Function at 0x14001dba0
Capabilities:
Enumerate process modules
Enumerate threads

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2770]
mov eax, 0x2870
call fcn.14004e560
sub rsp, rax
mov rax, qword [0x14006a040]
xor rax, rsp
mov qword [rbp + 0x2760], rax
mov rbx, rcx
mov qword [rbp + 0x28], rcx
xor r13d, r13d
mov eax, r13d
mov dword [rbp + 0x6f0], eax
mov dword [rbp + 0xba0], eax
xorps xmm0, xmm0
movups xmmword [rbp + 0xd40], xmm0
movups xmmword [rbp + 0xd50], xmm0
movups xmmword [rbp + 0xd60], xmm0
movups xmmword [rbp + 0xd70], xmm0
movups xmmword [rbp + 0xd80], xmm0
mov qword [rbp + 0xd90], rax
mov dword [rbp + 0xd98], eax
mov dword [rbp + 0xd40], 0x5c
mov dword [rbp + 0xd44], 0x40000000
mov dword [rbp + 0xd54], 0xffff
lea r9, [rbp + 0xd40]
mov edx, 0x444
lea r8d, [r13 + 1]
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str._r_nCheck_All_Process_Name__ID__Memory__Base_Priority__Thread_Count__Creation_Time_r_n_r_n
lea rcx, [rbp + 0xdb0]
call fcn.14001a7b0
nop
lea rcx, [rbp + 0xdb0]
call fcn.140041bc0
mov r9, rax
xor r8d, r8d
mov edx, 0xc2
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rbp + 0xc20]
call fcn.140041d30
nop
lea r8, [rbp + 0xbb8]
mov edx, 0x1000
lea rcx, [rbp + 0xf20]
call qword [sym.imp.KERNEL32.dll_K32EnumProcesses]
test eax, eax
jne 0x14001dd25
mov dword [rbp + 0xd54], 0xff
lea r9, [rbp + 0xd40]
mov edx, 0x444
lea r8d, [r13 + 1]
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
lea rdx, str.Unable_to_get_process_name._r_n
lea rcx, [rbp + 0xc68]
call fcn.14001a7b0
lea rcx, [rbp + 0xc68]
call fcn.140041bc0
mov r9, rax
xor r8d, r8d
mov edx, 0xc2
mov rcx, rbx
call qword [sym.imp.USER32.dll_SendMessageW]
lea rcx, [rbp + 0xc68]
call fcn.140003250
xor bl, bl
jmp 0x140020763
mov eax, dword [rbp + 0xbb8]
shr eax, 2
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], r13d
test eax, eax
je 0x140020761
mov r15, r13
mov qword [rsp + 0x48], r13
nop word [rax + rax]
mov r8d, dword [rbp + r15*4 + 0xf20]
xor edx, edx
mov ecx, 0x410
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov r12, rax
mov qword [rbp + 0xba8], rax
test rax, rax
jne 0x14001ddd0
lea rdx, str.OpenProcess___failed_for_PID
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140044180
mov edx, dword [rbp + r15*4 + 0xf20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, str._with_error:
call fcn.140044180
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140044350]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x140020745
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x2140]
call sub.VCRUNTIME140.dll_memset
xorps xmm0, xmm0
movups xmmword [rbp + 0xca8], xmm0
xor eax, eax
mov qword [rbp + 0xcb8], rax
mov qword [rbp + 0xcc0], 0xf
mov byte [rbp + 0xca8], al
movups xmmword [rbp + 0xcc8], xmm0
mov qword [rbp + 0xcd8], rax
mov qword [rbp + 0xce0], 0xf
mov byte [rbp + 0xcc8], al
movups xmmword [rbp + 0xce8], xmm0
mov qword [rbp + 0xcf8], rax
mov qword [rbp + 0xd00], 0xf
mov byte [rbp + 0xce8], al
movups xmmword [rbp + 0xd20], xmm0
mov qword [rbp + 0xd30], rax
mov esi, 0xf
mov qword [rbp - 0x50], rsi
mov qword [rbp + 0xd38], rsi
mov byte [rbp + 0xd20], al
mov ebx, eax
mov edx, dword [rbp + r15*4 + 0xf20]
lea ecx, [rax + 8]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
mov dword [rbp + 0x720], 0x438
lea rdx, [rbp + 0x720]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Module32FirstW]
test eax, eax
je 0x14001df9c
mov r14, qword [rbp + 0x738]
mov qword [rbp + 0x20], r14
mov esi, dword [rbp + 0x740]
add rsi, r14
mov qword [rbp + 0x18], rsi
lea rax, [rbp + 0x750]
mov r9, 0xffffffffffffffff
nop dword [rax + rax]
inc r9
cmp word [rax + r9*2], bx
jne 0x14001ded0
add r9, r9
lea rax, [rbp + 0x750]
add rax, r9
xorps xmm0, xmm0
movups xmmword [rbp + 0xb60], xmm0
xor ecx, ecx
mov qword [rbp + 0xb70], rcx
mov qword [rbp + 0xb78], rcx
lea rcx, [rbp + 0x750]
cmp rcx, rax
jne 0x14001df20
mov qword [rbp + 0xb78], 0xf
mov byte [rbp + 0xb60], bl
jmp 0x14001df36
sar r9, 1
lea rdx, [rbp + 0x750]
lea rcx, [rbp + 0xb60]
call fcn.140049cb0
lea rdx, [rbp + 0xb60]
lea rcx, [rbp + 0xd20]
call fcn.140041e80
mov rdx, qword [rbp + 0xb78]
cmp rdx, 0xf
jbe 0x14001df8a
inc rdx
mov rcx, qword [rbp + 0xb60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001df85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400207b3
call fcn.14004de50
mov ebx, 1
mov rax, qword [rbp + 0xd38]
mov qword [rbp - 0x50], rax
jmp 0x14001dfa4
mov rsi, qword [rbp + 0x18]
mov r14, qword [rbp + 0x20]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rbx, rbx
je 0x14001e037
mov rdx, r14
lea rcx, [rbp + 0xb80]
call fcn.14001da10
mov rdx, rax
lea rcx, [rbp + 0xca8]
call fcn.140041e80
lea rcx, [rbp + 0xb80]
call fcn.140041e20
mov rdx, rsi
lea rcx, [rbp + 0xb80]
call fcn.14001da10
mov rdx, rax
lea rcx, [rbp + 0xcc8]
call fcn.140041e80
lea rcx, [rbp + 0xb80]
call fcn.140041e20
mov rdx, rsi
sub rdx, r14
lea rcx, [rbp + 0xb80]
call fcn.14001da10
mov rdx, rax
lea rcx, [rbp + 0xce8]
call fcn.140041e80
lea rcx, [rbp + 0xb80]
call fcn.140041e20
lea r9, [rbp + 0xd08]
mov r8d, 8
lea rdx, [rbp + 0x710]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
test eax, eax
jne 0x14001e061
lea rdx, str.EnumProcessModules___failed_for_PID
jmp 0x14001e0b7
mov r9d, 0x104
lea r8, [rbp + 0x2140]
mov rdx, qword [rbp + 0x710]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_K32GetModuleBaseNameA]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xb60], xmm0
mov qword [rbp + 0xb70], rax
lea r9d, [rax + 0x18]
lea r8, [rbp + 0xb60]
mov rdx, qword [rbp + 0x710]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
test eax, eax
jne 0x14001e10c
lea rdx, str.GetModuleInformation___failed_for_PID
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140044180
mov edx, dword [rbp + r15*4 + 0xf20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, str._with_error:
call fcn.140044180
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140044350]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14001e367
mov rbx, qword [rbp + 0xb60]
mov esi, dword [rbp + 0xb68]
lea rdi, [rsi + rbx]
lea rcx, [rbp + 0x1f40]
call fcn.14000d6f0
lea rcx, [rbp + 0x1f40]
call fcn.14003f320
nop
lea rdx, [0x140002850]
lea rcx, [rbp + 0x1f50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x1f40]
call fcn.14003f300
nop
mov r8, rax
lea rdx, [0x1400588c4]
lea rcx, [rbp + 0xb80]
call fcn.140044000
mov rdx, rax
lea rcx, [rbp + 0xca8]
call fcn.140041e80
lea rcx, [rbp + 0xb80]
call fcn.140041e20
nop
lea rcx, [rsp + 0x50]
call fcn.140041e20
lea rcx, [rbp + 0xb80]
call fcn.140042150
nop
mov rdx, rax
lea rcx, [rbp + 0x1f40]
call fcn.14003f1f0
nop
lea rcx, [rbp + 0xb80]
call fcn.140041e20
mov rax, qword [rbp + 0x1f40]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x1f40]
add rcx, rax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
lea rdx, [0x140002850]
lea rcx, [rbp + 0x1f50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x1f40]
call fcn.14003f300
nop
mov r8, rax
lea rdx, [0x1400588c4]
lea rcx, [rbp + 0xb80]
call fcn.140044000
mov rdx, rax
lea rcx, [rbp + 0xcc8]
call fcn.140041e80
lea rcx, [rbp + 0xb80]
call fcn.140041e20
nop
lea rcx, [rsp + 0x50]
call fcn.140041e20
lea rcx, [rbp + 0xb80]
call fcn.140042150
nop
mov rdx, rax
lea rcx, [rbp + 0x1f40]
call fcn.14003f1f0
nop
lea rcx, [rbp + 0xb80]
call fcn.140041e20
mov rax, qword [rbp + 0x1f40]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x1f40]
add rcx, rax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
lea rdx, [0x140002850]
lea rcx, [rbp + 0x1f50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
mov edx, esi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_long_unsigned___int64_____ptr64]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x1f40]
call fcn.14003f300
nop
mov r8, rax
lea rdx, [0x1400588c4]
lea rcx, [rbp + 0xb80]
call fcn.140044000
mov rdx, rax
lea rcx, [rbp + 0xce8]
call fcn.140041e80
lea rcx, [rbp + 0xb80]
call fcn.140041e20
nop
lea rcx, [rsp + 0x50]
call fcn.140041e20
lea rcx, [rbp + 0xb80]
call fcn.140042150
nop
mov rdx, rax
lea rcx, [rbp + 0x1f40]
call fcn.14003f1f0
nop
lea rcx, [rbp + 0xb80]
call fcn.140041e20
mov rax, qword [rbp + 0x1f40]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x1f40]
add rcx, rax
xor r8d, r8d
xor edx, edx
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::clear_int__bool____ptr64]
nop
lea rcx, [rbp + 0x1f40]
call fcn.140010ae0
mov r8d, 0x50
lea rdx, [rbp + 0xed0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_K32GetProcessMemoryInfo]
test eax, eax
jne 0x14001e3da
lea rdx, str.GetProcessMemoryInfo___failed_for_PID
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140044180
mov edx, dword [rbp + r15*4 + 0xf20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, str._with_error:
call fcn.140044180
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140044350]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14001e3e1
mov r13d, dword [rbp + 0xee0]
mov r14d, dword [rbp + 0xf18]
mov dword [rbp + 0x6f4], 0
lea rdx, [rbp + 0x6f4]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetProcessHandleCount]
mov r15d, dword [rbp + 0xf08]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_GetPriorityClass]
mov r12d, eax
mov rsi, qword [rsp + 0x48]
mov esi, dword [rbp + rsi*4 + 0xf20]
xor ebx, ebx
xor edx, edx
lea ecx, [rbx + 4]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x14001e47a
mov dword [rbp + 0xb60], 0x1c
lea rdx, [rbp + 0xb60]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Thread32First]
jmp 0x14001e46d
cmp dword [rbp + 0xb6c], esi
jne 0x14001e45d
inc ebx
lea rdx, [rbp + 0xb60]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x14001e453
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
xor edi, edi
lea rax, [rbp + 0xc60]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xc48]
lea r8, [rbp + 0xda0]
lea rdx, [rbp + 0xda8]
mov rcx, qword [rbp + 0xba8]
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x14001e4fa
mov ecx, dword [rbp + 0xc4c]
shl rcx, 0x20
mov eax, dword [rbp + 0xc48]
or rcx, rax
movabs r8, 0xd6bf94d5e57a42bd
mov rax, r8
mul rcx
mov rsi, rdx
shr rsi, 0x17
mov ecx, dword [rbp + 0xc64]
shl rcx, 0x20
mov eax, dword [rbp + 0xc60]
or rcx, rax
mov rax, r8
mul rcx
mov rdi, rdx
shr rdi, 0x17
mov qword [rbp + 0x718], 0
lea r9, [rbp + 0xd0c]
mov r8d, 8
lea rdx, [rbp + 0x718]
mov rcx, qword [rbp + 0xba8]
call qword [sym.imp.KERNEL32.dll_K32EnumProcessModules]
mov r9d, 0x104
lea r8, [rbp + 0x2550]
mov rdx, qword [rbp + 0x718]
mov rcx, qword [rbp + 0xba8]
call qword [sym.imp.KERNEL32.dll_K32GetModuleFileNameExW]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xb60], xmm0
mov qword [rbp + 0xb70], rax
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rdx, rax
mov r9d, 0x18
lea r8, [rbp + 0xb60]
mov rcx, qword [rbp + 0xba8]
call qword [sym.imp.KERNEL32.dll_K32GetModuleInformation]
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp + 0xdd0]
call sub.VCRUNTIME140.dll_memset
lea rax, [0x14005b758]
mov qword [rbp + 0xdd0], rax
lea rax, [0x14005bc60]
mov qword [rbp + 0xde0], rax
lea rcx, [rbp + 0xe68]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
nop
mov eax, dword [rbp + 0x6f0]
bts eax, 7
mov dword [rbp + 0x6f0], eax
mov dword [rbp + 0xba0], eax
xor r8d, r8d
lea rdx, [rbp + 0xde8]
lea rcx, [rbp + 0xdd0]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__::constructor_class_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t______ptr64____ptr64]
nop
mov rax, qword [rbp + 0xdd0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx + 0xdd0], rax
mov rax, qword [rbp + 0xdd0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0xdcc], edx
lea rcx, [rbp + 0xde8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_wchar_t__struct_std::char_traits_wchar_t__::constructor_void____ptr64]
lea rax, vtable.std::basic_stringbuf_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + 0xde8], rax
xor eax, eax
mov qword [rbp + 0xe50], rax
mov dword [rbp + 0xe58], eax
lea rdx, [rbp + 0x2550]
lea rcx, [rbp + 0xde0]
call fcn.140044780
lea rdx, [rbp + 0xc88]
lea rcx, [rbp + 0xde8]
call fcn.140042b60
or dword [rbp + 0x6f0], 0x100
lea rdx, [rbp + 0xc88]
cmp qword [rbp + 0xca0], 7
seta r8b
cmova rdx, qword [rbp + 0xc88]
mov rax, qword [rbp + 0xc98]
lea r9, [rdx + rax*2]
lea rdx, [rbp + 0xc88]
test r8b, r8b
cmovne rdx, qword [rbp + 0xc88]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xor eax, eax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rax
cmp rdx, r9
jne 0x14001e6d8
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], 0xf
mov byte [rsp + 0x70], al
jmp 0x14001e6e9
sub r9, rdx
sar r9, 1
lea rcx, [rsp + 0x70]
call fcn.140049cb0
nop
lea r9, [rbp + 0x1f35]
dec r9
mov eax, 0xcccccccd
mul edi
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub dil, cl
add dil, 0x30
mov byte [r9], dil
mov edi, edx
test edx, edx
jne 0x14001e6f0
lea r8, [rbp + 0x1f35]
mov rdx, r9
lea rcx, [rsp + 0x50]
call fcn.140049b80
or dword [rbp + 0x6f0], 0x600
lea r9, [rbp + 0xb75]
nop dword [rax]
dec r9
mov eax, 0xcccccccd
mul esi
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub sil, cl
add sil, 0x30
mov byte [r9], sil
mov esi, edx
test edx, edx
jne 0x14001e740
lea r8, [rbp + 0xb75]
mov rdx, r9
lea rcx, [rbp - 0x28]
call fcn.140049b80
mov esi, dword [rbp + 0x6f0]
or esi, 0x1800
lea r9, [rbp + 0x1f35]
nop
dec r9
mov eax, 0xcccccccd
mul r14d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r14b, cl
add r14b, 0x30
mov byte [r9], r14b
mov r14d, edx
test edx, edx
jne 0x14001e790
lea r8, [rbp + 0x1f35]
mov rdx, r9
lea rcx, [rbp + 0x210]
call fcn.140049b80
or esi, 0x6000
lea r9, [rbp + 0xb75]
nop dword [rax]
dec r9
mov eax, 0xcccccccd
mul r15d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r15b, cl
add r15b, 0x30
mov byte [r9], r15b
mov r15d, edx
test edx, edx
jne 0x14001e7e0
lea r8, [rbp + 0xb75]
mov rdx, r9
lea rcx, [rbp + 0x400]
call fcn.140049b80
or esi, 0x18000
lea r9, [rbp + 0x1f35]
mov r8d, dword [rbp + 0x6f4]
nop dword [rax]
nop dword [rax + rax]
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x14001e840
lea r8, [rbp + 0x1f35]
mov rdx, r9
lea rcx, [rbp + 0x3e0]
call fcn.140049b80
or esi, 0x60000
lea r9, [rbp + 0xb75]
nop dword [rax]
dec r9
mov eax, 0xcccccccd
mul ebx
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub bl, cl
add bl, 0x30
mov byte [r9], bl
mov ebx, edx
test edx, edx
jne 0x14001e890
lea r8, [rbp + 0xb75]
mov rdx, r9
lea rcx, [rbp + 0x3a0]
call fcn.140049b80
or esi, 0x180000
lea r9, [rbp + 0x1f35]
nop dword [rax]
dec r9
mov eax, 0xcccccccd
mul r12d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r12b, cl
add r12b, 0x30
mov byte [r9], r12b
mov r12d, edx
test edx, edx
jne 0x14001e8e0
lea r8, [rbp + 0x1f35]
mov rdx, r9
lea rcx, [rbp + 0x380]
call fcn.140049b80
or esi, 0x600000
lea r9, [rbp + 0xb75]
nop dword [rax]
dec r9
mov eax, 0xcccccccd
mul r13d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r13b, cl
add r13b, 0x30
mov byte [r9], r13b
mov r13d, edx
test edx, edx
jne 0x14001e930
lea r8, [rbp + 0xb75]
mov rdx, r9
lea rcx, [rbp + 0x320]
call fcn.140049b80
or esi, 0x1800000
mov r15, qword [rsp + 0x48]
mov r8d, dword [rbp + r15*4 + 0xf20]
lea r9, [rbp + 0x1f35]
nop word [rax + rax]
dec r9
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r9], r8b
mov r8d, edx
test edx, edx
jne 0x14001e990
lea r8, [rbp + 0x1f35]
mov rdx, r9
lea rcx, [rbp + 0x300]
call fcn.140049b80
or esi, 0x6000000
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xor r13d, r13d
mov qword [rbp - 0x38], r13
mov qword [rbp - 0x30], r13
lea rax, [rbp + 0x2140]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], r13b
jne 0x14001e9f6
lea rdx, [rbp + 0x2140]
lea rcx, [rbp - 0x48]
call fcn.140004c00
nop
mov r8, qword [rbp - 0x38]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
sub rax, r8
cmp rax, 0x45
jb 0x14001eaac
lea rax, [r8 + 0x45]
mov qword [rbp - 0x38], rax
lea rbx, [rbp - 0x48]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x48]
lea rax, [0x140058bd5]
lea r14, str.__________________________________________________________nProc_Name:
cmp rax, rbx
jbe 0x14001ea6b
lea rax, [rbx + r8]
cmp r14, rax
ja 0x14001ea6b
cmp rbx, r14
ja 0x14001ea63
mov rdi, r13
jmp 0x14001ea70
mov rdi, rbx
sub rdi, r14
jmp 0x14001ea70
mov edi, 0x45
inc r8
lea rcx, [rbx + 0x45]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x45
sub r8, rdi
lea rdx, [r14 + 0x45]
add rdx, rdi
lea rcx, [rbx + rdi]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x48]
jmp 0x14001eacf
mov qword [rsp + 0x28], 0x45
lea rax, str.__________________________________________________________nProc_Name:
mov qword [rsp + 0x20], rax
mov edx, 0x45
lea rcx, [rbp - 0x48]
call fcn.14004b6b0
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], r13
mov qword [rbp + 0x48], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
bts esi, 0x1b
mov r8d, 1
lea rdx, [0x140058a70]
lea rcx, [rbp + 0x30]
call fcn.140041d80
xorps xmm0, xmm0
movups xmmword [rbp + 0x170], xmm0
mov qword [rbp + 0x180], r13
mov qword [rbp + 0x188], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x170], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x180], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
bts esi, 0x1c
mov r8d, 9
lea rdx, str.Proc_ID:
lea rcx, [rbp + 0x170]
call fcn.140041d80
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xc68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xc78], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
bts esi, 0x1d
lea r9, [rbp + 0x300]
lea r8, [rbp + 0xc68]
lea rcx, [rbp + 0x480]
call fcn.140049960
bts esi, 0x1e
mov r8d, 1
lea rdx, [0x140058a70]
lea rcx, [rbp + 0x480]
call fcn.140041d80
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
mov qword [rbp + 0x160], r13
mov qword [rbp + 0x168], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x150], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x160], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
or esi, 0x80000000
mov r8d, 8
lea rdx, str.Memory:
lea rcx, [rbp + 0x150]
call fcn.140041d80
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x290], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x2a0], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
lea r9, [rbp + 0x320]
lea r8, [rbp + 0x290]
lea rcx, [rbp + 0x460]
call fcn.140049960
nop
mov r8d, 7
lea rdx, str._bytes_n
lea rcx, [rbp + 0x460]
call fcn.140041d80
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], r13
mov qword [rbp + 0xc8], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xb0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xc0], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
mov r8d, 0xf
lea rdx, str.Base_Priority:
lea rcx, [rbp + 0xb0]
call fcn.140041d80
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x2b8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x2c8], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
lea r9, [rbp + 0x380]
lea r8, [rbp + 0x2b8]
lea rcx, [rbp + 0x440]
call fcn.140049960
nop
mov r8d, 1
lea rdx, [0x140058a70]
lea rcx, [rbp + 0x440]
call fcn.140041d80
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r13
mov qword [rbp + 0x68], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x60], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
mov r8d, 0xe
lea rdx, str.Thread_Count:
lea rcx, [rbp + 0x50]
call fcn.140041d80
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x2e0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x2f0], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
lea r9, [rbp + 0x3a0]
lea r8, [rbp + 0x2e0]
lea rcx, [rbp + 0x70]
call fcn.140049960
nop
mov r8d, 1
lea rdx, [0x140058a70]
lea rcx, [rbp + 0x70]
call fcn.140041d80
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], r13
mov qword [rbp + 0xa8], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x90], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa0], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
mov r8d, 0xe
lea rdx, str.Handle_Count:
lea rcx, [rbp + 0x90]
call fcn.140041d80
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x230], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x240], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
lea r9, [rbp + 0x3e0]
lea r8, [rbp + 0x230]
lea rcx, [rbp + 0x420]
call fcn.140049960
nop
mov r8d, 1
lea rdx, [0x140058a70]
lea rcx, [rbp + 0x420]
call fcn.140041d80
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], r13
mov qword [rbp + 0xe8], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xd0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xe0], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
mov r8d, 0x10
lea rdx, str.Pagefile_Count:
lea rcx, [rbp + 0xd0]
call fcn.140041d80
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x250], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x260], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
lea r9, [rbp + 0x400]
lea r8, [rbp + 0x250]
lea rcx, [rbp + 0x3c0]
call fcn.140049960
nop
mov r8d, 1
lea rdx, [0x140058a70]
lea rcx, [rbp + 0x3c0]
call fcn.140041d80
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], r13
mov qword [rbp + 0x108], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xf0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x100], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
mov r8d, 0x15
lea rdx, str.Virtual_Memory_Size:
lea rcx, [rbp + 0xf0]
call fcn.140041d80
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x270], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x280], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
lea r9, [rbp + 0x210]
lea r8, [rbp + 0x270]
lea rcx, [rbp + 0x360]
call fcn.140049960
nop
mov r8d, 1
lea rdx, [0x140058a70]
lea rcx, [rbp + 0x360]
call fcn.140041d80
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], r13
mov qword [rbp + 0x128], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x110], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x120], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
mov r8d, 0x12
lea rdx, str.Kernel_Mode_Time:
lea rcx, [rbp + 0x110]
call fcn.140041d80
movups xmm0, xmmword [rax]
movups xmmword [rbp - 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 8], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
lea r9, [rbp - 0x28]
lea r8, [rbp - 8]
lea rcx, [rbp + 0x340]
call fcn.140049960
nop
mov r8d, 9
lea rdx, str._seconds_n
lea rcx, [rbp + 0x340]
call fcn.140041d80
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], r13
mov qword [rbp + 0x148], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x130], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x140], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r8, str.User_Mode_Time:
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x6d0]
call fcn.1400437c0
nop
lea r8, [rsp + 0x50]
mov rdx, rax
lea rcx, [rbp + 0x6b0]
call fcn.1400438a0
nop
lea r8, str._seconds_n
mov rdx, rax
lea rcx, [rbp + 0x690]
call fcn.1400437c0
nop
lea r8, str.Base_Address:
mov rdx, rax
lea rcx, [rbp + 0x670]
call fcn.1400437c0
nop
lea r8, [rbp + 0xca8]
mov rdx, rax
lea rcx, [rbp + 0x530]
call fcn.140043830
nop
lea r8, [0x140058a70]
mov rdx, rax
lea rcx, [rbp + 0x650]
call fcn.1400437c0
nop
lea r8, str.End_Address:
mov rdx, rax
lea rcx, [rbp + 0x630]
call fcn.1400437c0
nop
lea r8, [rbp + 0xcc8]
mov rdx, rax
lea rcx, [rbp + 0x610]
call fcn.140043830
nop
lea r8, [0x140058a70]
mov rdx, rax
lea rcx, [rbp + 0x5f0]
call fcn.1400437c0
nop
lea r8, str.Offset:
mov rdx, rax
lea rcx, [rbp + 0x5d0]
call fcn.1400437c0
nop
lea r8, [rbp + 0xce8]
mov rdx, rax
lea rcx, [rbp + 0x5b0]
call fcn.140043830
nop
lea r8, [0x140058a70]
mov rdx, rax
lea rcx, [rbp + 0x590]
call fcn.1400437c0
nop
lea r8, str.Process_Main_Module:
mov rdx, rax
lea rcx, [rbp + 0x570]
call fcn.1400437c0
nop
lea r8, [rsp + 0x70]
mov rdx, rax
lea rcx, [rbp + 0x550]
call fcn.1400438a0
nop
lea r8, [0x140058a70]
mov rdx, rax
lea rcx, [rbp + 0xbc0]
call fcn.1400437c0
nop
lea rcx, [rbp + 0x550]
call fcn.140041e20
nop
lea rcx, [rbp + 0x570]
call fcn.140041e20
nop
lea rcx, [rbp + 0x590]
call fcn.140041e20
nop
lea rcx, [rbp + 0x5b0]
call fcn.140041e20
nop
lea rcx, [rbp + 0x5d0]
call fcn.140041e20
nop
lea rcx, [rbp + 0x5f0]
call fcn.140041e20
nop
lea rcx, [rbp + 0x610]
call fcn.140041e20
nop
lea rcx, [rbp + 0x630]
call fcn.140041e20
nop
lea rcx, [rbp + 0x650]
call fcn.140041e20
nop
lea rcx, [rbp + 0x530]
call fcn.140041e20
nop
lea rcx, [rbp + 0x670]
call fcn.140041e20
nop
lea rcx, [rbp + 0x690]
call fcn.140041e20
nop
lea rcx, [rbp + 0x6b0]
call fcn.140041e20
nop
lea rcx, [rbp + 0x6d0]
call fcn.140041e20
nop
lea rcx, [rbp + 0x130]
call fcn.140041e20
nop
lea rcx, [rbp + 0x340]
call fcn.140041e20
nop
lea rcx, [rbp - 8]
call fcn.140041e20
nop
lea rcx, [rbp + 0x110]
call fcn.140041e20
nop
lea rcx, [rbp + 0x360]
call fcn.140041e20
nop
lea rcx, [rbp + 0x270]
call fcn.140041e20
nop
lea rcx, [rbp + 0xf0]
call fcn.140041e20
nop
lea rcx, [rbp + 0x3c0]
call fcn.140041e20
nop
lea rcx, [rbp + 0x250]
call fcn.140041e20
nop
lea rcx, [rbp + 0xd0]
call fcn.140041e20
nop
lea rcx, [rbp + 0x420]
call fcn.140041e20
nop
lea rcx, [rbp + 0x230]
call fcn.140041e20
nop
lea rcx, [rbp + 0x90]
call fcn.140041e20
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x14001f39a
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f395
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400207ba
call fcn.14004de50
mov qword [rbp + 0x80], r13
mov qword [rbp + 0x88], 0xf
mov byte [rbp + 0x70], 0
lea rcx, [rbp + 0x2e0]
call fcn.140041e20
nop
lea rcx, [rbp + 0x50]
call fcn.140041e20
nop
lea rcx, [rbp + 0x440]
call fcn.140041e20
nop
lea rcx, [rbp + 0x2b8]
call fcn.140041e20
nop
lea rcx, [rbp + 0xb0]
call fcn.140041e20
nop
lea rcx, [rbp + 0x460]
call fcn.140041e20
nop
lea rcx, [rbp + 0x290]
call fcn.140041e20
nop
lea rcx, [rbp + 0x150]
call fcn.140041e20
nop
lea rcx, [rbp + 0x480]
call fcn.140041e20
nop
lea rcx, [rbp + 0xc68]
call fcn.140041e20
nop
lea rcx, [rbp + 0x170]
call fcn.140041e20
nop
lea rcx, [rbp + 0x30]
call fcn.140041e20
nop
lea rcx, [rbp - 0x48]
call fcn.140041e20
nop
lea rcx, [rbp + 0x300]
call fcn.140041e20
nop
lea rcx, [rbp + 0x320]
call fcn.140041e20
nop
lea rcx, [rbp + 0x380]
call fcn.140041e20
nop
lea rcx, [rbp + 0x3a0]
call fcn.140041e20
nop
lea rcx, [rbp + 0x3e0]
call fcn.140041e20
nop
lea rcx, [rbp + 0x400]
call fcn.140041e20
nop
lea rcx, [rbp + 0x210]
call fcn.140041e20
nop
lea rcx, [rbp - 0x28]
call fcn.140041e20
nop
lea rcx, [rsp + 0x50]
call fcn.140041e20
nop
lea rcx, [rsp + 0x70]
call fcn.140041e20
xor edx, edx
mov r14, qword [rbp + 0xba8]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetGuiResources]
mov ebx, eax
mov edx, 1
mov rcx, r14
call qword [sym.imp.USER32.dll_GetGuiResources]
mov edx, eax
lea rcx, [rbp + 0xb80]
call fcn.140002a20
mov rdi, rax
mov edx, ebx
lea rcx, [rbp + 0x1d0]
call fcn.140002a20
nop
mov r8, rax
lea rdx, str.GDI_Objects:
lea rcx, [rbp + 0x1f0]
call fcn.140044000
nop
lea r8, [0x140058a70]
mov rdx, rax
lea rcx, [rbp + 0x1b0]
call fcn.1400437c0
nop
mov r8d, 0xe
lea rdx, str.USER_Objects:
mov rcx, rax
call fcn.140041d80
movups xmm0, xmmword [rax]
movups xmmword [rbp - 8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 8], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
or esi, 8
mov r9, rdi
lea r8, [rbp - 8]
lea rcx, [rbp + 0x190]
call fcn.140049960
or esi, 0x10
mov r8d, 1
lea rdx, [0x140058a70]
lea rcx, [rbp + 0x190]
call fcn.140041d80
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
or esi, 0x20
mov dword [rbp + 0x6f0], esi
lea rdx, [rsp + 0x70]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
cmova rdx, rcx
movq r8, xmm1
lea rcx, [rbp + 0xbc0]
call fcn.140041d80
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x14001f636
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f630
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400207c1
call fcn.14004de50
nop
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 0xf
jbe 0x14001f677
inc rdx
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f672
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400207c8
call fcn.14004de50
mov qword [rbp + 0x1a0], r13
mov qword [rbp + 0x1a8], 0xf
mov byte [rbp + 0x190], 0
mov rdx, qword [rbp + 0x10]
cmp rdx, 0xf
jbe 0x14001f6cc
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f6c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400207cf
call fcn.14004de50
nop
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0xf
jbe 0x14001f70d
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f708
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400207d6
call fcn.14004de50
mov qword [rbp + 0x1c0], r13
mov qword [rbp + 0x1c8], 0xf
mov byte [rbp + 0x1b0], 0
mov rdx, qword [rbp + 0x208]
cmp rdx, 0xf
jbe 0x14001f767
inc rdx
mov rcx, qword [rbp + 0x1f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f762
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400207dd
call fcn.14004de50
mov qword [rbp + 0x200], r13
mov qword [rbp + 0x208], 0xf
mov byte [rbp + 0x1f0], 0
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 0xf
jbe 0x14001f7c1
inc rdx
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f7bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400207e4
call fcn.14004de50
mov qword [rbp + 0x1e0], r13
mov qword [rbp + 0x1e8], 0xf
mov byte [rbp + 0x1d0], 0
mov rdx, qword [rbp + 0xb98]
cmp rdx, 0xf
jbe 0x14001f81b
inc rdx
mov rcx, qword [rbp + 0xb80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001f816
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400207eb
call fcn.14004de50
lea rax, [rbp + 0xc58]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xc50]
lea r8, [rbp + 0xd18]
lea rdx, [rbp + 0xbb0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x14001f9f1
mov edx, dword [rbp + 0xc58]
add edx, dword [rbp + 0xc50]
mov eax, 0x6b5fca6b
mul edx
mov esi, edx
shr esi, 0x16
mov eax, 0x91a2b3c5
mul esi
mov ebx, edx
shr ebx, 0xb
imul eax, ebx, 0xe10
mov ecx, esi
sub ecx, eax
mov eax, 0x88888889
mul ecx
mov edi, edx
shr edi, 5
mov eax, 0x88888889
mul esi
shr edx, 5
imul eax, edx, 0x3c
sub esi, eax
lea rcx, [rbp + 0x1f40]
call fcn.14000d6f0
lea rcx, [rbp + 0x1f40]
call fcn.14003f320
nop
mov rax, qword [rbp + 0x1f50]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x1f50]
add rcx, rax
mov dl, 0x30
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::fill_char____ptr64]
mov edx, 2
lea rcx, [rbp + 0x4a0]
call qword [sym.imp.MSVCP140.dll_struct_std::_Smanip_long_long___int64_____cdecl_std::setw_long_long___int64__]
mov rdx, rax
lea rcx, [rbp + 0x1f50]
call fcn.1400451f0
mov edx, ebx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140057d8c]
call fcn.140044180
mov rbx, rax
mov edx, 2
lea rcx, [rbp + 0x4b0]
call qword [sym.imp.MSVCP140.dll_struct_std::_Smanip_long_long___int64_____cdecl_std::setw_long_long___int64__]
mov rdx, rax
mov rcx, rbx
call fcn.1400451f0
mov edx, edi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
mov rcx, rax
lea rdx, [0x140057d8c]
call fcn.140044180
mov rbx, rax
mov edx, 2
lea rcx, [rbp + 0x4c0]
call qword [sym.imp.MSVCP140.dll_struct_std::_Smanip_long_long___int64_____cdecl_std::setw_long_long___int64__]
mov rdx, rax
mov rcx, rbx
call fcn.1400451f0
mov edx, esi
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [rbp + 0xb80]
lea rcx, [rbp + 0x1f40]
call fcn.14003f300
nop
lea r8, [rbp + 0xb80]
lea rdx, str.Elapsed_Time:
lea rcx, [rbp - 0x28]
call fcn.140043ea0
nop
lea r8, [0x140058a70]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400437c0
nop
mov rdx, rax
lea rcx, [rbp + 0xbc0]
call fcn.140041e00
nop
lea rcx, [rsp + 0x50]
call fcn.140041e20
nop
lea rcx, [rbp - 0x28]
call fcn.140041e20
nop
lea rcx, [rbp + 0xb80]
call fcn.140041e20
nop
lea rcx, [rbp + 0x1f40]
call fcn.140010ae0
mov esi, dword [rbp + 0x6f0]
lea r8, [rbp + 0x6f8]
mov edx, 8
mov rcx, r14
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14001fc16
mov dword [rbp + 0x6f0], r13d
lea rax, [rbp + 0x6f0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
mov rcx, qword [rbp + 0x6f8]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x14001fa4b
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x14001fc09
mov ecx, dword [rbp + 0x6f0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rdi, rax
test rax, rax
je 0x14001fc00
lea rax, [rbp + 0x6f0]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x6f0]
mov r8, rdi
mov edx, 1
mov rcx, qword [rbp + 0x6f8]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x14001fc00
mov dword [rbp + 0xba8], 0x100
mov dword [rbp + 0xba0], 0x100
lea rax, [rbp + 0xd10]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0xba0]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x2350]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xba8]
lea r8, [rbp + 0x1f40]
mov rdx, qword [rdi]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupAccountSidW]
test eax, eax
je 0x14001fc00
lea rdx, [rbp + 0x1f40]
lea rcx, [rbp + 0x210]
call fcn.14001a7b0
mov rbx, rax
lea rdx, [rbp + 0x2350]
lea rcx, [rbp - 0x28]
call fcn.14001a7b0
nop
lea r8, [0x140055dec]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400445d0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0xc68]
call fcn.140044cc0
nop
lea rcx, [rsp + 0x50]
call fcn.140003250
nop
lea rcx, [rbp - 0x28]
call fcn.140003250
nop
lea rcx, [rbp + 0x210]
call fcn.140003250
lea rdx, [rbp + 0x2d8]
lea rcx, [rbp + 0xc68]
call fcn.140041bd0
mov r8, qword [rax]
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0xc68]
call fcn.140041bf0
mov rdx, qword [rax]
lea rcx, [rbp + 0xb80]
call fcn.140044130
nop
lea r8, [rbp + 0xb80]
lea rdx, str.Process_Owner:
lea rcx, [rbp - 0x28]
call fcn.140043ea0
nop
lea r8, [0x140058a70]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400437c0
nop
mov rdx, rax
lea rcx, [rbp + 0xbc0]
call fcn.140041e00
nop
lea rcx, [rsp + 0x50]
call fcn.140041e20
nop
lea rcx, [rbp - 0x28]
call fcn.140041e20
nop
lea rcx, [rbp + 0xb80]
call fcn.140041e20
nop
lea rcx, [rbp + 0xc68]
call fcn.140003250
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp + 0x6f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rax, [rbp + 0xc58]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xc50]
lea r8, [rbp + 0xd18]
lea rdx, [rbp + 0xbb0]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetProcessTimes]
test eax, eax
je 0x14001fe91
lea rdx, [rbp + 0xbb0]
lea rcx, [rbp + 0xbb0]
call qword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
lea rdx, [rbp + 0x700]
lea rcx, [rbp + 0xbb0]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea rcx, [rbp + 0x1f40]
call fcn.14000d6f0
lea rcx, [rbp + 0x1f40]
call fcn.14003f320
nop
mov rax, qword [rbp + 0x1f50]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x1f50]
add rcx, rax
mov dl, 0x30
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::fill_char____ptr64]
mov edx, 4
lea rcx, [rbp + 0x4d0]
call qword [sym.imp.MSVCP140.dll_struct_std::_Smanip_long_long___int64_____cdecl_std::setw_long_long___int64__]
mov rdx, rax
lea rcx, [rbp + 0x1f50]
call fcn.1400451f0
movzx edx, word [rbp + 0x700]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_short_int____ptr64]
mov rcx, rax
lea rdx, [0x140058c18]
call fcn.140044180
mov rbx, rax
mov edx, 2
lea rcx, [rbp + 0x4e0]
call qword [sym.imp.MSVCP140.dll_struct_std::_Smanip_long_long___int64_____cdecl_std::setw_long_long___int64__]
mov rdx, rax
mov rcx, rbx
call fcn.1400451f0
movzx edx, word [rbp + 0x702]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_short_int____ptr64]
mov rcx, rax
lea rdx, [0x140058c18]
call fcn.140044180
mov rbx, rax
mov edx, 2
lea rcx, [rbp + 0x4f0]
call qword [sym.imp.MSVCP140.dll_struct_std::_Smanip_long_long___int64_____cdecl_std::setw_long_long___int64__]
mov rdx, rax
mov rcx, rbx
call fcn.1400451f0
movzx edx, word [rbp + 0x706]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_short_int____ptr64]
mov rcx, rax
lea rdx, [0x140055678]
call fcn.140044180
mov rbx, rax
mov edx, 2
lea rcx, [rbp + 0x500]
call qword [sym.imp.MSVCP140.dll_struct_std::_Smanip_long_long___int64_____cdecl_std::setw_long_long___int64__]
mov rdx, rax
mov rcx, rbx
call fcn.1400451f0
movzx edx, word [rbp + 0x708]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_short_int____ptr64]
mov rcx, rax
lea rdx, [0x140057d8c]
call fcn.140044180
mov rbx, rax
mov edx, 2
lea rcx, [rbp + 0x510]
call qword [sym.imp.MSVCP140.dll_struct_std::_Smanip_long_long___int64_____cdecl_std::setw_long_long___int64__]
mov rdx, rax
mov rcx, rbx
call fcn.1400451f0
movzx edx, word [rbp + 0x70a]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_short_int____ptr64]
mov rcx, rax
lea rdx, [0x140057d8c]
call fcn.140044180
mov rbx, rax
mov edx, 2
lea rcx, [rbp + 0x520]
call qword [sym.imp.MSVCP140.dll_struct_std::_Smanip_long_long___int64_____cdecl_std::setw_long_long___int64__]
mov rdx, rax
mov rcx, rbx
call fcn.1400451f0
movzx edx, word [rbp + 0x70c]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_short_int____ptr64]
lea rdx, [rbp + 0xb80]
lea rcx, [rbp + 0x1f40]
call fcn.14003f300
nop
lea r8, [rbp + 0xb80]
lea rdx, str.Creation_Time:
lea rcx, [rbp - 0x28]
call fcn.140043ea0
nop
lea r8, [0x140058a70]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.1400437c0
nop
mov rdx, rax
lea rcx, [rbp + 0xbc0]
call fcn.140041e00
nop
lea rcx, [rsp + 0x50]
call fcn.140041e20
nop
lea rcx, [rbp - 0x28]
call fcn.140041e20
nop
lea rcx, [rbp + 0xb80]
call fcn.140041e20
nop
lea rcx, [rbp + 0x1f40]
call fcn.140010ae0
lea rdx, [rbp + 0xbc0]
cmp qword [rbp + 0xbd8], 0xf
seta r9b
cmova rdx, qword [rbp + 0xbc0]
mov r8, qword [rbp + 0xbd0]
add r8, rdx
lea rdx, [rbp + 0xbc0]
test r9b, r9b
cmovne rdx, qword [rbp + 0xbc0]
lea rcx, [rbp + 0xc00]
call fcn.140044b70
nop
lea rax, [rbp + 0xc00]
mov r10, qword [rbp + 0xc18]
cmp r10, 7
seta cl
mov r11, qword [rbp + 0xc00]
cmova rax, r11
mov r8, qword [rbp + 0xc10]
lea rdx, [rax + r8*2]
lea rax, [rbp + 0xc00]
test cl, cl
cmovne rax, r11
cmp rax, rdx
je 0x14001ff40
cmp word [rax], 0x20
jne 0x14001ff1d
mov word [rax], 0xa0
add rax, 2
cmp rax, rdx
jne 0x14001ff12
mov r15, qword [rsp + 0x48]
mov r10, qword [rbp + 0xc18]
mov r8, qword [rbp + 0xc10]
mov r11, qword [rbp + 0xc00]
movabs rax, 0x7ffffffffffffffe
sub rax, r8
cmp rax, 2
jb 0x1400208e1
lea r9, [rbp + 0xc00]
cmp r10, 7
cmova r9, r11
mov qword [rsp + 0x30], 2
lea rax, [0x14005788c]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r8
lea rcx, [rbp + 0xb80]
call fcn.140049820
or esi, 0x40
mov dword [rbp + 0x6f0], esi
mov rdx, qword [rbp + 0xc38]
cmp rdx, 7
jbe 0x14001ffdb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ffd6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400207f2
call fcn.14004de50
movups xmm0, xmmword [rbp + 0xb80]
movups xmmword [rbp + 0xc20], xmm0
movups xmm1, xmmword [rbp + 0xb90]
movups xmmword [rbp + 0xc30], xmm1
lea rax, [rbp + 0xc40]
mov qword [rsp + 0x20], rax
mov r9d, 0x100
lea r8, [rbp + 0x2250]
mov edx, 0x400000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x14002049a
lea rcx, [rbp + 0x1f40]
call fcn.14000d6f0
lea rcx, [rbp + 0x1f40]
call fcn.14003f320
nop
mov rbx, r13
cmp qword [rbp + 0xc40], rbx
jbe 0x14002008b
nop dword [rax + rax]
lea rdx, [0x140002850]
lea rcx, [rbp + 0x1f50]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::ios_base____ptr64____cdecl___class_std::ios_base____ptr64_____ptr64]
movzx edx, byte [rbp + rbx + 0x2250]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_int____ptr64]
mov rcx, rax
mov dl, 0x20
call fcn.140044390
inc rbx
cmp rbx, qword [rbp + 0xc40]
jb 0x140020050
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x1f58]
call fcn.1400431f0
or esi, 4
mov r8, qword [rbp - 0x60]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
sub rax, r8
cmp rax, 0xd
jb 0x14002013b
lea rax, [r8 + 0xd]
mov qword [rbp - 0x60], rax
lea rbx, [rbp - 0x70]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x70]
lea rax, [0x140058c3d]
lea r12, str.Memory_Data:
cmp rax, rbx
jbe 0x1400200f9
lea rax, [rbx + r8]
cmp r12, rax
ja 0x1400200f9
cmp rbx, r12
ja 0x1400200f1
mov rdi, r13
jmp 0x1400200fe
mov rdi, rbx
sub rdi, r12
jmp 0x1400200fe
mov edi, 0xd
inc r8
lea rcx, [rbx + 0xd]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r12
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0xd
sub r8, rdi
lea rdx, [r12 + 0xd]
add rdx, rdi
lea rcx, [rbx + rdi]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x70]
jmp 0x14002015e
mov qword [rsp + 0x28], 0xd
lea rax, str.Memory_Data:
mov qword [rsp + 0x20], rax
mov edx, 0xd
lea rcx, [rbp - 0x70]
call fcn.14004b6b0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f20], xmm0
mov qword [rbp + 0x1f30], r13
mov qword [rbp + 0x1f38], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1f20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1f30], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r13
mov byte [rax], 0
or esi, 2
mov r8d, 1
lea rdx, [0x140058a70]
lea rcx, [rbp + 0x1f20]
call fcn.140041d80
xorps xmm0, xmm0
movups xmmword [rbp + 0xb60], xmm0
mov qword [rbp + 0xb70], r13
mov qword [rbp + 0xb78], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xb60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xb70], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
or esi, 1
mov dword [rbp + 0x6f0], esi
mov rdx, qword [rbp + 0x1f38]
cmp rdx, 0xf
jbe 0x14002023c
inc rdx
mov rcx, qword [rbp + 0x1f20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020237
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400207f9
call fcn.14004de50
mov qword [rbp + 0x1f30], r13
mov qword [rbp + 0x1f38], 0xf
mov byte [rbp + 0x1f20], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140020290
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002028b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140020800
call fcn.14004de50
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], 0xf
mov byte [rbp - 0x70], 0
lea r8, [rbp + 0xb60]
cmp qword [rbp + 0xb78], 0xf
seta r9b
cmova r8, qword [rbp + 0xb60]
add r8, qword [rbp + 0xb70]
lea rdx, [rbp + 0xb60]
test r9b, r9b
cmovne rdx, qword [rbp + 0xb60]
lea rcx, [rbp + 0xbe0]
call fcn.140044b70
nop
lea rax, [rbp + 0xbe0]
mov r8, qword [rbp + 0xbf8]
cmp r8, 7
seta cl
mov r9, qword [rbp + 0xbe0]
cmova rax, r9
mov r10, qword [rbp + 0xbf0]
lea rdx, [rax + r10*2]
lea rax, [rbp + 0xbe0]
test cl, cl
cmovne rax, r9
cmp rax, rdx
je 0x14002034e
nop
cmp word [rax], 0x20
jne 0x14002032b
mov word [rax], 0xa0
add rax, 2
cmp rax, rdx
jne 0x140020320
mov r15, qword [rsp + 0x48]
mov r8, qword [rbp + 0xbf8]
mov r10, qword [rbp + 0xbf0]
mov r9, qword [rbp + 0xbe0]
lea rdx, [rbp + 0xbe0]
cmp r8, 7
cmova rdx, r9
mov r8, r10
lea rcx, [rbp + 0xc20]
call fcn.140041c10
nop
mov rdx, qword [rbp + 0xbf8]
cmp rdx, 7
jbe 0x1400203b3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xbe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400203ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140020807
call fcn.14004de50
mov qword [rbp + 0xbf0], r13
mov qword [rbp + 0xbf8], 7
mov word [rbp + 0xbe0], r13w
mov rdx, qword [rbp + 0xb78]
cmp rdx, 0xf
jbe 0x14002040e
inc rdx
mov rcx, qword [rbp + 0xb60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020409
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002080e
call fcn.14004de50
mov qword [rbp + 0xb70], r13
mov qword [rbp + 0xb78], 0xf
mov byte [rbp + 0xb60], 0
mov rax, qword [rbp + 0x1f40]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + rcx + 0x1f40], rax
mov rax, qword [rbp + 0x1f40]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0x1f3c], edx
lea rax, vtable.std::basic_stringbuf_char__struct_std::char_traits_char___class_std::allocator_char__.0
mov qword [rbp + 0x1f58], rax
lea rcx, [rbp + 0x1f58]
call fcn.140043140
lea rcx, [rbp + 0x1f58]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x1f60]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x1fd8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea r9, [rbp + 0xc20]
cmp qword [rbp + 0xc38], 7
cmova r9, qword [rbp + 0xc20]
xor r8d, r8d
mov edx, 0xc2
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.USER32.dll_SendMessageW]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
mov rdx, qword [rbp + 0xc18]
cmp rdx, 7
jbe 0x140020513
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc00]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002050e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140020815
call fcn.14004de50
mov qword [rbp + 0xc10], r13
mov qword [rbp + 0xc18], 7
mov word [rbp + 0xc00], r13w
mov rdx, qword [rbp + 0xbd8]
cmp rdx, 0xf
jbe 0x14002056e
inc rdx
mov rcx, qword [rbp + 0xbc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020569
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002081c
call fcn.14004de50
mov qword [rbp + 0xbd0], r13
mov qword [rbp + 0xbd8], 0xf
mov byte [rbp + 0xbc0], 0
mov rdx, qword [rbp + 0xca0]
cmp rdx, 7
jbe 0x1400205cd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400205c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140020823
call fcn.14004de50
mov qword [rbp + 0xc98], r13
mov qword [rbp + 0xca0], 7
mov word [rbp + 0xc88], r13w
mov rax, qword [rbp + 0xdd0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_stringstream_wchar_t__struct_std::char_traits_wchar_t___class_std::allocator_wchar_t__.0
mov qword [rbp + rcx + 0xdd0], rax
mov rax, qword [rbp + 0xdd0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0x98]
mov dword [rbp + rcx + 0xdcc], edx
lea rcx, [rbp + 0xde8]
call fcn.14003fa70
lea rcx, [rbp + 0xdf0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_iostream_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
lea rcx, [rbp + 0xe68]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::destructor_void____ptr64]
nop
mov rax, qword [rbp - 0x50]
cmp rax, 0xf
jbe 0x140020680
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0xd20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002067a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002082a
call fcn.14004de50
nop
mov rdx, qword [rbp + 0xd00]
cmp rdx, 0xf
jbe 0x1400206c2
inc rdx
mov rcx, qword [rbp + 0xce8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400206bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140020831
call fcn.14004de50
nop
mov rdx, qword [rbp + 0xce0]
cmp rdx, 0xf
jbe 0x140020704
inc rdx
mov rcx, qword [rbp + 0xcc8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400206fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140020838
call fcn.14004de50
nop
mov rdx, qword [rbp + 0xcc0]
cmp rdx, 0xf
jbe 0x140020745
inc rdx
mov rcx, qword [rbp + 0xca8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020740
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002083f
call fcn.14004de50
mov ebx, dword [rsp + 0x44]
inc ebx
mov dword [rsp + 0x44], ebx
inc r15
mov qword [rsp + 0x48], r15
cmp ebx, dword [rsp + 0x40]
jb 0x14001dd50
mov bl, 1
mov rdx, qword [rbp + 0xc38]
cmp rdx, 7
jbe 0x14002084b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140020846
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140020846
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14004de50
mov qword [rbp + 0xc30], r13
mov qword [rbp + 0xc38], 7
mov word [rbp + 0xc20], r13w
mov rdx, qword [rbp + 0xdc8]
cmp rdx, 7
jbe 0x1400208ae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xdb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400208a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400208a9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004de50
movzx eax, bl
mov rcx, qword [rbp + 0x2760]
xor rcx, rsp
call fcn.14004de30
lea r11, [rsp + 0x2870]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140002030
nop
int3