Function at 0x1400486d0
Capabilities:
Encode data using xor
Enumerate processes
Log keystrokes via polling

Disassembly:
mov rax, rsp
mov qword [rax + 0x18], rbx
mov qword [rax + 0x20], r14
push r15
sub rsp, 0x3a0
vmovaps xmmword [rax - 0x18], xmm6
vmovaps xmmword [rax - 0x28], xmm7
vmovaps xmmword [rax - 0x38], xmm8
vmovaps xmmword [rax - 0x48], xmm9
vmovaps xmmword [rax - 0x58], xmm10
mov rax, qword [0x14006b060]
xor rax, rsp
mov qword [rsp + 0x330], rax
xor ebx, ebx
lea rcx, [0x140049be0]
call qword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
vmovups xmm0, xmmword [0x140061888]
movzx eax, byte [0x140061898]
lea rcx, [rsp + 0x24]
vmovdqu xmm7, xmmword [0x140061ed0]
vmovdqu xmm6, xmmword [0x140062020]
vmovdqu xmm9, xmmword [0x140061f20]
vmovups xmmword [rsp + 0x20], xmm0
vmovdqu xmm0, xmmword [0x140061fe0]
mov r14d, 4
mov byte [rsp + 0x30], al
mov r15d, 0x1f
mov r8d, ebx
vmovdqu xmmword [rsp + 0x40], xmm0
mov edx, dword [rsp + 0x40]
vmovd xmm8, r14d
vmovd xmm10, r15d
nop
vmovd xmm0, r8d
vpshufd xmm0, xmm0, 0
vpaddd xmm5, xmm0, xmm7
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm6
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm6
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, xmm8
vpsrld xmm0, xmm4, xmm10
vpaddd xmm1, xmm0, xmm4
vmovd xmm0, dword [rcx - 4]
vpmulld xmm2, xmm1, xmm9
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x140061e90]
vmovd xmm1, edx
vpaddb xmm2, xmm4, xmm1
vpxor xmm1, xmm2, xmm0
vmovd dword [rcx - 4], xmm1
lea eax, [r8 + 4]
add r8d, 8
lea rcx, [rcx + 8]
vmovd xmm0, eax
vpshufd xmm0, xmm0, 0
vpaddd xmm5, xmm0, xmm7
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm6
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm6
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, xmm8
vpsrld xmm1, xmm4, xmm10
vpaddd xmm0, xmm1, xmm4
vpmulld xmm2, xmm0, xmm9
vmovd xmm0, edx
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x140061e90]
vpaddb xmm1, xmm4, xmm0
vmovd xmm0, dword [rcx - 8]
vpxor xmm1, xmm1, xmm0
vmovd dword [rcx - 8], xmm1
cmp r8d, 0x10
jl 0x140048780
cmp r8d, 0x11
jge 0x140048891
movsxd rax, r8d
lea r9, [rsp + 0x20]
add r9, rax
nop dword [rax]
mov eax, 0x5397829d
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x30
xor byte [r9 - 1], al
cmp r8d, 0x11
jl 0x140048860
lea rcx, [rsp + 0x20]
call fcn.140015634
cmp byte [0x140061aaf], bl
mov eax, dword [str.sa3e__GMbXSU_HO]
mov dword [rsp + 0x60], eax
je 0x140048916
vmovdqu xmm5, xmmword [0x140061ed0]
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmmword [0x140062020]
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmmword [0x140062020]
vshufps xmm4, xmm3, xmm2, 0xdd
vmovd xmm0, r14d
vpsrad xmm2, xmm4, xmm0
vmovd xmm0, r15d
vpsrld xmm1, xmm2, xmm0
vpaddd xmm2, xmm1, xmm2
vpmulld xmm3, xmm2, xmmword [0x140061f20]
vpsubd xmm4, xmm5, xmm3
vpshufb xmm2, xmm4, xmmword [0x140061e90]
vpaddb xmm3, xmm2, xmmword [0x140061fe0]
vmovd xmm0, eax
vpxor xmm1, xmm3, xmm0
vmovd dword [rsp + 0x60], xmm1
lea rcx, [rsp + 0x60]
call fcn.140015634
call fcn.14003e190
test al, al
jne 0x140048ac4
vmovups ymm0, ymmword [0x1400618a0]
vmovsd xmm1, qword [0x1400618c0]
mov eax, dword [0x1400618c8]
lea rcx, [rsp + 0xc4]
vmovdqu xmm7, xmmword [0x140061ed0]
vmovdqu xmm6, xmmword [0x140062020]
vmovdqu xmm9, xmmword [0x140061f20]
vmovups ymmword [rsp + 0xc0], ymm0
vmovdqu xmm0, xmmword [0x140061fe0]
vmovdqu xmmword [rsp + 0x40], xmm0
mov edx, dword [rsp + 0x40]
vmovsd qword [rsp + 0xe0], xmm1
mov dword [rsp + 0xe8], eax
vmovd xmm8, r14d
vmovd xmm10, r15d
nop dword [rax + rax]
vmovd xmm0, ebx
vpshufd xmm0, xmm0, 0
vpaddd xmm5, xmm0, xmm7
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm6
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm6
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, xmm8
vpsrld xmm0, xmm4, xmm10
vpaddd xmm1, xmm0, xmm4
vmovd xmm0, dword [rcx - 4]
vpmulld xmm2, xmm1, xmm9
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x140061e90]
vmovd xmm1, edx
vpaddb xmm2, xmm4, xmm1
vpxor xmm1, xmm2, xmm0
vmovd dword [rcx - 4], xmm1
lea eax, [rbx + 4]
add ebx, 8
lea rcx, [rcx + 8]
vmovd xmm0, eax
vpshufd xmm0, xmm0, 0
vpaddd xmm5, xmm0, xmm7
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm6
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm6
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, xmm8
vpsrld xmm1, xmm4, xmm10
vpaddd xmm0, xmm1, xmm4
vpmulld xmm2, xmm0, xmm9
vmovd xmm0, edx
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x140061e90]
vpaddb xmm1, xmm4, xmm0
vmovd xmm0, dword [rcx - 8]
vpxor xmm1, xmm1, xmm0
vmovd dword [rcx - 8], xmm1
cmp ebx, 0x28
jl 0x1400489a0
cmp ebx, 0x2c
jge 0x140048aad
movsxd rax, ebx
lea r8, [rsp + 0xc0]
add r8, rax
nop word [rax + rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul ebx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, bl
inc ebx
sub al, cl
add al, 0x30
xor byte [r8 - 1], al
cmp ebx, 0x2c
jl 0x140048a80
lea rcx, [rsp + 0xc0]
vzeroupper
call fcn.1400036e0
xor al, al
jmp 0x1400494e4
call fcn.14003ce00
test al, al
jne 0x140048c8a
vmovups ymm0, ymmword [0x140061d18]
vmovsd xmm1, qword [0x140061d38]
movzx eax, word [0x140061d40]
lea rcx, [rsp + 0xc4]
vmovdqu xmm7, xmmword [0x140061ed0]
vmovdqu xmm6, xmmword [0x140062020]
vmovdqu xmm9, xmmword [0x140061f20]
vmovups ymmword [rsp + 0xc0], ymm0
vmovdqu xmm0, xmmword [0x140061fe0]
vmovdqu xmmword [rsp + 0x40], xmm0
mov edx, dword [rsp + 0x40]
vmovsd qword [rsp + 0xe0], xmm1
mov word [rsp + 0xe8], ax
vmovd xmm8, r14d
vmovd xmm10, r15d
nop
vmovd xmm0, ebx
vpshufd xmm0, xmm0, 0
vpaddd xmm5, xmm0, xmm7
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm6
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm6
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, xmm8
vpsrld xmm0, xmm4, xmm10
vpaddd xmm1, xmm0, xmm4
vmovd xmm0, dword [rcx - 4]
vpmulld xmm2, xmm1, xmm9
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x140061e90]
vmovd xmm1, edx
vpaddb xmm2, xmm4, xmm1
vpxor xmm1, xmm2, xmm0
vmovd dword [rcx - 4], xmm1
lea eax, [rbx + 4]
add ebx, 8
lea rcx, [rcx + 8]
vmovd xmm0, eax
vpshufd xmm0, xmm0, 0
vpaddd xmm5, xmm0, xmm7
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm6
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm6
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, xmm8
vpsrld xmm1, xmm4, xmm10
vpaddd xmm0, xmm1, xmm4
vpmulld xmm2, xmm0, xmm9
vmovd xmm0, edx
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x140061e90]
vpaddb xmm1, xmm4, xmm0
vmovd xmm0, dword [rcx - 8]
vpxor xmm1, xmm1, xmm0
vmovd dword [rcx - 8], xmm1
cmp ebx, 0x28
jl 0x140048b40
cmp ebx, 0x2a
jge 0x140048c4d
movsxd rax, ebx
lea r8, [rsp + 0xc0]
add r8, rax
nop word [rax + rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul ebx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, bl
inc ebx
sub al, cl
add al, 0x30
xor byte [r8 - 1], al
cmp ebx, 0x2a
jl 0x140048c20
lea rcx, [rsp + 0xc0]
vzeroupper
call fcn.1400036e0
mov rcx, qword [0x140fb4ac0]
test rcx, rcx
je 0x140048c6f
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp qword [0x140fb4ac8], 0
je 0x140048c83
call fcn.14003fee0
call fcn.140040300
xor al, al
jmp 0x1400494e4
mov qword [rsp + 0x3b0], rsi
lea rcx, [0x140060e2c]
mov qword [rsp + 0x3b8], rdi
vmovaps xmmword [rsp + 0x340], xmm11
call fcn.140015634
cmp byte [0x140061821], bl
vmovsd xmm0, qword [0x140061818]
movzx eax, word [0x140061820]
vmovsd qword [rsp + 0x20], xmm0
mov word [rsp + 0x28], ax
je 0x140048d03
xor byte [rsp + 0x21], 0x31
xor byte [rsp + 0x22], 0x32
xor byte [rsp + 0x23], 0x33
xor byte [rsp + 0x24], 0x34
xor byte [rsp + 0x25], 0x35
xor byte [rsp + 0x26], 0x36
xor byte [rsp + 0x27], 0x37
xor byte [rsp + 0x28], 0x38
xor byte [rsp + 0x29], 0x39
mov byte [rsp + 0x20], 0xc9
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov esi, 8
test rax, rax
jne 0x140048ed9
nop
cmp byte [0x140061821], bl
vmovsd xmm0, qword [0x140061818]
movzx eax, word [0x140061820]
vmovsd qword [rsp + 0x20], xmm0
mov word [rsp + 0x28], ax
je 0x140048d74
xor byte [rsp + 0x21], 0x31
xor byte [rsp + 0x22], 0x32
xor byte [rsp + 0x23], 0x33
xor byte [rsp + 0x24], 0x34
xor byte [rsp + 0x25], 0x35
xor byte [rsp + 0x26], 0x36
xor byte [rsp + 0x27], 0x37
xor byte [rsp + 0x28], 0x38
xor byte [rsp + 0x29], 0x39
mov byte [rsp + 0x20], 0xc9
lea rdx, [rsp + 0x20]
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
mov ecx, 0x64
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_Sleep]
test rdi, rdi
jne 0x140048ed9
cmp byte [0x1400617a5], bl
mov eax, dword [0x1400617a0]
vmovsd xmm0, qword [0x140061798]
mov dword [rsp + 0x48], eax
movzx eax, word [0x1400617a4]
mov word [rsp + 0x4c], ax
vmovsd qword [rsp + 0x40], xmm0
je 0x140048eca
vmovdqu xmm5, xmmword [0x140061ed0]
vmovdqu xmm9, xmmword [0x140062020]
mov eax, dword [0x140061fe0]
lea r9, [rsp + 0x48]
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm9
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm9
vshufps xmm0, xmm3, xmm2, 0xdd
vmovd xmm8, r14d
vpsrad xmm4, xmm0, xmm8
vmovd xmm7, r15d
vpsrld xmm1, xmm4, xmm7
vpaddd xmm0, xmm1, xmm4
vpmulld xmm2, xmm0, xmmword [0x140061f20]
vmovd xmm1, dword [0x140061798]
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x140061e90]
vmovdqu xmm5, xmmword [0x140061ee0]
vmovd xmm0, eax
vpaddb xmm2, xmm4, xmm0
vpxor xmm0, xmm2, xmm1
vmovd dword [rsp + 0x40], xmm0
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm9
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm9
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, xmm8
vpsrld xmm1, xmm4, xmm7
vpaddd xmm0, xmm1, xmm4
vpmulld xmm2, xmm0, xmmword [0x140061f20]
vmovd xmm1, dword [rsp + 0x44]
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x140061e90]
vmovd xmm0, eax
vpaddb xmm2, xmm4, xmm0
vpxor xmm0, xmm2, xmm1
vmovd dword [rsp + 0x44], xmm0
mov r8d, esi
nop
mov eax, 0x5397829d
lea r9, [r9 + 1]
mul r8d
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x30
xor byte [r9 - 1], al
cmp r8d, 0xe
jl 0x140048ea0
lea rcx, [rsp + 0x40]
call fcn.1400036e0
jmp 0x140048d20
lea rcx, [0x140060e30]
call fcn.140015634
vmovups ymm0, ymmword [0x1400617b0]
vmovups ymm1, ymmword [0x1400617d0]
mov eax, dword [0x1400617f0]
lea rcx, [rsp + 0x74]
vmovdqu xmm7, xmmword [0x140061ed0]
vmovdqu xmm6, xmmword [0x140062020]
vmovdqu xmm9, xmmword [0x140061f20]
vmovups ymmword [rsp + 0x70], ymm0
vmovdqu xmm0, xmmword [0x140061fe0]
vmovdqu xmmword [rsp + 0x40], xmm0
mov edx, dword [rsp + 0x40]
mov r8d, ebx
vmovups ymmword [rsp + 0x90], ymm1
mov dword [rsp + 0xb0], eax
vmovd xmm8, r14d
vmovd xmm10, r15d
nop dword [rax]
vmovd xmm0, r8d
vpshufd xmm0, xmm0, 0
vpaddd xmm5, xmm0, xmm7
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm6
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm6
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, xmm8
vpsrld xmm0, xmm4, xmm10
vpaddd xmm1, xmm0, xmm4
vmovd xmm0, dword [rcx - 4]
vpmulld xmm2, xmm1, xmm9
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x140061e90]
vmovd xmm1, edx
vpaddb xmm2, xmm4, xmm1
vpxor xmm1, xmm2, xmm0
vmovd dword [rcx - 4], xmm1
lea eax, [r8 + 4]
add r8d, esi
lea rcx, [rcx + 8]
vmovd xmm0, eax
vpshufd xmm0, xmm0, 0
vpaddd xmm5, xmm0, xmm7
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm6
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm6
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, xmm8
vpsrld xmm1, xmm4, xmm10
vpaddd xmm0, xmm1, xmm4
vpmulld xmm2, xmm0, xmm9
vmovd xmm0, edx
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x140061e90]
vpaddb xmm1, xmm4, xmm0
vmovd xmm0, dword [rcx - 8]
vpxor xmm1, xmm1, xmm0
vmovd dword [rcx - 8], xmm1
cmp r8d, 0x40
jl 0x140048f50
cmp r8d, 0x44
jge 0x140049061
movsxd rax, r8d
lea r9, [rsp + 0x70]
add r9, rax
nop dword [rax + rax]
mov eax, 0x5397829d
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x30
xor byte [r9 - 1], al
cmp r8d, 0x44
jl 0x140049030
lea rcx, [rsp + 0x70]
vzeroupper
call fcn.1400036e0
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jne 0x14004909b
nop
mov ecx, 0xa
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x2d
call qword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x140049080
movzx eax, word [0x1400618e8]
lea rdx, [rsp + 0x20]
vmovsd xmm0, qword [0x1400618e0]
vmovsd qword [rsp + 0x20], xmm0
xor byte [rsp + 0x21], 0x31
lea rcx, [0x1401a2680]
xor byte [rsp + 0x22], 0x32
xor byte [rsp + 0x23], 0x33
xor byte [rsp + 0x24], 0x34
xor byte [rsp + 0x25], 0x35
xor byte [rsp + 0x26], 0x36
xor byte [rsp + 0x27], 0x37
mov word [rsp + 0x28], ax
movzx eax, byte [0x1400618ea]
xor byte [rsp + 0x28], 0x38
xor al, 0x3a
xor byte [rsp + 0x29], 0x39
mov byte [rsp + 0x2a], al
mov byte [rsp + 0x20], 0xbc
call fcn.140002730
mov rcx, rax
call fcn.140002cd0
vmovdqu xmm5, xmmword [0x140061ed0]
vmovdqu xmm9, xmmword [0x140062020]
vmovsd xmm0, qword [0x140061a98]
vmovups xmm8, xmmword [str.XP_WY_RVM]
mov eax, dword [0x140061aa0]
lea r9, [rsp + 0xd0]
vmovaps xmm11, xmmword [rsp + 0x340]
mov r8d, esi
vmovsd qword [rsp + 0xd0], xmm0
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm9
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm9
vshufps xmm0, xmm3, xmm2, 0xdd
vmovups xmmword [rsp + 0xc0], xmm8
vmovd xmm7, r14d
vpsrad xmm4, xmm0, xmm7
vmovd xmm6, r15d
vpsrld xmm1, xmm4, xmm6
vpaddd xmm0, xmm1, xmm4
vpmulld xmm2, xmm0, xmmword [0x140061f20]
vpsubd xmm3, xmm5, xmm2
vpshufb xmm0, xmm3, xmmword [0x140061fd0]
vpaddw xmm2, xmm0, xmmword [0x140061fb0]
vmovdqu xmm5, xmmword [0x140061ee0]
vmovq xmm0, xmm8
vpxor xmm2, xmm2, xmm0
vmovq qword [rsp + 0xc0], xmm2
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm9
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm9
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, xmm7
vpsrld xmm1, xmm4, xmm6
vpaddd xmm0, xmm1, xmm4
vpmulld xmm2, xmm0, xmmword [0x140061f20]
vpsubd xmm3, xmm5, xmm2
vmovq xmm2, qword [rsp + 0xc8]
vpshufb xmm0, xmm3, xmmword [0x140061fd0]
vpaddw xmm4, xmm0, xmmword [0x140061fb0]
mov dword [rsp + 0xd8], eax
movzx eax, word [0x140061aa4]
vpxor xmm1, xmm4, xmm2
vmovq qword [rsp + 0xc8], xmm1
mov word [rsp + 0xdc], ax
nop dword [rax + rax]
mov eax, 0x5397829d
lea r9, [r9 + 2]
mul r8d
shr edx, 4
movzx eax, dx
imul ecx, eax, 0x31
movzx eax, r8w
inc r8d
sub ax, cx
add ax, 0x30
xor word [r9 - 2], ax
cmp r8d, 0xf
jl 0x140049230
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x1400492fd
xor edx, edx
mov dword [rsp + 0xf0], 0x238
mov r8d, 0x234
lea rcx, [rsp + 0xf4]
call fcn.140011900
lea rdx, [rsp + 0xf0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400492f4
nop dword [rax + rax]
lea rax, [rsp + 0x11c]
lea r8, [rsp + 0xc0]
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400492d7
add rax, 2
test ecx, ecx
jne 0x1400492c3
mov rcx, rdi
test edx, edx
je 0x140049528
lea rdx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400492b0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x140fb3f04], ebx
mov eax, dword [0x140061b48]
lea rcx, [rsp + 0x24]
vmovups xmm0, xmmword [0x140061b30]
vmovsd xmm1, qword [str.7_1c2g.___GN]
vmovdqu xmm7, xmmword [0x140061ed0]
vmovdqu xmm6, xmmword [0x140062020]
vmovdqu xmm9, xmmword [0x140061f20]
mov dword [rsp + 0x38], eax
movzx eax, word [0x140061b4c]
vmovups xmmword [rsp + 0x20], xmm0
vmovdqu xmm0, xmmword [0x140061fe0]
mov word [rsp + 0x3c], ax
movzx eax, byte [0x140061b4e]
vmovdqu xmmword [rsp + 0x40], xmm0
mov edx, dword [rsp + 0x40]
mov byte [rsp + 0x3e], al
vmovsd qword [rsp + 0x30], xmm1
vmovd xmm8, r14d
vmovd xmm10, r15d
nop dword [rax]
vmovd xmm0, ebx
vpshufd xmm0, xmm0, 0
vpaddd xmm5, xmm0, xmm7
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm6
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm6
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, xmm8
vpsrld xmm0, xmm4, xmm10
vpaddd xmm1, xmm0, xmm4
vmovd xmm0, dword [rcx - 4]
vpmulld xmm2, xmm1, xmm9
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x140061e90]
vmovd xmm1, edx
vpaddb xmm2, xmm4, xmm1
vpxor xmm1, xmm2, xmm0
vmovd dword [rcx - 4], xmm1
lea eax, [rbx + 4]
add ebx, esi
lea rcx, [rcx + 8]
vmovd xmm0, eax
vpshufd xmm0, xmm0, 0
vpaddd xmm5, xmm0, xmm7
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm6
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm6
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, xmm8
vpsrld xmm1, xmm4, xmm10
vpaddd xmm0, xmm1, xmm4
vpmulld xmm2, xmm0, xmm9
vmovd xmm0, edx
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x140061e90]
vpaddb xmm1, xmm4, xmm0
vmovd xmm0, dword [rcx - 8]
vpxor xmm1, xmm1, xmm0
vmovd dword [rcx - 8], xmm1
cmp ebx, 0x18
jl 0x140049380
cmp ebx, r15d
jge 0x14004948d
movsxd rax, ebx
lea r8, [rsp + 0x20]
add r8, rax
nop word [rax + rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul ebx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, bl
inc ebx
sub al, cl
add al, 0x30
xor byte [r8 - 1], al
cmp ebx, r15d
jl 0x140049460
mov eax, dword [rsp + 0xd8]
lea rdx, [rsp + 0x40]
vmovups xmm0, xmmword [rsp + 0xc0]
vmovsd xmm1, qword [rsp + 0xd0]
mov dword [rsp + 0x58], eax
lea rcx, [rsp + 0x20]
movzx eax, word [rsp + 0xdc]
mov word [rsp + 0x5c], ax
vmovups xmmword [rsp + 0x40], xmm0
vmovsd qword [rsp + 0x50], xmm1
call fcn.1400036e0
xor al, al
mov rsi, qword [rsp + 0x3b0]
mov rdi, qword [rsp + 0x3b8]
mov rcx, qword [rsp + 0x330]
xor rcx, rsp
call fcn.14000ee10
lea r11, [rsp + 0x3a0]
mov rbx, qword [r11 + 0x20]
mov r14, qword [r11 + 0x28]
vmovaps xmm6, xmmword [r11 - 0x10]
vmovaps xmm7, xmmword [r11 - 0x20]
vmovaps xmm8, xmmword [r11 - 0x30]
vmovaps xmm9, xmmword [r11 - 0x40]
vmovaps xmm10, xmmword [r11 - 0x50]
mov rsp, r11
pop r15
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, dword [rsp + 0xf8]
mov dword [0x140fb3f04], r8d
test r8d, r8d
je 0x140049303
vmovdqu xmm5, xmmword [0x140061ed0]
vmovdqu xmm9, xmmword [0x140062020]
mov eax, dword [0x140061978]
lea r9, [rsp + 0x28]
vmovsd xmm0, qword [0x140061970]
vmovsd qword [rsp + 0x20], xmm0
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm9
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm9
vshufps xmm0, xmm3, xmm2, 0xdd
vmovd xmm8, r14d
vpsrad xmm4, xmm0, xmm8
vmovd xmm7, r15d
vpsrld xmm1, xmm4, xmm7
vpaddd xmm0, xmm1, xmm4
vpmulld xmm2, xmm0, xmmword [0x140061f20]
vmovd xmm1, dword [0x140061970]
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x140061e90]
vmovdqu xmm5, xmmword [0x140061ee0]
mov dword [rsp + 0x28], eax
movzx eax, byte [0x14006197c]
mov byte [rsp + 0x2c], al
mov eax, dword [0x140061fe0]
vmovd xmm0, eax
vpaddb xmm2, xmm4, xmm0
vpxor xmm0, xmm2, xmm1
vmovd dword [rsp + 0x20], xmm0
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm9
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm9
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, xmm8
vpsrld xmm1, xmm4, xmm7
vpaddd xmm0, xmm1, xmm4
vpmulld xmm2, xmm0, xmmword [0x140061f20]
vmovd xmm1, dword [rsp + 0x24]
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x140061e90]
vmovd xmm0, eax
vpaddb xmm2, xmm4, xmm0
vpxor xmm0, xmm2, xmm1
vmovd dword [rsp + 0x24], xmm0
nop dword [rax]
mov eax, 0x5397829d
lea r9, [r9 + 1]
mul esi
shr edx, 4
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, sil
inc esi
sub al, cl
add al, 0x30
xor byte [r9 - 1], al
cmp esi, 0xd
jl 0x140049640
mov eax, dword [rsp + 0xd8]
lea rdx, [rsp + 0x40]
vmovups xmm0, xmmword [rsp + 0xc0]
vmovsd xmm1, qword [rsp + 0xd0]
mov dword [rsp + 0x58], eax
lea rcx, [rsp + 0x20]
movzx eax, word [rsp + 0xdc]
mov word [rsp + 0x5c], ax
vmovups xmmword [rsp + 0x40], xmm0
vmovsd qword [rsp + 0x50], xmm1
call fcn.1400036e0
call fcn.14003b8c0
mov qword [0x140fb3ee0], rax
mov rdx, rax
test rax, rax
jne 0x140049874
cmp byte [0x1400619f5], bl
mov eax, dword [0x1400619f0]
vmovups xmm0, xmmword [0x1400619d8]
vmovsd xmm1, qword [0x1400619e8]
mov dword [rsp + 0xd8], eax
movzx eax, word [0x1400619f4]
mov word [rsp + 0xdc], ax
vmovups xmmword [rsp + 0xc0], xmm0
vmovsd qword [rsp + 0xd0], xmm1
je 0x14004985d
vmovdqu xmm0, xmmword [0x140061fe0]
vmovdqu xmm7, xmmword [0x140061ed0]
vmovdqu xmm6, xmmword [0x140062020]
vmovdqu xmm9, xmmword [0x140061f20]
vmovdqu xmmword [rsp + 0x40], xmm0
mov edx, dword [rsp + 0x40]
lea rcx, [rsp + 0xc4]
vmovd xmm8, r14d
vmovd xmm10, r15d
nop word [rax + rax]
vmovd xmm0, ebx
vpshufd xmm0, xmm0, 0
vpaddd xmm5, xmm0, xmm7
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm6
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm6
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, xmm8
vpsrld xmm0, xmm4, xmm10
vpaddd xmm1, xmm0, xmm4
vmovd xmm0, dword [rcx - 4]
vpmulld xmm2, xmm1, xmm9
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x140061e90]
vmovd xmm1, edx
vpaddb xmm2, xmm4, xmm1
vpxor xmm1, xmm2, xmm0
vmovd dword [rcx - 4], xmm1
lea eax, [rbx + 4]
add ebx, 8
lea rcx, [rcx + 8]
vmovd xmm0, eax
vpshufd xmm0, xmm0, 0
vpaddd xmm5, xmm0, xmm7
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm6
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm6
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, xmm8
vpsrld xmm1, xmm4, xmm10
vpaddd xmm0, xmm1, xmm4
vpmulld xmm2, xmm0, xmm9
vmovd xmm0, edx
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x140061e90]
vpaddb xmm1, xmm4, xmm0
vmovd xmm0, dword [rcx - 8]
vpxor xmm1, xmm1, xmm0
vmovd dword [rcx - 8], xmm1
cmp ebx, 0x18
jl 0x140049750
cmp ebx, 0x1e
jge 0x14004985d
movsxd rax, ebx
lea r8, [rsp + 0xc0]
add r8, rax
nop word [rax + rax]
mov eax, 0x5397829d
lea r8, [r8 + 1]
imul ebx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, bl
inc ebx
sub al, cl
add al, 0x30
xor byte [r8 - 1], al
cmp ebx, 0x1e
jl 0x140049830
lea rcx, [rsp + 0xc0]
call fcn.1400036e0
call fcn.14003fc20
jmp 0x1400494d2
vpxor xmm0, xmm0, xmm0
add rax, 0xffffffffffbfffff
movabs rcx, 0x7fffffffffbffffe
vmovups ymmword [rsp + 0x70], ymm0
vmovups ymmword [rsp + 0x90], ymm0
cmp rax, rcx
ja 0x1400498b5
mov ecx, dword [0x1401a3e80]
lea r8, [rsp + 0x70]
mov r9d, 0x40
vzeroupper
call fcn.14003c5c0
vmovups ymm0, ymmword [0x140061c20]
movzx eax, byte [0x140061c40]
lea rcx, [rsp + 0xc4]
vmovdqu xmm7, xmmword [0x140061ed0]
vmovdqu xmm6, xmmword [0x140062020]
vmovdqu xmm9, xmmword [0x140061f20]
vmovups ymmword [rsp + 0xc0], ymm0
vmovdqu xmm0, xmmword [0x140061fe0]
vmovdqu xmmword [rsp + 0x40], xmm0
mov edx, dword [rsp + 0x40]
mov r8d, ebx
mov byte [rsp + 0xe0], al
vmovd xmm8, r14d
vmovd xmm10, r15d
nop dword [rax]
nop word [rax + rax]
vmovd xmm0, r8d
vpshufd xmm0, xmm0, 0
vpaddd xmm5, xmm0, xmm7
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm6
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm6
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, xmm8
vpsrld xmm0, xmm4, xmm10
vpaddd xmm1, xmm0, xmm4
vmovd xmm0, dword [rcx - 4]
vpmulld xmm2, xmm1, xmm9
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x140061e90]
vmovd xmm1, edx
vpaddb xmm2, xmm4, xmm1
vpxor xmm1, xmm2, xmm0
vmovd dword [rcx - 4], xmm1
lea eax, [r8 + 4]
add r8d, 8
lea rcx, [rcx + 8]
vmovd xmm0, eax
vpshufd xmm0, xmm0, 0
vpaddd xmm5, xmm0, xmm7
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm6
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm6
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, xmm8
vpsrld xmm1, xmm4, xmm10
vpaddd xmm0, xmm1, xmm4
vpmulld xmm2, xmm0, xmm9
vmovd xmm0, edx
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x140061e90]
vpaddb xmm1, xmm4, xmm0
vmovd xmm0, dword [rcx - 8]
vpxor xmm1, xmm1, xmm0
vmovd dword [rcx - 8], xmm1
cmp r8d, 0x20
jl 0x140049920
cmp r8d, 0x21
jge 0x140049a31
movsxd rax, r8d
lea r9, [rsp + 0xc0]
add r9, rax
nop
mov eax, 0x5397829d
lea r9, [r9 + 1]
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x31
movzx eax, r8b
inc r8d
sub al, cl
add al, 0x30
xor byte [r9 - 1], al
cmp r8d, 0x21
jl 0x140049a00
movzx edi, word [rsp + 0x70]
lea rcx, [rsp + 0xc0]
mov edx, edi
vzeroupper
call fcn.1400036e0
mov eax, 0x5a4d
cmp di, ax
je 0x140049b97
vmovups ymm0, ymmword [0x140061ca0]
vmovsd xmm1, qword [0x140061cc0]
vmovdqu xmm7, xmmword [0x140061ed0]
vmovdqu xmm6, xmmword [0x140062020]
vmovdqu xmm9, xmmword [0x140061f20]
vmovups ymmword [rsp + 0xc0], ymm0
vmovdqu xmm0, xmmword [0x140061fe0]
vmovdqu xmmword [rsp + 0x40], xmm0
mov edx, dword [rsp + 0x40]
lea rcx, [rsp + 0xc4]
vmovsd qword [rsp + 0xe0], xmm1
vmovd xmm8, r14d
vmovd xmm10, r15d
nop dword [rax]
nop dword [rax + rax]
vmovd xmm0, ebx
vpshufd xmm0, xmm0, 0
vpaddd xmm5, xmm0, xmm7
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm6
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm6
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, xmm8
vpsrld xmm0, xmm4, xmm10
vpaddd xmm1, xmm0, xmm4
vmovd xmm0, dword [rcx - 4]
vpmulld xmm2, xmm1, xmm9
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x140061e90]
vmovd xmm1, edx
vpaddb xmm2, xmm4, xmm1
vpxor xmm1, xmm2, xmm0
vmovd dword [rcx - 4], xmm1
lea eax, [rbx + 4]
add ebx, 8
lea rcx, [rcx + 8]
vmovd xmm0, eax
vpshufd xmm0, xmm0, 0
vpaddd xmm5, xmm0, xmm7
vpunpckldq xmm0, xmm5, xmm5
vpmuldq xmm3, xmm0, xmm6
vpunpckhdq xmm1, xmm5, xmm5
vpmuldq xmm2, xmm1, xmm6
vshufps xmm0, xmm3, xmm2, 0xdd
vpsrad xmm4, xmm0, xmm8
vpsrld xmm1, xmm4, xmm10
vpaddd xmm0, xmm1, xmm4
vpmulld xmm2, xmm0, xmm9
vmovd xmm0, edx
vpsubd xmm3, xmm5, xmm2
vpshufb xmm4, xmm3, xmmword [0x140061e90]
vpaddb xmm1, xmm4, xmm0
vmovd xmm0, dword [rcx - 8]
vpxor xmm1, xmm1, xmm0
vmovd dword [rcx - 8], xmm1
cmp ebx, 0x28
jl 0x140049ac0
lea rcx, [rsp + 0xc0]
vzeroupper
call fcn.1400036e0
mov al, 1
jmp 0x1400494d4