Function at 0x14005bbf0
Capabilities:
Enumerate processes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x540
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1400f10c0]
xor rax, rsp
mov qword [rbp + 0x4e0], rax
xor r12d, r12d
cmp qword [0x1400f1440], r12
jne 0x14005bd3a
lea rcx, [rbp + 0x20]
call fcn.14005a980
lea rdi, [rbp + 0x20]
mov rsi, qword [rbp + 0x20]
mov r14, qword [rbp + 0x38]
cmp r14, 0xf
cmova rdi, rsi
mov rbx, qword [rbp + 0x30]
test rbx, rbx
je 0x14005bc79
mov r8, rbx
lea edx, [r12 + 0x2d]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x14005bc79
sub rax, rdi
jmp 0x14005bc80
mov rax, 0xffffffffffffffff
inc rax
lea rdi, [rbp + 0x20]
cmp r14, 0xf
cmova rdi, rsi
cmp rax, rbx
jae 0x14005bcd3
mov r8, rbx
sub r8, rax
lea rcx, [rdi + rax]
mov edx, reloc.WLDAP32.dll_Ordinal_45
call sub.VCRUNTIME140.dll_memchr
mov rdx, rax
test rax, rax
je 0x14005bcd3
sub rdx, rdi
cmp rdx, 0xffffffffffffffff
je 0x14005bcd3
lea rcx, [rdx + 1]
cmp rcx, rbx
jae 0x14005bcd3
lea rax, [rbp + 0x20]
cmp r14, 0xf
cmova rax, rsi
mov byte [rax + rdx + 1], 0x33
mov rdx, qword [reloc.WS2_32.dll_ntohs]
cmp rdx, 0xf
jbe 0x14005bd14
mov rcx, qword [0x1400f1430]
inc rdx
cmp rdx, 0x1000
jb 0x14005bd0f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14005bd9d
mov rcx, r8
call fcn.1400c4d8c
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [0x1400f1430], xmm0
movups xmm1, xmmword [rbp + 0x30]
movups xmmword [0x1400f1440], xmm1
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x20], r12b
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
mov qword [rbp + 0x1c0], r12
mov qword [rbp + 0x1c8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1b0], r12b
lea rcx, [rbp + 0x40]
call fcn.14005a980
lea rdi, [rbp + 0x40]
mov rsi, qword [rbp + 0x40]
mov r14, qword [rbp + 0x58]
cmp r14, 0xf
cmova rdi, rsi
mov rbx, qword [rbp + 0x50]
test rbx, rbx
je 0x14005bda4
mov r8, rbx
mov edx, reloc.WLDAP32.dll_Ordinal_45
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x14005bda4
sub rax, rdi
jmp 0x14005bdab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rax, 0xffffffffffffffff
inc rax
lea rdi, [rbp + 0x40]
cmp r14, 0xf
cmova rdi, rsi
cmp rax, rbx
jae 0x14005bdfe
mov r8, rbx
sub r8, rax
lea rcx, [rdi + rax]
mov edx, reloc.WLDAP32.dll_Ordinal_45
call sub.VCRUNTIME140.dll_memchr
mov rdx, rax
test rax, rax
je 0x14005bdfe
sub rdx, rdi
cmp rdx, 0xffffffffffffffff
je 0x14005bdfe
lea rcx, [rdx + 1]
cmp rcx, rbx
jae 0x14005bdfe
lea rax, [rbp + 0x40]
cmp r14, 0xf
cmova rax, rsi
mov byte [rax + rdx + 1], 0x33
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0xf
jbe 0x14005be42
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005be3d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005be3d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c4d8c
movups xmm0, xmmword [rbp + 0x40]
movups xmmword [rbp + 0x1b0], xmm0
movups xmm1, xmmword [rbp + 0x50]
movups xmmword [rbp + 0x1c0], xmm1
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x40], 0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rdi, 0x2e4b6b0271bf46aa
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0xa5ab46393e3f09dd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0x343b4a2ad11fb484
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0x9ceaeb2c6b4fbaad
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
movabs rax, 0x62f0756bbd20c975
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
movabs rdx, 0x60fd20820143e66a
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
movabs r15, 0xe664b5f35f602f1
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x3e0], rax
movabs r13, 0xfc8b1b7678714086
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x3e8], rax
movabs rsi, 0x46493f49f16dc1eb
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x3f0], rax
movabs rbx, 0xa6aea2684b3bd4c8
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x3f8], rax
movabs rax, 0x62f0756bbd20c955
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x400], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x408], rax
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0x3e0]
vmovdqa ymmword [rbp + 0x100], ymm1
vmovdqa xmm0, xmmword [rbp + 0x120]
vxorps xmm0, xmm0, xmmword [rbp + 0x400]
vmovdqa xmmword [rbp + 0x120], xmm0
lea rdx, [rbp + 0x100]
vzeroupper
call fcn.140005c50
lea r14, [0x1400f1430]
mov rdx, r14
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rdx, qword [0x1400f1430]
mov r8, qword [0x1400f1440]
mov rcx, rax
call fcn.140006f50
lea rdx, [0x140005e20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0xa5ab46393e3f09dd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0x23275a2ed11fb484
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0xefea820c2e4fb5ba
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0x62f0756bbd00f311
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rdx, 0x60fd20820143e66a
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x420], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x428], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x430], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x438], rax
movabs rax, 0x62f0756bbd20c955
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x440], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x448], rax
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0x420]
vmovdqa ymmword [rbp + 0x60], ymm1
vmovdqa xmm0, xmmword [rbp + 0x80]
vxorps xmm0, xmm0, xmmword [rbp + 0x440]
vmovdqa xmmword [rbp + 0x80], xmm0
lea rdx, [rbp + 0x60]
vzeroupper
call fcn.140005c50
lea rdx, [rbp + 0x1b0]
cmp qword [rbp + 0x1c8], 0xf
cmova rdx, qword [rbp + 0x1b0]
mov r8, qword [rbp + 0x1c0]
mov rcx, rax
call fcn.140006f50
lea rdx, [0x140005e20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
mov dword [rbp + 0x1f0], 0x130
mov edi, r12d
cmp rax, 0xffffffffffffffff
jne 0x14005c3cb
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
movabs rax, 0x2e4b6b0271bf46aa
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0xdcd649392a2305dd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0x32695b2c9d04a0ad
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0xc8c7c31c2954f4a7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0x11801405ce00a875
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0x12dd46ed21378902
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x51e0179bccfe9f9a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rax, 0xe8905f477703c7de
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movabs r9, 0x74c5df795c75759
mov qword [rbp], r9
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs r8, 0xe921696e50a763ce
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x320], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x328], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x330], rax
movabs rax, 0xa6aea2684b3bd4c8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x338], rax
movabs rax, 0x62f0756bbd20c955
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x340], rax
movabs rax, 0x60fd20820143e66a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x348], rax
movabs rax, 0x21c070f5a590f1ef
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x350], rax
movabs rdx, 0x9bf52c341260a8ac
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x358], rax
mov qword [rbp], r9
mov rax, qword [rbp]
mov qword [rbp + 0x360], rax
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x368], rax
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0x320]
vmovdqa ymmword [rbp + 0x60], ymm1
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x340]
vmovdqa ymmword [rbp + 0x80], ymm1
vmovdqa xmm0, xmmword [rbp + 0xa0]
vxorps xmm0, xmm0, xmmword [rbp + 0x360]
vmovdqa xmmword [rbp + 0xa0], xmm0
lea rdx, [rbp + 0x60]
vzeroupper
call fcn.140005c50
lea rdx, [0x140005e20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, [rbp + 0x18]
call fcn.140059330
movabs rcx, 0x7fffffff88ca6bff
mov rax, qword [rbp + 0x18]
cmp rax, rcx
jge 0x14005d10a
add rax, 0x77359400
jmp 0x14005d114
lea rdx, [rbp + 0x1f0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x14005c413
nop
lea rdx, str.Minecraft.Windows.exe
lea rcx, [rbp + 0x21c]
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14005c40d
lea rdx, [rbp + 0x1f0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x14005c3e0
jmp 0x14005c413
mov edi, dword [rbp + 0x1f8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
jne 0x14005c64b
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
movabs rax, 0x2e4b6b0271bf46aa
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x380], rax
movabs rax, 0xdcd649392a2305dd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x388], rax
movabs rax, 0x32695b2c9d04a0ad
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x390], rax
movabs rax, 0xc8c7c31c2954f4a7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x398], rax
movabs rax, 0x7931a19cd00a875
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3a0], rax
movabs rax, 0x10dd0cc648639519
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3a8], rax
movabs rax, 0x55b35090d6f19483
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3b0], rax
movabs rax, 0xfe9b45593214dacd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3b8], rax
movabs rax, 0x74c5d83f3a6253a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3c0], rax
movabs r8, 0xe921696e50a763ce
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x3c8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x320], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x328], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x330], rax
movabs rax, 0xa6aea2684b3bd4c8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x338], rax
movabs rax, 0x62f0756bbd20c955
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x340], rax
movabs rax, 0x60fd20820143e66a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x348], rax
movabs rax, 0x21c070f5a590f1ef
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x350], rax
movabs rdx, 0x9bf52c341260a8ac
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x358], rax
movabs r9, 0x74c5df795c75759
mov qword [rbp], r9
mov rax, qword [rbp]
mov qword [rbp + 0x360], rax
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x368], rax
vmovdqu ymm0, ymmword [rbp + 0x380]
vpxor ymm1, ymm0, ymmword [rbp + 0x320]
vmovdqa ymmword [rbp + 0x380], ymm1
vmovdqu ymm0, ymmword [rbp + 0x3a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x340]
vmovdqa ymmword [rbp + 0x3a0], ymm1
vmovdqa xmm0, xmmword [rbp + 0x3c0]
vxorps xmm0, xmm0, xmmword [rbp + 0x360]
vmovdqa xmmword [rbp + 0x3c0], xmm0
lea rdx, [rbp + 0x380]
jmp 0x14005c388
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rbx, 0x2e4b6b0271bf46aa
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs rax, 0xafab46393e3f09dd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movabs rax, 0x662e51209702ae9b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
movabs rax, 0x8acac71c395aa0bb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
movabs rax, 0x4295060ad84cb975
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
movabs rax, 0x60fd2082752a871d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x460], rax
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x468], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x470], rax
movabs rax, 0xa6aea2684b3bd4c8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x478], rax
movabs rax, 0x62f0756bbd20c955
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x480], rax
movabs rax, 0x60fd20820143e66a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x488], rax
vmovdqu ymm0, ymmword [rbp + 0x140]
vpxor ymm1, ymm0, ymmword [rbp + 0x460]
vmovdqa ymmword [rbp + 0x140], ymm1
vmovdqa xmm0, xmmword [rbp + 0x160]
vxorps xmm0, xmm0, xmmword [rbp + 0x480]
vmovdqa xmmword [rbp + 0x160], xmm0
lea rdx, [rbp + 0x140]
vzeroupper
call fcn.140005c50
lea rdx, [0x140005e20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
mov qword [rbp], rax
test rax, rax
je 0x14005cf57
nop
xor bl, bl
mov byte [rbp + 0x10], bl
mov rcx, rsi
cmp dword [0x1400f2848], 0xa
jge 0x14005cc29
mov r9d, Ordinal_50
lea r8, [rbp + 0x180]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
je 0x14005cc17
nop dword [rax]
nop word [rax + rax]
cmp dword [rbp + 0x1a0], 0x1000
jne 0x14005cbe2
mov eax, dword [rbp + 0x1a4]
cmp eax, 4
je 0x14005c834
cmp eax, 0x40
jne 0x14005cbe2
xorps xmm0, xmm0
mov rdi, qword [rbp + 0x198]
movdqu xmmword [rbp + 0x1d0], xmm0
mov qword [rbp + 0x1e0], r12
test rdi, rdi
je 0x14005c889
mov rdx, rdi
lea rcx, [rbp + 0x1d0]
call fcn.140007940
mov r8, rdi
xor edx, edx
mov r15, qword [rbp + 0x1d0]
mov rcx, r15
call sub.VCRUNTIME140.dll_memset
lea r13, [rdi + r15]
mov qword [rbp + 0x1d8], r13
mov rdi, qword [rbp + 0x198]
jmp 0x14005c897
mov r13, qword [rbp + 0x1d8]
mov r15, qword [rbp + 0x1d0]
mov rbx, r12
mov qword [rsp + 0x20], r12
mov r9, rdi
mov r8, r15
mov rdx, qword [rbp + 0x180]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor r12d, r12d
sub r13, r15
je 0x14005cb8c
xor r10d, r10d
lea r11, [r15 - 1]
mov rdi, qword [reloc.WS2_32.dll_ntohs]
mov r9, qword [0x1400f1440]
mov rsi, qword [0x1400f1430]
nop dword [rax]
xor eax, eax
test r9, r9
je 0x14005c918
nop word [rax + rax]
mov rcx, r14
cmp rdi, 0xf
cmova rcx, rsi
lea r8, [rax + 1]
movzx edx, byte [r8 + r11]
movsx ecx, byte [rcx + rax]
cmp ecx, edx
jne 0x14005c918
cmp r8, r9
cmove rbx, r10
mov rax, r8
jb 0x14005c8f0
inc r12d
inc r11
movsxd r10, r12d
cmp r10, r13
jb 0x14005c8e0
mov rsi, qword [rbp]
test rbx, rbx
je 0x14005cb8c
lea r8, [rbp + 0x1b0]
cmp qword [rbp + 0x1c8], 0xf
cmova r8, qword [rbp + 0x1b0]
mov r9, qword [rbp + 0x1c0]
inc r9
mov rdx, qword [rbp + 0x180]
add rdx, rbx
mov qword [rsp + 0x20], 0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x14005cb85
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0x2e4b6b0271bf46aa
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc0], rax
movabs rax, 0xbdab46393e3f09dd
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xc8], rax
movabs rax, 0x66734c3a941fa58f
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xd0], rax
movabs rax, 0xa6aea2684b3bacf8
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xd8], rax
movabs rdi, 0xe664b5f35f602f1
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4a0], rax
movabs r15, 0xfc8b1b7678714086
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4a8], rax
movabs r12, 0x46493f49f16dc1eb
mov qword [rbp + 8], r12
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4b0], rax
movabs r13, 0xa6aea2684b3bd4c8
mov qword [rbp + 8], r13
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4b8], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x4a0]
vmovdqa ymmword [rbp + 0xc0], ymm1
lea rdx, [rbp + 0xc0]
vzeroupper
call fcn.140005c50
lea rdx, [0x140059a40]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
lea rdx, [0x140059a60]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, qword [rbp + 0x180]
add rdx, rbx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
mov r8, rax
movabs rax, 0x6d13387f469775d1
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0xe0], rcx
movabs rax, 0x85e76e100b0225e5
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0xe8], rcx
movabs rax, 0x232059209502accb
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0xf0], rcx
movabs rax, 0xa6aea2684b3bd4ac
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0xf8], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4c0], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4c8], rax
mov qword [rbp + 8], r12
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4d0], rax
mov qword [rbp + 8], r13
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4d8], rax
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x4c0]
vmovdqa ymmword [rbp + 0xe0], ymm1
lea rdx, [rbp + 0xe0]
mov rcx, r8
vzeroupper
call fcn.140005c50
lea rdx, [0x140005e20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov r15, qword [rbp + 0x1d0]
mov bl, 1
mov byte [rbp + 0x10], bl
jmp 0x14005cb90
movzx ebx, byte [rbp + 0x10]
test r15, r15
je 0x14005cbdf
mov rdx, qword [rbp + 0x1e0]
sub rdx, r15
mov rax, r15
cmp rdx, 0x1000
jb 0x14005cbc0
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005cc22
mov rcx, r15
call fcn.1400c4d8c
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x1d0], xmm0
xor r12d, r12d
mov qword [rbp + 0x1e0], r12
jmp 0x14005cbe2
xor r12d, r12d
mov rdx, qword [rbp + 0x180]
add rdx, qword [rbp + 0x198]
mov r9d, Ordinal_50
lea r8, [rbp + 0x180]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_VirtualQueryEx]
test rax, rax
jne 0x14005c810
test bl, bl
jne 0x14005c7d0
inc dword [0x1400f2848]
jmp 0x14005c7d0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdi, qword [rbp + 0x1c0]
lea r9, [rbp + 0x1b0]
cmp qword [rbp + 0x1c8], 0xf
cmova r9, qword [rbp + 0x1b0]
mov rax, qword [reloc.WS2_32.dll_ntohs]
cmp rdi, rax
ja 0x14005cc83
mov rbx, r14
cmp rax, 0xf
cmova rbx, qword [0x1400f1430]
mov qword [0x1400f1440], rdi
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
jmp 0x14005cc8e
mov rdx, rdi
mov rcx, r14
call fcn.140007ad0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rsi, 0x2e4b6b0271bf46aa
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x380], rax
movabs rax, 0xb8ab46393e3f09dd
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x388], rax
movabs rax, 0x35694c28864d85a2
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x390], rax
movabs rax, 0xd3c8d11b2e58b7bd
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x398], rax
movabs rax, 0x49f1a1bce00b039
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x3a0], rax
movabs rax, 0x60fd20820143820f
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x3a8], rax
movabs r15, 0xe664b5f35f602f1
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x320], rax
movabs r13, 0xfc8b1b7678714086
mov qword [rbp + 8], r13
mov rax, qword [rbp + 8]
mov qword [rbp + 0x328], rax
movabs rbx, 0x46493f49f16dc1eb
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x330], rax
movabs rdi, 0xa6aea2684b3bd4c8
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x338], rax
movabs rax, 0x62f0756bbd20c955
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x340], rax
movabs rax, 0x60fd20820143e66a
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x348], rax
vmovdqu ymm0, ymmword [rbp + 0x380]
vpxor ymm1, ymm0, ymmword [rbp + 0x320]
vmovdqa ymmword [rbp + 0x380], ymm1
vmovdqa xmm0, xmmword [rbp + 0x3a0]
vxorps xmm0, xmm0, xmmword [rbp + 0x340]
vmovdqa xmmword [rbp + 0x3a0], xmm0
lea rdx, [rbp + 0x380]
vzeroupper
call fcn.140005c50
lea rdx, [0x140005e20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x380], rax
movabs rax, 0xa5ab46393e3f09dd
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x388], rax
movabs rax, 0x663e5a27d11fb484
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x390], rax
movabs rax, 0xa6aea248717f9d8c
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x398], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x320], rax
mov qword [rbp + 8], r13
mov rax, qword [rbp + 8]
mov qword [rbp + 0x328], rax
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x330], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x338], rax
vmovdqu ymm0, ymmword [rbp + 0x380]
vpxor ymm1, ymm0, ymmword [rbp + 0x320]
vmovdqa ymmword [rbp + 0x380], ymm1
lea rdx, [rbp + 0x380]
vzeroupper
call fcn.140005c50
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova r14, qword [0x1400f1430]
mov r8, qword [0x1400f1440]
mov rdx, r14
mov rcx, rax
call fcn.140006f50
lea rdx, [0x140005e20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [0x1400f2848], r12d
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0xf
jbe 0x14005d16b
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005cf4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005d15a
call fcn.1400c4d8c
jmp 0x14005d16b
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x320], rax
movabs rax, 0xdcd649392a2305dd
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x328], rax
movabs rax, 0x32695b2c9d04a0ad
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x330], rax
movabs rax, 0xc78ecc0d3b54f4a7
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x338], rax
movabs rax, 0x4295190fd341a175
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x340], rax
movabs rax, 0x10dd45ea7563891e
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x348], rax
movabs rax, 0x21c00386c0f39e9d
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x350], rax
movabs rdx, 0x9bf52c341260a8ac
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x358], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x380], rax
mov qword [rbp + 8], r13
mov rax, qword [rbp + 8]
mov qword [rbp + 0x388], rax
movabs rbx, 0x46493f49f16dc1eb
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x390], rax
movabs rax, 0xa6aea2684b3bd4c8
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x398], rax
movabs rax, 0x62f0756bbd20c955
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x3a0], rax
movabs rax, 0x60fd20820143e66a
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x3a8], rax
movabs rax, 0x21c070f5a590f1ef
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x3b0], rax
mov qword [rbp + 8], rdx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x3b8], rax
vmovdqu ymm0, ymmword [rbp + 0x320]
vpxor ymm1, ymm0, ymmword [rbp + 0x380]
vmovdqa ymmword [rbp + 0x320], ymm1
vmovdqu ymm0, ymmword [rbp + 0x340]
vpxor ymm1, ymm0, ymmword [rbp + 0x3a0]
vmovdqa ymmword [rbp + 0x340], ymm1
lea rdx, [rbp + 0x320]
vzeroupper
call fcn.140005c50
jmp 0x14005c3a0
movabs rax, 0x7fffffffffffffff
mov qword [rbp + 0x18], rax
lea rcx, [rbp + 0x18]
call fcn.1400598d0
nop
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0xf
jbe 0x14005d166
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005d161
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005d161
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c4d8c
mov eax, 1
mov rcx, qword [rbp + 0x4e0]
xor rcx, rsp
call fcn.1400c4af0
lea r11, [rsp + 0x540]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret