Function at 0x14003b1c0
Capabilities:
Enumerate processes

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x448]
sub rsp, 0x548
xor r13d, r13d
mov r14d, r13d
mov dword [rbp + 0x490], r13d
mov dword [rbp + 0x200], 0x238
xor edx, edx
lea ecx, [rdx + 2]
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov rbx, rax
mov qword [rbp + 0x1d8], rax
mov edx, 0xed
lea rcx, [rbp + 0x1e0]
call fcn.1400175a0
nop
cmp rbx, 0xffffffffffffffff
je 0x14003c7cb
lea rdx, [rbp + 0x200]
mov rcx, rbx
call sub.KERNEL32.dll_Process32FirstW
cmp eax, 1
jne 0x14003c7c1
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], 7
mov word [rbp - 0x38], r13w
lea rax, [rbp + 0x22c]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14003b260
lea rdx, [rbp + 0x22c]
lea rcx, [rbp - 0x38]
call fcn.14003a5e0
nop
lea r8, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae r8, qword [rbp - 0x38]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov qword [rsp + 0x20], r13
mov r9d, dword [rbp - 0x28]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbx, eax
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x40], 0
mov rdx, rbx
xor r8d, r8d
lea rcx, [rsp + 0x40]
call fcn.14002d900
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rax, qword [rsp + 0x40]
lea r8, [rbp - 0x38]
cmp qword [rbp - 0x20], 8
cmovae r8, qword [rbp - 0x38]
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
lea r9d, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 8
jb 0x14003b35e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003b359
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003c825
call fcn.140133e68
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], 7
mov word [rbp - 0x38], r13w
lea rdi, [rsp + 0x40]
mov rcx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x58]
cmp r8, 0x10
cmovae rdi, rcx
lea rsi, [rsp + 0x40]
cmovae rsi, rcx
mov r9, qword [rsp + 0x50]
add rsi, r9
lea rbx, [rsp + 0x40]
cmp r8, 0x10
cmovae rbx, rcx
cmp rbx, rsi
je 0x14003b3d2
sub rdi, rbx
nop dword [rax]
movsx ecx, byte [rbx]
call fcn.140172bc0
mov byte [rdi + rbx], al
inc rbx
cmp rbx, rsi
jne 0x14003b3b0
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
lea r14, [rsp + 0x40]
cmp r8, 0x10
cmovae r14, rcx
add r14, r9
lea rsi, [rsp + 0x40]
cmp r8, 0x10
cmovae rsi, rcx
add rsi, r9
lea rbx, [rsp + 0x40]
cmp r8, 0x10
cmovae rbx, rcx
cmp rbx, rsi
je 0x14003b460
movsx ecx, byte [rbx]
call fcn.140177fc8
test eax, eax
jne 0x14003b418
inc rbx
cmp rbx, rsi
jne 0x14003b404
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
cmp rbx, rsi
je 0x14003b460
lea rdi, [rbx + 1]
cmp rdi, rsi
je 0x14003b460
movsx ecx, byte [rdi]
call fcn.140177fc8
test eax, eax
jne 0x14003b449
movzx eax, byte [rdi]
mov byte [rbx], al
inc rbx
inc rdi
cmp rdi, rsi
jne 0x14003b435
mov r8, qword [rsp + 0x58]
mov r9, qword [rsp + 0x50]
mov rcx, qword [rsp + 0x40]
lea rax, [rsp + 0x40]
cmp r8, 0x10
cmovae rax, rcx
mov rdx, rbx
sub rdx, rax
sub r14, rbx
mov rax, r9
sub rax, rdx
cmp rax, r14
cmovb r14, rax
lea rax, [rsp + 0x40]
cmp r8, 0x10
cmovae rax, rcx
lea rcx, [rax + rdx]
sub r9, r14
mov qword [rsp + 0x50], r9
sub r9, rdx
lea r8, [r9 + 1]
lea rdx, [rcx + r14]
call fcn.1401378a0
mov edx, 0xed
lea rcx, [rbp - 8]
call fcn.1400175a0
mov r15, rax
cmp qword [rax + 0x18], 0x10
jb 0x14003b4c7
mov r15, qword [rax]
lea r14, [rsp + 0x40]
mov rdi, qword [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae r14, rdi
mov rsi, qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
cmp rsi, rcx
ja 0x14003b557
test rsi, rsi
jne 0x14003b4f3
mov rbx, r13
jmp 0x14003b55e
mov r12, r14
sub r12, rsi
add r12, rcx
movsx r13d, byte [r15]
lea r8, [r12 + 1]
sub r8, r14
mov edx, r13d
mov rcx, r14
call fcn.140138350
mov rbx, rax
test rax, rax
je 0x14003b554
nop dword [rax + rax]
mov r8, rsi
mov rdx, r15
mov rcx, rbx
call fcn.1401383d0
test eax, eax
je 0x14003b5e9
inc rbx
lea r8, [r12 + 1]
sub r8, rbx
mov edx, r13d
mov rcx, rbx
call fcn.140138350
mov rbx, rax
test rax, rax
jne 0x14003b520
xor r13d, r13d
mov rbx, 0xffffffffffffffff
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x14003b59e
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003b594
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003c82b
call fcn.140133e68
mov rdi, qword [rsp + 0x40]
cmp rbx, 0xffffffffffffffff
je 0x14003c763
lea rsi, [rbp + 0x1e0]
cmp qword [rbp + 0x1f8], 0x10
cmovae rsi, qword [rbp + 0x1e0]
lea r14, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae r14, rdi
mov rdi, qword [rbp + 0x1f0]
mov rcx, qword [rsp + 0x50]
cmp rdi, rcx
ja 0x14003b653
test rdi, rdi
jne 0x14003b5f4
mov rbx, r13
jmp 0x14003b65a
sub rbx, r14
xor r13d, r13d
jmp 0x14003b55e
mov r15, r14
sub r15, rdi
add r15, rcx
movsx r12d, byte [rsi]
lea r8, [r15 + 1]
sub r8, r14
mov edx, r12d
mov rcx, r14
call fcn.140138350
mov rbx, rax
test rax, rax
je 0x14003b653
nop dword [rax + rax]
mov r8, rdi
mov rdx, rsi
mov rcx, rbx
call fcn.1401383d0
test eax, eax
je 0x14003b6bc
inc rbx
lea r8, [r15 + 1]
sub r8, rbx
mov edx, r12d
mov rcx, rbx
call fcn.140138350
mov rbx, rax
test rax, rax
jne 0x14003b620
mov rbx, 0xffffffffffffffff
mov qword [rsp + 0x20], r13
lea r9, [0x14026cae4]
mov r8d, 4
mov rdx, rbx
lea rcx, [rsp + 0x40]
call fcn.14003caa0
mov qword [rbp + 0x38], r13
mov qword [rbp + 0x48], r13
mov qword [rbp + 0x50], r13
mov rdi, qword [rsp + 0x50]
lea rsi, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rsi, qword [rsp + 0x40]
movabs r14, 0x7fffffffffffffff
cmp rdi, 0x10
jae 0x14003b6c1
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x50], reloc.WS2_32.dll_ntohs
jmp 0x14003b731
sub rbx, r14
jmp 0x14003b65a
mov rbx, rdi
or rbx, 0xf
cmp rbx, r14
cmova rbx, r14
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14003b70b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003c837
mov rcx, rax
call fcn.140133e2c
mov rcx, rax
test rax, rax
je 0x14003c831
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003b71a
test rcx, rcx
je 0x14003b717
call fcn.140133e2c
jmp 0x14003b71a
mov rax, r13
mov qword [rbp + 0x38], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.1401378a0
mov qword [rbp + 0x50], rbx
mov qword [rbp + 0x48], rdi
lea rax, [rbp + 0x38]
mov qword [rbp + 0x4a0], rax
mov dword [rbp + 0x498], 0xc00ea8a7
lea rdx, [rbp + 0x38]
lea rcx, [rsp + 0x68]
call fcn.14000cca0
mov r8d, 1
mov rdx, rax
lea rcx, [rbp + 0x498]
call fcn.14003a840
nop
test al, al
mov dword [rbp - 0x50], 1
jne 0x14003b77d
mov dword [rbp - 0x50], r13d
lea rcx, [rbp + 0x38]
call fcn.14000d278
mov qword [rbp + 0x58], r13
mov qword [rbp + 0x68], r13
mov qword [rbp + 0x70], r13
mov rdi, qword [rsp + 0x50]
lea rsi, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rsi, qword [rsp + 0x40]
cmp rdi, 0x10
jae 0x14003b7bf
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x58], xmm0
mov qword [rbp + 0x70], reloc.WS2_32.dll_ntohs
jmp 0x14003b82f
mov rbx, rdi
or rbx, 0xf
cmp rbx, r14
cmova rbx, r14
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14003b809
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003c837
mov rcx, rax
call fcn.140133e2c
mov rcx, rax
test rax, rax
je 0x14003c831
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003b818
test rcx, rcx
je 0x14003b815
call fcn.140133e2c
jmp 0x14003b818
mov rax, r13
mov qword [rbp + 0x58], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.1401378a0
mov qword [rbp + 0x70], rbx
mov qword [rbp + 0x68], rdi
lea rax, [rbp + 0x58]
mov qword [rbp + 0x4a0], rax
mov dword [rbp + 0x498], 0xe6c340da
lea rdx, [rbp + 0x58]
lea rcx, [rsp + 0x68]
call fcn.14000cca0
mov r8d, 1
mov rdx, rax
lea rcx, [rbp + 0x498]
call fcn.14003a840
nop
test al, al
mov dword [rbp - 0x58], 2
jne 0x14003b87b
mov dword [rbp - 0x58], r13d
lea rcx, [rbp + 0x58]
call fcn.14000d278
mov qword [rbp + 0x78], r13
mov qword [rbp + 0x88], r13
mov qword [rbp + 0x90], r13
mov rdi, qword [rsp + 0x50]
lea rsi, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rsi, qword [rsp + 0x40]
cmp rdi, 0x10
jae 0x14003b8c6
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x78], xmm0
mov qword [rbp + 0x90], reloc.WS2_32.dll_ntohs
jmp 0x14003b939
mov rbx, rdi
or rbx, 0xf
cmp rbx, r14
cmova rbx, r14
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14003b910
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003c837
mov rcx, rax
call fcn.140133e2c
mov rcx, rax
test rax, rax
je 0x14003c831
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003b91f
test rcx, rcx
je 0x14003b91c
call fcn.140133e2c
jmp 0x14003b91f
mov rax, r13
mov qword [rbp + 0x78], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.1401378a0
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x88], rdi
lea rax, [rbp + 0x78]
mov qword [rbp + 0x4a0], rax
mov dword [rbp + 0x498], 0xfce090e7
lea rdx, [rbp + 0x78]
lea rcx, [rsp + 0x68]
call fcn.14000cca0
mov r8d, 1
mov rdx, rax
lea rcx, [rbp + 0x498]
call fcn.14003a840
nop
test al, al
mov dword [rbp - 0x54], 4
jne 0x14003b988
mov dword [rbp - 0x54], r13d
lea rcx, [rbp + 0x78]
call fcn.14000d278
mov qword [rbp + 0x98], r13
mov qword [rbp + 0xa8], r13
mov qword [rbp + 0xb0], r13
mov rdi, qword [rsp + 0x50]
lea rsi, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rsi, qword [rsp + 0x40]
cmp rdi, 0x10
jae 0x14003b9d9
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x98], xmm0
mov qword [rbp + 0xb0], reloc.WS2_32.dll_ntohs
jmp 0x14003ba4f
mov rbx, rdi
or rbx, 0xf
cmp rbx, r14
cmova rbx, r14
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14003ba23
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003c837
mov rcx, rax
call fcn.140133e2c
mov rcx, rax
test rax, rax
je 0x14003c831
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003ba32
test rcx, rcx
je 0x14003ba2f
call fcn.140133e2c
jmp 0x14003ba32
mov rax, r13
mov qword [rbp + 0x98], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.1401378a0
mov qword [rbp + 0xb0], rbx
mov qword [rbp + 0xa8], rdi
lea rax, [rbp + 0x98]
mov qword [rbp + 0x4a0], rax
mov dword [rbp + 0x498], 0xbba6a469
lea rdx, [rbp + 0x98]
lea rcx, [rsp + 0x68]
call fcn.14000cca0
mov r8d, 1
mov rdx, rax
lea rcx, [rbp + 0x498]
call fcn.14003a840
nop
test al, al
mov dword [rbp - 0x44], 8
jne 0x14003baa4
mov dword [rbp - 0x44], r13d
lea rcx, [rbp + 0x98]
call fcn.14000d278
mov qword [rbp + 0xb8], r13
mov qword [rbp + 0xc8], r13
mov qword [rbp + 0xd0], r13
mov rdi, qword [rsp + 0x50]
lea rsi, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rsi, qword [rsp + 0x40]
cmp rdi, 0x10
jae 0x14003baf8
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0xb8], xmm0
mov qword [rbp + 0xd0], reloc.WS2_32.dll_ntohs
jmp 0x14003bb6e
mov rbx, rdi
or rbx, 0xf
cmp rbx, r14
cmova rbx, r14
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14003bb42
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003c837
mov rcx, rax
call fcn.140133e2c
mov rcx, rax
test rax, rax
je 0x14003c831
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003bb51
test rcx, rcx
je 0x14003bb4e
call fcn.140133e2c
jmp 0x14003bb51
mov rax, r13
mov qword [rbp + 0xb8], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.1401378a0
mov qword [rbp + 0xd0], rbx
mov qword [rbp + 0xc8], rdi
lea rax, [rbp + 0xb8]
mov qword [rbp + 0x4a0], rax
mov dword [rbp + 0x498], 0xdefc40b8
lea rdx, [rbp + 0xb8]
lea rcx, [rsp + 0x68]
call fcn.14000cca0
mov r8d, 1
mov rdx, rax
lea rcx, [rbp + 0x498]
call fcn.14003a840
nop
test al, al
mov dword [rbp + 0x4a8], reloc.WS2_32.dll_recv
jne 0x14003bbc9
mov dword [rbp + 0x4a8], r13d
lea rcx, [rbp + 0xb8]
call fcn.14000d278
mov qword [rbp + 0xd8], r13
mov qword [rbp + 0xe8], r13
mov qword [rbp + 0xf0], r13
mov rdi, qword [rsp + 0x50]
lea rsi, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rsi, qword [rsp + 0x40]
cmp rdi, 0x10
jae 0x14003bc1d
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0xd8], xmm0
mov qword [rbp + reloc.WS2_32.dll_ntohs0], 0xf
jmp 0x14003bc93
mov rbx, rdi
or rbx, 0xf
cmp rbx, r14
cmova rbx, r14
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14003bc67
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003c837
mov rcx, rax
call fcn.140133e2c
mov rcx, rax
test rax, rax
je 0x14003c831
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003bc76
test rcx, rcx
je 0x14003bc73
call fcn.140133e2c
jmp 0x14003bc76
mov rax, r13
mov qword [rbp + 0xd8], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.1401378a0
mov qword [rbp + 0xf0], rbx
mov qword [rbp + 0xe8], rdi
lea rax, [rbp + 0xd8]
mov qword [rbp + 0x498], rax
mov dword [rbp + reloc.OLEAUT32.dll_VarUI8FromDec], 0x7fc43100
mov dword [rbp + 0x1bc], 0x172b00b
lea rdx, [rbp + 0xd8]
lea rcx, [rsp + 0x68]
call fcn.14000cca0
mov r8d, 2
mov rdx, rax
lea rcx, [rbp + reloc.OLEAUT32.dll_VarUI8FromDec]
call fcn.14003a840
nop
test al, al
mov dword [rbp - 0x48], reloc.WLDAP32.dll_Ordinal_32
jne 0x14003bcf2
mov dword [rbp - 0x48], r13d
lea rcx, [rbp + 0xd8]
call fcn.14000d278
mov qword [rbp + 0xf8], r13
mov qword [rbp + 0x108], r13
mov qword [rbp + 0x110], r13
mov rdi, qword [rsp + 0x50]
lea rsi, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rsi, qword [rsp + 0x40]
cmp rdi, 0x10
jae 0x14003bd46
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0xf8], xmm0
mov qword [rbp + 0x110], reloc.WS2_32.dll_ntohs
jmp 0x14003bdbc
mov rbx, rdi
or rbx, 0xf
cmp rbx, r14
cmova rbx, r14
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14003bd90
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003c837
mov rcx, rax
call fcn.140133e2c
mov rcx, rax
test rax, rax
je 0x14003c831
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003bd9f
test rcx, rcx
je 0x14003bd9c
call fcn.140133e2c
jmp 0x14003bd9f
mov rax, r13
mov qword [rbp + 0xf8], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.1401378a0
mov qword [rbp + 0x110], rbx
mov qword [rbp + 0x108], rdi
lea rax, [rbp + 0xf8]
mov qword [rbp + 0x4a0], rax
mov dword [rbp + 0x498], 0x1b79c3b1
lea rdx, [rbp + 0xf8]
lea rcx, [rsp + 0x68]
call fcn.14000cca0
mov r8d, 1
mov rdx, rax
lea rcx, [rbp + 0x498]
call fcn.14003a840
nop
test al, al
mov dword [rbp - 0x4c], 0x40
jne 0x14003be11
mov dword [rbp - 0x4c], r13d
lea rcx, [rbp + 0xf8]
call fcn.14000d278
mov qword [rbp + 0x118], r13
mov qword [rbp + 0x128], r13
mov qword [rbp + 0x130], r13
mov rdi, qword [rsp + 0x50]
lea rsi, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rsi, qword [rsp + 0x40]
cmp rdi, 0x10
jae 0x14003be65
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x118], xmm0
mov qword [rbp + 0x130], reloc.WS2_32.dll_ntohs
jmp 0x14003bedb
mov rbx, rdi
or rbx, 0xf
cmp rbx, r14
cmova rbx, r14
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14003beaf
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003c837
mov rcx, rax
call fcn.140133e2c
mov rcx, rax
test rax, rax
je 0x14003c831
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003bebe
test rcx, rcx
je 0x14003bebb
call fcn.140133e2c
jmp 0x14003bebe
mov rax, r13
mov qword [rbp + 0x118], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.1401378a0
mov qword [rbp + 0x130], rbx
mov qword [rbp + 0x128], rdi
lea rax, [rbp + 0x118]
mov qword [rbp + 0x4a0], rax
mov dword [rbp + 0x498], 0x88393547
lea rdx, [rbp + 0x118]
lea rcx, [rsp + 0x68]
call fcn.14000cca0
mov r8d, 1
mov rdx, rax
lea rcx, [rbp + 0x498]
call fcn.14003a840
nop
test al, al
mov dword [rbp + 0x4a0], 0x80
jne 0x14003bf36
mov dword [rbp + 0x4a0], r13d
lea rcx, [rbp + 0x118]
call fcn.14000d278
mov qword [rbp + 0x138], r13
mov qword [rbp + 0x148], r13
mov qword [rbp + 0x150], r13
mov rdi, qword [rsp + 0x50]
lea rsi, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rsi, qword [rsp + 0x40]
cmp rdi, 0x10
jae 0x14003bf8a
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x138], xmm0
mov qword [rbp + 0x150], reloc.WS2_32.dll_ntohs
jmp 0x14003c000
mov rbx, rdi
or rbx, 0xf
cmp rbx, r14
cmova rbx, r14
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14003bfd4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003c837
mov rcx, rax
call fcn.140133e2c
mov rcx, rax
test rax, rax
je 0x14003c831
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003bfe3
test rcx, rcx
je 0x14003bfe0
call fcn.140133e2c
jmp 0x14003bfe3
mov rax, r13
mov qword [rbp + 0x138], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.1401378a0
mov qword [rbp + 0x150], rbx
mov qword [rbp + 0x148], rdi
lea rax, [rbp + 0x138]
mov qword [rsp + 0x60], rax
mov dword [rbp + 0x498], 0xf45afe00
lea rdx, [rbp + 0x138]
lea rcx, [rsp + 0x68]
call fcn.14000cca0
mov r8d, 1
mov rdx, rax
lea rcx, [rbp + 0x498]
call fcn.14003a840
nop
test al, al
mov dword [rbp - 0x18], VarUI2FromI4
jne 0x14003c053
mov dword [rbp - 0x18], r13d
lea rcx, [rbp + 0x138]
call fcn.14000d278
mov qword [rbp + 0x158], r13
mov qword [rbp + 0x168], r13
mov qword [rbp + 0x170], r13
mov rdi, qword [rsp + 0x50]
lea rsi, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rsi, qword [rsp + 0x40]
cmp rdi, 0x10
jae 0x14003c0a7
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x158], xmm0
mov qword [rbp + 0x170], reloc.WS2_32.dll_ntohs
jmp 0x14003c11d
mov rbx, rdi
or rbx, 0xf
cmp rbx, r14
cmova rbx, r14
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14003c0f1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003c837
mov rcx, rax
call fcn.140133e2c
mov rcx, rax
test rax, rax
je 0x14003c831
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003c100
test rcx, rcx
je 0x14003c0fd
call fcn.140133e2c
jmp 0x14003c100
mov rax, r13
mov qword [rbp + 0x158], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.1401378a0
mov qword [rbp + 0x170], rbx
mov qword [rbp + 0x168], rdi
lea rax, [rbp + 0x158]
mov qword [rsp + 0x60], rax
mov dword [rbp + 0x498], 0x44cf94aa
lea rdx, [rbp + 0x158]
lea rcx, [rsp + 0x68]
call fcn.14000cca0
mov r8d, 1
mov rdx, rax
lea rcx, [rbp + 0x498]
call fcn.14003a840
nop
test al, al
mov dword [rbp + 0x498], 0x200
jne 0x14003c176
mov dword [rbp + 0x498], r13d
lea rcx, [rbp + 0x158]
call fcn.14000d278
mov qword [rbp + 0x178], r13
mov qword [rbp + 0x188], r13
mov qword [rbp + 0x190], r13
mov rdi, qword [rsp + 0x50]
lea rsi, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rsi, qword [rsp + 0x40]
cmp rdi, 0x10
jae 0x14003c1ca
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x178], xmm0
mov qword [rbp + 0x190], reloc.WS2_32.dll_ntohs
jmp 0x14003c240
mov rbx, rdi
or rbx, 0xf
cmp rbx, r14
cmova rbx, r14
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14003c214
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003c837
mov rcx, rax
call fcn.140133e2c
mov rcx, rax
test rax, rax
je 0x14003c831
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003c223
test rcx, rcx
je 0x14003c220
call fcn.140133e2c
jmp 0x14003c223
mov rax, r13
mov qword [rbp + 0x178], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.1401378a0
mov qword [rbp + 0x190], rbx
mov qword [rbp + 0x188], rdi
lea rax, [rbp + 0x178]
mov qword [rbp - 0x40], rax
mov dword [rsp + 0x60], 0xbebefa30
lea rdx, [rbp + 0x178]
lea rcx, [rsp + 0x68]
call fcn.14000cca0
mov r8d, 1
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14003a840
nop
test al, al
je 0x14003c289
mov r13d, 0x400
lea rcx, [rbp + 0x178]
call fcn.14000d278
xor ebx, ebx
mov qword [rbp + 0x198], rbx
mov qword [rbp + 0x1a8], rbx
mov qword [rbp + 0x1b0], rbx
mov rdi, qword [rsp + 0x50]
lea rsi, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rsi, qword [rsp + 0x40]
cmp rdi, 0x10
jae 0x14003c2df
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x198], xmm0
mov qword [rbp + 0x1b0], reloc.WS2_32.dll_ntohs
jmp 0x14003c356
mov rbx, rdi
or rbx, 0xf
cmp rbx, r14
cmova rbx, r14
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14003c329
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003c837
mov rcx, rax
call fcn.140133e2c
mov rcx, rax
test rax, rax
je 0x14003c831
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003c337
test rcx, rcx
je 0x14003c335
call fcn.140133e2c
jmp 0x14003c337
xor eax, eax
mov qword [rbp + 0x198], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.1401378a0
mov qword [rbp + 0x1b0], rbx
xor ebx, ebx
mov qword [rbp + 0x1a8], rdi
lea rax, [rbp + 0x198]
mov qword [rbp - 0x10], rax
mov dword [rsp + 0x60], 0xe3c1fdcc
lea rdx, [rbp + 0x198]
lea rcx, [rsp + 0x68]
call fcn.14000cca0
mov r8d, 1
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.14003a840
nop
test al, al
mov r12d, 0x800
jne 0x14003c3a2
mov r12d, ebx
lea rcx, [rbp + 0x198]
call fcn.14000d278
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x28], rbx
mov qword [rbp + 0x30], rbx
mov rdi, qword [rsp + 0x50]
lea rsi, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rsi, qword [rsp + 0x40]
cmp rdi, 0x10
jae 0x14003c3e7
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x30], reloc.WS2_32.dll_ntohs
jmp 0x14003c458
mov rbx, rdi
or rbx, 0xf
cmp rbx, r14
cmova rbx, r14
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14003c431
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003c837
mov rcx, rax
call fcn.140133e2c
mov rcx, rax
test rax, rax
je 0x14003c831
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003c43f
test rcx, rcx
je 0x14003c43d
call fcn.140133e2c
jmp 0x14003c43f
xor eax, eax
mov qword [rbp + 0x18], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.1401378a0
mov qword [rbp + 0x30], rbx
xor ebx, ebx
mov qword [rbp + 0x28], rdi
lea rax, [rbp + 0x18]
mov qword [rbp - 0x10], rax
mov dword [rbp + 0x1c8], 0xe7a436a3
mov dword [rbp + 0x1cc], 0x769dc7ad
mov dword [rbp + 0x1d0], 0xc52c44cc
mov dword [rbp + 0x1d4], 0x85a1fdc8
lea rdx, [rbp + 0x18]
lea rcx, [rsp + 0x68]
call fcn.14000cca0
mov r8d, 4
mov rdx, rax
lea rcx, [rbp + 0x1c8]
call fcn.14003a840
nop
test al, al
mov r15d, 0x1000
jne 0x14003c4bd
mov r15d, ebx
lea rcx, [rbp + 0x18]
call fcn.14000d278
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x60], rbx
mov rdi, qword [rsp + 0x50]
lea rsi, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rsi, qword [rsp + 0x40]
cmp rdi, 0x10
jae 0x14003c4ff
movups xmm0, xmmword [rsi]
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x60], reloc.WS2_32.dll_ntohs
jmp 0x14003c570
mov rbx, rdi
or rbx, 0xf
cmp rbx, r14
cmova rbx, r14
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14003c549
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003c837
mov rcx, rax
call fcn.140133e2c
mov rcx, rax
test rax, rax
je 0x14003c831
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003c557
test rcx, rcx
je 0x14003c555
call fcn.140133e2c
jmp 0x14003c557
xor eax, eax
mov qword [rbp - 0x78], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.1401378a0
mov qword [rbp - 0x60], rbx
xor ebx, ebx
mov qword [rbp - 0x68], rdi
lea rax, [rbp - 0x78]
mov qword [rbp - 0x10], rax
mov dword [rbp + 0x1c0], 0x241edfec
mov dword [rbp + 0x1c4], 0xad7a8ecb
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x68]
call fcn.14000cca0
mov r8d, 2
mov rdx, rax
lea rcx, [rbp + 0x1c0]
call fcn.14003a840
nop
test al, al
mov r14d, 0x2000
jne 0x14003c5c1
mov r14d, ebx
lea rcx, [rbp - 0x78]
call fcn.14000d278
mov qword [rbp - 8], rbx
mov qword [rbp + 8], rbx
mov qword [rbp + 0x10], rbx
mov rdi, qword [rsp + 0x50]
lea rsi, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rsi, qword [rsp + 0x40]
cmp rdi, 0x10
jae 0x14003c603
movups xmm0, xmmword [rsi]
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 0x10], reloc.WS2_32.dll_ntohs
jmp 0x14003c67c
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14003c657
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003c837
mov rcx, rax
call fcn.140133e2c
mov rcx, rax
test rax, rax
je 0x14003c831
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14003c665
test rcx, rcx
je 0x14003c663
call fcn.140133e2c
jmp 0x14003c665
xor eax, eax
mov qword [rbp - 8], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.1401378a0
mov qword [rbp + 0x10], rbx
mov qword [rbp + 8], rdi
lea rcx, [rbp - 8]
call fcn.14003afa0
neg al
sbb ecx, ecx
and ecx, 0x4000
or ecx, r13d
or ecx, dword [rbp + 0x498]
or ecx, dword [rbp + 0x4a0]
or ecx, dword [rbp + 0x4a8]
or ecx, dword [rbp - 0x58]
or ecx, dword [rbp - 0x54]
or ecx, dword [rbp - 0x50]
or ecx, r15d
or ecx, r12d
or ecx, dword [rbp - 0x18]
or ecx, r14d
or ecx, dword [rbp - 0x4c]
or ecx, dword [rbp - 0x48]
or ecx, dword [rbp - 0x44]
mov r14d, dword [rbp + 0x490]
or r14d, ecx
mov dword [rbp + 0x490], r14d
xor r13d, r13d
mov qword [rbp - 0x78], r13
mov qword [rbp - 0x68], r13
mov qword [rbp - 0x60], r13
mov rdi, qword [rsp + 0x50]
lea rsi, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae rsi, qword [rsp + 0x40]
cmp rdi, 0x10
jae 0x14003c713
movups xmm0, xmmword [rsi]
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x60], reloc.WS2_32.dll_ntohs
jmp 0x14003c74f
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmova rbx, rax
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x78]
call fcn.14000d60c
mov qword [rbp - 0x78], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.1401378a0
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x68], rdi
lea rcx, [rbp - 0x78]
call fcn.14003a9c0
mov rdi, qword [rsp + 0x40]
jmp 0x14003c76a
mov r14d, dword [rbp + 0x490]
mov rax, qword [rsp + 0x58]
cmp rax, 0x10
jb 0x14003c7a6
lea rdx, [rax + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14003c79e
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003c83d
mov rcx, rdi
call fcn.140133e68
lea rdx, [rbp + 0x200]
mov rbx, qword [rbp + 0x1d8]
mov rcx, rbx
call sub.KERNEL32.dll_Process32NextW
jmp 0x14003b232
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 0x10
jb 0x14003c808
inc rdx
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003c803
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003c81f
call fcn.140133e68
mov eax, r14d
add rsp, 0x548
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1401462a8
nop
call fcn.1401462a8
nop
call fcn.1401462a8
int3
call fcn.1401462a8
int3
call fcn.14000f3e0
nop
call fcn.1401462a8
int3