Function at 0x14000cc70
Capabilities:
Enumerate processes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x388]
sub rsp, 0x460
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x1401176e0]
xor rax, rsp
mov qword [rbp + 0x338], rax
mov qword [rbp - 0x68], rdx
mov r15, rcx
mov qword [rbp - 0x48], rcx
xor r13d, r13d
mov eax, r13d
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x58], eax
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov qword [rsp + 0x78], rax
cmp rax, 0xffffffffffffffff
je 0x14000dd3a
mov dword [rbp + 0x70], 0x238
lea rdx, [rbp + 0x70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14000dd31
movzx r14d, byte [rsp + 0x30]
movzx edi, byte [rsp + 0x30]
movzx esi, byte [rsp + 0x30]
mov rcx, qword [r15]
mov qword [rbp - 0x78], rcx
mov rax, qword [r15 + 8]
mov qword [rbp - 0x50], rax
cmp rcx, rax
je 0x14000d95a
lea rax, [rbp + 0x2b0]
mov qword [rbp - 0x70], rax
mov rbx, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0x10
jb 0x14000cd47
mov r15, qword [rcx]
add rbx, r15
jmp 0x14000cd4d
add rbx, rcx
mov r15, rcx
mov qword [rbp + 0x2b0], r13
mov rcx, r13
mov qword [rbp + 0x2c0], rcx
mov r8d, 7
mov qword [rbp + 0x2c8], r8
mov word [rbp + 0x2b0], r13w
mov rdx, rbx
sub rdx, r15
cmp rdx, r8
jbe 0x14000cd9b
lea rcx, [rbp + 0x2b0]
call fcn.140015b70
mov rcx, r13
mov qword [rbp + 0x2c0], rcx
mov r8, qword [rbp + 0x2c8]
cmp r15, rbx
je 0x14000ce01
movsx r9d, byte [r15]
cmp rcx, r8
jae 0x14000cdd4
lea rax, [rcx + 1]
mov qword [rbp + 0x2c0], rax
lea rax, [rbp + 0x2b0]
cmp r8, 8
cmovae rax, qword [rbp + 0x2b0]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r13w
jmp 0x14000cde9
movzx r8d, r14b
mov edx, 1
lea rcx, [rbp + 0x2b0]
call fcn.140015ce0
inc r15
cmp r15, rbx
je 0x14000ce01
mov r8, qword [rbp + 0x2c8]
mov rcx, qword [rbp + 0x2c0]
jmp 0x14000cda0
mov qword [rbp + 0x2d0], r13
mov qword [rbp + 0x2e0], r13
mov qword [rbp + 0x2e8], 7
lea rax, [rbp + 0x9c]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14000ce30
lea rdx, [rbp + 0x9c]
lea rcx, [rbp + 0x2d0]
call fcn.140013a70
lea rax, [rbp + 0x2b0]
mov r10, qword [rbp + 0x2b0]
mov rbx, qword [rbp + 0x2c8]
cmp rbx, 8
cmovae rax, r10
lea r9, [rbp + 0x2d0]
mov r12, qword [rbp + 0x2e8]
cmp r12, 8
setae r13b
mov r11, qword [rbp + 0x2d0]
cmovae r9, r11
mov rcx, qword [rbp + 0x2e0]
cmp rcx, qword [rbp + 0x2c0]
jne 0x14000cedc
test rcx, rcx
je 0x14000d046
movzx edx, word [r9]
movzx r8d, word [rax]
cmp dx, r8w
jb 0x14000cedc
sub r9, rax
cmp dx, r8w
ja 0x14000cedc
cmp rcx, 1
je 0x14000d046
dec rcx
add rax, 2
movzx edx, word [r9 + rax]
movzx r8d, word [rax]
cmp dx, r8w
jae 0x14000ceba
xor r15b, r15b
test r13b, r13b
je 0x14000cf27
lea rdx, [r12*2 + 2]
mov rax, r11
cmp rdx, 0x1000
jb 0x14000cf11
add rdx, 0x27
mov r11, qword [r11 - 8]
sub rax, r11
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000dd7a
mov rcx, r11
call fcn.1400a70c0
mov rbx, qword [rbp + 0x2c8]
mov r10, qword [rbp + 0x2b0]
cmp rbx, 8
jb 0x14000cf62
lea rdx, [rbx*2 + 2]
mov rax, r10
cmp rdx, 0x1000
jb 0x14000cf5a
add rdx, 0x27
mov r10, qword [r10 - 8]
sub rax, r10
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000dd80
mov rcx, r10
call fcn.1400a70c0
test r15b, r15b
je 0x14000d935
lea rdx, str.__
lea rcx, [0x140119f00]
call fcn.140015050
mov rcx, rax
call fcn.1400152c0
mov r8d, dword [rbp + 0x78]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r13, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14000d935
xor r12d, r12d
mov qword [rsp + 0x60], r12
lea r9d, [r12 + 0x30]
lea r8, [rbp + 0x40]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x14000d91c
nop dword [rax]
cmp dword [rbp + 0x60], 0x1000
jne 0x14000d8f1
mov r15, qword [rbp + 0x58]
test r15, r15
je 0x14000d8f5
xorps xmm0, xmm0
xor eax, eax
movdqu xmmword [rbp + 0x2f0], xmm0
mov qword [rbp + 0x300], rax
movabs rax, 0x7fffffffffffffff
cmp r15, rax
ja 0x14000ddb0
cmp r15, 0x1000
jb 0x14000d04e
lea rcx, [r15 + 0x27]
cmp rcx, r15
jbe 0x14000dd86
call fcn.1400a70c8
mov rcx, rax
test rax, rax
je 0x14000ddaa
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000d056
mov r15b, 1
jmp 0x14000cedf
mov rcx, r15
call fcn.1400a70c8
mov qword [rbp + 0x2f0], rax
lea rbx, [rax + r15]
mov qword [rbp + 0x300], rbx
mov r8, r15
xor edx, edx
mov rcx, rax
call fcn.1400a9660
mov qword [rbp + 0x2f8], rbx
lea rax, [rbp + 0x330]
mov qword [rsp + 0x20], rax
mov r9, qword [rbp + 0x58]
mov r8, qword [rbp + 0x2f0]
mov rdx, qword [rbp + 0x40]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14000d89b
xor ebx, ebx
mov qword [rbp + 0x2d0], rbx
mov qword [rbp + 0x2e0], rbx
mov qword [rbp + 0x2e8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x2d0], bl
mov r8, qword [rbp + 0x330]
mov rdx, qword [rbp + 0x2f0]
lea rcx, [rbp + 0x2d0]
call fcn.14000b330
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x310], xmm0
mov qword [rbp + 0x310], rbx
mov qword [rbp + 0x318], rbx
lea ecx, [rbx + 0x40]
call fcn.1400a70c8
mov qword [rsp + 0x58], rax
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x310], rax
mov rdx, qword [rbp - 0x68]
mov rcx, qword [rdx]
mov qword [rbp - 0x80], rcx
mov rdx, qword [rdx + 8]
mov qword [rbp - 0x58], rdx
cmp rcx, rdx
je 0x14000d793
mov r12, qword [rbp + 0x2e0]
nop dword [rax]
nop dword [rax + rax]
mov r15, qword [rcx + 0x10]
mov r13, rcx
cmp qword [rcx + 0x18], 0x10
jb 0x14000d161
mov r13, qword [rcx]
lea rcx, [rbp + 0x2d0]
cmp qword [rbp + 0x2e8], 0x10
setae dl
mov byte [rsp + 0x30], dl
cmovae rcx, qword [rbp + 0x2d0]
mov qword [rbp - 0x60], rcx
cmp r15, r12
ja 0x14000d1fb
test r15, r15
jne 0x14000d193
xor eax, eax
mov ebx, eax
jmp 0x14000d204
mov rax, rcx
sub rax, r15
inc rax
add rax, r12
mov qword [rsp + 0x68], rax
movsx edx, byte [r13]
mov r8, rax
sub r8, rcx
call fcn.1400a9930
mov rbx, rax
test rax, rax
je 0x14000d1f6
nop dword [rax]
mov r8, r15
mov rdx, r13
mov rcx, rbx
call fcn.1400a9bb0
test eax, eax
je 0x14000d29a
inc rbx
mov r8, qword [rsp + 0x68]
sub r8, rbx
movsx edx, byte [r13]
mov rcx, rbx
call fcn.1400a9930
mov rbx, rax
test rax, rax
jne 0x14000d1c0
movzx edx, byte [rsp + 0x30]
mov rbx, 0xffffffffffffffff
xor eax, eax
cmp rbx, 0xffffffffffffffff
je 0x14000d728
lea r8, [r15 + 0xa]
mov qword [rbp + 0x2b0], rax
mov qword [rbp + 0x2c0], rax
mov qword [rbp + 0x2c8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x2b0], 0
cmp r12, rbx
jb 0x14000dd9e
sub r12, rbx
cmp r12, r8
cmovb r8, r12
lea rax, [rbp + 0x2d0]
test dl, dl
cmovne rax, qword [rbp + 0x2d0]
lea rdx, [rbx + rax]
lea rcx, [rbp + 0x2b0]
call fcn.14000b330
or dword [rsp + 0x34], 1
lea rax, [rbp + 0x2b0]
mov rdx, qword [rbp + 0x2b0]
mov r11, qword [rbp + 0x2c8]
mov r8, qword [rbp + 0x2c0]
cmp r11, 0x10
jb 0x14000d2a8
mov rax, rdx
lea r9, [rdx + r8]
lea r10, [rdx + r8]
jmp 0x14000d2bd
sub rbx, qword [rbp - 0x60]
movzx edx, byte [rsp + 0x30]
jmp 0x14000d202
lea r10, [rax + r8]
lea r9, [rbp + 0x2b0]
add r9, r8
lea rax, [rbp + 0x2b0]
cmp rax, r9
je 0x14000d314
movzx ecx, byte [rax]
cmp cl, 0x22
je 0x14000d2d7
cmp cl, 0x27
je 0x14000d2d7
inc rax
cmp rax, r9
jne 0x14000d2c2
cmp rax, r9
je 0x14000d314
lea rcx, [rax + 1]
cmp rcx, r9
je 0x14000d314
movzx edx, byte [rcx]
cmp dl, 0x22
je 0x14000d2f7
cmp dl, 0x27
je 0x14000d2f7
mov byte [rax], dl
inc rax
inc rcx
cmp rcx, r9
jne 0x14000d2e5
mov r11, qword [rbp + 0x2c8]
mov r8, qword [rbp + 0x2c0]
mov rdx, qword [rbp + 0x2b0]
lea rcx, [rbp + 0x2b0]
sub r10, rax
cmp r11, 0x10
jb 0x14000d329
sub rax, rdx
jmp 0x14000d333
sub rax, rcx
lea rdx, [rbp + 0x2b0]
mov rcx, r8
sub rcx, rax
cmp rcx, r10
cmovb r10, rcx
lea rcx, [rdx + rax]
sub r8, r10
mov qword [rbp + 0x2c0], r8
sub r8, rax
inc r8
lea rdx, [rcx + r10]
call fcn.1400a8fb0
mov r13, qword [rbp + 0x310]
mov qword [rsp + 0x58], r13
mov rbx, qword [r13 + 8]
mov r12, qword [rbp + 0x2c0]
mov r15, qword [rbp + 0x2b0]
mov qword [rsp + 0x68], r15
cmp byte [rbx + 0x19], 0
jne 0x14000d3f1
cmp qword [rbp + 0x2c8], 0x10
setae sil
mov r14, r15
nop word [rax + rax]
lea rcx, [rbx + 0x20]
lea rdx, [rbp + 0x2b0]
test sil, sil
cmovne rdx, r14
mov r15, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0x10
jb 0x14000d3c0
mov rcx, qword [rcx]
mov r8, r15
cmp r12, r15
cmovb r8, r12
call fcn.1400a9bb0
test eax, eax
je 0x14000d434
js 0x14000d439
mov r13, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x14000d3a0
movzx esi, byte [rsp + 0x30]
movzx r14d, byte [rsp + 0x30]
mov r15, qword [rsp + 0x68]
cmp byte [r13 + 0x19], 0
jne 0x14000d452
lea rdx, [r13 + 0x20]
mov rbx, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x14000d40a
mov rdx, qword [rdx]
lea rcx, [rbp + 0x2b0]
cmp qword [rbp + 0x2c8], 0x10
cmovae rcx, r15
mov r8, r12
cmp rbx, r12
cmovb r8, rbx
call fcn.1400a9bb0
test eax, eax
je 0x14000d43f
jns 0x14000d444
jmp 0x14000d452
cmp r15, r12
jae 0x14000d3d5
mov rbx, qword [rbx + 0x10]
jmp 0x14000d3db
cmp r12, rbx
jb 0x14000d452
mov rax, qword [rsp + 0x58]
cmp r13, rax
jne 0x14000d744
lea rdx, [0x1401029c0]
lea rcx, [0x140119f00]
call fcn.140015050
mov r13, rax
xor r15d, r15d
mov qword [rsp + 0x38], r15
mov r8d, r15d
mov qword [rsp + 0x48], r15
mov r9d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x50], r9
mov byte [rsp + 0x38], r8b
mov eax, dword [rsp + 0x34]
or eax, 2
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x58], eax
lea rdx, [rbp + 0x2b0]
cmp qword [rbp + 0x2c8], 0x10
jb 0x14000d4b7
mov rcx, qword [rbp + 0x2b0]
mov rdx, rcx
mov rbx, rcx
jmp 0x14000d4c1
mov rbx, rdx
lea rcx, [rbp + 0x2b0]
mov r12, qword [rbp + 0x2c0]
add r12, rcx
cmp rdx, r12
je 0x14000d53e
movsx r15d, byte [rbx]
mov ecx, r15d
call fcn.1400ade00
test eax, eax
je 0x14000d529
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
cmp rcx, rdx
jae 0x14000d512
lea rax, [rcx + 1]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x38]
cmp rdx, 0x10
cmovae rax, qword [rsp + 0x38]
mov byte [rax + rcx], r15b
mov byte [rax + rcx + 1], 0
jmp 0x14000d529
movzx r9d, r15b
movzx r8d, dil
mov edx, 1
lea rcx, [rsp + 0x38]
call fcn.140016a70
inc rbx
cmp rbx, r12
jne 0x14000d4d0
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x48]
xor r15d, r15d
lea rdx, [rsp + 0x38]
cmp r9, 0x10
cmovae rdx, qword [rsp + 0x38]
mov rcx, r13
call fcn.14001cae0
mov rcx, rax
call fcn.1400152c0
mov r12d, dword [rsp + 0x34]
and r12d, 0xfffffffd
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x14000d5a4
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d59e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000dd8c
call fcn.1400a70c0
nop
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x48], r15
mov r15d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x50], r15
mov byte [rsp + 0x38], 0
or r12d, 4
mov dword [rsp + 0x34], r12d
mov dword [rsp + 0x58], r12d
lea rdx, [rbp + 0x2b0]
cmp qword [rbp + 0x2c8], 0x10
jb 0x14000d5ec
mov rcx, qword [rbp + 0x2b0]
mov rdx, rcx
mov rbx, rcx
jmp 0x14000d5f6
mov rbx, rdx
lea rcx, [rbp + 0x2b0]
mov r13, qword [rbp + 0x2c0]
add r13, rcx
cmp rdx, r13
je 0x14000d676
nop word [rax + rax]
movsx r12d, byte [rbx]
mov ecx, r12d
call fcn.1400ade00
test eax, eax
je 0x14000d669
mov rcx, qword [rsp + 0x48]
cmp rcx, r15
jae 0x14000d64d
lea rax, [rcx + 1]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x38]
cmp r15, 0x10
cmovae rax, qword [rsp + 0x38]
mov byte [rax + rcx], r12b
mov byte [rax + rcx + 1], 0
jmp 0x14000d664
movzx r9d, r12b
movzx r8d, sil
mov edx, 1
lea rcx, [rsp + 0x38]
call fcn.140016a70
mov r15, qword [rsp + 0x50]
inc rbx
cmp rbx, r13
jne 0x14000d610
mov r12d, dword [rsp + 0x34]
lea r8, [rsp + 0x38]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x310]
call fcn.14001d3c0
and r12d, 0xfffffffb
mov dword [rsp + 0x34], r12d
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x14000d6d2
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d6cc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000dd92
call fcn.1400a70c0
nop
mov rdx, qword [rbp + 0x2c8]
cmp rdx, 0x10
jb 0x14000d713
inc rdx
mov rcx, qword [rbp + 0x2b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d70e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000dd98
call fcn.1400a70c0
mov r12, qword [rbp + 0x2e0]
mov rax, qword [rbp + 0x310]
mov qword [rsp + 0x58], rax
jmp 0x14000d72d
mov rax, qword [rsp + 0x58]
mov rcx, qword [rbp - 0x80]
add rcx, 0x20
mov qword [rbp - 0x80], rcx
cmp rcx, qword [rbp - 0x58]
je 0x14000d789
jmp 0x14000d150
mov rcx, qword [rbp + 0x2c8]
cmp rcx, 0x10
jb 0x14000d789
lea rdx, [rcx + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x14000d77a
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000dd98
mov rcx, r15
call fcn.1400a70c0
mov rax, qword [rbp + 0x310]
mov r12, qword [rsp + 0x60]
mov r13, qword [rsp + 0x70]
mov rbx, qword [rax]
cmp byte [rbx + 0x19], 0
jne 0x14000d830
lea r8, [rbx + 0x20]
mov rax, qword [0x14011b9f0]
cmp rax, qword [0x14011b9f8]
je 0x14000d7c9
mov rdx, r8
mov rcx, rax
call fcn.140011820
add qword [0x14011b9f0], 0x20
jmp 0x14000d7d1
mov rdx, rax
call fcn.1400156c0
mov rax, qword [rbx + 0x10]
cmp byte [rax + 0x19], 0
je 0x14000d7fd
mov rax, qword [rbx + 8]
cmp byte [rax + 0x19], 0
jne 0x14000d7f8
cmp rbx, qword [rax + 0x10]
jne 0x14000d7f8
mov rbx, rax
mov rax, qword [rax + 8]
cmp byte [rax + 0x19], 0
je 0x14000d7e5
mov rbx, rax
jmp 0x14000d81f
mov rbx, rax
mov rcx, qword [rax]
cmp byte [rcx + 0x19], 0
jne 0x14000d81f
nop dword [rax]
mov rbx, rcx
mov rax, qword [rcx]
mov rcx, rax
cmp byte [rax + 0x19], 0
je 0x14000d810
cmp byte [rbx + 0x19], 0
je 0x14000d7a0
mov rax, qword [rbp + 0x310]
mov r8, qword [rax + 8]
lea rdx, [rbp + 0x310]
lea rcx, [rbp + 0x310]
call fcn.14001d590
mov edx, 0x40
mov rcx, qword [rbp + 0x310]
call fcn.1400a70c0
nop
mov rdx, qword [rbp + 0x2e8]
cmp rdx, 0x10
jb 0x14000d89b
inc rdx
mov rcx, qword [rbp + 0x2d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d895
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000dda4
call fcn.1400a70c0
nop
mov rcx, qword [rbp + 0x2f0]
test rcx, rcx
je 0x14000d8f1
mov rdx, qword [rbp + 0x300]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d8d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ddaa
call fcn.1400a70c0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2f0], xmm0
mov qword [rbp + 0x300], 0
mov r15, qword [rbp + 0x58]
add r12, r15
mov qword [rsp + 0x60], r12
mov r9d, 0x30
lea r8, [rbp + 0x40]
mov rdx, r12
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
jne 0x14000cfd0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rsp + 0x78]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000d93a
mov rbx, qword [rsp + 0x78]
mov rcx, qword [rbp - 0x78]
add rcx, 0x20
mov qword [rbp - 0x78], rcx
cmp rcx, qword [rbp - 0x50]
mov r13d, 0
jne 0x14000cd34
mov r15, qword [rbp - 0x48]
lea rdx, [rbp + 0x70]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x14000cd11
mov qword [rbp + 0x2d0], r13
mov qword [rbp + 0x2e0], r13
mov qword [rbp + 0x2e8], reloc.WS2_32.dll_ntohs
lea rax, [rbp + 0x2d0]
mov qword [rbp - 0x70], rax
mov rbx, qword [0x14011b9e8]
mov rdi, qword [0x14011b9f0]
cmp rbx, rdi
je 0x14000da0c
mov r9, rbx
lea r8, [rbp + 0x2d0]
lea rdx, [rsp + 0x38]
call fcn.14000ddc0
mov rdx, rax
lea rcx, [rbp + 0x2d0]
call fcn.140011780
mov rdx, qword [rsp + 0x50]
cmp rdx, 0x10
jb 0x14000da06
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000da01
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000ddb6
call fcn.1400a70c0
add rbx, 0x20
jmp 0x14000d9a1
movups xmm7, xmmword [rbp + 0x2d0]
movups xmm6, xmmword [rbp + 0x2e0]
mov byte [rbp + 0x2d0], 0
mov qword [rbp + 0x2e0], r13
mov qword [rbp + 0x2e8], reloc.WS2_32.dll_ntohs
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0x10
jb 0x14000da74
mov rcx, qword [0x140118300]
inc rdx
cmp rdx, 0x1000
jb 0x14000da6f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000dd74
mov rcx, r8
call fcn.1400a70c0
movups xmmword [0x140118300], xmm7
movups xmmword [0x140118310], xmm6
movq rax, xmm6
test rax, rax
je 0x14000dd3a
lea rcx, [rbp + 0x40]
call fcn.14000b490
mov r12, rax
lea rcx, [rbp + 0x20]
call fcn.140006bb0
nop
mov rdx, rax
lea rcx, [rbp]
call fcn.140003fa0
mov rdi, rax
mov r8, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, r8
cmp rax, 4
jb 0x14000db4d
lea rax, [r8 + 4]
mov qword [rdi + 0x10], rax
mov rbx, rdi
cmp rcx, 0x10
jb 0x14000dae1
mov rbx, qword [rdi]
lea rax, [0x1401029fc]
mov r15d, 4
lea r14, str.IP:
cmp rax, rbx
jbe 0x14000db15
lea rax, [rbx + r8]
cmp r14, rax
ja 0x14000db15
cmp rbx, r14
ja 0x14000db0d
mov rsi, r13
jmp 0x14000db18
mov rsi, rbx
sub rsi, r14
jmp 0x14000db18
mov rsi, r15
inc r8
lea rcx, [rbx + 4]
mov rdx, rbx
call fcn.1400a8fb0
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call fcn.1400a8fb0
sub r15, rsi
lea rdx, [r14 + 4]
add rdx, rsi
lea rcx, [rbx + rsi]
mov r8, r15
call fcn.1400a8fb0
jmp 0x14000db72
mov r15d, 4
mov qword [rsp + 0x28], r15
lea r14, str.IP:
mov qword [rsp + 0x20], r14
mov edx, r15d
mov rcx, rdi
call fcn.14001e1d0
mov rdi, rax
mov qword [rsp + 0x38], r13
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov r8d, 7
lea rdx, str._nHWID:
lea rcx, [rsp + 0x38]
call fcn.140011630
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x2f0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x300], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r9, r12
lea r8, [rbp + 0x2f0]
lea rcx, [rbp - 0x40]
call fcn.140019590
nop
mov r8d, recv
lea rdx, str._nSteaminfo:
lea rcx, [rbp - 0x40]
call fcn.140011630
mov qword [rbp + 0x2d0], r13
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2e0], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x2d0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x2e0], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [0x14011b9a8]
cmp qword [0x14011b9c0], 0x10
cmovae rdx, qword [0x14011b9a8]
mov r8, qword [0x14011b9b8]
lea rcx, [rbp + 0x2d0]
call fcn.140011630
mov qword [rbp + 0x2b0], r13
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2c0], xmm0
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.140013fb0
nop
lea r8, str._nfind:
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp - 0x20]
call fcn.140014ce0
nop
lea r8, [0x140118300]
mov rdx, rax
lea rcx, [rbp + 0x310]
call fcn.140014eb0
nop
mov rcx, rax
call fcn.14000c8f0
nop
lea rcx, [rbp + 0x310]
call fcn.140011720
nop
lea rcx, [rbp - 0x20]
call fcn.140011720
nop
lea rcx, [rbp + 0x2b0]
call fcn.140011720
nop
lea rcx, [rbp + 0x2d0]
call fcn.140011720
nop
lea rcx, [rbp - 0x40]
call fcn.140011720
nop
lea rcx, [rbp + 0x2f0]
call fcn.140011720
nop
lea rcx, [rsp + 0x38]
call fcn.140011720
nop
lea rcx, [rbp]
call fcn.140011720
nop
lea rcx, [rbp + 0x20]
call fcn.140011720
nop
lea rcx, [rbp + 0x40]
call fcn.140011720
jmp 0x14000dd3a
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x338]
xor rcx, rsp
call fcn.1400a70a0
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400b64e8
nop
call fcn.1400b64e8
nop
call fcn.1400b64e8
int3
call fcn.1400016c0
nop
call fcn.1400b64e8
int3
call fcn.1400b64e8
nop
call fcn.1400b64e8
int3
call fcn.140014990
nop
call fcn.1400b64e8
nop
call fcn.1400b64e8
int3
call fcn.140014870
nop
call fcn.1400b64e8
int3