Function at 0x140017090
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4e90]
mov eax, 0x4f90
call fcn.140084cd0
sub rsp, rax
mov rax, qword [0x1407eeb80]
xor rax, rsp
mov qword [rbp + 0x4e80], rax
mov ecx, 0x1000
call qword [sym.imp.USER32.dll_GetSystemMetrics]
test eax, eax
jne 0x140018beb
lea r8, [rbp + 0xc0]
mov edx, 0x4000
lea rcx, [rbp + 0x680]
call sub.KERNEL32.dll_K32EnumDeviceDrivers
xor r15d, r15d
mov rdi, 0xffffffffffffffff
movabs r12, 0xff945f7a4296841
movabs r14, 0xeaf6c782e5a780c6
test eax, eax
je 0x1400173b2
mov eax, dword [rbp + 0xc0]
cmp eax, 0x4000
jae 0x1400173b2
shr eax, 3
test eax, eax
je 0x1400173b2
mov esi, eax
mov ebx, r15d
movabs r13, 0x7a9b20b3d45d1c09
nop word [rax + rax]
mov r8d, 0x800
lea rdx, [rbp + 0x4680]
mov rcx, qword [rbp + rbx*8 + 0x680]
call sub.KERNEL32.dll_K32GetDeviceDriverBaseNameA
test eax, eax
je 0x1400173a6
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r15
mov qword [rbp + 0xf8], r15
lea rax, [rbp + 0x4680]
mov r8, rdi
inc r8
cmp byte [rax + r8], r15b
jne 0x140017194
lea rdx, [rbp + 0x4680]
lea rcx, [rbp + 0xe0]
call fcn.1400024b0
movabs rax, 0x7c8a2094cb5b182a
mov qword [rsp + 0x40], rax
movabs rax, 0xeaf6b5e78ec4e1ae
mov qword [rsp + 0x48], rax
mov qword [rbp + 0x100], r12
mov qword [rbp + 0x108], r14
movdqu xmm0, xmmword [rsp + 0x40]
xorps xmm0, xmmword [rbp + 0x100]
movdqa xmmword [rsp + 0x20], xmm0
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0xe0]
call fcn.140016f80
cmp rax, rdi
jne 0x140018c26
mov qword [rsp + 0x50], r13
movabs rax, 0xeaf6c782e5a780a1
mov qword [rsp + 0x58], rax
mov qword [rbp + 0x110], r12
mov qword [rbp + 0x118], r14
movdqu xmm0, xmmword [rsp + 0x50]
xorps xmm0, xmmword [rbp + 0x110]
movdqa xmmword [rsp + 0x20], xmm0
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0xe0]
call fcn.140016f80
cmp rax, rdi
jne 0x140018c1d
movabs rax, 0xff945f7a44f182f
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r14
mov qword [rbp + 0x120], r12
mov qword [rbp + 0x128], r14
movdqu xmm0, xmmword [rsp + 0x60]
xorps xmm0, xmmword [rbp + 0x120]
movdqa xmmword [rsp + 0x20], xmm0
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0xe0]
call fcn.140016f80
cmp rax, rdi
jne 0x140018c1d
movabs rax, 0x6b900d99c55d0115
mov qword [rsp + 0x70], rax
movabs rax, 0xeaf6c782e5a780a3
mov qword [rsp + 0x78], rax
mov qword [rbp + 0x130], r12
mov qword [rbp + 0x138], r14
movdqu xmm0, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp + 0x130]
movdqa xmmword [rsp + 0x20], xmm0
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0xe0]
call fcn.140016f80
cmp rax, rdi
jne 0x140018c1d
movabs rax, 0x50bd0a87d6480012
mov qword [rbp - 0x80], rax
movabs rax, 0xeaf6c782e5d1f282
mov qword [rbp - 0x78], rax
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
movdqu xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rsp + 0x20], xmm0
xor r8d, r8d
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0xe0]
call fcn.140016f80
mov rdx, qword [rbp + 0xf8]
cmp rax, rdi
jne 0x140018bb5
cmp rdx, 0xf
jbe 0x1400173a6
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400173a1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018c5e
call fcn.140084cac
inc rbx
cmp rbx, rsi
jl 0x140017150
movabs rax, 0x219e2793dd45042e
mov qword [rbp + 0xd0], rax
movabs rsi, 0xeaf6c782e5c2f8a3
mov qword [rbp + 0xd8], rsi
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x140], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x150], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
inc r8
cmp byte [rax + r8], r15b
jne 0x140017417
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x140]
call fcn.1400024b0
nop
movabs rax, 0x77a6249bc8500b12
mov qword [rbp + 0xd0], rax
movabs rax, 0xeaf6a2fa8089b4f0
mov qword [rbp + 0xd8], rax
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x170], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400174a0
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x160]
call fcn.1400024b0
nop
movabs rax, 0x6ad72295c01d5e39
mov qword [rbp + 0xd0], rax
movabs r13, 0xeaf6c782e5a7e5be
mov qword [rbp + 0xd8], r13
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x190], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x140017523
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x180]
call fcn.1400024b0
nop
movabs rax, 0x6a952cb1c6481a06
mov qword [rbp + 0xd0], rax
movabs rax, 0xeaf6c78280dfe5e8
mov qword [rbp + 0xd8], rax
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1b0], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x1400175a6
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x1a0]
call fcn.1400024b0
nop
movabs rax, 0x639003d7c6481a06
mov qword [rbp + 0xd0], rax
movabs rax, 0xeaf6c7e79dc2aea3
mov qword [rbp + 0xd8], rax
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1d0], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140017630
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x1c0]
call fcn.1400024b0
nop
movabs rax, 0x6ad72295c01b5b39
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xd8], r13
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1e0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1f0], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400176b0
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x1e0]
call fcn.1400024b0
nop
movabs rax, 0xf9c3d928a4c0125
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xd8], r14
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x200], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x210], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140017730
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x200]
call fcn.1400024b0
nop
movabs rax, 0x218e209ed2590b35
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xd8], rsi
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x220], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x230], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400177b0
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x220]
call fcn.1400024b0
nop
movabs rbx, 0x7c973085cb5d1d20
mov qword [rbp + 0xd0], rbx
movabs rax, 0xeaf6c78280dfe5e8
mov qword [rbp + 0xd8], rax
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x240], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x250], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x140017833
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x240]
call fcn.1400024b0
nop
mov qword [rbp + 0xd0], rbx
movabs rax, 0xeaf6c7e79dc2aea5
mov qword [rbp + 0xd8], rax
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x260], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x270], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400178b0
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x260]
call fcn.1400024b0
nop
movabs rax, 0x21972a9ac1450127
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xd8], rsi
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x280], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x290], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140017930
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x280]
call fcn.1400024b0
nop
movabs rax, 0x21972a9ac7461a31
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xd8], rsi
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x2a0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x2b0], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400179b0
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x2a0]
call fcn.1400024b0
nop
movabs rax, 0x6ad72b98c94e0d33
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xd8], r13
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x2c0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x2d0], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140017a30
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x2c0]
call fcn.1400024b0
nop
movabs rax, 0x21893d92c7461a31
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xd8], rsi
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x2e0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x2f0], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140017ab0
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x2e0]
call fcn.1400024b0
nop
movabs rax, 0x6a8120d9d5480c28
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xd8], r14
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x300], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x310], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140017b30
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x300]
call fcn.1400024b0
nop
movabs rax, 0x6ad771c1d5480c28
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xd8], r13
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x320], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x330], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140017bb0
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x320]
call fcn.1400024b0
nop
movabs rax, 0xf9c3d928a480c28
mov qword [rbp + 0xd0], rax
mov qword [rbp + 0xd8], r14
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x340], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x350], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140017c30
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x340]
call fcn.1400024b0
nop
movabs rax, 0x779c6bc392480c28
mov qword [rbp + 0xd0], rax
movabs rax, 0xeaf6c782e5a780a3
mov qword [rbp + 0xd8], rax
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x360], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x370], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x140017cb3
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x360]
call fcn.1400024b0
nop
movabs rax, 0x768d2c99d1440508
mov qword [rbp + 0xe0], rax
movabs rax, 0x9893a0e590c5e582
mov qword [rbp + 0xe8], rax
movabs rax, 0xc286afb1f9aa6e45
mov qword [rbp + 0xf0], rax
movabs rsi, 0x34b9c7c4ca54aec8
mov qword [rbp + 0xf8], rsi
movups xmm0, xmmword [rbp + 0xe0]
movups xmm1, xmmword [rbp + 0xf0]
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xe8], r14
movabs r13, 0xc286afb19cd20b6b
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], rsi
xorps xmm0, xmmword [rbp + 0xe0]
movdqa xmmword [rsp + 0x20], xmm0
xorps xmm1, xmmword [rbp + 0xf0]
movdqa xmmword [rsp + 0x30], xmm1
xorps xmm0, xmm0
movups xmmword [rbp + 0x380], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x390], xmm1
lea rax, [rsp + 0x20]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x140017d80
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x380]
call fcn.1400024b0
nop
movabs rax, 0x7d982d84c15b0116
mov qword [rbp + 0xd0], rax
movabs rax, 0xeaf6c7e79dc2aead
mov qword [rbp + 0xd8], rax
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x3a0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x3b0], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x140017e01
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x3a0]
call fcn.1400024b0
nop
movabs rbx, 0x21892494d4441d25
mov qword [rbp + 0xd0], rbx
movabs rax, 0xeaf6c782e5c2f8a3
mov qword [rbp + 0xd8], rax
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x3c0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x3d0], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x140017e84
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x3c0]
call fcn.1400024b0
nop
movabs rax, 0x63893db2cf460709
mov qword [rbp + 0xe0], rax
movabs rax, 0x8f8ea2ac97c2f2a9
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], rsi
movups xmm0, xmmword [rbp + 0xe0]
movups xmm1, xmmword [rbp + 0xf0]
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xe8], r14
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], rsi
xorps xmm0, xmmword [rbp + 0xe0]
movdqa xmmword [rsp + 0x20], xmm0
xorps xmm1, xmmword [rbp + 0xf0]
movdqa xmmword [rsp + 0x30], xmm1
xorps xmm0, xmm0
movups xmmword [rbp + 0x3e0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x3f0], xmm1
lea rax, [rsp + 0x20]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x140017f33
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x3e0]
call fcn.1400024b0
nop
movabs rax, 0x4aab3185cb590508
mov qword [rbp + 0xd0], rax
movabs rax, 0xeaf6c7e79dc2ae85
mov qword [rbp + 0xd8], rax
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x400], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x410], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x140017fb4
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x400]
call fcn.1400024b0
nop
movabs rax, 0x218a2998cb7d2d11
mov qword [rbp + 0xd0], rax
movabs rax, 0xeaf6c782e5c2f8a3
mov qword [rbp + 0xd8], rax
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x420], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x430], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140018040
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x420]
call fcn.1400024b0
nop
movabs rax, 0x6ad700a7c05b070d
mov qword [rbp + 0xd0], rax
movabs rax, 0xeaf6c782e5a7e5be
mov qword [rbp + 0xd8], rax
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x440], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x450], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x1400180c3
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x440]
call fcn.1400024b0
nop
mov qword [rbp + 0xd0], rbx
movabs rax, 0xeaf6c782e5c2f8a3
mov qword [rbp + 0xd8], rax
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x460], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x470], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140018140
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x460]
call fcn.1400024b0
nop
movabs rax, 0x6a893699ed5a1112
mov qword [rbp + 0xe0], rax
movabs rax, 0x8f8ea2ac97c8f4a5
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], rsi
movups xmm0, xmmword [rbp + 0xe0]
movups xmm1, xmmword [rbp + 0xf0]
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xe8], r14
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], rsi
xorps xmm0, xmmword [rbp + 0xe0]
movdqa xmmword [rsp + 0x20], xmm0
xorps xmm1, xmmword [rbp + 0xf0]
movdqa xmmword [rsp + 0x30], xmm1
xorps xmm0, xmm0
movups xmmword [rbp + 0x480], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x490], xmm1
lea rax, [rsp + 0x20]
mov r8, rdi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1400181f0
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x480]
call fcn.1400024b0
nop
movabs rax, 0x6e9724a8c7461a31
mov qword [rbp + 0xe0], rax
movabs rax, 0x9293e9f080ddf9aa
mov qword [rbp + 0xe8], rax
movabs rbx, 0xc286afb19cd20b0e
mov qword [rbp + 0xf0], rbx
mov qword [rbp + 0xf8], rsi
movups xmm0, xmmword [rbp + 0xe0]
movups xmm1, xmmword [rbp + 0xf0]
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xe8], r14
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], rsi
xorps xmm0, xmmword [rbp + 0xe0]
movdqa xmmword [rsp + 0x20], xmm0
xorps xmm1, xmmword [rbp + 0xf0]
movdqa xmmword [rsp + 0x30], xmm1
xorps xmm0, xmm0
movups xmmword [rbp + 0x4a0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x4b0], xmm1
lea rax, [rsp + 0x20]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400182b0
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x4a0]
call fcn.1400024b0
nop
movabs rax, 0x76952499e55a1132
mov qword [rbp + 0xd0], rax
movabs rax, 0xea93bfe7cbd5e5bc
mov qword [rbp + 0xd8], rax
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x4c0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x4d0], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x140018331
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x4c0]
call fcn.1400024b0
nop
movabs rax, 0x66911a91c2400632
mov qword [rbp + 0xd0], rax
movabs rax, 0xeaf6c7e79dc2aeb2
mov qword [rbp + 0xd8], rax
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x4e0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x4f0], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x1400183b4
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x4e0]
call fcn.1400024b0
nop
movabs rax, 0x6ad72295c0470136
mov qword [rbp + 0xd0], rax
movabs rax, 0xeaf6c782e5a7e5be
mov qword [rbp + 0xd8], rax
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x500], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x510], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140018440
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x500]
call fcn.1400024b0
nop
movabs rax, 0x609a3d98c64c072b
mov qword [rbp + 0xe0], rax
movabs rax, 0x9293e9ee8ad5f4a8
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0xf0], rbx
mov qword [rbp + 0xf8], rsi
movups xmm0, xmmword [rbp + 0xe0]
movups xmm1, xmmword [rbp + 0xf0]
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xe8], r14
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], rsi
xorps xmm0, xmmword [rbp + 0xe0]
movdqa xmmword [rsp + 0x20], xmm0
xorps xmm1, xmmword [rbp + 0xf0]
movdqa xmmword [rsp + 0x30], xmm1
xorps xmm0, xmm0
movups xmmword [rbp + 0x520], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x530], xmm1
lea rax, [rsp + 0x20]
mov r8, rdi
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1400184f0
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x520]
call fcn.1400024b0
nop
movabs rax, 0x6a8a3d98c64c072b
mov qword [rbp + 0xe0], rax
movabs rax, 0x8f8ea2ac97c2f6b4
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], rsi
movups xmm0, xmmword [rbp + 0xe0]
movups xmm1, xmmword [rbp + 0xf0]
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xe8], r14
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], rsi
xorps xmm0, xmmword [rbp + 0xe0]
movdqa xmmword [rsp + 0x20], xmm0
xorps xmm1, xmmword [rbp + 0xf0]
movdqa xmmword [rsp + 0x30], xmm1
xorps xmm0, xmm0
movups xmmword [rbp + 0x540], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x550], xmm1
lea rax, [rsp + 0x20]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400185a0
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x540]
call fcn.1400024b0
nop
movabs rax, 0x218b209bc04d0127
mov qword [rbp + 0xd0], rax
movabs rax, 0xeaf6c782e5c2f8a3
mov qword [rbp + 0xd8], rax
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x560], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x570], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x140018621
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x560]
call fcn.1400024b0
nop
movabs rax, 0x6ad777c4d3761e35
mov qword [rbp + 0xd0], rax
movabs rax, 0xeaf6c782e5a7e5be
mov qword [rbp + 0xd8], rax
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x580], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x590], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x1400186a4
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x580]
call fcn.1400024b0
nop
movabs rax, 0x6ad771c1dc761e35
mov qword [rbp + 0xd0], rax
movabs rax, 0xeaf6c782e5a7e5be
mov qword [rbp + 0xd8], rax
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x5a0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x5b0], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140018730
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x5a0]
call fcn.1400024b0
nop
movabs rax, 0x218a209bd6480002
mov qword [rbp + 0xd0], rax
movabs rax, 0xeaf6c782e5c2f8a3
mov qword [rbp + 0xd8], rax
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x5c0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x5d0], xmm1
lea rax, [rbp + 0xd0]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x1400187b3
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x5c0]
call fcn.1400024b0
nop
movabs rax, 0x6a8d299ee25d0d2f
mov qword [rbp + 0xe0], rax
movabs rax, 0x8f95aef497c2d3b4
mov qword [rbp + 0xe8], rax
movabs rax, 0xc286afb1f9aa6e45
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], rsi
movups xmm0, xmmword [rbp + 0xe0]
movups xmm1, xmmword [rbp + 0xf0]
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xe8], r14
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], rsi
xorps xmm0, xmmword [rbp + 0xe0]
movdqa xmmword [rsp + 0x20], xmm0
xorps xmm1, xmmword [rbp + 0xf0]
movdqa xmmword [rsp + 0x30], xmm1
xorps xmm0, xmm0
movups xmmword [rbp + 0x5e0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x5f0], xmm1
lea rax, [rsp + 0x20]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140018870
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x5e0]
call fcn.1400024b0
nop
movabs rax, 0x63982bb6f47d3c09
mov qword [rbp + 0xe0], rax
movabs rax, 0xbc92b3d197c2fabf
mov qword [rbp + 0xe8], rax
movabs rax, 0xc286afd4e4b7255c
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], rsi
movups xmm0, xmmword [rbp + 0xe0]
movups xmm1, xmmword [rbp + 0xf0]
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xe8], r14
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], rsi
xorps xmm0, xmmword [rbp + 0xe0]
movdqa xmmword [rsp + 0x20], xmm0
xorps xmm1, xmmword [rbp + 0xf0]
movdqa xmmword [rsp + 0x30], xmm1
xorps xmm0, xmm0
movups xmmword [rbp + 0x600], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x610], xmm1
lea rax, [rsp + 0x20]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140018930
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x600]
call fcn.1400024b0
nop
movabs rax, 0x478a3692c7461a11
mov qword [rbp + 0xe0], rax
movabs rax, 0x9293e9f080cce3a7
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0xf0], rbx
mov qword [rbp + 0xf8], rsi
movups xmm0, xmmword [rbp + 0xe0]
movups xmm1, xmmword [rbp + 0xf0]
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xe8], r14
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], rsi
xorps xmm0, xmmword [rbp + 0xe0]
movdqa xmmword [rsp + 0x20], xmm0
xorps xmm1, xmmword [rbp + 0xf0]
movdqa xmmword [rsp + 0x30], xmm1
xorps xmm0, xmm0
movups xmmword [rbp + 0x620], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x630], xmm1
lea rax, [rsp + 0x20]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400189e0
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x620]
call fcn.1400024b0
nop
movabs rax, 0x61b02892d05a1112
mov qword [rbp + 0xe0], rax
movabs rax, 0x8fd8b5e788d5efa0
mov qword [rbp + 0xe8], rax
movabs rax, 0xc286afb19cd26e13
mov qword [rbp + 0xf0], rax
mov qword [rbp + 0xf8], rsi
movups xmm0, xmmword [rbp + 0xe0]
movups xmm1, xmmword [rbp + 0xf0]
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xe8], r14
mov qword [rbp + 0xf0], r13
mov qword [rbp + 0xf8], rsi
xorps xmm0, xmmword [rbp + 0xe0]
movdqa xmmword [rsp + 0x20], xmm0
xorps xmm1, xmmword [rbp + 0xf0]
movdqa xmmword [rsp + 0x30], xmm1
xorps xmm0, xmm0
movups xmmword [rbp + 0x640], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x650], xmm1
lea rax, [rsp + 0x20]
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140018aa0
lea rdx, [rsp + 0x20]
lea rcx, [rbp + 0x640]
call fcn.1400024b0
nop
movabs rax, 0x6b8a2998cb5d0537
mov qword [rbp + 0xd0], rax
movabs rax, 0xeaf6c78280dfe5e8
mov qword [rbp + 0xd8], rax
movaps xmm0, xmmword [rbp + 0xd0]
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r14
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xd0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x660], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x670], xmm1
lea rax, [rbp + 0xd0]
nop
inc rdi
cmp byte [rax + rdi], 0
jne 0x140018b20
mov r8, rdi
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x660]
call fcn.1400024b0
nop
mov r14, r15
lea rsi, [rbp + 0x140]
nop word [rax + rax]
mov rbx, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x140018b5d
mov rbx, qword [rsi]
lea rdi, [rbp + 0x4680]
xor eax, eax
mov ecx, 0x130
rep stosb byte [rdi], al
xor edx, edx
mov ecx, 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140018cd4
mov dword [rbp + 0x4680], 0x130
lea rdx, [rbp + 0x4680]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x140018c65
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140018cd4
cmp rdx, 0xf
jbe 0x140018beb
inc rdx
mov rcx, qword [rbp + 0xe0]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140018be6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140018c5e
call fcn.140084cac
mov al, 1
mov rcx, qword [rbp + 0x4e80]
xor rcx, rsp
call fcn.140084c50
lea r11, [rsp + 0x4f90]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rdx, qword [rbp + 0xf8]
jmp 0x140018bb5
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x140018beb
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140018be6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140018be6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, rbx
lea rcx, [rbp + 0x46ac]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140018cc2
lea rdx, [rbp + 0x4680]
mov rcx, rdi
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x140018cb7
nop dword [rax]
mov rdx, rbx
lea rcx, [rbp + 0x46ac]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x140018cc2
lea rdx, [rbp + 0x4680]
mov rcx, rdi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x140018c90
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140018cd4
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [rbp + 0x4688], 0
jne 0x140018d0d
inc r15d
inc r14
add rsi, 0x20
cmp r14, 0x2a
jl 0x140018b50
lea r9, [fcn.1400038b0]
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov r8d, Ordinal_46
lea rcx, [rbp + 0x140]
call fcn.1400853f8
xor al, al
jmp 0x140018bed
movsxd rax, r15d
shl rax, 5
lea rbx, [rbp + 0x140]
add rbx, rax
cmp qword [rbx + 0x18], 0xf
jbe 0x140018d28
mov rbx, qword [rbx]
xor edx, edx
mov ecx, reloc.WS2_32.dll_ntohs
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rsi, rax
mov dword [rbp - 0x70], 0x130
lea rdx, [rbp - 0x70]
mov rcx, rax
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x140018db4
nop
lea rcx, [rbp - 0x44]
mov rdi, rbx
sub rdi, rcx
nop word [rax + rax]
movzx edx, byte [rcx]
movzx eax, byte [rcx + rdi]
sub edx, eax
jne 0x140018d72
inc rcx
test eax, eax
jne 0x140018d60
test edx, edx
jne 0x140018da4
mov r8d, dword [rbp - 0x68]
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rdi, rax
test rax, rax
je 0x140018da4
mov edx, 9
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rbp - 0x70]
mov rcx, rsi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x140018d50
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea r9, [fcn.1400038b0]
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov r8d, Ordinal_46
lea rcx, [rbp + 0x140]
call fcn.1400853f8
jmp 0x140018beb