Function at 0x140002df0
Capabilities:
Enumerate process modules

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x22d0]
mov eax, 0x23d0
call fcn.140006220
sub rsp, rax
mov rax, qword [0x14000a008]
xor rax, rsp
mov qword [rbp + 0x22c0], rax
mov dword [rsp + 0x28], ecx
mov r8d, ecx
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
mov qword [rbp + 0xc0], rax
test rax, rax
je 0x14000430d
lea r9, [rbp + 0xc8]
mov r8d, 0x2000
lea rdx, [rbp + 0x1b0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
je 0x140004304
xor r15d, r15d
mov ecx, r15d
mov dword [rsp + 0x38], ecx
test dword [rbp + 0xc8], 0xfffffff8
jbe 0x140004304
movabs r14, 0x7fffffffffffffff
movabs r13, 0x8000000000000000
lea r12d, [r15 + 0x16]
nop dword [rax]
mov edx, ecx
mov r9d, 0x104
lea r8, [rbp + 0x21b0]
mov rdx, qword [rbp + rdx*8 + 0x1b0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExA]
test eax, eax
je 0x1400042e9
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0xe8], r15
lea rax, [rbp + 0x21b0]
mov rdi, 0xffffffffffffffff
nop
inc rdi
cmp byte [rax + rdi], 0
jne 0x140002f00
cmp rdi, r14
ja 0x1400046d3
mov qword [rbp + 0xe8], 0xf
cmp rdi, 0x10
jae 0x140002f62
mov qword [rbp + 0xe0], rdi
mov r8, rdi
lea rdx, [rbp + 0x21b0]
lea rcx, [rbp + 0xd0]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rdi + 0xd0], 0
mov rsi, qword [rbp + 0xe8]
mov rdi, qword [rbp + 0xe0]
mov r14, qword [rbp + 0xd0]
jmp 0x140002ff6
mov rsi, rdi
or rsi, 0xf
cmp rsi, r14
jbe 0x140002f77
mov rsi, r14
lea rax, [r13 + 0x27]
jmp 0x140002f99
cmp rsi, 0x16
cmovb rsi, r12
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x140002fb8
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400046cd
mov rcx, rax
call fcn.140005310
test rax, rax
je 0x1400046c6
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140002fca
test rcx, rcx
je 0x140002fc7
call fcn.140005310
mov r14, rax
jmp 0x140002fca
mov r14, r15
mov qword [rbp + 0xd0], r14
mov qword [rbp + 0xe0], rdi
mov qword [rbp + 0xe8], rsi
mov r8, rdi
lea rdx, [rbp + 0x21b0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rdi], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0xe
mov qword [rsp + 0x58], 0xf
movsd xmm0, qword [str.Everything.exe]
movsd qword [rsp + 0x40], xmm0
mov eax, dword [0x140007720]
mov dword [rsp + 0x48], eax
movzx eax, word [0x140007724]
mov word [rsp + 0x4c], ax
mov byte [rsp + 0x4e], 0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x198], xmm0
mov qword [rbp + 0x1a8], r15
mov ecx, 0x20
call fcn.140005310
mov qword [rbp + 0x198], rax
mov qword [rbp + 0x1a0], rax
lea rcx, [rax + 0x20]
mov qword [rbp + 0x1a8], rcx
lea rcx, [rbp + 0x198]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x198]
mov r8, rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.140005050
mov qword [rbp + 0x1a0], rax
lea r9, [0x140004a30]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rsp + 0x40]
call fcn.14000534c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], rax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0xb
mov qword [rsp + 0x78], 0xf
movsd xmm0, qword [str.Fiddler.exe]
movsd qword [rsp + 0x60], xmm0
movzx eax, word [0x140007730]
mov word [rsp + 0x68], ax
movzx eax, byte [0x140007732]
mov byte [rsp + 0x6a], al
mov byte [rsp + 0x6b], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], 0xe
mov qword [rbp - 0x68], 0xf
movsd xmm0, qword [str.Fiddler.ni.exe]
movsd qword [rbp - 0x80], xmm0
mov eax, dword [0x140007740]
mov dword [rbp - 0x78], eax
movzx eax, word [0x140007744]
mov word [rbp - 0x74], ax
mov byte [rbp - 0x72], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], 0xf
mov ecx, 0x30
call fcn.140005310
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x50], 0x26
mov qword [rbp - 0x48], 0x2f
movups xmm0, xmmword [str.Telerik.NetworkConnections.Windows.dll]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140007758]
movups xmmword [rax + 0x10], xmm1
mov ecx, dword [0x140007768]
mov dword [rax + 0x20], ecx
movzx ecx, word [0x14000776c]
mov word [rax + 0x24], cx
mov byte [rax + 0x26], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], 0xf
mov ecx, 0x20
call fcn.140005310
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x30], 0x1a
mov qword [rbp - 0x28], 0x1f
movups xmm0, xmmword [str.FiddlerOrchestra.Addon.dll]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x140007780]
movsd qword [rax + 0x10], xmm1
movzx ecx, word [0x140007788]
mov word [rax + 0x18], cx
mov byte [rax + 0x1a], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], r15
mov qword [rbp - 8], 0xf
mov ecx, 0x20
call fcn.140005310
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x10], 0x1d
mov qword [rbp - 8], 0x1f
movups xmm0, xmmword [str.FiddlerOrchestra.Protocol.dll]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x1400077a0]
movsd qword [rax + 0x10], xmm1
mov ecx, dword [0x1400077a8]
mov dword [rax + 0x18], ecx
movzx ecx, byte [0x1400077ac]
mov byte [rax + 0x1c], cl
mov byte [rax + 0x1d], 0
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], 0xf
mov ecx, 0x20
call fcn.140005310
mov qword [rbp], rax
mov qword [rbp + 0x10], 0x1f
mov qword [rbp + 0x18], 0x1f
movups xmm0, xmmword [str.FiddlerOrchestra.Connection.dll]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x1400077c0]
movsd qword [rax + 0x10], xmm1
mov ecx, dword [0x1400077c8]
mov dword [rax + 0x18], ecx
movzx ecx, word [0x1400077cc]
mov word [rax + 0x1c], cx
movzx ecx, byte [0x1400077ce]
mov byte [rax + 0x1e], cl
mov byte [rax + 0x1f], 0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], r15
mov ecx, 0xc0
call fcn.140005310
mov qword [rbp + 0x180], rax
mov qword [rbp + 0x188], rax
lea rcx, [rax + 0xc0]
mov qword [rbp + 0x190], rcx
lea rcx, [rbp + 0x180]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x180]
mov r8, rax
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140005050
mov qword [rbp + 0x188], rax
lea r9, [0x140004a30]
mov edx, 0x20
lea r8d, [rdx - 0x1a]
lea rcx, [rsp + 0x60]
call fcn.14000534c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x168], xmm0
mov qword [rbp + 0x178], rax
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r15
mov qword [rbp + 0x58], 0xf
lea ecx, [rax + 0x20]
call fcn.140005310
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x50], 0x12
mov qword [rbp + 0x58], 0x1f
movups xmm0, xmmword [str.HTTPDebuggerUI.exe]
movups xmmword [rax], xmm0
movzx ecx, word [0x1400077e0]
mov word [rax + 0x10], cx
mov byte [rax + 0x12], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x78], 0xf
mov ecx, 0x20
call fcn.140005310
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x70], 0x17
mov qword [rbp + 0x78], 0x1f
movups xmm0, xmmword [str.HTTPDebuggerBrowser.dll]
movups xmmword [rax], xmm0
mov ecx, dword [0x1400077f8]
mov dword [rax + 0x10], ecx
movzx ecx, word [0x1400077fc]
mov word [rax + 0x14], cx
movzx ecx, byte [0x1400077fe]
mov byte [rax + 0x16], cl
mov byte [rax + 0x17], 0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x168], xmm0
mov qword [rbp + 0x178], r15
mov ecx, 0x40
call fcn.140005310
mov qword [rbp + 0x168], rax
mov qword [rbp + 0x170], rax
lea rcx, [rax + 0x40]
mov qword [rbp + 0x178], rcx
lea rcx, [rbp + 0x168]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x168]
mov r8, rax
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x40]
call fcn.140005050
mov qword [rbp + 0x170], rax
lea r9, [0x140004a30]
mov edx, 0x20
lea r8d, [rdx - 0x1e]
lea rcx, [rbp + 0x40]
call fcn.14000534c
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 9
mov qword [rsp + 0x78], 0xf
movsd xmm0, qword [str.clp64.dll]
movsd qword [rsp + 0x60], xmm0
movzx eax, byte [0x140007808]
mov byte [rsp + 0x68], al
mov byte [rsp + 0x69], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], 9
mov qword [rbp - 0x68], 0xf
movsd xmm0, qword [str.ida64.dll]
movsd qword [rbp - 0x80], xmm0
movzx eax, byte [0x140007818]
mov byte [rbp - 0x78], al
mov byte [rbp - 0x77], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], 9
mov qword [rbp - 0x48], 0xf
movsd xmm0, qword [str.pdb64.dll]
movsd qword [rbp - 0x60], xmm0
movzx eax, byte [0x140007828]
mov byte [rbp - 0x58], al
mov byte [rbp - 0x57], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], 0xe
mov qword [rbp - 0x28], 0xf
movsd xmm0, qword [str.eh_parse64.dll]
movsd qword [rbp - 0x40], xmm0
mov eax, dword [0x140007838]
mov dword [rbp - 0x38], eax
movzx eax, word [0x14000783c]
mov word [rbp - 0x34], ax
mov byte [rbp - 0x32], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], 9
mov qword [rbp - 8], 0xf
movsd xmm0, qword [str.dbg64.dll]
movsd qword [rbp - 0x20], xmm0
movzx eax, byte [0x140007848]
mov byte [rbp - 0x18], al
mov byte [rbp - 0x17], 0
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], 0xa
mov qword [rbp + 0x18], 0xf
movsd xmm0, qword [str.hexx64.dll]
movsd qword [rbp], xmm0
movzx eax, word [0x140007858]
mov word [rbp + 8], ax
mov byte [rbp + 0xa], 0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x150], xmm0
mov qword [rbp + 0x160], r15
mov ecx, 0xc0
call fcn.140005310
mov qword [rbp + 0x150], rax
mov qword [rbp + 0x158], rax
lea rcx, [rax + 0xc0]
mov qword [rbp + 0x160], rcx
lea rcx, [rbp + 0x150]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x150]
mov r8, rax
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x60]
call fcn.140005050
mov qword [rbp + 0x158], rax
lea r9, [0x140004a30]
mov edx, 0x20
lea r8d, [rdx - 0x1a]
lea rcx, [rsp + 0x60]
call fcn.14000534c
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], 0xb
mov qword [rsp + 0x58], 0xf
movsd xmm0, qword [str.OLLYDBG.EXE]
movsd qword [rsp + 0x40], xmm0
movzx eax, word [0x140007868]
mov word [rsp + 0x48], ax
movzx eax, byte [0x14000786a]
mov byte [rsp + 0x4a], al
mov byte [rsp + 0x4b], 0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x138], xmm0
mov qword [rbp + 0x148], r15
mov ecx, 0x20
call fcn.140005310
mov qword [rbp + 0x138], rax
mov qword [rbp + 0x140], rax
lea rcx, [rax + 0x20]
mov qword [rbp + 0x148], rcx
lea rcx, [rbp + 0x138]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x138]
mov r8, rax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x40]
call fcn.140005050
mov qword [rbp + 0x140], rax
lea r9, [0x140004a30]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rsp + 0x40]
call fcn.14000534c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], rax
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r15
mov qword [rbp + 0x58], 0xf
lea ecx, [rax + 0x20]
call fcn.140005310
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x50], 0x11
mov qword [rbp + 0x58], 0x1f
movups xmm0, xmmword [str.ProcessHacker.EXE]
movups xmmword [rax], xmm0
movzx ecx, byte [0x140007880]
mov byte [rax + 0x10], cl
mov byte [rax + 0x11], 0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], r15
mov ecx, 0x20
call fcn.140005310
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x128], rax
lea rcx, [rax + 0x20]
mov qword [rbp + 0x130], rcx
lea rcx, [rbp + 0x120]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x120]
mov r8, rax
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x40]
call fcn.140005050
mov qword [rbp + 0x128], rax
lea r9, [0x140004a30]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rbp + 0x40]
call fcn.14000534c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x108], xmm0
mov qword [rbp + 0x118], rax
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], 0xd
mov qword [rbp + 0x58], 0xf
movsd xmm0, qword [str.Wireshark.exe]
movsd qword [rbp + 0x40], xmm0
mov eax, dword [0x140007890]
mov dword [rbp + 0x48], eax
movzx eax, byte [0x140007894]
mov byte [rbp + 0x4c], al
mov byte [rbp + 0x4d], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x78], 0xf
mov ecx, 0x20
call fcn.140005310
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x70], 0x10
mov qword [rbp + 0x78], 0x1f
movups xmm0, xmmword [str.libwireshark.dll]
movups xmmword [rax], xmm0
mov byte [rax + 0x10], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], 0xe
mov qword [rbp + 0x98], 0xf
movsd xmm0, qword [str.libwiretap.dll]
movsd qword [rbp + 0x80], xmm0
mov eax, dword [0x1400078b8]
mov dword [rbp + 0x88], eax
movzx eax, word [0x1400078bc]
mov word [rbp + 0x8c], ax
mov byte [rbp + 0x8e], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], 0xb
mov qword [rbp + 0xb8], 0xf
movsd xmm0, qword [str.dumpcap.exe]
movsd qword [rbp + 0xa0], xmm0
movzx eax, word [0x1400078c8]
mov word [rbp + 0xa8], ax
movzx eax, byte [0x1400078ca]
mov byte [rbp + 0xaa], al
mov byte [rbp + 0xab], 0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x108], xmm0
mov qword [rbp + 0x118], r15
mov ecx, 0x80
call fcn.140005310
mov qword [rbp + 0x108], rax
mov qword [rbp + 0x110], rax
lea rcx, [rax + 0x80]
mov qword [rbp + 0x118], rcx
lea rcx, [rbp + 0x108]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x108]
mov r8, rax
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x40]
call fcn.140005050
mov qword [rbp + 0x110], rax
lea r9, [0x140004a30]
mov edx, 0x20
lea r8d, [rdx - 0x1c]
lea rcx, [rbp + 0x40]
call fcn.14000534c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], rax
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 0xf
mov qword [rsp + 0x78], 0xf
movsd xmm0, qword [str.TitanEngine.dll]
movsd qword [rsp + 0x60], xmm0
mov eax, dword [0x1400078d8]
mov dword [rsp + 0x68], eax
movzx eax, word [0x1400078dc]
mov word [rsp + 0x6c], ax
movzx eax, byte [0x1400078de]
mov byte [rsp + 0x6e], al
mov byte [rsp + 0x6f], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], 0xc
mov qword [rbp - 0x68], 0xf
movsd xmm0, qword [str.Themida.dp64]
movsd qword [rbp - 0x80], xmm0
mov eax, dword [0x1400078e8]
mov dword [rbp - 0x78], eax
mov byte [rbp - 0x74], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], 0xe
mov qword [rbp - 0x48], 0xf
movsd xmm0, qword [str.HyperHide.dp64]
movsd qword [rbp - 0x60], xmm0
mov eax, dword [0x1400078f8]
mov dword [rbp - 0x58], eax
movzx eax, word [0x1400078fc]
mov word [rbp - 0x54], ax
mov byte [rbp - 0x52], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], 0xf
mov ecx, 0x20
call fcn.140005310
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x30], 0x1b
mov qword [rbp - 0x28], 0x1f
movups xmm0, xmmword [str.ScyllaHideX64DBGPlugin.dp64]
movups xmmword [rax], xmm0
movsd xmm1, qword [0x140007910]
movsd qword [rax + 0x10], xmm1
movzx ecx, word [0x140007918]
mov word [rax + 0x18], cx
movzx ecx, byte [0x14000791a]
mov byte [rax + 0x1a], cl
mov byte [rax + 0x1b], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
mov qword [rbp - 0x10], 0xd
mov qword [rbp - 8], 0xf
movsd xmm0, qword [str.x64bridge.dll]
movsd qword [rbp - 0x20], xmm0
mov eax, dword [0x140007928]
mov dword [rbp - 0x18], eax
movzx eax, byte [0x14000792c]
mov byte [rbp - 0x14], al
mov byte [rbp - 0x13], 0
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], 0xa
mov qword [rbp + 0x18], 0xf
movsd xmm0, qword [str.x64dbg.dll]
movsd qword [rbp], xmm0
movzx eax, word [0x140007938]
mov word [rbp + 8], ax
mov byte [rbp + 0xa], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], 0xa
mov qword [rbp + 0x38], 0xf
movsd xmm0, qword [str.x64gui.dll]
movsd qword [rbp + 0x20], xmm0
movzx eax, word [0x140007948]
mov word [rbp + 0x28], ax
mov byte [rbp + 0x2a], 0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], r15
mov ecx, 0xe0
call fcn.140005310
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], rax
lea rcx, [rax + 0xe0]
mov qword [rbp + 0x100], rcx
lea rcx, [rbp + 0xf0]
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0xf0]
mov r8, rax
lea rdx, [rbp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.140005050
mov qword [rbp + 0xf8], rax
lea r9, [0x140004a30]
mov edx, 0x20
lea r8d, [rdx - 0x19]
lea rcx, [rsp + 0x60]
call fcn.14000534c
mov r12, qword [rbp + 0x198]
cmp r12, qword [rbp + 0x1a0]
je 0x140003c76
mov r13, r12
cmp qword [r12 + 0x18], 0x10
jb 0x140003bcf
mov r13, qword [r12]
lea rax, [rbp + 0xd0]
cmp rsi, 0x10
cmovae rax, r14
mov qword [rsp + 0x20], rax
mov r15, qword [r12 + 0x10]
cmp r15, rdi
ja 0x140003c65
mov rcx, rdi
sub rcx, r15
test r15, r15
je 0x14000433d
inc rcx
add rcx, rax
mov qword [rsp + 0x30], rcx
movsx edx, byte [r13]
mov r8, rcx
sub r8, rax
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140003c65
mov r8, r15
mov rdx, r13
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140003c56
inc rbx
mov r8, qword [rsp + 0x30]
sub r8, rbx
movsx edx, byte [r13]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140003c22
jmp 0x140003c65
sub rbx, qword [rsp + 0x20]
cmp rbx, 0xffffffffffffffff
jne 0x14000433d
add r12, 0x20
cmp r12, qword [rbp + 0x1a0]
jne 0x140003bc0
mov r12, qword [rbp + 0x180]
cmp r12, qword [rbp + 0x188]
je 0x140003d46
nop word [rax + rax]
mov r13, r12
cmp qword [r12 + 0x18], 0x10
jb 0x140003c9f
mov r13, qword [r12]
lea rax, [rbp + 0xd0]
cmp rsi, 0x10
cmovae rax, r14
mov qword [rsp + 0x30], rax
mov r15, qword [r12 + 0x10]
cmp r15, rdi
ja 0x140003d35
mov rcx, rdi
sub rcx, r15
test r15, r15
je 0x140004397
inc rcx
add rcx, rax
mov qword [rsp + 0x20], rcx
movsx edx, byte [r13]
mov r8, rcx
sub r8, rax
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140003d35
mov r8, r15
mov rdx, r13
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140003d26
inc rbx
mov r8, qword [rsp + 0x20]
sub r8, rbx
movsx edx, byte [r13]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140003cf2
jmp 0x140003d35
sub rbx, qword [rsp + 0x30]
cmp rbx, 0xffffffffffffffff
jne 0x140004397
add r12, 0x20
cmp r12, qword [rbp + 0x188]
jne 0x140003c90
mov r12, qword [rbp + 0x168]
cmp r12, qword [rbp + 0x170]
je 0x140003e16
nop word [rax + rax]
mov r13, r12
cmp qword [r12 + 0x18], 0x10
jb 0x140003d6f
mov r13, qword [r12]
lea rax, [rbp + 0xd0]
cmp rsi, 0x10
cmovae rax, r14
mov qword [rsp + 0x30], rax
mov r15, qword [r12 + 0x10]
cmp r15, rdi
ja 0x140003e05
mov rcx, rdi
sub rcx, r15
test r15, r15
je 0x1400043f1
inc rcx
add rcx, rax
mov qword [rsp + 0x20], rcx
movsx edx, byte [r13]
mov r8, rcx
sub r8, rax
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140003e05
mov r8, r15
mov rdx, r13
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140003df6
inc rbx
mov r8, qword [rsp + 0x20]
sub r8, rbx
movsx edx, byte [r13]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140003dc2
jmp 0x140003e05
sub rbx, qword [rsp + 0x30]
cmp rbx, 0xffffffffffffffff
jne 0x1400043f1
add r12, 0x20
cmp r12, qword [rbp + 0x170]
jne 0x140003d60
mov r12, qword [rbp + 0x150]
cmp r12, qword [rbp + 0x158]
je 0x140003ee6
nop word [rax + rax]
mov r13, r12
cmp qword [r12 + 0x18], 0x10
jb 0x140003e3f
mov r13, qword [r12]
lea rax, [rbp + 0xd0]
cmp rsi, 0x10
cmovae rax, r14
mov qword [rsp + 0x30], rax
mov r15, qword [r12 + 0x10]
cmp r15, rdi
ja 0x140003ed5
mov rcx, rdi
sub rcx, r15
test r15, r15
je 0x14000444b
inc rcx
add rcx, rax
mov qword [rsp + 0x20], rcx
movsx edx, byte [r13]
mov r8, rcx
sub r8, rax
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140003ed5
mov r8, r15
mov rdx, r13
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140003ec6
inc rbx
mov r8, qword [rsp + 0x20]
sub r8, rbx
movsx edx, byte [r13]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140003e92
jmp 0x140003ed5
sub rbx, qword [rsp + 0x30]
cmp rbx, 0xffffffffffffffff
jne 0x14000444b
add r12, 0x20
cmp r12, qword [rbp + 0x158]
jne 0x140003e30
mov r12, qword [rbp + 0x138]
cmp r12, qword [rbp + 0x140]
je 0x140003fb6
nop word [rax + rax]
mov r13, r12
cmp qword [r12 + 0x18], 0x10
jb 0x140003f0f
mov r13, qword [r12]
lea rax, [rbp + 0xd0]
cmp rsi, 0x10
cmovae rax, r14
mov qword [rsp + 0x30], rax
mov r15, qword [r12 + 0x10]
cmp r15, rdi
ja 0x140003fa5
mov rcx, rdi
sub rcx, r15
test r15, r15
je 0x1400044a5
inc rcx
add rcx, rax
mov qword [rsp + 0x20], rcx
movsx edx, byte [r13]
mov r8, rcx
sub r8, rax
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140003fa5
mov r8, r15
mov rdx, r13
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140003f96
inc rbx
mov r8, qword [rsp + 0x20]
sub r8, rbx
movsx edx, byte [r13]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140003f62
jmp 0x140003fa5
sub rbx, qword [rsp + 0x30]
cmp rbx, 0xffffffffffffffff
jne 0x1400044a5
add r12, 0x20
cmp r12, qword [rbp + 0x140]
jne 0x140003f00
mov r12, qword [rbp + 0x120]
cmp r12, qword [rbp + 0x128]
je 0x140004086
nop word [rax + rax]
mov r13, r12
cmp qword [r12 + 0x18], 0x10
jb 0x140003fdf
mov r13, qword [r12]
lea rax, [rbp + 0xd0]
cmp rsi, 0x10
cmovae rax, r14
mov qword [rsp + 0x30], rax
mov r15, qword [r12 + 0x10]
cmp r15, rdi
ja 0x140004075
mov rcx, rdi
sub rcx, r15
test r15, r15
je 0x1400044ff
inc rcx
add rcx, rax
mov qword [rsp + 0x20], rcx
movsx edx, byte [r13]
mov r8, rcx
sub r8, rax
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140004075
mov r8, r15
mov rdx, r13
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140004066
inc rbx
mov r8, qword [rsp + 0x20]
sub r8, rbx
movsx edx, byte [r13]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140004032
jmp 0x140004075
sub rbx, qword [rsp + 0x30]
cmp rbx, 0xffffffffffffffff
jne 0x1400044ff
add r12, 0x20
cmp r12, qword [rbp + 0x128]
jne 0x140003fd0
mov r12, qword [rbp + 0x108]
cmp r12, qword [rbp + 0x110]
je 0x140004156
nop word [rax + rax]
mov r13, r12
cmp qword [r12 + 0x18], 0x10
jb 0x1400040af
mov r13, qword [r12]
lea rax, [rbp + 0xd0]
cmp rsi, 0x10
cmovae rax, r14
mov qword [rsp + 0x30], rax
mov r15, qword [r12 + 0x10]
cmp r15, rdi
ja 0x140004145
mov rcx, rdi
sub rcx, r15
test r15, r15
je 0x140004559
inc rcx
add rcx, rax
mov qword [rsp + 0x20], rcx
movsx edx, byte [r13]
mov r8, rcx
sub r8, rax
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140004145
mov r8, r15
mov rdx, r13
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140004136
inc rbx
mov r8, qword [rsp + 0x20]
sub r8, rbx
movsx edx, byte [r13]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140004102
jmp 0x140004145
sub rbx, qword [rsp + 0x30]
cmp rbx, 0xffffffffffffffff
jne 0x140004559
add r12, 0x20
cmp r12, qword [rbp + 0x110]
jne 0x1400040a0
mov r12, qword [rbp + 0xf0]
cmp r12, qword [rbp + 0xf8]
je 0x140004226
nop word [rax + rax]
mov r13, r12
cmp qword [r12 + 0x18], 0x10
jb 0x14000417f
mov r13, qword [r12]
lea rax, [rbp + 0xd0]
cmp rsi, 0x10
cmovae rax, r14
mov qword [rsp + 0x30], rax
mov r15, qword [r12 + 0x10]
cmp r15, rdi
ja 0x140004215
mov rcx, rdi
sub rcx, r15
test r15, r15
je 0x1400045b0
inc rcx
add rcx, rax
mov qword [rsp + 0x20], rcx
movsx edx, byte [r13]
mov r8, rcx
sub r8, rax
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140004215
mov r8, r15
mov rdx, r13
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140004206
inc rbx
mov r8, qword [rsp + 0x20]
sub r8, rbx
movsx edx, byte [r13]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x1400041d2
jmp 0x140004215
sub rbx, qword [rsp + 0x30]
cmp rbx, 0xffffffffffffffff
jne 0x1400045b0
add r12, 0x20
cmp r12, qword [rbp + 0xf8]
jne 0x140004170
lea rcx, [rbp + 0xf0]
call fcn.140004ad0
nop
lea rcx, [rbp + 0x108]
call fcn.140004ad0
nop
lea rcx, [rbp + 0x120]
call fcn.140004ad0
nop
lea rcx, [rbp + 0x138]
call fcn.140004ad0
nop
lea rcx, [rbp + 0x150]
call fcn.140004ad0
nop
lea rcx, [rbp + 0x168]
call fcn.140004ad0
nop
lea rcx, [rbp + 0x180]
call fcn.140004ad0
nop
lea rcx, [rbp + 0x198]
call fcn.140004ad0
nop
cmp rsi, 0x10
jb 0x1400042c5
lea rdx, [rsi + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400042bd
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400046c6
mov rcx, r14
call fcn.14000541c
mov r12d, 0x16
movabs r13, 0x8000000000000000
movabs r14, 0x7fffffffffffffff
xor r15d, r15d
mov rbx, qword [rbp + 0xc0]
mov ecx, dword [rsp + 0x38]
inc ecx
mov dword [rsp + 0x38], ecx
mov eax, dword [rbp + 0xc8]
shr eax, 3
cmp ecx, eax
jb 0x140002eb0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x22c0]
xor rcx, rsp
call fcn.1400052f0
lea r11, [rsp + 0x23d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rdx, str.Loaded_DLL_from_Process
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004be0
mov rcx, rax
mov edx, dword [rsp + 0x28]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140007630]
call fcn.140004be0
mov rcx, rax
lea rdx, [rbp + 0x21b0]
call fcn.140004be0
mov rcx, rax
lea rdx, [0x140004db0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Everything_detected
jmp 0x140004605
lea rdx, str.Loaded_DLL_from_Process
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004be0
mov rcx, rax
mov edx, dword [rsp + 0x28]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140007630]
call fcn.140004be0
mov rcx, rax
lea rdx, [rbp + 0x21b0]
call fcn.140004be0
mov rcx, rax
lea rdx, [0x140004db0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Fiddler_detected
jmp 0x140004605
lea rdx, str.Loaded_DLL_from_Process
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004be0
mov rcx, rax
mov edx, dword [rsp + 0x28]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140007630]
call fcn.140004be0
mov rcx, rax
lea rdx, [rbp + 0x21b0]
call fcn.140004be0
mov rcx, rax
lea rdx, [0x140004db0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.HttpDbg_detected
jmp 0x140004605
lea rdx, str.Loaded_DLL_from_Process
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004be0
mov rcx, rax
mov edx, dword [rsp + 0x28]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140007630]
call fcn.140004be0
mov rcx, rax
lea rdx, [rbp + 0x21b0]
call fcn.140004be0
mov rcx, rax
lea rdx, [0x140004db0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.ida_Pro_detected
jmp 0x140004605
lea rdx, str.Loaded_DLL_from_Process
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004be0
mov rcx, rax
mov edx, dword [rsp + 0x28]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140007630]
call fcn.140004be0
mov rcx, rax
lea rdx, [rbp + 0x21b0]
call fcn.140004be0
mov rcx, rax
lea rdx, [0x140004db0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.Olly_Dbg_detected
jmp 0x140004605
lea rdx, str.Loaded_DLL_from_Process
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004be0
mov rcx, rax
mov edx, dword [rsp + 0x28]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140007630]
call fcn.140004be0
mov rcx, rax
lea rdx, [rbp + 0x21b0]
call fcn.140004be0
mov rcx, rax
lea rdx, [0x140004db0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.process_Hacker_detected
jmp 0x140004605
lea rdx, str.Loaded_DLL_from_Process
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004be0
mov rcx, rax
mov edx, dword [rsp + 0x28]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140007630]
call fcn.140004be0
mov rcx, rax
lea rdx, [rbp + 0x21b0]
call fcn.140004be0
mov rcx, rax
lea rdx, [0x140004db0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.WireShark_detected
jmp 0x140004605
lea rdx, str.Loaded_DLL_from_Process
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004be0
mov rcx, rax
mov edx, dword [rsp + 0x28]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140007630]
call fcn.140004be0
mov rcx, rax
lea rdx, [rbp + 0x21b0]
call fcn.140004be0
mov rcx, rax
lea rdx, [0x140004db0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rdx, str.x64dbg_detected
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004be0
lea rdx, [0x140004db0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rbp + 0xf0]
call fcn.140004ad0
nop
lea rcx, [rbp + 0x108]
call fcn.140004ad0
nop
lea rcx, [rbp + 0x120]
call fcn.140004ad0
nop
lea rcx, [rbp + 0x138]
call fcn.140004ad0
nop
lea rcx, [rbp + 0x150]
call fcn.140004ad0
nop
lea rcx, [rbp + 0x168]
call fcn.140004ad0
nop
lea rcx, [rbp + 0x180]
call fcn.140004ad0
nop
lea rcx, [rbp + 0x198]
call fcn.140004ad0
nop
cmp rsi, 0x10
jb 0x14000430d
lea rdx, [rsi + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400046b9
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400046c6
mov rcx, r14
call fcn.14000541c
jmp 0x14000430d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001100
int3
call fcn.1400011a0
int3