Function at 0x140017850
Capabilities:
Enumerate gui resources
Enumerate processes
Shutdown system
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x18], rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x24b0
call fcn.1400a7fb0
sub rsp, rax
mov rax, qword [0x1400d8708]
xor rax, rsp
mov qword [rsp + 0x24a0], rax
mov r15, rdx
mov r14d, ecx
xor r12d, r12d
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
mov dword [rsp + 0x16b0], r12d
lea rdx, [rsp + 0x16b0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleMode]
test eax, eax
je 0x1400178d0
mov edx, dword [rsp + 0x16b0]
or edx, 4
mov dword [rsp + 0x16b0], edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleMode]
lea rcx, [rsp + 0x1610]
call fcn.140006f60
nop
mov rdx, rax
lea rcx, [rsp + 0x1640]
call qword [sym.imp.MSVCP140.dll_public:_static_class_std::locale___cdecl_std::locale::global_class_std::locale_const____ptr64_]
mov rcx, qword [rsp + 0x1648]
test rcx, rcx
je 0x140017919
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
test rax, rax
je 0x140017919
mov rcx, qword [rax]
mov r8, qword [rcx]
mov edx, 1
mov rcx, rax
call r8
nop
mov rcx, qword [rsp + 0x1618]
test rcx, rcx
je 0x140017942
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
test rax, rax
je 0x140017942
mov rcx, qword [rax]
mov r8, qword [rcx]
mov edx, 1
mov rcx, rax
call r8
mov rdx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
mov rax, qword [rdx]
movsxd rbx, dword [rax + 4]
add rbx, rdx
mov cl, 1
call qword [sym.imp.MSVCP140.dll_private:_static_class_std::locale::_Locimp____ptr64___cdecl_std::locale::_Init_bool_]
mov qword [rsp + 0x1618], rax
lea r8, [rsp + 0x1610]
lea rdx, [rsp + 0x1640]
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::locale___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::imbue_class_std::locale_const____ptr64____ptr64]
mov rcx, qword [rsp + 0x1648]
test rcx, rcx
je 0x1400179a6
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
test rax, rax
je 0x1400179a6
mov rcx, qword [rax]
mov r8, qword [rcx]
mov edx, 1
mov rcx, rax
call r8
nop
mov rcx, qword [rsp + 0x1618]
test rcx, rcx
je 0x1400179cf
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
test rax, rax
je 0x1400179cf
mov rcx, qword [rax]
mov r8, qword [rcx]
mov edx, 1
mov rcx, rax
call r8
lea rdx, [0x14002bea0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, str._n_n_n________
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14002bcc0
lea rdx, [0x14002bed0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [0x1400c0620]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14002bcc0
lea rdx, [0x14002bed0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [0x1400c06e0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14002bcc0
lea rdx, [0x14002bed0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [0x1400c07a0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14002bcc0
lea rdx, [0x14002bed0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [0x1400c0860]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14002bcc0
lea rdx, [0x14002bed0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [0x1400c0920]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.14002bcc0
lea rdx, [0x14002bed0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [0x14002bf10]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
lea rdx, [0x14002bed0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140017ba1
lea rdx, str.Error_ID:__45645067398547346_
lea rcx, [rsp + 0x15c0]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x1538]
mov edx, Ordinal_41
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea r8, [rsp + 0x1604]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [rsp + 0x1600], 1
mov dword [rsp + 0x160c], 2
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rsp + 0x1600]
xor edx, edx
mov rcx, qword [rsp + 0x1538]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor edx, edx
lea ecx, [rdx + 0xc]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.1400121d0
test al, al
jne 0x140017beb
lea rdx, str.Error_ID:__54352342342345345_
lea rcx, [rsp + 0x15c0]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov qword [rsp + 0x1598], r12
mov ecx, reloc.WS2_32.dll_recv
call fcn.1400a7918
mov qword [rsp + 0x1670], rax
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov dword [rax], r12d
mov qword [rax + 8], r12
mov qword [rsp + 0x1598], rax
xor edx, edx
mov r8d, 0x110
lea rcx, [rsp + 0x1e70]
call sub.VCRUNTIME140.dll_memset
lea rdx, str.config.yml
lea rcx, [rsp + 0x1e70]
call fcn.140025920
nop
cmp qword [rsp + 0x1f00], 0
je 0x14001d063
xor edx, edx
lea r8d, [rdx + 2]
lea rcx, [rsp + 0x1e70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int____ptr64]
lea rdx, [rsp + 0x1620]
lea rcx, [rsp + 0x1e70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::fpos_struct__Mbstatet____cdecl_std::basic_istream_char__struct_std::char_traits_char__::tellg_void____ptr64]
mov rbx, qword [rax + 8]
add rbx, qword [rax]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x1e70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int____ptr64]
mov rcx, rbx
call fcn.1400a7ca8
mov rdi, rax
mov qword [rsp + 0x1670], rax
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x1e70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::read_char____ptr64__long_long___int64_____ptr64]
lea rcx, [rsp + 0x1e80]
call fcn.140025bb0
test rax, rax
jne 0x140017cf4
mov rax, qword [rsp + 0x1e70]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x1e70]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov r8, rbx
mov rdx, rdi
lea rcx, [rsp + 0x1598]
call fcn.140048190
nop
mov rcx, rdi
call fcn.1400a77f0
nop
lea rcx, [rsp + 0x1e70]
call fcn.140017730
nop
lea rdx, [rsp + 0x1598]
lea rcx, [rsp + 0x2050]
call fcn.14001d330
nop
lea rdx, [rsp + 0x2078]
lea rcx, [rsp + 0x1a90]
call fcn.14001d120
nop
call fcn.1400121d0
lea rcx, [rsp + 0x15c0]
test al, al
jne 0x140017d95
lea rdx, str.Error_ID:__54352342342345345_
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp byte [rsp + 0x2050], 0
jne 0x140017ddd
lea r8, [rsp + 0x2058]
lea rdx, str.Config_is_invalid.
call fcn.14002aed0
nop
mov rdx, rax
mov ecx, 3
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
nop
mov ecx, 0x98967f
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140017dd0
lea rdx, str.Loaded_config.yml
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
mov ecx, 1
call fcn.14000dc40
nop
mov rdx, qword [rsp + 0x15d8]
cmp rdx, 0x10
jb 0x140017e43
inc rdx
mov rcx, qword [rsp + 0x15c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017e3e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140017e3e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a77f0
lea r8, [rsp + 0x20d8]
lea rdx, str.Config:
lea rcx, [rsp + 0x15c0]
call fcn.14002aed0
nop
mov rdx, rax
mov ecx, 4
call fcn.14000dc40
nop
mov rdx, qword [rsp + 0x15d8]
cmp rdx, 0x10
jb 0x140017eb4
inc rdx
mov rcx, qword [rsp + 0x15c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140017eaf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140017eaf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a77f0
lea rdx, [rsp + 0x1a90]
lea rcx, [rsp + 0x1e70]
call fcn.14001d120
mov rdx, rax
lea rcx, [rsp + 0x1c70]
call fcn.1400153c0
nop
cmp byte [rsp + 0x1c70], 0
jmp 0x140017f2d
lea rdx, [rsp + 0x1c78]
mov ecx, 1
call fcn.14000dc40
lea rdx, str.https:__joshplays05.pythonanywhere.com_version
lea rcx, [rsp + 0x1828]
call fcn.1400247c0
nop
lea rcx, [rsp + 0x1718]
call fcn.14000aa40
mov edx, 6
lea rcx, [rsp + 0x18f0]
call fcn.1400072d0
nop
mov r8, rax
lea rcx, [rsp + 0x1a20]
call fcn.14002b760
nop
lea rax, [rsp + 0x1a20]
mov qword [rsp + 0x1610], rax
lea rax, [rsp + 0x1a60]
mov qword [rsp + 0x1618], rax
movaps xmm0, xmmword [rsp + 0x1610]
movdqa xmmword [rsp + 0x1640], xmm0
lea rdx, [rsp + 0x1640]
lea rcx, [rsp + 0x1718]
call fcn.140021cf0
nop
lea r9, [fcn.1400152f0]
mov edx, 0x40
lea r8d, [rdx - 0x3f]
lea rcx, [rsp + 0x1a20]
call fcn.1400a7954
nop
lea rcx, [rsp + 0x18f0]
call fcn.1400245c0
call fcn.1400121d0
test al, al
jne 0x140018041
lea rdx, str.Error_ID:__54352342342345345_
lea rcx, [rsp + 0x15c0]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea r8, [rsp + 0x1718]
lea rdx, [rsp + 0x1828]
lea rcx, [rsp + 0x1868]
call fcn.140011870
nop
cmp byte [rsp + 0x1c70], 0
je 0x140018ce9
cmp dword [rsp + 0x1868], 0xc8
jne 0x14001d057
lea rdx, [rsp + 0x1870]
lea rcx, [rsp + 0x15c0]
call fcn.140024800
nop
mov qword [rsp + 0x1a58], r12
lea r8, [rsp + 0x1a20]
lea rdx, [rsp + 0x15c0]
lea rcx, [rsp + 0x1600]
call fcn.14002b7e0
nop
lea rdx, str.message
lea rcx, [rsp + 0x1600]
call fcn.14002b900
mov rcx, rax
call fcn.14002ba20
cmp dword [rsp + 0x1868], 0x1aa
je 0x14001d04b
lea rdx, str.forced
lea rcx, [rsp + 0x1600]
call fcn.14002b900
mov rcx, rax
call fcn.14002bb30
test al, al
jne 0x14001d04b
cmp dword [rsp + 0x1868], 0xc8
jne 0x14001d04b
lea rcx, [rsp + 0x1600]
call fcn.1400153a0
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
lea rdx, str.your_token_here
lea rcx, [rsp + 0x1a90]
call fcn.1400275a0
test al, al
jne 0x14001d057
lea rdx, [0x1400bf45a]
lea rcx, [rsp + 0x1a90]
call fcn.1400275a0
test al, al
jne 0x14001d057
cmp byte [rsp + 0x1c70], al
je 0x140018ce9
lea rcx, [rsp + 0x17b8]
call fcn.140010c10
nop
lea rdx, str.FAILURE
lea rcx, [rsp + 0x17b8]
call fcn.14002ae40
test al, al
je 0x1400181b9
cmp byte [rsp + 0x1c70], 0
je 0x140018cdb
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, [rsp + 0x1670]
lea rcx, [rsp + 0x17b8]
call fcn.1400240a0
mov r8, qword [rax]
lea rdx, [rsp + 0x1538]
lea rcx, [rsp + 0x17b8]
call fcn.1400240c0
mov rdx, qword [rax]
lea rcx, [rsp + 0x1798]
call fcn.14002afb0
nop
lea r8, [rsp + 0x1798]
lea rdx, str.Getting_hwid_number:
lea rcx, [rsp + 0x15c0]
call fcn.14002aed0
nop
mov rdx, rax
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
lea rcx, [rsp + 0x16e8]
call fcn.14000aa40
lea rcx, [rsp + 0x16e8]
call fcn.14000d810
nop
mov dword [rsp + 0x2490], 0x3020100
mov dword [rsp + 0x2494], 0x7060504
mov dword [rsp + 0x2498], 0xb0a0908
mov dword [rsp + 0x249c], 0xf0e0d0c
mov edx, dword [rsp + 0x17a8]
mov eax, edx
and eax, 0xf
sub edx, eax
add edx, 0x10
lea rcx, [rsp + 0x16d0]
call fcn.14000aa40
lea rcx, [rsp + 0x16d0]
call fcn.1400230e0
nop
mov r9, qword [rsp + 0x16d8]
mov rdx, qword [rsp + 0x16d0]
sub r9, rdx
mov r10, qword [rsp + 0x16f0]
mov r8, qword [rsp + 0x16e8]
sub r10, r8
lea rcx, [rsp + 0x1798]
call fcn.1400244a0
mov dword [rsp + 0x30], r9d
mov qword [rsp + 0x28], rdx
lea rcx, [rsp + 0x2490]
mov qword [rsp + 0x20], rcx
mov r9d, r10d
mov edx, dword [rsp + 0x17a8]
mov rcx, rax
call fcn.14000d870
lea rdx, [0x1400bf45a]
lea rcx, [rsp + 0x1808]
call fcn.1400247c0
nop
mov rdi, qword [rsp + 0x16d0]
mov rsi, qword [rsp + 0x16d8]
cmp rdi, rsi
je 0x140018396
nop dword [rax + rax]
movzx ebx, byte [rdi]
mov edx, ebx
lea rcx, [rsp + 0x15c0]
call fcn.1400072d0
nop
mov rdx, rax
lea rcx, [rsp + 0x1808]
call fcn.140024550
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
mov rcx, qword [rsp + 0x16d8]
mov rax, qword [rsp + 0x16d0]
sub rcx, rax
cmp bl, byte [rax + rcx - 1]
je 0x14001838e
lea rdx, [0x1400bf9a0]
lea rcx, [rsp + 0x1808]
call fcn.140024530
inc rdi
cmp rdi, rsi
jne 0x140018330
lea rdx, str.https:__joshplays05.pythonanywhere.com_
lea rcx, [rsp + 0x18d0]
call fcn.1400247c0
nop
lea rcx, [rsp + 0x1780]
call fcn.14000aa40
lea rcx, [rsp + 0x15c0]
call fcn.14002b0f0
nop
lea rax, [rsp + 0x15c0]
mov qword [rsp + 0x1610], rax
lea rax, [rsp + 0x1600]
mov qword [rsp + 0x1618], rax
movaps xmm0, xmmword [rsp + 0x1610]
movdqa xmmword [rsp + 0x1640], xmm0
lea rdx, [rsp + 0x1640]
lea rcx, [rsp + 0x1780]
call fcn.140021cf0
nop
lea r9, [fcn.1400152f0]
mov edx, 0x40
lea r8d, [rdx - 0x3f]
lea rcx, [rsp + 0x15c0]
call fcn.1400a7954
lea rcx, [rsp + 0x48]
call fcn.14002bb90
nop
lea rdx, [rsp + 0x1a90]
lea rcx, [rsp + 0x60]
call fcn.14002bc60
nop
lea rax, [rsp + 0x48]
mov qword [rsp + 0x1610], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x1618], rax
movaps xmm0, xmmword [rsp + 0x1610]
movdqa xmmword [rsp + 0x1640], xmm0
lea rdx, [rsp + 0x1640]
lea rcx, [rsp + 0x1a20]
call fcn.140021c10
nop
lea rdx, str.hardware_id
lea rcx, [rsp + 0x78]
call fcn.14002b160
nop
lea rdx, [rsp + 0x1808]
lea rcx, [rsp + 0x90]
call fcn.14002bc60
nop
lea rax, [rsp + 0x78]
mov qword [rsp + 0x1610], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x1618], rax
movaps xmm0, xmmword [rsp + 0x1610]
movdqa xmmword [rsp + 0x1640], xmm0
lea rdx, [rsp + 0x1640]
lea rcx, [rsp + 0x1a38]
call fcn.140021c10
nop
lea rax, [rsp + 0x1a20]
mov qword [rsp + 0x1610], rax
lea rax, [rsp + 0x1a50]
mov qword [rsp + 0x1618], rax
movaps xmm0, xmmword [rsp + 0x1610]
movdqa xmmword [rsp + 0x1640], xmm0
mov r8b, 1
lea rdx, [rsp + 0x1640]
lea rcx, [rsp + 0x1688]
call fcn.140022e30
nop
lea r9, [fcn.1400153a0]
mov edx, Ordinal_27
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x1a20]
call fcn.1400a7954
nop
lea r9, [fcn.1400153a0]
mov edx, Ordinal_27
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x78]
call fcn.1400a7954
nop
lea r9, [fcn.1400153a0]
mov edx, Ordinal_27
lea r8d, [rdx - 0x16]
lea rcx, [rsp + 0x48]
call fcn.1400a7954
lea rdx, [rsp + 0x18b0]
lea rcx, [rsp + 0x1688]
call fcn.140022b50
nop
call fcn.1400121d0
test al, al
jne 0x1400185f2
lea rdx, str.Error_ID:__54352342342345345_
lea rcx, [rsp + 0x15c0]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea r9, [rsp + 0x1780]
lea r8, [rsp + 0x18b0]
lea rdx, [rsp + 0x18d0]
lea rcx, [rsp + 0x1990]
call fcn.140011d10
nop
cmp dword [rsp + 0x1990], 0xc8
je 0x14001d042
lea rdx, [rsp + 0x1998]
lea rcx, [rsp + 0x15c0]
call fcn.140024800
nop
mov qword [rsp + 0x1a58], r12
lea r8, [rsp + 0x1a20]
lea rdx, [rsp + 0x15c0]
lea rcx, [rsp + 0x1640]
call fcn.14002b7e0
lea rcx, [rsp + 0x1640]
call fcn.1400153a0
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
cmp dword [rsp + 0x1990], 0xc8
je 0x14001d042
cmp byte [rsp + 0x1be4], 0
je 0x14001882a
call fcn.1400121d0
test al, al
jne 0x1400186e8
lea rdx, str.Error_ID:__54352342342345345_
lea rcx, [rsp + 0x15c0]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
lea rcx, [rsp + 0x15c0]
test eax, eax
je 0x1400187b0
lea rdx, str.Error_ID:__456450656467398547346_
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x1538]
mov edx, Ordinal_41
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea r8, [rsp + 0x1604]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [rsp + 0x1600], 1
mov dword [rsp + 0x160c], 2
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rsp + 0x1600]
xor edx, edx
mov rcx, qword [rsp + 0x1538]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor edx, edx
lea ecx, [rdx + 0xc]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.Starting_Clean_Files_thread
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
mov ecx, 1
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
nop
lea rax, [0x14000fc90]
mov qword [rsp + 0x1538], rax
lea r8, [rsp + 0x1a90]
lea rdx, [rsp + 0x1538]
lea rcx, [rsp + 0x1610]
call fcn.14002bf40
nop
lea rcx, [rsp + 0x1610]
call fcn.14000af20
nop
cmp dword [rsp + 0x1618], 0
je 0x14001882a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
cmp byte [rsp + 0x1c18], 0
jne 0x140018842
cmp byte [rsp + 0x1c40], 0
je 0x1400189ce
call fcn.1400121d0
test al, al
jne 0x14001888c
lea rdx, str.Error_ID:__54352342342345345_
lea rcx, [rsp + 0x15c0]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
lea rcx, [rsp + 0x15c0]
test eax, eax
je 0x140018954
lea rdx, str.Error_ID:__4564598547346_
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x1538]
mov edx, Ordinal_41
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea r8, [rsp + 0x1604]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [rsp + 0x1600], 1
mov dword [rsp + 0x160c], 2
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rsp + 0x1600]
xor edx, edx
mov rcx, qword [rsp + 0x1538]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor edx, edx
lea ecx, [rdx + 0xc]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.Starting_Statistics_thread
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
mov ecx, 1
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
nop
lea rax, [0x1400127f0]
mov qword [rsp + 0x1538], rax
lea r8, [rsp + 0x1a90]
lea rdx, [rsp + 0x1538]
lea rcx, [rsp + 0x1610]
call fcn.14002bf40
nop
lea rcx, [rsp + 0x1610]
call fcn.14000af20
nop
cmp dword [rsp + 0x1618], 0
je 0x1400189ce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
cmp r14d, 1
jge 0x140018af3
lea rdx, str.Error:_Unable_to_get_the_current_executable_path.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14002a6b0
lea rdx, [0x14002bc80]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
lea rcx, [rsp + 0x1990]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x18b0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1688]
call fcn.1400153a0
nop
lea rcx, [rsp + 0x1780]
call fcn.140025a30
nop
lea rcx, [rsp + 0x18d0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1808]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x16d0]
call fcn.140023080
nop
lea rcx, [rsp + 0x16e8]
call fcn.140023080
nop
lea rcx, [rsp + 0x1798]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x17b8]
call fcn.14000b3c0
nop
lea rcx, [rsp + 0x1868]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x1718]
call fcn.140025a30
nop
lea rcx, [rsp + 0x1828]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1c70]
call fcn.140017390
nop
lea rcx, [rsp + 0x1a90]
call fcn.14000e5a0
nop
lea rcx, [rsp + 0x2050]
call fcn.140017390
nop
lea rcx, [rsp + 0x1598]
call fcn.140045a00
mov eax, 1
jmp 0x140018d4c
mov rdx, qword [r15]
lea rcx, [rsp + 0x19b8]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x19b8]
lea rcx, [rsp + 0x1950]
call fcn.140017400
nop
lea rcx, [rsp + 0x1930]
call fcn.140010c10
nop
lea rdx, str.FAILURE
lea rcx, [rsp + 0x1930]
call fcn.14002ae40
test al, al
je 0x140018b4c
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, [rsp + 0x1670]
lea rcx, [rsp + 0x1930]
call fcn.1400240a0
mov r8, qword [rax]
lea rdx, [rsp + 0x1538]
lea rcx, [rsp + 0x1930]
call fcn.1400240c0
mov rdx, qword [rax]
lea rcx, [rsp + 0x1848]
call fcn.14002afb0
nop
lea r8, [rsp + 0x1848]
lea rdx, str.Getting_hwid_number_2:
lea rcx, [rsp + 0x15c0]
call fcn.14002aed0
nop
mov rdx, rax
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
lea rcx, [rsp + 0x17f0]
call fcn.14000aa40
lea rcx, [rsp + 0x17f0]
call fcn.14000d810
nop
mov dword [rsp + 0x2490], 0x3020100
mov dword [rsp + 0x2494], 0x7060504
mov dword [rsp + 0x2498], 0xb0a0908
mov dword [rsp + 0x249c], 0xf0e0d0c
cmp byte [rsp + 0x1c70], 0
jne 0x140018d79
lea rcx, [rsp + 0x17f0]
call fcn.140023080
nop
lea rcx, [rsp + 0x1848]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1930]
call fcn.14000b3c0
nop
lea rcx, [rsp + 0x1950]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x19b8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1990]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x18b0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1688]
call fcn.1400153a0
nop
lea rcx, [rsp + 0x1780]
call fcn.140025a30
nop
lea rcx, [rsp + 0x18d0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1808]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x16d0]
call fcn.140023080
nop
lea rcx, [rsp + 0x16e8]
call fcn.140023080
nop
lea rcx, [rsp + 0x1798]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x17b8]
call fcn.14000b3c0
nop
lea rcx, [rsp + 0x1868]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x1718]
call fcn.140025a30
nop
lea rcx, [rsp + 0x1828]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1c70]
call fcn.140017390
nop
lea rcx, [rsp + 0x1a90]
call fcn.14000e5a0
nop
lea rcx, [rsp + 0x2050]
call fcn.140017390
nop
lea rcx, [rsp + 0x1598]
call fcn.140045a00
xor eax, eax
mov rcx, qword [rsp + 0x24a0]
xor rcx, rsp
call fcn.1400a77d0
lea r11, [rsp + 0x24b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov edx, dword [rsp + 0x1858]
mov eax, edx
and eax, 0xf
sub edx, eax
add edx, 0x10
lea rcx, [rsp + 0x1700]
call fcn.14000aa40
lea rcx, [rsp + 0x1700]
call fcn.1400230e0
nop
mov r10, qword [rsp + 0x1708]
mov rdx, qword [rsp + 0x1700]
sub r10, rdx
mov r9, qword [rsp + 0x16f0]
mov r8, qword [rsp + 0x16e8]
sub r9, r8
lea rcx, [rsp + 0x1848]
call fcn.1400244a0
mov dword [rsp + 0x30], r10d
mov qword [rsp + 0x28], rdx
lea rcx, [rsp + 0x2490]
mov qword [rsp + 0x20], rcx
mov edx, dword [rsp + 0x1858]
mov rcx, rax
call fcn.14000d870
lea rdx, [0x1400bf45a]
lea rcx, [rsp + 0x1890]
call fcn.1400247c0
nop
mov rdi, qword [rsp + 0x1700]
mov rsi, qword [rsp + 0x1708]
cmp rdi, rsi
je 0x140018e96
nop dword [rax + rax]
movzx ebx, byte [rdi]
mov edx, ebx
lea rcx, [rsp + 0x15c0]
call fcn.1400072d0
nop
mov rdx, rax
lea rcx, [rsp + 0x1890]
call fcn.140024550
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
mov rcx, qword [rsp + 0x1708]
mov rax, qword [rsp + 0x1700]
sub rcx, rax
cmp bl, byte [rax + rcx - 1]
je 0x140018e8e
lea rdx, [0x1400bf9a0]
lea rcx, [rsp + 0x1890]
call fcn.140024530
inc rdi
cmp rdi, rsi
jne 0x140018e30
lea r8, [rsp + 0x1890]
lea rdx, str.Getting_hwid_number_encrypt_2:
lea rcx, [rsp + 0x15c0]
call fcn.14002aed0
nop
mov rdx, rax
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
mov edx, 6
lea rcx, [rsp + 0x19f8]
call fcn.1400072d0
nop
lea rcx, [rsp + 0x17d8]
call fcn.14000aa40
lea r8, [rsp + 0x19f8]
lea rcx, [rsp + 0x1e70]
call fcn.14002bff0
nop
lea r8, [rsp + 0x1a90]
lea rcx, [rsp + 0x1eb0]
call fcn.14002c050
nop
lea r8, [rsp + 0x1890]
lea rcx, [rsp + 0x1ef0]
call fcn.14002c0b0
nop
lea r8, [rsp + 0x1950]
lea rcx, [rsp + 0x1f30]
call fcn.14002c110
nop
lea rax, [rsp + 0x1e70]
mov qword [rsp + 0x1610], rax
lea rax, [rsp + 0x1f70]
mov qword [rsp + 0x1618], rax
movaps xmm0, xmmword [rsp + 0x1610]
movdqa xmmword [rsp + 0x1640], xmm0
lea rdx, [rsp + 0x1640]
lea rcx, [rsp + 0x17d8]
call fcn.140021cf0
nop
lea r9, [fcn.1400152f0]
mov edx, 0x40
lea r8d, [rdx - 0x3c]
lea rcx, [rsp + 0x1e70]
call fcn.1400a7954
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140019072
lea rdx, str.Error_ID:__4567398547346_
lea rcx, [rsp + 0x15c0]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x1538]
mov edx, Ordinal_41
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea r8, [rsp + 0x1604]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [rsp + 0x1600], 1
mov dword [rsp + 0x160c], 2
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rsp + 0x1600]
xor edx, edx
mov rcx, qword [rsp + 0x1538]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor edx, edx
lea ecx, [rdx + 0xc]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.1400121d0
lea rcx, [rsp + 0x15c0]
test al, al
jne 0x1400190bc
lea rdx, str.Error_ID:__54352342342345345_
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea r8, [rsp + 0x1950]
lea rdx, str.Current_exe_hash:
call fcn.14002aed0
nop
mov rdx, rax
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
lea rdx, str.https:__joshplays05.pythonanywhere.com_test
lea rcx, [rsp + 0x19d8]
call fcn.1400247c0
nop
lea r8, [rsp + 0x17d8]
lea rdx, [rsp + 0x19d8]
lea rcx, [rsp + 0x1570]
call fcn.140011870
nop
mov edx, dword [rsp + 0x1570]
lea rcx, [rsp + 0x18f0]
call fcn.1400072d0
nop
mov r8, rax
lea rdx, str._test_Status_code:
lea rcx, [rsp + 0x15c0]
call fcn.14002af40
nop
mov rdx, rax
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x18f0]
call fcn.1400245c0
cmp dword [rsp + 0x1570], 0x193
jmp 0x14001918e
lea rcx, [rsp + 0x1660]
call fcn.14000eb50
lea rcx, [rsp + 0x1660]
call fcn.140021b80
nop
lea rcx, [rsp + 0x1678]
call fcn.14000eb50
lea rcx, [rsp + 0x1678]
call fcn.140021b80
nop
lea rcx, [rsp + 0x1760]
call fcn.14000aa40
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x1760], xmm0
mov qword [rsp + 0x1770], r12
lea rdx, [0x1400bf45a]
lea rcx, [rsp + 0x1970]
call fcn.1400247c0
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, 0x1388
mov qword [rsp + 0x40], rax
lea rcx, [rsp + 0x1748]
call fcn.14000aa40
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x1748], xmm0
mov qword [rsp + 0x1758], r12
lea rcx, [rsp + 0x1730]
call fcn.14000aa40
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x1730], xmm0
mov qword [rsp + 0x1740], r12
mov r13b, 1
lea rcx, [rsp + 0x1698]
call fcn.14000aa40
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x1698], xmm0
mov qword [rsp + 0x16a8], r12
lea rsi, [0x140000000]
nop dword [rax + rax]
cmp byte [rsp + 0x1c70], 0
jne 0x14001947e
lea rcx, [rsp + 0x1698]
call fcn.140021700
nop
lea rcx, [rsp + 0x1730]
call fcn.140021700
nop
lea rcx, [rsp + 0x1748]
call fcn.140023540
nop
lea rcx, [rsp + 0x1970]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1760]
call fcn.140023540
nop
lea rcx, [rsp + 0x1678]
call fcn.14001d2b0
nop
lea rcx, [rsp + 0x1660]
call fcn.14001d2b0
nop
lea rcx, [rsp + 0x1570]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x19d8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x17d8]
call fcn.140025a30
nop
lea rcx, [rsp + 0x19f8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1890]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1700]
call fcn.140023080
nop
lea rcx, [rsp + 0x17f0]
call fcn.140023080
nop
lea rcx, [rsp + 0x1848]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1930]
call fcn.14000b3c0
nop
lea rcx, [rsp + 0x1950]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x19b8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1990]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x18b0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1688]
call fcn.1400153a0
nop
lea rcx, [rsp + 0x1780]
call fcn.140025a30
nop
lea rcx, [rsp + 0x18d0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1808]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x16d0]
call fcn.140023080
nop
lea rcx, [rsp + 0x16e8]
call fcn.140023080
nop
lea rcx, [rsp + 0x1798]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x17b8]
call fcn.14000b3c0
nop
lea rcx, [rsp + 0x1868]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x1718]
call fcn.140025a30
nop
lea rcx, [rsp + 0x1828]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1c70]
call fcn.140017390
nop
lea rcx, [rsp + 0x1a90]
call fcn.14000e5a0
nop
lea rcx, [rsp + 0x2050]
call fcn.140017390
nop
lea rcx, [rsp + 0x1598]
call fcn.140045a00
xor eax, eax
jmp 0x140018d4c
lea rdx, str.Start_loop
lea rcx, [rsp + 0x15c0]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
lea rcx, [rsp + 0x16b8]
call fcn.14000aa40
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x16b8], xmm0
mov qword [rsp + 0x16c8], r12
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov qword [rsp + 0x1548], rax
cmp rax, 0xffffffffffffffff
jne 0x140019530
lea rdx, str.Failed_to_create_snapshot.
lea rcx, [rsp + 0x15c0]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
lea ecx, [rdi + 4]
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
mov ecx, 0x98967f
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x140019523
mov dword [rsp + 0x2250], 0x238
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140019603
lea rdx, str.Error_ID:__56346436435634_
lea rcx, [rsp + 0x15c0]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x1538]
mov edx, Ordinal_41
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea r8, [rsp + 0x1604]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [rsp + 0x1600], 1
mov dword [rsp + 0x160c], 2
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rsp + 0x1600]
xor edx, edx
mov rcx, qword [rsp + 0x1538]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor edx, edx
lea ecx, [rdx + 0xc]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, [rsp + 0x2250]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x14001bc1d
lea rcx, [rsp + 0x1ab0]
call fcn.1400244a0
mov r9, 0xffffffffffffffff
inc r9
cmp byte [rax + r9], 0
jne 0x140019630
mov qword [rsp + 0x1670], r9
lea rcx, [rsp + 0x1ab0]
call fcn.1400244a0
mov r8, rax
lea rdx, [rsp + 0x1e70]
lea rcx, [rsp + 0x1670]
call fcn.14002ae20
lea rdx, [rsp + 0x227c]
lea rcx, [rsp + 0x1e70]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__wcsicmp]
test eax, eax
jne 0x14001aad1
mov eax, dword [rsp + 0x2258]
mov dword [rsp + 0x1530], eax
lea rdx, [rsp + 0x1530]
lea rcx, [rsp + 0x16b8]
call fcn.140023520
lea r8, [rsp + 0x1530]
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x1660]
call fcn.140021bc0
mov rcx, qword [rsp + 0x1660]
cmp qword [rax], rcx
je 0x14001ab2d
lea r8, [rsp + 0x1530]
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0x1678]
call fcn.140021bc0
mov rcx, qword [rsp + 0x1678]
cmp qword [rax], rcx
jne 0x14001ab2d
cmp byte [rsp + 0x1b38], 0
je 0x14001aad1
lea rdx, [rsp + 0x1530]
lea rcx, [rsp + 0x1660]
call fcn.140021a80
mov rbx, qword [rax]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
sub rax, rbx
movsxd rcx, dword [rsp + 0x1b3c]
cmp rax, rcx
jl 0x14001aad1
mov edx, dword [rsp + 0x1530]
lea rcx, [rsp + 0x1910]
call fcn.1400072d0
mov rbx, rax
lea r8, [rsp + 0x1ab0]
lea rdx, str.Lowering_affinity_and_priority_of
lea rcx, [rsp + 0x15a0]
call fcn.14002aed0
nop
lea r8, str._with_pid
mov rdx, rax
lea rcx, [rsp + 0x1620]
call fcn.14002a2c0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x15c0]
call fcn.14002a3a0
nop
mov rdx, rax
mov ecx, 1
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1620]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x15a0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1910]
call fcn.1400245c0
mov r8d, dword [rsp + 0x1530]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r15, rax
test rax, rax
jne 0x140019905
lea rdx, str.Failed_to_open_process.
lea rcx, [rsp + 0x15c0]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
lea ecx, [r15 + 3]
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14001aad1
lea rdx, str.Error_ID:__54365463456_
lea rcx, [rsp + 0x15c0]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
lea ecx, [r15 + 4]
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x1538]
lea edx, [r15 + 0x28]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea r8, [rsp + 0x1604]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [rsp + 0x1600], 1
mov dword [rsp + 0x160c], 2
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rsp + 0x1600]
xor edx, edx
mov rcx, qword [rsp + 0x1538]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor edx, edx
lea ecx, [rdx + 0xc]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
lea ecx, [r15 + 1]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.Opened_process.
lea rcx, [rsp + 0x1620]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x1620]
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x1620]
call fcn.1400245c0
mov r14, r12
lea rdx, str.neither
lea rcx, [rsp + 0x1af0]
call fcn.1400275a0
test al, al
je 0x140019985
mov rcx, qword [rsp + 0x1b40]
mov rdx, qword [rsp + 0x1b48]
cmp rcx, rdx
je 0x14001a556
nop
movsxd rax, dword [rcx]
bts r14, rax
add rcx, 4
cmp rcx, rdx
jne 0x140019970
jmp 0x14001a556
lea rdx, str.random
lea rcx, [rsp + 0x1af0]
call fcn.1400275a0
test al, al
je 0x140019a33
lea rcx, [rsp + 0x15a0]
call fcn.14000aa40
lea rdx, [rsp + 0x1b40]
lea rcx, [rsp + 0x15a0]
call fcn.1400235a0
nop
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
lea rcx, [rsp + 0x1a0]
call fcn.140021a30
mov r8, rax
mov rdx, qword [rsp + 0x15a8]
mov rcx, qword [rsp + 0x15a0]
call fcn.14002c170
mov eax, dword [rsp + 0x1b78]
test eax, eax
jle 0x140019a21
mov rcx, qword [rsp + 0x15a0]
mov edx, eax
nop word [rax + rax]
movsxd rax, dword [rcx]
bts r14, rax
lea rcx, [rcx + 4]
sub rdx, 1
jne 0x140019a10
lea rcx, [rsp + 0x15a0]
call fcn.140023540
jmp 0x14001a556
lea rdx, str.lowest_usage
lea rcx, [rsp + 0x1af0]
call fcn.1400275a0
test al, al
je 0x140019b91
lea rcx, [rsp + 0x1650]
call fcn.14000eb50
lea rax, [rsp + 0x1620]
mov qword [rsp + 0x1540], rax
lea rdx, [rsp + 0x1b40]
lea rcx, [rsp + 0x1620]
call fcn.1400235a0
mov rbx, rax
lea rdx, [rsp + 0x1a90]
lea rcx, [rsp + 0x1a0]
call fcn.14001d120
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x1650]
call fcn.14000df70
nop
lea rcx, [rsp + 0x15a0]
call fcn.14000aa40
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x15a0], xmm0
mov qword [rsp + 0x15b0], r12
mov rax, qword [rsp + 0x1650]
mov rax, qword [rax]
mov qword [rsp + 0x1540], rax
cmp byte [rax + 0x19], 0
jne 0x140019b28
mov ecx, dword [rax + 0x1c]
mov dword [rsp + 0xe8], ecx
mov ecx, dword [rax + 0x20]
mov dword [rsp + 0xec], ecx
lea rdx, [rsp + 0xe8]
lea rcx, [rsp + 0x15a0]
call fcn.1400216e0
lea rcx, [rsp + 0x1540]
call fcn.1400219c0
mov rax, qword [rsp + 0x1540]
jmp 0x140019ae2
mov rdx, qword [rsp + 0x15a8]
mov rcx, qword [rsp + 0x15a0]
call fcn.14002c2c0
mov eax, dword [rsp + 0x1b78]
test eax, eax
jle 0x140019b71
mov rcx, qword [rsp + 0x15a0]
mov edx, eax
nop dword [rax]
nop word [rax + rax]
movsxd rax, dword [rcx]
bts r14, rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x140019b60
lea rcx, [rsp + 0x15a0]
call fcn.140021700
nop
lea rcx, [rsp + 0x1650]
call fcn.14000eaf0
jmp 0x14001a556
lea rdx, str.instance_per_core
lea rcx, [rsp + 0x1b58]
call fcn.1400275a0
test al, al
je 0x14001a556
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x140019c75
lea rdx, str.Error_ID:__67445674574_
lea rcx, [rsp + 0x1620]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x1620]
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x1620]
call fcn.1400245c0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x1538]
mov edx, Ordinal_41
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea r8, [rsp + 0x1654]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [rsp + 0x1650], 1
mov dword [rsp + 0x165c], 2
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rsp + 0x1650]
xor edx, edx
mov rcx, qword [rsp + 0x1538]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor edx, edx
lea ecx, [rdx + 0xc]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
cmp byte [rsp + 0x1c70], 0
jne 0x140019e81
lea rcx, [rsp + 0x16b8]
call fcn.140023540
nop
lea rcx, [rsp + 0x1698]
call fcn.140021700
nop
lea rcx, [rsp + 0x1730]
call fcn.140021700
nop
lea rcx, [rsp + 0x1748]
call fcn.140023540
nop
lea rcx, [rsp + 0x1970]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1760]
call fcn.140023540
nop
lea rcx, [rsp + 0x1678]
call fcn.14001d2b0
nop
lea rcx, [rsp + 0x1660]
call fcn.14001d2b0
nop
lea rcx, [rsp + 0x1570]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x19d8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x17d8]
call fcn.140025a30
nop
lea rcx, [rsp + 0x19f8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1890]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1700]
call fcn.140023080
nop
lea rcx, [rsp + 0x17f0]
call fcn.140023080
nop
lea rcx, [rsp + 0x1848]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1930]
call fcn.14000b3c0
nop
lea rcx, [rsp + 0x1950]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x19b8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1990]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x18b0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1688]
call fcn.1400153a0
nop
lea rcx, [rsp + 0x1780]
call fcn.140025a30
nop
lea rcx, [rsp + 0x18d0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1808]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x16d0]
call fcn.140023080
nop
lea rcx, [rsp + 0x16e8]
call fcn.140023080
nop
lea rcx, [rsp + 0x1798]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x17b8]
call fcn.14000b3c0
nop
lea rcx, [rsp + 0x1868]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x1718]
call fcn.140025a30
nop
lea rcx, [rsp + 0x1828]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1c70]
call fcn.140017390
nop
lea rcx, [rsp + 0x1a90]
call fcn.14000e5a0
nop
lea rcx, [rsp + 0x2050]
call fcn.140017390
nop
lea rcx, [rsp + 0x1598]
call fcn.140045a00
xor eax, eax
jmp 0x140018d4c
lea rcx, [rsp + 0x15a0]
call fcn.14000aa40
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x15a0], xmm0
mov qword [rsp + 0x15b0], r12
test r13b, r13b
jne 0x14001a1b3
lea rcx, [rsp + 0x1600]
call fcn.14000eb50
lea rax, [rsp + 0x1620]
mov qword [rsp + 0x1910], rax
lea rdx, [rsp + 0x1b40]
lea rcx, [rsp + 0x1620]
call fcn.1400235a0
mov rbx, rax
lea rdx, [rsp + 0x1a90]
lea rcx, [rsp + 0x1a0]
call fcn.14001d120
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x1600]
call fcn.14000df70
nop
cmp byte [rsp + 0x1c70], r13b
jne 0x14001a132
lea rcx, [rsp + 0x1600]
call fcn.14000eaf0
nop
lea rcx, [rsp + 0x15a0]
call fcn.140021700
nop
lea rcx, [rsp + 0x16b8]
call fcn.140023540
nop
lea rcx, [rsp + 0x1698]
call fcn.140021700
nop
lea rcx, [rsp + 0x1730]
call fcn.140021700
nop
lea rcx, [rsp + 0x1748]
call fcn.140023540
nop
lea rcx, [rsp + 0x1970]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1760]
call fcn.140023540
nop
lea rcx, [rsp + 0x1678]
call fcn.14001d2b0
nop
lea rcx, [rsp + 0x1660]
call fcn.14001d2b0
nop
lea rcx, [rsp + 0x1570]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x19d8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x17d8]
call fcn.140025a30
nop
lea rcx, [rsp + 0x19f8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1890]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1700]
call fcn.140023080
nop
lea rcx, [rsp + 0x17f0]
call fcn.140023080
nop
lea rcx, [rsp + 0x1848]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1930]
call fcn.14000b3c0
nop
lea rcx, [rsp + 0x1950]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x19b8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1990]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x18b0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1688]
call fcn.1400153a0
nop
lea rcx, [rsp + 0x1780]
call fcn.140025a30
nop
lea rcx, [rsp + 0x18d0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1808]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x16d0]
call fcn.140023080
nop
lea rcx, [rsp + 0x16e8]
call fcn.140023080
nop
lea rcx, [rsp + 0x1798]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x17b8]
call fcn.14000b3c0
nop
lea rcx, [rsp + 0x1868]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x1718]
call fcn.140025a30
nop
lea rcx, [rsp + 0x1828]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1c70]
call fcn.140017390
nop
lea rcx, [rsp + 0x1a90]
call fcn.14000e5a0
nop
lea rcx, [rsp + 0x2050]
call fcn.140017390
nop
lea rcx, [rsp + 0x1598]
call fcn.140045a00
xor eax, eax
jmp 0x140018d4c
mov rax, qword [rsp + 0x1600]
mov rax, qword [rax]
mov qword [rsp + 0x1540], rax
cmp byte [rax + 0x19], 0
jne 0x14001a18b
mov ecx, dword [rax + 0x1c]
mov dword [rsp + 0xa8], ecx
mov ecx, dword [rax + 0x20]
mov dword [rsp + 0xac], ecx
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0x15a0]
call fcn.1400216e0
lea rcx, [rsp + 0x1540]
call fcn.1400219c0
mov rax, qword [rsp + 0x1540]
jmp 0x14001a145
mov rdx, qword [rsp + 0x15a8]
mov rcx, qword [rsp + 0x15a0]
call fcn.14002c2f0
nop
lea rcx, [rsp + 0x1600]
call fcn.14000eaf0
jmp 0x14001a285
mov rdi, qword [rsp + 0x1b40]
mov rsi, qword [rsp + 0x1b48]
cmp rdi, rsi
je 0x14001a261
mov ebx, dword [rdi]
mov ecx, r12d
mov r9, qword [rsp + 0x16a0]
mov r8, qword [rsp + 0x1698]
nop dword [rax]
nop word [rax + rax]
mov rax, r9
sub rax, r8
sar rax, 3
movsxd rdx, ecx
cmp rdx, rax
jae 0x14001a230
cmp dword [r8 + rdx*8], ebx
jne 0x14001a25d
mov dword [rsp + 0xf0], ebx
mov eax, dword [r8 + rdx*8 + 4]
mov dword [rsp + 0xf4], eax
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0x15a0]
call fcn.1400216e0
mov dword [rsp + 0xb0], ebx
mov dword [rsp + 0xb4], r12d
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x15a0]
call fcn.1400216e0
add rdi, 4
jmp 0x14001a1c3
inc ecx
jmp 0x14001a1f0
mov rdx, qword [rsp + 0x15a8]
mov rcx, qword [rsp + 0x15a0]
call fcn.14002c2f0
mov rdi, qword [rsp + 0x1548]
lea rsi, [0x140000000]
mov edx, r12d
mov r8, qword [rsp + 0x15a8]
mov rcx, qword [rsp + 0x15a0]
sub r8, rcx
sar r8, 3
test r8, r8
je 0x14001a337
mov r10d, dword [rsp + 0x1b78]
movsxd r9, dword [rcx]
cmp dword [rcx + 4], r10d
jl 0x14001a2c9
inc edx
add rcx, 8
movsxd rax, edx
cmp rax, r8
jb 0x14001a2b0
jmp 0x14001a337
mov r14, r12
bts r14, r9
test r13b, r13b
je 0x14001a337
mov edx, r12d
mov r8, qword [rsp + 0x16a0]
mov r10, qword [rsp + 0x1698]
sub r8, r10
sar r8, 3
test r8, r8
je 0x14001a30e
mov rcx, r10
cmp dword [rcx], r9d
je 0x14001a5da
inc edx
add rcx, 8
movsxd rax, edx
cmp rax, r8
jb 0x14001a2f7
mov dword [rsp + 0xd0], r9d
mov dword [rsp + 0xd4], 1
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x1698]
call fcn.1400216e0
nop
lea rcx, [rsp + 0x15a0]
cmp byte [rsp + 0x1c70], 0
jne 0x14001a551
call fcn.140021700
nop
lea rcx, [rsp + 0x16b8]
call fcn.140023540
nop
lea rcx, [rsp + 0x1698]
call fcn.140021700
nop
lea rcx, [rsp + 0x1730]
call fcn.140021700
nop
lea rcx, [rsp + 0x1748]
call fcn.140023540
nop
lea rcx, [rsp + 0x1970]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1760]
call fcn.140023540
nop
lea rcx, [rsp + 0x1678]
call fcn.14001d2b0
nop
lea rcx, [rsp + 0x1660]
call fcn.14001d2b0
nop
lea rcx, [rsp + 0x1570]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x19d8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x17d8]
call fcn.140025a30
nop
lea rcx, [rsp + 0x19f8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1890]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1700]
call fcn.140023080
nop
lea rcx, [rsp + 0x17f0]
call fcn.140023080
nop
lea rcx, [rsp + 0x1848]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1930]
call fcn.14000b3c0
nop
lea rcx, [rsp + 0x1950]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x19b8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1990]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x18b0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1688]
call fcn.1400153a0
nop
lea rcx, [rsp + 0x1780]
call fcn.140025a30
nop
lea rcx, [rsp + 0x18d0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1808]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x16d0]
call fcn.140023080
nop
lea rcx, [rsp + 0x16e8]
call fcn.140023080
nop
lea rcx, [rsp + 0x1798]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x17b8]
call fcn.14000b3c0
nop
lea rcx, [rsp + 0x1868]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x1718]
call fcn.140025a30
nop
lea rcx, [rsp + 0x1828]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1c70]
call fcn.140017390
nop
lea rcx, [rsp + 0x1a90]
call fcn.14000e5a0
nop
lea rcx, [rsp + 0x2050]
call fcn.140017390
nop
lea rcx, [rsp + 0x1598]
call fcn.140045a00
xor eax, eax
jmp 0x140018d4c
call fcn.140021700
mov rdx, r14
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
lea rdx, str.Set_affinity.
lea rcx, [rsp + 0x1620]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x1620]
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x1620]
call fcn.1400245c0
lea rdx, [rsp + 0x1b80]
lea rcx, [rsp + 0x15c0]
call fcn.140024800
nop
xor edx, edx
lea rcx, [rsp + 0x15c0]
call fcn.140023fe0
movsx ecx, byte [rax]
add ecx, 0xffffff9f
cmp ecx, 0x11
ja case.0x14001a5d8.99
movsxd rax, ecx
mov ecx, dword [rsi + rax*4 + 0x1d088]
add rcx, rsi
jmp rcx
movsxd rax, edx
inc dword [r10 + rax*8 + 4]
jmp 0x14001a337
mov edx, 0x100
jmp 0x14001aa5a
mov edx, 0x80
jmp 0x14001aa5a
mov edx, 0x8000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
cmp byte [rsp + 0x1c70], 0
jne 0x14001aa63
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x16b8]
call fcn.140023540
nop
lea rcx, [rsp + 0x1698]
call fcn.140021700
nop
lea rcx, [rsp + 0x1730]
call fcn.140021700
nop
lea rcx, [rsp + 0x1748]
call fcn.140023540
nop
lea rcx, [rsp + 0x1970]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1760]
call fcn.140023540
nop
lea rcx, [rsp + 0x1678]
call fcn.14001d2b0
nop
lea rcx, [rsp + 0x1660]
call fcn.14001d2b0
nop
lea rcx, [rsp + 0x1570]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x19d8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x17d8]
call fcn.140025a30
nop
lea rcx, [rsp + 0x19f8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1890]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1700]
call fcn.140023080
nop
lea rcx, [rsp + 0x17f0]
call fcn.140023080
nop
lea rcx, [rsp + 0x1848]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1930]
call fcn.14000b3c0
nop
lea rcx, [rsp + 0x1950]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x19b8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1990]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x18b0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1688]
call fcn.1400153a0
nop
lea rcx, [rsp + 0x1780]
call fcn.140025a30
nop
lea rcx, [rsp + 0x18d0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1808]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x16d0]
call fcn.140023080
nop
lea rcx, [rsp + 0x16e8]
call fcn.140023080
nop
lea rcx, [rsp + 0x1798]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x17b8]
call fcn.14000b3c0
nop
lea rcx, [rsp + 0x1868]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x1718]
call fcn.140025a30
nop
lea rcx, [rsp + 0x1828]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1c70]
call fcn.140017390
nop
lea rcx, [rsp + 0x1a90]
call fcn.14000e5a0
nop
lea rcx, [rsp + 0x2050]
call fcn.140017390
nop
lea rcx, [rsp + 0x1598]
call fcn.140045a00
xor eax, eax
jmp 0x140018d4c
mov edx, reloc.WLDAP32.dll_Ordinal_32
jmp 0x14001aa5a
mov edx, 0x4000
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
cmp byte [rsp + 0x1c70], 0
jne 0x14001aa63
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x16b8]
call fcn.140023540
nop
lea rcx, [rsp + 0x1698]
call fcn.140021700
nop
lea rcx, [rsp + 0x1730]
call fcn.140021700
nop
lea rcx, [rsp + 0x1748]
call fcn.140023540
nop
lea rcx, [rsp + 0x1970]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1760]
call fcn.140023540
nop
lea rcx, [rsp + 0x1678]
call fcn.14001d2b0
nop
lea rcx, [rsp + 0x1660]
call fcn.14001d2b0
nop
lea rcx, [rsp + 0x1570]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x19d8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x17d8]
call fcn.140025a30
nop
lea rcx, [rsp + 0x19f8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1890]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1700]
call fcn.140023080
nop
lea rcx, [rsp + 0x17f0]
call fcn.140023080
nop
lea rcx, [rsp + 0x1848]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1930]
call fcn.14000b3c0
nop
lea rcx, [rsp + 0x1950]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x19b8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1990]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x18b0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1688]
call fcn.1400153a0
nop
lea rcx, [rsp + 0x1780]
call fcn.140025a30
nop
lea rcx, [rsp + 0x18d0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1808]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x16d0]
call fcn.140023080
nop
lea rcx, [rsp + 0x16e8]
call fcn.140023080
nop
lea rcx, [rsp + 0x1798]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x17b8]
call fcn.14000b3c0
nop
lea rcx, [rsp + 0x1868]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x1718]
call fcn.140025a30
nop
lea rcx, [rsp + 0x1828]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1c70]
call fcn.140017390
nop
lea rcx, [rsp + 0x1a90]
call fcn.14000e5a0
nop
lea rcx, [rsp + 0x2050]
call fcn.140017390
nop
lea rcx, [rsp + 0x1598]
call fcn.140045a00
xor eax, eax
jmp 0x140018d4c
mov edx, 0x40
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea rdx, str.Set_priority.
lea rcx, [rsp + 0x1620]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x1620]
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x1620]
call fcn.1400245c0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rbx, rax
lea rdx, [rsp + 0x1530]
lea rcx, [rsp + 0x1678]
call fcn.140021a80
mov qword [rax], rbx
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, [rsp + 0x2250]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x140019614
lea r8, [rsp + 0x15c0]
lea rdx, str.Invalid_priority:
lea rcx, [rsp + 0x1620]
call fcn.14002aed0
nop
mov rdx, rax
mov ecx, 3
call fcn.14000dc40
nop
lea rcx, [rsp + 0x1620]
call fcn.1400245c0
nop
mov ecx, 0x98967f
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001ab20
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14001abf5
lea rdx, str.Error_ID:__4756745674567_
lea rcx, [rsp + 0x15c0]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x1538]
mov edx, Ordinal_41
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea r8, [rsp + 0x1654]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [rsp + 0x1650], 1
mov dword [rsp + 0x165c], 2
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rsp + 0x1650]
xor edx, edx
mov rcx, qword [rsp + 0x1538]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor edx, edx
lea ecx, [rdx + 0xc]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea r8, [rsp + 0x1530]
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x1660]
call fcn.140021bc0
mov rcx, qword [rsp + 0x1660]
cmp qword [rax], rcx
jne 0x14001aad1
mov edx, dword [rsp + 0x1530]
lea rcx, [rsp + 0x1620]
call fcn.1400072d0
nop
mov r8, rax
lea rdx, str.New_process_found_with_pid
lea rcx, [rsp + 0x15c0]
call fcn.14002af40
nop
mov rdx, rax
mov ecx, 1
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1620]
call fcn.1400245c0
mov r8d, dword [rsp + 0x1530]
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r14, rax
test rax, rax
jne 0x14001ace0
lea rdx, str.Failed_to_open_process.
lea rcx, [rsp + 0x15c0]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
lea ecx, [r14 + 3]
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
lea rdx, [rsp + 0x2250]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x140019614
lea rdx, str.Opened_process.
lea rcx, [rsp + 0x1620]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x1620]
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x1620]
call fcn.1400245c0
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14001addd
lea rdx, str.Error_ID:__3547656474567_
lea rcx, [rsp + 0x1620]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x1620]
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x1620]
call fcn.1400245c0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x1538]
mov edx, Ordinal_41
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea r8, [rsp + 0x1654]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [rsp + 0x1650], 1
mov dword [rsp + 0x165c], 2
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rsp + 0x1650]
xor edx, edx
mov rcx, qword [rsp + 0x1538]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor edx, edx
lea ecx, [rdx + 0xc]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rsi, r12
lea rdx, str.neither
lea rcx, [rsp + 0x1af0]
call fcn.1400275a0
test al, al
je 0x14001ae35
mov rcx, qword [rsp + 0x1ad8]
mov rdx, qword [rsp + 0x1ae0]
cmp rcx, rdx
je 0x14001b875
nop dword [rax]
nop word [rax + rax]
movsxd rax, dword [rcx]
bts rsi, rax
add rcx, 4
cmp rcx, rdx
jne 0x14001ae20
jmp 0x14001b875
lea rdx, str.random
lea rcx, [rsp + 0x1af0]
call fcn.1400275a0
test al, al
je 0x14001b0f3
cmp byte [rsp + 0x1c70], 0
jne 0x14001b05d
lea rcx, [rsp + 0x16b8]
call fcn.140023540
nop
lea rcx, [rsp + 0x1698]
call fcn.140021700
nop
lea rcx, [rsp + 0x1730]
call fcn.140021700
nop
lea rcx, [rsp + 0x1748]
call fcn.140023540
nop
lea rcx, [rsp + 0x1970]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1760]
call fcn.140023540
nop
lea rcx, [rsp + 0x1678]
call fcn.14001d2b0
nop
lea rcx, [rsp + 0x1660]
call fcn.14001d2b0
nop
lea rcx, [rsp + 0x1570]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x19d8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x17d8]
call fcn.140025a30
nop
lea rcx, [rsp + 0x19f8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1890]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1700]
call fcn.140023080
nop
lea rcx, [rsp + 0x17f0]
call fcn.140023080
nop
lea rcx, [rsp + 0x1848]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1930]
call fcn.14000b3c0
nop
lea rcx, [rsp + 0x1950]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x19b8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1990]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x18b0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1688]
call fcn.1400153a0
nop
lea rcx, [rsp + 0x1780]
call fcn.140025a30
nop
lea rcx, [rsp + 0x18d0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1808]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x16d0]
call fcn.140023080
nop
lea rcx, [rsp + 0x16e8]
call fcn.140023080
nop
lea rcx, [rsp + 0x1798]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x17b8]
call fcn.14000b3c0
nop
lea rcx, [rsp + 0x1868]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x1718]
call fcn.140025a30
nop
lea rcx, [rsp + 0x1828]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1c70]
call fcn.140017390
nop
lea rcx, [rsp + 0x1a90]
call fcn.14000e5a0
nop
lea rcx, [rsp + 0x2050]
call fcn.140017390
nop
lea rcx, [rsp + 0x1598]
call fcn.140045a00
xor eax, eax
jmp 0x140018d4c
lea rcx, [rsp + 0x15a0]
call fcn.14000aa40
lea rdx, [rsp + 0x1ad8]
lea rcx, [rsp + 0x15a0]
call fcn.1400235a0
nop
call qword [sym.imp.MSVCP140.dll_unsigned_int___cdecl_std::_Random_device_void_]
mov edx, eax
lea rcx, [rsp + 0x1a0]
call fcn.140021a30
mov r8, rax
mov rdx, qword [rsp + 0x15a8]
mov rcx, qword [rsp + 0x15a0]
call fcn.14002c170
mov eax, dword [rsp + 0x1b10]
test eax, eax
jle 0x14001b0e1
mov rcx, qword [rsp + 0x15a0]
mov edx, eax
nop dword [rax]
nop word [rax + rax]
movsxd rax, dword [rcx]
bts rsi, rax
lea rcx, [rcx + 4]
sub rdx, 1
jne 0x14001b0d0
lea rcx, [rsp + 0x15a0]
call fcn.140023540
jmp 0x14001b875
lea rdx, str.lowest_usage
lea rcx, [rsp + 0x1af0]
call fcn.1400275a0
test al, al
je 0x14001b311
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14001b1d7
lea rdx, str.Error_ID:__456345634563465_
lea rcx, [rsp + 0x1620]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x1620]
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x1620]
call fcn.1400245c0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rsp + 0x1538]
mov edx, Ordinal_41
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
lea r8, [rsp + 0x1654]
lea rdx, str.SeShutdownPrivilege
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov dword [rsp + 0x1650], 1
mov dword [rsp + 0x165c], 2
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, [rsp + 0x1650]
xor edx, edx
mov rcx, qword [rsp + 0x1538]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
xor edx, edx
lea ecx, [rdx + 0xc]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rsp + 0x1a78]
call fcn.14000eb50
lea rax, [rsp + 0x1620]
mov qword [rsp + 0x1910], rax
lea rdx, [rsp + 0x1ad8]
lea rcx, [rsp + 0x1620]
call fcn.1400235a0
mov rbx, rax
lea rdx, [rsp + 0x1a90]
lea rcx, [rsp + 0x1a0]
call fcn.14001d120
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x1a78]
call fcn.14000df70
nop
lea rcx, [rsp + 0x15a0]
call fcn.14000aa40
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x15a0], xmm0
mov qword [rsp + 0x15b0], r12
mov rax, qword [rsp + 0x1a78]
mov rax, qword [rax]
mov qword [rsp + 0x1540], rax
nop word [rax + rax]
cmp byte [rax + 0x19], 0
jne 0x14001b2b6
mov ecx, dword [rax + 0x1c]
mov dword [rsp + 0xb8], ecx
mov ecx, dword [rax + 0x20]
mov dword [rsp + 0xbc], ecx
lea rdx, [rsp + 0xb8]
lea rcx, [rsp + 0x15a0]
call fcn.1400216e0
lea rcx, [rsp + 0x1540]
call fcn.1400219c0
mov rax, qword [rsp + 0x1540]
jmp 0x14001b270
mov rdx, qword [rsp + 0x15a8]
mov rcx, qword [rsp + 0x15a0]
call fcn.14002c2c0
mov eax, dword [rsp + 0x1b10]
test eax, eax
jle 0x14001b2f1
mov rcx, qword [rsp + 0x15a0]
mov edx, eax
movsxd rax, dword [rcx]
bts rsi, rax
lea rcx, [rcx + 8]
sub rdx, 1
jne 0x14001b2e0
lea rcx, [rsp + 0x15a0]
call fcn.140021700
nop
lea rcx, [rsp + 0x1a78]
call fcn.14000eaf0
jmp 0x14001b875
lea rdx, str.instance_per_core
lea rcx, [rsp + 0x1af0]
call fcn.1400275a0
test al, al
je 0x14001b875
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14001b343
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rsp + 0x15a0]
call fcn.14000aa40
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x15a0], xmm0
mov qword [rsp + 0x15b0], r12
test r13b, r13b
jne 0x14001b44e
lea rcx, [rsp + 0x1610]
call fcn.14000eb50
lea rax, [rsp + 0x1620]
mov qword [rsp + 0x1910], rax
lea rdx, [rsp + 0x1ad8]
lea rcx, [rsp + 0x1620]
call fcn.1400235a0
mov rbx, rax
lea rdx, [rsp + 0x1a90]
lea rcx, [rsp + 0x1a0]
call fcn.14001d120
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x1610]
call fcn.14000df70
nop
mov rax, qword [rsp + 0x1610]
mov rax, qword [rax]
mov qword [rsp + 0x1540], rax
nop
cmp byte [rax + 0x19], 0
jne 0x14001b426
mov ecx, dword [rax + 0x1c]
mov dword [rsp + 0xc0], ecx
mov ecx, dword [rax + 0x20]
mov dword [rsp + 0xc4], ecx
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x15a0]
call fcn.1400216e0
lea rcx, [rsp + 0x1540]
call fcn.1400219c0
mov rax, qword [rsp + 0x1540]
jmp 0x14001b3e0
mov rdx, qword [rsp + 0x15a8]
mov rcx, qword [rsp + 0x15a0]
call fcn.14002c2f0
nop
lea rcx, [rsp + 0x1610]
call fcn.14000eaf0
jmp 0x14001b728
mov rbx, qword [rsp + 0x1ad8]
mov rdi, qword [rsp + 0x1ae0]
nop
cmp rbx, rdi
je 0x14001b4f9
mov r9d, dword [rbx]
mov ecx, r12d
mov r10, qword [rsp + 0x16a0]
mov r8, qword [rsp + 0x1698]
nop
mov rax, r10
sub rax, r8
sar rax, 3
movsxd rdx, ecx
cmp rdx, rax
jae 0x14001b4cb
cmp dword [r8 + rdx*8], r9d
jne 0x14001b4c7
mov dword [rsp + 0xc8], r9d
mov eax, dword [r8 + rdx*8 + 4]
mov dword [rsp + 0xcc], eax
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x15a0]
call fcn.1400216e0
add rbx, 4
jmp 0x14001b460
inc ecx
jmp 0x14001b480
mov dword [rsp + 0xd8], r9d
mov dword [rsp + 0xdc], r12d
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x15a0]
call fcn.1400216e0
add rbx, 4
jmp 0x14001b460
mov rdx, qword [rsp + 0x15a8]
mov rcx, qword [rsp + 0x15a0]
call fcn.14002c2f0
cmp byte [rsp + 0x1c70], 0
jne 0x14001b728
lea rcx, [rsp + 0x15a0]
call fcn.140021700
nop
lea rcx, [rsp + 0x16b8]
call fcn.140023540
nop
lea rcx, [rsp + 0x1698]
call fcn.140021700
nop
lea rcx, [rsp + 0x1730]
call fcn.140021700
nop
lea rcx, [rsp + 0x1748]
call fcn.140023540
nop
lea rcx, [rsp + 0x1970]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1760]
call fcn.140023540
nop
lea rcx, [rsp + 0x1678]
call fcn.14001d2b0
nop
lea rcx, [rsp + 0x1660]
call fcn.14001d2b0
nop
lea rcx, [rsp + 0x1570]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x19d8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x17d8]
call fcn.140025a30
nop
lea rcx, [rsp + 0x19f8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1890]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1700]
call fcn.140023080
nop
lea rcx, [rsp + 0x17f0]
call fcn.140023080
nop
lea rcx, [rsp + 0x1848]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1930]
call fcn.14000b3c0
nop
lea rcx, [rsp + 0x1950]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x19b8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1990]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x18b0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1688]
call fcn.1400153a0
nop
lea rcx, [rsp + 0x1780]
call fcn.140025a30
nop
lea rcx, [rsp + 0x18d0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1808]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x16d0]
call fcn.140023080
nop
lea rcx, [rsp + 0x16e8]
call fcn.140023080
nop
lea rcx, [rsp + 0x1798]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x17b8]
call fcn.14000b3c0
nop
lea rcx, [rsp + 0x1868]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x1718]
call fcn.140025a30
nop
lea rcx, [rsp + 0x1828]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1c70]
call fcn.140017390
nop
lea rcx, [rsp + 0x1a90]
call fcn.14000e5a0
nop
lea rcx, [rsp + 0x2050]
call fcn.140017390
nop
lea rcx, [rsp + 0x1598]
call fcn.140045a00
xor eax, eax
jmp 0x140018d4c
mov edi, dword [rsp + 0x1b10]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14001b745
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov edx, r12d
mov r8, qword [rsp + 0x15a8]
mov rcx, qword [rsp + 0x15a0]
sub r8, rcx
sar r8, 3
test r8, r8
je 0x14001b860
movsxd rbx, dword [rcx]
cmp dword [rcx + 4], edi
jl 0x14001b783
inc edx
add rcx, 8
movsxd rax, edx
cmp rax, r8
jb 0x14001b768
jmp 0x14001b860
mov edx, ebx
lea rcx, [rsp + 0x48]
call fcn.1400072d0
nop
mov r8, rax
lea rdx, str.Setting_affinity_to_core
lea rcx, [rsp + 0x1910]
call fcn.14002af40
nop
lea r8, [0x1400bf8f4]
mov rdx, rax
lea rcx, [rsp + 0x1620]
call fcn.14002a2c0
nop
mov rdx, rax
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x1620]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1910]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x48]
call fcn.1400245c0
mov rsi, r12
bts rsi, rbx
test r13b, r13b
je 0x14001b860
mov edx, r12d
mov r8, qword [rsp + 0x16a0]
mov r9, qword [rsp + 0x1698]
sub r8, r9
sar r8, 3
test r8, r8
je 0x14001b838
mov rcx, r9
cmp dword [rcx], ebx
je 0x14001b900
inc edx
add rcx, 8
movsxd rax, edx
cmp rax, r8
jb 0x14001b822
mov dword [rsp + 0xe0], ebx
mov dword [rsp + 0xe4], 1
lea rdx, [rsp + 0xe0]
lea rcx, [rsp + 0x1698]
call fcn.1400216e0
nop
lea rcx, [rsp + 0x15a0]
call fcn.140021700
mov rdi, qword [rsp + 0x1548]
mov rdx, rsi
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetProcessAffinityMask]
lea rdx, str.Set_affinity.
lea rcx, [rsp + 0x1620]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x1620]
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x1620]
call fcn.1400245c0
lea rdx, [rsp + 0x1b18]
lea rcx, [rsp + 0x15c0]
call fcn.140024800
nop
xor edx, edx
lea rcx, [rsp + 0x15c0]
call fcn.140023fe0
movsx ecx, byte [rax]
add ecx, 0xffffff9f
cmp ecx, 0x11
ja case.0x14001b8fe.99
movsxd rax, ecx
lea rsi, [0x140000000]
mov ecx, dword [rsi + rax*4 + 0x1d0d0]
add rcx, rsi
jmp rcx
movsxd rax, edx
inc dword [r9 + rax*8 + 4]
jmp 0x14001b860
mov edx, 0x100
jmp 0x14001bb5f
mov edx, 0x80
jmp 0x14001bb5f
mov edx, 0x8000
jmp 0x14001bb5f
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
cmp byte [rsp + 0x1c70], 0
jne 0x14001bb68
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x16b8]
call fcn.140023540
nop
lea rcx, [rsp + 0x1698]
call fcn.140021700
nop
lea rcx, [rsp + 0x1730]
call fcn.140021700
nop
lea rcx, [rsp + 0x1748]
call fcn.140023540
nop
lea rcx, [rsp + 0x1970]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1760]
call fcn.140023540
nop
lea rcx, [rsp + 0x1678]
call fcn.14001d2b0
nop
lea rcx, [rsp + 0x1660]
call fcn.14001d2b0
nop
lea rcx, [rsp + 0x1570]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x19d8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x17d8]
call fcn.140025a30
nop
lea rcx, [rsp + 0x19f8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1890]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1700]
call fcn.140023080
nop
lea rcx, [rsp + 0x17f0]
call fcn.140023080
nop
lea rcx, [rsp + 0x1848]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1930]
call fcn.14000b3c0
nop
lea rcx, [rsp + 0x1950]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x19b8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1990]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x18b0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1688]
call fcn.1400153a0
nop
lea rcx, [rsp + 0x1780]
call fcn.140025a30
nop
lea rcx, [rsp + 0x18d0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1808]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x16d0]
call fcn.140023080
nop
lea rcx, [rsp + 0x16e8]
call fcn.140023080
nop
lea rcx, [rsp + 0x1798]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x17b8]
call fcn.14000b3c0
nop
lea rcx, [rsp + 0x1868]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x1718]
call fcn.140025a30
nop
lea rcx, [rsp + 0x1828]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1c70]
call fcn.140017390
nop
lea rcx, [rsp + 0x1a90]
call fcn.14000e5a0
nop
lea rcx, [rsp + 0x2050]
call fcn.140017390
nop
lea rcx, [rsp + 0x1598]
call fcn.140045a00
xor eax, eax
jmp 0x140018d4c
mov edx, 0x4000
jmp 0x14001bb5f
mov edx, 0x40
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_SetPriorityClass]
lea rdx, str.Set_priority.
lea rcx, [rsp + 0x1620]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x1620]
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x1620]
call fcn.1400245c0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rbx, rax
lea rdx, [rsp + 0x1530]
lea rcx, [rsp + 0x1660]
call fcn.140021a80
mov qword [rax], rbx
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
mov rcx, r14
jmp 0x14001aacb
lea r8, [rsp + 0x15c0]
lea rdx, str.Invalid_priority:
lea rcx, [rsp + 0x48]
call fcn.14002aed0
nop
mov rdx, rax
mov ecx, 3
call fcn.14000dc40
nop
lea rcx, [rsp + 0x48]
call fcn.1400245c0
nop word [rax + rax]
mov ecx, 0x98967f
call qword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x14001bc10
cmp byte [rsp + 0x1ba0], 0
jne 0x14001bc35
cmp byte [rsp + 0x1bc0], 0
je 0x14001c57a
lea rcx, [rsp + 0x15a0]
call fcn.14000aa40
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x15a0], xmm0
mov qword [rsp + 0x15b0], r12
lea rdx, [rsp + 0x15a0]
lea rcx, [0x14000eb60]
call qword [sym.imp.USER32.dll_EnumWindows]
cmp byte [rsp + 0x1c70], 0
jne 0x14001be85
lea rcx, [rsp + 0x15a0]
call fcn.140022a70
nop
lea rcx, [rsp + 0x16b8]
call fcn.140023540
nop
lea rcx, [rsp + 0x1698]
call fcn.140021700
nop
lea rcx, [rsp + 0x1730]
call fcn.140021700
nop
lea rcx, [rsp + 0x1748]
call fcn.140023540
nop
lea rcx, [rsp + 0x1970]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1760]
call fcn.140023540
nop
lea rcx, [rsp + 0x1678]
call fcn.14001d2b0
nop
lea rcx, [rsp + 0x1660]
call fcn.14001d2b0
nop
lea rcx, [rsp + 0x1570]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x19d8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x17d8]
call fcn.140025a30
nop
lea rcx, [rsp + 0x19f8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1890]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1700]
call fcn.140023080
nop
lea rcx, [rsp + 0x17f0]
call fcn.140023080
nop
lea rcx, [rsp + 0x1848]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1930]
call fcn.14000b3c0
nop
lea rcx, [rsp + 0x1950]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x19b8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1990]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x18b0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1688]
call fcn.1400153a0
nop
lea rcx, [rsp + 0x1780]
call fcn.140025a30
nop
lea rcx, [rsp + 0x18d0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1808]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x16d0]
call fcn.140023080
nop
lea rcx, [rsp + 0x16e8]
call fcn.140023080
nop
lea rcx, [rsp + 0x1798]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x17b8]
call fcn.14000b3c0
nop
lea rcx, [rsp + 0x1868]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x1718]
call fcn.140025a30
nop
lea rcx, [rsp + 0x1828]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1c70]
call fcn.140017390
nop
lea rcx, [rsp + 0x1a90]
call fcn.14000e5a0
nop
lea rcx, [rsp + 0x2050]
call fcn.140017390
nop
lea rcx, [rsp + 0x1598]
call fcn.140045a00
xor eax, eax
jmp 0x140018d4c
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14001be9b
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov rdi, qword [rsp + 0x15a0]
mov rsi, qword [rsp + 0x15a8]
nop dword [rax + rax]
cmp rdi, rsi
je 0x14001c566
mov rdx, rdi
lea rcx, [rsp + 0x1620]
call fcn.140024280
nop
lea rcx, [rsp + 0x1a20]
call fcn.14001d310
lea rcx, [rsp + 0x1a20]
call fcn.140021800
nop
lea rdx, [rsp + 0x1a20]
lea rcx, [rsp + 0x1620]
call fcn.14002c320
test al, al
je 0x14001c542
lea rcx, [rsp + 0x1620]
call fcn.140024090
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowW]
mov qword [rsp + 0x1540], rax
lea r9, [rsp + 0x1540]
mov r8, qword [rsp + 0x1738]
mov rdx, qword [rsp + 0x1730]
lea rcx, [rsp + 0x108]
call fcn.14002c360
mov rcx, qword [rsp + 0x1738]
cmp qword [rax], rcx
jne 0x14001c542
lea rdx, [rsp + 0x150]
lea rcx, [rsp + 0x1620]
call fcn.1400240a0
mov r8, qword [rax]
lea rdx, [rsp + 0x118]
lea rcx, [rsp + 0x1620]
call fcn.1400240c0
mov rdx, qword [rax]
lea rcx, [rsp + 0x1910]
call fcn.14002afb0
nop
cmp byte [rsp + 0x1ba0], 0
je 0x14001c10b
lea rdx, str.Setting_window_size.
lea rcx, [rsp + 0x15c0]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
mov rbx, qword [rsp + 0x1540]
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x14001c059
lea r8, [rsp + 0x1910]
lea rdx, str.Size_Window__
lea rcx, [rsp + 0x15c0]
call fcn.14002aed0
nop
lea r8, str.__is_not_visible.
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14002a2c0
nop
mov rdx, rax
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x48]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
mov edx, 5
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindowAsync]
jmp 0x14001c113
mov rax, qword [rsp + 0x1ba8]
mov ecx, dword [rax]
mov eax, dword [rax + 4]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], ecx
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
xor ecx, ecx
call fcn.140011480
lea rcx, [rsp + 0x15c0]
test eax, eax
jne 0x14001c0dc
lea r8, [rsp + 0x1910]
lea rdx, str.Window__
call fcn.14002aed0
nop
lea r8, str.__timed_out_while_setting_size.
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14002a2c0
nop
mov rdx, rax
mov ecx, 3
call fcn.14000dc40
nop
lea rcx, [rsp + 0x48]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
jmp 0x14001c113
lea rdx, str.Set_window_size.
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
jmp 0x14001c113
mov rbx, qword [rsp + 0x1540]
cmp byte [rsp + 0x1bc0], 0
je 0x14001c51e
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14001c137
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.Setting_window_position.
lea rcx, [rsp + 0x15c0]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
mov rcx, rbx
call qword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
jne 0x14001c1e4
lea r8, [rsp + 0x1910]
lea rdx, str.Position_Window__
lea rcx, [rsp + 0x15c0]
call fcn.14002aed0
nop
lea r8, str.__is_not_visible.
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14002a2c0
nop
mov rdx, rax
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x48]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
mov edx, 5
mov rcx, rbx
call qword [sym.imp.USER32.dll_ShowWindowAsync]
jmp 0x14001c534
mov rax, qword [rsp + 0x1bc8]
mov r8d, dword [rax]
mov r9d, dword [rax + 4]
cmp byte [rsp + 0x1c70], 0
jne 0x14001c437
lea rcx, [rsp + 0x1910]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1a20]
call fcn.140021760
nop
lea rcx, [rsp + 0x1620]
call fcn.14000b3c0
nop
lea rcx, [rsp + 0x15a0]
call fcn.140022a70
nop
lea rcx, [rsp + 0x16b8]
call fcn.140023540
nop
lea rcx, [rsp + 0x1698]
call fcn.140021700
nop
lea rcx, [rsp + 0x1730]
call fcn.140021700
nop
lea rcx, [rsp + 0x1748]
call fcn.140023540
nop
lea rcx, [rsp + 0x1970]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1760]
call fcn.140023540
nop
lea rcx, [rsp + 0x1678]
call fcn.14001d2b0
nop
lea rcx, [rsp + 0x1660]
call fcn.14001d2b0
nop
lea rcx, [rsp + 0x1570]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x19d8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x17d8]
call fcn.140025a30
nop
lea rcx, [rsp + 0x19f8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1890]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1700]
call fcn.140023080
nop
lea rcx, [rsp + 0x17f0]
call fcn.140023080
nop
lea rcx, [rsp + 0x1848]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1930]
call fcn.14000b3c0
nop
lea rcx, [rsp + 0x1950]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x19b8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1990]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x18b0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1688]
call fcn.1400153a0
nop
lea rcx, [rsp + 0x1780]
call fcn.140025a30
nop
lea rcx, [rsp + 0x18d0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1808]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x16d0]
call fcn.140023080
nop
lea rcx, [rsp + 0x16e8]
call fcn.140023080
nop
lea rcx, [rsp + 0x1798]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x17b8]
call fcn.14000b3c0
nop
lea rcx, [rsp + 0x1868]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x1718]
call fcn.140025a30
nop
lea rcx, [rsp + 0x1828]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1c70]
call fcn.140017390
nop
lea rcx, [rsp + 0x1a90]
call fcn.14000e5a0
nop
lea rcx, [rsp + 0x2050]
call fcn.140017390
nop
lea rcx, [rsp + 0x1598]
call fcn.140045a00
xor eax, eax
jmp 0x140018d4c
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
mov rdx, rbx
mov ecx, 1
call fcn.140011480
test eax, eax
jne 0x14001c4e9
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x1620]
call fcn.1400240a0
mov r8, qword [rax]
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0x1620]
call fcn.1400240c0
mov rdx, qword [rax]
lea rcx, [rsp + 0x15c0]
call fcn.14002afb0
nop
lea r8, [rsp + 0x15c0]
lea rdx, str.Window__
lea rcx, [rsp + 0x78]
call fcn.14002aed0
nop
lea r8, str.__timed_out_while_setting_position.
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.14002a2c0
nop
mov rdx, rax
mov ecx, 3
call fcn.14000dc40
nop
lea rcx, [rsp + 0x48]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x78]
call fcn.1400245c0
nop
jmp 0x14001c511
lea rdx, str.Set_window_position.
lea rcx, [rsp + 0x15c0]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
lea rdx, [rsp + 0x1540]
lea rcx, [rsp + 0x1730]
call fcn.1400216e0
nop
lea rcx, [rsp + 0x1910]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1a20]
call fcn.140021760
nop
lea rcx, [rsp + 0x1620]
call fcn.14000b3c0
add rdi, 0x20
jmp 0x14001beb0
lea rcx, [rsp + 0x15a0]
call fcn.140022a70
lea rsi, [0x140000000]
cmp byte [rsp + 0x1be0], 0
je 0x14001ccfa
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14001c59e
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov qword [rsp + 0x1548], r12
lea rcx, [rsp + 0x15a0]
call fcn.14000aa40
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x15a0], xmm0
mov qword [rsp + 0x15b0], r12
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
lea rax, [rsp + 0x1548]
mov qword [rsp + 0x20], rax
lea r9, [0x1400c4470]
xor edx, edx
lea r8d, [rdx + 0x17]
lea rcx, [0x1400c3f68]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jns 0x14001c642
lea rdx, str.Failed_to_create_device_enumerator_instance.
lea rcx, [rsp + 0x15c0]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
mov ecx, 3
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x15a0]
call fcn.140021700
jmp 0x14001ccee
mov qword [rsp + 0x1568], r12
mov rcx, qword [rsp + 0x1548]
mov rax, qword [rcx]
lea r9, [rsp + 0x1568]
xor edx, edx
lea r8d, [rdx + 1]
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
test eax, eax
jns 0x14001c6b2
lea rdx, str.Failed_to_get_default_audio_endpoint.
lea rcx, [rsp + 0x15c0]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
mov ecx, 3
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x15a0]
call fcn.140021700
jmp 0x14001ccee
mov qword [rsp + 0x1538], r12
mov rcx, qword [rsp + 0x1568]
mov rax, qword [rcx]
lea rdx, [rsp + 0x1538]
mov qword [rsp + 0x20], rdx
xor r9d, r9d
lea r8d, [r9 + 0x17]
lea rdx, [0x1400c4300]
call qword [rax + Ordinal_26]
test eax, eax
jns 0x14001c72f
lea rdx, str.Failed_to_activate_audio_session_manager.
lea rcx, [rsp + 0x15c0]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
mov ecx, 3
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x15a0]
call fcn.140021700
jmp 0x14001ccee
mov qword [rsp + 0x1560], r12
mov rcx, qword [rsp + 0x1538]
mov rax, qword [rcx]
lea rdx, [rsp + 0x1560]
call qword [rax + Ordinal_41]
test eax, eax
jns 0x14001c799
lea rdx, str.Failed_to_get_audio_session_enumerator.
lea rcx, [rsp + 0x15c0]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
mov ecx, 3
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x15a0]
call fcn.140021700
jmp 0x14001ccee
mov dword [rsp + 0x1778], r12d
mov rcx, qword [rsp + 0x1560]
mov rax, qword [rcx]
lea rdx, [rsp + 0x1778]
call qword [rax + Ordinal_26]
mov ebx, eax
cmp byte [rsp + 0x1c70], 0
jne 0x14001c9d3
lea rcx, [rsp + 0x15a0]
call fcn.140021700
nop
lea rcx, [rsp + 0x16b8]
call fcn.140023540
nop
lea rcx, [rsp + 0x1698]
call fcn.140021700
nop
lea rcx, [rsp + 0x1730]
call fcn.140021700
nop
lea rcx, [rsp + 0x1748]
call fcn.140023540
nop
lea rcx, [rsp + 0x1970]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1760]
call fcn.140023540
nop
lea rcx, [rsp + 0x1678]
call fcn.14001d2b0
nop
lea rcx, [rsp + 0x1660]
call fcn.14001d2b0
nop
lea rcx, [rsp + 0x1570]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x19d8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x17d8]
call fcn.140025a30
nop
lea rcx, [rsp + 0x19f8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1890]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1700]
call fcn.140023080
nop
lea rcx, [rsp + 0x17f0]
call fcn.140023080
nop
lea rcx, [rsp + 0x1848]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1930]
call fcn.14000b3c0
nop
lea rcx, [rsp + 0x1950]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x19b8]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1990]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x18b0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1688]
call fcn.1400153a0
nop
lea rcx, [rsp + 0x1780]
call fcn.140025a30
nop
lea rcx, [rsp + 0x18d0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1808]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x16d0]
call fcn.140023080
nop
lea rcx, [rsp + 0x16e8]
call fcn.140023080
nop
lea rcx, [rsp + 0x1798]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x17b8]
call fcn.14000b3c0
nop
lea rcx, [rsp + 0x1868]
call fcn.14000ea80
nop
lea rcx, [rsp + 0x1718]
call fcn.140025a30
nop
lea rcx, [rsp + 0x1828]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1c70]
call fcn.140017390
nop
lea rcx, [rsp + 0x1a90]
call fcn.14000e5a0
nop
lea rcx, [rsp + 0x2050]
call fcn.140017390
nop
lea rcx, [rsp + 0x1598]
call fcn.140045a00
xor eax, eax
jmp 0x140018d4c
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x14001c9e9
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
test ebx, ebx
jns 0x14001ca35
lea rdx, str.Failed_to_get_audio_session_count.
lea rcx, [rsp + 0x15c0]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
mov ecx, 3
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x15a0]
call fcn.140021700
jmp 0x14001ccee
mov ebx, r12d
nop dword [rax + rax]
cmp ebx, dword [rsp + 0x1778]
jge 0x14001cb59
mov qword [rsp + 0x1540], r12
mov rcx, qword [rsp + 0x1560]
mov rax, qword [rcx]
lea r8, [rsp + 0x1540]
mov edx, ebx
call qword [rax + reloc.WLDAP32.dll_Ordinal_32]
test eax, eax
jns 0x14001cab9
lea rdx, str.Failed_to_get_audio_session.
lea rcx, [rsp + 0x15c0]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
mov ecx, 3
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x15a0]
call fcn.140021700
jmp 0x14001ccee
mov rcx, qword [rsp + 0x1540]
test rcx, rcx
je 0x14001cb52
mov qword [rsp + 0x1550], r12
mov rax, qword [rcx]
lea r8, [rsp + 0x1550]
lea rdx, [0x1400c4530]
call qword [rax]
test eax, eax
jns 0x14001cb32
lea rdx, str.Failed_to_query_interface.
lea rcx, [rsp + 0x15c0]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
mov ecx, 3
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x15a0]
call fcn.140021700
jmp 0x14001ccee
cmp qword [rsp + 0x1550], 0
je 0x14001cb52
lea rdx, [rsp + 0x1550]
lea rcx, [rsp + 0x15a0]
call fcn.1400216e0
inc ebx
jmp 0x14001ca40
mov rdi, qword [rsp + 0x15a0]
mov rsi, qword [rsp + 0x15a8]
nop dword [rax]
cmp rdi, rsi
je 0x14001cce0
mov rbx, qword [rdi]
mov dword [rsp + 0x1530], r12d
mov rax, qword [rbx]
lea rdx, [rsp + 0x1530]
mov rcx, rbx
call qword [rax + reloc.WS2_32.dll_WSASetLastError]
lea r9, [rsp + 0x1530]
mov r8, qword [rsp + 0x16c0]
mov rdx, qword [rsp + 0x16b8]
lea rcx, [rsp + 0x130]
call fcn.14002c390
mov rcx, qword [rsp + 0x16c0]
cmp qword [rax], rcx
je 0x14001ccd7
lea r9, [rsp + 0x1530]
mov r8, qword [rsp + 0x1750]
mov rdx, qword [rsp + 0x1748]
lea rcx, [rsp + 0x2490]
call fcn.14002c390
mov rdx, qword [rsp + 0x1750]
cmp qword [rax], rdx
jne 0x14001ccd7
mov dword [rsp + 0x177c], r12d
mov qword [rsp + 0x1558], r12
mov rax, qword [rbx]
lea r8, [rsp + 0x1558]
lea rdx, [0x1400c44f0]
mov rcx, rbx
call qword [rax]
mov rcx, qword [rsp + 0x1558]
test rcx, rcx
je 0x14001ccd7
mov rax, qword [rcx]
lea rdx, [rsp + 0x177c]
call qword [rax + Ordinal_50]
cmp dword [rsp + 0x177c], 0
jne 0x14001ccd7
mov rcx, qword [rsp + 0x1558]
mov rax, qword [rcx]
xor r8d, r8d
lea edx, [r8 + 1]
call qword [rax + Ordinal_41]
mov eax, dword [rsp + 0x1530]
mov dword [rsp + 0x1540], eax
lea rdx, [rsp + 0x1540]
lea rcx, [rsp + 0x1748]
call fcn.140023520
mov edx, dword [rsp + 0x1530]
lea rcx, [rsp + 0x48]
call fcn.140007390
nop
mov r8, rax
lea rdx, str.Muted_sound_for_process_with_pid
lea rcx, [rsp + 0x78]
call fcn.14002af40
nop
mov rdx, rax
mov ecx, 1
call fcn.14000dc40
nop
lea rcx, [rsp + 0x78]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x48]
call fcn.1400245c0
add rdi, 8
jmp 0x14001cb70
lea rcx, [rsp + 0x15a0]
call fcn.140021700
nop
jmp 0x14001ccf3
lea rsi, [0x140000000]
mov r14, qword [rsp + 0x40]
lea rdx, [0x1400bf45a]
lea rcx, [rsp + 0x18f0]
call fcn.1400247c0
nop
lea rcx, [rsp + 0x1a60]
call fcn.14000aa40
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x1a60], xmm0
mov qword [rsp + 0x1a70], r12
lea rax, [rsp + 0x1a60]
mov qword [rsp + 0x1640], rax
mov qword [rsp + 0x1648], r12
movaps xmm0, xmmword [rsp + 0x1640]
movdqa xmmword [rsp + 0x1910], xmm0
lea rax, [rsp + 0x1910]
mov qword [rsp + 0x28], rax
mov rax, qword [rsp + 0x16c0]
mov qword [rsp + 0x20], rax
mov r9, qword [rsp + 0x16b8]
mov r8, qword [rsp + 0x1768]
mov rdx, qword [rsp + 0x1760]
lea rcx, [rsp + 0x168]
call fcn.14002c3c0
mov rdi, qword [rsp + 0x1a68]
mov rax, rdi
mov rbx, qword [rsp + 0x1a60]
sub rax, rbx
sar rax, 2
test rax, rax
je 0x14001ce50
cmp rbx, rdi
je 0x14001ce50
mov edx, dword [rbx]
lea rcx, [rsp + 0x15c0]
call fcn.1400072d0
nop
mov r8, rax
lea rdx, str.Process_with_pid
lea rcx, [rsp + 0x48]
call fcn.14002af40
nop
lea r8, str._closed.
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.14002a2c0
mov rdx, rax
lea rcx, [rsp + 0x18f0]
call fcn.140024620
lea rcx, [rsp + 0x78]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x48]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
lea rdx, [rsp + 0x18f0]
mov ecx, 3
call fcn.14000dc40
add rbx, 4
jmp 0x14001cdc0
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x14001d031
mov rdx, qword [rsp + 0x16c0]
sub rdx, qword [rsp + 0x16b8]
sar rdx, 2
test rdx, rdx
je 0x14001cefa
lea rcx, [rsp + 0x48]
call fcn.140007410
nop
mov r8, rax
lea rdx, str.Processes_found:
lea rcx, [rsp + 0x78]
call fcn.14002af40
mov rdx, rax
lea rcx, [rsp + 0x18f0]
call fcn.140024620
lea rcx, [rsp + 0x78]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x48]
call fcn.1400245c0
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, r14
cmp rax, 0x1388
ja 0x14001cee9
lea rdx, [rsp + 0x1970]
lea rcx, [rsp + 0x18f0]
call fcn.14002ae90
test al, al
jne 0x14001cf52
lea rdx, [rsp + 0x18f0]
xor ecx, ecx
call fcn.14000dc40
jmp 0x14001cf47
lea rdx, str.No_processes_found.
lea rcx, [rsp + 0x18f0]
call fcn.140024570
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
sub rax, r14
cmp rax, 0x1388
ja 0x14001cf38
lea rdx, [rsp + 0x1970]
lea rcx, [rsp + 0x18f0]
call fcn.14002ae90
test al, al
jne 0x14001cf52
lea rdx, [rsp + 0x18f0]
xor ecx, ecx
call fcn.14000dc40
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x16b8]
lea rcx, [rsp + 0x1760]
call fcn.1400234f0
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x14001d031
lea rdx, [rsp + 0x18f0]
lea rcx, [rsp + 0x1970]
call fcn.140024590
xor r13b, r13b
lea rdx, str.Loop_finished.
lea rcx, [rsp + 0x15c0]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, str.Sleep_finished.
lea rcx, [rsp + 0x15c0]
call fcn.1400247c0
nop
lea rdx, [rsp + 0x15c0]
mov ecx, 4
call fcn.14000dc40
nop
lea rcx, [rsp + 0x15c0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x1a60]
call fcn.140023540
nop
lea rcx, [rsp + 0x18f0]
call fcn.1400245c0
nop
lea rcx, [rsp + 0x16b8]
call fcn.140023540
jmp 0x140019280
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
jmp 0x140018c5d
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
lea rcx, [rsp + 0x178]
call fcn.140044a40
lea rdx, [0x1400d3e50]
lea rcx, [rsp + 0x178]
call sub.VCRUNTIME140.dll__CxxThrowException
int3