Function at 0x140054dd0
Capabilities:
Encode data using xor
Enumerate processes

Disassembly:
mov r11, rsp
mov qword [r11 + 0x10], rsi
push rdi
sub rsp, 0x220
movaps xmmword [r11 - 0x18], xmm6
movaps xmmword [r11 - 0x28], xmm7
mov rax, qword [0x1400f20c0]
xor rax, rsp
mov qword [rsp + 0x1f0], rax
xor esi, esi
mov qword [r11 + 8], rbx
mov qword [rsp + 0x30], rsi
lea rcx, str..83040329_923403830
mov dword [rsp + 0x28], esi
xor r9d, r9d
mov edx, 0xc0000000
mov dword [rsp + 0x20], 3
mov r8d, 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, dword [reloc.WS2_32.dll_accept]
movdqa xmm6, xmmword [0x1400dfa10]
mov qword [0x14010f168], rax
inc rax
test rax, 0xfffffffffffffffe
jne 0x14005528b
xor edx, edx
mov cl, 0x45
call fcn.140043520
mov edx, 1
mov byte [rsp + 0x40], al
mov cl, WSAStartup
call fcn.140043520
mov edx, 2
mov byte [rsp + 0x41], al
call fcn.140043520
mov edx, 3
mov byte [rsp + 0x42], al
mov cl, reloc.WLDAP32.dll_Ordinal_79
call fcn.140043520
mov edx, 4
mov byte [rsp + 0x43], al
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140043520
mov edx, 5
mov byte [rsp + 0x44], al
mov cl, 0x49
call fcn.140043520
mov edx, 6
mov byte [rsp + 0x45], al
mov cl, WSAGetLastError
call fcn.140043520
mov edx, 7
mov byte [rsp + 0x46], al
mov cl, 0x69
call fcn.140043520
mov edx, 8
mov byte [rsp + 0x47], al
mov cl, reloc.WS2_32.dll_WSACleanup
call fcn.140043520
mov edx, 9
mov byte [rsp + 0x48], al
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140043520
mov edx, 0xa
mov byte [rsp + 0x49], al
mov cl, 0x44
call fcn.140043520
mov edx, ntohl
mov byte [rsp + 0x4a], al
mov cl, WSAStartup
call fcn.140043520
mov edx, ntohl
mov byte [rsp + 0x4b], al
mov cl, 0x69
call fcn.140043520
mov edx, reloc.WS2_32.dll_listen
mov byte [rsp + 0x4c], al
mov cl, 0x76
call fcn.140043520
mov edx, reloc.WS2_32.dll_ntohl
mov byte [rsp + 0x4d], al
mov cl, 0x65
call fcn.140043520
mov edx, reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x4e], al
mov cl, WSAStartup
call fcn.140043520
mov edx, reloc.WS2_32.dll_recv
mov byte [rsp + 0x4f], al
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140043520
mov edx, reloc.WS2_32.dll_recvfrom
mov byte [rsp + 0x50], al
mov cl, reloc.WLDAP32.dll_Ordinal_79
call fcn.140043520
mov edx, reloc.WS2_32.dll_select
mov byte [rsp + 0x51], al
mov cl, reloc.WS2_32.dll_WSASetLastError
call fcn.140043520
mov edx, reloc.WS2_32.dll_send
mov byte [rsp + 0x52], al
mov cl, 0x65
call fcn.140043520
mov byte [rsp + 0x53], al
mov edx, reloc.WS2_32.dll_sendto
mov cl, WSAGetLastError
call fcn.140043520
mov edx, reloc.WS2_32.dll_setsockopt
mov byte [rsp + 0x54], al
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140043520
mov edx, reloc.WLDAP32.dll_Ordinal_22
mov byte [rsp + 0x55], al
mov cl, 0x54
call fcn.140043520
mov edx, reloc.WS2_32.dll_socket
mov byte [rsp + 0x56], al
mov cl, 0x69
call fcn.140043520
mov edx, Ordinal_26
mov byte [rsp + 0x57], al
mov cl, 0x63
call fcn.140043520
mov edx, Ordinal_26
mov byte [rsp + 0x58], al
mov cl, 0x6b
call fcn.140043520
mov edx, reloc.WLDAP32.dll_Ordinal_26
mov byte [rsp + 0x59], al
mov cl, reloc.WS2_32.dll_WSACleanup
call fcn.140043520
mov edx, reloc.WLDAP32.dll_Ordinal_27
mov byte [rsp + 0x5a], al
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140043520
mov edx, Ordinal_32
mov byte [rsp + 0x5b], al
mov cl, 0x46
call fcn.140043520
mov edx, Ordinal_32
mov byte [rsp + 0x5c], al
mov cl, reloc.WS2_32.dll_WSAGetLastError
call fcn.140043520
mov edx, reloc.WLDAP32.dll_Ordinal_30
mov byte [rsp + 0x5d], al
mov cl, WSAStartup
call fcn.140043520
mov edx, Ordinal_32
mov byte [rsp + 0x5e], al
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140043520
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov byte [rsp + 0x5f], al
mov cl, 0x53
call fcn.140043520
mov edx, reloc.WLDAP32.dll_Ordinal_33
mov byte [rsp + 0x60], al
mov cl, 0x75
call fcn.140043520
mov edx, Ordinal_35
mov byte [rsp + 0x61], al
mov cl, reloc.WS2_32.dll_WSASetLastError
call fcn.140043520
mov edx, reloc.WLDAP32.dll_Ordinal_35
mov byte [rsp + 0x62], al
mov cl, reloc.WS2_32.dll_WSAGetLastError
call fcn.140043520
mov edx, 0x24
mov byte [rsp + 0x63], al
mov cl, WSAStartup
call fcn.140043520
mov edx, Ordinal_41
mov byte [rsp + 0x64], al
mov cl, reloc.WS2_32.dll_WSACleanup
call fcn.140043520
mov edx, Ordinal_41
mov byte [rsp + 0x65], al
mov cl, 0xa
call fcn.140043520
mov byte [rsp + 0x66], al
mov r9d, esi
xor eax, eax
mov byte [rsp + 0x67], al
cmp edi, 6
jl 0x140055250
movdqa xmm1, xmmword [0x1400dfe10]
movdqa xmm0, xmmword [0x1400dfe50]
movdqa xmm7, xmmword [0x1400dfa70]
movdqa xmmword [rsp + 0x70], xmm1
mov edx, dword [rsp + 0x70]
movdqa xmmword [rsp + 0x80], xmm0
mov r8d, dword [rsp + 0x80]
movsxd rcx, r9d
lea eax, [r9 + 4]
movd xmm1, r9d
pshufd xmm1, xmm1, 0
paddd xmm1, xmm7
movd xmm0, edx
pshufb xmm1, xmm6
vpmovzxbw ymm0, xmm0
movd xmm4, r8d
vpmovzxbw ymm1, xmm1
vpmullw ymm1, ymm1, ymm0
movd xmm0, dword [rsp + rcx + 0x40]
vpmovzxwd zmm2, ymm1
vpmovdb xmm3, zmm2
psubb xmm4, xmm3
movd xmm1, eax
pshufd xmm1, xmm1, 0
lea eax, [r9 + 8]
xorps xmm4, xmm0
movd xmm5, r8d
paddd xmm1, xmm7
movd dword [rsp + rcx + 0x40], xmm4
pshufb xmm1, xmm6
movd xmm0, edx
vpmovzxbw ymm1, xmm1
vpmovzxbw ymm0, xmm0
vpmullw ymm1, ymm1, ymm0
movd xmm0, dword [rsp + rcx + 0x44]
vpmovzxwd zmm2, ymm1
vpmovdb xmm3, zmm2
movd xmm1, eax
lea eax, [r9 + 0xc]
pshufd xmm1, xmm1, 0
add r9d, 0x10
movd xmm4, r8d
paddd xmm1, xmm7
psubb xmm4, xmm3
xorps xmm4, xmm0
movd xmm0, edx
movd dword [rsp + rcx + 0x44], xmm4
movd xmm4, r8d
pshufb xmm1, xmm6
vpmovzxbw ymm0, xmm0
vpmovzxbw ymm1, xmm1
vpmullw ymm1, ymm1, ymm0
movd xmm0, dword [rsp + rcx + 0x48]
vpmovzxwd zmm2, ymm1
movd xmm1, eax
pshufd xmm1, xmm1, 0
paddd xmm1, xmm7
vpmovdb xmm3, zmm2
psubb xmm5, xmm3
xorps xmm5, xmm0
movd xmm0, edx
movd dword [rsp + rcx + 0x48], xmm5
pshufb xmm1, xmm6
vpmovzxbw ymm0, xmm0
vpmovzxbw ymm1, xmm1
vpmullw ymm1, ymm1, ymm0
movd xmm0, dword [rsp + rcx + 0x4c]
vpmovzxwd zmm2, ymm1
vpmovdb xmm3, zmm2
psubb xmm4, xmm3
xorps xmm4, xmm0
movd dword [rsp + rcx + 0x4c], xmm4
cmp r9d, 0x20
jb 0x140055101
cmp r9d, 0x27
jae 0x140055275
nop word [rax + rax]
movsxd rax, r9d
lea r8, [rsp + 0x40]
add r8, rax
movsx eax, r9b
imul edx, eax, 0x6c
inc r9d
mov eax, 0xffffffd4
sub al, dl
xor byte [r8], al
cmp r9d, 0x27
jb 0x140055250
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x67], sil
call fcn.140059d20
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
lea rdx, [rsp + 0xc0]
mov dword [rsp + 0xc0], 0x130
mov rcx, rax
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400552f2
nop dword [rax + rax]
lea rdx, str.FortniteClient_Win64_Shipping.exe
lea rcx, [rsp + 0xec]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x140055a95
lea rdx, [rsp + 0xc0]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400552c0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [0x14010f170], esi
xor edx, edx
mov cl, 0x47
call fcn.140043520
mov edx, 1
mov byte [rsp + 0xa0], al
mov cl, 0x61
call fcn.140043520
mov edx, 2
mov byte [rsp + 0xa1], al
mov cl, 0x6d
call fcn.140043520
mov edx, 3
mov byte [rsp + 0xa2], al
mov cl, 0x65
call fcn.140043520
mov edx, 4
mov byte [rsp + 0xa3], al
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140043520
mov edx, 5
mov byte [rsp + 0xa4], al
mov cl, Ordinal_79
call fcn.140043520
mov edx, 6
mov byte [rsp + 0xa5], al
mov cl, reloc.WS2_32.dll_WSAGetLastError
call fcn.140043520
mov edx, 7
mov byte [rsp + 0xa6], al
mov cl, reloc.WS2_32.dll_WSACleanup
call fcn.140043520
mov edx, 8
mov byte [rsp + 0xa7], al
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140043520
mov edx, 9
mov byte [rsp + 0xa8], al
mov cl, reloc.WLDAP32.dll_Ordinal_79
call fcn.140043520
mov edx, 0xa
mov byte [rsp + 0xa9], al
mov cl, reloc.WS2_32.dll_WSASetLastError
call fcn.140043520
mov edx, ntohl
mov byte [rsp + 0xaa], al
mov cl, 0x65
call fcn.140043520
mov edx, ntohl
mov byte [rsp + 0xab], al
mov cl, WSAGetLastError
call fcn.140043520
mov edx, reloc.WS2_32.dll_listen
mov byte [rsp + 0xac], al
mov cl, 0xa
call fcn.140043520
mov byte [rsp + 0xad], al
mov ecx, esi
xor eax, eax
mov byte [rsp + 0xae], al
cmp edi, 6
jl 0x1400554b0
movdqa xmm1, xmmword [0x1400dfe10]
movdqa xmm0, xmmword [0x1400dfe50]
movdqa xmm5, xmmword [0x1400dfa70]
movdqa xmmword [rsp + 0x70], xmm1
mov edx, dword [rsp + 0x70]
movdqa xmmword [rsp + 0x80], xmm0
mov r8d, dword [rsp + 0x80]
nop
movd xmm1, ecx
pshufd xmm1, xmm1, 0
paddd xmm1, xmm5
movsxd rax, ecx
pshufb xmm1, xmm6
add ecx, 4
movd xmm0, edx
movd xmm4, r8d
vpmovzxbw ymm0, xmm0
vpmovzxbw ymm1, xmm1
vpmullw ymm1, ymm1, ymm0
movd xmm0, dword [rsp + rax + 0xa0]
vpmovzxwd zmm2, ymm1
vpmovdb xmm3, zmm2
psubb xmm4, xmm3
xorps xmm4, xmm0
movd dword [rsp + rax + 0xa0], xmm4
cmp ecx, 0xc
jb 0x140055450
cmp ecx, 0xe
jae 0x1400554d5
nop
movsxd rax, ecx
lea r8, [rsp + 0xa0]
add r8, rax
movsx eax, cl
imul edx, eax, 0x6c
inc ecx
mov eax, 0xffffffd4
sub al, dl
xor byte [r8], al
cmp ecx, 0xe
jb 0x1400554b0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0xa0]
mov byte [rsp + 0xae], sil
call fcn.140059d20
mov eax, dword [0x14010f170]
mov rcx, qword [0x14010f168]
lea r8, [rsp + 0x90]
mov qword [rsp + 0x38], rsi
mov r9d, reloc.WS2_32.dll_recv
mov dword [rsp + 0x94], eax
mov edx, 0x226600
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x98], rax
mov qword [rsp + 0x20], rsi
mov qword [rsp + 0xb0], rsi
mov dword [rsp + 0x90], 0x69b5b66
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0x230]
mov qword [0x14010f190], rax
test rax, rax
jne 0x140055994
xor edx, edx
mov cl, 0x45
call fcn.140043520
mov edx, 1
mov byte [rsp + 0x40], al
mov cl, WSAStartup
call fcn.140043520
mov edx, 2
mov byte [rsp + 0x41], al
call fcn.140043520
mov edx, 3
mov byte [rsp + 0x42], al
mov cl, reloc.WLDAP32.dll_Ordinal_79
call fcn.140043520
mov edx, 4
mov byte [rsp + 0x43], al
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140043520
mov edx, 5
mov byte [rsp + 0x44], al
mov cl, 0x49
call fcn.140043520
mov edx, 6
mov byte [rsp + 0x45], al
mov cl, WSAGetLastError
call fcn.140043520
mov edx, 7
mov byte [rsp + 0x46], al
mov cl, 0x69
call fcn.140043520
mov edx, 8
mov byte [rsp + 0x47], al
mov cl, reloc.WS2_32.dll_WSACleanup
call fcn.140043520
mov edx, 9
mov byte [rsp + 0x48], al
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140043520
mov edx, 0xa
mov byte [rsp + 0x49], al
mov cl, 0x43
call fcn.140043520
mov edx, ntohl
mov byte [rsp + 0x4a], al
mov cl, 0x68
call fcn.140043520
mov edx, ntohl
mov byte [rsp + 0x4b], al
mov cl, 0x65
call fcn.140043520
mov edx, reloc.WS2_32.dll_listen
mov byte [rsp + 0x4c], al
mov cl, 0x61
call fcn.140043520
mov edx, reloc.WS2_32.dll_ntohl
mov byte [rsp + 0x4d], al
mov cl, reloc.WS2_32.dll_WSACleanup
call fcn.140043520
mov edx, reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x4e], al
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140043520
mov edx, reloc.WS2_32.dll_recv
mov byte [rsp + 0x4f], al
mov cl, reloc.WLDAP32.dll_Ordinal_79
call fcn.140043520
mov edx, reloc.WS2_32.dll_recvfrom
mov byte [rsp + 0x50], al
mov cl, reloc.WS2_32.dll_WSASetLastError
call fcn.140043520
mov edx, reloc.WS2_32.dll_select
mov byte [rsp + 0x51], al
mov cl, 0x65
call fcn.140043520
mov edx, reloc.WS2_32.dll_send
mov byte [rsp + 0x52], al
mov cl, WSAGetLastError
call fcn.140043520
mov byte [rsp + 0x53], al
mov edx, reloc.WS2_32.dll_sendto
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140043520
mov edx, reloc.WS2_32.dll_setsockopt
mov byte [rsp + 0x54], al
mov cl, 0x54
call fcn.140043520
mov edx, reloc.WLDAP32.dll_Ordinal_22
mov byte [rsp + 0x55], al
mov cl, 0x69
call fcn.140043520
mov edx, reloc.WS2_32.dll_socket
mov byte [rsp + 0x56], al
mov cl, 0x63
call fcn.140043520
mov edx, Ordinal_26
mov byte [rsp + 0x57], al
mov cl, 0x6b
call fcn.140043520
mov edx, Ordinal_26
mov byte [rsp + 0x58], al
mov cl, reloc.WS2_32.dll_WSACleanup
call fcn.140043520
mov edx, reloc.WLDAP32.dll_Ordinal_26
mov byte [rsp + 0x59], al
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140043520
mov edx, reloc.WLDAP32.dll_Ordinal_27
mov byte [rsp + 0x5a], al
mov cl, 0x46
call fcn.140043520
mov edx, Ordinal_32
mov byte [rsp + 0x5b], al
mov cl, reloc.WS2_32.dll_WSAGetLastError
call fcn.140043520
mov edx, Ordinal_32
mov byte [rsp + 0x5c], al
mov cl, WSAStartup
call fcn.140043520
mov edx, reloc.WLDAP32.dll_Ordinal_30
mov byte [rsp + 0x5d], al
mov cl, reloc.WLDAP32.dll_Ordinal_32
call fcn.140043520
mov edx, Ordinal_32
mov byte [rsp + 0x5e], al
mov cl, 0x53
call fcn.140043520
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov byte [rsp + 0x5f], al
mov cl, 0x75
call fcn.140043520
mov edx, reloc.WLDAP32.dll_Ordinal_33
mov byte [rsp + 0x60], al
mov cl, reloc.WS2_32.dll_WSASetLastError
call fcn.140043520
mov edx, Ordinal_35
mov byte [rsp + 0x61], al
mov cl, reloc.WS2_32.dll_WSAGetLastError
call fcn.140043520
mov edx, reloc.WLDAP32.dll_Ordinal_35
mov byte [rsp + 0x62], al
mov cl, WSAStartup
call fcn.140043520
mov edx, 0x24
mov byte [rsp + 0x63], al
mov cl, reloc.WS2_32.dll_WSACleanup
call fcn.140043520
mov edx, Ordinal_41
mov byte [rsp + 0x64], al
mov cl, 0xa
call fcn.140043520
mov byte [rsp + 0x65], al
xor eax, eax
mov byte [rsp + 0x66], al
cmp edi, 6
jl 0x140055961
movdqa xmm1, xmmword [0x1400dfe10]
movdqa xmm0, xmmword [0x1400dfe50]
movdqa xmm7, xmmword [0x1400dfa70]
movdqa xmmword [rsp + 0x70], xmm1
mov r8d, dword [rsp + 0x70]
movdqa xmmword [rsp + 0x80], xmm0
mov r9d, dword [rsp + 0x80]
nop dword [rax]
nop word [rax + rax]
movsxd rdx, eax
lea ecx, [rax + 4]
movd xmm1, eax
pshufd xmm1, xmm1, 0
paddd xmm1, xmm7
movd xmm0, r8d
pshufb xmm1, xmm6
vpmovzxbw ymm0, xmm0
movd xmm4, r9d
vpmovzxbw ymm1, xmm1
vpmullw ymm1, ymm1, ymm0
movd xmm0, dword [rsp + rdx + 0x40]
vpmovzxwd zmm2, ymm1
vpmovdb xmm3, zmm2
psubb xmm4, xmm3
movd xmm1, ecx
pshufd xmm1, xmm1, 0
lea ecx, [rax + 8]
xorps xmm4, xmm0
movd xmm5, r9d
paddd xmm1, xmm7
movd dword [rsp + rdx + 0x40], xmm4
pshufb xmm1, xmm6
movd xmm0, r8d
vpmovzxbw ymm1, xmm1
vpmovzxbw ymm0, xmm0
vpmullw ymm1, ymm1, ymm0
movd xmm0, dword [rsp + rdx + 0x44]
vpmovzxwd zmm2, ymm1
vpmovdb xmm3, zmm2
movd xmm1, ecx
lea ecx, [rax + 0xc]
pshufd xmm1, xmm1, 0
add eax, 0x10
movd xmm4, r9d
paddd xmm1, xmm7
psubb xmm4, xmm3
xorps xmm4, xmm0
movd xmm0, r8d
movd dword [rsp + rdx + 0x44], xmm4
movd xmm4, r9d
pshufb xmm1, xmm6
vpmovzxbw ymm0, xmm0
vpmovzxbw ymm1, xmm1
vpmullw ymm1, ymm1, ymm0
movd xmm0, dword [rsp + rdx + 0x48]
vpmovzxwd zmm2, ymm1
movd xmm1, ecx
pshufd xmm1, xmm1, 0
paddd xmm1, xmm7
vpmovdb xmm3, zmm2
psubb xmm5, xmm3
xorps xmm5, xmm0
movd xmm0, r8d
movd dword [rsp + rdx + 0x48], xmm5
pshufb xmm1, xmm6
vpmovzxbw ymm0, xmm0
vpmovzxbw ymm1, xmm1
vpmullw ymm1, ymm1, ymm0
movd xmm0, dword [rsp + rdx + 0x4c]
vpmovzxwd zmm2, ymm1
vpmovdb xmm3, zmm2
psubb xmm4, xmm3
xorps xmm4, xmm0
movd dword [rsp + rdx + 0x4c], xmm4
cmp eax, 0x20
jb 0x140055820
cmp eax, 0x26
jae 0x14005597e
movsx edx, al
imul r8d, edx, 0x6c
mov edx, 0xffffffd4
movsxd rcx, eax
inc eax
sub dl, r8b
xor byte [rsp + rcx + 0x40], dl
cmp eax, 0x26
jb 0x140055961
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, [rsp + 0x40]
mov byte [rsp + 0x66], sil
call fcn.140059d20
mov eax, dword [0x14010f170]
lea r8, [rsp + 0x80]
mov rcx, qword [0x14010f168]
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x38], rsi
mov edx, 0x226608
mov dword [rsp + 0x80], eax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x88], rax
mov qword [rsp + 0xa0], rsi
mov dword [rsp + 0x84], esi
mov qword [rsp + 0x20], rsi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rsp + 0xa0]
lea rdx, str.Base_Address___
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [0x14010f1f8], rax
call fcn.140059d20
mov rdx, qword [0x14010f190]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140059f00]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
lea rdx, str.CR3___
call fcn.140059d20
mov rdx, qword [0x14010f1f8]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov rcx, rax
lea rdx, [0x140059f00]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov al, 1
mov rcx, qword [rsp + 0x1f0]
xor rcx, rsp
call fcn.1400c2370
lea r11, [rsp + 0x220]
mov rsi, qword [r11 + 0x18]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rsp + 0xc8]
mov dword [0x14010f170], eax
test eax, eax
jne 0x1400554f7
jmp 0x140055301