Function at 0x140033bc0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x6f0]
sub rsp, 0x7f0
mov rax, qword [0x14037da00]
xor rax, rsp
mov qword [rbp + 0x6e0], rax
mov r13d, r8d
mov r12, rdx
mov r15, rcx
xor esi, esi
mov byte [rsp + 0x40], sil
mov r14d, esi
xorps xmm0, xmm0
movups xmmword [rbp + 0x398], xmm0
mov qword [rbp + 0x3a8], rsi
mov qword [rbp + 0x3b0], SHCreateThread
mov byte [rbp + 0x398], 0
movups xmmword [rbp + 0x3d8], xmm0
mov qword [rbp + 0x3e8], rsi
mov qword [rbp + 0x3f0], SHCreateThread
mov byte [rbp + 0x3d8], 0
movups xmmword [rbp + 0x378], xmm0
mov qword [rbp + 0x388], rsi
mov qword [rbp + 0x390], SHCreateThread
mov byte [rbp + 0x378], 0
xor dil, dil
lea r9, [rbp + 0x378]
lea r8, [rbp + 0x3d8]
lea rdx, [rbp + 0x398]
mov ecx, r14d
call fcn.14002bb60
test al, al
je 0x140033d75
lea rcx, [rbp + 0x398]
cmp qword [rbp + 0x3b0], 0xf
jbe 0x140033cb0
mov rcx, qword [rbp + 0x398]
test rcx, rcx
jne 0x140033cb0
mov rax, rsi
jmp 0x140033cc0
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], dil
jne 0x140033cb7
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x88], rcx
movaps xmm0, xmmword [rbp + 0x80]
movdqa xmmword [rbp + 0x260], xmm0
lea rdx, [rbp + 0x260]
lea rcx, [rbp + 0xa8]
call fcn.14008e330
nop
lea rdx, [rbp + 0xa8]
lea rcx, [rbp - 0x70]
call fcn.140042ea0
nop
lea rcx, [rbp - 0x70]
call fcn.140043510
mov edx, 2
lea rcx, [rbp - 0x70]
call fcn.140043210
test al, al
je 0x140033d33
mov rdx, r12
lea rcx, [rbp - 0x70]
call fcn.140049d30
test rax, rax
jle 0x140033d33
mov dil, 1
jmp 0x140033d36
xor dil, dil
lea rcx, [rbp - 0x70]
call fcn.140044880
nop
lea rcx, [rbp - 0x70]
call fcn.140042f80
nop
mov rcx, qword [rbp + 0xa8]
test rcx, rcx
je 0x140033d75
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
setne al
test al, al
jne 0x140033d75
mov rcx, qword [rbp + 0xa8]
call fcn.14021b810
mov edx, 0x6f
lea rcx, [rbp + 0x270]
call fcn.140011170
mov rbx, rax
mov rcx, qword [rax]
test rcx, rcx
je 0x140033d98
mov ecx, dword [rcx]
cmp ecx, 1
jle 0x140033daa
mov r8d, 1
mov rdx, qword [rax + 0x10]
mov rcx, rbx
call fcn.14003f770
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140033dcb
mov rax, 0xffffffffffffffff
nop word [rax + rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140033dc0
jmp 0x140033dce
mov rax, rsi
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], rcx
movaps xmm0, xmmword [rbp - 0x30]
movdqa xmmword [rbp + 0x1b0], xmm0
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0xc0]
call fcn.14008e330
nop
mov r8d, esi
test dil, dil
setne r8b
mov dword [rsp + 0x20], esi
mov r9d, r14d
lea rdx, [rbp + 0xc0]
mov rcx, r15
call fcn.140032cb0
nop
mov rcx, qword [rbp + 0xc0]
test rcx, rcx
je 0x140033e43
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
setne al
test al, al
jne 0x140033e43
mov rcx, qword [rbp + 0xc0]
call fcn.14021b810
nop
mov rcx, qword [rbp + 0x270]
test rcx, rcx
je 0x140033e6e
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
setne al
test al, al
jne 0x140033e6e
mov rcx, qword [rbp + 0x270]
call fcn.14021b810
test dil, dil
jne 0x140034030
mov edx, 0xe1
lea rcx, [rbp + 0x288]
call fcn.140011170
mov rbx, rax
mov rcx, qword [rax]
test rcx, rcx
je 0x140033e9a
mov ecx, dword [rcx]
cmp ecx, 1
jle 0x140033eac
mov r8d, 1
mov rdx, qword [rax + 0x10]
mov rcx, rbx
call fcn.14003f770
mov rdx, qword [rbx + 8]
xorps xmm0, xmm0
movups xmmword [rbp + 0x3f8], xmm0
mov qword [rbp + 0x408], rsi
mov qword [rbp + 0x410], rsi
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x140033ed0
lea rcx, [rbp + 0x3f8]
call fcn.140006bb0
nop
lea rcx, [rbp + 0x398]
cmp qword [rbp + 0x3b0], 0xf
jbe 0x140033f09
mov rcx, qword [rbp + 0x398]
test rcx, rcx
jne 0x140033f09
mov rax, rsi
jmp 0x140033f19
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140033f10
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], rcx
movaps xmm0, xmmword [rbp - 0x20]
movdqa xmmword [rbp + 0x240], xmm0
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0xd8]
call fcn.14008e330
nop
lea rdx, [rbp + 0xd8]
lea rcx, [rsp + 0x60]
call fcn.1400ab680
nop
mov rcx, qword [rbp + 0xd8]
test rcx, rcx
je 0x140033f7e
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
setne al
test al, al
jne 0x140033f7e
mov rcx, qword [rbp + 0xd8]
call fcn.14021b810
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x60]
call fcn.1400aba50
nop
mov rcx, rax
call fcn.1400aa030
nop
lea rcx, [rbp - 0x60]
call fcn.1400a6a70
nop
lea rcx, [rsp + 0x60]
call fcn.1400ab8e0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rbp + 0x410]
cmp rdx, 0xf
jbe 0x140033ff8
inc rdx
mov rcx, qword [rbp + 0x3f8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033ff2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400350d4
call fcn.140214360
nop
mov rcx, qword [rbp + 0x288]
test rcx, rcx
je 0x140034e8d
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
setne al
test al, al
jne 0x140034e8d
mov rcx, qword [rbp + 0x288]
call fcn.14021b810
jmp 0x140034e8d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0x398]
cmp qword [rbp + 0x3b0], 0xf
jbe 0x14003405d
mov rcx, qword [rbp + 0x398]
test rcx, rcx
jne 0x14003405d
mov rax, rsi
jmp 0x14003406d
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140034064
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rcx
movaps xmm0, xmmword [rbp - 0x10]
movdqa xmmword [rbp + 0x1c0], xmm0
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0xf0]
call fcn.14008e330
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], rsi
lea rdx, [rbp + 0xf0]
lea rcx, [rsp + 0x68]
call fcn.140042ea0
nop
lea rcx, [rsp + 0x68]
call fcn.140043150
test al, al
je 0x1400341a9
mov edx, 1
lea rcx, [rsp + 0x68]
call fcn.140043210
test al, al
je 0x1400341a9
lea rdx, [rbp + 0x2a0]
lea rcx, [rsp + 0x68]
call fcn.1400487f0
mov rdx, qword [rsp + 0x48]
mov rcx, qword [rax]
mov qword [rsp + 0x48], rcx
mov qword [rax], rdx
mov rdx, qword [rsp + 0x50]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x50], rcx
mov qword [rax + 8], rdx
mov rdx, qword [rsp + 0x58]
mov rcx, qword [rax + 0x10]
mov qword [rsp + 0x58], rcx
mov qword [rax + 0x10], rdx
mov rcx, qword [rbp + 0x2a0]
test rcx, rcx
je 0x14003414e
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
setne al
test al, al
jne 0x14003414e
mov rcx, qword [rbp + 0x2a0]
call fcn.14021b810
lea rcx, [rsp + 0x68]
call fcn.140044880
cmp qword [rsp + 0x58], 0
setg bl
lea rcx, [rsp + 0x68]
call fcn.140042f80
test bl, bl
je 0x1400341b4
lea rdx, [r15 + 0x60]
lea rcx, [rsp + 0x48]
call fcn.14002b920
movzx edi, al
mov rdx, qword [rsp + 0x48]
test rdx, rdx
je 0x1400341de
mov ecx, 0xffffffff
lock xadd dword [rdx], ecx
cmp ecx, 1
setne cl
test cl, cl
jne 0x1400341de
mov rcx, qword [rsp + 0x48]
call fcn.14021b810
jmp 0x1400341de
lea rcx, [rsp + 0x68]
call fcn.140042f80
nop
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1400341db
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
setne al
test al, al
jne 0x1400341db
mov rcx, qword [rsp + 0x48]
call fcn.14021b810
xor dil, dil
mov rcx, qword [rbp + 0xf0]
test rcx, rcx
je 0x140034209
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
setne al
test al, al
jne 0x140034209
mov rcx, qword [rbp + 0xf0]
call fcn.14021b810
mov edx, 0x70
lea rcx, [rbp + 0x2b8]
call fcn.140011170
mov rbx, rax
mov rcx, qword [rax]
test rcx, rcx
je 0x14003422c
mov ecx, dword [rcx]
cmp ecx, 1
jle 0x14003423e
mov r8d, 1
mov rdx, qword [rax + 0x10]
mov rcx, rbx
call fcn.14003f770
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14003425b
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x140034250
jmp 0x14003425e
mov rax, rsi
mov qword [rbp], rax
mov qword [rbp + 8], rcx
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp + 0x1d0], xmm0
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x108]
call fcn.14008e330
nop
movzx r8d, dil
mov dword [rsp + 0x20], esi
mov r9d, r14d
lea rdx, [rbp + 0x108]
mov rcx, r15
call fcn.140032cb0
nop
mov rcx, qword [rbp + 0x108]
test rcx, rcx
je 0x1400342cd
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
setne al
test al, al
jne 0x1400342cd
mov rcx, qword [rbp + 0x108]
call fcn.14021b810
nop
mov rcx, qword [rbp + 0x2b8]
test rcx, rcx
je 0x1400342f8
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
setne al
test al, al
jne 0x1400342f8
mov rcx, qword [rbp + 0x2b8]
call fcn.14021b810
test dil, dil
jne 0x1400344c0
mov edx, 0xe2
lea rcx, [rbp + 0x2d0]
call fcn.140011170
mov rbx, rax
mov rcx, qword [rax]
test rcx, rcx
je 0x140034324
mov ecx, dword [rcx]
cmp ecx, 1
jle 0x140034336
mov r8d, 1
mov rdx, qword [rax + 0x10]
mov rcx, rbx
call fcn.14003f770
mov rdx, qword [rbx + 8]
xorps xmm0, xmm0
movups xmmword [rbp + 0x418], xmm0
mov qword [rbp + 0x428], rsi
mov qword [rbp + 0x430], rsi
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140034360
lea rcx, [rbp + 0x418]
call fcn.140006bb0
nop
lea rcx, [rbp + 0x398]
cmp qword [rbp + 0x3b0], 0xf
jbe 0x140034399
mov rcx, qword [rbp + 0x398]
test rcx, rcx
jne 0x140034399
mov rax, rsi
jmp 0x1400343a9
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1400343a0
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], rcx
movaps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x1e0], xmm0
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x90]
call fcn.14008e330
nop
lea rdx, [rbp + 0x90]
lea rcx, [rsp + 0x78]
call fcn.1400ab680
nop
mov rcx, qword [rbp + 0x90]
test rcx, rcx
je 0x14003440e
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
setne al
test al, al
jne 0x14003440e
mov rcx, qword [rbp + 0x90]
call fcn.14021b810
lea rdx, [rbp - 0x58]
lea rcx, [rsp + 0x78]
call fcn.1400aba50
nop
mov rcx, rax
call fcn.1400aa030
nop
lea rcx, [rbp - 0x58]
call fcn.1400a6a70
nop
lea rcx, [rsp + 0x78]
call fcn.1400ab8e0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rbp + 0x430]
cmp rdx, 0xf
jbe 0x140034488
inc rdx
mov rcx, qword [rbp + 0x418]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034482
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400350da
call fcn.140214360
nop
mov rcx, qword [rbp + 0x2d0]
test rcx, rcx
je 0x140034e8d
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
setne al
test al, al
jne 0x140034e8d
mov rcx, qword [rbp + 0x2d0]
call fcn.14021b810
jmp 0x140034e8d
lea rcx, [rbp + 0x398]
cmp qword [rbp + 0x3b0], 0xf
cmova rcx, qword [rbp + 0x398]
mov dword [rsp + 0x28], 0x80
mov edx, 0xa0000000
call fcn.140025d80
mov rdi, rax
test rax, rax
je 0x1400344f9
mov rcx, rax
call fcn.140024ff0
mov edx, 0x71
lea rcx, [rbp + 0x2e8]
call fcn.140011170
mov rbx, rax
mov rcx, qword [rax]
test rcx, rcx
je 0x14003451c
mov ecx, dword [rcx]
cmp ecx, 1
jle 0x14003452e
mov r8d, 1
mov rdx, qword [rax + 0x10]
mov rcx, rbx
call fcn.14003f770
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14003454b
mov rax, 0xffffffffffffffff
nop
inc rax
cmp byte [rcx + rax], 0
jne 0x140034540
jmp 0x14003454e
mov rax, rsi
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rcx
movaps xmm0, xmmword [rbp + 0x20]
movdqa xmmword [rbp + 0x1f0], xmm0
lea rdx, [rbp + 0x1f0]
lea rcx, [rbp + 0x120]
call fcn.14008e330
nop
mov r8d, esi
test rdi, rdi
setne r8b
mov dword [rsp + 0x20], esi
mov r9d, r14d
lea rdx, [rbp + 0x120]
mov rcx, r15
call fcn.140032cb0
nop
mov rcx, qword [rbp + 0x120]
test rcx, rcx
je 0x1400345c3
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
setne al
test al, al
jne 0x1400345c3
mov rcx, qword [rbp + 0x120]
call fcn.14021b810
nop
mov rcx, qword [rbp + 0x2e8]
test rcx, rcx
je 0x1400345ee
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
setne al
test al, al
jne 0x1400345ee
mov rcx, qword [rbp + 0x2e8]
call fcn.14021b810
test rdi, rdi
jne 0x1400347ad
mov edx, 0xe3
lea rcx, [rbp + 0x300]
call fcn.140011170
mov rbx, rax
mov rcx, qword [rax]
test rcx, rcx
je 0x14003461a
mov ecx, dword [rcx]
cmp ecx, 1
jle 0x14003462c
mov r8d, 1
mov rdx, qword [rax + 0x10]
mov rcx, rbx
call fcn.14003f770
mov rdx, qword [rbx + 8]
xorps xmm0, xmm0
movups xmmword [rbp + 0x438], xmm0
mov qword [rbp + 0x448], rsi
mov qword [rbp + 0x450], rsi
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x140034650
lea rcx, [rbp + 0x438]
call fcn.140006bb0
nop
lea rcx, [rbp + 0x398]
cmp qword [rbp + 0x3b0], 0xf
jbe 0x140034689
mov rcx, qword [rbp + 0x398]
test rcx, rcx
jne 0x140034689
mov rax, rsi
jmp 0x140034699
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140034690
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rcx
movaps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x210], xmm0
lea rdx, [rbp + 0x210]
lea rcx, [rbp + 0x138]
call fcn.14008e330
nop
lea rdx, [rbp + 0x138]
lea rcx, [rbp - 0x80]
call fcn.1400ab680
nop
mov rcx, qword [rbp + 0x138]
test rcx, rcx
je 0x1400346fd
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
setne al
test al, al
jne 0x1400346fd
mov rcx, qword [rbp + 0x138]
call fcn.14021b810
lea rdx, [rbp - 0x50]
lea rcx, [rbp - 0x80]
call fcn.1400aba50
nop
mov rcx, rax
call fcn.1400aa030
nop
lea rcx, [rbp - 0x50]
call fcn.1400a6a70
nop
lea rcx, [rbp - 0x80]
call fcn.1400ab8e0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rbp + 0x450]
cmp rdx, 0xf
jbe 0x140034775
inc rdx
mov rcx, qword [rbp + 0x438]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003476f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400350e0
call fcn.140214360
nop
mov rcx, qword [rbp + 0x300]
test rcx, rcx
je 0x140034e8d
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
setne al
test al, al
jne 0x140034e8d
mov rcx, qword [rbp + 0x300]
call fcn.14021b810
jmp 0x140034e8d
lea rcx, [rbp + 0x398]
cmp qword [rbp + 0x3b0], 0xf
jbe 0x1400347cf
mov rcx, qword [rbp + 0x398]
test rcx, rcx
jne 0x1400347cf
mov rax, rsi
jmp 0x1400347df
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1400347d6
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rcx
movaps xmm0, xmmword [rbp + 0x40]
movdqa xmmword [rbp + 0x220], xmm0
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x150]
call fcn.14008e330
nop
mov edx, r13d
lea rcx, [rbp + 0x150]
call fcn.140035100
mov rbx, rax
mov qword [rbp - 0x48], rax
mov rcx, qword [rbp + 0x150]
test rcx, rcx
je 0x140034848
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
setne al
test al, al
jne 0x140034848
mov rcx, qword [rbp + 0x150]
call fcn.14021b810
mov edx, 0x72
lea rcx, [rbp + 0x318]
call fcn.140011170
mov rdi, rax
mov rcx, qword [rax]
test rcx, rcx
je 0x14003486b
mov ecx, dword [rcx]
cmp ecx, 1
jle 0x14003487d
mov r8d, 1
mov rdx, qword [rax + 0x10]
mov rcx, rdi
call fcn.14003f770
mov rcx, qword [rdi + 8]
test rcx, rcx
je 0x14003489b
mov rax, 0xffffffffffffffff
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140034890
jmp 0x14003489e
mov rax, rsi
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rcx
movaps xmm0, xmmword [rbp + 0x50]
movdqa xmmword [rbp + 0x230], xmm0
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0x168]
call fcn.14008e330
nop
mov eax, dword [rbp - 0x44]
mov dword [rsp + 0x20], eax
mov r9d, r14d
mov r8d, ebx
lea rdx, [rbp + 0x168]
mov rcx, r15
call fcn.140032cb0
nop
mov rcx, qword [rbp + 0x168]
test rcx, rcx
je 0x14003490f
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
setne al
test al, al
jne 0x14003490f
mov rcx, qword [rbp + 0x168]
call fcn.14021b810
nop
mov rcx, qword [rbp + 0x318]
test rcx, rcx
je 0x14003493a
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
setne al
test al, al
jne 0x14003493a
mov rcx, qword [rbp + 0x318]
call fcn.14021b810
test ebx, ebx
jne 0x140034afd
mov edx, 0xe4
lea rcx, [rbp + 0x330]
call fcn.140011170
mov rbx, rax
mov rcx, qword [rax]
test rcx, rcx
je 0x140034965
mov ecx, dword [rcx]
cmp ecx, 1
jle 0x140034977
mov r8d, 1
mov rdx, qword [rax + 0x10]
mov rcx, rbx
call fcn.14003f770
mov rdx, qword [rbx + 8]
xorps xmm0, xmm0
movups xmmword [rbp + 0x458], xmm0
mov qword [rbp + 0x468], rsi
mov qword [rbp + 0x470], rsi
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400349a0
lea rcx, [rbp + 0x458]
call fcn.140006bb0
nop
lea rcx, [rbp + 0x398]
cmp qword [rbp + 0x3b0], 0xf
jbe 0x1400349d9
mov rcx, qword [rbp + 0x398]
test rcx, rcx
jne 0x1400349d9
mov rax, rsi
jmp 0x1400349e9
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x1400349e0
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], rcx
movaps xmm0, xmmword [rbp + 0x60]
movdqa xmmword [rbp + 0x200], xmm0
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x180]
call fcn.14008e330
nop
lea rdx, [rbp + 0x180]
lea rcx, [rbp - 0x78]
call fcn.1400ab680
nop
mov rcx, qword [rbp + 0x180]
test rcx, rcx
je 0x140034a4d
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
setne al
test al, al
jne 0x140034a4d
mov rcx, qword [rbp + 0x180]
call fcn.14021b810
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x78]
call fcn.1400aba50
nop
mov rcx, rax
call fcn.1400aa030
nop
lea rcx, [rbp - 0x40]
call fcn.1400a6a70
nop
lea rcx, [rbp - 0x78]
call fcn.1400ab8e0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
nop
mov rdx, qword [rbp + 0x470]
cmp rdx, 0xf
jbe 0x140034ac5
inc rdx
mov rcx, qword [rbp + 0x458]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034abf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400350e6
call fcn.140214360
nop
mov rcx, qword [rbp + 0x330]
test rcx, rcx
je 0x140034e8d
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
setne al
test al, al
jne 0x140034e8d
mov rcx, qword [rbp + 0x330]
call fcn.14021b810
jmp 0x140034e8d
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov edi, dword [rbp + 0x388]
lea r8, [rbp + 0x378]
cmp qword [rbp + 0x390], 0xf
cmova r8, qword [rbp + 0x378]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r9d, edi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x3b8], xmm0
mov qword [rbp + 0x3c8], rsi
mov qword [rbp + 0x3d0], rsi
mov r8, rbx
xor edx, edx
lea rcx, [rbp + 0x3b8]
call fcn.140035550
lea rcx, [rbp + 0x3b8]
cmp qword [rbp + 0x3d0], 7
cmova rcx, qword [rbp + 0x3b8]
lea r8, [rbp + 0x378]
cmp qword [rbp + 0x390], 0xf
cmova r8, qword [rbp + 0x378]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
mov r9d, edi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
nop
nop dword [rax]
nop word [rax + rax]
xor dil, dil
mov dword [rbp + 0x4a0], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x140034c4e
lea rdx, [rbp + 0x4a0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
cmp eax, 1
jne 0x140034c41
nop word [rax + rax]
lea rcx, [rbp + 0x3b8]
cmp qword [rbp + 0x3d0], 7
cmova rcx, qword [rbp + 0x3b8]
lea rdx, [rbp + 0x4cc]
call fcn.140221a28
test eax, eax
je 0x140034c3e
lea rdx, [rbp + 0x4a0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
cmp eax, 1
je 0x140034c00
jmp 0x140034c41
mov dil, 1
mov rcx, rbx
call fcn.140024ff0
test dil, dil
jne 0x140034c6b
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
add esi, 0x3e8
cmp esi, 0x4e20
jl 0x140034bc0
mov edx, 0x73
lea rcx, [rbp + 0x348]
call fcn.140011170
mov rbx, rax
mov rcx, qword [rax]
test rcx, rcx
je 0x140034c8e
mov ecx, dword [rcx]
cmp ecx, 1
jle 0x140034ca0
mov r8d, 1
mov rdx, qword [rax + 0x10]
mov rcx, rbx
call fcn.14003f770
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140034cbd
mov rax, 0xffffffffffffffff
inc rax
cmp byte [rcx + rax], 0
jne 0x140034cb0
xor esi, esi
jmp 0x140034cc1
xor esi, esi
mov eax, esi
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], rcx
movaps xmm0, xmmword [rbp + 0x70]
movdqa xmmword [rbp + 0x250], xmm0
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x198]
call fcn.14008e330
nop
mov r8d, esi
test dil, dil
setne r8b
mov dword [rsp + 0x20], esi
mov r9d, r14d
lea rdx, [rbp + 0x198]
mov rcx, r15
call fcn.140032cb0
nop
mov rcx, qword [rbp + 0x198]
test rcx, rcx
je 0x140034d36
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
setne al
test al, al
jne 0x140034d36
mov rcx, qword [rbp + 0x198]
call fcn.14021b810
nop
mov rcx, qword [rbp + 0x348]
test rcx, rcx
je 0x140034d61
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
setne al
test al, al
jne 0x140034d61
mov rcx, qword [rbp + 0x348]
call fcn.14021b810
test dil, dil
jne 0x140034f7c
mov edx, 0xe5
lea rcx, [rbp + 0x360]
call fcn.140011170
mov rbx, rax
mov rcx, qword [rax]
test rcx, rcx
je 0x140034d8d
mov ecx, dword [rcx]
cmp ecx, 1
jle 0x140034d9f
mov r8d, 1
mov rdx, qword [rax + 0x10]
mov rcx, rbx
call fcn.14003f770
mov rdx, qword [rbx + 8]
xorps xmm0, xmm0
movups xmmword [rbp + 0x478], xmm0
mov qword [rbp + 0x488], rsi
mov qword [rbp + 0x490], rsi
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140034dc2
lea rcx, [rbp + 0x478]
call fcn.140006bb0
nop
lea rdx, [rbp + 0x398]
call fcn.140033ae0
nop
mov rdx, qword [rbp + 0x490]
cmp rdx, 0xf
jbe 0x140034e28
inc rdx
mov rcx, qword [rbp + 0x478]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034e22
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400350ec
call fcn.140214360
nop
mov rcx, qword [rbp + 0x360]
test rcx, rcx
je 0x140034e54
mov eax, 0xffffffff
lock xadd dword [rcx], eax
cmp eax, 1
setne al
test al, al
jne 0x140034e54
mov rcx, qword [rbp + 0x360]
call fcn.14021b810
nop
mov r8, qword [rbp + 0x3d0]
cmp r8, 7
jbe 0x140034e74
mov rdx, qword [rbp + 0x3b8]
lea rcx, [rbp + 0x3b8]
call fcn.140003d70
mov qword [rbp + 0x3c8], rsi
mov qword [rbp + 0x3d0], 7
mov word [rbp + 0x3b8], si
mov rdx, qword [rbp + 0x390]
cmp rdx, 0xf
jbe 0x140034ece
mov rcx, qword [rbp + 0x378]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034ec9
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400350f2
call fcn.140214360
mov qword [rbp + 0x388], rsi
mov qword [rbp + 0x390], SHCreateThread
mov byte [rbp + 0x378], 0
mov rdx, qword [rbp + 0x3f0]
cmp rdx, 0xf
jbe 0x140034f29
mov rcx, qword [rbp + 0x3d8]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034f23
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400350f8
call fcn.140214360
nop
mov rdx, qword [rbp + 0x3b0]
cmp rdx, 0xf
jbe 0x140034f6a
mov rcx, qword [rbp + 0x398]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034f65
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400350ce
call fcn.140214360
inc r14d
cmp r14d, 3
jl 0x140033c03
jmp 0x140035093
mov byte [rsp + 0x40], 1
mov r8, qword [rbp + 0x3d0]
cmp r8, 7
jbe 0x140034fa1
mov rdx, qword [rbp + 0x3b8]
lea rcx, [rbp + 0x3b8]
call fcn.140003d70
mov qword [rbp + 0x3c8], rsi
mov qword [rbp + 0x3d0], 7
mov word [rbp + 0x3b8], si
mov rdx, qword [rbp + 0x390]
cmp rdx, 0xf
jbe 0x140034ffb
inc rdx
mov rcx, qword [rbp + 0x378]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034ff6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400350f2
call fcn.140214360
mov qword [rbp + 0x388], rsi
mov qword [rbp + 0x390], SHCreateThread
mov byte [rbp + 0x378], 0
mov rdx, qword [rbp + 0x3f0]
cmp rdx, 0xf
jbe 0x140035056
inc rdx
mov rcx, qword [rbp + 0x3d8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140035050
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400350f8
call fcn.140214360
nop
mov rdx, qword [rbp + 0x3b0]
cmp rdx, 0xf
jbe 0x140035093
inc rdx
mov rcx, qword [rbp + 0x398]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003508e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400350ce
call fcn.140214360
lea rdx, [r15 + 0x80]
call fcn.140026680
movzx eax, byte [rsp + 0x40]
mov rcx, qword [rbp + 0x6e0]
xor rcx, rsp
call fcn.140214340
mov rbx, qword [rsp + 0x848]
add rsp, 0x7f0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1402214b0
nop
call fcn.1402214b0
nop
call fcn.1402214b0
nop
call fcn.1402214b0
nop
call fcn.1402214b0
nop
call fcn.1402214b0
nop
call fcn.1402214b0
nop
call fcn.1402214b0
int3