Function at 0x1400053a0
Capabilities:
Enumerate process modules

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x12e8
call fcn.140030ea0
sub rsp, rax
lea r12, [rsp + 0x2e0]
lea rdi, [rsp + 0x8c]
mov rbx, qword [sym.imp.KERNEL32.dll_lstrcmpiW]
mov eax, 0xa6a6f2c8
mov esi, 0x463f1643
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7e8fd9bb
mov ecx, 0x7be5bf0b
nop word cs:[rax + rax]
nop
cmove eax, ecx
cmp dword [0x14004ad40], 0xa
cmovl eax, ecx
cmp eax, 0x19bca6f
jg 0x140005490
cmp eax, 0xc6f8badd
jle 0x140005500
cmp eax, 0xe62b37f3
jle 0x14000561b
cmp eax, 0xf143af8e
jle 0x140005776
cmp eax, 0xf7e4e39f
jg 0x140005a19
cmp eax, 0xf40f4c52
jg 0x140005e4b
cmp eax, 0xf20be194
jg 0x1400065d6
cmp eax, 0xf143af8f
je 0x140006f92
cmp eax, 0xf1b16b54
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x4f0bcf0b
mov ecx, 0x7d472d1b
jmp 0x140005400
cmp eax, 0x3fc326bd
jle 0x1400055b0
cmp eax, 0x66a918ae
jg 0x14000567b
cmp eax, 0x4f2aecee
jle 0x1400057c4
cmp eax, 0x5cb1ce24
jle 0x140005a63
cmp eax, 0x5f669f0f
jg 0x140005e8a
cmp eax, 0x5df1da3e
jg 0x1400065f6
cmp eax, 0x5cb1ce25
je 0x140006fb0
cmp eax, 0x5dbe63c0
jne 0x14000540d
mov r13d, 2
mov eax, 0x3dbea07e
jmp 0x14000540d
cmp eax, 0xacd46d0a
jg 0x1400056db
cmp eax, 0x9f593d2b
jg 0x140005819
cmp eax, 0x8efc64a4
jle 0x140005aad
cmp eax, 0x98c7ade3
jg 0x140005ed4
cmp eax, 0x963f5f9b
jg 0x140006616
cmp eax, 0x8efc64a5
je 0x140006fd3
cmp eax, 0x925fa673
jne 0x14000540d
mov qword [rsp + 0xa8], r12
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xb0], rdi
mov rax, qword [rsp + 0xb0]
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x48], rax
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xafef5c29
mov ecx, 0x77021793
cmovne eax, ecx
cmp dword [0x14004ad40], 0xa
mov ecx, 0xafef5c29
cmovl eax, ecx
jmp 0x14000540d
cmp eax, 0x235c7e91
jg 0x140005727
cmp eax, 0x139ee879
jg 0x14000586c
cmp eax, 0x6e9cf7f
jle 0x140005af7
cmp eax, 0xc0c4b8b
jg 0x140005f0a
cmp eax, 0xa354c09
jg 0x14000663a
cmp eax, 0x6e9cf80
je 0x140006ff1
cmp eax, 0x7b01b4e
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xbfc3d5c2
mov ecx, 0xeb93cc2b
jmp 0x140005400
cmp eax, 0xd643ac60
jg 0x1400058c1
cmp eax, 0xcd41d113
jle 0x140005b41
cmp eax, 0xcfe38168
jg 0x140005f3d
cmp eax, 0xcf025865
jg 0x14000665a
cmp eax, 0xcd41d114
je 0x14000700f
cmp eax, 0xcddca1a9
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x725a8fff
mov ecx, 0x5af5c055
jmp 0x140005400
cmp eax, 0x763f014b
jg 0x14000591a
cmp eax, 0x725a8ffe
jle 0x140005b77
cmp eax, 0x7538a254
jg 0x140005f8e
cmp eax, 0x72a960db
jg 0x14000668e
cmp eax, 0x725a8fff
je 0x14000702d
cmp eax, 0x7288f1cf
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x371a45bd
mov ecx, 0xf5c7a88c
jmp 0x140005400
cmp eax, 0xb92803a0
jg 0x14000598f
cmp eax, 0xb1bf7017
jle 0x140005bc1
cmp eax, 0xb5fdd26d
jg 0x140005fdf
cmp eax, 0xb3f4f449
jg 0x1400066c2
cmp eax, 0xb1bf7018
je 0x140007037
cmp eax, 0xb3555a09
jne 0x14000540d
mov eax, 0xdf06c56d
jmp 0x14000540d
cmp eax, 0x33f3b9a6
jg 0x1400059d0
cmp eax, 0x2a28d75a
jle 0x140005c0b
cmp eax, 0x2c5005f5
jg 0x14000600a
cmp eax, 0x2b91b23d
jg 0x140006708
cmp eax, 0x2a28d75b
je 0x140007055
cmp eax, 0x2b4eae85
jne 0x14000540d
xor r13d, r13d
mov eax, 0x3dbea07e
jmp 0x14000540d
cmp eax, 0xe9d9a38e
jle 0x140005c55
cmp eax, 0xec9ffd0f
jg 0x140006035
cmp eax, 0xeb4d1765
jg 0x140006745
cmp eax, 0xe9d9a38f
je 0x14000705f
cmp eax, 0xeac539be
jne 0x14000540d
cmp byte [rsp + 0x29], 0
mov eax, 0xcd389412
mov ecx, 0x6e2db5e1
cmovne eax, ecx
jmp 0x14000540d
cmp eax, 0x454de256
jle 0x140005c8b
cmp eax, 0x4be78cbd
jg 0x140006060
cmp eax, 0x4a391353
jg 0x140006779
cmp eax, 0x454de257
je 0x140007071
cmp eax, 0x463f1643
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd7795f86
mov ecx, 0xe7b9c9b7
jmp 0x140005400
cmp eax, 0xa6a6f2c7
jle 0x140005cc1
cmp eax, 0xaa9c5731
jg 0x1400060c8
cmp eax, 0xa83b43fb
jg 0x1400067ad
cmp eax, 0xa6a6f2c8
je 0x1400070a1
cmp eax, 0xa7c563a5
jne 0x14000540d
mov rcx, qword [rsp + 0x68]
lea rdx, str.NULL
call rbx
mov dword [rsp + 0x60], eax
mov eax, 0x75f75157
jmp 0x14000540d
cmp eax, 0x1bd1ea56
jle 0x140005cf7
cmp eax, 0x2043d2b6
jg 0x140006107
cmp eax, 0x1d272c09
jg 0x1400067e1
cmp eax, 0x1bd1ea57
je 0x1400070ab
cmp eax, 0x1c37865c
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2bfe4183
mov ecx, 0xf9c18993
jmp 0x140005400
cmp eax, 0xdf06c56c
jle 0x140005d2d
cmp eax, 0xe38b615a
jg 0x140006132
cmp eax, 0xe203264b
jg 0x140006801
cmp eax, 0xdf06c56d
je 0x1400070c9
cmp eax, 0xe1146a5c
jne 0x14000540d
mov eax, dword [rsp + 0x44]
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7538a255
mov ecx, 0x4f34306c
jmp 0x140005400
cmp eax, 0x7b73abfc
jle 0x140005d63
cmp eax, 0x7e79430c
jg 0x14000615d
cmp eax, 0x7be5bf0a
jg 0x140006821
cmp eax, 0x7b73abfd
je 0x1400070e7
cmp eax, 0x7b87cadd
jne 0x14000540d
mov rcx, qword [rsp + 0x48]
mov r8d, 0x208
xor edx, edx
call fcn.140032ca0
mov rax, qword [rsp + 0x48]
movabs rcx, 0x4c004c0055004e
mov qword [rax], rcx
mov rcx, r12
mov edx, 0x1000
mov r8, rdi
call sub.KERNEL32.dll_K32EnumProcesses
mov eax, 0x29696c89
jmp 0x14000540d
cmp eax, 0xc0307670
jle 0x140005dc3
cmp eax, 0xc177cc9c
jg 0x140006188
cmp eax, 0xc0f9fdb1
jg 0x140006855
cmp eax, 0xc0307671
je 0x140007126
cmp eax, 0xc074ccbf
jne 0x14000540d
mov eax, 0x9c6c225f
jmp 0x14000540d
cmp eax, 0x371a45bc
jle 0x140005dfc
cmp eax, 0x3c8f5b5f
jg 0x1400061c7
cmp eax, 0x39810c1c
jg 0x140006893
cmp eax, 0x371a45bd
je 0x140007145
cmp eax, 0x397444e3
jne 0x14000540d
mov rax, qword [rsp + 0xc0]
mov eax, 0x77b02c1e
jmp 0x14000540d
cmp eax, 0xfdec8492
jg 0x1400061fa
cmp eax, 0xfc7f2420
jg 0x1400068c0
cmp eax, 0xf7e4e3a0
je 0x14000714f
cmp eax, 0xf9c18993
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xbb84cfca
mov ecx, 0x36fcd54d
jmp 0x140005400
cmp eax, 0x55aa77c9
jle 0x14000623d
cmp eax, 0x5acf2842
jg 0x1400068f4
cmp eax, 0x55aa77ca
je 0x140007159
cmp eax, 0x57ede43b
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x17b34d9e
mov ecx, 0xb1bf7018
jmp 0x140005400
cmp eax, 0x89315c9e
jle 0x14000627c
cmp eax, 0x89ba02ba
jg 0x140006928
cmp eax, 0x89315c9f
je 0x140007171
cmp eax, 0x89840019
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x4f0bcf0b
mov ecx, 0x5acf2843
jmp 0x140005400
cmp eax, 0x2d884d3
jle 0x1400062ca
cmp eax, 0x49a2405
jg 0x140006955
cmp eax, 0x2d884d4
je 0x140007186
cmp eax, 0x31aa87c
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2043d2b7
mov ecx, 0x34017708
jmp 0x140005400
cmp eax, 0xc97ba809
jle 0x1400062f5
cmp eax, 0xcbb00f2e
jg 0x140006989
cmp eax, 0xc97ba80a
je 0x1400071b6
cmp eax, 0xcb23d4c6
jne 0x14000540d
mov eax, 0x7e79430d
jmp 0x14000540d
cmp eax, 0x6be1fcac
jle 0x140006334
cmp eax, 0x6e42f0be
jg 0x1400069bd
cmp eax, 0x6be1fcad
je 0x1400071d4
cmp eax, 0x6e2db5e1
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe8f0f882
mov ecx, 0x19bca70
jmp 0x140005400
cmp eax, 0xafef5c28
jle 0x140006364
cmp eax, 0xb18c115e
jg 0x1400069f1
cmp eax, 0xafef5c29
je 0x14000720c
cmp eax, 0xb16f95a3
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3d72f088
mov ecx, 0xdb35df87
jmp 0x140005400
cmp eax, 0x271b2554
jle 0x1400063ae
cmp eax, 0x29696c88
jg 0x140006a2f
cmp eax, 0x271b2555
je 0x140007216
cmp eax, 0x28b56ca8
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb3555a09
mov ecx, 0xdf06c56d
jmp 0x140005400
cmp eax, 0xe89b393b
jle 0x14000641c
cmp eax, 0xe9af43a8
jg 0x140006a70
cmp eax, 0xe89b393c
je 0x140007233
cmp eax, 0xe8f0f882
jne 0x14000540d
mov eax, 0x19bca70
jmp 0x14000540d
cmp eax, 0x411d7020
jle 0x14000646f
cmp eax, 0x44e0fc4c
jg 0x140006aa4
cmp eax, 0x411d7021
je 0x140007251
cmp eax, 0x43d81134
jne 0x14000540d
mov eax, 0x7a9ea1e6
jmp 0x14000540d
cmp eax, 0xa29898cf
jle 0x14000649a
cmp eax, 0xa3b64d38
jg 0x140006ad1
cmp eax, 0xa29898d0
je 0x14000726f
cmp eax, 0xa37e60e0
jne 0x14000540d
mov eax, 0x4d33cfee
jmp 0x14000540d
cmp eax, 0x17884d83
jle 0x1400064d9
cmp eax, 0x17e669c9
jg 0x140006b05
cmp eax, 0x17884d84
je 0x140007279
cmp eax, 0x17b34d9e
jne 0x14000540d
mov eax, 0xb1bf7018
jmp 0x14000540d
cmp eax, 0xdb35df86
jle 0x140006504
cmp eax, 0xdc4fc083
jg 0x140006b25
cmp eax, 0xdb35df87
je 0x140007297
cmp eax, 0xdbcd9c4e
jne 0x14000540d
mov eax, 0x345570d4
jmp 0x14000540d
cmp eax, 0x77b02c1d
jle 0x140006541
cmp eax, 0x7a74b6da
jg 0x140006b45
cmp eax, 0x77b02c1e
je 0x1400053dc
cmp eax, 0x79933875
jne 0x14000540d
mov rcx, qword [rsp + 0x30]
lea rdx, [rsp + 0xa0]
mov r8d, 8
lea r9, [rsp + 0x88]
call sub.KERNEL32.dll_K32EnumProcessModules
test eax, eax
mov eax, 0xe62b37f4
mov ecx, 0x2d884d4
cmove eax, ecx
jmp 0x14000540d
cmp eax, 0xbb84cfc9
jle 0x14000656c
cmp eax, 0xbf814302
jg 0x140006b92
cmp eax, 0xbb84cfca
je 0x1400072c7
cmp eax, 0xbbaeb1b8
jne 0x14000540d
xor r15d, r15d
mov eax, 0xc6f8bade
jmp 0x14000540d
cmp eax, 0x3545ee88
jle 0x140006597
cmp eax, 0x3630a95e
jg 0x140006bc6
cmp eax, 0x3545ee89
je 0x1400072ee
cmp eax, 0x35a65d23
jne 0x14000540d
mov dword [rsp + 0x2c], r14d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xcb1b34b
mov ecx, 0xffa15972
jmp 0x140005400
cmp eax, 0xf6024044
jg 0x140006c17
cmp eax, 0xf40f4c53
je 0x14000730c
cmp eax, 0xf5c7a88c
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x371a45bd
mov ecx, 0x2b4eae85
jmp 0x140005400
cmp eax, 0x6534450a
jg 0x140006c7c
cmp eax, 0x5f669f10
je 0x140007316
cmp eax, 0x648152bd
jne 0x14000540d
cmp qword [rsp + 0x30], 0
setne byte [rsp + 0x26]
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x31aa87c
mov ecx, 0xa564ba8a
jmp 0x140005400
cmp eax, 0x9c6c225e
jg 0x140006cb0
cmp eax, 0x98c7ade4
je 0x140007328
cmp eax, 0x98ef5b0b
jne 0x14000540d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xadd75b96
jmp 0x14000540d
cmp eax, 0x1028ce5f
jg 0x140006cee
cmp eax, 0xc0c4b8c
je 0x140007335
cmp eax, 0xcb1b34b
jne 0x14000540d
mov eax, dword [rsp + 0x3c]
mov eax, dword [rsp + 0x2c]
mov eax, 0xffa15972
jmp 0x14000540d
cmp eax, 0xd4ddbea3
jg 0x140006d22
cmp eax, 0xcfe38169
je 0x14000733f
cmp eax, 0xd13b1b4c
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xdca0078f
mov ecx, 0x6afaae0c
cmovne eax, ecx
cmp dword [0x14004ad40], 0xa
mov ecx, 0xdca0078f
cmovl eax, ecx
jmp 0x14000540d
cmp eax, 0x75f75156
jg 0x140006d42
cmp eax, 0x7538a255
je 0x14000735d
cmp eax, 0x757dbe90
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7442dae1
mov ecx, 0xe38b615b
cmovne eax, ecx
cmp dword [0x14004ad40], 0xa
mov ecx, 0x7442dae1
cmovl eax, ecx
jmp 0x14000540d
cmp eax, 0xb687fc7a
jg 0x140006d76
cmp eax, 0xb5fdd26e
je 0x14000737b
cmp eax, 0xb65c5552
jne 0x14000540d
mov eax, 0x24c54f27
jmp 0x14000540d
cmp eax, 0x3265d6b3
jg 0x140006daa
cmp eax, 0x2c5005f6
je 0x140007385
cmp eax, 0x3183935a
jne 0x14000540d
mov eax, 0xf6024045
jmp 0x14000540d
cmp eax, 0xef24677a
jg 0x140006dde
cmp eax, 0xec9ffd10
je 0x1400073a3
cmp eax, 0xeefebd5e
jne 0x14000540d
mov eax, 0xaa43e4ae
jmp 0x14000540d
cmp eax, 0x4d33cfed
jg 0x140006dfe
cmp eax, 0x4be78cbe
je 0x1400073b1
cmp eax, 0x4cae304c
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x14004ad40], 0xa
setl cl
mov edx, ecx
and dl, al
xor cl, al
mov eax, edx
xor al, cl
mov ebp, 0x528cedc6
mov r8d, 0xac1848cd
cmovne ebp, r8d
test cl, cl
mov eax, ebp
cmovne eax, r8d
test dl, dl
cmove eax, ebp
jmp 0x14000540d
cmp eax, 0xac1848cc
jg 0x140006e1e
cmp eax, 0xaa9c5732
je 0x1400073bb
cmp eax, 0xab602370
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x51132cb8
mov ecx, 0xf20ee838
jmp 0x140005400
cmp eax, 0x20beb6cb
jg 0x140006e3e
cmp eax, 0x2043d2b7
je 0x1400073c5
cmp eax, 0x2060edde
jne 0x14000540d
mov eax, 0x1bd1ea57
jmp 0x14000540d
cmp eax, 0xe58ea82b
jg 0x140006e66
cmp eax, 0xe38b615b
je 0x1400073d4
cmp eax, 0xe47d3f10
jne 0x14000540d
mov eax, 0x2d884d4
jmp 0x14000540d
cmp eax, 0x7efcaa04
jg 0x140006e9a
cmp eax, 0x7e79430d
je 0x1400073de
cmp eax, 0x7e8fd9bb
jne 0x14000540d
mov eax, 0x7be5bf0b
jmp 0x14000540d
cmp eax, 0xc5699d7b
jg 0x140006ece
cmp eax, 0xc177cc9d
je 0x1400073fc
cmp eax, 0xc2e17d80
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xcd41d114
mov ecx, 0x9c6c225f
jmp 0x140005400
cmp eax, 0x3d72f087
jg 0x140006f00
cmp eax, 0x3c8f5b60
je 0x140007406
cmp eax, 0x3d404438
jne 0x14000540d
mov dword [rsp + 0x5c], 0
mov eax, 0x26f4d069
jmp 0x14000540d
cmp eax, 0xfeefbb84
jg 0x140006f49
cmp eax, 0xfdec8493
je 0x140007410
cmp eax, 0xfe6724a3
jne 0x14000540d
mov eax, dword [rsp + 0x44]
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x96e7d4d0
mov ecx, 0x44e0fc4d
jmp 0x140005400
cmp eax, 0x51132cb7
jle 0x140006f7d
cmp eax, 0x51132cb8
je 0x14000741a
cmp eax, 0x528cedc6
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe9af43a9
mov ecx, 0x9fb8d5e5
jmp 0x140005400
cmp eax, 0x80350179
je 0x140007424
cmp eax, 0x84d927b8
je 0x14000742e
cmp eax, 0x874411b3
jne 0x14000540d
mov eax, dword [rsp + 0x3c]
mov ecx, dword [rsp + 0x2c]
cmp ecx, eax
setb byte [rsp + 0x25]
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe9d9a38f
mov ecx, 0x17e669ca
jmp 0x140005400
cmp eax, 0x19bca70
je 0x140007445
cmp eax, 0x26c262c
je 0x140007463
cmp eax, 0x2c63a8b
jne 0x14000540d
mov eax, 0x3265d6b4
jmp 0x14000540d
cmp eax, 0xc6f8bade
je 0x140007481
cmp eax, 0xc7685ccc
je 0x140007496
cmp eax, 0xc7cf0d3e
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xbf814303
mov ecx, 0x84d927b8
jmp 0x140005400
cmp eax, 0x66a918af
je 0x1400074a0
cmp eax, 0x68048207
je 0x1400074d0
cmp eax, 0x6afaae0c
jne 0x14000540d
mov rax, qword [rsp + 0x70]
mov eax, 0x463f1643
jmp 0x14000540d
cmp eax, 0xacd46d0b
je 0x1400074da
cmp eax, 0xad248110
je 0x1400074f8
cmp eax, 0xadd75b96
jne 0x14000540d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x98ef5b0b
mov ecx, 0x4b7801b4
jmp 0x140005400
cmp eax, 0x235c7e92
je 0x140007528
cmp eax, 0x24c54f27
je 0x140007532
cmp eax, 0x26f4d069
jne 0x14000540d
mov eax, dword [rsp + 0x5c]
mov dword [rsp + 0x44], eax
mov rax, qword [rsp + 0x48]
mov rax, qword [rsp + 0xb0]
mov rax, qword [rsp + 0xa8]
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe1146a5c
mov ecx, 0x7538a255
cmovne eax, ecx
cmp dword [0x14004ad40], 0xa
mov ecx, 0xe1146a5c
cmovl eax, ecx
jmp 0x14000540d
cmp eax, 0xe62b37f4
je 0x140007550
cmp eax, 0xe7395a1f
je 0x140007567
cmp eax, 0xe7b9c9b7
jne 0x14000540d
mov rax, qword [rsp + 0x70]
lea rax, [rsp + rax*4]
add rax, 0x2e0
mov qword [rsp + 0x50], rax
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd7795f86
mov ecx, 0xd13b1b4c
jmp 0x140005400
cmp eax, 0x3fc326be
je 0x14000759c
cmp eax, 0x40799821
je 0x1400075b6
cmp eax, 0x408cabf4
jne 0x14000540d
mov eax, 0xb92803a1
jmp 0x14000540d
cmp eax, 0x9f593d2c
je 0x1400075cd
cmp eax, 0x9fb8d5e5
je 0x1400075fd
cmp eax, 0xa263554f
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa37e60e0
mov ecx, 0x4d33cfee
jmp 0x140005400
cmp eax, 0x139ee87a
je 0x14000761b
cmp eax, 0x155c12d4
je 0x140007625
cmp eax, 0x176fcce5
jne 0x14000540d
mov eax, 0xc97ba80a
jmp 0x14000540d
cmp eax, 0xd643ac61
je 0x140007643
cmp eax, 0xd7795f86
je 0x14000764d
cmp eax, 0xdafed408
jne 0x14000540d
mov r8d, dword [rsp + 0x40]
mov ecx, 0x478
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov eax, 0xe7395a1f
jmp 0x14000540d
cmp eax, 0x763f014c
je 0x14000765c
cmp eax, 0x768e31f2
je 0x1400076a2
cmp eax, 0x77021793
jne 0x14000540d
mov eax, 0x925fa673
jmp 0x14000540d
cmp eax, 0xb92803a1
je 0x1400076ca
cmp eax, 0xbb364d3b
je 0x1400076e8
cmp eax, 0xbb4b441b
jne 0x14000540d
mov eax, 0xe89b393c
jmp 0x14000540d
cmp eax, 0x33f3b9a7
je 0x1400076f6
cmp eax, 0x34017708
je 0x140007726
cmp eax, 0x345570d4
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xdbcd9c4e
mov ecx, 0xf1b16b54
jmp 0x140005400
cmp eax, 0xf20be195
je 0x140007749
cmp eax, 0xf20ee838
jne 0x14000540d
mov eax, 0x5f669f10
jmp 0x14000540d
cmp eax, 0x5df1da3f
je 0x140007757
cmp eax, 0x5e2ea87b
jne 0x14000540d
mov eax, 0x3545ee89
jmp 0x14000540d
cmp eax, 0x963f5f9c
je 0x14000776c
cmp eax, 0x96e7d4d0
jne 0x14000540d
mov eax, dword [rsp + 0x44]
mov eax, 0xfe6724a3
jmp 0x14000540d
cmp eax, 0xa354c0a
je 0x140007776
cmp eax, 0xbddcf61
jne 0x14000540d
mov eax, 0xb5ab19cd
jmp 0x14000540d
cmp eax, 0xcf025866
je 0x140007780
cmp eax, 0xcfd8151e
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc7685ccc
mov ecx, 0x68048207
jmp 0x140005400
cmp eax, 0x72a960dc
je 0x14000779e
cmp eax, 0x7442dae1
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3183935a
mov ecx, 0x6534450b
jmp 0x140005400
cmp eax, 0xb3f4f44a
je 0x1400077b7
cmp eax, 0xb5ab19cd
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf40f4c53
mov ecx, 0xbddcf61
cmovne eax, ecx
cmp dword [0x14004ad40], 0xa
mov ecx, 0xf40f4c53
cmovl eax, ecx
jmp 0x14000540d
cmp eax, 0x2b91b23e
je 0x1400077d5
cmp eax, 0x2bfe4183
jne 0x14000540d
mov rcx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov r9d, 0x104
call sub.KERNEL32.dll_K32GetModuleBaseNameW
mov eax, 0xf9c18993
jmp 0x14000540d
cmp eax, 0xeb4d1766
je 0x1400077f3
cmp eax, 0xeb93cc2b
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc177cc9d
mov ecx, 0x7f1eadc0
jmp 0x140005400
cmp eax, 0x4a391354
je 0x140007811
cmp eax, 0x4b7801b4
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x89315c9f
mov ecx, 0x89840019
jmp 0x140005400
cmp eax, 0xa83b43fc
je 0x140007828
cmp eax, 0xaa43e4ae
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xeefebd5e
mov ecx, 0xe203264c
jmp 0x140005400
cmp eax, 0x1d272c0a
je 0x14000783f
cmp eax, 0x1e575049
jne 0x14000540d
mov eax, 0x397444e3
jmp 0x14000540d
cmp eax, 0xe203264c
je 0x14000786f
cmp eax, 0xe2547e0e
jne 0x14000540d
mov eax, 0x2b91b23e
jmp 0x14000540d
cmp eax, 0x7be5bf0b
je 0x140007879
cmp eax, 0x7d472d1b
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xcb23d4c6
mov ecx, 0x7e79430d
jmp 0x140005400
cmp eax, 0xc0f9fdb2
je 0x140007897
cmp eax, 0xc0fd5505
jne 0x14000540d
cmp dword [rsp + 0x60], 0
setne byte [rsp + 0x27]
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xbb364d3b
mov ecx, 0x235c7e92
jmp 0x140005400
cmp eax, 0x39810c1d
je 0x1400078b5
cmp eax, 0x3c2417cb
jne 0x14000540d
cmp dword [rsp + 0x40], 0
mov eax, 0x49a2406
mov ecx, 0x55aa77ca
cmove eax, ecx
jmp 0x14000540d
cmp eax, 0xfc7f2421
je 0x1400078cf
cmp eax, 0xfd2bb7b5
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x98ef5b0b
mov ecx, 0xadd75b96
jmp 0x140005400
cmp eax, 0x5acf2843
je 0x1400078e6
cmp eax, 0x5af5c055
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3183935a
mov ecx, 0xf6024045
jmp 0x140005400
cmp eax, 0x89ba02bb
je 0x140007904
cmp eax, 0x8a6d9a56
jne 0x14000540d
cmp byte [rsp + 0x2a], 0
mov eax, 0xcd389412
mov ecx, 0xa263554f
cmovne eax, ecx
jmp 0x14000540d
cmp eax, 0x49a2406
je 0x140007922
cmp eax, 0x56ecdfb
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xef24677b
mov ecx, 0x20beb6cc
jmp 0x140005400
cmp eax, 0xcbb00f2f
je 0x140007940
cmp eax, 0xcd389412
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xcbb00f2f
mov ecx, 0x6e9cf80
jmp 0x140005400
cmp eax, 0x6e42f0bf
je 0x14000794a
cmp eax, 0x6f35bb5f
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf20be195
mov ecx, 0xc5699d7c
jmp 0x140005400
cmp eax, 0xb18c115f
je 0x140007954
cmp eax, 0xb1aed8d0
jne 0x14000540d
cmp dword [rsp + 0x38], 0
sete byte [rsp + 0x2b]
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe598a201
mov ecx, 0xc67059b6
jmp 0x140005400
cmp eax, 0x29696c89
je 0x14000795e
cmp eax, 0x296ebcd6
jne 0x14000540d
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x68], rax
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa354c0a
mov ecx, 0xfdec8493
jmp 0x140005400
cmp eax, 0xe9af43a9
je 0x1400079b7
cmp eax, 0xe9b4f793
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xaa9c5732
mov ecx, 0x66a918af
jmp 0x140005400
cmp eax, 0x44e0fc4d
je 0x1400079c1
cmp eax, 0x450001db
jne 0x14000540d
cmp byte [rsp + 0x28], 0
mov eax, 0xcd389412
mov ecx, 0xc0307671
cmovne eax, ecx
jmp 0x14000540d
cmp eax, 0xa3b64d39
je 0x1400079cb
cmp eax, 0xa564ba8a
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc7685ccc
mov ecx, 0xcfd8151e
jmp 0x140005400
cmp eax, 0x17e669ca
je 0x1400079e9
cmp eax, 0x1aa8b438
jne 0x14000540d
mov eax, 0x6be1fcad
jmp 0x14000540d
cmp eax, 0xdc4fc084
je 0x140007a07
cmp eax, 0xdca0078f
jne 0x14000540d
mov eax, 0x5df1da3f
jmp 0x14000540d
cmp eax, 0x7a74b6db
je 0x140007a25
cmp eax, 0x7a9ea1e6
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
and cl, 1
cmp dword [0x14004ad40], 0xa
setl dl
mov eax, 0x43d81134
mov ebp, 0xc0f9fdb2
cmovl eax, ebp
xor dl, cl
test cl, cl
mov ecx, 0x43d81134
cmovne eax, ecx
jmp 0x14000711c
cmp eax, 0xbf814303
je 0x140007a43
cmp eax, 0xbfc3d5c2
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xbddcf61
mov ecx, 0xb5ab19cd
jmp 0x140005400
cmp eax, 0x3630a95f
je 0x140007a4d
cmp eax, 0x36fcd54d
jne 0x14000540d
mov rcx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov r9d, 0x104
call sub.KERNEL32.dll_K32GetModuleBaseNameW
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xbb84cfca
mov ecx, 0x7efcaa05
jmp 0x140005400
cmp eax, 0xf6024045
je 0x140007a57
cmp eax, 0xf662ea28
jne 0x14000540d
mov eax, dword [rsp + 0x38]
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x14004ad40], 0xa
setl cl
mov edx, ecx
and dl, al
xor cl, al
mov eax, edx
xor al, cl
test cl, cl
mov ecx, 0xec9ffd10
mov ebp, 0xf143af8f
cmovne ecx, ebp
test dl, dl
mov edx, 0xec9ffd10
cmove ecx, edx
test al, al
cmovne ecx, ebp
mov eax, ecx
jmp 0x14000540d
cmp eax, 0x6534450b
je 0x140007a75
cmp eax, 0x66093d88
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2060edde
mov ecx, 0x1bd1ea57
jmp 0x140005400
cmp eax, 0x9c6c225f
je 0x140007a93
cmp eax, 0x9e98a5f7
jne 0x14000540d
mov rax, qword [rsp + 0x50]
call fcn.140004e50
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd4ddbea4
mov ecx, 0xd5f3699d
jmp 0x140005400
cmp eax, 0x1028ce60
je 0x140007ab1
cmp eax, 0x1069396f
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5e2ea87b
mov ecx, 0x3545ee89
jmp 0x140005400
cmp eax, 0xd4ddbea4
je 0x140007acf
cmp eax, 0xd5f3699d
jne 0x14000540d
mov eax, 0x768e31f2
jmp 0x14000540d
cmp eax, 0x75f75157
je 0x140007ae3
cmp eax, 0x76276796
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa29898d0
mov ecx, 0xeb4d1766
jmp 0x140005400
cmp eax, 0xb687fc7b
je 0x140007b17
cmp eax, 0xb6cdf67c
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x963f5f9c
mov ecx, 0x1c37865c
jmp 0x140005400
cmp eax, 0x3265d6b4
je 0x140007b35
cmp eax, 0x326b7169
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x43d81134
mov ecx, 0x7a9ea1e6
jmp 0x140005400
cmp eax, 0xef24677b
je 0x140007b57
cmp eax, 0xf00a3a0f
jne 0x14000540d
mov eax, 0x26c262c
jmp 0x14000540d
cmp eax, 0x4d33cfee
je 0x140007b65
cmp eax, 0x4f0bcf0b
jne 0x14000540d
mov eax, 0x5acf2843
jmp 0x14000540d
cmp eax, 0xac1848cd
je 0x140007b83
cmp eax, 0xacb144b8
jne 0x14000540d
mov eax, 0x79933875
jmp 0x14000540d
cmp eax, 0x20beb6cc
je 0x140007ba1
cmp eax, 0x22ddc858
jne 0x14000540d
mov eax, 0x26f4d069
mov dword [rsp + 0x5c], 1
jmp 0x14000540d
cmp eax, 0xe58ea82c
je 0x140007bc8
cmp eax, 0xe598a201
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xec9ffd10
mov ecx, 0xf662ea28
jmp 0x140005400
cmp eax, 0x7efcaa05
je 0x140007bd2
cmp eax, 0x7f1eadc0
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc177cc9d
mov ecx, 0xacd46d0b
jmp 0x140005400
cmp eax, 0xc5699d7c
je 0x140007bf0
cmp eax, 0xc67059b6
jne 0x14000540d
cmp byte [rsp + 0x2b], 0
mov eax, 0xc6f8bade
mov ecx, 0xbbaeb1b8
cmovne eax, ecx
mov r15d, dword [rsp + 0x38]
jmp 0x14000540d
cmp eax, 0x3d72f088
je 0x140007c18
cmp eax, 0x3dbea07e
jne 0x14000540d
mov dword [rsp + 0x38], r13d
mov rax, qword [rsp + 0xc0]
mov rax, qword [rsp + 0xb8]
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe598a201
mov ecx, 0xb1aed8d0
jmp 0x140005400
cmp eax, 0xfeefbb85
je 0x140007c30
cmp eax, 0xffa15972
jne 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe9d9a38f
mov ecx, 0x874411b3
jmp 0x140005400
cmp eax, 0x4f2aecef
jne 0x140007c4e
mov eax, 0xcf025866
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xeefebd5e
mov ecx, 0xaa43e4ae
jmp 0x140005400
mov rax, qword [rsp + 0x48]
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7b87cadd
mov ecx, 0x29696c89
jmp 0x140005400
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x89315c9f
mov ecx, 0xfd2bb7b5
jmp 0x140005400
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xcbb00f2f
mov ecx, 0x7b01b4e
jmp 0x140005400
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x4be78cbe
mov ecx, 0x1d272c0a
jmp 0x140005400
mov eax, 0xcddca1a9
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x17b34d9e
mov ecx, 0x4cae304c
jmp 0x140005400
mov eax, 0x9f593d2c
jmp 0x14000540d
mov eax, dword [rsp + 0x3c]
mov eax, dword [rsp + 0x2c]
mov eax, 0x874411b3
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x411d7021
mov ecx, 0x3c8f5b60
cmovne eax, ecx
cmp dword [0x14004ad40], 0xa
mov ecx, 0x411d7021
cmovl eax, ecx
jmp 0x14000540d
mov eax, 0xfeefbb85
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2060edde
mov ecx, 0x56ecdfb
jmp 0x140005400
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb3555a09
mov ecx, 0xa3b64d39
jmp 0x140005400
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x14004ad40], 0xa
setl cl
mov edx, ecx
and dl, al
xor cl, al
mov eax, edx
xor al, cl
mov ebp, 0x6afaae0c
cmovne ebp, esi
test cl, cl
mov eax, ebp
cmovne eax, esi
test dl, dl
cmove eax, ebp
jmp 0x14000540d
mov rcx, qword [rsp + 0x68]
lea rdx, str.RuntimeBroker.exe
call rbx
mov dword [rsp + 0x90], eax
mov eax, 0x40799821
jmp 0x14000540d
mov eax, 0xf5c7a88c
jmp 0x14000540d
mov eax, 0xc2e17d80
jmp 0x14000540d
mov eax, dword [rsp + 0x2c]
add eax, 1
mov dword [rsp + 0x9c], eax
mov eax, 0xdc4fc084
jmp 0x14000540d
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 0xfd2bb7b5
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x296ebcd6
mov ecx, 0xa354c0a
cmovne eax, ecx
cmp dword [0x14004ad40], 0xa
mov ecx, 0x296ebcd6
cmovl eax, ecx
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x176fcce5
mov ecx, 0x1aa8b438
jmp 0x140005400
mov rax, qword [rsp + 0x50]
mov eax, dword [rax]
mov dword [rsp + 0x94], eax
call fcn.140004e50
mov dword [rsp + 0x98], eax
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7a74b6db
mov ecx, 0x3630a95f
jmp 0x140005400
mov eax, 0x5cb1ce25
jmp 0x14000540d
mov eax, dword [rsp + 0x94]
cmp eax, dword [rsp + 0x98]
setne byte [rsp + 0x2a]
mov eax, 0x89ba02bb
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xbb4b441b
mov ecx, 0x22ddc858
jmp 0x140005400
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3c8f5b60
mov ecx, 0xc7cf0d3e
jmp 0x140005400
mov eax, 0x76276796
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x963f5f9c
mov ecx, 0xb6cdf67c
jmp 0x140005400
mov rcx, qword [rsp + 0x68]
lea rdx, str.svchost.exe
call rbx
mov dword [rsp + 0x64], eax
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x3d72f088
mov ecx, 0xe58ea82c
jmp 0x140005400
mov rcx, qword [rsp + 0x30]
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x80]
mov r9d, 0x104
call sub.KERNEL32.dll_K32GetModuleBaseNameW
mov eax, 0x36fcd54d
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x5e2ea87b
mov ecx, 0x3d404438
jmp 0x140005400
mov eax, 0xeb93cc2b
jmp 0x14000540d
mov r14d, dword [rsp + 0x9c]
mov eax, 0x35a65d23
jmp 0x14000540d
mov eax, 0x35a65d23
xor r14d, r14d
jmp 0x14000540d
mov eax, 0x98c7ade4
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xd4ddbea4
mov ecx, 0x9e98a5f7
jmp 0x140005400
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x96e7d4d0
mov ecx, 0xfe6724a3
jmp 0x140005400
mov eax, 0xf00a3a0f
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x139ee87a
mov ecx, 0x8a6d9a56
jmp 0x140005400
mov eax, dword [rsp + 0x38]
mov eax, 0xf662ea28
jmp 0x14000540d
mov eax, 0x1d272c0a
jmp 0x14000540d
mov eax, 0xe9b4f793
jmp 0x14000540d
mov rax, qword [rsp + 0x30]
mov eax, 0x34017708
jmp 0x14000540d
mov eax, 0x757dbe90
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xcb23d4c6
mov ecx, 0x2c63a8b
jmp 0x140005400
mov eax, 0x7f1eadc0
jmp 0x14000540d
mov eax, 0x411d7021
jmp 0x14000540d
mov eax, 0xa7c563a5
jmp 0x14000540d
mov eax, 0xab602370
jmp 0x14000540d
mov eax, 0x7b73abfd
jmp 0x14000540d
cmp byte [rsp + 0x25], 0
mov eax, 0x1069396f
mov ecx, 0x66093d88
cmovne eax, ecx
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe8f0f882
mov ecx, 0x1028ce60
jmp 0x140005400
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x31aa87c
mov ecx, 0x648152bd
jmp 0x140005400
test r15d, r15d
mov eax, 0x1069396f
mov ecx, 0x55aa77ca
cmove eax, ecx
jmp 0x14000540d
mov eax, 0xcfd8151e
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2c5005f6
mov ecx, 0x139ee87a
cmovne eax, ecx
cmp dword [0x14004ad40], 0xa
mov ecx, 0x2c5005f6
cmovl eax, ecx
jmp 0x14000540d
mov eax, 0x4a391354
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa29898d0
mov ecx, 0x76276796
jmp 0x140005400
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2b91b23e
mov ecx, 0xe2547e0e
cmovne eax, ecx
cmp dword [0x14004ad40], 0xa
mov ecx, 0x2b91b23e
cmovl eax, ecx
jmp 0x14000540d
mov eax, 0xa83b43fc
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x408cabf4
mov ecx, 0xb92803a1
jmp 0x140005400
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x78], rax
mov eax, 0x39810c1d
jmp 0x14000540d
mov r8d, dword [rsp + 0x40]
mov ecx, 0x478
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov qword [rsp + 0x30], rax
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xdafed408
mov ecx, 0xb5fdd26e
jmp 0x140005400
mov rax, qword [rsp + 0xc8]
shr rax, 2
mov dword [rsp + 0x3c], eax
mov eax, 0xc0c4b8c
jmp 0x14000540d
cmp dword [rsp + 0x90], 0
setne byte [rsp + 0x29]
mov eax, 0xeac539be
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf7e4e3a0
mov ecx, 0x2a28d75b
cmovne eax, ecx
cmp dword [0x14004ad40], 0xa
mov ecx, 0xf7e4e3a0
cmovl eax, ecx
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe9af43a9
mov ecx, 0xd643ac61
jmp 0x140005400
mov eax, 0x2c5005f6
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xbf814303
mov ecx, 0x454de257
jmp 0x140005400
mov eax, 0xac1848cd
jmp 0x14000540d
mov rax, qword [rsp + 0x70]
mov eax, 0xe7b9c9b7
jmp 0x14000540d
lea rax, [rsp + 0xa0]
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0xb8]
lea rax, [rsp + 0x88]
mov qword [rsp + 0xc0], rax
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb3f4f44a
mov ecx, 0x1e575049
jmp 0x140005400
mov rax, qword [rsp + 0x50]
call fcn.140004e50
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xcfe38169
mov ecx, 0xb687fc7b
jmp 0x140005400
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x408cabf4
mov ecx, 0x450001db
jmp 0x140005400
mov eax, dword [rsp + 0x60]
mov eax, 0xc0fd5505
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x9f593d2c
mov ecx, 0x2a28d75b
cmovne eax, ecx
cmp dword [0x14004ad40], 0xa
mov ecx, 0x9f593d2c
cmovl eax, ecx
jmp 0x14000540d
mov rax, qword [rsp + 0x30]
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2043d2b7
mov ecx, 0xb18c115f
jmp 0x140005400
mov eax, dword [rsp + 0x64]
mov eax, 0xc5699d7c
jmp 0x14000540d
mov rax, qword [rsp + 0x50]
mov eax, dword [rax]
mov dword [rsp + 0x40], eax
mov eax, 0x3c2417cb
jmp 0x14000540d
mov eax, 0xb6cdf67c
jmp 0x14000540d
mov eax, 0x296ebcd6
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x4f2aecef
mov ecx, 0x6e42f0bf
jmp 0x140005400
mov eax, dword [rsp + 0x8c]
mov qword [rsp + 0xc8], rax
mov eax, 0x3fc326be
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x4f2aecef
mov ecx, 0xcf025866
jmp 0x140005400
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe2547e0e
mov ecx, 0x5dbe63c0
jmp 0x140005400
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xbfc3d5c2
mov ecx, 0x7288f1cf
jmp 0x140005400
cmp byte [rsp + 0x26], 0
mov eax, 0xbbaeb1b8
mov ecx, 0x326b7169
cmovne eax, ecx
jmp 0x14000540d
cmp byte [rsp + 0x27], 0
mov eax, 0xcd389412
mov ecx, 0xb16f95a3
cmovne eax, ecx
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xc074ccbf
mov ecx, 0x4be78cbe
cmovne eax, ecx
cmp dword [0x14004ad40], 0xa
mov ecx, 0xc074ccbf
cmovl eax, ecx
jmp 0x14000540d
mov eax, 0xb1aed8d0
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7e8fd9bb
mov ecx, 0xacb144b8
jmp 0x140005400
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xb3f4f44a
mov ecx, 0x763f014c
jmp 0x140005400
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x80], rax
mov eax, 0x17884d84
jmp 0x14000540d
cmp byte [rsp + 0x24], 0
mov eax, 0x28b56ca8
mov ecx, 0x72a960dc
cmovne eax, ecx
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xdbcd9c4e
mov ecx, 0x345570d4
jmp 0x140005400
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xaa9c5732
mov ecx, 0xe9b4f793
jmp 0x140005400
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xdafed408
mov ecx, 0xe7395a1f
jmp 0x140005400
mov eax, 0x6e9cf80
jmp 0x14000540d
mov eax, 0x763f014c
jmp 0x14000540d
mov eax, 0x648152bd
jmp 0x14000540d
mov rcx, qword [rsp + 0x48]
mov r8d, 0x208
xor edx, edx
call fcn.140032ca0
mov rax, qword [rsp + 0x48]
movabs rcx, 0x4c004c0055004e
mov qword [rax], rcx
mov rcx, r12
mov edx, 0x1000
mov r8, rdi
call sub.KERNEL32.dll_K32EnumProcesses
test eax, eax
setne byte [rsp + 0x24]
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7b87cadd
mov ecx, 0xfc7f2421
jmp 0x140005400
mov eax, 0x9fb8d5e5
jmp 0x14000540d
mov eax, 0xe1146a5c
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xbb4b441b
mov ecx, 0xe89b393c
jmp 0x140005400
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xcb1b34b
mov ecx, 0x155c12d4
jmp 0x140005400
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x51132cb8
mov ecx, 0xab602370
jmp 0x140005400
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xcfe38169
mov ecx, 0x768e31f2
jmp 0x140005400
mov eax, 0x454de257
jmp 0x14000540d
mov eax, 0x271b2555
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xe38b615b
mov ecx, 0x757dbe90
jmp 0x140005400
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x77021793
mov ecx, 0x925fa673
jmp 0x140005400
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xcd41d114
mov ecx, 0x57ede43b
jmp 0x140005400
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x7a74b6db
mov ecx, 0x6be1fcad
jmp 0x140005400
mov rax, qword [rsp + 0x50]
call fcn.140004e50
mov eax, 0x9e98a5f7
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
and ecx, 1
sete al
cmp dword [0x14004ad40], 0xa
setl dl
xor cl, dl
and al, dl
xor al, cl
mov eax, 0xc0fd5505
mov ecx, 0xbb364d3b
cmovne eax, ecx
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x176fcce5
mov ecx, 0xc97ba80a
jmp 0x140005400
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rax, qword [rsp + 0x50]
mov eax, dword [rax]
mov dword [0x14004ab38], eax
mov eax, 0xad248110
jmp 0x14000540d
mov eax, dword [rsp + 0x2c]
mov eax, 0x20beb6cc
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xa37e60e0
mov ecx, 0x8efc64a5
jmp 0x140005400
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x528cedc6
mov ecx, 0xe47d3f10
jmp 0x140005400
mov eax, dword [rsp + 0x2c]
mov qword [rsp + 0x70], rax
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xef24677b
mov ecx, 0x80350179
jmp 0x140005400
mov eax, 0x6f35bb5f
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x2bfe4183
mov ecx, 0x33f3b9a7
jmp 0x140005400
cmp dword [rsp + 0x64], 0
setne byte [rsp + 0x28]
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0xf20be195
mov ecx, 0xb65c5552
jmp 0x140005400
mov rcx, qword [rsp + 0x68]
lea rdx, str.svchost.exe
call rbx
mov eax, 0xdb35df87
jmp 0x14000540d
mov eax, dword [0x14004ad3c]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
mov eax, 0x725a8fff
mov ecx, 0xcddca1a9
jmp 0x140005400
cmp eax, 0x4f34306c
jne 0x14000540d
mov eax, 1
add rsp, 0x12e8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret