Function at 0x1800538a0
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rbx
sub rsp, 0xf8
lea rbp, [rsp + 0x80]
mov qword [rbp - 0x58], rdx
mov qword [rbp - 0x50], rcx
mov rax, qword [0x1800eb0a8]
xor rax, rbp
mov qword [rbp + 0x70], rax
mov dword [rbp - 0x40], 0x64f09047
mov eax, dword [rbp - 0x40]
mov dword [rbp - 0x5c], eax
sub eax, 0x837274fe
je 0x1800546dd
jmp 0x1800538e4
mov eax, dword [rbp - 0x5c]
sub eax, 0x88f0baff
je 0x180054916
jmp 0x1800538f7
mov eax, dword [rbp - 0x5c]
sub eax, 0x8ff4e6da
je 0x1800545d9
jmp 0x18005390a
mov eax, dword [rbp - 0x5c]
sub eax, 0x9a3031e9
je 0x18005457e
jmp 0x18005391d
mov eax, dword [rbp - 0x5c]
sub eax, 0x9d03ade5
je 0x180054865
jmp 0x180053930
mov eax, dword [rbp - 0x5c]
sub eax, 0x9d2e8acd
je 0x180054891
jmp 0x180053943
mov eax, dword [rbp - 0x5c]
sub eax, 0x9d810324
je 0x180054847
jmp 0x180053956
mov eax, dword [rbp - 0x5c]
sub eax, 0x9f484ae1
je 0x180054779
jmp 0x180053969
mov eax, dword [rbp - 0x5c]
sub eax, 0xa1e5530c
je 0x180054228
jmp 0x18005397c
mov eax, dword [rbp - 0x5c]
sub eax, 0xa4908f58
je 0x1800547aa
jmp 0x18005398f
mov eax, dword [rbp - 0x5c]
sub eax, 0xa7a8a347
je 0x180054796
jmp 0x1800539a2
mov eax, dword [rbp - 0x5c]
sub eax, 0xaf328a51
je 0x18005489d
jmp 0x1800539b5
mov eax, dword [rbp - 0x5c]
sub eax, 0xb4b8ae18
je 0x180054395
jmp 0x1800539c8
mov eax, dword [rbp - 0x5c]
sub eax, 0xbd78e056
je 0x1800547d9
jmp 0x1800539db
mov eax, dword [rbp - 0x5c]
sub eax, 0xbed7cbf1
je 0x1800541c4
jmp 0x1800539ee
mov eax, dword [rbp - 0x5c]
sub eax, 0xc5913cfb
je 0x18005463a
jmp 0x180053a01
mov eax, dword [rbp - 0x5c]
sub eax, 0xcc45e7e8
je 0x180053f29
jmp 0x180053a14
mov eax, dword [rbp - 0x5c]
sub eax, 0xd06d97ba
je 0x180054853
jmp 0x180053a27
mov eax, dword [rbp - 0x5c]
sub eax, 0xd304aecc
je 0x180053ece
jmp 0x180053a3a
mov eax, dword [rbp - 0x5c]
sub eax, 0xd41dc7d9
je 0x180053f95
jmp 0x180053a4d
mov eax, dword [rbp - 0x5c]
sub eax, 0xd7d052df
je 0x180053fbd
jmp 0x180053a60
mov eax, dword [rbp - 0x5c]
sub eax, 0xd9fc1544
je 0x1800548e5
jmp 0x180053a73
mov eax, dword [rbp - 0x5c]
sub eax, 0xdc031908
je 0x18005481f
jmp 0x180053a86
mov eax, dword [rbp - 0x5c]
sub eax, 0xdc585c3e
je 0x180054099
jmp 0x180053a99
mov eax, dword [rbp - 0x5c]
sub eax, 0xe0d0463c
je 0x180053da8
jmp 0x180053aac
mov eax, dword [rbp - 0x5c]
sub eax, 0xe826f4a3
je 0x180053e6c
jmp 0x180053abf
mov eax, dword [rbp - 0x5c]
sub eax, 0xeeb6c0f8
je 0x1800542ec
jmp 0x180053ad2
mov eax, dword [rbp - 0x5c]
sub eax, 0xefbc5876
je 0x180053e3e
jmp 0x180053ae5
mov eax, dword [rbp - 0x5c]
sub eax, 0xf0324fbb
je 0x18005408d
jmp 0x180053af8
mov eax, dword [rbp - 0x5c]
sub eax, 0xf1ebb8cc
je 0x1800540a5
jmp 0x180053b0b
mov eax, dword [rbp - 0x5c]
sub eax, 0xfb7517e9
je 0x18005419b
jmp 0x180053b1e
mov eax, dword [rbp - 0x5c]
sub eax, 0xfcc48dd9
je 0x1800546af
jmp 0x180053b31
mov eax, dword [rbp - 0x5c]
sub eax, 0xfe639511
je 0x180054180
jmp 0x180053b44
mov eax, dword [rbp - 0x5c]
sub eax, 0x92e4da4
je 0x1800548f5
jmp 0x180053b57
mov eax, dword [rbp - 0x5c]
sub eax, 0x97fa61d
je 0x1800543b0
jmp 0x180053b6a
mov eax, dword [rbp - 0x5c]
sub eax, 0xc054393
je 0x180054169
jmp 0x180053b7d
mov eax, dword [rbp - 0x5c]
sub eax, 0xee2dae2
je 0x180053f1d
jmp 0x180053b90
mov eax, dword [rbp - 0x5c]
sub eax, 0x11bbb0be
je 0x180054885
jmp 0x180053ba3
mov eax, dword [rbp - 0x5c]
sub eax, 0x13670f8b
je 0x18005400c
jmp 0x180053bb6
mov eax, dword [rbp - 0x5c]
sub eax, 0x1add12bc
je 0x1800542e0
jmp 0x180053bc9
mov eax, dword [rbp - 0x5c]
sub eax, 0x20cbb3ec
je 0x180054694
jmp 0x180053bdc
mov eax, dword [rbp - 0x5c]
sub eax, 0x21c34314
je 0x180054492
jmp 0x180053bef
mov eax, dword [rbp - 0x5c]
sub eax, 0x2b1a72a0
je 0x180053e7f
jmp 0x180053c02
mov eax, dword [rbp - 0x5c]
sub eax, 0x30a53fd4
je 0x1800543e3
jmp 0x180053c15
mov eax, dword [rbp - 0x5c]
sub eax, 0x3749b929
je 0x1800540d7
jmp 0x180053c28
mov eax, dword [rbp - 0x5c]
sub eax, 0x4ac99fe6
je 0x1800544fd
jmp 0x180053c3b
mov eax, dword [rbp - 0x5c]
sub eax, 0x583dd5f4
je 0x1800544f1
jmp 0x180053c4e
mov eax, dword [rbp - 0x5c]
sub eax, 0x5b617a3e
je 0x1800545f0
jmp 0x180053c61
mov eax, dword [rbp - 0x5c]
sub eax, 0x5c0f9e1e
je 0x180054411
jmp 0x180053c74
mov eax, dword [rbp - 0x5c]
sub eax, 0x5ca40e62
je 0x1800541d9
jmp 0x180053c87
mov eax, dword [rbp - 0x5c]
sub eax, 0x5de83e27
je 0x1800546f1
jmp 0x180053c9a
mov eax, dword [rbp - 0x5c]
sub eax, 0x62d30b91
je 0x1800546c6
jmp 0x180053cad
mov eax, dword [rbp - 0x5c]
sub eax, 0x64f09047
je 0x180053d37
jmp 0x180053cc0
mov eax, dword [rbp - 0x5c]
sub eax, 0x66741ee7
je 0x180054336
jmp 0x180053cd3
mov eax, dword [rbp - 0x5c]
sub eax, 0x6b993654
je 0x180054922
jmp 0x180053ce6
mov eax, dword [rbp - 0x5c]
sub eax, 0x6cd8bee0
je 0x1800547f0
jmp 0x180053cf9
mov eax, dword [rbp - 0x5c]
sub eax, 0x6e317837
je 0x1800545cd
jmp 0x180053d0c
mov eax, dword [rbp - 0x5c]
sub eax, 0x79152ba3
je 0x180053f63
jmp 0x180053d1f
mov eax, dword [rbp - 0x5c]
sub eax, 0x7d0df1c0
je 0x180054762
jmp 0x180053d32
jmp 0x18005492d
mov eax, 0x10
mov qword [rbp - 0x68], rax
call fcn.1800e0a50
sub rsp, rax
mov rax, qword [rbp - 0x68]
mov rcx, rsp
mov qword [rbp - 0x38], rcx
call fcn.1800e0a50
sub rsp, rax
mov rax, qword [rbp - 0x68]
mov rcx, rsp
mov qword [rbp - 0x30], rcx
call fcn.1800e0a50
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x28], rax
mov eax, 0x240
call fcn.1800e0a50
sub rsp, rax
mov rax, qword [rbp - 0x68]
mov rcx, rsp
mov qword [rbp - 0x20], rcx
call fcn.1800e0a50
sub rsp, rax
mov rax, rsp
mov qword [rbp - 0x18], rax
mov dword [rbp - 0x40], 0xe0d0463c
jmp 0x18005492d
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x58]
mov eax, 0x10
mov qword [rbp - 0x70], rax
call fcn.1800e0a50
sub rsp, rax
mov rax, qword [rbp - 0x70]
mov r8, rsp
mov qword [rbp - 0x10], r8
call fcn.1800e0a50
sub rsp, rax
mov rax, qword [rbp - 0x70]
mov r8, rsp
mov qword [rbp - 8], r8
call fcn.1800e0a50
sub rsp, rax
mov rax, qword [rbp - 0x70]
mov r8, rsp
mov qword [rbp], r8
call fcn.1800e0a50
sub rsp, rax
mov rax, rsp
mov qword [rbp + 8], rax
mov rax, qword [rbp - 0x38]
mov qword [rax], rdx
mov rax, qword [rbp - 0x30]
mov qword [rax], rcx
mov rax, qword [rbp - 0x30]
mov rax, qword [rax]
mov qword [rbp + 0x10], rax
mov ecx, 2
xor edx, edx
sub rsp, 0x20
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
add rsp, 0x20
mov qword [rbp + 0x18], rax
mov dword [rbp - 0x40], 0xefbc5876
jmp 0x18005492d
mov rax, qword [rbp - 0x28]
mov rcx, qword [rbp + 0x18]
mov qword [rax], rcx
mov rdx, qword [rbp - 0x28]
mov r8, 0xffffffffffffffff
mov eax, 0xcc45e7e8
mov ecx, 0xe826f4a3
cmp qword [rdx], r8
cmove eax, ecx
mov dword [rbp - 0x40], eax
jmp 0x18005492d
mov dword [rbp - 0x3c], 0xffffffff
mov dword [rbp - 0x40], 0x2b1a72a0
jmp 0x18005492d
mov eax, dword [0x18184c924]
mov ecx, dword [0x18184c920]
mov edx, eax
sub edx, 0xefd6cfd5
sub edx, 1
add edx, 0xefd6cfd5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x11bbb0be
mov ecx, 0xd304aecc
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x40], eax
jmp 0x18005492d
mov eax, dword [0x18184c924]
mov ecx, dword [0x18184c920]
mov edx, eax
sub edx, 0xed47719f
sub edx, 1
add edx, 0xed47719f
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x11bbb0be
mov ecx, 0xee2dae2
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x40], eax
jmp 0x18005492d
mov dword [rbp - 0x40], 0xd06d97ba
jmp 0x18005492d
mov rcx, qword [rbp - 0x20]
xor edx, edx
mov r8d, 0x238
sub rsp, 0x20
call sub.msvcrt.dll_memset
add rsp, 0x20
mov rax, qword [rbp - 0x20]
mov dword [rax], 0x238
mov rax, qword [rbp - 0x28]
mov rax, qword [rax]
mov qword [rbp + 0x20], rax
mov dword [rbp - 0x40], 0x79152ba3
jmp 0x18005492d
mov rdx, qword [rbp - 0x20]
mov rcx, qword [rbp + 0x20]
sub rsp, 0x20
call sub.KERNEL32.dll_Process32FirstW
add rsp, 0x20
mov r8d, eax
xor edx, edx
mov eax, 0xdc585c3e
mov ecx, 0xd41dc7d9
cmp edx, r8d
cmove eax, ecx
mov dword [rbp - 0x40], eax
jmp 0x18005492d
mov rax, qword [rbp - 0x28]
mov rcx, qword [rax]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
mov dword [rbp - 0x3c], 0xffffffff
mov dword [rbp - 0x40], 0xd7d052df
jmp 0x18005492d
mov eax, dword [0x18184c924]
mov ecx, dword [0x18184c920]
mov edx, eax
add edx, 0xefd60017
sub edx, 1
sub edx, 0xefd60017
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x9d2e8acd
mov ecx, 0x13670f8b
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x40], eax
jmp 0x18005492d
mov ecx, dword [0x18184c924]
mov eax, dword [0x18184c920]
mov edx, ecx
add edx, 0x1520f5cb
sub edx, 1
sub edx, 0x1520f5cb
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x9d2e8acd
mov ecx, 0xf0324fbb
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x40], eax
jmp 0x18005492d
mov dword [rbp - 0x40], 0xd06d97ba
jmp 0x18005492d
mov dword [rbp - 0x40], 0xf1ebb8cc
jmp 0x18005492d
mov rcx, qword [0x18184c428]
mov rax, qword [rcx]
sub rsp, 0x20
call qword [rax + 0x30]
add rsp, 0x20
movzx eax, al
cmp eax, 6
setge al
and al, 1
mov byte [rbp + 0x2c], al
mov al, byte [rbp + 0x2c]
mov dword [rbp - 0x40], 0x3749b929
jmp 0x18005492d
mov dl, byte [rbp + 0x2c]
mov ecx, 0x400
mov eax, 0x1000
test dl, 1
cmovne ecx, eax
mov rax, qword [rbp - 0x18]
mov dword [rax], ecx
mov rax, qword [rbp - 0x20]
mov r8d, dword [rax + 8]
mov rax, qword [rbp - 0x18]
mov ecx, dword [rax]
xor edx, edx
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_OpenProcess]
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 0x10]
mov qword [rax], rcx
mov rax, qword [rbp - 8]
mov qword [rax], 0
mov rax, qword [rbp]
mov dword [rax], 0
mov rcx, qword [rbp + 0x10]
sub rsp, 0x20
call fcn.1800553b0
add rsp, 0x20
mov cl, al
and cl, 1
mov rax, qword [rbp + 8]
mov byte [rax], cl
mov r8, qword [rbp - 0x10]
xor eax, eax
mov edx, eax
mov eax, 0x8ff4e6da
mov ecx, 0xc054393
cmp rdx, qword [r8]
cmovne eax, ecx
mov dword [rbp - 0x40], eax
jmp 0x18005492d
mov rax, qword [rbp + 8]
mov al, byte [rax]
and al, 1
mov byte [rbp + 0x2d], al
mov dword [rbp - 0x40], 0xfe639511
jmp 0x18005492d
mov dl, byte [rbp + 0x2d]
mov eax, 0xfb7517e9
mov ecx, 0x5ca40e62
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x40], eax
jmp 0x18005492d
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax]
mov rcx, qword [rbp + 0x10]
sub rsp, 0x20
call fcn.180055770
add rsp, 0x20
and al, 1
mov byte [rbp + 0x2e], al
mov dword [rbp - 0x40], 0xbed7cbf1
jmp 0x18005492d
mov rax, qword [rbp + 8]
mov cl, byte [rbp + 0x2e]
mov byte [rax], cl
mov dword [rbp - 0x40], 0x5ca40e62
jmp 0x18005492d
mov eax, dword [0x18184c924]
mov ecx, dword [0x18184c920]
mov edx, eax
add edx, 0xb7c0cad5
sub edx, 1
sub edx, 0xb7c0cad5
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xaf328a51
mov ecx, 0xa1e5530c
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x40], eax
jmp 0x18005492d
mov rax, qword [rbp - 0x20]
mov edx, dword [rax + 8]
mov rcx, qword [rbp + 0x10]
sub rsp, 0x20
call fcn.180055e70
add rsp, 0x20
mov ecx, eax
mov rax, qword [rbp]
mov dword [rax], ecx
mov ecx, 0x800
sub rsp, 0x20
call sub.msvcrt.dll_malloc
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 8]
mov qword [rax], rcx
mov ecx, dword [0x18184c924]
mov eax, dword [0x18184c920]
xor r8d, r8d
sub r8d, 1
mov edx, ecx
add edx, r8d
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0xaf328a51
mov ecx, 0x1add12bc
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x40], eax
jmp 0x18005492d
mov dword [rbp - 0x40], 0xeeb6c0f8
jmp 0x18005492d
mov eax, dword [0x18184c924]
mov ecx, dword [0x18184c920]
xor r8d, r8d
sub r8d, 1
mov edx, eax
add edx, r8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd9fc1544
mov ecx, 0x66741ee7
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x40], eax
jmp 0x18005492d
mov rax, qword [rbp - 8]
cmp qword [rax], 0
setne al
and al, 1
mov byte [rbp + 0x2f], al
mov eax, dword [0x18184c924]
mov ecx, dword [0x18184c920]
mov edx, eax
sub edx, 0x6fb4148d
sub edx, 1
add edx, 0x6fb4148d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0xd9fc1544
mov ecx, 0xb4b8ae18
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x40], eax
jmp 0x18005492d
mov dl, byte [rbp + 0x2f]
mov eax, 0x5c0f9e1e
mov ecx, 0x97fa61d
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x40], eax
jmp 0x18005492d
mov rax, qword [rbp - 8]
mov rcx, qword [rax]
xor edx, edx
mov r8d, 0x800
sub rsp, 0x20
call sub.msvcrt.dll_memset
add rsp, 0x20
mov rax, qword [rbp - 8]
mov rax, qword [rax]
mov qword [rbp + 0x30], rax
mov dword [rbp - 0x40], 0x30a53fd4
jmp 0x18005492d
mov rax, qword [rbp - 0x10]
mov rdx, qword [rax]
mov rcx, qword [rbp + 0x10]
mov r8, qword [rbp + 0x30]
mov r9d, 0x800
sub rsp, 0x20
call fcn.180056100
add rsp, 0x20
mov dword [rbp - 0x40], 0x5c0f9e1e
jmp 0x18005492d
mov ecx, dword [0x18184c924]
mov eax, dword [0x18184c920]
mov edx, ecx
sub edx, 0x593fdb6a
sub edx, 1
add edx, 0x593fdb6a
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 0
mov dl, al
and dl, 0
and r11b, cl
mov r9b, r8b
and r9b, 0
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 0
and al, cl
or dl, al
mov eax, 0x92e4da4
mov ecx, 0x21c34314
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x40], eax
jmp 0x18005492d
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
mov eax, dword [0x18184c924]
mov ecx, dword [0x18184c920]
xor r8d, r8d
sub r8d, 1
mov edx, eax
add edx, r8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x92e4da4
mov ecx, 0x583dd5f4
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x40], eax
jmp 0x18005492d
mov dword [rbp - 0x40], 0x4ac99fe6
jmp 0x18005492d
mov ecx, dword [0x18184c924]
mov eax, dword [0x18184c920]
mov edx, ecx
sub edx, 0xca6a8f48
sub edx, 1
add edx, 0xca6a8f48
imul ecx, edx
and ecx, 1
cmp ecx, 0
sete r11b
cmp eax, 0xa
setl r10b
mov al, r11b
xor al, 0xff
mov r8b, r10b
xor r8b, 0xff
mov cl, 1
xor cl, 1
mov dl, al
and dl, 0xff
and r11b, cl
mov r9b, r8b
and r9b, 0xff
and r10b, cl
or dl, r11b
or r9b, r10b
xor dl, r9b
or al, r8b
xor al, 0xff
or cl, 1
and al, cl
or dl, al
mov eax, 0x88f0baff
mov ecx, 0x9a3031e9
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x40], eax
jmp 0x18005492d
mov eax, dword [0x18184c924]
mov ecx, dword [0x18184c920]
mov edx, eax
add edx, 0x1e4be42e
sub edx, 1
sub edx, 0x1e4be42e
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x88f0baff
mov ecx, 0x6e317837
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x40], eax
jmp 0x18005492d
mov dword [rbp - 0x40], 0x8ff4e6da
jmp 0x18005492d
mov rax, qword [rbp - 0x38]
mov rax, qword [rax]
mov qword [rbp + 0x38], rax
mov dword [rbp - 0x40], 0x5b617a3e
jmp 0x18005492d
mov eax, dword [0x18184c924]
mov ecx, dword [0x18184c920]
xor r8d, r8d
sub r8d, 1
mov edx, eax
add edx, r8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6b993654
mov ecx, 0xc5913cfb
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x40], eax
jmp 0x18005492d
mov rax, qword [rbp - 8]
cmp qword [rax], 0
sete al
and al, 1
mov byte [rbp + 0x47], al
mov eax, dword [0x18184c924]
mov ecx, dword [0x18184c920]
xor r8d, r8d
sub r8d, 1
mov edx, eax
add edx, r8d
imul eax, edx
and eax, 1
cmp eax, 0
sete al
cmp ecx, 0xa
setl cl
mov dl, al
and dl, cl
xor al, cl
or dl, al
mov eax, 0x6b993654
mov ecx, 0x20cbb3ec
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x40], eax
jmp 0x18005492d
mov dl, byte [rbp + 0x47]
mov eax, 0x62d30b91
mov ecx, 0xfcc48dd9
test dl, 1
cmovne eax, ecx
mov dword [rbp - 0x40], eax
jmp 0x18005492d
mov dword [rbp - 0x40], 0x5de83e27
lea rax, [0x1800e2938]
mov qword [rbp - 0x48], rax
jmp 0x18005492d
mov rax, qword [rbp - 8]
mov rax, qword [rax]
mov qword [rbp + 0x48], rax
mov dword [rbp - 0x40], 0x837274fe
jmp 0x18005492d
mov dword [rbp - 0x40], 0x5de83e27
mov rax, qword [rbp + 0x48]
mov qword [rbp - 0x48], rax
jmp 0x18005492d
mov r10, qword [rbp - 0x48]
mov r11, qword [rbp - 0x20]
add r11, 0x2c
mov rax, qword [rbp + 8]
mov bl, byte [rax]
mov rax, qword [rbp - 0x20]
mov r9d, dword [rax + 0x20]
mov rax, qword [rbp - 0x20]
mov r8d, dword [rax + 8]
mov rax, qword [rbp]
mov edx, dword [rax]
mov rax, qword [rbp + 0x38]
mov rax, qword [rax]
mov rax, qword [rax]
mov rcx, qword [rbp + 0x38]
and bl, 1
sub rsp, 0x40
mov byte [rsp + 0x20], bl
mov qword [rsp + 0x28], r11
mov qword [rsp + 0x30], r10
call rax
add rsp, 0x40
mov r8, qword [rbp - 0x10]
xor eax, eax
mov edx, eax
mov eax, 0xa7a8a347
mov ecx, 0x7d0df1c0
cmp rdx, qword [r8]
cmovne eax, ecx
mov dword [rbp - 0x40], eax
jmp 0x18005492d
mov rax, qword [rbp - 8]
mov rax, qword [rax]
mov qword [rbp + 0x50], rax
mov dword [rbp - 0x40], 0x9f484ae1
jmp 0x18005492d
mov rcx, qword [rbp + 0x50]
sub rsp, 0x20
call fcn.1800d8bf7
add rsp, 0x20
mov dword [rbp - 0x40], 0xa7a8a347
jmp 0x18005492d
mov rax, qword [rbp - 0x20]
mov qword [rbp + 0x58], rax
mov dword [rbp - 0x40], 0xa4908f58
jmp 0x18005492d
mov rcx, qword [rbp + 0x58]
xor edx, edx
mov r8d, 0x238
sub rsp, 0x20
call sub.msvcrt.dll_memset
add rsp, 0x20
mov rax, qword [rbp - 0x20]
mov dword [rax], 0x238
mov dword [rbp - 0x40], 0xbd78e056
jmp 0x18005492d
mov rax, qword [rbp - 0x28]
mov rax, qword [rax]
mov qword [rbp + 0x60], rax
mov dword [rbp - 0x40], 0x6cd8bee0
jmp 0x18005492d
mov rdx, qword [rbp - 0x20]
mov rcx, qword [rbp + 0x60]
sub rsp, 0x20
call sub.KERNEL32.dll_Process32NextW
add rsp, 0x20
mov edx, eax
mov eax, 0xdc031908
mov ecx, 0xf1ebb8cc
cmp edx, 0
cmovne eax, ecx
mov dword [rbp - 0x40], eax
jmp 0x18005492d
mov rax, qword [rbp - 0x28]
mov rcx, qword [rax]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
mov dword [rbp - 0x3c], 0
mov dword [rbp - 0x40], 0x9d810324
jmp 0x18005492d
mov dword [rbp - 0x40], 0xd06d97ba
jmp 0x18005492d
mov eax, dword [rbp - 0x3c]
mov dword [rbp + 0x6c], eax
mov dword [rbp - 0x40], 0x9d03ade5
jmp 0x18005492d
mov eax, dword [rbp + 0x6c]
mov dword [rbp - 0x74], eax
mov rcx, qword [rbp + 0x70]
xor rcx, rbp
sub rsp, 0x20
call fcn.1800e09d0
mov eax, dword [rbp - 0x74]
lea rsp, [rbp + 0x78]
pop rbx
pop rbp
ret
mov dword [rbp - 0x40], 0xd304aecc
jmp 0x18005492d
mov dword [rbp - 0x40], 0x13670f8b
jmp 0x18005492d
mov rax, qword [rbp - 0x20]
mov edx, dword [rax + 8]
mov rcx, qword [rbp + 0x10]
sub rsp, 0x20
call fcn.180055e70
add rsp, 0x20
mov ecx, eax
mov rax, qword [rbp]
mov dword [rax], ecx
mov ecx, 0x800
sub rsp, 0x20
call sub.msvcrt.dll_malloc
add rsp, 0x20
mov rcx, rax
mov rax, qword [rbp - 8]
mov qword [rax], rcx
mov dword [rbp - 0x40], 0xa1e5530c
jmp 0x18005492d
mov rax, qword [rbp - 8]
mov dword [rbp - 0x40], 0x66741ee7
jmp 0x18005492d
mov rax, qword [rbp - 0x10]
mov rcx, qword [rax]
sub rsp, 0x20
call qword [sym.imp.KERNEL32.dll_CloseHandle]
add rsp, 0x20
mov dword [rbp - 0x40], 0x21c34314
jmp 0x18005492d
mov dword [rbp - 0x40], 0x9a3031e9
jmp 0x18005492d
mov rax, qword [rbp - 8]
mov dword [rbp - 0x40], 0xc5913cfb
jmp 0x1800538ce