Function at 0x14001b050
Capabilities:
Create process on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x500]
sub rsp, 0x600
mov rax, qword [0x1401c4080]
xor rax, rsp
mov qword [rbp + 0x4f8], rax
xor ebx, ebx
mov r15d, ebx
mov dword [rbp + 0x120], ebx
mov byte [0x140204d64], 1
xorps xmm0, xmm0
movups xmmword [rbp + 0x3e0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x3f0], xmm1
mov r8d, Ordinal_41
lea rdx, str._C:Program_FilesBlueStacksHD_Adb.exe_
lea rcx, [rbp + 0x3e0]
call fcn.1400028e0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x400], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x410], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_45
lea rdx, str._C:Program_FilesBlueStacks_msi5HD_Adb.exe_
lea rcx, [rbp + 0x400]
call fcn.1400028e0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x420], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x430], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_46
lea rdx, str._C:Program_FilesBlueStacks_bgp64HD_Adb.exe_
lea rcx, [rbp + 0x420]
call fcn.1400028e0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x440], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x450], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_35
lea rdx, str._C:Program_FilesLDPlayer_adb.exe_
lea rcx, [rbp + 0x440]
call fcn.1400028e0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x460], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x470], xmm1
mov r8d, Ordinal_41
lea rdx, str._C:Program_FilesLDPlayer_4_adb.exe_
lea rcx, [rbp + 0x460]
call fcn.1400028e0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x480], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x490], xmm1
mov r8d, Ordinal_41
lea rdx, str._C:Program_FilesMSI_Emulator_adb.exe_
lea rcx, [rbp + 0x480]
call fcn.1400028e0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x4a0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x4b0], xmm1
mov r8d, Ordinal_41
lea rdx, str._C:Program_Files__x86_Nox_bin_adb.exe_
lea rcx, [rbp + 0x4a0]
call fcn.1400028e0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x4c0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x4d0], xmm1
mov r8d, Ordinal_46
lea rdx, str._C:Program_Files__x86_Genymotion_adb.exe_
lea rcx, [rbp + 0x4c0]
call fcn.1400028e0
nop
mov dword [rbp + 0x370], WSASetLastError
xorps xmm0, xmm0
movups xmmword [rbp + 0x378], xmm0
movups xmmword [rbp + 0x388], xmm0
movups xmmword [rbp + 0x398], xmm0
movups xmmword [rbp + 0x3a8], xmm0
movups xmmword [rbp + 0x3b8], xmm0
movups xmmword [rbp + 0x3c8], xmm0
mov dword [rbp + 0x3ac], 1
mov word [rbp + 0x3b0], bx
movdqa xmm0, xmmword [0x1401a9290]
movdqu xmmword [rbp + 0x4e0], xmm0
mov dword [rbp + 0x4f0], 0x15b7
mov dword [rbp + 0x4f4], 0x15b8
lea rsi, [rbp + 0x3e0]
movabs r13, 0x7fffffffffffffff
movzx ebx, byte [rsp + 0x50]
movzx edi, byte [rsp + 0x50]
nop dword [rax]
lea r14, [rbp + 0x4e0]
nop word [rax + rax]
mov edx, dword [r14]
lea rcx, [rbp + 0x1d0]
call fcn.14000ee90
mov r12, rax
mov rdx, qword [rsi + 0x10]
mov rcx, r13
sub rcx, rdx
cmp rcx, 0x13
jb 0x14001cdf1
mov r9, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x14001b2e3
mov r9, qword [rsi]
mov qword [rsp + 0x30], reloc.WS2_32.dll_send
lea rax, str._connect_localhost:
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdx
mov r8, rsi
movzx edx, bl
lea rcx, [rbp + 0x1b0]
call fcn.140024570
or r15d, 1
mov r9, r12
lea r8, [rbp + 0x1b0]
movzx edx, dil
lea rcx, [rbp + 0x170]
call fcn.140024380
or r15d, 2
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0xf
jbe 0x14001b373
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b36d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b47a
call fcn.14012edf4
nop
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 0xf
jbe 0x14001b3b4
inc rdx
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b3af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b481
call fcn.14012edf4
lea rdx, [rbp + 0x170]
cmp qword [rbp + 0x188], 0xf
cmova rdx, qword [rbp + 0x170]
lea rax, [rbp + 0x128]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x370]
mov qword [rsp + 0x40], rax
xor r12d, r12d
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x14001b488
mov rdx, qword [rbp + 0x188]
cmp rdx, 0xf
jbe 0x14001b44d
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b448
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001b4ec
call fcn.14012edf4
add r14, 4
lea rax, [rbp + 0x4f8]
cmp r14, rax
jne 0x14001b2b0
add rsi, 0x20
lea rax, [rbp + 0x4e0]
cmp rsi, rax
jne 0x14001b2a0
jmp 0x14001cc23
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x188]
cmp rdx, 0xf
jbe 0x14001b4f8
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b4f3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001b4f3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012edf4
mov rax, r13
mov rcx, qword [rbp + 0x3f0]
sub rax, rcx
cmp rax, 0x33
jb 0x14001cdf7
lea r9, [rbp + 0x3e0]
cmp qword [rbp + 0x3f8], 0xf
cmova r9, qword [rbp + 0x3e0]
mov qword [rsp + 0x30], gethostname
lea rax, str._shell_settings_put_global_window_animation_scale_0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x3e0]
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp + 0x350]
call fcn.140024570
nop
mov rax, r13
mov rcx, qword [rbp + 0x3f0]
sub rax, rcx
cmp rax, 0x37
jb 0x14001cdfd
lea r9, [rbp + 0x3e0]
cmp qword [rbp + 0x3f8], 0xf
cmova r9, qword [rbp + 0x3e0]
mov qword [rsp + 0x30], Ordinal_60
lea rax, str._shell_settings_put_global_transition_animation_scale_0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x3e0]
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp + 0x330]
call fcn.140024570
nop
mov rax, r13
mov rcx, qword [rbp + 0x3f0]
sub rax, rcx
cmp rax, 0x34
jb 0x14001ce03
lea r9, [rbp + 0x3e0]
cmp qword [rbp + 0x3f8], 0xf
cmova r9, qword [rbp + 0x3e0]
mov qword [rsp + 0x30], Ordinal_60
lea rax, str._shell_settings_put_global_animator_duration_scale_0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x3e0]
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp + 0x310]
call fcn.140024570
nop
mov rax, r13
mov rcx, qword [rbp + 0x3f0]
sub rax, rcx
cmp rax, 0x26
jb 0x14001ce09
lea r9, [rbp + 0x3e0]
cmp qword [rbp + 0x3f8], 0xf
cmova r9, qword [rbp + 0x3e0]
mov qword [rsp + 0x30], Ordinal_46
lea rax, str._shell_settings_put_global_auto_sync_0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x3e0]
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp + 0x2f0]
call fcn.140024570
nop
mov rax, r13
mov rcx, qword [rbp + 0x3f0]
sub rax, rcx
cmp rax, 0x2c
jb 0x14001ce0f
lea r9, [rbp + 0x3e0]
cmp qword [rbp + 0x3f8], 0xf
cmova r9, qword [rbp + 0x3e0]
mov qword [rsp + 0x30], Ordinal_46
lea rax, str._shell_settings_put_global_background_data_0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x3e0]
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp + 0x2d0]
call fcn.140024570
nop
mov rax, r13
mov rcx, qword [rbp + 0x3f0]
sub rax, rcx
cmp rax, 0x30
jb 0x14001ce15
lea r9, [rbp + 0x3e0]
cmp qword [rbp + 0x3f8], 0xf
cmova r9, qword [rbp + 0x3e0]
mov qword [rsp + Ordinal_50], 0x30
lea rax, str._shell_settings_put_system_screensaver_enabled_0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x3e0]
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp + 0x2b0]
call fcn.140024570
nop
mov rax, r13
mov rcx, qword [rbp + 0x3f0]
sub rax, rcx
cmp rax, 0x26
jb 0x14001ce1b
lea r9, [rbp + 0x3e0]
cmp qword [rbp + 0x3f8], 0xf
cmova r9, qword [rbp + 0x3e0]
mov qword [rsp + 0x30], Ordinal_46
lea rax, str._shell_settings_put_global_low_power_0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x3e0]
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp + 0x290]
call fcn.140024570
nop
mov rax, r13
mov rcx, qword [rbp + 0x3f0]
sub rax, rcx
cmp rax, 0x27
jb 0x14001ce21
lea r9, [rbp + 0x3e0]
cmp qword [rbp + 0x3f8], 0xf
cmova r9, qword [rbp + 0x3e0]
mov qword [rsp + 0x30], Ordinal_46
lea rax, str._shell_settings_put_system_vibrate_on_0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x3e0]
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp + 0x270]
call fcn.140024570
nop
mov rax, r13
mov rcx, qword [rbp + 0x3f0]
sub rax, rcx
cmp rax, 0x26
jb 0x14001ce27
lea r9, [rbp + 0x3e0]
cmp qword [rbp + 0x3f8], 0xf
cmova r9, qword [rbp + 0x3e0]
mov qword [rsp + 0x30], Ordinal_46
lea rax, str._shell_settings_put_global_auto_time_0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x3e0]
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp + 0x250]
call fcn.140024570
nop
mov rax, r13
mov rcx, qword [rbp + 0x3f0]
sub rax, rcx
cmp rax, 0x28
jb 0x14001ce2d
lea r9, [rbp + 0x3e0]
cmp qword [rbp + 0x3f8], 0xf
cmova r9, qword [rbp + 0x3e0]
mov qword [rsp + 0x30], Ordinal_46
lea rax, str._shell_settings_put_global_mobile_data_0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x3e0]
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp + 0x230]
call fcn.140024570
nop
mov rax, r13
mov rcx, qword [rbp + 0x3f0]
sub rax, rcx
cmp rax, 0x3b
jb 0x14001ce33
lea r9, [rbp + 0x3e0]
cmp qword [rbp + 0x3f8], 0xf
cmova r9, qword [rbp + 0x3e0]
mov qword [rsp + 0x30], Ordinal_60
lea rax, str._shell_settings_put_global_heads_up_notifications_enabled_0
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x3e0]
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp + 0x210]
call fcn.140024570
nop
mov rax, r13
mov rcx, qword [rbp + 0x3f0]
sub rax, rcx
cmp rax, 0x4c
jb 0x14001ce39
lea r9, [rbp + 0x3e0]
cmp qword [rbp + 0x3f8], 0xf
cmova r9, qword [rbp + 0x3e0]
mov qword [rsp + 0x30], Ordinal_79
lea rax, str._shell_settings_put_secure_location_providers_allowed__gps__network__passive
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x3e0]
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp + 0x1f0]
call fcn.140024570
nop
mov rax, r13
mov rcx, qword [rbp + 0x3f0]
sub rax, rcx
cmp rax, 0x36
jb 0x14001ce3f
lea r9, [rbp + 0x3e0]
cmp qword [rbp + 0x3f8], 0xf
cmova r9, qword [rbp + 0x3e0]
mov qword [rsp + 0x30], Ordinal_60
lea rax, str._shell_pm_disable_user___user_0_com.google.android.gms
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x3e0]
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp + 0x1d0]
call fcn.140024570
nop
mov rax, r13
mov rcx, qword [rbp + 0x3f0]
sub rax, rcx
cmp rax, 0x12
jb 0x14001ce45
lea r9, [rbp + 0x3e0]
cmp qword [rbp + 0x3f8], 0xf
cmova r9, qword [rbp + 0x3e0]
mov qword [rsp + 0x30], reloc.WS2_32.dll_select
lea rax, str._shell_am_kill_all
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x3e0]
movzx edx, byte [rsp + 0x50]
lea rcx, [rbp + 0x1b0]
call fcn.140024570
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x158], xmm0
mov qword [rbp + 0x168], rax
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqa xmmword [rsp + 0x70], xmm1
lea rsi, [rbp + 0x350]
cmp qword [rbp + 0x368], 0xf
cmova rsi, qword [rbp + 0x350]
mov rdi, qword [rbp + 0x360]
cmp rdi, r13
ja 0x14001ce4b
movabs r14, 0x8000000000000000
mov r15d, reloc.WLDAP32.dll_Ordinal_22
cmp rdi, 0xf
ja 0x14001babf
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0x60], xmm0
jmp 0x14001bb48
mov rbx, rdi
or rbx, 0xf
cmp rbx, r13
jbe 0x14001baf0
mov rbx, r13
lea rax, [r14 + 0x27]
mov rcx, rax
call fcn.14012edb0
mov rcx, rax
test rax, rax
je 0x14001bb1d
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001bb29
cmp rbx, r15
cmovb rbx, r15
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x14001bb05
mov rax, r12
jmp 0x14001bb29
cmp rcx, 0x1000
jb 0x14001bb24
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001cd9d
jmp 0x14001bad2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012edb0
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x70], xmm1
lea rsi, [rbp + 0x330]
cmp qword [rbp + 0x348], 0xf
cmova rsi, qword [rbp + 0x330]
mov rdi, qword [rbp + 0x340]
cmp rdi, r13
ja 0x14001ce51
cmp rdi, 0xf
ja 0x14001bb9c
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [rsi]
movaps xmmword [rbp - 0x80], xmm0
jmp 0x14001bc23
mov rbx, rdi
or rbx, 0xf
cmp rbx, r13
jbe 0x14001bbcd
mov rbx, r13
lea rax, [r14 + 0x27]
mov rcx, rax
call fcn.14012edb0
mov rcx, rax
test rax, rax
je 0x14001bbfb
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001bc07
cmp rbx, 0x16
cmovb rbx, r15
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x14001bbe3
mov rax, r12
jmp 0x14001bc07
cmp rcx, 0x1000
jb 0x14001bc02
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001cda3
jmp 0x14001bbaf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012edb0
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x50], xmm1
lea rsi, [rbp + 0x310]
cmp qword [rbp + 0x328], 0xf
cmova rsi, qword [rbp + 0x310]
mov rdi, qword [rbp + 0x320]
cmp rdi, r13
ja 0x14001ce57
cmp rdi, 0xf
ja 0x14001bc77
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [rsi]
movaps xmmword [rbp - 0x60], xmm0
jmp 0x14001bcfe
mov rbx, rdi
or rbx, 0xf
cmp rbx, r13
jbe 0x14001bca8
mov rbx, r13
lea rax, [r14 + 0x27]
mov rcx, rax
call fcn.14012edb0
mov rcx, rax
test rax, rax
je 0x14001bcd6
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001bce2
cmp rbx, 0x16
cmovb rbx, r15
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x14001bcbe
mov rax, r12
jmp 0x14001bce2
cmp rcx, 0x1000
jb 0x14001bcdd
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001cda9
jmp 0x14001bc8a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012edb0
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x30], xmm1
lea rsi, [rbp + 0x2f0]
cmp qword [rbp + 0x308], 0xf
cmova rsi, qword [rbp + 0x2f0]
mov rdi, qword [rbp + 0x300]
cmp rdi, r13
ja 0x14001ce5d
cmp rdi, 0xf
ja 0x14001bd52
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [rsi]
movaps xmmword [rbp - 0x40], xmm0
jmp 0x14001bdd9
mov rbx, rdi
or rbx, 0xf
cmp rbx, r13
jbe 0x14001bd83
mov rbx, r13
lea rax, [r14 + 0x27]
mov rcx, rax
call fcn.14012edb0
mov rcx, rax
test rax, rax
je 0x14001bdb1
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001bdbd
cmp rbx, 0x16
cmovb rbx, r15
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x14001bd99
mov rax, r12
jmp 0x14001bdbd
cmp rcx, 0x1000
jb 0x14001bdb8
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001cdaf
jmp 0x14001bd65
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012edb0
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x28], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x10], xmm1
lea rsi, [rbp + 0x2d0]
cmp qword [rbp + 0x2e8], 0xf
cmova rsi, qword [rbp + 0x2d0]
mov rdi, qword [rbp + 0x2e0]
cmp rdi, r13
ja 0x14001ce63
cmp rdi, 0xf
ja 0x14001be2d
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [rsi]
movaps xmmword [rbp - 0x20], xmm0
jmp 0x14001beb4
mov rbx, rdi
or rbx, 0xf
cmp rbx, r13
jbe 0x14001be5e
mov rbx, r13
lea rax, [r14 + 0x27]
mov rcx, rax
call fcn.14012edb0
mov rcx, rax
test rax, rax
je 0x14001be8c
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001be98
cmp rbx, 0x16
cmovb rbx, r15
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x14001be74
mov rax, r12
jmp 0x14001be98
cmp rcx, 0x1000
jb 0x14001be93
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001cdb5
jmp 0x14001be40
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012edb0
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x10], rdi
mov qword [rbp - 8], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x10], xmm1
lea rsi, [rbp + 0x2b0]
cmp qword [rbp + 0x2c8], 0xf
cmova rsi, qword [rbp + 0x2b0]
mov rdi, qword [rbp + 0x2c0]
cmp rdi, r13
ja 0x14001ce69
cmp rdi, 0xf
ja 0x14001bf08
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x18], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [rsi]
movaps xmmword [rbp], xmm0
jmp 0x14001bf8f
mov rbx, rdi
or rbx, 0xf
cmp rbx, r13
jbe 0x14001bf39
mov rbx, r13
lea rax, [r14 + 0x27]
mov rcx, rax
call fcn.14012edb0
mov rcx, rax
test rax, rax
je 0x14001bf67
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001bf73
cmp rbx, 0x16
cmovb rbx, r15
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x14001bf4f
mov rax, r12
jmp 0x14001bf73
cmp rcx, 0x1000
jb 0x14001bf6e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001cdbb
jmp 0x14001bf1b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012edb0
mov qword [rbp], rax
mov qword [rbp + 0x10], rdi
mov qword [rbp + 0x18], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x30], xmm1
lea rsi, [rbp + 0x290]
cmp qword [rbp + 0x2a8], 0xf
cmova rsi, qword [rbp + 0x290]
mov rdi, qword [rbp + 0x2a0]
cmp rdi, r13
ja 0x14001ce6f
cmp rdi, 0xf
ja 0x14001bfe3
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x38], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [rsi]
movaps xmmword [rbp + 0x20], xmm0
jmp 0x14001c06a
mov rbx, rdi
or rbx, 0xf
cmp rbx, r13
jbe 0x14001c014
mov rbx, r13
lea rax, [r14 + 0x27]
mov rcx, rax
call fcn.14012edb0
mov rcx, rax
test rax, rax
je 0x14001c042
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001c04e
cmp rbx, 0x16
cmovb rbx, r15
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x14001c02a
mov rax, r12
jmp 0x14001c04e
cmp rcx, 0x1000
jb 0x14001c049
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001cdc1
jmp 0x14001bff6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012edb0
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x38], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x50], xmm1
lea rsi, [rbp + 0x270]
cmp qword [rbp + 0x288], 0xf
cmova rsi, qword [rbp + 0x270]
mov rdi, qword [rbp + 0x280]
cmp rdi, r13
ja 0x14001ce75
cmp rdi, 0xf
ja 0x14001c0be
mov qword [rbp + 0x50], rdi
mov qword [rbp + 0x58], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [rsi]
movaps xmmword [rbp + 0x40], xmm0
jmp 0x14001c145
mov rbx, rdi
or rbx, 0xf
cmp rbx, r13
jbe 0x14001c0ef
mov rbx, r13
lea rax, [r14 + 0x27]
mov rcx, rax
call fcn.14012edb0
mov rcx, rax
test rax, rax
je 0x14001c11d
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001c129
cmp rbx, 0x16
cmovb rbx, r15
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x14001c105
mov rax, r12
jmp 0x14001c129
cmp rcx, 0x1000
jb 0x14001c124
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001cdc7
jmp 0x14001c0d1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012edb0
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x50], rdi
mov qword [rbp + 0x58], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x70], xmm1
lea rsi, [rbp + 0x250]
cmp qword [rbp + 0x268], 0xf
cmova rsi, qword [rbp + 0x250]
mov rdi, qword [rbp + 0x260]
cmp rdi, r13
ja 0x14001ce7b
cmp rdi, 0xf
ja 0x14001c199
mov qword [rbp + 0x70], rdi
mov qword [rbp + 0x78], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [rsi]
movaps xmmword [rbp + 0x60], xmm0
jmp 0x14001c220
mov rbx, rdi
or rbx, 0xf
cmp rbx, r13
jbe 0x14001c1ca
mov rbx, r13
lea rax, [r14 + 0x27]
mov rcx, rax
call fcn.14012edb0
mov rcx, rax
test rax, rax
je 0x14001c1f8
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001c204
cmp rbx, 0x16
cmovb rbx, r15
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x14001c1e0
mov rax, r12
jmp 0x14001c204
cmp rcx, 0x1000
jb 0x14001c1ff
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001cdcd
jmp 0x14001c1ac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012edb0
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x70], rdi
mov qword [rbp + 0x78], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x90], xmm1
lea rsi, [rbp + 0x230]
cmp qword [rbp + 0x248], 0xf
cmova rsi, qword [rbp + 0x230]
mov rdi, qword [rbp + 0x240]
cmp rdi, r13
ja 0x14001ce81
cmp rdi, 0xf
ja 0x14001c283
mov qword [rbp + 0x90], rdi
mov qword [rbp + 0x98], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [rsi]
movaps xmmword [rbp + 0x80], xmm0
jmp 0x14001c313
mov rbx, rdi
or rbx, 0xf
cmp rbx, r13
jbe 0x14001c2b4
mov rbx, r13
lea rax, [r14 + 0x27]
mov rcx, rax
call fcn.14012edb0
mov rcx, rax
test rax, rax
je 0x14001c2e2
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001c2ee
cmp rbx, 0x16
cmovb rbx, r15
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x14001c2ca
mov rax, r12
jmp 0x14001c2ee
cmp rcx, 0x1000
jb 0x14001c2e9
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001cdd3
jmp 0x14001c296
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012edb0
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x90], rdi
mov qword [rbp + 0x98], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xb0], xmm1
lea rsi, [rbp + 0x210]
cmp qword [rbp + 0x228], 0xf
cmova rsi, qword [rbp + 0x210]
mov rdi, qword [rbp + 0x220]
cmp rdi, r13
ja 0x14001ce87
cmp rdi, 0xf
ja 0x14001c376
mov qword [rbp + 0xb0], rdi
mov qword [rbp + 0xb8], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [rsi]
movaps xmmword [rbp + 0xa0], xmm0
jmp 0x14001c406
mov rbx, rdi
or rbx, 0xf
cmp rbx, r13
jbe 0x14001c3a7
mov rbx, r13
lea rax, [r14 + 0x27]
mov rcx, rax
call fcn.14012edb0
mov rcx, rax
test rax, rax
je 0x14001c3d5
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001c3e1
cmp rbx, 0x16
cmovb rbx, r15
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x14001c3bd
mov rax, r12
jmp 0x14001c3e1
cmp rcx, 0x1000
jb 0x14001c3dc
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001cdd9
jmp 0x14001c389
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012edb0
mov qword [rbp + 0xa0], rax
mov qword [rbp + 0xb0], rdi
mov qword [rbp + 0xb8], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xd0], xmm1
lea rsi, [rbp + 0x1f0]
cmp qword [rbp + 0x208], 0xf
cmova rsi, qword [rbp + 0x1f0]
mov rdi, qword [rbp + 0x200]
cmp rdi, r13
ja 0x14001ce8d
cmp rdi, 0xf
ja 0x14001c469
mov qword [rbp + 0xd0], rdi
mov qword [rbp + 0xd8], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [rsi]
movaps xmmword [rbp + 0xc0], xmm0
jmp 0x14001c4f9
mov rbx, rdi
or rbx, 0xf
cmp rbx, r13
jbe 0x14001c49a
mov rbx, r13
lea rax, [r14 + 0x27]
mov rcx, rax
call fcn.14012edb0
mov rcx, rax
test rax, rax
je 0x14001c4c8
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001c4d4
cmp rbx, 0x16
cmovb rbx, r15
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x14001c4b0
mov rax, r12
jmp 0x14001c4d4
cmp rcx, 0x1000
jb 0x14001c4cf
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001cddf
jmp 0x14001c47c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012edb0
mov qword [rbp + 0xc0], rax
mov qword [rbp + 0xd0], rdi
mov qword [rbp + 0xd8], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0xf0], xmm1
lea rsi, [rbp + 0x1d0]
mov r15, qword [rbp + 0x1d0]
mov r12, qword [rbp + 0x1e8]
cmp r12, 0xf
cmova rsi, r15
mov rdi, qword [rbp + 0x1e0]
cmp rdi, r13
ja 0x14001ce93
cmp rdi, 0xf
ja 0x14001c562
mov qword [rbp + 0xf0], rdi
mov qword [rbp + reloc.WS2_32.dll_ntohs8], 0xf
movups xmm0, xmmword [rsi]
movaps xmmword [rbp + 0xe0], xmm0
jmp 0x14001c5f6
mov rbx, rdi
or rbx, 0xf
cmp rbx, r13
jbe 0x14001c593
mov rbx, r13
lea rax, [r14 + 0x27]
mov rcx, rax
call fcn.14012edb0
mov rcx, rax
test rax, rax
je 0x14001c5c5
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001c5d1
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x14001c5ad
xor eax, eax
jmp 0x14001c5d1
cmp rcx, 0x1000
jb 0x14001c5cc
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001cde5
jmp 0x14001c575
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012edb0
mov qword [rbp + 0xe0], rax
mov qword [rbp + 0xf0], rdi
mov qword [rbp + 0xf8], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x110], xmm1
lea rdi, [rbp + 0x1b0]
mov rsi, qword [rbp + 0x1b0]
mov r14, qword [rbp + 0x1c8]
cmp r14, 0xf
cmova rdi, rsi
mov rbx, qword [rbp + 0x1c0]
cmp rbx, r13
ja 0x14001cd97
cmp rbx, 0xf
ja 0x14001c65f
mov qword [rbp + 0x110], rbx
mov qword [rbp + 0x118], reloc.WS2_32.dll_ntohs
movups xmm0, xmmword [rdi]
movaps xmmword [rbp + 0x100], xmm0
jmp 0x14001c6fd
mov rax, rbx
or rax, 0xf
cmp rax, r13
jbe 0x14001c697
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14012edb0
mov rcx, rax
test rax, rax
je 0x14001c6cc
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14001c6d8
mov r13, rax
cmp rax, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb r13, rax
lea rcx, [r13 + 1]
test rcx, rcx
jne 0x14001c6b4
xor eax, eax
jmp 0x14001c6d8
cmp rcx, 0x1000
jb 0x14001c6d3
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001cdeb
jmp 0x14001c679
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012edb0
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x110], rbx
mov qword [rbp + 0x118], r13
lea r8, [rbx + 1]
mov rdx, rdi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x158], xmm0
xor r13d, r13d
mov qword [rbp + 0x168], r13
mov edx, reloc.WS2_32.dll_ntohl
lea rcx, [rbp + 0x158]
call fcn.1400065b0
lea rax, [rbp + 0x158]
mov qword [rbp + 0x120], rax
lea rdi, [rsp + 0x60]
xorps xmm0, xmm0
movups xmmword [rbp + 0x170], xmm0
mov rbx, qword [rbp + 0x158]
mov qword [rbp + 0x170], rbx
mov qword [rbp + 0x178], rbx
lea rax, [rbp + 0x158]
mov qword [rbp + 0x180], rax
mov rdx, rdi
mov rcx, rbx
call fcn.140004f10
add rbx, 0x20
mov qword [rbp + 0x178], rbx
add rdi, 0x20
lea rax, [rbp + 0x120]
cmp rdi, rax
jne 0x14001c763
lea r8, [rbp + 0x158]
mov rdx, rbx
mov rcx, rbx
call fcn.140005dc0
mov qword [rbp + 0x160], rbx
lea r9, [fcn.1400027b0]
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov r8d, reloc.WS2_32.dll_ntohl
lea rcx, [rsp + 0x60]
call fcn.14012f188
mov rdi, qword [rbp + 0x160]
mov rbx, qword [rbp + 0x158]
cmp rbx, rdi
je 0x14001c855
mov rdx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14001c7e2
mov rdx, qword [rbx]
lea rax, [rbp + 0x128]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x370]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14001c84c
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x128]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x130]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rbx, 0x20
cmp rbx, rdi
jne 0x14001c7d5
lea rcx, [rbp + 0x158]
call fcn.140005030
nop
cmp r14, 0xf
jbe 0x14001c89d
lea rdx, [r14 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14001c894
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001c894
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14012edf4
nop
cmp r12, 0xf
jbe 0x14001c8d9
lea rdx, [r12 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x14001c8d0
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001c8d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.14012edf4
nop
mov rax, qword [rbp + 0x208]
cmp rax, 0xf
jbe 0x14001c91f
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x1f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c919
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001c919
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012edf4
nop
mov rax, qword [rbp + 0x228]
cmp rax, 0xf
jbe 0x14001c965
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x210]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c95f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001c95f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012edf4
nop
mov rax, qword [rbp + 0x248]
cmp rax, 0xf
jbe 0x14001c9ab
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x230]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c9a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001c9a5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012edf4
nop
mov rax, qword [rbp + 0x268]
cmp rax, 0xf
jbe 0x14001c9f1
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x250]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c9eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001c9eb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012edf4
nop
mov rax, qword [rbp + 0x288]
cmp rax, 0xf
jbe 0x14001ca37
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x270]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ca31
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001ca31
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012edf4
nop
mov rax, qword [rbp + 0x2a8]
cmp rax, 0xf
jbe 0x14001ca7d
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x290]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ca77
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001ca77
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012edf4
nop
mov rax, qword [rbp + 0x2c8]
cmp rax, 0xf
jbe 0x14001cac3
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x2b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cabd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001cabd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012edf4
nop
mov rax, qword [rbp + 0x2e8]
cmp rax, 0xf
jbe 0x14001cb09
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x2d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cb03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001cb03
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012edf4
nop
mov rax, qword [rbp + 0x308]
cmp rax, 0xf
jbe 0x14001cb4f
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x2f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cb49
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001cb49
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012edf4
nop
mov rax, qword [rbp + 0x328]
cmp rax, 0xf
jbe 0x14001cb95
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x310]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cb8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001cb8f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012edf4
nop
mov rax, qword [rbp + 0x348]
cmp rax, 0xf
jbe 0x14001cbdb
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x330]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cbd5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001cbd5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012edf4
nop
mov rax, qword [rbp + 0x368]
cmp rax, 0xf
jbe 0x14001cc20
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x350]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cc1b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001cc1b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012edf4
xor r12d, r12d
xorps xmm0, xmm0
movups xmmword [rbp + 0x190], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1a0], xmm1
mov r8d, reloc.WLDAP32.dll_Ordinal_26
lea rdx, str.taskkill__F__IM_HD_Adb.exe
lea rcx, [rbp + 0x190]
call fcn.1400028e0
lea rdx, [rbp + 0x190]
cmp qword [rbp + 0x1a8], 0xf
cmova rdx, qword [rbp + 0x190]
lea rax, [rbp + 0x140]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x370]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x14001ccd2
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x140]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
mov r8d, 0x10001
lea rcx, str.SYSTEMA
call qword [sym.imp.WINMM.dll_PlaySoundA]
mov byte [0x140204d64], 0
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 0xf
jbe 0x14001cd32
inc rdx
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001cd2d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001cd2d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14012edf4
movdqa xmm0, xmmword [0x1401a9200]
movdqu xmmword [rbp + 0x1a0], xmm0
mov byte [rbp + 0x190], 0
lea r9, [fcn.1400027b0]
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov r8d, 8
lea rcx, [rbp + 0x3e0]
call fcn.14012f188
mov rcx, qword [rbp + 0x4f8]
xor rcx, rsp
call fcn.14012ed90
lea r11, [rsp + 0x600]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140002600
nop
call fcn.140002560
nop
call fcn.140002560
nop
call fcn.140002560
nop
call fcn.140002560
nop
call fcn.140002560
nop
call fcn.140002560
nop
call fcn.140002560
nop
call fcn.140002560
nop
call fcn.140002560
nop
call fcn.140002560
nop
call fcn.140002560
nop
call fcn.140002560
nop
call fcn.140002560
nop
call fcn.140002560
nop
call fcn.140002600
nop
call fcn.140002600
nop
call fcn.140002600
nop
call fcn.140002600
nop
call fcn.140002600
nop
call fcn.140002600
nop
call fcn.140002600
nop
call fcn.140002600
nop
call fcn.140002600
nop
call fcn.140002600
nop
call fcn.140002600
nop
call fcn.140002600
nop
call fcn.140002600
nop
call fcn.140002600
nop
call fcn.140002600
nop
call fcn.140002600
nop
call fcn.140002600
nop
call fcn.140002600
nop
call fcn.140002600
nop
call fcn.140002600
nop
call fcn.140002600
nop
call fcn.140002600
nop
call fcn.140002600
nop
call fcn.140002600
nop
call fcn.140002600
nop
call fcn.140002600
nop
call fcn.140002600
nop
call fcn.140002600
int3