Function at 0x1400c55a0
Capabilities:
Get logon sessions

Disassembly:
mov qword [rsp + 0x10], rdx
mov dword [rsp + 8], ecx
push rsi
push rdi
mov eax, 0x96d8
call fcn.140101da0
sub rsp, rax
mov rax, qword [0x1401cf518]
xor rax, rsp
mov qword [rsp + 0x96c0], rax
mov dword [rsp + 0x40], 0
lea rdx, [0x140151b80]
lea rcx, [rsp + 0xcd0]
call fcn.140003570
nop
lea rdx, [rsp + 0xcd0]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0x44], al
lea rcx, [rsp + 0xcd0]
call fcn.140003860
movzx eax, byte [rsp + 0x44]
test eax, eax
je 0x1400c5621
lea rcx, str._nmain
call fcn.14000ad70
mov dword [rsp + 0x1410], 0x54
mov dword [rsp + 0x1414], 0
xor eax, eax
mov word [rsp + 0x1418], ax
mov eax, ntohs
mov word [rsp + 0x141a], ax
mov dword [rsp + 0x141c], 0
mov dword [rsp + 0x1420], 0x190
lea rdx, str.Consolas
lea rcx, [rsp + 0x1424]
call fcn.14010e3b0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
lea r8, [rsp + 0x1410]
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetCurrentConsoleFontEx]
mov ecx, 0x4e4
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov ecx, 0x4e4
call qword [sym.imp.KERNEL32.dll_SetConsoleCP]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov dx, 7
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rcx, [0x140151bf4]
call fcn.140112e28
lea rcx, [0x1401d7c10]
call fcn.1400b5410
mov qword [rsp + 0x118], rax
lea rax, [rsp + 0x10b0]
mov qword [rsp + 0x100], rax
lea rcx, [rsp + 0x6c]
call fcn.140003030
mov qword [rsp + 0xf8], rax
lea rdx, [0x140151bf8]
lea rcx, [rsp + 0x7f8]
call fcn.140003570
nop
lea rax, [rsp + 0x818]
mov r8, rax
lea rdx, [rsp + 0x7f8]
lea rcx, [rsp + 0xf70]
call fcn.140033310
lea rcx, [rsp + 0x5e0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x5f0]
lea rcx, [rsp + 0x5e0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rsp + 0xf8]
lea rdx, [rsp + 0x5f0]
mov rcx, qword [rsp + 0x100]
call fcn.1400348f0
mov qword [rsp + 0x108], rax
mov rax, qword [rsp + 0x108]
mov qword [rsp + 0x110], rax
mov rdx, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x118]
call fcn.1400bf180
mov qword [rsp + 0x120], rax
lea rdx, str._t_t:_Analyze_all_processes:_characteristics__memory__threads_and_.NET_Assemblies.
lea rcx, [rsp + 0xcf0]
call fcn.140003570
nop
lea rdx, [rsp + 0xcf0]
mov rcx, qword [rsp + 0x120]
call fcn.1400b7730
mov qword [rsp + 0x128], rax
xor edx, edx
mov rcx, qword [rsp + 0x128]
call fcn.1400c1e90
nop
lea rcx, [rsp + 0xcf0]
call fcn.140003860
nop
lea r9, [fcn.140003860]
mov r8d, 1
mov edx, 0x20
lea rcx, [rsp + 0x7f8]
call fcn.140102180
lea rcx, [0x1401d7c10]
call fcn.1400b5410
mov qword [rsp + 0x150], rax
lea rax, [rsp + 0x1218]
mov qword [rsp + 0x138], rax
lea rcx, [rsp + 0x6d]
call fcn.140003030
mov qword [rsp + 0x130], rax
lea rdx, [0x140151c98]
lea rcx, [rsp + 0x7d0]
call fcn.140003570
nop
lea rax, [rsp + 0x7f0]
mov r8, rax
lea rdx, [rsp + 0x7d0]
lea rcx, [rsp + 0xf10]
call fcn.140033310
lea rcx, [rsp + 0x600]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x610]
lea rcx, [rsp + 0x600]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rsp + 0x130]
lea rdx, [rsp + 0x610]
mov rcx, qword [rsp + 0x138]
call fcn.1400348f0
mov qword [rsp + 0x140], rax
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x148], rax
mov rdx, qword [rsp + 0x148]
mov rcx, qword [rsp + 0x150]
call fcn.1400bf180
mov qword [rsp + 0x158], rax
lea rdx, str._PID__Process_name____...___..._...__t:_Analyze_those_processes._Use_space_as_separator.
lea rcx, [rsp + 0xd10]
call fcn.140003570
nop
lea rdx, [rsp + 0xd10]
mov rcx, qword [rsp + 0x158]
call fcn.1400b7730
mov qword [rsp + 0x160], rax
xor edx, edx
mov rcx, qword [rsp + 0x160]
call fcn.1400c1e90
nop
lea rcx, [rsp + 0xd10]
call fcn.140003860
nop
lea r9, [fcn.140003860]
mov r8d, 1
mov edx, 0x20
lea rcx, [rsp + 0x7d0]
call fcn.140102180
lea rcx, [0x1401d7c10]
call fcn.1400b5410
mov qword [rsp + 0x188], rax
lea rax, [rsp + 0x1200]
mov qword [rsp + 0x170], rax
lea rcx, [rsp + 0x5c]
call fcn.140003030
mov qword [rsp + 0x168], rax
lea rdx, [0x140151d5c]
lea rcx, [rsp + 0xa28]
call fcn.140003570
nop
lea rax, [rsp + 0xa48]
mov r8, rax
lea rdx, [rsp + 0xa28]
lea rcx, [rsp + 0xf90]
call fcn.140033310
lea rcx, [rsp + 0x620]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x630]
lea rcx, [rsp + 0x620]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rsp + 0x168]
lea rdx, [rsp + 0x630]
mov rcx, qword [rsp + 0x170]
call fcn.1400348f0
mov qword [rsp + 0x178], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x180], rax
mov rdx, qword [rsp + 0x180]
mov rcx, qword [rsp + 0x188]
call fcn.1400bf180
mov qword [rsp + 0x190], rax
lea rdx, str._n__t:_Used_indicating_a_process_with__p._It_will_show_all_processes_created_n_minutes_after_or_before_the_indicated_process.
lea rcx, [rsp + 0xd30]
call fcn.140003570
nop
lea rdx, [rsp + 0xd30]
mov rcx, qword [rsp + 0x190]
call fcn.1400b7730
mov qword [rsp + 0x198], rax
xor edx, edx
mov rcx, qword [rsp + 0x198]
call fcn.1400c1e90
nop
lea rcx, [rsp + 0xd30]
call fcn.140003860
nop
lea r9, [fcn.140003860]
mov r8d, 1
mov edx, 0x20
lea rcx, [rsp + 0xa28]
call fcn.140102180
lea rcx, [0x1401d7c10]
call fcn.1400b5410
mov qword [rsp + 0x1c0], rax
lea rax, [rsp + 0x11e8]
mov qword [rsp + 0x1a8], rax
lea rcx, [rsp + 0x5d]
call fcn.140003030
mov qword [rsp + 0x1a0], rax
lea rdx, [0x140151de0]
lea rcx, [rsp + 0xa00]
call fcn.140003570
nop
lea rax, [rsp + 0xa20]
mov r8, rax
lea rdx, [rsp + 0xa00]
lea rcx, [rsp + 0xfa0]
call fcn.140033310
lea rcx, [rsp + 0x640]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x550]
lea rcx, [rsp + 0x640]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rsp + 0x1a0]
lea rdx, [rsp + 0x550]
mov rcx, qword [rsp + 0x1a8]
call fcn.1400348f0
mov qword [rsp + 0x1b0], rax
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x1b8], rax
mov rdx, qword [rsp + 0x1b8]
mov rcx, qword [rsp + 0x1c0]
call fcn.1400bf180
mov qword [rsp + 0x1c8], rax
lea rdx, str._t_t:_Used_with__a__p._Analyze_modules_and_shows_extended_information_of_those_with_alerts.
lea rcx, [rsp + 0xd50]
call fcn.140003570
nop
lea rdx, [rsp + 0xd50]
mov rcx, qword [rsp + 0x1c8]
call fcn.1400b7730
mov qword [rsp + 0x1d0], rax
xor edx, edx
mov rcx, qword [rsp + 0x1d0]
call fcn.1400c1e90
nop
lea rcx, [rsp + 0xd50]
call fcn.140003860
nop
lea r9, [fcn.140003860]
mov r8d, 1
mov edx, 0x20
lea rcx, [rsp + 0xa00]
call fcn.140102180
lea rcx, [0x1401d7c10]
call fcn.1400b5410
mov qword [rsp + 0x1f8], rax
lea rax, [rsp + 0x11d0]
mov qword [rsp + 0x1e0], rax
lea rcx, [rsp + 0x5e]
call fcn.140003030
mov qword [rsp + 0x1d8], rax
lea rdx, str.__ds
lea rcx, [rsp + 0x9d8]
call fcn.140003570
nop
lea rax, [rsp + 0x9f8]
mov r8, rax
lea rdx, [rsp + 0x9d8]
lea rcx, [rsp + 0xfb0]
call fcn.140033310
lea rcx, [rsp + 0x660]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x670]
lea rcx, [rsp + 0x660]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rsp + 0x1d8]
lea rdx, [rsp + 0x670]
mov rcx, qword [rsp + 0x1e0]
call fcn.1400348f0
mov qword [rsp + 0x1e8], rax
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x1f0], rax
mov rdx, qword [rsp + 0x1f0]
mov rcx, qword [rsp + 0x1f8]
call fcn.1400bf180
mov qword [rsp + 0x200], rax
lea rdx, str._t:_Used_with__a__p._Deep_scan_searching_moated_modules_in_memory._Time_consuming._Highly_recommended.
lea rcx, [rsp + 0xd70]
call fcn.140003570
nop
lea rdx, [rsp + 0xd70]
mov rcx, qword [rsp + 0x200]
call fcn.1400b7730
mov qword [rsp + 0x208], rax
xor edx, edx
mov rcx, qword [rsp + 0x208]
call fcn.1400c1e90
nop
lea rcx, [rsp + 0xd70]
call fcn.140003860
nop
lea r9, [fcn.140003860]
mov r8d, 1
mov edx, 0x20
lea rcx, [rsp + 0x9d8]
call fcn.140102180
lea rcx, [0x1401d7c10]
call fcn.1400b5410
mov qword [rsp + 0x230], rax
lea rax, [rsp + 0x11b8]
mov qword [rsp + 0x218], rax
lea rcx, [rsp + 0x5f]
call fcn.140003030
mov qword [rsp + 0x210], rax
lea rdx, str.__ns
lea rcx, [rsp + 0x9b0]
call fcn.140003570
nop
lea rax, [rsp + 0x9d0]
mov r8, rax
lea rdx, [rsp + 0x9b0]
lea rcx, [rsp + 0xfc0]
call fcn.140033310
lea rcx, [rsp + 0x680]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x690]
lea rcx, [rsp + 0x680]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rsp + 0x210]
lea rdx, [rsp + 0x690]
mov rcx, qword [rsp + 0x218]
call fcn.1400348f0
mov qword [rsp + 0x220], rax
mov rax, qword [rsp + 0x220]
mov qword [rsp + 0x228], rax
mov rdx, qword [rsp + 0x228]
mov rcx, qword [rsp + 0x230]
call fcn.1400bf180
mov qword [rsp + 0x238], rax
lea rdx, str._t:_Used_with__a__p._No_system_logon_session_processes.
lea rcx, [rsp + 0xd90]
call fcn.140003570
nop
lea rdx, [rsp + 0xd90]
mov rcx, qword [rsp + 0x238]
call fcn.1400b7730
mov qword [rsp + 0x240], rax
xor edx, edx
mov rcx, qword [rsp + 0x240]
call fcn.1400c1e90
nop
lea rcx, [rsp + 0xd90]
call fcn.140003860
nop
lea r9, [fcn.140003860]
mov r8d, 1
mov edx, 0x20
lea rcx, [rsp + 0x9b0]
call fcn.140102180
lea rcx, [0x1401d7c10]
call fcn.1400b5410
mov qword [rsp + 0x268], rax
lea rax, [rsp + 0x11a0]
mov qword [rsp + 0x250], rax
lea rcx, [rsp + 0x60]
call fcn.140003030
mov qword [rsp + 0x248], rax
lea rdx, str.__os
lea rcx, [rsp + 0x938]
call fcn.140003570
nop
lea rax, [rsp + 0x958]
mov r8, rax
lea rdx, [rsp + 0x938]
lea rcx, [rsp + 0xfd0]
call fcn.140033310
lea rcx, [rsp + 0x6a0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x6b0]
lea rcx, [rsp + 0x6a0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rsp + 0x248]
lea rdx, [rsp + 0x6b0]
mov rcx, qword [rsp + 0x250]
call fcn.1400348f0
mov qword [rsp + 0x258], rax
mov rax, qword [rsp + 0x258]
mov qword [rsp + 0x260], rax
mov rdx, qword [rsp + 0x260]
mov rcx, qword [rsp + 0x268]
call fcn.1400bf180
mov qword [rsp + 0x270], rax
lea rdx, str._t:_Used_with__a__p._Only_system_logon_session_processes.
lea rcx, [rsp + 0xdb0]
call fcn.140003570
nop
lea rdx, [rsp + 0xdb0]
mov rcx, qword [rsp + 0x270]
call fcn.1400b7730
mov qword [rsp + 0x278], rax
xor edx, edx
mov rcx, qword [rsp + 0x278]
call fcn.1400c1e90
nop
lea rcx, [rsp + 0xdb0]
call fcn.140003860
nop
lea r9, [fcn.140003860]
mov r8d, 1
mov edx, 0x20
lea rcx, [rsp + 0x938]
call fcn.140102180
lea rcx, [0x1401d7c10]
call fcn.1400b5410
mov qword [rsp + 0x2a0], rax
lea rax, [rsp + 0x1188]
mov qword [rsp + 0x288], rax
lea rcx, [rsp + 0x61]
call fcn.140003030
mov qword [rsp + 0x280], rax
lea rdx, str.__mm
lea rcx, [rsp + 0x988]
call fcn.140003570
nop
lea rax, [rsp + 0x9a8]
mov r8, rax
lea rdx, [rsp + 0x988]
lea rcx, [rsp + 0xfe0]
call fcn.140033310
lea rcx, [rsp + 0x6c0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x6d0]
lea rcx, [rsp + 0x6c0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rsp + 0x280]
lea rdx, [rsp + 0x6d0]
mov rcx, qword [rsp + 0x288]
call fcn.1400348f0
mov qword [rsp + 0x290], rax
mov rax, qword [rsp + 0x290]
mov qword [rsp + 0x298], rax
mov rdx, qword [rsp + 0x298]
mov rcx, qword [rsp + 0x2a0]
call fcn.1400bf180
mov qword [rsp + 0x2a8], rax
lea rdx, str._t:_Used_with__a__p:_like__m_but_shows_extended_information_of_all_modules.
lea rcx, [rsp + 0xdd0]
call fcn.140003570
nop
lea rdx, [rsp + 0xdd0]
mov rcx, qword [rsp + 0x2a8]
call fcn.1400b7730
mov qword [rsp + 0x2b0], rax
xor edx, edx
mov rcx, qword [rsp + 0x2b0]
call fcn.1400c1e90
nop
lea rcx, [rsp + 0xdd0]
call fcn.140003860
nop
lea r9, [fcn.140003860]
mov r8d, 1
mov edx, 0x20
lea rcx, [rsp + 0x988]
call fcn.140102180
lea rcx, [0x1401d7c10]
call fcn.1400b5410
mov qword [rsp + 0x2d8], rax
lea rax, [rsp + 0x1110]
mov qword [rsp + 0x2c0], rax
lea rcx, [rsp + 0x62]
call fcn.140003030
mov qword [rsp + 0x2b8], rax
lea rdx, str.__np
lea rcx, [rsp + 0x960]
call fcn.140003570
nop
lea rax, [rsp + 0x980]
mov r8, rax
lea rdx, [rsp + 0x960]
lea rcx, [rsp + 0xf80]
call fcn.140033310
lea rcx, [rsp + 0x6e0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x6f0]
lea rcx, [rsp + 0x6e0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rsp + 0x2b8]
lea rdx, [rsp + 0x6f0]
mov rcx, qword [rsp + 0x2c0]
call fcn.1400348f0
mov qword [rsp + 0x2c8], rax
mov rax, qword [rsp + 0x2c8]
mov qword [rsp + 0x2d0], rax
mov rdx, qword [rsp + 0x2d0]
mov rcx, qword [rsp + 0x2d8]
call fcn.1400bf180
mov qword [rsp + 0x2e0], rax
lea rdx, str._t:_Displays_the_Named_Pipes_of_the_system.
lea rcx, [rsp + 0xdf0]
call fcn.140003570
nop
lea rdx, [rsp + 0xdf0]
mov rcx, qword [rsp + 0x2e0]
call fcn.1400b7730
mov qword [rsp + 0x2e8], rax
xor edx, edx
mov rcx, qword [rsp + 0x2e8]
call fcn.1400c1e90
nop
lea rcx, [rsp + 0xdf0]
call fcn.140003860
nop
lea r9, [fcn.140003860]
mov r8d, 1
mov edx, 0x20
lea rcx, [rsp + 0x960]
call fcn.140102180
lea rcx, [0x1401d7c10]
call fcn.1400b5410
mov qword [rsp + 0x310], rax
lea rax, [rsp + 0x10c8]
mov qword [rsp + 0x2f8], rax
lea rcx, [rsp + 0x63]
call fcn.140003030
mov qword [rsp + 0x2f0], rax
lea rdx, str.__kl
lea rcx, [rsp + 0x910]
call fcn.140003570
nop
lea rax, [rsp + 0x930]
mov r8, rax
lea rdx, [rsp + 0x910]
lea rcx, [rsp + 0x1000]
call fcn.140033310
lea rcx, [rsp + 0x700]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x710]
lea rcx, [rsp + 0x700]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rsp + 0x2f0]
lea rdx, [rsp + 0x710]
mov rcx, qword [rsp + 0x2f8]
call fcn.1400348f0
mov qword [rsp + 0x300], rax
mov rax, qword [rsp + 0x300]
mov qword [rsp + 0x308], rax
mov rdx, qword [rsp + 0x308]
mov rcx, qword [rsp + 0x310]
call fcn.1400bf180
mov qword [rsp + 0x318], rax
lea rdx, str.__n__t:_Used_with__m___mm:_shows_the_name_of_the_first_n_modified_exported_functions._n_t_t_t_t_t_t_tIf_omitted_shows_the_first_20_modified_functions.
lea rcx, [rsp + 0xe10]
call fcn.140003570
nop
lea rdx, [rsp + 0xe10]
mov rcx, qword [rsp + 0x318]
call fcn.1400b7730
mov qword [rsp + 0x320], rax
xor edx, edx
mov rcx, qword [rsp + 0x320]
call fcn.1400c1e90
nop
lea rcx, [rsp + 0xe10]
call fcn.140003860
nop
lea r9, [fcn.140003860]
mov r8d, 1
mov edx, 0x20
lea rcx, [rsp + 0x910]
call fcn.140102180
lea rcx, [0x1401d7c10]
call fcn.1400b5410
mov qword [rsp + 0x348], rax
lea rax, [rsp + 0x1170]
mov qword [rsp + 0x330], rax
lea rcx, [rsp + 0x64]
call fcn.140003030
mov qword [rsp + 0x328], rax
lea rdx, str.__kd
lea rcx, [rsp + 0x8e8]
call fcn.140003570
nop
lea rax, [rsp + 0x908]
mov r8, rax
lea rdx, [rsp + 0x8e8]
lea rcx, [rsp + 0xf20]
call fcn.140033310
lea rcx, [rsp + 0x720]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x730]
lea rcx, [rsp + 0x720]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rsp + 0x328]
lea rdx, [rsp + 0x730]
mov rcx, qword [rsp + 0x330]
call fcn.1400348f0
mov qword [rsp + 0x338], rax
mov rax, qword [rsp + 0x338]
mov qword [rsp + 0x340], rax
mov rdx, qword [rsp + 0x340]
mov rcx, qword [rsp + 0x348]
call fcn.1400bf180
mov qword [rsp + 0x350], rax
lea rdx, str.__n__t:_Used_with__m___mm:_shows_the_name_and_disassembles_the_first_n_modified_exported_functions._n_t_t_t_t_t_t_tIf_omitted_shows_the_first_5_modified_functions.
lea rcx, [rsp + 0xc50]
call fcn.140003570
nop
lea rdx, [rsp + 0xc50]
mov rcx, qword [rsp + 0x350]
call fcn.1400b7730
mov qword [rsp + 0x358], rax
xor edx, edx
mov rcx, qword [rsp + 0x358]
call fcn.1400c1e90
nop
lea rcx, [rsp + 0xc50]
call fcn.140003860
nop
lea r9, [fcn.140003860]
mov r8d, 1
mov edx, 0x20
lea rcx, [rsp + 0x8e8]
call fcn.140102180
lea rcx, [0x1401d7c10]
call fcn.1400b5410
mov qword [rsp + 0x380], rax
lea rax, [rsp + 0x1128]
mov qword [rsp + 0x368], rax
lea rcx, [rsp + 0x65]
call fcn.140003030
mov qword [rsp + 0x360], rax
lea rdx, str.__cs
lea rcx, [rsp + 0x8c0]
call fcn.140003570
nop
lea rax, [rsp + 0x8e0]
mov r8, rax
lea rdx, [rsp + 0x8c0]
lea rcx, [rsp + 0x1010]
call fcn.140033310
lea rcx, [rsp + 0x740]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x750]
lea rcx, [rsp + 0x740]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rsp + 0x360]
lea rdx, [rsp + 0x750]
mov rcx, qword [rsp + 0x368]
call fcn.1400348f0
mov qword [rsp + 0x370], rax
mov rax, qword [rsp + 0x370]
mov qword [rsp + 0x378], rax
mov rdx, qword [rsp + 0x378]
mov rcx, qword [rsp + 0x380]
call fcn.1400bf180
mov qword [rsp + 0x388], rax
lea rdx, str._t:_Used_with__a__p._Shows_the_Call_Stack_of_all_threads_and_not_just_from_suspicious_threads.
lea rcx, [rsp + 0xe30]
call fcn.140003570
nop
lea rdx, [rsp + 0xe30]
mov rcx, qword [rsp + 0x388]
call fcn.1400b7730
mov qword [rsp + 0x390], rax
xor edx, edx
mov rcx, qword [rsp + 0x390]
call fcn.1400c1e90
nop
lea rcx, [rsp + 0xe30]
call fcn.140003860
nop
lea r9, [fcn.140003860]
mov r8d, 1
mov edx, 0x20
lea rcx, [rsp + 0x8c0]
call fcn.140102180
lea rcx, [0x1401d7c10]
call fcn.1400b5410
mov qword [rsp + 0x3b8], rax
lea rax, [rsp + 0x1140]
mov qword [rsp + 0x3a0], rax
lea rcx, [rsp + 0x66]
call fcn.140003030
mov qword [rsp + 0x398], rax
lea rdx, [0x1401524a8]
lea rcx, [rsp + 0x898]
call fcn.140003570
nop
lea rax, [rsp + 0x8b8]
mov r8, rax
lea rdx, [rsp + 0x898]
lea rcx, [rsp + 0xf30]
call fcn.140033310
lea rcx, [rsp + 0x760]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x770]
lea rcx, [rsp + 0x760]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rsp + 0x398]
lea rdx, [rsp + 0x770]
mov rcx, qword [rsp + 0x3a0]
call fcn.1400348f0
mov qword [rsp + 0x3a8], rax
mov rax, qword [rsp + 0x3a8]
mov qword [rsp + 0x3b0], rax
mov rdx, qword [rsp + 0x3b0]
mov rcx, qword [rsp + 0x3b8]
call fcn.1400bf180
mov qword [rsp + 0x3c0], rax
lea rdx, str._t_t:_Used_with__a__p:_saves_the_results_to_files.
lea rcx, [rsp + 0xe50]
call fcn.140003570
nop
lea rdx, [rsp + 0xe50]
mov rcx, qword [rsp + 0x3c0]
call fcn.1400b7730
mov qword [rsp + 0x3c8], rax
xor edx, edx
mov rcx, qword [rsp + 0x3c8]
call fcn.1400c1e90
nop
lea rcx, [rsp + 0xe50]
call fcn.140003860
nop
lea r9, [fcn.140003860]
mov r8d, 1
mov edx, 0x20
lea rcx, [rsp + 0x898]
call fcn.140102180
lea rcx, [0x1401d7c10]
call fcn.1400b5410
mov qword [rsp + 0x3f0], rax
lea rax, [rsp + 0x1158]
mov qword [rsp + 0x3d8], rax
lea rcx, [rsp + 0x67]
call fcn.140003030
mov qword [rsp + 0x3d0], rax
lea rdx, str.__nd
lea rcx, [rsp + 0x870]
call fcn.140003570
nop
lea rax, [rsp + 0x890]
mov r8, rax
lea rdx, [rsp + 0x870]
lea rcx, [rsp + 0xf40]
call fcn.140033310
lea rcx, [rsp + 0x650]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x780]
lea rcx, [rsp + 0x650]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rsp + 0x3d0]
lea rdx, [rsp + 0x780]
mov rcx, qword [rsp + 0x3d8]
call fcn.1400348f0
mov qword [rsp + 0x3e0], rax
mov rax, qword [rsp + 0x3e0]
mov qword [rsp + 0x3e8], rax
mov rdx, qword [rsp + 0x3e8]
mov rcx, qword [rsp + 0x3f0]
call fcn.1400bf180
mov qword [rsp + 0x3f8], rax
lea rdx, str._t:_Used_with__s:_does_not_display_the_information_obtained_on_the_screen.
lea rcx, [rsp + 0xe70]
call fcn.140003570
nop
lea rdx, [rsp + 0xe70]
mov rcx, qword [rsp + 0x3f8]
call fcn.1400b7730
mov qword [rsp + 0x400], rax
xor edx, edx
mov rcx, qword [rsp + 0x400]
call fcn.1400c1e90
nop
lea rcx, [rsp + 0xe70]
call fcn.140003860
nop
lea r9, [fcn.140003860]
mov r8d, 1
mov edx, 0x20
lea rcx, [rsp + 0x870]
call fcn.140102180
lea rcx, [0x1401d7c10]
call fcn.1400b5410
mov qword [rsp + 0x428], rax
lea rax, [rsp + 0x10e0]
mov qword [rsp + 0x410], rax
lea rcx, [rsp + 0x68]
call fcn.140003030
mov qword [rsp + 0x408], rax
lea rdx, [0x1401526b0]
lea rcx, [rsp + 0x848]
call fcn.140003570
nop
lea rax, [rsp + 0x868]
mov r8, rax
lea rdx, [rsp + 0x848]
lea rcx, [rsp + 0xf50]
call fcn.140033310
lea rcx, [rsp + 0x790]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x7a0]
lea rcx, [rsp + 0x790]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rsp + 0x408]
lea rdx, [rsp + 0x7a0]
mov rcx, qword [rsp + 0x410]
call fcn.1400348f0
mov qword [rsp + 0x418], rax
mov rax, qword [rsp + 0x418]
mov qword [rsp + 0x420], rax
mov rdx, qword [rsp + 0x420]
mov rcx, qword [rsp + 0x428]
call fcn.1400bf180
mov qword [rsp + 0x430], rax
lea rdx, str._t_t:_Used_with__a__p._Saves_detected_memory_areas_to_files._By_default_always_saves__No_Name__detected_modules._n_t_t_t_t___Saved_files_are_xored_with_key_0x0E.
lea rcx, [rsp + 0xe90]
call fcn.140003570
nop
lea rdx, [rsp + 0xe90]
mov rcx, qword [rsp + 0x430]
call fcn.1400b7730
mov qword [rsp + 0x438], rax
xor edx, edx
mov rcx, qword [rsp + 0x438]
call fcn.1400c1e90
nop
lea rcx, [rsp + 0xe90]
call fcn.140003860
nop
lea r9, [fcn.140003860]
mov r8d, 1
mov edx, 0x20
lea rcx, [rsp + 0x848]
call fcn.140102180
lea rcx, [0x1401d7c10]
call fcn.1400b5410
mov qword [rsp + 0x460], rax
lea rax, [rsp + 0x10f8]
mov qword [rsp + 0x448], rax
lea rcx, [rsp + 0x69]
call fcn.140003030
mov qword [rsp + 0x440], rax
lea rdx, str.__debug
lea rcx, [rsp + 0x820]
call fcn.140003570
nop
lea rax, [rsp + 0x840]
mov r8, rax
lea rdx, [rsp + 0x820]
lea rcx, [rsp + 0xf60]
call fcn.140033310
lea rcx, [rsp + 0x7b0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rax, [rsp + 0x7c0]
lea rcx, [rsp + 0x7b0]
mov rdi, rax
mov rsi, rcx
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rsp + 0x440]
lea rdx, [rsp + 0x7c0]
mov rcx, qword [rsp + 0x448]
call fcn.1400348f0
mov qword [rsp + 0x450], rax
mov rax, qword [rsp + 0x450]
mov qword [rsp + 0x458], rax
mov rdx, qword [rsp + 0x458]
mov rcx, qword [rsp + 0x460]
call fcn.1400bf180
mov qword [rsp + 0x468], rax
lea rdx, [0x1401442b4]
lea rcx, [rsp + 0xeb0]
call fcn.140003570
nop
lea rdx, [rsp + 0xeb0]
mov rcx, qword [rsp + 0x468]
call fcn.1400b7730
mov qword [rsp + 0x470], rax
xor edx, edx
mov rcx, qword [rsp + 0x470]
call fcn.1400c1e90
nop
lea rcx, [rsp + 0xeb0]
call fcn.140003860
nop
lea r9, [fcn.140003860]
mov r8d, 1
mov edx, 0x20
lea rcx, [rsp + 0x820]
call fcn.140102180
lea rcx, [0x1401d7c10]
call fcn.1400bb4a0
mov r9, qword [rsp + 0x96f8]
mov r8d, dword [rsp + 0x96f0]
lea rdx, [rsp + 0x12b0]
lea rcx, [0x1401d7c10]
call fcn.1400bfbb0
nop
lea rcx, [rsp + 0x12b0]
call fcn.140041f20
movzx eax, al
test eax, eax
je 0x1400c6d5a
lea rdx, [rsp + 0x12b0]
lea rcx, [0x1401d8710]
call fcn.140041350
mov qword [rsp + 0x478], rax
lea rdx, [0x14002c370]
mov rcx, qword [rsp + 0x478]
call fcn.140041320
call fcn.14008d750
lea rcx, [0x1401d7c10]
call fcn.1400c1080
mov dword [rsp + 0x98], 0xffffffff
lea rcx, [rsp + 0x12b0]
call fcn.14003cb10
mov eax, dword [rsp + 0x98]
jmp 0x1400c8115
mov byte [0x1401d2a17], 1
mov byte [0x1401d2a1a], 0
lea rdx, [0x1401527ec]
lea rcx, [rsp + 0xed0]
call fcn.140003570
nop
lea rdx, [rsp + 0xed0]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0x45], al
lea rcx, [rsp + 0xed0]
call fcn.140003860
movzx eax, byte [rsp + 0x45]
test eax, eax
je 0x1400c6db9
mov byte [0x1401d2a17], 0
mov byte [0x1401d2a1a], 1
lea rdx, [0x140152824]
lea rcx, [rsp + 0xef0]
call fcn.140003570
nop
lea rdx, [rsp + 0xef0]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0x46], al
lea rcx, [rsp + 0xef0]
call fcn.140003860
movzx eax, byte [rsp + 0x46]
test eax, eax
je 0x1400c6e03
mov byte [0x1401d2a1a], 1
lea rdx, [0x14015286c]
lea rcx, [rsp + 0xa50]
call fcn.140003570
nop
lea rdx, [rsp + 0xa50]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0x47], al
lea rcx, [rsp + 0xa50]
call fcn.140003860
movzx eax, byte [rsp + 0x47]
test eax, eax
je 0x1400c6e7b
call fcn.14008d750
lea rcx, [0x1401d7c10]
call fcn.1400c1080
mov dword [rsp + 0x9c], 0
lea rcx, [rsp + 0x12b0]
call fcn.14003cb10
mov eax, dword [rsp + 0x9c]
jmp 0x1400c8115
lea rdx, [0x1401528cc]
lea rcx, [rsp + 0xaf0]
call fcn.140003570
nop
mov eax, dword [rsp + 0x40]
or eax, 1
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0xaf0]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
jne 0x1400c6f30
lea rdx, [0x1401528e8]
lea rcx, [rsp + 0xad0]
call fcn.140003570
nop
mov eax, dword [rsp + 0x40]
or eax, 2
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0xad0]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
jne 0x1400c6f30
lea rdx, [0x140152904]
lea rcx, [rsp + 0xab0]
call fcn.140003570
nop
mov eax, dword [rsp + 0x40]
or eax, 4
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0xab0]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
je 0x1400c6fb0
lea rdx, [0x14015290c]
lea rcx, [rsp + 0xa90]
call fcn.140003570
nop
mov eax, dword [rsp + 0x40]
or eax, 8
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0xa90]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
je 0x1400c6fa6
lea rdx, [0x140152910]
lea rcx, [rsp + 0xa70]
call fcn.140003570
nop
mov eax, dword [rsp + 0x40]
or eax, 0x10
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0xa70]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
jne 0x1400c6fb0
mov dword [rsp + 0x78], 0
jmp 0x1400c6fb8
mov dword [rsp + 0x78], 1
movzx eax, byte [rsp + 0x78]
mov byte [rsp + 0x48], al
mov eax, dword [rsp + 0x40]
and eax, 0x10
test eax, eax
je 0x1400c6fdf
and dword [rsp + 0x40], 0xffffffef
lea rcx, [rsp + 0xa70]
call fcn.140003860
nop
mov eax, dword [rsp + 0x40]
and eax, 8
test eax, eax
je 0x1400c6ffd
and dword [rsp + 0x40], 0xfffffff7
lea rcx, [rsp + 0xa90]
call fcn.140003860
nop
mov eax, dword [rsp + 0x40]
and eax, 4
test eax, eax
je 0x1400c701b
and dword [rsp + 0x40], 0xfffffffb
lea rcx, [rsp + 0xab0]
call fcn.140003860
nop
mov eax, dword [rsp + 0x40]
and eax, 2
test eax, eax
je 0x1400c7039
and dword [rsp + 0x40], 0xfffffffd
lea rcx, [rsp + 0xad0]
call fcn.140003860
nop
mov eax, dword [rsp + 0x40]
and eax, 1
test eax, eax
je 0x1400c7056
and dword [rsp + 0x40], 0xfffffffe
lea rcx, [rsp + 0xaf0]
call fcn.140003860
movzx eax, byte [rsp + 0x48]
test eax, eax
je 0x1400c7094
call fcn.14008d750
lea rcx, [0x1401d7c10]
call fcn.1400c1080
mov dword [rsp + 0xa0], 0xffffffff
lea rcx, [rsp + 0x12b0]
call fcn.14003cb10
mov eax, dword [rsp + 0xa0]
jmp 0x1400c8115
lea rdx, [0x14015299c]
lea rcx, [rsp + 0xc90]
call fcn.140003570
nop
mov eax, dword [rsp + 0x40]
or eax, 0x20
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0xc90]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
jne 0x1400c7114
lea rdx, [0x1401529e4]
lea rcx, [rsp + 0xb10]
call fcn.140003570
nop
mov eax, dword [rsp + 0x40]
or eax, 0x40
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0xb10]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
je 0x1400c7114
mov dword [rsp + 0x7c], 1
jmp 0x1400c711c
mov dword [rsp + 0x7c], 0
movzx eax, byte [rsp + 0x7c]
mov byte [rsp + 0x49], al
mov eax, dword [rsp + 0x40]
and eax, 0x40
test eax, eax
je 0x1400c7143
and dword [rsp + 0x40], 0xffffffbf
lea rcx, [rsp + 0xb10]
call fcn.140003860
nop
mov eax, dword [rsp + 0x40]
and eax, 0x20
test eax, eax
je 0x1400c7160
and dword [rsp + 0x40], 0xffffffdf
lea rcx, [rsp + 0xc90]
call fcn.140003860
movzx eax, byte [rsp + 0x49]
test eax, eax
je 0x1400c719e
call fcn.14008d750
lea rcx, [0x1401d7c10]
call fcn.1400c1080
mov dword [rsp + 0xa4], 0xffffffff
lea rcx, [rsp + 0x12b0]
call fcn.14003cb10
mov eax, dword [rsp + 0xa4]
jmp 0x1400c8115
lea rdx, [0x140152b74]
lea rcx, [rsp + 0xb30]
call fcn.140003570
nop
lea rdx, [rsp + 0xb30]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0x4a], al
lea rcx, [rsp + 0xb30]
call fcn.140003860
movzx eax, byte [rsp + 0x4a]
test eax, eax
je 0x1400c76ba
mov edx, 0xf0
lea rcx, [rsp + 0x15d0]
call fcn.1400079b0
lea rdx, [0x140152ba0]
lea rcx, [rsp + 0xb50]
call fcn.140003570
nop
lea r8, [rsp + 0xb50]
lea rdx, [rsp + 0x1020]
lea rcx, [0x1401d7c10]
call fcn.14002d570
mov qword [rsp + 0x480], rax
mov rax, qword [rsp + 0x480]
mov qword [rsp + 0x488], rax
mov r9d, 1
mov r8d, 1
mov rdx, qword [rsp + 0x488]
lea rcx, [rsp + 0x15d0]
call fcn.140031af0
nop
lea rcx, [rsp + 0x1020]
call fcn.140003860
nop
lea rcx, [rsp + 0xb50]
call fcn.140003860
mov edx, 0x28
lea rcx, [rsp + 0x1310]
call fcn.1400079b0
lea rdx, [rsp + 0x15d0]
lea rcx, [rsp + 0x1310]
call fcn.140033890
nop
mov edx, 0x28
lea rcx, [rsp + 0x1338]
call fcn.1400079b0
lea rcx, [rsp + 0x1338]
call fcn.140033930
nop
mov edx, 0x18
lea rcx, [rsp + 0x12d8]
call fcn.1400079b0
lea rcx, [rsp + 0x6a]
call fcn.140003030
mov qword [rsp + 0x4b8], rax
lea rax, [rsp + 0x1230]
mov qword [rsp + 0x490], rax
lea rdx, [rsp + 0x1338]
mov rcx, qword [rsp + 0x490]
call fcn.1400338e0
mov qword [rsp + 0x498], rax
mov rax, qword [rsp + 0x498]
mov qword [rsp + 0x4a0], rax
mov rax, qword [rsp + 0x4a0]
mov qword [rsp + 0x4c0], rax
lea rax, [rsp + 0x1258]
mov qword [rsp + 0x4a8], rax
lea rdx, [rsp + 0x1310]
mov rcx, qword [rsp + 0x4a8]
call fcn.1400338e0
mov qword [rsp + 0x4b0], rax
mov rax, qword [rsp + 0x4b0]
mov qword [rsp + 0x4c8], rax
mov r9, qword [rsp + 0x4b8]
mov r8, qword [rsp + 0x4c0]
mov rdx, qword [rsp + 0x4c8]
lea rcx, [rsp + 0x12d8]
call fcn.14000e5b0
nop
lea rax, [rsp + 0x12d8]
mov qword [rsp + 0xb8], rax
mov rcx, qword [rsp + 0xb8]
call fcn.140008ce0
mov qword [rsp + 0x90], rax
mov rcx, qword [rsp + 0xb8]
call fcn.14001c8b0
mov qword [rsp + 0x4d0], rax
jmp 0x1400c73e9
mov rax, qword [rsp + 0x90]
add rax, 0x20
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x4d0]
cmp qword [rsp + 0x90], rax
je 0x1400c7683
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x70], rax
mov edx, 0xf0
lea rcx, [rsp + 0x14e0]
call fcn.1400079b0
mov r9d, 1
mov r8d, 1
mov rdx, qword [rsp + 0x70]
lea rcx, [rsp + 0x14e0]
call fcn.140031af0
nop
lea rdx, [0x1401d6a2c]
lea rcx, [rsp + 0x14e0]
call fcn.140040d80
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0xc0]
mov rax, qword [rax]
movsxd rax, dword [rax + 4]
mov rcx, qword [rsp + 0xc0]
add rcx, rax
mov rax, rcx
mov rcx, rax
call fcn.140041ff0
movzx eax, al
test eax, eax
je 0x1400c74a4
mov byte [0x1401d2a1b], 1
lea rdx, [0x1401d6a2c]
lea rcx, [0x1401d7bf0]
call fcn.1400c1930
jmp 0x1400c7671
mov byte [0x1401d2a1c], 1
lea rax, [rsp + 0x4b]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx eax, byte [rsp + 0x4b]
mov byte [rsp + 0x4c], al
movzx eax, byte [rsp + 0x4c]
mov byte [rsp + 0x4d], al
movzx eax, byte [rsp + 0x4d]
mov byte [rsp + 0x4e], al
lea rdx, [rsp + 0x5a0]
mov rcx, qword [rsp + 0x70]
call fcn.1400b5fc0
mov rax, qword [rax]
mov qword [rsp + 0x4d8], rax
mov rax, qword [rsp + 0x4d8]
mov qword [rsp + 0x4e0], rax
mov rax, qword [rsp + 0x4e0]
mov qword [rsp + 0x508], rax
lea rdx, [rsp + 0x5a8]
mov rcx, qword [rsp + 0x70]
call fcn.1400bb5c0
mov rax, qword [rax]
mov qword [rsp + 0x4e8], rax
mov rax, qword [rsp + 0x4e8]
mov qword [rsp + 0x4f0], rax
mov rax, qword [rsp + 0x4f0]
mov qword [rsp + 0x510], rax
lea rdx, [rsp + 0x5b0]
mov rcx, qword [rsp + 0x70]
call fcn.1400b5fc0
mov rax, qword [rax]
mov qword [rsp + 0x4f8], rax
mov rax, qword [rsp + 0x4f8]
mov qword [rsp + 0x500], rax
mov rax, qword [rsp + 0x500]
mov qword [rsp + 0x518], rax
movzx eax, byte [rsp + 0x4e]
mov byte [rsp + 0x20], al
mov r9, qword [rsp + 0x508]
mov r8, qword [rsp + 0x510]
mov rdx, qword [rsp + 0x518]
lea rcx, [rsp + 0x5b8]
call fcn.14002eb40
lea rcx, [rsp + 0x6b]
call fcn.140003030
mov qword [rsp + 0x530], rax
lea rdx, [rsp + 0x5c0]
mov rcx, qword [rsp + 0x70]
call fcn.1400bb5c0
mov rax, qword [rax]
mov qword [rsp + 0x520], rax
mov rax, qword [rsp + 0x520]
mov qword [rsp + 0x538], rax
lea rdx, [rsp + 0x5c8]
mov rcx, qword [rsp + 0x70]
call fcn.1400b5fc0
mov rax, qword [rax]
mov qword [rsp + 0x528], rax
mov rax, qword [rsp + 0x528]
mov qword [rsp + 0x540], rax
mov r9, qword [rsp + 0x530]
mov r8, qword [rsp + 0x538]
mov rdx, qword [rsp + 0x540]
lea rcx, [rsp + 0x14b0]
call fcn.14000da40
nop
lea rdx, [rsp + 0x14b0]
lea rcx, [0x1401d7908]
call fcn.1400c19f0
nop
lea rcx, [rsp + 0x14b0]
call fcn.140003890
nop
lea rcx, [rsp + 0x14e0]
call fcn.140043860
jmp 0x1400c73d5
lea rcx, [rsp + 0x12d8]
call fcn.14003d0d0
nop
lea rcx, [rsp + 0x1338]
call fcn.14003cb10
nop
lea rcx, [rsp + 0x1310]
call fcn.14003cb10
nop
lea rcx, [rsp + 0x15d0]
call fcn.140043860
lea rdx, [0x140152c70]
lea rcx, [rsp + 0xb70]
call fcn.140003570
nop
lea rdx, [rsp + 0xb70]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0x4f], al
lea rcx, [rsp + 0xb70]
call fcn.140003860
movzx eax, byte [rsp + 0x4f]
test eax, eax
je 0x1400c7766
lea rcx, [0x1401d7bf0]
call fcn.1400c32b0
mov qword [rsp + 0xc8], rax
lea rcx, [0x1401d7908]
call fcn.1400c32e0
mov rcx, qword [rsp + 0xc8]
add rcx, rax
mov rax, rcx
cmp rax, 1
je 0x1400c7766
call fcn.14008d750
lea rcx, [0x1401d7c10]
call fcn.1400c1080
mov dword [rsp + 0xa8], 0xffffffff
lea rcx, [rsp + 0x12b0]
call fcn.14003cb10
mov eax, dword [rsp + 0xa8]
jmp 0x1400c8115
mov byte [0x1401d2a1e], 0
lea rdx, [0x140152d90]
lea rcx, [rsp + 0xcb0]
call fcn.140003570
nop
mov eax, dword [rsp + 0x40]
bts eax, 7
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0xcb0]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
jne 0x1400c77f2
lea rdx, [0x140152d98]
lea rcx, [rsp + 0xb90]
call fcn.140003570
nop
mov eax, dword [rsp + 0x40]
bts eax, 8
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0xb90]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
jne 0x1400c77f2
mov dword [rsp + 0x80], 0
jmp 0x1400c77fd
mov dword [rsp + 0x80], 1
movzx eax, byte [rsp + 0x80]
mov byte [rsp + 0x50], al
mov eax, dword [rsp + 0x40]
and eax, 0x100
test eax, eax
je 0x1400c782c
and dword [rsp + 0x40], 0xfffffeff
lea rcx, [rsp + 0xb90]
call fcn.140003860
nop
mov eax, dword [rsp + 0x40]
and eax, 0x80
test eax, eax
je 0x1400c784e
and dword [rsp + 0x40], 0xffffff7f
lea rcx, [rsp + 0xcb0]
call fcn.140003860
movzx eax, byte [rsp + 0x50]
test eax, eax
je 0x1400c785c
call fcn.14008bb40
lea rdx, str.gapfnscsendmessage
lea rcx, [rsp + 0xbb0]
call fcn.140003570
nop
lea rdx, [rsp + 0xbb0]
lea rcx, [0x1401d73b0]
call fcn.1400c1960
nop
lea rcx, [rsp + 0xbb0]
call fcn.140003860
lea rax, [rsp + 0x16c0]
mov rdi, rax
xor eax, eax
mov ecx, 0x7fff
rep stosb byte [rdi], al
mov r8d, 0x7fff
lea rdx, [rsp + 0x16c0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rsp + 0x16c0]
lea rcx, [rsp + 0x12f0]
call fcn.140003570
nop
mov r8, 0xffffffffffffffff
lea rdx, [0x140152dd4]
lea rcx, [rsp + 0x12f0]
call fcn.1400bc8c0
mov r9, rax
xor r8d, r8d
lea rdx, [rsp + 0x1470]
lea rcx, [rsp + 0x12f0]
call fcn.1400c37f0
nop
call fcn.14009e9a0
call fcn.14005cd70
lea rax, [rsp + 0x12a0]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rax, [rsp + 0x14d0]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rcx, [rsp + 0x12a0]
call qword [sym.imp.KERNEL32.dll_GetSystemTime]
movzx eax, word [rsp + 0x12ac]
movzx ecx, word [rsp + 0x12aa]
movzx edx, word [rsp + 0x12a8]
movzx edi, word [rsp + 0x12a6]
movzx esi, word [rsp + 0x12a2]
movzx r8d, word [rsp + 0x12a0]
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], edi
mov r9d, esi
lea rdx, str._d_02d_02dZ_02d_02d_02d
lea rcx, [0x1401d6c50]
call fcn.14002e700
lea rdx, [0x1401d6c50]
lea rcx, [0x1401d6a50]
call fcn.14010e840
lea rdx, str._processes.tsv
lea rcx, [0x1401d6a50]
call fcn.14010e7a0
lea rdx, [0x1401d6c50]
lea rcx, [0x1401d6b50]
call fcn.14010e840
lea rdx, str._WhacAMole.html
lea rcx, [0x1401d6b50]
call fcn.14010e7a0
lea rdx, [0x1401d6c50]
lea rcx, [0x1401d6d50]
call fcn.14010e840
lea rdx, str._Lista_DLL.tsv
lea rcx, [0x1401d6d50]
call fcn.14010e7a0
lea rdx, reloc.WS2_32.dll_WSAStartup
lea rcx, [rsp + 0xbd0]
call fcn.140003570
nop
lea rdx, [rsp + 0xbd0]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0x51], al
lea rcx, [rsp + 0xbd0]
call fcn.140003860
movzx eax, byte [rsp + 0x51]
test eax, eax
je 0x1400c7af8
mov r9d, 0x40
mov r8d, 2
lea rdx, [0x1401d6a50]
lea rcx, [0x1401d77d0]
call fcn.1400bf460
lea rdx, str.Process_name_tFileSize_tPID_tPPID_tNetwork_tEP__process__tEP__file__tBase_Address_tPE_Sections_tSizeOfInitializedData_tDLLCharacteristics_tMajorImageVersion_tCheckSumOriginal_tCheckSumComputed_tInternal_Name_tOriginal_File_Name_tSession_ID__Process__tSession_ID__LSA__tLogon_Session_tOriginating_Logon_Session_tToken_Integrity_tToken_Type_tLogon_Type_tAuthentication_Package_tDomainUser_tSID_tBUILTINAdministrators_tCmdLine_tExe_Path_tCWD_tPE_format_tCreation_time_tCreation_delay_tProduct_name_tCompany_Name_tFile_Description_tSignature_tSHA1_tCLR_tTmTx_tDetected_tScore
lea rcx, [0x1401d77d0]
call fcn.14000f800
mov r9d, 0x40
mov r8d, 2
lea rdx, [0x1401d6b50]
lea rcx, [0x1401d7940]
call fcn.1400bf460
lea rcx, [0x1401d7350]
call fcn.1400b3ed0
mov rdx, rax
lea rcx, [0x1401d7940]
call fcn.14000f800
mov r9d, 0x40
mov r8d, 2
lea rdx, [0x1401d6d50]
lea rcx, [0x1401d7680]
call fcn.1400bf460
lea rdx, str.PID_tProcessPath_tDLL_tLoadTime_tLinkedLists_tCLR_tExports_tMEM_TYPE_tMemAllocProtect_tBaseAddress_tSignature_tSHA1_tSHA256_.text_MEM_tSHA256_.text_FILE_tDetected
lea rcx, [0x1401d7680]
call fcn.14000f800
call fcn.14008d750
lea rdx, [0x1401d7010]
lea rcx, [0x1401d7940]
call fcn.14000f400
lea rcx, [rsp + 0xff0]
call fcn.140005e80
lea rcx, [rsp + 0x560]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x560]
lea rcx, [0x1401d73e8]
call fcn.14003e890
call fcn.14008bd10
lea rdx, [0x14015323c]
lea rcx, [rsp + 0xbf0]
call fcn.140003570
nop
lea rdx, [rsp + 0xbf0]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
mov byte [rsp + 0x52], al
lea rcx, [rsp + 0xbf0]
call fcn.140003860
movzx eax, byte [rsp + 0x52]
test eax, eax
je 0x1400c7b93
call fcn.140065620
lea rdx, [0x1401532b0]
lea rcx, [rsp + 0xc30]
call fcn.140003570
nop
mov eax, dword [rsp + 0x40]
bts eax, 9
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0xc30]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
jne 0x1400c7c18
lea rdx, [0x1401532b4]
lea rcx, [rsp + 0xc10]
call fcn.140003570
nop
mov eax, dword [rsp + 0x40]
bts eax, 0xa
mov dword [rsp + 0x40], eax
lea rdx, [rsp + 0xc10]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
jne 0x1400c7c18
mov dword [rsp + 0x84], 1
jmp 0x1400c7c23
mov dword [rsp + 0x84], 0
movzx eax, byte [rsp + 0x84]
mov byte [rsp + 0x53], al
mov eax, dword [rsp + 0x40]
and eax, 0x400
test eax, eax
je 0x1400c7c52
and dword [rsp + 0x40], 0xfffffbff
lea rcx, [rsp + 0xc10]
call fcn.140003860
nop
mov eax, dword [rsp + 0x40]
and eax, 0x200
test eax, eax
je 0x1400c7c74
and dword [rsp + 0x40], 0xfffffdff
lea rcx, [rsp + 0xc30]
call fcn.140003860
movzx eax, byte [rsp + 0x53]
test eax, eax
je 0x1400c7cbd
mov dword [rsp + 0xac], 0
lea rcx, [rsp + 0x1470]
call fcn.140003860
nop
lea rcx, [rsp + 0x12f0]
call fcn.140003860
nop
lea rcx, [rsp + 0x12b0]
call fcn.14003cb10
mov eax, dword [rsp + 0xac]
jmp 0x1400c8115
call fcn.14004dde0
mov dword [rsp + 0x129c], 0
mov qword [rsp + 0x1288], 0
lea rdx, [rsp + 0x1288]
lea rcx, [rsp + 0x129c]
call sub.Secur32.dll_LsaEnumerateLogonSessions
mov dword [rsp + 0xd8], eax
mov dword [rsp + 0x58], 0
jmp 0x1400c7d09
mov eax, dword [rsp + 0x58]
inc eax
mov dword [rsp + 0x58], eax
mov eax, dword [rsp + 0x129c]
cmp dword [rsp + 0x58], eax
jae 0x1400c8017
mov qword [rsp + 0x1280], 0
mov eax, dword [rsp + 0x58]
mov rcx, qword [rsp + 0x1288]
lea rax, [rcx + rax*8]
lea rdx, [rsp + 0x1280]
mov rcx, rax
call sub.Secur32.dll_LsaGetLogonSessionData
mov dword [rsp + 0xb0], eax
mov dword [rsp + 0x1298], 0
cmp dword [rsp + 0xb0], 0
jne 0x1400c8005
mov rax, qword [rsp + 0x1280]
mov rcx, qword [rsp + 0x1280]
mov ecx, dword [rcx + 4]
mov eax, dword [rax + 8]
or eax, ecx
mov dword [rsp + 0x1298], eax
mov qword [rsp + 0x1290], 0
lea rax, [rsp + 0x1360]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea rcx, [rsp + 0x1368]
call fcn.140006080
lea rcx, [rsp + 0x1388]
call fcn.140006080
lea rcx, [rsp + 0x13a8]
call fcn.140006080
lea rcx, [rsp + 0x13c8]
call fcn.140006080
lea rax, [rsp + 0x13e8]
mov rdi, rax
xor eax, eax
mov ecx, 8
rep stosb byte [rdi], al
lea rcx, [rsp + 0x13f0]
call fcn.140006080
nop
mov rax, qword [rsp + 0x1280]
mov rax, qword [rax + 4]
mov qword [rsp + 0xd0], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x1360], rax
lea rax, [rsp + 0x570]
mov rcx, qword [rsp + 0x1280]
mov rdi, rax
lea rsi, [rcx + 0x30]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x570]
lea rcx, [rsp + 0x1070]
call fcn.14009ece0
mov qword [rsp + 0xe0], rax
mov rdx, qword [rsp + 0xe0]
lea rcx, [rsp + 0x13a8]
call fcn.140009740
lea rcx, [rsp + 0x1070]
call fcn.140003890
lea rax, [rsp + 0x580]
mov rcx, qword [rsp + 0x1280]
mov rdi, rax
lea rsi, [rcx + 0x20]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x580]
lea rcx, [rsp + 0x1050]
call fcn.14009ece0
mov qword [rsp + 0xe8], rax
mov rdx, qword [rsp + 0xe8]
lea rcx, [rsp + 0x1388]
call fcn.140009740
lea rcx, [rsp + 0x1050]
call fcn.140003890
mov rax, qword [rsp + 0x1280]
mov eax, dword [rax + 0x44]
mov dword [rsp + 0x13e8], eax
lea rdx, [rsp + 0x1290]
mov rax, qword [rsp + 0x1280]
mov rcx, qword [rax + 0x48]
call sub.ADVAPI32.dll_ConvertSidToStringSidW
cmp qword [rsp + 0x1290], 0
je 0x1400c7f26
mov rdx, qword [rsp + 0x1290]
lea rcx, [rsp + 0x13f0]
call fcn.1400097c0
jmp 0x1400c7f3a
lea rdx, [0x140153350]
lea rcx, [rsp + 0x13f0]
call fcn.1400097c0
lea rax, [rsp + 0x590]
mov rcx, qword [rsp + 0x1280]
mov rdi, rax
lea rsi, [rcx + 0x10]
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x590]
lea rcx, [rsp + 0x1090]
call fcn.14009ece0
mov qword [rsp + 0xf0], rax
mov rdx, qword [rsp + 0xf0]
lea rcx, [rsp + 0x1368]
call fcn.140009740
lea rcx, [rsp + 0x1090]
call fcn.140003890
mov rax, qword [rsp + 0x1280]
mov edx, dword [rax + 0x40]
lea rcx, [rsp + 0x1490]
call fcn.14005fe20
nop
lea rdx, [rsp + 0x1490]
lea rcx, [rsp + 0x13c8]
call fcn.140006550
lea rdx, [rsp + 0x1298]
lea rcx, [0x1401d7528]
call fcn.140041800
lea rdx, [rsp + 0x1360]
mov rcx, rax
call fcn.140040c00
nop
lea rcx, [rsp + 0x1490]
call fcn.140003890
nop
lea rcx, [rsp + 0x1360]
call fcn.14003de60
mov rcx, qword [rsp + 0x1280]
call sub.Secur32.dll_LsaFreeReturnBuffer
jmp 0x1400c7cff
mov rcx, qword [rsp + 0x1288]
call sub.Secur32.dll_LsaFreeReturnBuffer
lea rcx, [rsp + 0x1040]
call fcn.140005e80
lea rcx, [rsp + 0x5d0]
mov rdi, rcx
mov rsi, rax
mov ecx, 0x10
rep movsb byte [rdi], byte [rsi]
lea rdx, [rsp + 0x5d0]
lea rcx, [0x1401d8408]
call fcn.14003e780
call fcn.1400ca8b0
call fcn.140065bb0
lea rdx, [0x1401533e4]
lea rcx, [rsp + 0xc70]
call fcn.140003570
nop
lea rdx, [rsp + 0xc70]
lea rcx, [0x1401d7c10]
call fcn.1400bc030
movzx eax, al
test eax, eax
jne 0x1400c80a1
mov dword [rsp + 0x88], 1
jmp 0x1400c80ac
mov dword [rsp + 0x88], 0
movzx eax, byte [rsp + 0x88]
mov byte [rsp + 0x54], al
lea rcx, [rsp + 0xc70]
call fcn.140003860
movzx eax, byte [rsp + 0x54]
test eax, eax
je 0x1400c80da
lea rcx, [0x1401533e8]
call fcn.14000ad70
mov dword [rsp + 0xb4], 0
lea rcx, [rsp + 0x1470]
call fcn.140003860
nop
lea rcx, [rsp + 0x12f0]
call fcn.140003860
nop
lea rcx, [rsp + 0x12b0]
call fcn.14003cb10
mov eax, dword [rsp + 0xb4]
mov rcx, qword [rsp + 0x96c0]
xor rcx, rsp
call fcn.140101e00
add rsp, 0x96d8
pop rdi
pop rsi
ret