Function at 0x10001b90
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100125f5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2ec
push esi
push edi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x2f8], 0x22c
lea eax, [ebp - 0x2f8]
mov dword [ebp - 0x40], esi
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
mov dword [ebp - 0x60], 0x64
mov dword [ebp - 0x5c], 0
lea ecx, [ebp - 0x60]
call fcn.100017f0
cmp byte [0x10019496], 0
je 0x10001c26
sub esp, 0x18
xorps xmm0, xmm0
mov eax, esp
mov ecx, 1
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
call fcn.100088a0
add esp, 0x18
mov byte [0x10019496], 0
lea eax, [ebp - 0x2d4]
push eax
lea ecx, [ebp - 0x58]
call fcn.10003170
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x58]
cmp dword [ebp - 0x44], 7
mov eax, dword [ebp - 0x48]
cmova ecx, dword [ebp - 0x58]
seta byte [ebp - 0xd]
cmp byte [ebp - 0xd], 0
lea eax, [ecx + eax*2]
lea ecx, [ebp - 0x58]
cmovne ecx, dword [ebp - 0x58]
push ecx
push eax
push ecx
lea ecx, [ebp - 0x34]
call fcn.100034a0
mov byte [ebp - 4], 1
lea edx, [ebp - 0x34]
cmp dword [ebp - 0x20], 0xf
mov eax, dword [ebp - 0x34]
mov edi, dword [ebp - 0x24]
seta byte [ebp - 0xd]
cmova edx, eax
mov dword [ebp - 0x14], eax
cmp edi, 9
jne 0x10001cea
mov esi, edi
mov ecx, str.csrss.exe
sub esi, 4
jb 0x10001ca4
mov eax, dword [edx]
cmp eax, dword [ecx]
jne 0x10001ca9
add edx, 4
add ecx, 4
sub esi, 4
jae 0x10001c93
cmp esi, 0xfffffffc
je 0x10001cdd
mov al, byte [edx]
cmp al, byte [ecx]
jne 0x10001cd6
cmp esi, 0xfffffffd
je 0x10001cdd
mov al, byte [edx + 1]
cmp al, byte [ecx + 1]
jne 0x10001cd6
cmp esi, 0xfffffffe
je 0x10001cdd
mov al, byte [edx + 2]
cmp al, byte [ecx + 2]
jne 0x10001cd6
cmp esi, 0xffffffff
je 0x10001cdd
mov al, byte [edx + 3]
cmp al, byte [ecx + 3]
je 0x10001cdd
sbb eax, eax
or eax, 1
jmp 0x10001cdf
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
lea ecx, [ebp - 0x34]
test dl, dl
cmovne ecx, eax
cmp edi, 8
jne 0x10001d60
mov esi, edi
mov edx, str.ekrn.exe
sub esi, 4
jb 0x10001d17
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10001d1c
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10001d06
cmp esi, 0xfffffffc
je 0x10001d50
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10001d49
cmp esi, 0xfffffffd
je 0x10001d50
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10001d49
cmp esi, 0xfffffffe
je 0x10001d50
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10001d49
cmp esi, 0xffffffff
je 0x10001d50
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x10001d50
sbb eax, eax
or eax, 1
jmp 0x10001d52
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
test dl, dl
lea ecx, [ebp - 0x34]
cmovne ecx, eax
cmp edi, 9
jne 0x10001dda
mov esi, edi
mov edx, str.lsass.exe
sub esi, 4
jb 0x10001d91
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10001d96
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10001d80
cmp esi, 0xfffffffc
je 0x10001dca
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10001dc3
cmp esi, 0xfffffffd
je 0x10001dca
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10001dc3
cmp esi, 0xfffffffe
je 0x10001dca
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10001dc3
cmp esi, 0xffffffff
je 0x10001dca
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x10001dca
sbb eax, eax
or eax, 1
jmp 0x10001dcc
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
test dl, dl
lea ecx, [ebp - 0x34]
cmovne ecx, eax
cmp edi, 0xc
jne 0x10001e4d
mov esi, edi
mov edx, str.services.exe
sub esi, 4
jb 0x10001e04
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10001e09
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10001df3
cmp esi, 0xfffffffc
je 0x10001e3d
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10001e36
cmp esi, 0xfffffffd
je 0x10001e3d
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10001e36
cmp esi, 0xfffffffe
je 0x10001e3d
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10001e36
cmp esi, 0xffffffff
je 0x10001e3d
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x10001e3d
sbb eax, eax
or eax, 1
jmp 0x10001e3f
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
test dl, dl
lea ecx, [ebp - 0x34]
cmovne ecx, eax
cmp edi, 8
jne 0x10001ec0
mov esi, edi
mov edx, str.smss.exe
sub esi, 4
jb 0x10001e77
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10001e7c
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10001e66
cmp esi, 0xfffffffc
je 0x10001eb0
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10001ea9
cmp esi, 0xfffffffd
je 0x10001eb0
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10001ea9
cmp esi, 0xfffffffe
je 0x10001eb0
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10001ea9
cmp esi, 0xffffffff
je 0x10001eb0
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x10001eb0
sbb eax, eax
or eax, 1
jmp 0x10001eb2
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
test dl, dl
lea ecx, [ebp - 0x34]
cmovne ecx, eax
cmp edi, 9
jne 0x10001f3a
mov esi, edi
mov edx, str.httpd.exe
sub esi, 4
jb 0x10001ef1
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10001ef6
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10001ee0
cmp esi, 0xfffffffc
je 0x10001f2a
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10001f23
cmp esi, 0xfffffffd
je 0x10001f2a
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10001f23
cmp esi, 0xfffffffe
je 0x10001f2a
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10001f23
cmp esi, 0xffffffff
je 0x10001f2a
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x10001f2a
sbb eax, eax
or eax, 1
jmp 0x10001f2c
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
test dl, dl
lea ecx, [ebp - 0x34]
cmovne ecx, eax
cmp edi, 0xa
jne 0x10001fad
mov esi, edi
mov edx, str.msedge.exe
sub esi, 4
jb 0x10001f64
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10001f69
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10001f53
cmp esi, 0xfffffffc
je 0x10001f9d
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10001f96
cmp esi, 0xfffffffd
je 0x10001f9d
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10001f96
cmp esi, 0xfffffffe
je 0x10001f9d
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10001f96
cmp esi, 0xffffffff
je 0x10001f9d
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x10001f9d
sbb eax, eax
or eax, 1
jmp 0x10001f9f
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
test dl, dl
lea ecx, [ebp - 0x34]
cmovne ecx, eax
cmp edi, 0x16
jne 0x10002020
mov esi, edi
mov edx, str.SearchProtocolHost.exe
sub esi, 4
jb 0x10001fd7
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10001fdc
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10001fc6
cmp esi, 0xfffffffc
je 0x10002010
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10002009
cmp esi, 0xfffffffd
je 0x10002010
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10002009
cmp esi, 0xfffffffe
je 0x10002010
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10002009
cmp esi, 0xffffffff
je 0x10002010
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x10002010
sbb eax, eax
or eax, 1
jmp 0x10002012
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
test dl, dl
lea ecx, [ebp - 0x34]
cmovne ecx, eax
cmp edi, 0xd
jne 0x1000209a
mov esi, edi
mov edx, str.UI0Detect.exe
sub esi, 4
jb 0x10002051
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10002056
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10002040
cmp esi, 0xfffffffc
je 0x1000208a
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10002083
cmp esi, 0xfffffffd
je 0x1000208a
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10002083
cmp esi, 0xfffffffe
je 0x1000208a
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10002083
cmp esi, 0xffffffff
je 0x1000208a
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000208a
sbb eax, eax
or eax, 1
jmp 0x1000208c
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
test dl, dl
lea ecx, [ebp - 0x34]
cmovne ecx, eax
cmp edi, 0xb
jne 0x1000210d
mov esi, edi
mov edx, str.wininit.exe
sub esi, 4
jb 0x100020c4
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x100020c9
add ecx, 4
add edx, 4
sub esi, 4
jae 0x100020b3
cmp esi, 0xfffffffc
je 0x100020fd
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x100020f6
cmp esi, 0xfffffffd
je 0x100020fd
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x100020f6
cmp esi, 0xfffffffe
je 0x100020fd
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x100020f6
cmp esi, 0xffffffff
je 0x100020fd
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x100020fd
sbb eax, eax
or eax, 1
jmp 0x100020ff
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
test dl, dl
lea ecx, [ebp - 0x34]
cmovne ecx, eax
cmp edi, 7
jne 0x10002180
mov esi, edi
mov edx, str.lsm.exe
sub esi, 4
jb 0x10002137
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000213c
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10002126
cmp esi, 0xfffffffc
je 0x10002170
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10002169
cmp esi, 0xfffffffd
je 0x10002170
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10002169
cmp esi, 0xfffffffe
je 0x10002170
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10002169
cmp esi, 0xffffffff
je 0x10002170
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x10002170
sbb eax, eax
or eax, 1
jmp 0x10002172
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
test dl, dl
lea ecx, [ebp - 0x34]
cmovne ecx, eax
cmp edi, 0xb
jne 0x100021fa
mov esi, edi
mov edx, str.spoolsv.exe
sub esi, 4
jb 0x100021b1
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x100021b6
add ecx, 4
add edx, 4
sub esi, 4
jae 0x100021a0
cmp esi, 0xfffffffc
je 0x100021ea
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x100021e3
cmp esi, 0xfffffffd
je 0x100021ea
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x100021e3
cmp esi, 0xfffffffe
je 0x100021ea
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x100021e3
cmp esi, 0xffffffff
je 0x100021ea
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x100021ea
sbb eax, eax
or eax, 1
jmp 0x100021ec
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
test dl, dl
lea ecx, [ebp - 0x34]
cmovne ecx, eax
cmp edi, 0x10
jne 0x1000226d
mov esi, edi
mov edx, str.IpOverUsbSvc.exe
sub esi, 4
jb 0x10002224
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10002229
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10002213
cmp esi, 0xfffffffc
je 0x1000225d
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10002256
cmp esi, 0xfffffffd
je 0x1000225d
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10002256
cmp esi, 0xfffffffe
je 0x1000225d
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10002256
cmp esi, 0xffffffff
je 0x1000225d
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000225d
sbb eax, eax
or eax, 1
jmp 0x1000225f
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
test dl, dl
lea ecx, [ebp - 0x34]
cmovne ecx, eax
cmp edi, 0xc
jne 0x100022e0
mov esi, edi
mov edx, str.sqlservr.exe
sub esi, 4
jb 0x10002297
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000229c
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10002286
cmp esi, 0xfffffffc
je 0x100022d0
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x100022c9
cmp esi, 0xfffffffd
je 0x100022d0
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x100022c9
cmp esi, 0xfffffffe
je 0x100022d0
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x100022c9
cmp esi, 0xffffffff
je 0x100022d0
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x100022d0
sbb eax, eax
or eax, 1
jmp 0x100022d2
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
test dl, dl
lea ecx, [ebp - 0x34]
cmovne ecx, eax
cmp edi, 0xa
jne 0x1000235a
mov esi, edi
mov edx, str.mysqld.exe
sub esi, 4
jb 0x10002311
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10002316
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10002300
cmp esi, 0xfffffffc
je 0x1000234a
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10002343
cmp esi, 0xfffffffd
je 0x1000234a
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10002343
cmp esi, 0xfffffffe
je 0x1000234a
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10002343
cmp esi, 0xffffffff
je 0x1000234a
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000234a
sbb eax, eax
or eax, 1
jmp 0x1000234c
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
test dl, dl
lea ecx, [ebp - 0x34]
cmovne ecx, eax
cmp edi, 0xd
jne 0x100023cd
mov esi, edi
mov edx, str.sqlwriter.exe
sub esi, 4
jb 0x10002384
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10002389
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10002373
cmp esi, 0xfffffffc
je 0x100023bd
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x100023b6
cmp esi, 0xfffffffd
je 0x100023bd
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x100023b6
cmp esi, 0xfffffffe
je 0x100023bd
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x100023b6
cmp esi, 0xffffffff
je 0x100023bd
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x100023bd
sbb eax, eax
or eax, 1
jmp 0x100023bf
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
test dl, dl
lea ecx, [ebp - 0x34]
cmovne ecx, eax
cmp edi, 0xb
jne 0x10002440
mov esi, edi
mov edx, str.jusched.exe
sub esi, 4
jb 0x100023f7
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x100023fc
add ecx, 4
add edx, 4
sub esi, 4
jae 0x100023e6
cmp esi, 0xfffffffc
je 0x10002430
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10002429
cmp esi, 0xfffffffd
je 0x10002430
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10002429
cmp esi, 0xfffffffe
je 0x10002430
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10002429
cmp esi, 0xffffffff
je 0x10002430
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x10002430
sbb eax, eax
or eax, 1
jmp 0x10002432
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
test dl, dl
lea ecx, [ebp - 0x34]
cmovne ecx, eax
cmp edi, 9
jne 0x100024ba
mov esi, edi
mov edx, str.IDMan.exe
sub esi, 4
jb 0x10002471
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10002476
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10002460
cmp esi, 0xfffffffc
je 0x100024aa
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x100024a3
cmp esi, 0xfffffffd
je 0x100024aa
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x100024a3
cmp esi, 0xfffffffe
je 0x100024aa
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x100024a3
cmp esi, 0xffffffff
je 0x100024aa
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x100024aa
sbb eax, eax
or eax, 1
jmp 0x100024ac
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
test dl, dl
lea ecx, [ebp - 0x34]
cmovne ecx, eax
cmp edi, 0x11
jne 0x1000252d
mov esi, edi
mov edx, str.SearchIndexer.exe
sub esi, 4
jb 0x100024e4
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x100024e9
add ecx, 4
add edx, 4
sub esi, 4
jae 0x100024d3
cmp esi, 0xfffffffc
je 0x1000251d
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10002516
cmp esi, 0xfffffffd
je 0x1000251d
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10002516
cmp esi, 0xfffffffe
je 0x1000251d
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10002516
cmp esi, 0xffffffff
je 0x1000251d
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000251d
sbb eax, eax
or eax, 1
jmp 0x1000251f
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
test dl, dl
lea ecx, [ebp - 0x34]
cmovne ecx, eax
cmp edi, 0xd
jne 0x100025a0
mov esi, edi
mov edx, str.IEMonitor.exe
sub esi, 4
jb 0x10002557
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000255c
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10002546
cmp esi, 0xfffffffc
je 0x10002590
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10002589
cmp esi, 0xfffffffd
je 0x10002590
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10002589
cmp esi, 0xfffffffe
je 0x10002590
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10002589
cmp esi, 0xffffffff
je 0x10002590
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x10002590
sbb eax, eax
or eax, 1
jmp 0x10002592
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
test dl, dl
lea ecx, [ebp - 0x34]
cmovne ecx, eax
cmp edi, 0xc
jne 0x1000261a
mov esi, edi
mov edx, str.wmpnetwk.exe
sub esi, 4
jb 0x100025d1
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x100025d6
add ecx, 4
add edx, 4
sub esi, 4
jae 0x100025c0
cmp esi, 0xfffffffc
je 0x1000260a
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10002603
cmp esi, 0xfffffffd
je 0x1000260a
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10002603
cmp esi, 0xfffffffe
je 0x1000260a
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10002603
cmp esi, 0xffffffff
je 0x1000260a
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000260a
sbb eax, eax
or eax, 1
jmp 0x1000260c
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
test dl, dl
lea ecx, [ebp - 0x34]
cmovne ecx, eax
cmp edi, 0xa
jne 0x1000268d
mov esi, edi
mov edx, str.devenv.exe
sub esi, 4
jb 0x10002644
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10002649
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10002633
cmp esi, 0xfffffffc
je 0x1000267d
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10002676
cmp esi, 0xfffffffd
je 0x1000267d
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10002676
cmp esi, 0xfffffffe
je 0x1000267d
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10002676
cmp esi, 0xffffffff
je 0x1000267d
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000267d
sbb eax, eax
or eax, 1
jmp 0x1000267f
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
test dl, dl
lea ecx, [ebp - 0x34]
cmovne ecx, eax
cmp edi, 0xc
jne 0x10002700
mov esi, edi
mov edx, str.WUDFHost.exe
sub esi, 4
jb 0x100026b7
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x100026bc
add ecx, 4
add edx, 4
sub esi, 4
jae 0x100026a6
cmp esi, 0xfffffffc
je 0x100026f0
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x100026e9
cmp esi, 0xfffffffd
je 0x100026f0
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x100026e9
cmp esi, 0xfffffffe
je 0x100026f0
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x100026e9
cmp esi, 0xffffffff
je 0x100026f0
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x100026f0
sbb eax, eax
or eax, 1
jmp 0x100026f2
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
test dl, dl
lea ecx, [ebp - 0x34]
cmovne ecx, eax
cmp edi, 0xb
jne 0x1000277a
mov esi, edi
mov edx, str.MSBuild.exe
sub esi, 4
jb 0x10002731
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10002736
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10002720
cmp esi, 0xfffffffc
je 0x1000276a
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10002763
cmp esi, 0xfffffffd
je 0x1000276a
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10002763
cmp esi, 0xfffffffe
je 0x1000276a
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10002763
cmp esi, 0xffffffff
je 0x1000276a
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000276a
sbb eax, eax
or eax, 1
jmp 0x1000276c
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
test dl, dl
lea ecx, [ebp - 0x34]
cmovne ecx, eax
cmp edi, 0xb
jne 0x100027ed
mov esi, edi
mov edx, str.conhost.exe
sub esi, 4
jb 0x100027a4
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x100027a9
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10002793
cmp esi, 0xfffffffc
je 0x100027dd
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x100027d6
cmp esi, 0xfffffffd
je 0x100027dd
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x100027d6
cmp esi, 0xfffffffe
je 0x100027dd
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x100027d6
cmp esi, 0xffffffff
je 0x100027dd
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x100027dd
sbb eax, eax
or eax, 1
jmp 0x100027df
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
test dl, dl
lea ecx, [ebp - 0x34]
cmovne ecx, eax
cmp edi, 0xc
jne 0x10002860
mov esi, edi
mov edx, str.mspdbsrv.exe
sub esi, 4
jb 0x10002817
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000281c
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10002806
cmp esi, 0xfffffffc
je 0x10002850
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10002849
cmp esi, 0xfffffffd
je 0x10002850
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10002849
cmp esi, 0xfffffffe
je 0x10002850
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10002849
cmp esi, 0xffffffff
je 0x10002850
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x10002850
sbb eax, eax
or eax, 1
jmp 0x10002852
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
test dl, dl
lea ecx, [ebp - 0x34]
cmovne ecx, eax
cmp edi, 0xc
jne 0x100028da
mov esi, edi
mov edx, str.vcpkgsrv.exe
sub esi, 4
jb 0x10002891
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10002896
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10002880
cmp esi, 0xfffffffc
je 0x100028ca
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x100028c3
cmp esi, 0xfffffffd
je 0x100028ca
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x100028c3
cmp esi, 0xfffffffe
je 0x100028ca
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x100028c3
cmp esi, 0xffffffff
je 0x100028ca
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x100028ca
sbb eax, eax
or eax, 1
jmp 0x100028cc
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
test dl, dl
lea ecx, [ebp - 0x34]
cmovne ecx, eax
cmp edi, 0xd
jne 0x1000294d
mov esi, edi
mov edx, str.eguiProxy.exe
sub esi, 4
jb 0x10002904
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10002909
add ecx, 4
add edx, 4
sub esi, 4
jae 0x100028f3
cmp esi, 0xfffffffc
je 0x1000293d
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10002936
cmp esi, 0xfffffffd
je 0x1000293d
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10002936
cmp esi, 0xfffffffe
je 0x1000293d
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10002936
cmp esi, 0xffffffff
je 0x1000293d
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x1000293d
sbb eax, eax
or eax, 1
jmp 0x1000293f
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
test dl, dl
lea ecx, [ebp - 0x34]
cmovne ecx, eax
cmp edi, 9
jne 0x100029c0
mov esi, edi
mov edx, str.mstsc.exe
sub esi, 4
jb 0x10002977
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x1000297c
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10002966
cmp esi, 0xfffffffc
je 0x100029b0
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x100029a9
cmp esi, 0xfffffffd
je 0x100029b0
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x100029a9
cmp esi, 0xfffffffe
je 0x100029b0
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x100029a9
cmp esi, 0xffffffff
je 0x100029b0
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x100029b0
sbb eax, eax
or eax, 1
jmp 0x100029b2
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
test dl, dl
lea ecx, [ebp - 0x34]
cmovne ecx, eax
cmp edi, 0xa
jne 0x10002a3a
mov esi, edi
mov edx, str.msedge.exe
sub esi, 4
jb 0x100029f1
nop dword [eax]
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x100029f6
add ecx, 4
add edx, 4
sub esi, 4
jae 0x100029e0
cmp esi, 0xfffffffc
je 0x10002a2a
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10002a23
cmp esi, 0xfffffffd
je 0x10002a2a
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10002a23
cmp esi, 0xfffffffe
je 0x10002a2a
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10002a23
cmp esi, 0xffffffff
je 0x10002a2a
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x10002a2a
sbb eax, eax
or eax, 1
jmp 0x10002a2c
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
test dl, dl
lea ecx, [ebp - 0x34]
cmovne ecx, eax
cmp edi, 0xb
jne 0x10002aa9
mov esi, edi
mov edx, str.svchost.exe
sub esi, 4
jb 0x10002a64
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10002a69
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10002a53
cmp esi, 0xfffffffc
je 0x10002a9d
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10002a96
cmp esi, 0xfffffffd
je 0x10002a9d
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10002a96
cmp esi, 0xfffffffe
je 0x10002a9d
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10002a96
cmp esi, 0xffffffff
je 0x10002a9d
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x10002a9d
sbb eax, eax
or eax, 1
jmp 0x10002a9f
xor eax, eax
test eax, eax
je 0x10002b16
mov eax, dword [ebp - 0x14]
mov dl, byte [ebp - 0xd]
test dl, dl
lea ecx, [ebp - 0x34]
cmovne ecx, eax
cmp edi, 0xb
jne 0x10002b58
mov esi, edi
mov edx, str.Conquer.exe
sub esi, 4
jb 0x10002ad7
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10002adc
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10002ac6
cmp esi, 0xfffffffc
je 0x10002b10
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10002b09
cmp esi, 0xfffffffd
je 0x10002b10
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10002b09
cmp esi, 0xfffffffe
je 0x10002b10
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10002b09
cmp esi, 0xffffffff
je 0x10002b10
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
je 0x10002b10
sbb eax, eax
or eax, 1
jmp 0x10002b12
xor eax, eax
test eax, eax
jne 0x10002b58
cmp byte [ebp - 0xd], 0
mov byte [ebp - 4], 0
je 0x1000308c
mov ecx, dword [ebp - 0x20]
mov edx, dword [ebp - 0x14]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x10002b49
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100030fb
push ecx
push edx
call fcn.1000ef69
add esp, 8
jmp 0x1000308c
push dword [ebp - 0x2f0]
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
mov dword [ebp - 0x1c], esi
test esi, esi
je 0x10002c73
mov edi, 0x10018094
mov dword [ebp - 0x18], 0xb
lea eax, [ebp - 0x3c]
push eax
push 8
lea eax, [ebp - 0x68]
push eax
push dword [edi - 4]
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x10002c5a
cmp dword [ebp - 0x3c], 8
jne 0x10002c5a
lea ecx, [ebp - 0x68]
mov edx, edi
mov esi, 4
mov eax, dword [ecx]
cmp eax, dword [edx]
jne 0x10002bc9
add ecx, 4
add edx, 4
sub esi, 4
jae 0x10002bb4
xor eax, eax
jmp 0x10002bf0
mov al, byte [ecx]
cmp al, byte [edx]
jne 0x10002beb
mov al, byte [ecx + 1]
cmp al, byte [edx + 1]
jne 0x10002beb
mov al, byte [ecx + 2]
cmp al, byte [edx + 2]
jne 0x10002beb
mov al, byte [ecx + 3]
cmp al, byte [edx + 3]
jne 0x10002beb
xor eax, eax
jmp 0x10002bf0
sbb eax, eax
or eax, 1
test eax, eax
jne 0x10002c57
push eax
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea eax, [edi + 0x10]
push eax
lea eax, [ebp - 0xcc]
push 0x1001478c
push eax
call fcn.10001280
sub esp, 0xc
lea ecx, [ebp - 0xcc]
mov edx, esp
lea esi, [ecx + 1]
xorps xmm0, xmm0
movups xmmword [edx], xmm0
mov dword [edx + 0x10], 0
mov dword [edx + 0x14], 0
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10002c35
sub ecx, esi
lea eax, [ebp - 0xcc]
push ecx
push eax
mov ecx, edx
call fcn.10001890
xor ecx, ecx
call fcn.100088a0
add esp, 0x18
mov esi, dword [ebp - 0x1c]
add edi, 0x78
sub dword [ebp - 0x18], 1
jne 0x10002b84
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10003077
sub esp, 0x18
xorps xmm0, xmm0
mov edx, esp
mov dword [ebp - 0x38], esp
sub esp, 0x18
mov ecx, esp
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 0xb
mov dword [ecx + 0x14], 0xf
movq xmm0, qword [str.mrokdoxqsxo]
movq qword [ecx], xmm0
mov ax, word [0x10014798]
mov word [ecx + 8], ax
mov al, byte [0x1001479a]
mov byte [ecx + 0xa], al
mov byte [ecx + 0xb], 0
mov ecx, edx
call fcn.10004be0
cmp byte [ebp - 0xd], 0
lea ecx, [ebp - 0x34]
mov esi, dword [ebp - 0x14]
mov eax, esp
mov byte [ebp - 4], 2
xorps xmm0, xmm0
cmovne ecx, esi
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], ecx
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0
cmp edi, 0x7fffffff
ja 0x10003101
mov dword [eax + 0x14], 0xf
cmp edi, 0xf
ja 0x10002d10
mov dword [eax + 0x10], edi
movups xmm0, xmmword [ecx]
movups xmmword [eax], xmm0
jmp 0x10002d9d
mov esi, edi
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x10002d2c
mov eax, 0x80000000
mov esi, 0x7fffffff
add eax, 0x23
jmp 0x10002d4d
cmp esi, 0x16
mov ecx, 0x16
cmovb esi, ecx
lea ecx, [esi + 1]
cmp ecx, 0x1000
jb 0x10002d6c
lea eax, [ecx + 0x23]
cmp eax, ecx
jbe 0x10003106
push eax
call fcn.1000ec1f
add esp, 4
test eax, eax
je 0x100030fb
lea ecx, [eax + 0x23]
and ecx, 0xffffffe0
mov dword [ecx - 4], eax
mov eax, dword [ebp - 0x18]
jmp 0x10002d82
test ecx, ecx
je 0x10002d80
push ecx
call fcn.1000ec1f
mov ecx, eax
add esp, 4
mov eax, dword [ebp - 0x18]
jmp 0x10002d82
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], esi
lea eax, [edi + 1]
push eax
push dword [ebp - 0x1c]
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov esi, dword [ebp - 0x14]
add esp, 0xc
mov byte [ebp - 4], 1
call fcn.10001a40
add esp, 0x30
test al, al
je 0x10002e84
sub esp, 0x18
lea ecx, [ebp - 0x34]
cmp byte [ebp - 0xd], 0
mov eax, esp
xorps xmm0, xmm0
mov dword [ebp - 0x18], eax
cmovne ecx, esi
mov dword [ebp - 0x1c], ecx
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
cmp edi, 0xf
ja 0x10002ded
mov dword [eax + 0x10], edi
movups xmm0, xmmword [ecx]
movups xmmword [eax], xmm0
jmp 0x10002e7a
mov esi, edi
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x10002e09
mov eax, 0x80000000
mov esi, 0x7fffffff
add eax, 0x23
jmp 0x10002e2a
cmp esi, 0x16
mov ecx, 0x16
cmovb esi, ecx
lea ecx, [esi + 1]
cmp ecx, 0x1000
jb 0x10002e49
lea eax, [ecx + 0x23]
cmp eax, ecx
jbe 0x10003106
push eax
call fcn.1000ec1f
add esp, 4
test eax, eax
je 0x100030fb
lea ecx, [eax + 0x23]
and ecx, 0xffffffe0
mov dword [ecx - 4], eax
mov eax, dword [ebp - 0x18]
jmp 0x10002e5f
test ecx, ecx
je 0x10002e5d
push ecx
call fcn.1000ec1f
mov ecx, eax
add esp, 4
mov eax, dword [ebp - 0x18]
jmp 0x10002e5f
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], esi
lea eax, [edi + 1]
push eax
push dword [ebp - 0x1c]
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov esi, dword [ebp - 0x14]
add esp, 0xc
xor ecx, ecx
call fcn.100088a0
add esp, 0x18
sub esp, 0x18
xorps xmm0, xmm0
mov edx, esp
mov dword [ebp - 0x38], esp
sub esp, 0x18
mov ecx, esp
movups xmmword [ecx], xmm0
mov dword [ecx + 0x10], 7
mov dword [ecx + 0x14], 0xf
mov eax, dword [str.yvvinlq]
mov dword [ecx], eax
mov ax, word [0x100147a0]
mov word [ecx + 4], ax
mov al, byte [0x100147a2]
mov byte [ecx + 6], al
mov byte [ecx + 7], 0
mov ecx, edx
call fcn.10004be0
cmp byte [ebp - 0xd], 0
lea ecx, [ebp - 0x34]
mov eax, esp
mov byte [ebp - 4], 3
xorps xmm0, xmm0
mov dword [ebp - 0x18], eax
cmovne ecx, esi
mov dword [ebp - 0x1c], ecx
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
cmp edi, 0xf
ja 0x10002f06
mov dword [eax + 0x10], edi
movups xmm0, xmmword [ecx]
movups xmmword [eax], xmm0
jmp 0x10002f93
mov esi, edi
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x10002f22
mov eax, 0x80000000
mov esi, 0x7fffffff
add eax, 0x23
jmp 0x10002f43
cmp esi, 0x16
mov ecx, 0x16
cmovb esi, ecx
lea ecx, [esi + 1]
cmp ecx, 0x1000
jb 0x10002f62
lea eax, [ecx + 0x23]
cmp eax, ecx
jbe 0x10003106
push eax
call fcn.1000ec1f
add esp, 4
test eax, eax
je 0x100030fb
lea ecx, [eax + 0x23]
and ecx, 0xffffffe0
mov dword [ecx - 4], eax
mov eax, dword [ebp - 0x18]
jmp 0x10002f78
test ecx, ecx
je 0x10002f76
push ecx
call fcn.1000ec1f
mov ecx, eax
add esp, 4
mov eax, dword [ebp - 0x18]
jmp 0x10002f78
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], esi
lea eax, [edi + 1]
push eax
push dword [ebp - 0x1c]
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov esi, dword [ebp - 0x14]
add esp, 0xc
mov byte [ebp - 4], 1
call fcn.10001a40
add esp, 0x30
test al, al
je 0x10003077
sub esp, 0x18
lea ecx, [ebp - 0x34]
cmp byte [ebp - 0xd], 0
mov eax, esp
xorps xmm0, xmm0
mov dword [ebp - 0x18], eax
cmovne ecx, esi
mov dword [ebp - 0x1c], ecx
movups xmmword [eax], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
cmp edi, 0xf
ja 0x10002fe3
mov dword [eax + 0x10], edi
movups xmm0, xmmword [ecx]
movups xmmword [eax], xmm0
jmp 0x1000306d
mov esi, edi
or esi, 0xf
cmp esi, 0x7fffffff
jbe 0x10002fff
mov eax, 0x80000000
mov esi, 0x7fffffff
add eax, 0x23
jmp 0x10003020
cmp esi, 0x16
mov ecx, 0x16
cmovb esi, ecx
lea ecx, [esi + 1]
cmp ecx, 0x1000
jb 0x1000303f
lea eax, [ecx + 0x23]
cmp eax, ecx
jbe 0x10003106
push eax
call fcn.1000ec1f
add esp, 4
test eax, eax
je 0x100030fb
lea ecx, [eax + 0x23]
and ecx, 0xffffffe0
mov dword [ecx - 4], eax
mov eax, dword [ebp - 0x18]
jmp 0x10003055
test ecx, ecx
je 0x10003053
push ecx
call fcn.1000ec1f
mov ecx, eax
add esp, 4
mov eax, dword [ebp - 0x18]
jmp 0x10003055
xor ecx, ecx
mov dword [eax], ecx
mov dword [eax + 0x10], edi
mov dword [eax + 0x14], esi
lea eax, [edi + 1]
push eax
push dword [ebp - 0x1c]
push ecx
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
xor ecx, ecx
call fcn.100088a0
add esp, 0x18
cmp byte [ebp - 0xd], 0
je 0x1000308c
mov eax, dword [ebp - 0x20]
mov edx, dword [ebp - 0x14]
push eax
call fcn.100017b0
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x44]
cmp ecx, 7
jbe 0x100030c9
mov edx, dword [ebp - 0x58]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x100030bf
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100030fb
push ecx
push edx
call fcn.1000ef69
add esp, 8
mov esi, dword [ebp - 0x40]
lea eax, [ebp - 0x2f8]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x10001be5
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 0xc]
mov al, 1
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
call fcn.10001520
call fcn.10001480
int3