Function at 0x1400405a0
Capabilities:
Enumerate processes
Execute command
Terminate process

Disassembly:
mov rax, rsp
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x3e8]
sub rsp, 0x4a8
movaps xmmword [rax - 0x58], xmm6
movaps xmmword [rax - 0x68], xmm7
xor esi, esi
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x144]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x140], 0x114
lea rcx, [0x14004e098]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x1400406b3
lea rdx, str.RtlGetVersion
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400406b3
lea rcx, [rbp + 0x140]
call rax
test eax, eax
jne 0x1400406b3
lea rdx, str.OS_Version:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140043700
mov edx, dword [rbp + 0x144]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x14004e0c0]
call fcn.140043700
mov edx, dword [rbp + 0x148]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400438e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str.Build_Number:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140043700
mov edx, dword [rbp + 0x14c]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___unsigned_long_int____ptr64]
lea rdx, [0x1400438e0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
mov eax, dword [rbp + 0x14c]
mov dword [0x140080660], eax
movabs rdi, 0x469a438cbd6e113b
mov qword [rbp - 0x40], rdi
movabs rbx, 0xdbe7b3e9944a7380
mov qword [rbp - 0x38], rbx
movabs r13, 0xebba6742e9e7a255
mov qword [rbp - 0x30], r13
movabs r12, 0xfd009f675527ed22
mov qword [rbp - 0x28], r12
movabs rax, 0x66f463e99d1c317a
mov qword [rbp + 0x60], rax
movabs rax, 0xf5d19dd0ba3c53e1
mov qword [rbp + 0x68], rax
movabs rax, 0xebba6742e3ed9364
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], r12
movups xmm1, xmmword [rbp + 0x60]
movups xmm2, xmmword [rbp + 0x70]
movdqa xmm0, xmmword [rbp - 0x40]
xorps xmm0, xmm1
movdqa xmmword [rbp + 0x100], xmm0
xorps xmm2, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x110], xmm2
lea rdx, [rbp + 0x100]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400434e0
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov r14, rsi
mov qword [rbp + 0xb0], rsi
mov r15d, 0xf
mov qword [rbp + 0xb8], r15
mov byte [rbp + 0xa0], sil
movups xmmword [rbp + 0x100], xmm0
movdqa xmm6, xmmword [0x14004e4a0]
movdqu xmmword [rbp + 0x110], xmm6
mov byte [rbp + 0x100], 0
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x30], r13
mov qword [rbp - 0x28], r12
movabs rax, 0x69b579ffcd1a6553
mov qword [rbp + 0x60], rax
movabs rax, 0xaf88c199f1241cfa
mov qword [rbp + 0x68], rax
movabs rax, 0x82db482f86848c3d
mov qword [rbp + 0x70], rax
movabs rax, 0xfd009f675527ed0d
mov qword [rbp + 0x78], rax
movups xmm1, xmmword [rbp + 0x60]
movups xmm2, xmmword [rbp + 0x70]
movdqa xmm0, xmmword [rbp - 0x40]
xorps xmm0, xmm1
movdqa xmmword [rbp + 0xe0], xmm0
xorps xmm2, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0xf0], xmm2
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x60]
call fcn.140042a20
nop
lea rcx, [rbp - 0x20]
call fcn.14003efe0
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.1400454c0
nop
cmp qword [rax + 0x18], r15
jbe 0x140040835
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp + 0x80]
call fcn.140042a20
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x140040889
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040884
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140040884
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140045afc
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], rsi
mov qword [rbp + 0xd8], 0xf
mov byte [rbp + 0xc0], 0
movups xmmword [rbp + 0xe0], xmm0
movdqa xmm7, xmmword [0x14004e4a0]
movdqu xmmword [rbp + 0xf0], xmm7
mov byte [rbp + 0xe0], 0
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], rbx
movabs rax, 0x2d314c49d333a60
mov qword [rsp + 0x30], rax
movabs rax, 0xdbe7b3e9946a4ea0
mov qword [rsp + 0x38], rax
movdqa xmm0, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
call fcn.140037360
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0xf
cmova rdx, qword [rbp + 0x80]
mov r8, qword [rbp + 0x90]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400444a0
lea rdx, [0x1400436c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov qword [rbp + 0x40], rdi
mov qword [rbp + 0x48], rbx
mov qword [rbp + 0x50], r13
mov qword [rbp + 0x58], r12
movabs rax, 0x34ef2cd59d333a60
mov qword [rbp - 0x40], rax
movabs rax, 0xe1c7dd8cff2527a0
mov qword [rbp - 0x38], rax
movabs rax, 0xebba6742e9e7a275
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], r12
movups xmm1, xmmword [rbp - 0x40]
movups xmm2, xmmword [rbp - 0x30]
movdqa xmm0, xmmword [rbp + 0x40]
xorps xmm0, xmm1
movdqa xmmword [rbp - 0x20], xmm0
xorps xmm2, xmmword [rbp + 0x50]
movdqa xmmword [rbp - 0x10], xmm2
lea rcx, [rbp - 0x20]
call fcn.140037360
lea rdx, [rbp + 0xc0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
call fcn.140043920
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rbx
movabs rax, 0x469a438cbd5d2014
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp + 0x40], xmm0
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x38], rbx
movabs rax, 0x469a438cbd6e1114
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rbx
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x30], xmm0
movabs r9, 0x7fffffffffffffff
mov rax, r9
mov rdx, qword [rbp + 0x70]
sub rax, rdx
mov rcx, qword [rbp + 0xd0]
cmp rax, rcx
jb 0x140041b55
lea r12, [rbp + 0x60]
mov rax, qword [rbp + 0x60]
mov qword [rbp + 0x408], rax
mov r8, qword [rbp + 0x78]
mov qword [rbp + 0x400], r8
cmp r8, 0xf
cmova r12, rax
lea r13, [rbp + 0xc0]
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x3f8], rax
mov r8, qword [rbp + 0xd8]
mov qword [rbp + 0x3f0], r8
cmp r8, 0xf
cmova r13, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
lea rsi, [rcx + rdx]
mov ebx, 0xf
lea rdi, [rbp - 0x40]
cmp rsi, rbx
jbe 0x140040b2b
mov rbx, rsi
or rbx, 0xf
cmp rbx, r9
jbe 0x140040aea
mov rbx, r9
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140045b74
test rax, rax
je 0x140040daa
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140040b23
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140040b03
xor edi, edi
jmp 0x140040b27
cmp rcx, 0x1000
jb 0x140040b1b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140041b5b
jmp 0x140040acb
call fcn.140045b74
mov rdi, rax
mov rdx, qword [rbp + 0x70]
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x28], rbx
mov r8, rdx
mov rdx, r12
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbp + 0x70]
add rcx, rdi
mov r8, qword [rbp + 0xd0]
mov rdx, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
lea r8, [rsp + 0x30]
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.140043320
mov rdi, rax
mov rsi, qword [rbp + 0x90]
lea r9, [rbp + 0x80]
cmp qword [rbp + 0x98], 0xf
cmova r9, qword [rbp + 0x80]
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x140040bcd
lea rax, [rcx + rsi]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0xf
jbe 0x140040bb5
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8, rsi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rsi], 0
jmp 0x140040be0
mov qword [rsp + 0x20], rsi
mov rdx, rsi
mov rcx, rdi
call fcn.140044040
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x50], xmm1
xor esi, esi
mov qword [rdi + 0x10], rsi
mov qword [rdi + 0x18], 0xf
mov byte [rdi], sil
lea r8, [rbp + 0x40]
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.140043320
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.14003eac0
mov rbx, rax
lea rax, [rbp + 0xa0]
cmp rax, rbx
je 0x140040c7b
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0xa0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0xb0], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], sil
movdqa xmm0, xmm1
psrldq xmm0, 8
movq r15, xmm0
movq r14, xmm1
mov rdx, qword [rbp + 0x138]
cmp rdx, 0xf
jbe 0x140040cbf
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040cba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140040cba
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140045afc
movdqa xmm0, xmmword [0x14004e4a0]
movdqu xmmword [rbp + 0x130], xmm0
mov byte [rbp + 0x120], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140040d1e
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040d11
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140040d11
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140045afc
movdqa xmm0, xmmword [0x14004e4a0]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140040d6f
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040d62
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140040d62
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140045afc
movdqa xmm0, xmmword [0x14004e4a0]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140040db6
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140040db1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140040db1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140045afc
movabs r13, 0x469a438cbd6e113b
mov qword [rbp + 0x40], r13
movabs r12, 0xdbe7b3e9944a7380
mov qword [rbp + 0x48], r12
movabs rax, 0xebba6742e9e7a255
mov qword [rbp + 0x50], rax
movabs rcx, 0xfd009f675527ed22
mov qword [rbp + 0x58], rcx
movabs rax, 0x29d663d196351b31
mov qword [rbp - 0x40], rax
movabs rax, 0xf5c99d8efa2317e1
mov qword [rbp - 0x38], rax
movabs rax, 0xebba6742e9e7a85f
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rcx
movups xmm1, xmmword [rbp - 0x40]
movups xmm2, xmmword [rbp - 0x30]
movdqa xmm0, xmmword [rbp + 0x40]
xorps xmm0, xmm1
movdqa xmmword [rbp - 0x20], xmm0
xorps xmm2, xmmword [rbp + 0x50]
movdqa xmmword [rbp - 0x10], xmm2
lea rdx, [rbp - 0x20]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400434e0
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r12
movabs rdi, 0x32f436e3db1a7e55
mov qword [rsp + 0x40], rdi
movabs rax, 0xdbe7b3e9f53e12e4
mov qword [rsp + 0x48], rax
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
mov rbx, 0xffffffffffffffff
mov rax, rbx
inc rax
cmp byte [rcx + rax], 0
jne 0x140040e92
lea rcx, [rbp + 0xa0]
mov rsi, qword [rbp + 0xa0]
cmp r15, 0xf
cmova rcx, rsi
cmp r14, rax
jne 0x140041090
mov r8, r14
lea rdx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140041090
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r12
movabs rax, 0xebba6742e9e7a255
mov qword [rbp - 0x10], rax
movabs rax, 0xfd009f675527ed22
mov qword [rbp - 8], rax
movabs rax, 0x1b521c2078572f8f
mov qword [rbp], rax
movabs rax, 0xf9d866ad77307b64
mov qword [rbp + 8], rax
movabs rax, 0x769b317618870bf9
mov qword [rbp + 0x10], rax
movabs rax, 0xacd9bbfbfc598b86
mov qword [rbp + 0x18], rax
movabs rax, 0xed3354c43694b6c3
mov qword [rbp + 0x20], rax
movabs rax, 0x2b0d660166c93008
mov qword [rbp + 0x28], rax
movabs rax, 0xc0f3f83a03cc66fd
mov qword [rbp + 0x30], rax
movabs rax, 0x1792449f91bb87aa
mov qword [rbp + 0x38], rax
movabs rcx, 0x2af322ca9d333a60
mov qword [rsp + 0x60], rcx
movabs rcx, 0xfbba98b29e6a17e5
mov qword [rsp + 0x68], rcx
movabs rcx, 0x9b9a02318882ce05
mov qword [rsp + 0x70], rcx
movabs rcx, 0xdd65ec063d449f57
mov qword [rsp + 0x78], rcx
movabs rcx, 0x3b3f7d521f385dff
mov qword [rbp - 0x80], rcx
movabs rcx, 0x89bd08c22d100f05
mov qword [rbp - 0x78], rcx
movabs rcx, 0x1bf4525870f3648b
mov qword [rbp - 0x70], rcx
movabs rcx, 0xd9b1e8dba172d08c
mov qword [rbp - 0x68], rcx
movabs rcx, 0xbd133ab359f096b7
mov qword [rbp - 0x60], rcx
movabs rcx, 0x422d0b6014ae5f7a
mov qword [rbp - 0x58], rcx
movabs rcx, 0xee909d4923f94693
mov qword [rbp - 0x50], rcx
mov qword [rbp - 0x48], rax
movdqa xmm0, xmmword [rbp - 0x20]
xorps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm1, xmmword [rbp - 0x10]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rbp]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [rbp - 0x70]
xorps xmm1, xmmword [rbp + 0x10]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [rbp - 0x60]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [rbp - 0x50]
xorps xmm1, xmmword [rbp + 0x30]
movdqa xmmword [rbp - 0x50], xmm1
lea rdx, [rsp + 0x60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400434e0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], rdi
movabs rax, 0xdbe7b3e9f02304e8
mov qword [rsp + 0x48], rax
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
mov rax, rbx
inc rax
cmp byte [rcx + rax], 0
jne 0x1400410c7
lea rcx, [rbp + 0xa0]
cmp r15, 0xf
cmova rcx, rsi
cmp r14, rax
jne 0x1400412c0
mov r8, r14
lea rdx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400412c0
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r12
movabs rax, 0xebba6742e9e7a255
mov qword [rbp - 0x10], rax
movabs rax, 0xfd009f675527ed22
mov qword [rbp - 8], rax
movabs rax, 0x1b521c2078572f8f
mov qword [rbp], rax
movabs rax, 0xf9d866ad77307b64
mov qword [rbp + 8], rax
movabs rax, 0x769b317618870bf9
mov qword [rbp + 0x10], rax
movabs rax, 0xacd9bbfbfc598b86
mov qword [rbp + 0x18], rax
movabs rax, 0xed3354c43694b6c3
mov qword [rbp + 0x20], rax
movabs rax, 0x2b0d660166c93008
mov qword [rbp + 0x28], rax
movabs rax, 0xc0f3f83a03cc66fd
mov qword [rbp + 0x30], rax
movabs rax, 0x1792449f91bb87aa
mov qword [rbp + 0x38], rax
movabs rax, 0x2d314c49d333a60
mov qword [rsp + 0x60], rax
movabs rax, 0xfac6c186e63836a0
mov qword [rsp + 0x68], rax
movabs rax, 0x87ea471fc2bca874
mov qword [rsp + 0x70], rax
movabs rax, 0x8f75ef4730548c47
mov qword [rsp + 0x78], rax
movabs rax, 0x69223c450b3647ec
mov qword [rbp - 0x80], rax
movabs rax, 0x8db946c016421c0b
mov qword [rbp - 0x78], rax
movabs rax, 0x19e9411376e851d9
mov qword [rbp - 0x70], rax
movabs rax, 0xf7d3d6949f77e3f2
mov qword [rbp - 0x68], rax
movabs rax, 0xcd4721ac65b4ebe8
mov qword [rbp - 0x60], rax
movabs rax, 0x447f362108be5f6c
mov qword [rbp - 0x58], rax
movabs rax, 0xe09d911a6ead149a
mov qword [rbp - 0x50], rax
movabs rax, 0x17926afcf4c8a79f
mov qword [rbp - 0x48], rax
movdqa xmm0, xmmword [rbp - 0x20]
xorps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm1, xmmword [rbp - 0x10]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rbp]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [rbp - 0x70]
xorps xmm1, xmmword [rbp + 0x10]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [rbp - 0x60]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [rbp - 0x50]
xorps xmm1, xmmword [rbp + 0x30]
movdqa xmmword [rbp - 0x50], xmm1
lea rdx, [rsp + 0x60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400434e0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], rdi
movabs rax, 0xdbe7b387f1211cf4
mov qword [rsp + 0x48], rax
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
mov rax, rbx
inc rax
cmp byte [rcx + rax], 0
jne 0x1400412f7
lea rcx, [rbp + 0xa0]
cmp r15, 0xf
cmova rcx, rsi
cmp r14, rax
jne 0x1400414f0
mov r8, r14
lea rdx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400414f0
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r12
movabs rax, 0xebba6742e9e7a255
mov qword [rbp - 0x10], rax
movabs rax, 0xfd009f675527ed22
mov qword [rbp - 8], rax
movabs rax, 0x1b521c2078572f8f
mov qword [rbp], rax
movabs rax, 0xf9d866ad77307b64
mov qword [rbp + 8], rax
movabs rax, 0x769b317618870bf9
mov qword [rbp + 0x10], rax
movabs rax, 0xacd9bbfbfc598b86
mov qword [rbp + 0x18], rax
movabs rax, 0xed3354c43694b6c3
mov qword [rbp + 0x20], rax
movabs rax, 0x2b0d660166c93008
mov qword [rbp + 0x28], rax
movabs rax, 0xc0f3f83a03cc66fd
mov qword [rbp + 0x30], rax
movabs rax, 0x1792449f91bb87aa
mov qword [rbp + 0x38], rax
movabs rax, 0x2d314c49d333a60
mov qword [rsp + 0x60], rax
movabs rax, 0xfac6c186e63836a0
mov qword [rsp + 0x68], rax
movabs rax, 0x87ea471fc2bca874
mov qword [rsp + 0x70], rax
movabs rax, 0x8f75ef4730548c47
mov qword [rsp + 0x78], rax
movabs rax, 0x69223c450b3647ec
mov qword [rbp - 0x80], rax
movabs rax, 0x8db946c016421c0b
mov qword [rbp - 0x78], rax
movabs rax, 0x19e9411376e851d9
mov qword [rbp - 0x70], rax
movabs rax, 0xf7d3d6949f77e3f2
mov qword [rbp - 0x68], rax
movabs rax, 0xcd4721ac65b4ebe8
mov qword [rbp - 0x60], rax
movabs rax, 0x447f362108be5f6c
mov qword [rbp - 0x58], rax
movabs rax, 0xe09d911a6ead149a
mov qword [rbp - 0x50], rax
movabs rax, 0x17926afcf4c8a79f
mov qword [rbp - 0x48], rax
movdqa xmm0, xmmword [rbp - 0x20]
xorps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm1, xmmword [rbp - 0x10]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rbp]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [rbp - 0x70]
xorps xmm1, xmmword [rbp + 0x10]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [rbp - 0x60]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [rbp - 0x50]
xorps xmm1, xmmword [rbp + 0x30]
movdqa xmmword [rbp - 0x50], xmm1
lea rdx, [rsp + 0x60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400434e0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r12
movabs rax, 0x469a438cd6016252
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r12
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x30], xmm0
lea rax, [rsp + 0x30]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140041524
lea rcx, [rbp + 0xa0]
cmp r15, 0xf
cmova rcx, rsi
cmp r14, rbx
jne 0x140041998
mov r8, r14
lea rdx, [rsp + 0x30]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140041998
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
xor ebx, ebx
cmp rax, 0xffffffffffffffff
je 0x14004161e
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x144]
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x140], 0x238
lea rdx, [rbp + 0x140]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x140041611
lea rdx, [rbp + 0x16c]
lea rcx, str.UAGame.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x1400415c8
mov ebx, dword [rbp + 0x148]
jmp 0x140041611
lea rdx, [rbp + 0x140]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
je 0x140041611
nop dword [rax]
lea rdx, [rbp + 0x16c]
lea rcx, str.UAGame.exe
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
cmove ebx, dword [rbp + 0x148]
lea rdx, [rbp + 0x140]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1400415e0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
jne 0x140041684
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r12
movabs rax, 0x469a438cc907704c
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], r12
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp + 0x40], xmm0
lea rdx, [rbp + 0x40]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400434e0
lea rdx, [0x1400436c0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
cmp dword [0x140080660], 0x5867
jne 0x14004167f
call fcn.14003fa90
jmp 0x140041684
call fcn.14003f7c0
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r12
movabs rbx, 0x469a438cbd1d7d58
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], r12
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp + 0x40], xmm0
lea rcx, [rbp + 0x40]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r12
movabs rax, 0xebba6742e9e7a255
mov qword [rbp - 0x10], rax
movabs rax, 0xfd009f675527ed22
mov qword [rbp - 8], rax
movabs rax, 0x1b521c2078572f8f
mov qword [rbp], rax
movabs rax, 0xf9d866ad77307b64
mov qword [rbp + 8], rax
movabs rcx, 0x27ff2fdc9d333a60
mov qword [rsp + 0x60], rcx
movabs rcx, 0xa894d69be46a16f3
mov qword [rsp + 0x68], rcx
movabs rcx, 0xc9c8023687a28075
mov qword [rsp + 0x70], rcx
movabs rcx, 0x986dfe2075498402
mov qword [rsp + 0x78], rcx
movabs rcx, 0x1b521c20785725a1
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x78], rax
movups xmm1, xmmword [rsp + 0x60]
movups xmm2, xmmword [rsp + 0x70]
movups xmm3, xmmword [rbp - 0x80]
movdqa xmm0, xmmword [rbp - 0x20]
xorps xmm0, xmm1
movdqa xmmword [rsp + 0x60], xmm0
xorps xmm2, xmmword [rbp - 0x10]
movdqa xmmword [rsp + 0x70], xmm2
xorps xmm3, xmmword [rbp]
movdqa xmmword [rbp - 0x80], xmm3
lea rcx, [rsp + 0x60]
call fcn.140037360
call qword [sym.imp.api_ms_win_crt_conio_l1_1_0.dll__getch]
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], r12
movdqa xmm0, xmmword [rsp + 0x30]
xorps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rbp + 0x40], xmm0
lea rcx, [rbp + 0x40]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call fcn.14003fd60
nop
psrldq xmm7, 8
movq rdx, xmm7
cmp rdx, 0xf
jbe 0x140041805
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400417ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400417ff
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140045afc
nop
mov rdx, qword [rbp + 0x3f0]
cmp rdx, 0xf
jbe 0x14004184a
inc rdx
mov rcx, qword [rbp + 0x3f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041844
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140041844
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140045afc
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x14004188e
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041889
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140041889
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140045afc
mov qword [rbp + 0x90], 0
mov qword [rbp + 0x98], 0xf
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp + 0x400]
cmp rdx, 0xf
jbe 0x1400418f0
inc rdx
mov rcx, qword [rbp + 0x408]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400418ea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400418ea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140045afc
nop
psrldq xmm6, 8
movq rdx, xmm6
cmp rdx, 0xf
jbe 0x140041938
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140041932
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140041932
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140045afc
nop
cmp r15, 0xf
jbe 0x140041972
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14004196a
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004196a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140045afc
xor eax, eax
movaps xmm6, xmmword [rsp + 0x490]
movaps xmm7, xmmword [rsp + 0x480]
add rsp, 0x4a8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], r12
movabs rax, 0xebba6742e9e7a255
mov qword [rbp - 0x10], rax
movabs rax, 0xfd009f675527ed22
mov qword [rbp - 8], rax
movabs rax, 0x1b521c2078572f8f
mov qword [rbp], rax
movabs rax, 0xf9d866ad77307b64
mov qword [rbp + 8], rax
movabs rax, 0x769b317618870bf9
mov qword [rbp + 0x10], rax
movabs rax, 0xacd9bbfbfc598b86
mov qword [rbp + 0x18], rax
movabs rax, 0xed3354c43694b6c3
mov qword [rbp + 0x20], rax
movabs rax, 0x2b0d660166c93008
mov qword [rbp + 0x28], rax
movabs rax, 0xc0f3f83a03cc66fd
mov qword [rbp + 0x30], rax
movabs rax, 0x1792449f91bb87aa
mov qword [rbp + 0x38], rax
movabs rax, 0x66ee2cc29d333a60
mov qword [rsp + 0x60], rax
movabs rax, 0xd1c692c8ff381cf7
mov qword [rsp + 0x68], rax
movabs rax, 0x8adf0b12c9ba890e
mov qword [rsp + 0x70], rax
movabs rax, 0x9563ed1225078851
mov qword [rsp + 0x78], rax
movabs rax, 0x7c3d6e5058325cee
mov qword [rbp - 0x80], rax
movabs rax, 0xa3f812cc575d1a16
mov qword [rbp - 0x78], rax
movabs rax, 0x1eef5e0468e26596
mov qword [rbp - 0x70], rax
movabs rax, 0xf1f2e0f19136e8a8
mov qword [rbp - 0x68], rax
movabs rax, 0x825774b043fce5e3
mov qword [rbp - 0x60], rax
movabs rax, 0x596a097336e95e7f
mov qword [rbp - 0x58], rax
movabs rax, 0xe0c6d8546aec0b9c
mov qword [rbp - 0x50], rax
movabs rax, 0x1792449fbfd8e2d9
mov qword [rbp - 0x48], rax
movdqa xmm0, xmmword [rbp - 0x20]
xorps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm1, xmmword [rsp + 0x70]
xorps xmm1, xmmword [rbp - 0x10]
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rbp]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [rbp - 0x70]
xorps xmm1, xmmword [rbp + 0x10]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [rbp - 0x60]
xorps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [rbp - 0x50]
xorps xmm1, xmmword [rbp + 0x30]
movdqa xmmword [rbp - 0x50], xmm1
lea rdx, [rsp + 0x60]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400434e0
mov ecx, 0x1388
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.140037560
int3
call fcn.1400374c0
int3