Function at 0x14001dda0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rdi
push rbp
mov rbp, rsp
sub rsp, 0x50
mov rax, qword [0x1401a8f70]
xor rax, rsp
mov qword [rbp - 8], rax
movzx eax, word [0x14013dc20]
lea rcx, [rbp - 0x30]
movsd xmm0, qword [str.ollydbg.exe]
xor edi, edi
mov word [rbp - 0x28], ax
movzx eax, byte [0x14013dc22]
mov byte [rbp - 0x26], al
mov dword [rbp - 0x24], edi
mov qword [rbp - 0x20], recv
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
movsd qword [rbp - 0x30], xmm0
mov byte [rbp - 0x25], dil
call fcn.14001c890
mov rdx, qword [rbp - 0x18]
mov rbx, rax
cmp rdx, 0x10
jb 0x14001de42
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001de3d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb62
call fcn.14010bf20
test rbx, rbx
jne 0x14001f46a
lea ecx, [rbx + 0x20]
mov qword [rbp - 0x28], rdi
call fcn.14010c2e4
movups xmm0, xmmword [str.ProcessHacker.exe]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x20], reloc.WS2_32.dll_recvfrom
movups xmmword [rax], xmm0
movzx ecx, byte [0x14013dc38]
mov byte [rax + 0x10], cl
lea rcx, [rbp - 0x30]
mov qword [rbp - 0x18], Ordinal_33
mov byte [rax + 0x11], dil
call fcn.14001c890
mov rdx, qword [rbp - 0x18]
mov rbx, rax
cmp rdx, 0x10
jb 0x14001deca
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001dec5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb62
call fcn.14010bf20
test rbx, rbx
jne 0x14001f46a
mov eax, dword [0x14013dc48]
lea rcx, [rbp - 0x30]
movsd xmm0, qword [str.Dump_Fixer.exe]
mov dword [rbp - 0x28], eax
movzx eax, word [0x14013dc4c]
mov word [rbp - 0x24], ax
mov word [rbp - 0x22], di
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohl
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
movsd qword [rbp - 0x30], xmm0
call fcn.14001c890
mov rdx, qword [rbp - 0x18]
mov rbx, rax
cmp rdx, 0x10
jb 0x14001df4f
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001df4a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb62
call fcn.14010bf20
test rbx, rbx
jne 0x14001f46a
mov eax, dword [0x14013dc58]
lea rcx, [rbp - 0x30]
movsd xmm0, qword [str.kdstinker.exe]
mov dword [rbp - 0x28], eax
movzx eax, byte [0x14013dc5c]
mov byte [rbp - 0x24], al
mov word [rbp - 0x22], di
mov qword [rbp - 0x20], reloc.WS2_32.dll_listen
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
movsd qword [rbp - 0x30], xmm0
mov byte [rbp - 0x23], dil
call fcn.14001c890
mov rdx, qword [rbp - 0x18]
mov rbx, rax
cmp rdx, 0x10
jb 0x14001dfd7
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001dfd2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb62
call fcn.14010bf20
test rbx, rbx
jne 0x14001f46a
movzx eax, word [0x14013dc68]
lea rcx, [rbp - 0x30]
movsd xmm0, qword [str.tcpview.exe]
mov word [rbp - 0x28], ax
movzx eax, byte [0x14013dc6a]
mov byte [rbp - 0x26], al
mov dword [rbp - 0x24], edi
mov qword [rbp - 0x20], recv
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
movsd qword [rbp - 0x30], xmm0
mov byte [rbp - 0x25], dil
call fcn.14001c890
mov rdx, qword [rbp - 0x18]
mov rbx, rax
cmp rdx, 0x10
jb 0x14001e060
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e05b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb62
call fcn.14010bf20
test rbx, rbx
jne 0x14001f46a
mov eax, dword [0x14013dc78]
lea rcx, [rbp - 0x30]
xorps xmm0, xmm0
mov qword [rbp - 0x20], send
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.autoruns.exe]
movsd qword [rbp - 0x30], xmm0
mov dword [rbp - 0x28], eax
mov byte [rbp - 0x24], dil
call fcn.14001c890
mov rdx, qword [rbp - 0x18]
mov rbx, rax
cmp rdx, 0x10
jb 0x14001e0e1
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e0dc
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb62
call fcn.14010bf20
test rbx, rbx
jne 0x14001f46a
mov eax, dword [0x14013dc88]
lea rcx, [rbp - 0x30]
movsd xmm0, qword [str.autorunsc.exe]
mov dword [rbp - 0x28], eax
movzx eax, byte [0x14013dc8c]
mov byte [rbp - 0x24], al
mov word [rbp - 0x22], di
mov qword [rbp - 0x20], reloc.WS2_32.dll_listen
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
movsd qword [rbp - 0x30], xmm0
mov byte [rbp - 0x23], dil
call fcn.14001c890
mov rdx, qword [rbp - 0x18]
mov rbx, rax
cmp rdx, 0x10
jb 0x14001e169
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e164
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb62
call fcn.14010bf20
test rbx, rbx
jne 0x14001f46a
movzx eax, word [0x14013dc98]
lea rcx, [rbp - 0x30]
movsd xmm0, qword [str.filemon.exe]
mov word [rbp - 0x28], ax
movzx eax, byte [0x14013dc9a]
mov byte [rbp - 0x26], al
mov dword [rbp - 0x24], edi
mov qword [rbp - 0x20], recv
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
movsd qword [rbp - 0x30], xmm0
mov byte [rbp - 0x25], dil
call fcn.14001c890
mov rdx, qword [rbp - 0x18]
mov rbx, rax
cmp rdx, 0x10
jb 0x14001e1f2
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e1ed
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb62
call fcn.14010bf20
test rbx, rbx
jne 0x14001f46a
movzx eax, word [0x14013dca8]
lea rcx, [rbp - 0x30]
movsd xmm0, qword [str.procmon.exe]
mov word [rbp - 0x28], ax
movzx eax, byte [0x14013dcaa]
mov byte [rbp - 0x26], al
mov dword [rbp - 0x24], edi
mov qword [rbp - 0x20], recv
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
movsd qword [rbp - 0x30], xmm0
mov byte [rbp - 0x25], dil
call fcn.14001c890
mov rdx, qword [rbp - 0x18]
mov rbx, rax
cmp rdx, 0x10
jb 0x14001e27b
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e276
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb62
call fcn.14010bf20
test rbx, rbx
jne 0x14001f46a
movzx eax, word [0x14013dcb8]
lea rcx, [rbp - 0x30]
xorps xmm0, xmm0
mov qword [rbp - 0x20], 0xa
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.regmon.exe]
movsd qword [rbp - 0x30], xmm0
mov word [rbp - 0x28], ax
mov byte [rbp - 0x26], dil
call fcn.14001c890
mov rdx, qword [rbp - 0x18]
mov rbx, rax
cmp rdx, 0x10
jb 0x14001e2fe
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e2f9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb62
call fcn.14010bf20
test rbx, rbx
jne 0x14001f46a
movzx eax, word [0x14013dcc8]
lea rcx, [rbp - 0x30]
movsd xmm0, qword [str.procexp.exe]
mov word [rbp - 0x28], ax
movzx eax, byte [0x14013dcca]
mov byte [rbp - 0x26], al
mov dword [rbp - 0x24], edi
mov qword [rbp - 0x20], recv
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
movsd qword [rbp - 0x30], xmm0
mov byte [rbp - 0x25], dil
call fcn.14001c890
mov rdx, qword [rbp - 0x18]
mov rbx, rax
cmp rdx, 0x10
jb 0x14001e387
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e382
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb62
call fcn.14010bf20
test rbx, rbx
jne 0x14001f46a
lea ecx, [rbx + 0x20]
mov qword [rbp - 0x28], rdi
call fcn.14010c2e4
movups xmm0, xmmword [str.ImmunityDebugger.exe]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x20], reloc.WS2_32.dll_sendto
movups xmmword [rax], xmm0
mov ecx, dword [0x14013dce0]
mov dword [rax + 0x10], ecx
lea rcx, [rbp - 0x30]
mov qword [rbp - 0x18], Ordinal_33
mov byte [rax + 0x14], dil
call fcn.14001c890
mov rdx, qword [rbp - 0x18]
mov rbx, rax
cmp rdx, 0x10
jb 0x14001e40e
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e409
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb62
call fcn.14010bf20
test rbx, rbx
jne 0x14001f46a
mov eax, dword [0x14013dcf0]
lea rcx, [rbp - 0x30]
movsd xmm0, qword [str.Wireshark.exe]
mov dword [rbp - 0x28], eax
movzx eax, byte [0x14013dcf4]
mov byte [rbp - 0x24], al
mov word [rbp - 0x22], di
mov qword [rbp - 0x20], reloc.WS2_32.dll_listen
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
movsd qword [rbp - 0x30], xmm0
mov byte [rbp - 0x23], dil
call fcn.14001c890
mov rdx, qword [rbp - 0x18]
mov rbx, rax
cmp rdx, 0x10
jb 0x14001e496
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e491
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb62
call fcn.14010bf20
test rbx, rbx
jne 0x14001f46a
movzx eax, word [0x14013dd00]
lea rcx, [rbp - 0x30]
movsd xmm0, qword [str.dumpcap.exe]
mov word [rbp - 0x28], ax
movzx eax, byte [0x14013dd02]
mov byte [rbp - 0x26], al
mov dword [rbp - 0x24], edi
mov qword [rbp - 0x20], recv
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
movsd qword [rbp - 0x30], xmm0
mov byte [rbp - 0x25], dil
call fcn.14001c890
mov rdx, qword [rbp - 0x18]
mov rbx, rax
cmp rdx, 0x10
jb 0x14001e51f
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e51a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb62
call fcn.14010bf20
test rbx, rbx
jne 0x14001f46a
lea ecx, [rbx + 0x20]
mov qword [rbp - 0x28], rdi
call fcn.14010c2e4
movups xmm0, xmmword [str.HookExplorer.exe]
lea rcx, [rbp - 0x30]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x20], reloc.WS2_32.dll_recv
movups xmmword [rax], xmm0
mov byte [rax + 0x10], dil
mov qword [rbp - 0x18], Ordinal_33
call fcn.14001c890
mov rdx, qword [rbp - 0x18]
mov rbx, rax
cmp rdx, 0x10
jb 0x14001e59d
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e598
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb62
call fcn.14010bf20
test rbx, rbx
jne 0x14001f46a
mov eax, dword [0x14013dd28]
lea rcx, [rbp - 0x30]
movsd xmm0, qword [str.ImportREC.exe]
mov dword [rbp - 0x28], eax
movzx eax, byte [0x14013dd2c]
mov byte [rbp - 0x24], al
mov word [rbp - 0x22], di
mov qword [rbp - 0x20], reloc.WS2_32.dll_listen
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
movsd qword [rbp - 0x30], xmm0
mov byte [rbp - 0x23], dil
call fcn.14001c890
mov rdx, qword [rbp - 0x18]
mov rbx, rax
cmp rdx, 0x10
jb 0x14001e625
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e620
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb62
call fcn.14010bf20
test rbx, rbx
jne 0x14001f46a
movzx eax, word [0x14013dd38]
lea rcx, [rbp - 0x30]
movsd xmm0, qword [str.PETools.exe]
mov word [rbp - 0x28], ax
movzx eax, byte [0x14013dd3a]
mov byte [rbp - 0x26], al
mov dword [rbp - 0x24], edi
mov qword [rbp - 0x20], recv
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
movsd qword [rbp - 0x30], xmm0
mov byte [rbp - 0x25], dil
call fcn.14001c890
mov rdx, qword [rbp - 0x18]
mov rbx, rax
cmp rdx, 0x10
jb 0x14001e6ae
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e6a9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb62
call fcn.14010bf20
test rbx, rbx
jne 0x14001f46a
movzx eax, word [0x14013dd48]
lea rcx, [rbp - 0x30]
xorps xmm0, xmm0
mov qword [rbp - 0x20], 0xa
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.LordPE.exe]
movsd qword [rbp - 0x30], xmm0
mov word [rbp - 0x28], ax
mov byte [rbp - 0x26], dil
call fcn.14001c890
mov rdx, qword [rbp - 0x18]
mov rbx, rax
cmp rdx, 0x10
jb 0x14001e731
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e72c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb62
call fcn.14010bf20
test rbx, rbx
jne 0x14001f46a
movzx eax, word [0x14013dd00]
lea rcx, [rbp - 0x30]
movsd xmm0, qword [str.dumpcap.exe]
mov word [rbp - 0x28], ax
movzx eax, byte [0x14013dd02]
mov byte [rbp - 0x26], al
mov dword [rbp - 0x24], edi
mov qword [rbp - 0x20], recv
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
movsd qword [rbp - 0x30], xmm0
mov byte [rbp - 0x25], dil
call fcn.14001c890
mov rdx, qword [rbp - 0x18]
mov rbx, rax
cmp rdx, 0x10
jb 0x14001e7ba
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e7b5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb62
call fcn.14010bf20
test rbx, rbx
jne 0x14001f46a
lea ecx, [rbx + 0x20]
mov qword [rbp - 0x28], rdi
call fcn.14010c2e4
movups xmm0, xmmword [str.SysInspector.exe]
lea rcx, [rbp - 0x30]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x20], reloc.WS2_32.dll_recv
movups xmmword [rax], xmm0
mov byte [rax + 0x10], dil
mov qword [rbp - 0x18], Ordinal_33
call fcn.14001c890
mov rdx, qword [rbp - 0x18]
mov rbx, rax
cmp rdx, 0x10
jb 0x14001e838
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e833
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb62
call fcn.14010bf20
test rbx, rbx
jne 0x14001f46a
lea ecx, [rbx + 0x20]
mov qword [rbp - 0x28], rdi
call fcn.14010c2e4
movups xmm0, xmmword [str.proc_analyzer.exe]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x20], reloc.WS2_32.dll_recvfrom
movups xmmword [rax], xmm0
movzx ecx, byte [0x14013dd78]
mov byte [rax + 0x10], cl
lea rcx, [rbp - 0x30]
mov qword [rbp - 0x18], Ordinal_33
mov byte [rax + 0x11], dil
call fcn.14001c890
mov rdx, qword [rbp - 0x18]
mov rbx, rax
cmp rdx, 0x10
jb 0x14001e8c0
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e8bb
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb62
call fcn.14010bf20
test rbx, rbx
jne 0x14001f46a
mov eax, dword [0x14013dd88]
lea rcx, [rbp - 0x30]
movsd xmm0, qword [str.sysAnalyzer.exe]
mov dword [rbp - 0x28], eax
movzx eax, word [0x14013dd8c]
mov word [rbp - 0x24], ax
movzx eax, byte [0x14013dd8e]
mov byte [rbp - 0x22], al
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
movsd qword [rbp - 0x30], xmm0
mov byte [rbp - 0x21], dil
call fcn.14001c890
mov rdx, qword [rbp - 0x18]
mov rbx, rax
cmp rdx, 0x10
jb 0x14001e94f
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e94a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb62
call fcn.14010bf20
test rbx, rbx
jne 0x14001f46a
mov eax, dword [0x14013dd98]
lea rcx, [rbp - 0x30]
movsd xmm0, qword [str.sniff_hit.exe]
mov dword [rbp - 0x28], eax
movzx eax, byte [0x14013dd9c]
mov byte [rbp - 0x24], al
mov word [rbp - 0x22], di
mov qword [rbp - 0x20], reloc.WS2_32.dll_listen
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
movsd qword [rbp - 0x30], xmm0
mov byte [rbp - 0x23], dil
call fcn.14001c890
mov rdx, qword [rbp - 0x18]
mov rbx, rax
cmp rdx, 0x10
jb 0x14001e9d7
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001e9d2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb62
call fcn.14010bf20
test rbx, rbx
jne 0x14001f46a
movzx eax, word [0x14013dda8]
lea rcx, [rbp - 0x30]
xorps xmm0, xmm0
mov qword [rbp - 0x20], 0xa
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.windbg.exe]
movsd qword [rbp - 0x30], xmm0
mov word [rbp - 0x28], ax
mov byte [rbp - 0x26], dil
call fcn.14001c890
mov rdx, qword [rbp - 0x18]
mov rbx, rax
cmp rdx, 0x10
jb 0x14001ea5a
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ea55
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb62
call fcn.14010bf20
test rbx, rbx
jne 0x14001f46a
lea ecx, [rbx + 0x20]
mov qword [rbp - 0x28], rdi
call fcn.14010c2e4
movups xmm0, xmmword [str.joeboxcontrol.exe]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x20], reloc.WS2_32.dll_recvfrom
movups xmmword [rax], xmm0
movzx ecx, byte [0x14013ddc0]
mov byte [rax + 0x10], cl
lea rcx, [rbp - 0x30]
mov qword [rbp - 0x18], Ordinal_33
mov byte [rax + 0x11], dil
call fcn.14001c890
mov rdx, qword [rbp - 0x18]
mov rbx, rax
cmp rdx, 0x10
jb 0x14001eae2
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001eadd
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001eb62
call fcn.14010bf20
test rbx, rbx
jne 0x14001f46a
movzx eax, word [0x14013ddd0]
lea rcx, [rbp - 0x30]
movsd xmm0, qword [str.Fiddler.exe]
mov word [rbp - 0x28], ax
movzx eax, byte [0x14013ddd2]
mov byte [rbp - 0x26], al
mov dword [rbp - 0x24], edi
mov qword [rbp - 0x20], recv
mov qword [rbp - 0x18], reloc.WS2_32.dll_ntohs
movsd qword [rbp - 0x30], xmm0
mov byte [rbp - 0x25], dil
call fcn.14001c890
mov rdx, qword [rbp - 0x18]
mov rbx, rax
cmp rdx, 0x10
jb 0x14001eb6e
mov rcx, qword [rbp - 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001eb69
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001eb69
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14010bf20
test rbx, rbx
jne 0x14001f46a
lea ecx, [rbx + 0x20]
mov qword [rbp - 0x28], rdi
call fcn.14010c2e4
mov r8d, reloc.WS2_32.dll_recv
mov qword [rbp - 0x30], rax
lea rdx, str.joeboxserver.exe
mov qword [rbp - 0x20], reloc.WS2_32.dll_recv
mov rcx, rax
mov qword [rbp - 0x18], Ordinal_33
mov rbx, rax
call fcn.14000fe20
lea rcx, [rbp - 0x30]
mov byte [rbx + 0x10], dil
call fcn.14001c890
lea rcx, [rbp - 0x30]
mov rbx, rax
call fcn.140023ec0
test rbx, rbx
jne 0x14001f46a
lea rdx, str.ida64.exe
lea rcx, [rbp - 0x30]
call fcn.14000fc80
lea rcx, [rbp - 0x30]
call fcn.14001c890
lea rcx, [rbp - 0x30]
mov rbx, rax
call fcn.140023ec0
test rbx, rbx
jne 0x14001f46a
lea rdx, str.ida.exe
lea rcx, [rbp - 0x30]
call fcn.14000fc80
lea rcx, [rbp - 0x30]
call fcn.14001c890
lea rcx, [rbp - 0x30]
mov rbx, rax
call fcn.140023ec0
test rbx, rbx
jne 0x14001f46a
lea rdx, str.idaq64.exe
lea rcx, [rbp - 0x30]
call fcn.14000fc80
lea rcx, [rbp - 0x30]
call fcn.14001c890
lea rcx, [rbp - 0x30]
mov rbx, rax
call fcn.140023ec0
test rbx, rbx
jne 0x14001f46a
lea rdx, str.Vmtoolsd.exe
lea rcx, [rbp - 0x30]
call fcn.14000fc80
lea rcx, [rbp - 0x30]
call fcn.14001c890
lea rcx, [rbp - 0x30]
mov rbx, rax
call fcn.140023ec0
test rbx, rbx
jne 0x14001f46a
lea rdx, str.Vmwaretrat.exe
lea rcx, [rbp - 0x30]
call fcn.14000fc80
lea rcx, [rbp - 0x30]
call fcn.14001c890
lea rcx, [rbp - 0x30]
mov rbx, rax
call fcn.140023ec0
test rbx, rbx
jne 0x14001f46a
lea rdx, str.Vmwareuser.exe
lea rcx, [rbp - 0x30]
call fcn.14000fc80
lea rcx, [rbp - 0x30]
call fcn.14001c890
lea rcx, [rbp - 0x30]
mov rbx, rax
call fcn.140023ec0
test rbx, rbx
jne 0x14001f46a
lea rdx, str.Vmacthlp.exe
lea rcx, [rbp - 0x30]
call fcn.14000fc80
lea rcx, [rbp - 0x30]
call fcn.14001c890
lea rcx, [rbp - 0x30]
mov rbx, rax
call fcn.140023ec0
test rbx, rbx
jne 0x14001f46a
lea rdx, str.vboxservice.exe
lea rcx, [rbp - 0x30]
call fcn.14000fc80
lea rcx, [rbp - 0x30]
call fcn.14001c890
lea rcx, [rbp - 0x30]
mov rbx, rax
call fcn.140023ec0
test rbx, rbx
jne 0x14001f46a
lea rdx, str.vboxtray.exe
lea rcx, [rbp - 0x30]
call fcn.14000fc80
lea rcx, [rbp - 0x30]
call fcn.14001c890
lea rcx, [rbp - 0x30]
mov rbx, rax
call fcn.140023ec0
test rbx, rbx
jne 0x14001f46a
lea rdx, str.ReClass.NET.exe
lea rcx, [rbp - 0x30]
call fcn.14000fc80
lea rcx, [rbp - 0x30]
call fcn.14001c890
lea rcx, [rbp - 0x30]
mov rbx, rax
call fcn.140023ec0
test rbx, rbx
jne 0x14001f46a
lea rdx, str.x64dbg.exe
lea rcx, [rbp - 0x30]
call fcn.14000fc80
lea rcx, [rbp - 0x30]
call fcn.14001c890
lea rcx, [rbp - 0x30]
mov rbx, rax
call fcn.140023ec0
test rbx, rbx
jne 0x14001f46a
lea rdx, str.OLLYDBG.exe
lea rcx, [rbp - 0x30]
call fcn.14000fc80
lea rcx, [rbp - 0x30]
call fcn.14001c890
lea rcx, [rbp - 0x30]
mov rbx, rax
call fcn.140023ec0
test rbx, rbx
jne 0x14001f46a
lea rdx, str.Cheat_Engine.exe
lea rcx, [rbp - 0x30]
call fcn.14000fc80
lea rcx, [rbp - 0x30]
call fcn.14001c890
lea rcx, [rbp - 0x30]
mov rbx, rax
call fcn.140023ec0
test rbx, rbx
jne 0x14001f46a
lea rdx, str.cheatengine_x86_64_SSE4_AVX2.exe
lea rcx, [rbp - 0x30]
call fcn.14000fc80
lea rcx, [rbp - 0x30]
call fcn.14001c890
lea rcx, [rbp - 0x30]
mov rbx, rax
call fcn.140023ec0
test rbx, rbx
jne 0x14001f46a
movdqa xmm0, xmmword [0x140169a00]
lea rcx, [rbp - 0x30]
movdqa xmm1, xmmword [0x140169aa0]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x10], 0x100
movdqu xmmword [rbp - 0x20], xmm1
call fcn.14001c790
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14001f46a
lea rdx, str.MugenJinFuu_i386.exe
lea rcx, [rbp - 0x30]
call fcn.14000fc80
lea rcx, [rbp - 0x30]
call fcn.14001c890
lea rcx, [rbp - 0x30]
mov rbx, rax
call fcn.140023ec0
test rbx, rbx
jne 0x14001f46a
movdqa xmm0, xmmword [0x140169860]
lea rcx, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x79637f37
mov word [rbp - 0x1c], 0x100
call fcn.14001f490
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14001f46a
lea rdx, str.Mugen_JinFuu.exe
lea rcx, [rbp - 0x30]
call fcn.14000fc80
lea rcx, [rbp - 0x30]
call fcn.14001c890
lea rcx, [rbp - 0x30]
mov rbx, rax
call fcn.140023ec0
test rbx, rbx
jne 0x14001f46a
movdqa xmm0, xmmword [0x140169c30]
lea rcx, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x20], 0x100
call fcn.140013a30
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14001f46a
lea rdx, str.MugenJinFuu_x86_64_SSE4_AVX2.exe
lea rcx, [rbp - 0x30]
call fcn.14000fc80
lea rcx, [rbp - 0x30]
call fcn.14001c890
lea rcx, [rbp - 0x30]
mov rbx, rax
call fcn.140023ec0
test rbx, rbx
jne 0x14001f46a
movdqa xmm0, xmmword [0x1401699f0]
lea rcx, [rbp - 0x30]
movdqa xmm1, xmmword [0x140169aa0]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x10], 0x100
movdqu xmmword [rbp - 0x20], xmm1
call fcn.14001c790
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14001f46a
lea rdx, str.MugenJinFuu_x86_64.exe
lea rcx, [rbp - 0x30]
call fcn.14000fc80
lea rcx, [rbp - 0x30]
call fcn.14001c890
lea rcx, [rbp - 0x30]
mov rbx, rax
call fcn.140023ec0
test rbx, rbx
jne 0x14001f46a
movdqa xmm0, xmmword [0x1401699f0]
lea rcx, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x79352e2f
mov dword [rbp - 0x1c], 0x1007b65
call fcn.14001dd70
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14001f46a
movdqa xmm0, xmmword [0x140169c20]
lea rcx, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x6e746d6d
mov dword [rbp - 0x1c], 0x4e5e3e76
mov dword [rbp - 0x18], 0x5e5a4e40
mov dword [rbp - 0x14], 0x1005440
call fcn.14001f4c0
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14001f46a
movdqa xmm0, xmmword [0x140169bb0]
lea rcx, [rbp - 0x30]
movdqa xmm1, xmmword [0x140169a20]
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x10], 0x494c4d5c
movdqu xmmword [rbp - 0x20], xmm1
mov word [rbp - 0xc], 0x5f
mov byte [rbp - 0xa], 1
call fcn.14001dc10
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14001f46a
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x683f3c71
mov dword [rbp - 0x2c], 0x100696f
call fcn.140017440
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14001f46a
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x794f7942
mov dword [rbp - 0x2c], 0x626a7e60
mov word [rbp - 0x28], 0x100
call fcn.1400174a0
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14001f46a
lea rdx, str.KsDumper.exe
lea rcx, [rbp - 0x30]
call fcn.14000fc80
lea rcx, [rbp - 0x30]
call fcn.14001c890
lea rcx, [rbp - 0x30]
mov rbx, rax
call fcn.140023ec0
test rbx, rbx
jne 0x14001f46a
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x7c58646d
mov word [rbp - 0x2c], reloc.WS2_32.dll_WSACleanup
mov byte [rbp - 0x2a], 1
call fcn.14001dc40
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14001f46a
lea rdx, str.dnSpy.exe
lea rcx, [rbp - 0x30]
call fcn.14000fc80
lea rcx, [rbp - 0x30]
call fcn.14001c890
lea rcx, [rbp - 0x30]
mov rbx, rax
call fcn.140023ec0
test rbx, rbx
jne 0x14001f46a
lea rdx, str.cheatengine_i386.exe
lea rcx, [rbp - 0x30]
call fcn.14000fc80
lea rcx, [rbp - 0x30]
call fcn.14001c890
lea rcx, [rbp - 0x30]
mov rbx, rax
call fcn.140023ec0
test rbx, rbx
jne 0x14001f46a
lea rdx, str.cheatengine_x86_64.exe
lea rcx, [rbp - 0x30]
call fcn.14000fc80
lea rcx, [rbp - 0x30]
call fcn.14001c890
lea rcx, [rbp - 0x30]
mov rbx, rax
call fcn.140023ec0
test rbx, rbx
jne 0x14001f46a
lea rdx, str.Fiddler_Everywhere.exe
lea rcx, [rbp - 0x30]
call fcn.14000fc80
lea rcx, [rbp - 0x30]
call fcn.14001c890
lea rcx, [rbp - 0x30]
mov rbx, rax
call fcn.140023ec0
test rbx, rbx
jne 0x14001f46a
lea rdx, str.HTTPDebuggerSvc.exe
lea rcx, [rbp - 0x30]
call fcn.14000fc80
lea rcx, [rbp - 0x30]
call fcn.14001c890
lea rcx, [rbp - 0x30]
mov rbx, rax
call fcn.140023ec0
test rbx, rbx
jne 0x14001f46a
lea rdx, str.Fiddler.WebUi.exe
lea rcx, [rbp - 0x30]
call fcn.14000fc80
lea rcx, [rbp - 0x30]
call fcn.14001c890
lea rcx, [rbp - 0x30]
mov rbx, rax
call fcn.140023ec0
test rbx, rbx
jne 0x14001f46a
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x7d6a6e60
mov dword [rbp - 0x2c], 0x1003a3b
call fcn.140017440
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14001f46a
movdqa xmm0, xmmword [0x140169c50]
lea rcx, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x1007f6b
call fcn.14001c7f0
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14001f46a
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x6979635e
mov dword [rbp - 0x2c], 0x626e667e
mov word [rbp - 0x28], 0x7a
mov byte [rbp - 0x26], 1
call fcn.140017470
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14001f46a
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x7c667f4d
mov dword [rbp - 0x2c], 0x7f6f6e
mov byte [rbp - 0x28], 1
call fcn.140013a60
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14001f46a
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x686f634f
mov dword [rbp - 0x2c], 0x3e7d6b61
mov dword [rbp - 0x28], 0x41717746
mov word [rbp - 0x24], 0x7c
mov byte [rbp - 0x22], 1
call fcn.140013a90
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14001f46a
movdqa xmm0, xmmword [str.A__Jjrdutqg6_l9n_hjt_vp_rD]
lea rcx, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov dword [rbp - 0x20], 0x6872782b
mov dword [rbp - 0x1c], 0x100376e
call fcn.14001dd70
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14001f46a
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x5c5f5e41
mov dword [rbp - 0x2c], 0x726a4a2d
mov dword [rbp - 0x28], 0x71747564
mov word [rbp - 0x24], 0x67
mov byte [rbp - 0x22], 1
call fcn.140013a90
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14001f46a
lea rcx, [rbp - 0x30]
mov dword [rbp - 0x30], 0x3a6a6e60
mov word [rbp - 0x2c], reloc.WS2_32.dll_gethostname
mov byte [rbp - 0x2a], 1
call fcn.14001dc40
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14001f46a
movdqa xmm0, xmmword [str._NJ_9______]
lea rcx, [rbp - 0x30]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x20], 1
call fcn.14001f4f0
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
jne 0x14001f46a
lea rdx, str.createdump.exe
lea rcx, [rbp - 0x30]
call fcn.14000fc80
lea rcx, [rbp - 0x30]
call fcn.14001c890
lea rcx, [rbp - 0x30]
mov rbx, rax
call fcn.140023ec0
test rbx, rbx
je 0x14001f46f
call fcn.14001c4d0
mov rcx, qword [rbp - 8]
xor rcx, rsp
call fcn.14010bf00
mov rbx, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x68]
add rsp, 0x50
pop rbp
ret