Function at 0x1400051a0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1830]
mov eax, 0x1930
call fcn.14004ff30
sub rsp, rax
mov rax, qword [0x140092100]
xor rax, rsp
mov qword [rbp + 0x1820], rax
mov qword [rsp + 0x48], rcx
call fcn.14002f380
xorps xmm0, xmm0
movups xmmword [rbp + 0x5c0], xmm0
xor r14d, r14d
mov qword [rbp + 0x5c0], r14
mov qword [rbp + 0x5c8], r14
lea ecx, [r14 + 0x28]
call fcn.14004fd74
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp + 0x5c0], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x88], xmm0
mov ecx, 0x88
call fcn.14004fd74
mov qword [rbp + 0x378], rax
test rax, rax
je 0x14000527e
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
mov qword [rax + 0x80], rcx
mov dl, 1
mov rcx, rax
call fcn.140010420
mov r13, rax
jmp 0x140005281
mov r13, r14
mov qword [rsp + 0x40], r13
mov qword [rbp + 0x1c8], r13
mov ecx, 0x18
call fcn.14004fd74
mov r12, rax
mov qword [rbp - 0x38], rax
lea rdi, vtable.WRST::MCYVMA_PKO_.0
test rax, rax
je 0x1400052c7
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
mov qword [rax], rdi
mov qword [rax + 0x10], r13
jmp 0x1400052ce
mov r12, r14
mov qword [rbp - 0x38], r14
mov qword [rbp + 0x88], r13
mov qword [rbp + 0x90], r12
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov r15, rax
mov rsi, 0xffffffffffffffff
cmp rax, rsi
je 0x140005a6c
mov dword [rbp + 0x380], 0x238
lea rdx, [rbp + 0x380]
mov rcx, rax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x140005a6c
nop word [rax + rax]
mov r8d, dword [rbp + 0x388]
test r8d, r8d
je 0x140005a4c
xor edx, edx
mov ecx, 0x410
call fcn.14003c110
mov r14, rax
test rax, rax
jne 0x140005375
mov r8d, dword [rbp + 0x388]
xor edx, edx
mov ecx, 0x400
call fcn.14003c110
mov r14, rax
test rax, rax
jne 0x140005375
mov r8d, dword [rbp + 0x388]
xor edx, edx
mov ecx, 0x1000
call fcn.14003c110
mov r14, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x78], xmm0
mov ecx, 0x88
call fcn.14004fd74
mov qword [rsp + 0x38], rax
test rax, rax
je 0x1400053ca
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
mov qword [rax + 0x80], rcx
mov dl, 1
mov rcx, rax
call fcn.140010420
mov rsi, rax
jmp 0x1400053cc
xor esi, esi
mov qword [rbp + 0x2f0], rsi
mov ecx, 0x18
call fcn.14004fd74
mov rbx, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x140005407
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
mov qword [rax], rdi
mov qword [rax + 0x10], rsi
jmp 0x140005409
xor ebx, ebx
mov qword [rbp + 0x78], rsi
mov qword [rbp + 0x80], rbx
mov ecx, 0x88
call fcn.14004fd74
mov qword [rbp + 0x30], rax
test rax, rax
je 0x14000546c
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
mov qword [rax + 0x80], rcx
lea r9d, [rcx + 4]
lea r8, [rbp + 0x388]
mov dl, 1
mov rcx, rax
call fcn.140010550
mov rdi, rax
jmp 0x14000546e
xor edi, edi
xorps xmm0, xmm0
movdqu xmmword [rbp + 8], xmm0
mov qword [rsp + 0x70], rdi
mov ecx, 0x18
call fcn.14004fd74
mov qword [rsp + 0x58], rax
test rax, rax
je 0x1400054b1
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rcx, vtable.WRST::MCYVMA_PKO_.0
mov qword [rax], rcx
mov qword [rax + 0x10], rdi
mov qword [rbp + 8], rdi
mov qword [rbp + 0x10], rax
lea rdx, [rbp + 8]
mov rcx, rsi
call fcn.140010c50
mov ecx, 0x88
call fcn.14004fd74
mov rdi, rax
mov qword [rbp + 0x58], rax
test rax, rax
je 0x140005564
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
movups xmmword [rdi + 0x50], xmm0
movups xmmword [rdi + 0x60], xmm0
movups xmmword [rdi + 0x70], xmm0
mov qword [rdi + 0x80], rax
movups xmmword [rbp + 0xe8], xmm0
mov qword [rbp + 0xf8], rax
mov qword [rbp + 0x100], rax
lea rax, [rbp + 0x3ac]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140005530
lea rdx, [rbp + 0x3ac]
lea rcx, [rbp + 0xe8]
call fcn.1400032b0
lea r8, [rbp + 0xe8]
mov dl, 2
mov rcx, rdi
call fcn.140010730
mov rdi, rax
jmp 0x140005566
xor edi, edi
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x18], xmm0
mov qword [rsp + 0x58], rdi
mov ecx, 0x18
call fcn.14004fd74
mov qword [rsp + 0x68], rax
test rax, rax
je 0x1400055a9
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rcx, vtable.WRST::MCYVMA_PKO_.0
mov qword [rax], rcx
mov qword [rax + 0x10], rdi
mov qword [rbp + 0x18], rdi
mov qword [rbp + 0x20], rax
lea rdx, [rbp + 0x18]
mov rcx, rsi
call fcn.140010c50
mov ecx, 0x88
call fcn.14004fd74
mov rdi, rax
mov qword [rbp + 0x50], rax
test rax, rax
je 0x140005624
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
movups xmmword [rdi + 0x50], xmm0
movups xmmword [rdi + 0x60], xmm0
movups xmmword [rdi + 0x70], xmm0
mov qword [rdi + 0x80], rax
mov r8, r14
lea rdx, [rbp + 0x2f8]
mov rcx, qword [rsp + 0x48]
call fcn.140004be0
mov r8, rax
mov dl, 3
mov rcx, rdi
call fcn.140010730
mov rdi, rax
jmp 0x140005626
xor edi, edi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov qword [rsp + 0x68], rdi
mov ecx, 0x18
call fcn.14004fd74
mov qword [rsp + 0x50], rax
test rax, rax
je 0x140005669
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rcx, vtable.WRST::MCYVMA_PKO_.0
mov qword [rax], rcx
mov qword [rax + 0x10], rdi
mov qword [rbp - 0x68], rdi
mov qword [rbp - 0x60], rax
lea rdx, [rbp - 0x68]
mov rcx, rsi
call fcn.140010c50
mov ecx, 0x88
call fcn.14004fd74
mov rdi, rax
mov qword [rbp + 0x38], rax
test rax, rax
je 0x14000573e
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
movups xmmword [rdi + 0x50], xmm0
movups xmmword [rdi + 0x60], xmm0
movups xmmword [rdi + 0x70], xmm0
mov qword [rdi + 0x80], rax
test r14, r14
jne 0x1400056d0
lea rdx, [0x140079c08]
jmp 0x1400056f1
mov rdx, r14
mov rcx, qword [rsp + 0x48]
call fcn.140004ea0
lea rdx, str.32bit
test al, al
lea rax, str.64bit
cmovne rdx, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x108], xmm0
xor eax, eax
mov qword [rbp + 0x118], rax
mov qword [rbp + 0x120], rax
mov r8, 0xffffffffffffffff
inc r8
cmp word [rdx + r8*2], ax
jne 0x140005712
lea rcx, [rbp + 0x108]
call fcn.1400032b0
lea r8, [rbp + 0x108]
mov dl, 4
mov rcx, rdi
call fcn.140010730
mov rdi, rax
jmp 0x140005740
xor edi, edi
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x78], xmm0
mov qword [rsp + 0x50], rdi
mov ecx, 0x18
call fcn.14004fd74
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140005783
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rcx, vtable.WRST::MCYVMA_PKO_.0
mov qword [rax], rcx
mov qword [rax + 0x10], rdi
mov qword [rbp - 0x78], rdi
mov qword [rbp - 0x70], rax
lea rdx, [rbp - 0x78]
mov rcx, rsi
call fcn.140010c50
mov ecx, 0x88
call fcn.14004fd74
mov rdi, rax
mov qword [rbp + 0x40], rax
test rax, rax
je 0x140005801
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
movups xmmword [rdi + 0x50], xmm0
movups xmmword [rdi + 0x60], xmm0
movups xmmword [rdi + 0x70], xmm0
mov qword [rdi + 0x80], rax
mov r8, r14
lea rdx, [rbp + 0x318]
mov rcx, qword [rsp + 0x48]
call fcn.1400049f0
mov r8, rax
mov dl, 5
mov rcx, rdi
call fcn.140010730
mov rdi, rax
xor r14d, r14d
jmp 0x140005807
xor r14d, r14d
mov edi, r14d
xorps xmm0, xmm0
movdqu xmmword [rbp - 8], xmm0
mov qword [rsp + 0x60], rdi
mov ecx, 0x18
call fcn.14004fd74
mov qword [rsp + 0x78], rax
test rax, rax
je 0x14000584c
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rcx, vtable.WRST::MCYVMA_PKO_.0
mov qword [rax], rcx
mov qword [rax + 0x10], rdi
jmp 0x14000584f
mov rax, r14
mov qword [rbp - 8], rdi
mov qword [rbp], rax
lea rdx, [rbp - 8]
mov rcx, rsi
call fcn.140010c50
mov ecx, 0x88
call fcn.14004fd74
mov qword [rsp + 0x30], rax
test rax, rax
je 0x1400058bc
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
mov qword [rax + 0x80], rcx
lea r9d, [rcx + 4]
lea r8, [rbp + 0x3a0]
mov dl, 6
mov rcx, rax
call fcn.140010550
mov rdi, rax
jmp 0x1400058bf
mov rdi, r14
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rsp + 0x78], rdi
mov ecx, 0x18
call fcn.14004fd74
mov qword [rbp - 0x80], rax
test rax, rax
je 0x140005903
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rcx, vtable.WRST::MCYVMA_PKO_.0
mov qword [rax], rcx
mov qword [rax + 0x10], rdi
jmp 0x140005906
mov rax, r14
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x18]
mov rcx, rsi
call fcn.140010c50
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x28], xmm0
test rbx, rbx
je 0x14000592b
lock inc dword [rbx + 8]
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], rbx
lea rdx, [rbp - 0x28]
mov rcx, r13
call fcn.140010c50
mov edi, dword [rbp + 0x388]
mov rsi, qword [rbp + 0x5c0]
mov rax, qword [rsi + 8]
mov qword [rbp + 0x60], rax
mov dword [rbp + 0x68], r14d
mov rcx, rsi
cmp byte [rax + 0x19], 0
jne 0x140005987
mov qword [rbp + 0x60], rax
cmp dword [rax + 0x1c], edi
jae 0x140005974
mov dword [rbp + 0x68], r14d
mov rax, qword [rax + 0x10]
jmp 0x140005981
mov dword [rbp + 0x68], 1
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140005961
cmp byte [rcx + 0x19], 0
jne 0x140005992
cmp edi, dword [rcx + 0x1c]
jae 0x140005a0c
movabs rax, 0x666666666666666
cmp qword [rbp + 0x5c8], rax
je 0x14000668e
lea rax, [rbp + 0x5c0]
mov qword [rbp + 0x98], rax
mov qword [rbp + 0xa0], r14
mov ecx, 0x28
call fcn.14004fd74
nop
mov dword [rax + 0x1c], edi
mov byte [rax + 0x20], 0
mov qword [rax], rsi
mov qword [rax + 8], rsi
mov qword [rax + 0x10], rsi
mov word [rax + 0x18], 0
mov qword [rbp + 0xa0], r14
movups xmm0, xmmword [rbp + 0x60]
movaps xmmword [rbp + 0x1e0], xmm0
mov r8, rax
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x5c0]
call fcn.140004f20
mov rcx, rax
mov byte [rcx + 0x20], 1
mov rsi, 0xffffffffffffffff
test rbx, rbx
je 0x140005a45
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140005a45
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140005a45
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
lea rdi, vtable.WRST::MCYVMA_PKO_.0
lea rdx, [rbp + 0x380]
mov rcx, r15
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x140005320
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8, [rbp + 0x5dc]
mov edx, 0x1000
lea rcx, [rbp + 0x610]
call fcn.14003b1d0
test eax, eax
je 0x1400065ad
mov ebx, dword [rbp + 0x5dc]
shr ebx, 2
mov dword [rsp + 0x38], ebx
mov r13d, r14d
test ebx, ebx
je 0x1400065a8
lea r12, [rbp + 0x610]
movabs rdx, 0x3f003f003f
mov eax, ebx
mov r15, qword [rsp + 0x40]
nop dword [rax]
mov ebx, dword [r12]
test ebx, ebx
je 0x14000658d
mov rcx, qword [rbp + 0x5c0]
mov rax, qword [rcx + 8]
cmp byte [rax + 0x19], 0
jne 0x140005af7
nop dword [rax]
cmp dword [rax + 0x1c], ebx
jae 0x140005aeb
mov rax, qword [rax + 0x10]
jmp 0x140005af1
mov rcx, rax
mov rax, qword [rax]
cmp byte [rax + 0x19], 0
je 0x140005ae0
cmp byte [rcx + 0x19], 0
jne 0x140005b06
cmp ebx, dword [rcx + 0x1c]
jb 0x140005b06
mov al, 1
jmp 0x140005b08
xor al, al
test al, al
jne 0x140006589
mov qword [rbp + 0x1610], rdx
xor edx, edx
mov r8d, 0x200
lea rcx, [rbp + 0x1618]
call fcn.140074850
mov r8d, ebx
xor edx, edx
mov ecx, 0x410
call fcn.14003c110
mov r14, rax
test rax, rax
jne 0x140005ffe
mov r8d, dword [r12]
xor edx, edx
mov ecx, 0x400
call fcn.14003c110
mov r14, rax
test rax, rax
jne 0x140005ffe
mov r8d, dword [r12]
xor edx, edx
mov ecx, 0x1000
call fcn.14003c110
mov r14, rax
test rax, rax
jne 0x140005ffe
xorps xmm0, xmm0
movups xmmword [rbp + 0xa8], xmm0
mov ecx, 0x88
call fcn.14004fd74
mov qword [rbp - 0x80], rax
test rax, rax
je 0x140005bd5
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
mov qword [rax + 0x80], rcx
mov dl, 1
mov rcx, rax
call fcn.140010420
mov rdi, rax
jmp 0x140005bdb
xor r14d, r14d
mov edi, r14d
mov qword [rbp + 0x1d0], rdi
mov ecx, 0x18
call fcn.14004fd74
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x140005c1d
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
lea rax, vtable.WRST::MCYVMA_PKO_.0
mov qword [rbx], rax
mov qword [rbx + 0x10], rdi
jmp 0x140005c20
mov rbx, r14
mov qword [rbp + 0xa8], rdi
mov qword [rbp + 0xb0], rbx
mov ecx, 0x88
call fcn.14004fd74
mov rcx, rax
mov qword [rbp + 0x40], rax
test rax, rax
je 0x140005c8c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x30], xmm0
movups xmmword [rcx + 0x40], xmm0
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm0
movups xmmword [rcx + 0x70], xmm0
mov qword [rcx + 0x80], rax
mov eax, r13d
lea r8, [rbp + 0x610]
lea r8, [r8 + rax*4]
mov r9d, 4
mov dl, 1
call fcn.140010550
jmp 0x140005c8f
mov rax, r14
mov rdx, rax
lea rcx, [rbp + 0x1f0]
call fcn.1400030b0
mov rdx, rax
mov rcx, rdi
call fcn.140010c50
mov ecx, 0x88
call fcn.14004fd74
mov rsi, rax
mov qword [rbp + 0x38], rax
test rax, rax
je 0x140005d29
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm0
movups xmmword [rsi + 0x40], xmm0
movups xmmword [rsi + 0x50], xmm0
movups xmmword [rsi + 0x60], xmm0
movups xmmword [rsi + 0x70], xmm0
mov qword [rsi + 0x80], rax
movups xmmword [rbp + 0x128], xmm0
mov qword [rbp + 0x138], r14
mov qword [rbp + 0x140], r14
lea r8d, [rax + 3]
lea rdx, [0x140079c08]
lea rcx, [rbp + 0x128]
call fcn.1400032b0
lea r8, [rbp + 0x128]
mov dl, 2
mov rcx, rsi
call fcn.140010730
jmp 0x140005d2c
mov rax, r14
mov rdx, rax
lea rcx, [rbp + 0x200]
call fcn.1400030b0
mov rdx, rax
mov rcx, rdi
call fcn.140010c50
mov ecx, 0x88
call fcn.14004fd74
mov rsi, rax
mov qword [rbp + 0x50], rax
test rax, rax
je 0x140005dc6
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm0
movups xmmword [rsi + 0x40], xmm0
movups xmmword [rsi + 0x50], xmm0
movups xmmword [rsi + 0x60], xmm0
movups xmmword [rsi + 0x70], xmm0
mov qword [rsi + 0x80], rax
movups xmmword [rbp + 0x148], xmm0
mov qword [rbp + 0x158], r14
mov qword [rbp + 0x160], r14
lea r8d, [rax + 3]
lea rdx, [0x140079c08]
lea rcx, [rbp + 0x148]
call fcn.1400032b0
lea r8, [rbp + 0x148]
mov dl, 3
mov rcx, rsi
call fcn.140010730
jmp 0x140005dc9
mov rax, r14
mov rdx, rax
lea rcx, [rbp + 0x210]
call fcn.1400030b0
mov rdx, rax
mov rcx, rdi
call fcn.140010c50
mov ecx, 0x88
call fcn.14004fd74
mov rsi, rax
mov qword [rbp + 0x58], rax
test rax, rax
je 0x140005e63
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm0
movups xmmword [rsi + 0x40], xmm0
movups xmmword [rsi + 0x50], xmm0
movups xmmword [rsi + 0x60], xmm0
movups xmmword [rsi + 0x70], xmm0
mov qword [rsi + 0x80], rax
movups xmmword [rbp + 0x168], xmm0
mov qword [rbp + 0x178], r14
mov qword [rbp + 0x180], r14
lea r8d, [rax + 3]
lea rdx, [0x140079c08]
lea rcx, [rbp + 0x168]
call fcn.1400032b0
lea r8, [rbp + 0x168]
mov dl, 4
mov rcx, rsi
call fcn.140010730
jmp 0x140005e66
mov rax, r14
mov rdx, rax
lea rcx, [rbp + 0x220]
call fcn.1400030b0
mov rdx, rax
mov rcx, rdi
call fcn.140010c50
mov ecx, 0x88
call fcn.14004fd74
mov rsi, rax
mov qword [rbp + 0x30], rax
test rax, rax
je 0x140005f00
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsi], xmm0
movups xmmword [rsi + 0x10], xmm0
movups xmmword [rsi + 0x20], xmm0
movups xmmword [rsi + 0x30], xmm0
movups xmmword [rsi + 0x40], xmm0
movups xmmword [rsi + 0x50], xmm0
movups xmmword [rsi + 0x60], xmm0
movups xmmword [rsi + 0x70], xmm0
mov qword [rsi + 0x80], rax
movups xmmword [rbp + 0xc8], xmm0
mov qword [rbp + 0xd8], r14
mov qword [rbp + 0xe0], r14
lea r8d, [rax + 3]
lea rdx, [0x140079c08]
lea rcx, [rbp + 0xc8]
call fcn.1400032b0
lea r8, [rbp + 0xc8]
mov dl, 5
mov rcx, rsi
call fcn.140010730
jmp 0x140005f03
mov rax, r14
mov rdx, rax
lea rcx, [rbp + 0x230]
call fcn.1400030b0
mov rdx, rax
mov rcx, rdi
call fcn.140010c50
mov ecx, 0x88
call fcn.14004fd74
mov qword [rbp + 0x270], rax
test rax, rax
je 0x140005f75
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
mov qword [rax + 0x80], rcx
lea r9d, [rcx + 4]
lea r8, [0x140079c2c]
mov dl, 6
mov rcx, rax
call fcn.140010550
jmp 0x140005f78
mov rax, r14
mov rdx, rax
lea rcx, [rbp + 0x240]
call fcn.1400030b0
mov rdx, rax
mov rcx, rdi
call fcn.140010c50
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x48], xmm0
test rbx, rbx
je 0x140005fa3
lock inc dword [rbx + 8]
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x40], rbx
lea rdx, [rbp - 0x48]
mov rcx, r15
call fcn.140010c50
nop
mov rsi, 0xffffffffffffffff
test rbx, rbx
je 0x14000657f
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14000657f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14000657f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
jmp 0x14000657f
lea r9, [rbp + 0x5d8]
mov r8d, 8
lea rdx, [rbp + 0x378]
mov rcx, r14
call fcn.14003b040
test eax, eax
je 0x14000603e
mov r9d, 0x104
lea r8, [rbp + 0x1610]
mov rdx, qword [rbp + 0x378]
mov rcx, r14
call fcn.14003b5b0
test eax, eax
jne 0x14000605e
lea r9, [rbp + 0x5d8]
lea r8, [rbp + 0x1610]
xor edx, edx
mov rcx, r14
call fcn.14003c4e0
test eax, eax
je 0x14000657f
mov edx, 0x5c
lea rcx, [rbp + 0x1610]
call fcn.140051a80
mov rsi, rax
test rax, rax
je 0x14000607d
add rsi, 2
jmp 0x140006084
lea rsi, [rbp + 0x1610]
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
mov ecx, 0x88
call fcn.14004fd74
mov qword [rbp + 0x2a8], rax
test rax, rax
je 0x1400060de
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
mov qword [rax + 0x80], rcx
mov dl, 1
mov rcx, rax
call fcn.140010420
mov r15, rax
jmp 0x1400060e1
xor r15d, r15d
mov qword [rbp + 0x2b0], r15
mov ecx, 0x18
call fcn.14004fd74
mov rbx, rax
mov qword [rsp + 0x30], rax
test rax, rax
je 0x14000611c
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax + 8], 1
mov dword [rax + 0xc], 1
mov qword [rax], rdi
mov qword [rax + 0x10], r15
jmp 0x14000611e
xor ebx, ebx
mov qword [rbp + 0xb8], r15
mov qword [rbp + 0xc0], rbx
test r14, r14
je 0x1400061a8
lea rcx, [0x140079cb0]
call fcn.1400387c0
mov rcx, rax
call fcn.14003bd00
mov rcx, rax
lea rdx, str.NtQueryInformationProcess
call fcn.14003b800
xorps xmm0, xmm0
movups xmmword [rbp + 0x5e0], xmm0
movups xmmword [rbp + 0x5f0], xmm0
movups xmmword [rbp + 0x600], xmm0
mov dword [rbp + 0x5d4], 0
test rax, rax
je 0x1400061a8
lea rcx, [rbp + 0x5d4]
mov qword [rsp + 0x20], rcx
mov r9d, 0x30
lea r8, [rbp + 0x5e0]
xor edx, edx
mov rcx, r14
call rax
xor ecx, ecx
test eax, eax
cmove ecx, dword [rbp + 0x608]
jmp 0x1400061aa
xor ecx, ecx
mov dword [rbp + 0x5d0], ecx
mov ecx, 0x88
call fcn.14004fd74
mov rcx, rax
mov qword [rbp + 0x2b8], rax
test rax, rax
je 0x140006210
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm0
movups xmmword [rcx + 0x20], xmm0
movups xmmword [rcx + 0x30], xmm0
movups xmmword [rcx + 0x40], xmm0
movups xmmword [rcx + 0x50], xmm0
movups xmmword [rcx + 0x60], xmm0
movups xmmword [rcx + 0x70], xmm0
mov qword [rcx + 0x80], rax
mov eax, r13d
lea r8, [rbp + 0x610]
lea r8, [r8 + rax*4]
mov r9d, 4
mov dl, 1
call fcn.140010550
nop
mov rdx, rax
lea rcx, [rbp + 0x250]
call fcn.1400030b0
mov rdx, rax
mov rcx, r15
call fcn.140010c50
mov ecx, 0x88
call fcn.14004fd74
mov rdi, rax
mov qword [rbp + 0x2e8], rax
test rax, rax
je 0x1400062bb
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
movups xmmword [rdi + 0x50], xmm0
movups xmmword [rdi + 0x60], xmm0
movups xmmword [rdi + 0x70], xmm0
mov qword [rdi + 0x80], rax
movups xmmword [rbp + 0x188], xmm0
mov qword [rbp + 0x198], rax
mov qword [rbp + 0x1a0], rax
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rsi + r8*2], ax
jne 0x140006290
mov rdx, rsi
lea rcx, [rbp + 0x188]
call fcn.1400032b0
lea r8, [rbp + 0x188]
mov dl, 2
mov rcx, rdi
call fcn.140010730
nop
mov rdx, rax
lea rcx, [rbp + 0x260]
call fcn.1400030b0
mov rdx, rax
mov rcx, r15
call fcn.140010c50
mov ecx, 0x88
call fcn.14004fd74
mov rdi, rax
mov qword [rbp + 0x2c0], rax
mov rsi, qword [rsp + 0x48]
test rax, rax
je 0x14000633e
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
movups xmmword [rdi + 0x50], xmm0
movups xmmword [rdi + 0x60], xmm0
movups xmmword [rdi + 0x70], xmm0
mov qword [rdi + 0x80], rax
mov r8, r14
lea rdx, [rbp + 0x338]
mov rcx, rsi
call fcn.140004be0
mov r8, rax
mov dl, 3
mov rcx, rdi
call fcn.140010730
nop
mov rdx, rax
lea rcx, [rbp + 0x2d8]
call fcn.1400030b0
mov rdx, rax
mov rcx, r15
call fcn.140010c50
mov ecx, 0x88
call fcn.14004fd74
mov rdi, rax
mov qword [rbp + 0x2c8], rax
test rax, rax
je 0x14000640c
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
movups xmmword [rdi + 0x50], xmm0
movups xmmword [rdi + 0x60], xmm0
movups xmmword [rdi + 0x70], xmm0
mov qword [rdi + 0x80], rax
mov rdx, r14
mov rcx, rsi
call fcn.140004ea0
lea rdx, str.32bit
test al, al
lea rax, str.64bit
cmovne rdx, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a8], xmm0
xor eax, eax
mov qword [rbp + 0x1b8], rax
mov qword [rbp + 0x1c0], rax
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp word [rdx + r8*2], ax
jne 0x1400063e3
lea rcx, [rbp + 0x1a8]
call fcn.1400032b0
lea r8, [rbp + 0x1a8]
mov dl, 4
mov rcx, rdi
call fcn.140010730
jmp 0x140006413
mov rsi, 0xffffffffffffffff
mov rdx, rax
lea rcx, [rbp + 0x278]
call fcn.1400030b0
mov rdx, rax
mov rcx, r15
call fcn.140010c50
mov ecx, 0x88
call fcn.14004fd74
mov rdi, rax
mov qword [rbp + 0x2d0], rax
test rax, rax
je 0x140006493
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rdi], xmm0
movups xmmword [rdi + 0x10], xmm0
movups xmmword [rdi + 0x20], xmm0
movups xmmword [rdi + 0x30], xmm0
movups xmmword [rdi + 0x40], xmm0
movups xmmword [rdi + 0x50], xmm0
movups xmmword [rdi + 0x60], xmm0
movups xmmword [rdi + 0x70], xmm0
mov qword [rdi + 0x80], rax
mov r8, r14
lea rdx, [rbp + 0x358]
mov rcx, qword [rsp + 0x48]
call fcn.1400049f0
mov r8, rax
mov dl, 5
mov rcx, rdi
call fcn.140010730
nop
mov rdx, rax
lea rcx, [rbp + 0x288]
call fcn.1400030b0
mov rdx, rax
mov rcx, r15
call fcn.140010c50
mov ecx, 0x88
call fcn.14004fd74
mov qword [rbp + 0x48], rax
test rax, rax
je 0x140006501
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rax], xmm0
movups xmmword [rax + 0x10], xmm0
movups xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm0
movups xmmword [rax + 0x40], xmm0
movups xmmword [rax + 0x50], xmm0
movups xmmword [rax + 0x60], xmm0
movups xmmword [rax + 0x70], xmm0
mov qword [rax + 0x80], rcx
lea r9d, [rcx + 4]
lea r8, [rbp + 0x5d0]
mov dl, 6
mov rcx, rax
call fcn.140010550
nop
mov rdx, rax
lea rcx, [rbp + 0x298]
call fcn.1400030b0
mov rdx, rax
mov rcx, r15
call fcn.140010c50
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x58], xmm0
test rbx, rbx
je 0x14000652c
lock inc dword [rbx + 8]
mov qword [rbp - 0x58], r15
mov qword [rbp - 0x50], rbx
lea rdx, [rbp - 0x58]
mov rcx, qword [rsp + 0x40]
call fcn.140010c50
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
test rbx, rbx
je 0x14000657a
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x14000657a
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x14000657a
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 8]
mov r15, qword [rsp + 0x40]
movabs rdx, 0x3f003f003f
mov eax, dword [rsp + 0x38]
inc r13d
add r12, 4
cmp r13d, eax
lea rdi, vtable.WRST::MCYVMA_PKO_.0
jb 0x140005ac0
mov r12, qword [rbp - 0x38]
mov r13, qword [rsp + 0x40]
lea rdx, [rbp - 0x38]
mov rcx, r13
call fcn.140011070
mov rdx, rax
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rbx + 0x68]
call fcn.1400092d0
mov dl, 1
mov ecx, dword [rbx + 0x58]
call fcn.140021f00
call fcn.14002f370
nop
test r12, r12
je 0x14000660d
mov eax, esi
lock xadd dword [r12 + 8], eax
cmp eax, 1
jne 0x14000660d
mov rax, qword [r12]
mov rcx, r12
call qword [rax]
lock xadd dword [r12 + 0xc], esi
cmp esi, 1
jne 0x14000660d
mov rax, qword [r12]
mov rcx, r12
call qword [rax + 8]
nop
mov rcx, qword [rbp + 0x5c0]
mov rbx, qword [rcx + 8]
cmp byte [rbx + 0x19], 0
jne 0x140006654
nop
mov r8, qword [rbx + 0x10]
lea rdx, [rbp + 0x5c0]
lea rcx, [rbp + 0x5c0]
call fcn.140004890
mov rcx, rbx
mov rbx, qword [rbx]
mov edx, 0x28
call fcn.14004fdb0
cmp byte [rbx + 0x19], 0
je 0x140006620
mov rcx, qword [rbp + 0x5c0]
mov edx, 0x28
call fcn.14004fdb0
mov rcx, qword [rbp + 0x1820]
xor rcx, rsp
call fcn.14004fe50
lea r11, [rsp + 0x1930]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140005180
nop
int3