Function at 0x66143ba0
Capabilities:
Enumerate processes

Disassembly:
push rbp
sub rsp, 0x1f0
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x70], rcx
mov dword [rbp - 0x64], 0x7bf9634d
mov eax, dword [rbp - 0x64]
mov dword [rbp - 0x74], eax
sub eax, 0x86728cae
je 0x661444e1
jmp 0x66143bd1
mov eax, dword [rbp - 0x74]
sub eax, 0x891537a3
je 0x66144a95
jmp 0x66143be4
mov eax, dword [rbp - 0x74]
sub eax, 0x90900998
je 0x661448c9
jmp 0x66143bf7
mov eax, dword [rbp - 0x74]
sub eax, 0x923d3c89
je 0x66144a32
jmp 0x66143c0a
mov eax, dword [rbp - 0x74]
sub eax, 0x95a4d287
je 0x6614416f
jmp 0x66143c1d
mov eax, dword [rbp - 0x74]
sub eax, 0x9cda7212
je 0x661448d5
jmp 0x66143c30
mov eax, dword [rbp - 0x74]
sub eax, 0x9ceeaa2d
je 0x66144910
jmp 0x66143c43
mov eax, dword [rbp - 0x74]
sub eax, 0xa0934775
je 0x66144936
jmp 0x66143c56
mov eax, dword [rbp - 0x74]
sub eax, 0xa0c0a83a
je 0x6614452d
jmp 0x66143c69
mov eax, dword [rbp - 0x74]
sub eax, 0xa0e4f9c5
je 0x66144264
jmp 0x66143c7c
mov eax, dword [rbp - 0x74]
sub eax, 0xa290f41c
je 0x6614487a
jmp 0x66143c8f
mov eax, dword [rbp - 0x74]
sub eax, 0xae19999a
je 0x66144686
jmp 0x66143ca2
mov eax, dword [rbp - 0x74]
sub eax, 0xb4129005
je 0x66144282
jmp 0x66143cb5
mov eax, dword [rbp - 0x74]
sub eax, 0xbb8e0964
je 0x6614436d
jmp 0x66143cc8
mov eax, dword [rbp - 0x74]
sub eax, 0xc26050f2
je 0x66144a01
jmp 0x66143cdb
mov eax, dword [rbp - 0x74]
sub eax, 0xc26bb668
je 0x66144a89
jmp 0x66143cee
mov eax, dword [rbp - 0x74]
sub eax, 0xc2949e04
je 0x661446e9
jmp 0x66143d01
mov eax, dword [rbp - 0x74]
sub eax, 0xc7c47ea8
je 0x66144258
jmp 0x66143d14
mov eax, dword [rbp - 0x74]
sub eax, 0xd8dd6133
je 0x6614446d
jmp 0x66143d27
mov eax, dword [rbp - 0x74]
sub eax, 0xdcbd184b
je 0x6614408a
jmp 0x66143d3a
mov eax, dword [rbp - 0x74]
sub eax, 0xed7cadbf
je 0x6614412e
jmp 0x66143d4d
mov eax, dword [rbp - 0x74]
sub eax, 0xefd2d7bf
je 0x661445f5
jmp 0x66143d60
mov eax, dword [rbp - 0x74]
sub eax, 0xfac5eefa
je 0x661441b9
jmp 0x66143d73
mov eax, dword [rbp - 0x74]
sub eax, 0xfd4f2a24
je 0x66144158
jmp 0x66143d86
mov eax, dword [rbp - 0x74]
sub eax, 0x269dd79
je 0x661446b8
jmp 0x66143d99
mov eax, dword [rbp - 0x74]
sub eax, 0x2fea4b9
je 0x66144512
jmp 0x66143dac
mov eax, dword [rbp - 0x74]
sub eax, 0x4314703
je 0x66144818
jmp 0x66143dbf
mov eax, dword [rbp - 0x74]
sub eax, 0x5813f67
je 0x66144361
jmp 0x66143dd2
mov eax, dword [rbp - 0x74]
sub eax, 0x68bd6ac
je 0x66144797
jmp 0x66143de5
mov eax, dword [rbp - 0x74]
sub eax, 0xb6e419d
je 0x66144824
jmp 0x66143df8
mov eax, dword [rbp - 0x74]
sub eax, 0xbbc4a94
je 0x661448f6
jmp 0x66143e0b
mov eax, dword [rbp - 0x74]
sub eax, 0xfba144d
je 0x66144a56
jmp 0x66143e1e
mov eax, dword [rbp - 0x74]
sub eax, 0x1068a432
je 0x661443ee
jmp 0x66143e31
mov eax, dword [rbp - 0x74]
sub eax, 0x2033da84
je 0x6614414c
jmp 0x66143e44
mov eax, dword [rbp - 0x74]
sub eax, 0x2224edf3
je 0x6614448b
jmp 0x66143e57
mov eax, dword [rbp - 0x74]
sub eax, 0x2a13afb3
je 0x661449b2
jmp 0x66143e6a
mov eax, dword [rbp - 0x74]
sub eax, 0x2d5bb13a
je 0x66144830
jmp 0x66143e7d
mov eax, dword [rbp - 0x74]
sub eax, 0x2e3a099c
je 0x66144461
jmp 0x66143e90
mov eax, dword [rbp - 0x74]
sub eax, 0x3719cb83
je 0x66144655
jmp 0x66143ea3
mov eax, dword [rbp - 0x74]
sub eax, 0x3a2c358c
je 0x6614460f
jmp 0x66143eb6
mov eax, dword [rbp - 0x74]
sub eax, 0x3fcf43ac
je 0x6614471b
jmp 0x66143ec9
mov eax, dword [rbp - 0x74]
sub eax, 0x59233b34
je 0x661446d2
jmp 0x66143edc
mov eax, dword [rbp - 0x74]
sub eax, 0x5d74488a
je 0x66144a62
jmp 0x66143eef
mov eax, dword [rbp - 0x74]
sub eax, 0x5eb17df7
je 0x661445ad
jmp 0x66143f02
mov eax, dword [rbp - 0x74]
sub eax, 0x5f02eff8
je 0x66144aa1
jmp 0x66143f15
mov eax, dword [rbp - 0x74]
sub eax, 0x620ee6ba
je 0x661442d1
jmp 0x66143f28
mov eax, dword [rbp - 0x74]
sub eax, 0x65359f00
je 0x6614403b
jmp 0x66143f3b
mov eax, dword [rbp - 0x74]
sub eax, 0x685587d6
je 0x66144637
jmp 0x66143f4e
mov eax, dword [rbp - 0x74]
sub eax, 0x69bb3711
je 0x6614466f
jmp 0x66143f61
mov eax, dword [rbp - 0x74]
sub eax, 0x6c1b20ed
je 0x6614491c
jmp 0x66143f74
mov eax, dword [rbp - 0x74]
sub eax, 0x7a20f3ac
je 0x66144a11
jmp 0x66143f87
mov eax, dword [rbp - 0x74]
sub eax, 0x7bf9634d
je 0x66143fb2
jmp 0x66143f9a
mov eax, dword [rbp - 0x74]
sub eax, 0x7cafe96a
je 0x661444ab
jmp 0x66143fad
jmp 0x66144aa8
mov eax, 0x10
mov qword [rbp - 0x80], rax
call fcn.66182470
sub rsp, rax
mov rax, qword [rbp - 0x80]
mov rcx, rsp
mov qword [rbp + 0xf0], rcx
call fcn.66182470
sub rsp, rax
mov rax, rsp
mov qword [rbp + 0xf8], rax
mov eax, 0x30
call fcn.66182470
sub rsp, rax
mov rax, qword [rbp - 0x70]
mov rcx, rsp
mov qword [rbp + 0x100], rcx
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xd8], 0
mov dword [rbp - 0x58], 0x130
mov ecx, 2
xor edx, edx
sub rsp, 0x20
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
add rsp, 0x20
mov qword [rbp - 0x60], rax
mov dword [rbp - 0x64], 0x65359f00
jmp 0x66144aa8
mov eax, dword [sym.some4.dll_x.74]
mov ecx, dword [sym.some4.dll_y.75]
mov edx, eax
sub edx, 0xcea09885
sub edx, 1
add edx, 0xcea09885
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x7a20f3ac
mov ecx, 0xdcbd184b
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x64], eax
jmp 0x66144aa8
mov rcx, qword [rbp - 0x60]
lea rdx, [rbp - 0x58]
sub rsp, 0x20
call sub.KERNEL32.dll_Process32First
add rsp, 0x20
cmp eax, 1
sete al
and al, 1
mov byte [rbp + 0x10f], al
mov ecx, dword [sym.some4.dll_x.74]
mov eax, dword [sym.some4.dll_y.75]
mov edx, ecx
sub edx, 0x758fbe9
sub edx, 1
add edx, 0x758fbe9
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x7a20f3ac
mov ecx, 0xed7cadbf
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x64], eax
jmp 0x66144aa8
mov dl, byte [rbp + 0x10f]
mov eax, 0x9cda7212
mov ecx, 0x2033da84
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x64], eax
jmp 0x66144aa8
mov dword [rbp - 0x64], 0xfd4f2a24
jmp 0x66144aa8
mov rax, qword [rbp - 0x60]
mov qword [rbp + 0x110], rax
mov dword [rbp - 0x64], 0x95a4d287
jmp 0x66144aa8
mov eax, dword [sym.some4.dll_x.74]
mov ecx, dword [sym.some4.dll_y.75]
xor r8d, r8d
sub r8d, 1
mov edx, eax
add edx, r8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x923d3c89
mov ecx, 0xfac5eefa
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x64], eax
jmp 0x66144aa8
mov rcx, qword [rbp + 0x110]
lea rdx, [rbp - 0x58]
sub rsp, 0x20
call sub.KERNEL32.dll_Process32Next
add rsp, 0x20
mov dword [rbp + 0x11c], eax
mov ecx, dword [sym.some4.dll_x.74]
mov eax, dword [sym.some4.dll_y.75]
mov edx, ecx
add edx, 0x2b4100d5
sub edx, 1
sub edx, 0x2b4100d5
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x923d3c89
mov ecx, 0xc7c47ea8
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x64], eax
jmp 0x66144aa8
mov dword [rbp - 0x64], 0xa0e4f9c5
jmp 0x66144aa8
mov edx, dword [rbp + 0x11c]
mov eax, 0x2d5bb13a
mov ecx, 0xb4129005
cmp edx, 1
cmove eax, ecx
mov dword [rbp - 0x64], eax
jmp 0x66144aa8
mov eax, dword [sym.some4.dll_x.74]
mov ecx, dword [sym.some4.dll_y.75]
mov edx, eax
add edx, 0xefa57dd5
sub edx, 1
sub edx, 0xefa57dd5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xfba144d
mov ecx, 0x620ee6ba
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x64], eax
jmp 0x66144aa8
lea rax, [rbp - 0x58]
add rax, 0x2c
mov qword [rbp + 0x120], rax
mov ecx, dword [sym.some4.dll_x.74]
mov eax, dword [sym.some4.dll_y.75]
mov edx, ecx
add edx, 0x9ab9682c
sub edx, 1
sub edx, 0x9ab9682c
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xfba144d
mov ecx, 0x5813f67
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x64], eax
jmp 0x66144aa8
mov dword [rbp - 0x64], 0xbb8e0964
jmp 0x66144aa8
mov ecx, dword [sym.some4.dll_x.74]
mov eax, dword [sym.some4.dll_y.75]
mov edx, ecx
add edx, 0xde7ba1dc
sub edx, 1
sub edx, 0xde7ba1dc
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5d74488a
mov ecx, 0x1068a432
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x64], eax
jmp 0x66144aa8
mov rdx, qword [rbp + 0xe0]
mov rcx, qword [rbp + 0x120]
sub rsp, 0x20
call sub.msvcrt.dll__stricmp
add rsp, 0x20
cmp eax, 0
sete al
and al, 1
mov byte [rbp + 0x12f], al
mov eax, dword [sym.some4.dll_x.74]
mov ecx, dword [sym.some4.dll_y.75]
xor r8d, r8d
sub r8d, 1
mov edx, eax
add edx, r8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5d74488a
mov ecx, 0x2e3a099c
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x64], eax
jmp 0x66144aa8
mov dword [rbp - 0x64], 0xd8dd6133
jmp 0x66144aa8
mov dl, byte [rbp + 0x12f]
mov eax, 0xb6e419d
mov ecx, 0x2224edf3
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x64], eax
jmp 0x66144aa8
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
add rsp, 0x20
mov dword [rbp + 0x130], eax
mov dword [rbp - 0x64], 0x7cafe96a
jmp 0x66144aa8
mov rdx, qword [rbp + 0xf0]
mov ecx, dword [rbp + 0x130]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
add rsp, 0x20
mov rax, qword [rbp + 0xf0]
mov eax, dword [rax]
mov dword [rbp + 0x134], eax
mov dword [rbp - 0x64], 0x86728cae
jmp 0x66144aa8
mov ecx, dword [rbp - 0x50]
sub rsp, 0x20
call sym.some4.dll_GetProcSessionID_unsigned_long_
add rsp, 0x20
mov r8d, eax
mov edx, dword [rbp + 0x134]
mov eax, 0x3fcf43ac
mov ecx, 0x2fea4b9
cmp edx, r8d
cmove eax, ecx
mov dword [rbp - 0x64], eax
jmp 0x66144aa8
mov rax, qword [rbp + 0xf8]
mov qword [rax + 8], 0
mov dword [rbp - 0x64], 0xa0c0a83a
jmp 0x66144aa8
mov ecx, dword [rbp - 0x50]
sub rsp, 0x20
call fcn.66143b30
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp + 0xf8]
mov qword [rax], rcx
mov rax, qword [rbp + 0x100]
mov dword [rax], 0x30
mov rax, qword [rbp + 0x100]
mov qword [rax + 8], 0
mov rax, qword [rbp + 0x100]
mov dword [rax + 0x18], 0
mov rax, qword [rbp + 0x100]
mov qword [rax + 0x10], 0
mov rax, qword [rbp + 0x100]
mov qword [rax + 0x20], 0
mov rax, qword [rbp + 0x100]
mov qword [rax + 0x28], 0
mov dword [rbp - 0x64], 0x5eb17df7
jmp 0x66144aa8
mov rax, qword [sym.some4.dll_YuSpySUojWbACMcJshb]
mov r9, qword [rbp + 0xf8]
mov r8, qword [rbp + 0x100]
lea rcx, [rbp + 0xd8]
mov edx, 0x1fffff
sub rsp, 0x20
call rax
add rsp, 0x20
mov eax, 0x269dd79
mov ecx, 0xefd2d7bf
cmp qword [rbp + 0xd8], 0
cmovne eax, ecx
mov dword [rbp - 0x64], eax
jmp 0x66144aa8
mov rax, qword [rbp + 0xd8]
mov qword [rbp + 0x138], rax
mov dword [rbp - 0x64], 0x3a2c358c
jmp 0x66144aa8
mov rax, qword [rbp + 0x138]
mov rcx, 0xffffffffffffffff
cmp rax, rcx
setne al
and al, 1
mov byte [rbp + 0x147], al
mov dword [rbp - 0x64], 0x685587d6
jmp 0x66144aa8
mov dl, byte [rbp + 0x147]
mov eax, 0x269dd79
mov ecx, 0x3719cb83
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x64], eax
jmp 0x66144aa8
mov rax, qword [sym.some4.dll_ZubCDvEPzeCwJVMmDjH]
mov qword [rbp + 0x148], rax
mov dword [rbp - 0x64], 0x69bb3711
jmp 0x66144aa8
mov rax, qword [rbp - 0x60]
mov qword [rbp + 0x150], rax
mov dword [rbp - 0x64], 0xae19999a
jmp 0x66144aa8
mov rax, qword [rbp + 0x148]
mov rcx, qword [rbp + 0x150]
sub rsp, 0x20
call rax
add rsp, 0x20
mov rax, qword [rbp + 0xd8]
mov qword [rbp + 0xe8], rax
mov dword [rbp - 0x64], 0x6c1b20ed
jmp 0x66144aa8
mov rax, qword [sym.some4.dll_ZubCDvEPzeCwJVMmDjH]
mov qword [rbp + 0x158], rax
mov dword [rbp - 0x64], 0x59233b34
jmp 0x66144aa8
mov rax, qword [rbp - 0x60]
mov qword [rbp + 0x160], rax
mov dword [rbp - 0x64], 0xc2949e04
jmp 0x66144aa8
mov rax, qword [rbp + 0x158]
mov rcx, qword [rbp + 0x160]
sub rsp, 0x20
call rax
add rsp, 0x20
mov rax, 0xffffffffffffffff
mov qword [rbp + 0xe8], rax
mov dword [rbp - 0x64], 0x6c1b20ed
jmp 0x66144aa8
mov ecx, dword [sym.some4.dll_x.74]
mov eax, dword [sym.some4.dll_y.75]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc26bb668
mov ecx, 0x68bd6ac
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x64], eax
jmp 0x66144aa8
mov ecx, dword [sym.some4.dll_x.74]
mov eax, dword [sym.some4.dll_y.75]
mov edx, ecx
sub edx, 0xa76238f7
sub edx, 1
add edx, 0xa76238f7
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xc26bb668
mov ecx, 0x4314703
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x64], eax
jmp 0x66144aa8
mov dword [rbp - 0x64], 0xb6e419d
jmp 0x66144aa8
mov dword [rbp - 0x64], 0xfd4f2a24
jmp 0x66144aa8
mov eax, dword [sym.some4.dll_x.74]
mov ecx, dword [sym.some4.dll_y.75]
xor r8d, r8d
sub r8d, 1
mov edx, eax
add edx, r8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x891537a3
mov ecx, 0xa290f41c
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x64], eax
jmp 0x66144aa8
mov eax, dword [sym.some4.dll_x.74]
mov ecx, dword [sym.some4.dll_y.75]
mov edx, eax
sub edx, 0x1722775f
sub edx, 1
add edx, 0x1722775f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x891537a3
mov ecx, 0x90900998
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x64], eax
jmp 0x66144aa8
mov dword [rbp - 0x64], 0x9cda7212
jmp 0x66144aa8
mov rax, qword [sym.some4.dll_ZubCDvEPzeCwJVMmDjH]
mov rcx, qword [rbp - 0x60]
sub rsp, 0x20
call rax
add rsp, 0x20
mov dword [rbp - 0x64], 0xbbc4a94
jmp 0x66144aa8
mov rax, 0xffffffffffffffff
mov qword [rbp + 0xe8], rax
mov dword [rbp - 0x64], 0x9ceeaa2d
jmp 0x66144aa8
mov dword [rbp - 0x64], 0x6c1b20ed
jmp 0x66144aa8
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x168], rax
mov dword [rbp - 0x64], 0xa0934775
jmp 0x66144aa8
mov ecx, dword [sym.some4.dll_x.74]
mov eax, dword [sym.some4.dll_y.75]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x5f02eff8
mov ecx, 0x2a13afb3
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x64], eax
jmp 0x66144aa8
mov eax, dword [sym.some4.dll_x.74]
mov ecx, dword [sym.some4.dll_y.75]
mov edx, eax
add edx, 0x399aaf13
sub edx, 1
sub edx, 0x399aaf13
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x5f02eff8
mov ecx, 0xc26050f2
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x64], eax
jmp 0x66144aa8
mov rax, qword [rbp + 0x168]
lea rsp, [rbp + 0x170]
pop rbp
ret
mov rcx, qword [rbp - 0x60]
lea rdx, [rbp - 0x58]
sub rsp, 0x20
call sub.KERNEL32.dll_Process32First
add rsp, 0x20
mov dword [rbp - 0x64], 0xdcbd184b
jmp 0x66144aa8
mov rcx, qword [rbp + 0x110]
lea rdx, [rbp - 0x58]
sub rsp, 0x20
call sub.KERNEL32.dll_Process32Next
add rsp, 0x20
mov dword [rbp - 0x64], 0xfac5eefa
jmp 0x66144aa8
mov dword [rbp - 0x64], 0x620ee6ba
jmp 0x66144aa8
mov rdx, qword [rbp + 0xe0]
mov rcx, qword [rbp + 0x120]
sub rsp, 0x20
call sub.msvcrt.dll__stricmp
add rsp, 0x20
mov dword [rbp - 0x64], 0x1068a432
jmp 0x66144aa8
mov dword [rbp - 0x64], 0x68bd6ac
jmp 0x66144aa8
mov dword [rbp - 0x64], 0xa290f41c
jmp 0x66144aa8
mov dword [rbp - 0x64], 0x2a13afb3
jmp 0x66143bbb