, xmm0
punpcklwd xmm2, xmm0
punpckldq xmm2, xmm0
xorps xmm2, xmm8
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp - 0x6a], xmm1
movd xmm2, dword [rbp - 0x66]
xorps xmm0, xmm0
punpcklwd xmm2, xmm0
punpckldq xmm2, xmm0
xorps xmm2, xmm7
pshufd xmm0, xmm2, 0xd8
pshuflw xmm1, xmm0, 0xd8
movd dword [rbp - 0x66], xmm1
mov ecx, 8
nop dword [rax]
nop word [rax + rax]
movzx eax, cx
sub ax, r12w
xor word [rbp + rcx*2 - 0x72], ax
inc rcx
cmp rcx, 0xd
jb 0x140072b10
mov byte [rbp - 0x56], 0
lea r8, [rbp - 0x58]
lea rdx, [rbp - 0x72]
lea rcx, [rbp + 0x2d0]
call fcn.14007b230
or r14d, 0x3cffffc
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x98], xmm0
mov qword [rbp + 0xa8], r13
mov ecx, 0x180
call fcn.1400daf0c
mov rbx, rax
mov qword [rbp + 0x98], rax
mov qword [rbp + 0xa0], rax
lea rcx, [rax + 0x180]
mov qword [rbp + 0xa8], rcx
lea rax, [rbp + 0x98]
mov qword [rbp + 0x4a8], rax
lea rdi, [rbp + 0x170]
mov qword [rbp + 0xb0], rbx
mov qword [rbp + 0xb8], rbx
lea rax, [rbp + 0x98]
mov qword [rbp + 0xc0], rax
mov rdx, rdi
mov rcx, rbx
call fcn.1400776b0
add rbx, 0x20
mov qword [rbp + 0xb8], rbx
add rdi, 0x20
lea rax, [rbp + 0x2f0]
cmp rdi, rax
jne 0x140072bb0
mov qword [rbp + 0xa0], rbx
lea r9, [fcn.14004a710]
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov r8d, ntohs
lea rcx, [rbp + 0x170]
call fcn.1400daf48
mov rbx, qword [rbp + 0x98]
mov rsi, qword [rbp + 0xa0]
cmp rbx, rsi
je 0x140072cf0
mov r8, rbx
lea rdx, [rbp + 0x110]
lea rcx, [rbp + 0x150]
call fcn.14007b0c0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 7
jbe 0x140072c37
mov rax, qword [rax]
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], r13
mov qword [rbp + 0xe8], r13
mov rdx, rax
lea rcx, [rbp + 0xd0]
call fcn.140067730
or r14d, 3
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x130]
call fcn.14004adf0
movsd xmm0, qword [rax]
movsd qword [rbp + 0x100], xmm0
mov ecx, dword [rax + 8]
mov dword [rbp + 0xf0], ecx
lea rax, [0x1401b5c28]
mov qword [rbp + 0xf8], rax
movaps xmm0, xmmword [rbp + 0xf0]
movdqa xmmword [rbp + 0xb0], xmm0
mov eax, dword [rbp + 0x100]
test eax, eax
je 0x140072cba
cmp eax, 1
setne dil
jmp 0x140072cc5
xor dil, dil
test ecx, ecx
jne 0x140072d63
lea rcx, [rbp + 0xd0]
call fcn.140079350
nop
lea rcx, [rbp + 0x150]
call fcn.140079350
test dil, dil
jne 0x140072d5d
add rbx, 0x20
cmp rbx, rsi
jne 0x140072c12
lea rcx, [rbp + 0x98]
call fcn.1400789f0
mov esi, 0xc56b
lea rcx, [rbp + 0x110]
call fcn.140079350
lea rdx, [rbp + 0x2f0]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140071d68
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r11, [rsp + 0x560]
mov rbx, qword [r11 + 0x50]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140071990
nop
lea r8, [rbp + 0xd0]
lea rdx, [rbp + 0xb0]
call fcn.14004ad40
int3