Function at 0x14000107b
Capabilities:
Enumerate processes via ntquerysysteminformation
Get disk information
Get local ipv4 addresses
Get logon sessions
Get memory capacity
Get system information on windows
List groups for user account
List user accounts
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x758
movdqa xmmword [rsp + 0x740], xmm8
movdqa xmmword [rsp + 0x730], xmm7
movdqa xmmword [rsp + 0x720], xmm6
lea rsi, [rsp + 0x110]
mov qword [rsi], 1
pxor xmm0, xmm0
movdqu xmmword [rsi + 8], xmm0
mov eax, 1
xor edi, edi
lea rbx, [0x1400246b9]
xor edx, edx
cmp rdi, 0x179
je 0x14000111d
mov bpl, byte [rdi + rbx]
cmp rdx, qword [rsp + 0x118]
jne 0x140001101
mov rcx, rsi
call fcn.140004b9d
mov rax, qword [rsp + 0x110]
mov rdx, qword [rsp + 0x120]
mov byte [rax + rdx], bpl
mov rdx, qword [rsp + 0x120]
inc rdx
mov qword [rsp + 0x120], rdx
inc rdi
jmp 0x1400010d2
mov qword [rsp + 0x128], 8
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x130], xmm0
call fcn.140011dd9
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x88], rdx
lea rsi, [rsp + 0x1f0]
mov edx, 0x158
mov r8d, 0x1f4
mov rcx, rsi
call fcn.1400118db
mov rsi, qword [rsi]
test rsi, rsi
je 0x140001195
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x98], rax
mov rdi, qword [rsp + 0x200]
mov rax, qword [rsp + 0x208]
mov qword [rsp + 0x90], rax
jmp 0x1400011ad
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x98], rax
mov rdi, qword [rsp + 0x200]
mov ecx, 9
call fcn.140004cd1
mov r14, rax
mov r15, rdx
movabs rax, 0x5043206c61746f54
mov qword [r14], rax
mov byte [r14 + 8], 0x55
mov ecx, 8
mov edx, 0x120
call fcn.140004b95
test rax, rax
je 0x1400042e7
mov rbx, rax
movabs rbp, 0x19db1ded53e8000
call fcn.140011dd9
mov r12, rax
mov r13, rdx
call fcn.14000c3e7
shl rdx, 0x20
mov eax, eax
or rax, rdx
movabs rcx, 0xfe624e212ac18000
cmp rax, rbp
jge 0x140001220
xor ebp, ebp
jmp 0x14000124b
add rax, rcx
mov ecx, 0x989680
xor edx, edx
div rcx
mov rbp, rax
call sub.KERNEL32.dll_GetTickCount64
mov ecx, 0x3e8
xor edx, edx
div rcx
sub rbp, rax
mov eax, 0
cmovb rbp, rax
mov rcx, qword [rsp + 0x90]
pxor xmm6, xmm6
movdqu xmmword [rsp + 0x2f0], xmm6
mov qword [rsp + 0x230], rsi
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x238], rax
mov qword [rsp + 0x240], rdi
mov qword [rsp + 0x248], rcx
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x250], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x258], rax
movdqu xmmword [rsp + 0x290], xmm6
movdqu xmmword [rsp + 0x2a0], xmm6
mov qword [rsp + 0x300], r14
mov qword [rsp + 0x308], r15
mov qword [rsp + 0x310], 9
mov eax, 1
mov qword [rsp + 0x318], rax
movdqu xmmword [rsp + 0x320], xmm6
mov qword [rsp + 0x330], rax
and qword [rsp + 0x348], 0
movdqu xmmword [rsp + 0x338], xmm6
and qword [rsp + 0x360], 0
and dword [rsp + 0x368], 0
mov eax, 8
mov qword [rsp + 0x370], rax
movdqu xmmword [rsp + 0x378], xmm6
mov byte [rsp + 0x388], 0
mov qword [rsp + 0x2b8], rax
movdqu xmmword [rsp + 0x2c0], xmm6
mov qword [rsp + 0x2d0], rbx
mov qword [rsp + 0x2d8], 2
and qword [rsp + 0x2e0], 0
and qword [rsp + 0x1f0], 0
lea r14, [0x1400250d0]
mov qword [rsp + 0x260], r14
and qword [rsp + 0x278], 0
movdqu xmmword [rsp + 0x268], xmm6
mov qword [rsp + 0x280], r12
mov qword [rsp + 0x288], r13
mov qword [rsp + 0x2b0], rbp
mov qword [rsp + 0x2e8], rax
lea rsi, [rsp + 0x5a0]
movdqa xmmword [rsi], xmm6
movdqa xmmword [rsi + 0x30], xmm6
movdqa xmmword [rsi + 0x20], xmm6
movdqa xmmword [rsi + 0x10], xmm6
mov dword [rsi], 0x40
mov rcx, rsi
call sub.KERNEL32.dll_GlobalMemoryStatusEx
movdqu xmm0, xmmword [rsi + 8]
movdqu xmmword [rsp + 0x290], xmm0
lea rcx, [rsp + 0x450]
movdqa xmmword [rcx + 0x50], xmm6
movdqa xmmword [rcx + 0x40], xmm6
movdqa xmmword [rcx + 0x30], xmm6
movdqa xmmword [rcx + 0x20], xmm6
movdqa xmmword [rcx + 0x10], xmm6
movdqa xmmword [rcx], xmm6
and qword [rcx + 0x60], 0
mov edx, 0x68
call sub.PSAPI.DLL_GetPerformanceInfo
cmp eax, 1
jne 0x140001479
mov rdx, qword [rsp + 0x460]
mov r9, qword [rsp + 0x470]
xor r10d, r10d
sub rdx, r9
cmovb rdx, r10
mov rcx, qword [rsp + 0x4a0]
mov rax, rcx
mul rdx
mov r8, rax
mov r11, 0xffffffffffffffff
cmovo r8, r11
mov rdx, qword [rsp + 0x458]
sub rdx, r9
cmovb rdx, r10
mov rax, rcx
mul rdx
cmovo rax, r11
mov qword [rsp + 0x2a0], r8
mov qword [rsp + 0x2a8], rax
lea rax, [rsp + 0x300]
cmp qword [rax - 0x110], 0
jne 0x1400016f2
lea r8, [rsp + 0x5a0]
and qword [r8], 0
xor esi, esi
xor ecx, ecx
xor edx, edx
call sub.pdh.dll_PdhOpenQueryA
mov edi, eax
test eax, eax
je 0x1400014ae
jmp 0x1400014cb
mov rbx, qword [rsp + 0x5a0]
call fcn.140011dd9
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x450], xmm0
mov rsi, r14
and qword [rsp + 0x1f8], 0
and qword [rsp + 0x228], 0
mov qword [rsp + 0x1f0], rsi
movdqa xmm0, xmmword [rsp + 0x450]
movdqu xmmword [rsp + 0x200], xmm0
mov qword [rsp + 0x210], rax
mov qword [rsp + 0x218], rdx
mov qword [rsp + 0x220], rbx
test edi, edi
jne 0x1400016e9
mov ecx, 0x23
call fcn.140004cd1
movups xmm0, xmmword [0x1400252bf]
movups xmmword [rax], xmm0
movdqu xmm0, xmmword [0x1400252cf]
movdqu xmmword [rax + 0x10], xmm0
mov dword [rax + 0x1f], 0x656d6954
mov qword [rsp + 0x5a0], rax
mov qword [rsp + 0x5a8], rdx
mov qword [rsp + 0x5b0], 0x23
lea r14, [rsp + 0x348]
mov ecx, 5
call fcn.140004cd1
mov dword [rax], 0x5f746f74
mov byte [rax + 4], 0x30
lea r9, [rsp + 0x450]
mov qword [r9], rax
mov qword [r9 + 8], rdx
mov qword [r9 + 0x10], 5
lea rdx, [rsp + 0x1f0]
lea rcx, [rsp + 0x5a0]
mov r8, r14
call fcn.140012dcd
lea rcx, [rsp + 0x300]
mov dl, 1
call fcn.140013102
mov r14, rax
mov qword [rsp + 0x88], rdx
xor eax, eax
mov qword [rsp + 0x78], rax
mov edi, 2
mov r12d, 1
cmp r14, qword [rsp + 0x88]
je 0x1400016da
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x140], rax
inc rax
mov qword [rsp + 0x78], rax
lea rax, [0x140025300]
mov qword [rsp + 0x450], rax
mov qword [rsp + 0x458], rdi
and qword [rsp + 0x470], 0
lea rbx, [rsp + 0x140]
mov qword [rsp + 0x5a0], rbx
lea rsi, [0x140005afd]
mov qword [rsp + 0x5a8], rsi
lea rbp, [rsp + 0x5a0]
mov qword [rsp + 0x460], rbp
mov qword [rsp + 0x468], r12
lea r13, [rsp + 0x390]
mov rcx, r13
lea r15, [rsp + 0x450]
mov rdx, r15
call fcn.14000f2a4
lea rax, [0x140025328]
mov qword [rsp + 0x450], rax
mov qword [rsp + 0x458], rdi
and qword [rsp + 0x470], 0
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xd8], rsi
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x460], rax
mov qword [rsp + 0x468], r12
mov rcx, rbp
mov rdx, r15
call fcn.14000f2a4
lea r8, [r14 + 0x48]
mov rcx, r13
lea rdx, [rsp + 0x1f0]
mov r9, rbp
call fcn.140012dcd
add r14, 0x70
jmp 0x1400015d2
mov rsi, qword [rsp + 0x1f0]
lea r14, [0x1400250d0]
test rsi, rsi
je 0x140001806
mov rcx, qword [rsp + 0x220]
call sub.pdh.dll_PdhCollectQueryData
cmp qword [rsp + 0x348], 0
je 0x140001730
lea rdx, [rsp + 0x348]
lea rcx, [rsp + 0x1f0]
call fcn.140013124
test eax, eax
je 0x1400042d4
movd dword [rsp + 0x368], xmm0
lea rcx, [rsp + 0x300]
mov dl, 1
call fcn.140013102
mov rsi, rax
mov rdi, rdx
add rsi, 0x48
lea rbx, [rsp + 0x1f0]
lea rax, [rsi - 0x48]
cmp rax, rdi
je 0x14000177e
cmp qword [rsi], 0
je 0x140001778
mov rcx, rbx
mov rdx, rsi
call fcn.140013124
test eax, eax
je 0x1400042d4
movd dword [rsi + 0x20], xmm0
add rsi, 0x70
jmp 0x140001751
cmp byte [rsp + 0x388], 0
jne 0x140001806
mov rsi, qword [rsp + 0x380]
lea rdi, [rsp + 0x450]
mov rcx, rdi
mov rdx, rsi
call fcn.140012637
mov rbx, qword [rsp + 0x370]
mov rcx, qword [rdi]
mov rdx, qword [rdi + 8]
mov rax, qword [rdi + 0x10]
shl rax, 3
imul r8, rsi, 0x70
xor r9d, r9d
mov r10, rbx
test r8, r8
je 0x1400017e4
cmp rax, r9
je 0x1400017e4
mov r11, qword [rcx + r9]
mov qword [r10 + 0x60], r11
add r10, 0x70
add r9, 8
add r8, 0xffffffffffffff90
jmp 0x1400017c4
call fcn.140011019
test rsi, rsi
je 0x1400017f4
mov rax, qword [rbx + 0x60]
jmp 0x1400017f6
xor eax, eax
mov qword [rsp + 0x360], rax
mov byte [rsp + 0x388], 1
lea rsi, [rsp + 0x5a0]
mov rcx, rsi
call fcn.140012896
cmp dword [rsi], 2
je 0x140001a50
mov rax, qword [rsp + 0x5d0]
lea rdx, [rsp + 0x450]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x5a0]
movups xmm1, xmmword [rsp + 0x5b0]
movups xmm2, xmmword [rsp + 0x5c0]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0x390]
mov rcx, rsi
call fcn.1400128c2
cmp qword [rsi], 2
je 0x140001a50
mov rax, qword [rsp + 0x3c0]
lea rdx, [rsp + 0x450]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x390]
movups xmm1, xmmword [rsp + 0x3a0]
movups xmm2, xmmword [rsp + 0x3b0]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0xd0]
mov rcx, rsi
call fcn.14001293c
cmp qword [rsi], 2
je 0x140001a50
mov rax, qword [rsp + 0x100]
lea rdx, [rsp + 0x450]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0xd0]
movups xmm1, xmmword [rsp + 0xe0]
movups xmm2, xmmword [rsp + 0xf0]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0x140]
mov rcx, rsi
call fcn.1400129d2
cmp qword [rsi], 2
je 0x140001a50
mov rax, qword [rsp + 0x170]
lea rdx, [rsp + 0x450]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x140]
movups xmm1, xmmword [rsp + 0x150]
movups xmm2, xmmword [rsp + 0x160]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0x1b0]
mov rcx, rsi
call fcn.140012a9c
cmp qword [rsi], 2
je 0x140001a50
mov rax, qword [rsp + 0x1e0]
lea rdx, [rsp + 0x450]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x1b0]
movups xmm1, xmmword [rsp + 0x1c0]
movups xmm2, xmmword [rsp + 0x1d0]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0x418]
mov rcx, rsi
call fcn.140012b19
mov rax, qword [rsi]
cmp rax, 2
je 0x140001a50
movups xmm0, xmmword [rsp + 0x420]
movups xmm1, xmmword [rsp + 0x430]
movups xmm2, xmmword [rsp + 0x440]
lea rsi, [rsp + 0x6e8]
movups xmmword [rsi + 0x28], xmm2
movups xmmword [rsi + 0x18], xmm1
movups xmmword [rsi + 8], xmm0
mov qword [rsi], rax
lea rdi, [rsp + 0x390]
mov rcx, rdi
mov rdx, rsi
mov r8b, 1
call fcn.140012bf8
mov rax, qword [rsi + 0x30]
mov qword [rsp + 0x480], rax
movdqu xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmm2, xmmword [rsi + 0x20]
movaps xmmword [rsp + 0x470], xmm2
movaps xmmword [rsp + 0x460], xmm1
movdqa xmmword [rsp + 0x450], xmm0
mov ebp, dword [rdi + 4]
cmp ebp, 2
jne 0x1400041de
lea rcx, [rsp + 0x450]
call fcn.140011609
mov esi, 8
xor edi, edi
mov rcx, qword [rsp + 0x2b8]
mov rdx, qword [rsp + 0x2c8]
call fcn.1400115cb
mov rcx, qword [rsp + 0x2b8]
mov rdx, qword [rsp + 0x2c0]
call fcn.140011707
mov qword [rsp + 0x2b8], rsi
mov qword [rsp + 0x2c0], rdi
mov qword [rsp + 0x2c8], rdi
lea rcx, [rsp + 0xd0]
and qword [rcx], 0
call sub.IPHLPAPI.DLL_GetIfTable2
test eax, eax
jne 0x1400028ab
lea r8, [rsp + 0x280]
mov rax, qword [r8 - 0x20]
mov rcx, qword [r8 - 0x18]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [r8 - 8]
lea rsi, [rsp + 0x450]
mov qword [rsi], rax
add rax, 0x10
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov word [rsi + 0x18], dx
mov qword [rsi + 0x20], r8
mov rcx, rsi
call fcn.140011802
test rax, rax
je 0x140001b08
mov byte [rdx + 0x6e], 0
jmp 0x140001af5
call fcn.140011dd9
pxor xmm0, xmm0
lea rcx, [rsp + 0x470]
movdqu xmmword [rcx - 0x10], xmm0
mov qword [rcx - 0x20], r14
and qword [rcx - 0x18], 0
mov qword [rcx], rax
mov qword [rcx + 8], rdx
lea rax, [rsp + 0x390]
mov qword [rax], 8
movdqu xmmword [rax + 8], xmm0
mov rax, qword [rsp + 0xd0]
mov ecx, dword [rax]
add rax, 8
lea r15, [rsp + 0x5a0]
pcmpeqd xmm6, xmm6
xor edx, edx
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rcx
cmp rdx, rcx
je 0x140001e65
mov rdi, rdx
inc rdx
imul rsi, rdi, 0x548
cmp qword [rax + rsi + 0x4a8], 0
jne 0x140001b9a
cmp qword [rax + rsi + 0x4b0], 0
je 0x140001b6e
cmp dword [rax + rsi + 0x48c], 2
je 0x140001b6e
cmp dword [rax + rsi + 0x420], 0
je 0x140001b6e
mov qword [rsp + 0x88], rdx
mov ecx, 0x14
mov edx, 2
mov r14, rax
call fcn.14000bcae
mov r13, rax
mov eax, dword [r14 + rsi + 0x10]
movzx ecx, byte [r14 + rsi + 0x14]
movzx edx, byte [r14 + rsi + 0x15]
movzx r8d, byte [r14 + rsi + 0x16]
movzx r9d, byte [r14 + rsi + 0x17]
movzx r10d, byte [r14 + rsi + 0x18]
movzx r11d, byte [r14 + rsi + 0x19]
movzx ebx, byte [r14 + rsi + 0x1a]
movzx esi, byte [r14 + rsi + 0x1b]
mov dword [r13], eax
mov word [r13 + 4], cx
mov word [r13 + 6], dx
mov word [r13 + 8], r8w
mov word [r13 + 0xa], r9w
mov word [r13 + 0xc], r10w
mov word [r13 + 0xe], r11w
mov word [r13 + 0x10], bx
mov word [r13 + 0x12], si
mov ecx, 0xa
xor edx, edx
call fcn.140009e9e
mov rbx, rax
mov qword [rsp + 0x90], rdx
movups xmm0, xmmword [r13]
movups xmmword [rax], xmm0
mov eax, dword [r13 + 0x10]
mov dword [rbx + 0x10], eax
mov rcx, qword [rsp + 0x470]
mov rdx, qword [rsp + 0x478]
mov r9d, 0xa
mov r8, rbx
call fcn.140011030
mov rsi, qword [rsp + 0x450]
mov r14, qword [rsp + 0x458]
mov r12, r14
and r12, rax
mov qword [rsp + 0xb0], rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor eax, eax
mov qword [rsp + 0x78], rax
movdqu xmm8, xmmword [rsi + r12]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0x5a0], ax
mov rcx, r15
call fcn.14000fd3b
test rax, rax
je 0x140001cff
add rdx, r12
and rdx, r14
shl rdx, 5
mov rbp, rsi
sub rbp, rdx
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x10]
mov r9d, 0xa
mov r8, rbx
call fcn.14001115c
test al, al
je 0x140001cc6
jmp 0x140001d2b
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x140001dcd
mov rax, qword [rsp + 0x78]
add r12, rax
add r12, 0x10
add rax, 0x10
mov qword [rsp + 0x78], rax
and r12, r14
jmp 0x140001cab
mov rcx, rbx
mov rdx, qword [rsp + 0x90]
call fcn.14000a368
mov eax, dword [rbp - 8]
inc eax
mov dword [rbp - 8], eax
cmp eax, 1
jle 0x140001d57
mov edx, 0xa
mov rcx, r13
call fcn.14000a368
jmp 0x140001db0
mov rdx, qword [rsp + 0x3a0]
cmp rdx, qword [rsp + 0x398]
jne 0x140001d7e
lea rcx, [rsp + 0x390]
call fcn.140011350
mov rdx, qword [rsp + 0x3a0]
mov rax, qword [rsp + 0x390]
mov rcx, rdx
shl rcx, 5
mov dword [rax + rcx], edi
mov qword [rax + rcx + 8], r13
mov r8d, 0xa
mov qword [rax + rcx + 0x10], r8
mov qword [rax + rcx + 0x18], r8
inc rdx
mov qword [rsp + 0x3a0], rdx
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0x88]
jmp 0x140001b6e
cmp qword [rsp + 0x460], 0
je 0x140001e3b
mov rcx, rsi
mov rdx, r14
mov r8, qword [rsp + 0xb0]
call fcn.140011822
mov rcx, qword [rsp + 0x450]
shl rax, 5
mov rbp, rcx
and dl, 1
neg dl
movsx rdx, dl
add qword [rsp + 0x460], rdx
sub rbp, rax
neg rax
mov qword [rcx + rax - 0x20], rbx
mov rax, qword [rsp + 0x90]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], 0xa
and dword [rbp - 8], 0
inc qword [rsp + 0x468]
jmp 0x140001d3b
lea rcx, [rsp + 0x450]
lea rdx, [rsp + 0x470]
call fcn.1400227d5
mov rsi, qword [rsp + 0x450]
mov r14, qword [rsp + 0x458]
jmp 0x140001dd8
mov rax, qword [rsp + 0x390]
mov rcx, qword [rsp + 0x398]
mov qword [rsp + 0x198], rcx
mov rbx, qword [rsp + 0x3a0]
shl rbx, 5
add rbx, rax
lea rsi, [rsp + 0x5a0]
pcmpeqd xmm6, xmm6
mov qword [rsp + 0x190], rax
mov r12, rax
mov qword [rsp + 0xa0], rbx
mov rdi, r12
cmp r12, rbx
je 0x140002405
lea r12, [rdi + 0x20]
mov rbp, qword [rdi + 8]
test rbp, rbp
je 0x140002402
mov r15, qword [rdi + 0x10]
mov edx, dword [rdi]
cmp qword [rsp + 0x468], 0
mov qword [rsp + 0x78], r12
mov qword [rsp + 0x88], r15
je 0x140001fd6
mov qword [rsp + 0x90], rdx
mov rdi, qword [rdi + 0x18]
mov rcx, qword [rsp + 0x470]
mov rdx, qword [rsp + 0x478]
mov r8, rbp
mov r9, rdi
call fcn.140011030
mov rbx, qword [rsp + 0x450]
mov r12, qword [rsp + 0x458]
mov r13, r12
and r13, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor r15d, r15d
movdqu xmm8, xmmword [rbx + r13]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0x5a0], ax
mov rcx, rsi
call fcn.14000fd3b
test rax, rax
je 0x140001f91
add rdx, r13
and rdx, r12
shl rdx, 5
mov r14, rbx
sub r14, rdx
mov r8, qword [r14 - 0x20]
mov r9, qword [r14 - 0x10]
mov rcx, rbp
mov rdx, rdi
call fcn.14001115c
test al, al
je 0x140001f5b
jmp 0x140001fb3
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x140002259
add r13, r15
add r13, 0x10
add r15, 0x10
and r13, r12
jmp 0x140001f40
add r14, 0xffffffffffffffe0
mov rbx, qword [rsp + 0xa0]
mov r12, qword [rsp + 0x78]
mov r15, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x90]
jmp 0x140001fd9
xor r14d, r14d
lea rax, [r14 + 0x18]
test r14, r14
lea rcx, [0x14002523c]
cmove rax, rcx
cmp dword [rax], 1
jg 0x140002249
imul r14, rdx, 0x548
mov rax, qword [rsp + 0x98]
lea r13, [rax + r14]
lea rdx, [rax + r14]
add rdx, 0x1c
xor r8d, r8d
cmp r8, 0x101
je 0x140002028
cmp word [rdx + r8*2], 0
je 0x140002030
inc r8
jmp 0x140002012
mov r8d, 0x101
jmp 0x14000203d
cmp r8, 0x102
jae 0x1400042d4
mov rcx, rsi
call fcn.140004e82
mov rdi, qword [rsp + 0x5a0]
test rdi, rdi
je 0x140002249
mov qword [rsp + 0xc0], r13
mov qword [rsp + 0xb0], r14
mov rax, qword [rsp + 0x5a8]
mov qword [rsp + 0x108], rax
mov r14, qword [rsp + 0x5b0]
mov rcx, qword [rsp + 0x280]
mov rdx, qword [rsp + 0x288]
mov r8, rdi
mov r9, r14
call fcn.1400110c6
mov r12, qword [rsp + 0x260]
mov r13, qword [rsp + 0x268]
mov rbx, r13
and rbx, rax
mov qword [rsp + 0x1a0], rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor eax, eax
mov qword [rsp + 0x90], rax
movdqu xmm8, xmmword [r12 + rbx]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0x5a0], ax
mov rcx, rsi
call fcn.14000fd3b
test rax, rax
je 0x14000212d
add rdx, rbx
and rdx, r13
neg rdx
imul r15, rdx, 0x88
mov rcx, qword [r12 + r15 - 0x88]
mov rdx, qword [r12 + r15 - 0x78]
mov r8, rdi
mov r9, r14
call fcn.140005ca2
test al, al
je 0x1400020f2
jmp 0x140002162
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x140002261
mov rax, qword [rsp + 0x90]
add rbx, rax
add rbx, 0x10
add rax, 0x10
mov qword [rsp + 0x90], rax
and rbx, r13
jmp 0x1400020d7
add r12, r15
mov rax, qword [r12 - 0x68]
mov rcx, qword [r12 - 0x58]
mov qword [r12 - 0x60], rax
mov rdx, qword [rsp + 0x98]
mov r8, qword [rsp + 0xb0]
mov rax, qword [rdx + r8 + 0x500]
mov qword [r12 - 0x68], rax
mov qword [r12 - 0x50], rcx
mov rax, qword [rdx + r8 + 0x4b8]
mov qword [r12 - 0x58], rax
mov rax, qword [r12 - 0x48]
mov qword [r12 - 0x40], rax
mov rax, qword [rdx + r8 + 0x4c0]
add rax, qword [rdx + r8 + 0x4c8]
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov qword [r12 - 0x48], rax
mov rax, qword [r12 - 0x38]
mov qword [r12 - 0x30], rax
mov rax, qword [rdx + r8 + 0x508]
add rax, qword [rdx + r8 + 0x510]
cmovb rax, rcx
mov qword [r12 - 0x38], rax
mov rax, qword [r12 - 0x28]
mov qword [r12 - 0x20], rax
mov rax, qword [rdx + r8 + 0x4d8]
mov qword [r12 - 0x28], rax
mov rax, qword [r12 - 0x18]
mov qword [r12 - 0x10], rax
mov rax, qword [rdx + r8 + 0x520]
mov qword [r12 - 0x18], rax
mov byte [r12 - 2], 1
mov rcx, rdi
mov rdx, qword [rsp + 0x108]
call fcn.140004bb8
mov rbx, qword [rsp + 0xa0]
mov r12, qword [rsp + 0x78]
mov r15, qword [rsp + 0x88]
mov rcx, rbp
mov rdx, r15
call fcn.14000a368
jmp 0x140001eab
xor r14d, r14d
jmp 0x140001fb7
cmp qword [rsp + 0x270], 0
je 0x1400023d8
mov rax, qword [rsp + 0x98]
mov rdx, qword [rsp + 0xb0]
mov r8, qword [rax + rdx + 0x4c0]
add r8, qword [rax + rdx + 0x4c8]
mov rcx, qword [rax + rdx + 0x4b8]
mov qword [rsp + 0x90], rcx
mov rcx, 0xffffffffffffffff
cmovb r8, rcx
mov qword [rsp + 0x188], r8
mov rbx, qword [rax + rdx + 0x508]
add rbx, qword [rax + rdx + 0x510]
cmovb rbx, rcx
mov rcx, qword [rsp + 0xc0]
mov rcx, qword [rcx]
mov qword [rsp + 0x180], rcx
mov r15, qword [rax + rdx + 0x500]
mov rcx, qword [rax + rdx + 0x4d8]
mov qword [rsp + 0xc0], rcx
mov rax, qword [rax + rdx + 0x520]
mov qword [rsp + 0xb0], rax
mov rcx, r12
mov rdx, r13
mov r8, qword [rsp + 0x1a0]
call fcn.140011822
mov rcx, qword [rsp + 0x260]
neg rax
and dl, 1
neg dl
movsx rdx, dl
add qword [rsp + 0x270], rdx
imul rax, rax, 0x88
mov qword [rcx + rax - 0x88], rdi
mov rdx, qword [rsp + 0x108]
mov qword [rcx + rax - 0x80], rdx
mov qword [rcx + rax - 0x78], r14
mov rdx, qword [rsp + 0x180]
mov qword [rcx + rax - 0x70], rdx
mov qword [rcx + rax - 0x68], r15
mov qword [rcx + rax - 0x60], r15
mov rdx, qword [rsp + 0x90]
mov qword [rcx + rax - 0x58], rdx
mov qword [rcx + rax - 0x50], rdx
mov rdx, qword [rsp + 0x188]
mov qword [rcx + rax - 0x48], rdx
mov qword [rcx + rax - 0x40], rdx
mov qword [rcx + rax - 0x38], rbx
mov qword [rcx + rax - 0x30], rbx
mov rdx, qword [rsp + 0xc0]
mov qword [rcx + rax - 0x28], rdx
mov qword [rcx + rax - 0x20], rdx
mov rdx, qword [rsp + 0xb0]
mov qword [rcx + rax - 0x18], rdx
mov qword [rcx + rax - 0x10], rdx
and dword [rcx + rax - 8], 0
and word [rcx + rax - 4], 0
mov byte [rcx + rax - 2], 1
inc qword [rsp + 0x278]
jmp 0x140002234
lea rcx, [rsp + 0x260]
lea rdx, [rsp + 0x280]
call fcn.1400224de
mov r12, qword [rsp + 0x260]
mov r13, qword [rsp + 0x268]
jmp 0x140002270
mov rdi, r12
sub rbx, rdi
shr rbx, 5
add rdi, 0x10
mov rsi, qword [rsp + 0x198]
lea r14, [rsp + 0x260]
sub rbx, 1
jb 0x140002438
mov rcx, qword [rdi - 8]
mov rdx, qword [rdi]
call fcn.14000a368
add rdi, 0x20
jmp 0x140002420
test rsi, rsi
je 0x140002456
shl rsi, 5
mov edx, 8
mov rcx, qword [rsp + 0x190]
mov r8, rsi
call fcn.140006ead
mov rcx, qword [rsp + 0xd0]
call sub.IPHLPAPI.DLL_FreeMibTable
mov rdx, qword [rsp + 0x458]
test rdx, rdx
je 0x14000255e
mov rcx, qword [rsp + 0x450]
mov rax, qword [rsp + 0x468]
test rax, rax
je 0x140002553
add rdx, rcx
inc rdx
movdqa xmm0, xmmword [rcx]
pmovmskb r8d, xmm0
not r8d
lea rsi, [rsp + 0x5b8]
mov qword [rsi - 0x18], rcx
add rcx, 0x10
mov qword [rsi - 0x10], rcx
mov qword [rsi - 8], rdx
mov word [rsi], r8w
mov qword [rsi + 8], rax
mov edi, 1
test rdi, rdi
je 0x140002543
mov rcx, rsi
call fcn.14000fd3b
cmp rax, 1
je 0x14000250b
mov rax, qword [rsp + 0x5a8]
movdqa xmm0, xmmword [rax]
pmovmskb ecx, xmm0
not ecx
mov word [rsp + 0x5b8], cx
add qword [rsp + 0x5a0], 0xfffffffffffffe00
add rax, 0x10
mov qword [rsp + 0x5a8], rax
jmp 0x1400024c9
shl rdx, 5
mov rax, qword [rsp + 0x5a0]
mov rdi, qword [rsp + 0x5c0]
mov rcx, rax
sub rcx, rdx
dec rdi
mov qword [rsp + 0x5c0], rdi
mov rcx, qword [rcx - 0x20]
neg rdx
mov rdx, qword [rax + rdx - 0x18]
call fcn.14000a368
jmp 0x1400024c4
mov rcx, qword [rsp + 0x450]
mov rdx, qword [rsp + 0x458]
mov r8d, 0x20
call fcn.14001171b
mov rax, qword [rsp + 0x260]
mov rcx, qword [rsp + 0x268]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [rsp + 0x278]
lea rsi, [rsp + 0x450]
mov qword [rsi], rax
add rax, 0x10
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov word [rsi + 0x18], dx
mov qword [rsi + 0x20], r8
mov ebx, 0x88
mov rcx, rsi
call fcn.140010f95
test rax, rax
je 0x1400025ed
mov rdi, rax
cmp byte [rax - 2], 0
jne 0x1400025aa
mov rax, qword [rsp + 0x260]
sub rax, rdi
cqo
idiv rbx
mov rcx, r14
mov rdx, rax
call fcn.140011d65
mov rcx, qword [rdi - 0x88]
mov rdx, qword [rdi - 0x80]
call fcn.140004bb8
jmp 0x1400025aa
lea rdi, [rsp + 0x1b0]
mov dword [rdi], 0x3c00
and dword [rsp + 0x140], 0
mov ebx, 3
sub ebx, 1
jb 0x1400026d1
mov ecx, dword [rsp + 0x1b0]
call fcn.140017018
test rax, rax
je 0x140002676
mov rsi, rax
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0xe
xor r8d, r8d
mov r9, rax
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
mov dword [rsp + 0x140], eax
cmp eax, 0x6f
jne 0x140002652
mov rcx, rsi
call fcn.140017020
jmp 0x140002608
test eax, eax
jne 0x1400026c9
mov qword [rsp + 0x5a8], rsi
mov qword [rsp + 0x5b0], rsi
and qword [rsp + 0x5a0], 0
xor ecx, ecx
jmp 0x140002733
mov ecx, 0x32
call fcn.140004cd1
mov rcx, rax
movups xmm0, xmmword [str.failed_to_allocate_memory_for_IP_ADAPTER_ADDRESSES]
movups xmmword [rax], xmm0
movups xmm0, xmmword [0x1400253d8]
movups xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [0x1400253e8]
movdqu xmmword [rax + 0x20], xmm0
mov word [rax + 0x30], 0x5345
mov qword [rsp + 0x5a0], rax
mov qword [rsp + 0x5a8], rdx
mov qword [rsp + 0x5b0], 0x32
jmp 0x140002733
mov rcx, rsi
call fcn.140017020
lea rax, [rsp + 0x140]
mov qword [rsp + 0x390], rax
lea rax, str.GetAdaptersAddresses___failed_with_code
lea rdx, [rsp + 0x450]
mov qword [rdx], rax
mov eax, 1
mov qword [rdx + 8], rax
and qword [rdx + 0x20], 0
lea rcx, [0x1400057cf]
mov qword [rsp + 0x398], rcx
lea rcx, [rsp + 0x390]
mov qword [rdx + 0x10], rcx
mov qword [rdx + 0x18], rax
lea rsi, [rsp + 0x5a0]
mov rcx, rsi
call fcn.14000f2a4
mov rcx, qword [rsi]
test rcx, rcx
je 0x14000274a
mov rdx, qword [rsp + 0x5a8]
call fcn.140004bb8
jmp 0x1400028ab
movdqu xmm0, xmmword [rsp + 0x5a8]
lea rax, [rsp + 0x390]
movdqu xmmword [rax], xmm0
lea rbx, [rsp + 0x140]
pcmpeqd xmm6, xmm6
lea rcx, [rsp + 0x450]
lea rdx, [rsp + 0x390]
call fcn.1400127d4
mov r14, qword [rsp + 0x450]
test r14, r14
je 0x14000289e
mov rax, qword [rsp + 0x458]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x278], 0
je 0x14000288c
mov r12, qword [rsp + 0x460]
mov rcx, qword [rsp + 0x280]
mov rdx, qword [rsp + 0x288]
mov r8, r14
mov r9, r12
call fcn.1400110c6
mov rbp, qword [rsp + 0x260]
mov rsi, qword [rsp + 0x268]
mov rdi, rsi
and rdi, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor r13d, r13d
movdqu xmm8, xmmword [rbp + rdi]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0x140], ax
mov rcx, rbx
call fcn.14000fd3b
test rax, rax
je 0x140002856
add rdx, rdi
and rdx, rsi
neg rdx
imul r15, rdx, 0x88
mov r8, qword [rbp + r15 - 0x88]
mov r9, qword [rbp + r15 - 0x78]
mov rcx, r14
mov rdx, r12
call fcn.140005ca2
test al, al
je 0x14000281b
jmp 0x140002874
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x14000288c
add rdi, r13
add rdi, 0x10
add r13, 0x10
and rdi, rsi
jmp 0x1400027ff
add rbp, r15
lea rcx, [rsp + 0x468]
movzx eax, word [rcx + 4]
mov word [rbp - 4], ax
mov eax, dword [rcx]
mov dword [rbp - 8], eax
mov rcx, r14
mov rdx, qword [rsp + 0x78]
call fcn.140004bb8
jmp 0x14000276b
mov rcx, qword [rsp + 0x390]
call fcn.140017020
mov byte [rsp + 0x86], 1
mov word [rsp + 0x84], 0x101
call fcn.14000c3e7
shl rdx, 0x20
mov eax, eax
or rax, rdx
movabs rcx, 0x19db1ded53e8000
cmp rax, rcx
jge 0x1400028de
xor eax, eax
jmp 0x1400028f5
movabs rcx, 0xfe624e212ac18000
add rax, rcx
mov ecx, 0x989680
xor edx, edx
div rcx
mov qword [rsp + 0xb8], rax
mov esi, 0x80000
lea rbx, [rsp + 0xac]
mov rdi, qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov rcx, rsi
xor edx, edx
call fcn.140004c74
mov r14, rax
mov rbp, rdx
and dword [rsp + 0xac], 0
mov ecx, 5
mov rdx, rax
mov r8d, esi
mov r9, rbx
call rdi
cmp eax, 0xc0000004
jne 0x140002965
mov eax, dword [rsp + 0xac]
test eax, eax
je 0x140002955
add eax, 0x2800
mov rsi, rax
jmp 0x140002958
add rsi, rsi
mov rcx, r14
mov rdx, rbp
call fcn.140004bb8
jmp 0x140002911
mov ecx, 8
mov edx, 0xfa0
call fcn.140004b95
test rax, rax
je 0x1400042f3
lea rsi, [rsp + 0x140]
mov qword [rsi], rax
mov qword [rsi + 8], 0x1f4
and qword [rsi + 0x10], 0
xor edx, edx
xor edi, edi
cmp rdx, qword [rsp + 0x148]
jne 0x1400029bb
mov rcx, rsi
call fcn.1400111e0
mov rax, qword [rsp + 0x140]
mov rdx, qword [rsp + 0x150]
lea rcx, [r14 + rdi]
mov qword [rax + rdx*8], rcx
mov rdx, qword [rsp + 0x150]
inc rdx
mov qword [rsp + 0x150], rdx
mov ecx, dword [rcx]
add rdi, rcx
test rcx, rcx
jne 0x140002999
mov qword [rsp + 0x88], r14
lea rsi, [rsp + 0x6e8]
lea rax, [rsp + 0x230]
mov qword [rsi], rax
lea rcx, [rsp + 0x300]
xor edx, edx
call fcn.140011f1d
mov rax, qword [rsp + 0x380]
lea rcx, [rsp + 0x418]
mov qword [rcx], rax
mov rbx, qword [rsp + 0x150]
mov qword [rsp + 0x460], rbx
movdqu xmm0, xmmword [rsp + 0x140]
movdqa xmmword [rsp + 0x450], xmm0
mov qword [rsp + 0xd0], 8
pxor xmm0, xmm0
movdqu xmmword [rsp + 0xd8], xmm0
mov qword [rsp + 0x468], rsi
lea rax, [rsp + 0x84]
mov qword [rsp + 0x470], rax
mov qword [rsp + 0x478], rcx
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x480], rax
mov rdi, qword [rsp + 0x458]
cmp rdi, rbx
jb 0x1400042d4
lea rsi, [rsp + 0x468]
mov r14, qword [rsi - 0x18]
mov rcx, rbx
call fcn.140010ff6
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 1
lea rsi, [rsp + 0x390]
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
mov r9, rax
call fcn.14000cd87
test rdi, rdi
je 0x140002af7
shl rdi, 3
mov edx, 8
mov rcx, r14
mov r8, rdi
call fcn.140006ead
mov rax, qword [rsp + 0x3a0]
xor edx, edx
sub rax, 1
jb 0x140002b19
mov rsi, qword [rsi]
test rsi, rsi
je 0x140002b19
add rdx, qword [rsi + 0x10]
add rsi, 0x18
jmp 0x140002b01
lea rcx, [rsp + 0xd0]
call fcn.1400111b2
mov rax, qword [rsp + 0x3a0]
lea rsi, [rsp + 0x5a0]
mov qword [rsi + 0x10], rax
movdqu xmm0, xmmword [rsp + 0x390]
movdqa xmmword [rsi], xmm0
lea r15, [rsp + 0x458]
lea rdi, [rsp + 0x450]
mov rcx, rsi
call fcn.14000ed56
test rax, rax
je 0x140002bfb
mov rbx, qword [rax]
movdqu xmm0, xmmword [rax + 8]
movdqa xmmword [rsp + 0x1b0], xmm0
mov rcx, rax
call fcn.140007611
test rbx, rbx
je 0x140002bfb
mov qword [rsp + 0x450], rbx
movdqa xmm0, xmmword [rsp + 0x1b0]
movdqu xmmword [r15], xmm0
mov r14, qword [rsp + 0x460]
lea rcx, [rsp + 0xd0]
mov rdx, r14
call fcn.1400111b2
mov r12, qword [rsp + 0xe0]
imul rcx, r12, 0x150
add rcx, qword [rsp + 0xd0]
imul r8, r14, 0x150
mov rdx, rbx
call fcn.140013d90
add r12, r14
mov qword [rsp + 0xe0], r12
and qword [rsp + 0x460], 0
mov rcx, rdi
call fcn.14000c783
jmp 0x140002b57
mov qword [rsp + 0x98], rbp
lea rcx, [rsp + 0x5a0]
call fcn.14000ed24
mov rbp, qword [rsp + 0xd0]
imul rcx, qword [rsp + 0xe0], 0x150
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0xa0], rax
lea rax, [rcx + rbp]
mov qword [rsp + 0xb0], rax
lea rsi, [rsp + 0x390]
lea r13, [rsp + 0x450]
mov qword [rsp + 0x90], rbp
test rcx, rcx
je 0x140002ea1
mov rbx, qword [rbp]
cmp rbx, 2
je 0x140002e9a
mov qword [rsp + 0x78], rcx
lea r12, [rbp + 0xc8]
mov rdi, qword [rbp + 0xc0]
lea rdx, [rbp + 8]
mov r8d, 0xb8
lea rcx, [rsp + 0x5a0]
call fcn.140013d90
mov r8d, 0x88
mov rcx, rsi
mov rdx, r12
call fcn.140013d90
mov qword [rsp + 0x1b0], rdi
mov rcx, qword [rsp + 0x250]
mov rdx, qword [rsp + 0x258]
mov r8, rdi
call fcn.14000fcc0
mov r12, rax
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0xd0], rax
cmp qword [rsp + 0x240], 0
je 0x140002e80
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x450], rax
lea rax, [rsp + 0x230]
mov qword [rsp + 0x458], rax
mov rcx, qword [rsp + 0x230]
mov rdx, qword [rsp + 0x238]
lea rax, [0x140011d1b]
mov qword [rsp + 0x20], rax
mov r8, r12
mov r9, r13
call fcn.140011b6b
test rax, rax
je 0x140002de1
mov rax, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0x230]
movzx r8d, byte [rcx + rdx]
and r8d, 1
sub qword [rsp + 0x240], r8
shr r12, 0x39
lea r8, [rdx - 0x10]
and r8, qword [rsp + 0x238]
mov byte [rcx + rdx], r12b
mov byte [r8 + rcx + 0x10], r12b
inc qword [rsp + 0x248]
mov r15, qword [rsp + 0x230]
neg rdx
imul r14, rdx, 0x158
lea r12, [r15 + r14]
add r12, 0xfffffffffffffeb8
mov qword [r12 - 0x10], rax
mov qword [r12 - 8], rbx
mov r8d, 0xb8
mov rcx, r12
lea rdx, [rsp + 0x5a0]
call fcn.140013d90
mov qword [r12 + 0xb8], rdi
lea rcx, [r15 + r14]
add rcx, 0xffffffffffffff78
mov r8d, 0x88
mov rdx, rsi
call fcn.140013d90
jmp 0x140002e68
mov r14, qword [rsp + 0x230]
neg rdx
imul r15, rdx, 0x158
lea r12, [r14 + r15]
add r12, 0xfffffffffffffeb0
mov r8d, 0x150
mov rcx, r13
mov rdx, r12
call fcn.140013d90
mov qword [r12], rbx
lea r12, [r14 + r15]
add r12, 0xfffffffffffffeb8
mov r8d, 0xb8
mov rcx, r12
lea rdx, [rsp + 0x5a0]
call fcn.140013d90
mov qword [r12 + 0xb8], rdi
lea rcx, [r14 + r15]
add rcx, 0xffffffffffffff78
mov r8d, 0x88
mov rdx, rsi
call fcn.140013d90
cmp qword [rsp + 0x450], 2
je 0x140002e68
mov rcx, r13
call fcn.14000c7ee
add rbp, 0x150
mov rcx, qword [rsp + 0x78]
add rcx, 0xfffffffffffffeb0
jmp 0x140002c58
lea rcx, [rsp + 0x230]
lea rdx, [rsp + 0x250]
call fcn.140022db5
jmp 0x140002cec
add rbp, 0x150
mov rax, qword [rsp + 0xb0]
sub rax, rbp
mov ecx, 0x150
xor edx, edx
div rcx
mov rcx, rbp
mov rdx, rax
call fcn.14000c7c4
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0xa0]
call fcn.14000c7ad
mov rax, qword [rsp + 0x230]
mov rcx, qword [rsp + 0x238]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [rsp + 0x248]
lea rdi, [rsp + 0x450]
mov qword [rdi], rax
add rax, 0x10
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rcx
mov word [rdi + 0x18], dx
mov qword [rdi + 0x20], r8
mov r14d, 0x158
lea rbp, [rsp + 0xac]
mov rcx, rdi
call fcn.1400117a1
test rax, rax
je 0x140002f76
mov rbx, rax
cmp byte [rax - 4], 0
mov byte [rax - 4], 0
jne 0x140002f2b
mov rax, qword [rsp + 0x230]
sub rax, rbx
cqo
idiv r14
lea rcx, [rsp + 0x230]
mov rdx, rax
call fcn.140011d65
add rbx, 0xfffffffffffffeb0
mov rcx, rbx
call fcn.14000c7ee
jmp 0x140002f2b
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x98]
call fcn.140004bb8
call sub.KERNEL32.dll_GetLogicalDrives
mov dword [rsp + 0x1b0], eax
test eax, eax
je 0x14000315e
lea r12, [rsp + 0xd8]
mov qword [r12 - 8], 8
pxor xmm0, xmm0
movdqu xmmword [r12], xmm0
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0x450], rax
movabs rax, 0x2000000000
mov qword [rsp + 0x458], rax
mov ecx, 0x20
call fcn.140010ff6
and dword [rsp + 0x28], 0
mov qword [rsp + 0x38], rdi
mov dword [rsp + 0x30], 0x20
mov qword [rsp + 0x20], 1
xor edi, edi
mov edx, 0x20
mov rcx, rsi
xor r8d, r8d
mov r9, rax
call fcn.14000ffc2
mov rax, qword [rsp + 0x3a0]
lea r15, [rsp + 0x418]
lea r13, [rsp + 0x84]
sub rax, 1
jb 0x140003046
mov rsi, qword [rsi]
test rsi, rsi
je 0x140003046
add rdi, qword [rsi + 0x10]
add rsi, 0x18
jmp 0x14000302e
lea rsi, [rsp + 0xd0]
mov rcx, rsi
mov rdx, rdi
call fcn.140011184
mov rax, qword [rsp + 0x3a0]
lea rdi, [rsp + 0x5a0]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0x390]
movaps xmmword [rdi], xmm0
lea rbx, [rsp + 0x450]
mov rcx, rdi
call fcn.14000ed56
test rax, rax
je 0x140003138
mov r14, qword [rax]
movups xmm0, xmmword [rax + 8]
movaps xmmword [rsp + 0x140], xmm0
mov rcx, rax
call fcn.140007611
test r14, r14
je 0x140003138
mov qword [rsp + 0x450], r14
movdqa xmm0, xmmword [rsp + 0x140]
lea rax, [rsp + 0x458]
movdqu xmmword [rax], xmm0
mov r15, qword [rsp + 0x460]
mov rcx, rsi
mov rdx, r15
call fcn.140011184
mov r13, qword [rsp + 0xe0]
imul rcx, r13, 0x90
add rcx, qword [rsp + 0xd0]
imul r8, r15, 0x90
mov rdx, r14
call fcn.140013d90
add r13, r15
mov qword [rsp + 0xe0], r13
lea r13, [rsp + 0x84]
lea r15, [rsp + 0x418]
and qword [rsp + 0x460], 0
mov rcx, rbx
call fcn.14000c91f
jmp 0x140003080
lea rcx, [rsp + 0x5a0]
call fcn.140010a2a
mov rsi, qword [rsp + 0xd0]
movdqu xmm0, xmmword [r12]
movdqa xmmword [rsp + 0x450], xmm0
jmp 0x140003180
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x450], xmm0
mov esi, 8
lea r15, [rsp + 0x418]
lea r13, [rsp + 0x84]
lea rcx, [rsp + 0x2d0]
call fcn.14000c91f
mov qword [rsp + 0x2d0], rsi
lea rax, [rsp + 0x480]
movdqa xmm0, xmmword [rax - 0x30]
movdqu xmmword [rsp + 0x2d8], xmm0
lea rax, [rsp + 0x1b0]
mov qword [rax], 8
pxor xmm6, xmm6
lea rcx, [rsp + 0x1a8]
and dword [rcx], 0
movdqu xmmword [rax + 8], xmm6
lea rsi, [rsp + 0x6e8]
lea rdi, [rsp + 0x5a0]
and qword [rsp + 0xb8], 0
and dword [rsp + 0xcc], 0
and dword [rsp + 0x1ac], 0
lea rax, [rsp + 0x1a8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x1ac]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xcc]
mov qword [rsp + 0x28], rax
or dword [rsp + 0x20], 0xffffffff
xor ecx, ecx
xor edx, edx
mov r8d, 2
lea r9, [rsp + 0xb8]
call sub.NETAPI32.dll_NetUserEnum
test eax, eax
je 0x140003249
cmp eax, 0xea
jne 0x140003591
mov dword [rsp + 0x78], eax
mov rbx, qword [rsp + 0xb8]
mov eax, dword [rsp + 0xcc]
lea r14, [rbx + rax*8]
cmp rbx, r14
je 0x140003575
mov r12, rbx
add rbx, 8
cmp qword [r12], 0
je 0x140003260
and qword [rsp + 0x6e8], 0
mov rdx, qword [r12]
xor ecx, ecx
mov r8d, 0x17
mov r9, rsi
call sub.NETAPI32.dll_NetUserGetInfo
test eax, eax
jne 0x14000355a
mov rax, qword [rsp + 0x6e8]
mov rdx, qword [rax + 0x20]
lea rcx, [rsp + 0x140]
call fcn.14000f5ae
mov rdx, qword [rsp + 0x140]
test rdx, rdx
je 0x14000355a
lea rcx, [rsp + 0x450]
call fcn.140011e0e
cmp qword [rsp + 0x450], 0
je 0x140003302
mov rax, qword [rsp + 0x460]
mov qword [rsp + 0xe0], rax
movdqu xmm0, xmmword [rsp + 0x450]
movdqa xmmword [rsp + 0xd0], xmm0
jmp 0x140003313
mov rdx, qword [r12]
lea rcx, [rsp + 0xd0]
call fcn.14000c56b
mov rdx, qword [r12]
and qword [rsp + 0x418], 0
and dword [rsp + 0x84], 0
and dword [rsp + 0xac], 0
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x20], r15
or dword [rsp + 0x28], 0xffffffff
lea rcx, [0x140025388]
xor r8d, r8d
mov r9d, 1
call sub.NETAPI32.dll_NetUserGetLocalGroups
test eax, eax
je 0x14000337a
lea rax, [rsp + 0x398]
movdqu xmmword [rax], xmm6
mov qword [rsp + 0x390], 8
jmp 0x1400034bf
mov r15d, dword [rsp + 0x84]
test r15, r15
je 0x1400033a2
imul r12, r15, 0x18
mov ecx, 8
mov rdx, r12
call fcn.140004b95
test rax, rax
jne 0x1400033a7
jmp 0x1400042d8
mov eax, 8
mov qword [rsp + 0x390], rax
mov qword [rsp + 0x398], r15
and qword [rsp + 0x3a0], 0
mov r13, qword [rsp + 0x418]
test r13, r13
je 0x140003406
mov r12d, dword [rsp + 0x84]
cmp r15d, r12d
jae 0x140003446
lea rcx, [rsp + 0x390]
xor edx, edx
mov r8, r12
call fcn.14000fb82
mov rcx, rax
call fcn.140004a9a
mov rax, qword [rsp + 0x390]
mov r15, qword [rsp + 0x3a0]
jmp 0x140003456
mov rax, qword [rsp + 0x3a0]
lea rcx, [rsp + 0x480]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x390]
mov qword [rcx], rax
mov rax, qword [rsp + 0x398]
mov qword [rcx + 8], rax
lea r15, [rsp + 0x418]
lea r13, [rsp + 0x84]
jmp 0x1400034fc
mov r15d, 0
mov ecx, 0
test r12, r12
je 0x1400034a7
imul rsi, r15, 0x18
add rsi, rax
xor ebp, ebp
mov rdx, qword [r13 + rbp*8]
mov rcx, rdi
call fcn.14000c56b
mov rax, qword [rsp + 0x5b0]
mov qword [rsi + 0x10], rax
movdqu xmm0, xmmword [rsp + 0x5a0]
movdqu xmmword [rsi], xmm0
inc rbp
add rsi, 0x18
cmp r12, rbp
jne 0x14000345f
add r15, rbp
mov rcx, r15
lea rsi, [rsp + 0x6e8]
lea rbp, [rsp + 0xac]
mov qword [rsp + 0x3a0], rcx
lea r15, [rsp + 0x418]
lea r13, [rsp + 0x84]
mov rcx, qword [rsp + 0x418]
mov rax, qword [rsp + 0x3a0]
lea rdx, [rsp + 0x480]
mov qword [rdx + 0x10], rax
mov rax, qword [rsp + 0x390]
mov qword [rdx], rax
mov rax, qword [rsp + 0x398]
mov qword [rdx + 8], rax
test rcx, rcx
je 0x1400034fc
call sub.NETAPI32.dll_NetApiBufferFree
movups xmm0, xmmword [rsp + 0x140]
movaps xmmword [rsp + 0x450], xmm0
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x460], rax
and dword [rsp + 0x498], 0
mov rax, qword [rsp + 0xe0]
lea rcx, [rsp + 0x468]
mov qword [rcx + 0x10], rax
movdqa xmm0, xmmword [rsp + 0xd0]
movdqu xmmword [rcx], xmm0
lea rcx, [rsp + 0x1b0]
lea rdx, [rsp + 0x450]
call fcn.140011edc
mov rcx, qword [rsp + 0x6e8]
test rcx, rcx
je 0x140003260
call sub.NETAPI32.dll_NetApiBufferFree
jmp 0x140003260
mov rcx, qword [rsp + 0xb8]
cmp dword [rsp + 0x78], 0xea
jne 0x140003599
call fcn.140011dfa
jmp 0x1400031de
mov rcx, qword [rsp + 0xb8]
call fcn.140011dfa
lea rcx, [rsp + 0x418]
and dword [rcx], 0
lea rsi, [rsp + 0x140]
and qword [rsi], 0
mov rdx, rsi
call sub.Secur32.dll_LsaEnumerateLogonSessions
mov rcx, qword [rsi]
test eax, eax
jne 0x1400037c5
mov eax, dword [rsp + 0x418]
lea rdi, [rcx + rax*8]
lea rsi, [rsp + 0xd0]
lea r15, [rsp + 0x450]
pxor xmm6, xmm6
cmp rcx, rdi
je 0x1400037bd
lea rbx, [rcx + 8]
and qword [rsp + 0xd0], 0
mov rdx, rsi
call sub.Secur32.dll_LsaGetLogonSessionData
mov rcx, qword [rsp + 0xd0]
test eax, eax
je 0x14000361b
call fcn.140011e04
mov rcx, rbx
jmp 0x1400035e7
test rcx, rcx
je 0x1400036be
cmp dword [rcx + 0x40], 3
je 0x140003611
movzx r14d, word [rcx + 0x10]
mov r12, qword [rcx + 0x18]
mov rdx, qword [rcx + 0x48]
mov rcx, r15
call fcn.14000f5ae
mov rbp, qword [rsp + 0x450]
test rbp, rbp
je 0x1400037b0
mov qword [rsp + 0x88], r12
mov rax, qword [rsp + 0x458]
mov qword [rsp + 0x78], rax
mov r13, qword [rsp + 0x460]
mov rdx, qword [rsp + 0x1b0]
imul r15, qword [rsp + 0x1c0], 0x50
test r15, r15
je 0x1400036c5
lea r12, [rdx + 0x50]
mov rcx, qword [rdx]
mov rdx, qword [rdx + 0x10]
mov r8, rbp
mov r9, r13
call fcn.140005ca2
add r15, 0xffffffffffffffb0
mov rdx, r12
test al, al
je 0x14000367e
mov rcx, rbp
mov rdx, qword [rsp + 0x78]
call fcn.140004bb8
lea r15, [rsp + 0x450]
jmp 0x1400037b0
xor ecx, ecx
jmp 0x140003611
lea rcx, [rsp + 0x5a0]
mov rdx, rbp
call fcn.140011e0e
mov rax, qword [rsp + 0x5a0]
test rax, rax
je 0x140003701
lea rcx, [rsp + 0x5a8]
movdqu xmm0, xmmword [rcx]
movdqa xmmword [rsp + 0x390], xmm0
lea r15, [rsp + 0x450]
jmp 0x140003751
shr r14d, 1
lea r15, [rsp + 0x450]
mov rcx, r15
mov rdx, qword [rsp + 0x88]
mov r8, r14
call fcn.140004e82
mov rax, qword [rsp + 0x450]
test rax, rax
je 0x140003743
lea rcx, [rsp + 0x458]
movdqu xmm0, xmmword [rcx]
movdqa xmmword [rsp + 0x390], xmm0
jmp 0x140003751
movdqa xmmword [rsp + 0x390], xmm6
mov eax, 1
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x450], rbp
mov qword [rsp + 0x458], rcx
mov qword [rsp + 0x460], r13
movdqa xmm0, xmmword [rsp + 0x390]
lea rcx, [rsp + 0x470]
movdqu xmmword [rcx], xmm0
and dword [rcx + 0x28], 0
movdqu xmmword [rcx + 0x18], xmm6
mov qword [rsp + 0x468], rax
mov qword [rsp + 0x480], 8
lea rcx, [rsp + 0x1b0]
mov rdx, r15
call fcn.140011edc
mov rcx, qword [rsp + 0xd0]
jmp 0x140003611
mov rcx, qword [rsp + 0x140]
mov rax, qword [rsp + 0x1c0]
mov qword [rsp + 0x460], rax
movups xmm0, xmmword [rsp + 0x1b0]
movaps xmmword [rsp + 0x450], xmm0
test rcx, rcx
je 0x1400037ef
call fcn.1400132b8
mov rcx, qword [rsp + 0x2e8]
mov rdx, qword [rsp + 0x2f8]
call fcn.14001169a
mov rcx, qword [rsp + 0x2e8]
mov rdx, qword [rsp + 0x2f0]
call fcn.1400116f3
mov rax, qword [rsp + 0x460]
lea rcx, [rsp + 0x2e8]
mov qword [rcx + 0x10], rax
movdqa xmm0, xmmword [rsp + 0x450]
movdqu xmmword [rcx], xmm0
mov rax, qword [rsp + 0x1f0]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x208]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x220]
mov qword [rsp + 0x670], rax
mov rax, qword [rsp + 0x228]
mov qword [rsp + 0x668], rax
mov r14, qword [rsp + 0x230]
mov rbp, qword [rsp + 0x238]
mov r15, qword [rsp + 0x248]
mov rax, qword [rsp + 0x260]
mov qword [rsp + 0x680], rax
mov rax, qword [rsp + 0x268]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x278]
mov qword [rsp + 0x678], rax
mov r12, qword [rsp + 0x2b8]
mov rax, qword [rsp + 0x2c0]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x2c8]
mov qword [rsp + 0x108], rax
mov rbx, qword [rsp + 0x2d0]
movdqa xmm6, xmmword [r14]
mov rax, qword [rsp + 0x2d8]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x2e0]
mov qword [rsp + 0x1a0], rax
mov rsi, qword [rsp + 0x2e8]
mov rax, qword [rsp + 0x2f0]
mov qword [rsp + 0x6b0], rax
mov rdi, qword [rsp + 0x2f8]
mov rax, qword [rsp + 0x300]
mov qword [rsp + 0x6b8], rax
mov rax, qword [rsp + 0x308]
mov qword [rsp + 0x6c0], rax
mov rax, qword [rsp + 0x318]
mov qword [rsp + 0x6d0], rax
mov rax, qword [rsp + 0x320]
mov qword [rsp + 0x6d8], rax
mov rax, qword [rsp + 0x330]
mov qword [rsp + 0x6e0], rax
mov rax, qword [rsp + 0x338]
mov qword [rsp + 0x180], rax
mov rax, qword [rsp + 0x348]
mov qword [rsp + 0x6c8], rax
mov rax, qword [rsp + 0x350]
mov qword [rsp + 0x660], rax
mov rax, qword [rsp + 0x370]
mov qword [rsp + 0x190], rax
mov rax, qword [rsp + 0x378]
mov qword [rsp + 0x198], rax
mov rax, qword [rsp + 0x380]
mov qword [rsp + 0x188], rax
mov al, byte [0x140030b80]
mov ecx, 0x38
mov edx, 8
call fcn.1400044a0
test rax, rax
je 0x1400042ff
mov r13, rax
mov qword [rsp + 0x690], r12
mov qword [rsp + 0x698], rbx
mov qword [rsp + 0x6a0], rdi
mov qword [rsp + 0x6a8], rsi
mov qword [rsp + 0x78], rbp
lea rdi, [rbp + r14 + 1]
lea rbx, [r14 + 0x10]
pmovmskb eax, xmm6
not eax
mov qword [r13], r14
mov qword [r13 + 8], rbx
mov qword [r13 + 0x10], rdi
mov word [r13 + 0x18], ax
mov qword [rsp + 0x658], r15
mov qword [r13 + 0x20], r15
lea rbp, [0x1400246ae]
mov qword [r13 + 0x28], rbp
mov qword [r13 + 0x30], 0xb
mov esi, 0xb
mov rcx, r13
call fcn.1400117a1
test rax, rax
je 0x140003b0b
mov r12, rax
add rax, 0xfffffffffffffeb0
je 0x140003b0b
mov rcx, qword [r12 - 0xd8]
mov rdx, qword [r12 - 0xc8]
mov r8, rbp
mov r9, rsi
call fcn.140005ca7
test al, al
je 0x140003a81
mov esi, dword [r12 - 0x90]
mov rdx, qword [rsp + 0x138]
cmp rdx, qword [rsp + 0x130]
jne 0x140003ae7
lea rcx, [rsp + 0x128]
call fcn.140006bf9
mov rdx, qword [rsp + 0x138]
mov rax, qword [rsp + 0x128]
mov qword [rax + rdx*8], rsi
inc rdx
mov qword [rsp + 0x138], rdx
mov rbp, qword [r13 + 0x28]
mov rsi, qword [r13 + 0x30]
jmp 0x140003a81
mov rbp, qword [rsp + 0x6b0]
mov edx, 8
mov rcx, r13
call fcn.140004530
mov r15, qword [rsp + 0x128]
mov rax, qword [rsp + 0x130]
mov qword [rsp + 0x688], rax
mov r12, qword [rsp + 0x138]
cmp qword [rsp + 0x78], 0
mov r13, qword [rsp + 0xa0]
je 0x140003bb3
mov rcx, qword [rsp + 0x658]
test rcx, rcx
je 0x140003ba0
movdqa xmm0, xmmword [r14]
pmovmskb eax, xmm0
not eax
lea rsi, [rsp + 0x1f0]
mov word [rsi + 0x18], ax
mov qword [rsi], r14
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rdi
mov qword [rsi + 0x20], rcx
mov rcx, rsi
call fcn.1400117a1
test rax, rax
je 0x140003ba0
add rax, 0xfffffffffffffeb0
mov rcx, rax
call fcn.14000c7ee
jmp 0x140003b83
mov r8d, 0x158
mov rcx, r14
mov rdx, qword [rsp + 0x78]
call fcn.140001050
mov rcx, qword [rsp + 0x6b8]
mov rdx, qword [rsp + 0x6c0]
call fcn.140004bb8
mov rcx, qword [rsp + 0x6c8]
test rcx, rcx
je 0x140003be2
mov rdx, qword [rsp + 0x660]
call fcn.140004bb8
mov rcx, qword [rsp + 0x6d0]
mov rdx, qword [rsp + 0x6d8]
call fcn.140004bb8
mov rcx, qword [rsp + 0x6e0]
mov rdx, qword [rsp + 0x180]
call fcn.140004bb8
mov rsi, qword [rsp + 0x190]
mov rcx, rsi
mov rdx, qword [rsp + 0x188]
call fcn.140011575
mov rcx, rsi
mov rdx, qword [rsp + 0x198]
call fcn.1400116df
mov rsi, qword [rsp + 0x690]
mov rcx, rsi
mov rdx, qword [rsp + 0x108]
call fcn.1400115cb
mov rcx, rsi
mov rdx, qword [rsp + 0xb0]
call fcn.140011707
mov rsi, qword [rsp + 0x698]
mov rcx, rsi
mov rdx, qword [rsp + 0x1a0]
call fcn.14000c949
mov rcx, rsi
mov rdx, qword [rsp + 0xc0]
call fcn.14000c9a2
mov r14, qword [rsp + 0x90]
test r14, r14
je 0x140003d70
lea rdi, [r14 + r13]
inc rdi
movdqa xmm0, xmmword [r14]
pmovmskb eax, xmm0
not eax
lea rbx, [r14 + 0x10]
lea rsi, [rsp + 0x1f0]
mov qword [rsi], r14
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rdi
mov word [rsi + 0x18], ax
mov rax, qword [rsp + 0x88]
mov qword [rsi + 0x20], rax
mov rcx, rsi
call fcn.140011743
test rax, rax
je 0x140003ce6
mov rcx, qword [rax - 8]
call sub.pdh.dll_PdhRemoveCounter
jmp 0x140003cce
mov rcx, qword [rsp + 0x668]
test rcx, rcx
je 0x140003cf9
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x670]
test rcx, rcx
je 0x140003d0b
call sub.pdh.dll_PdhCloseQuery
test r13, r13
je 0x140003d70
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x140003d5f
movdqa xmm0, xmmword [r14]
pmovmskb eax, xmm0
not eax
lea rsi, [rsp + 0x1f0]
mov qword [rsi], r14
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rdi
mov word [rsi + 0x18], ax
mov qword [rsi + 0x20], rcx
mov rcx, rsi
call fcn.140011743
test rax, rax
je 0x140003d5f
mov rcx, qword [rax - 0x20]
mov rdx, qword [rax - 0x18]
call fcn.140004bb8
jmp 0x140003d43
mov r8d, 0x20
mov rcx, r14
mov rdx, r13
call fcn.14001171b
mov rbx, qword [rsp + 0x98]
test rbx, rbx
je 0x140003df2
mov r8, qword [rsp + 0x678]
test r8, r8
mov rdi, qword [rsp + 0x680]
je 0x140003de1
lea rax, [rbx + rdi]
inc rax
movdqa xmm0, xmmword [rdi]
pmovmskb ecx, xmm0
not ecx
lea rdx, [rdi + 0x10]
lea rsi, [rsp + 0x1f0]
mov qword [rsi], rdi
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
mov qword [rsi + 0x20], r8
mov rcx, rsi
call fcn.140010f95
test rax, rax
je 0x140003de1
mov rcx, qword [rax - 0x88]
mov rdx, qword [rax - 0x80]
call fcn.140004bb8
jmp 0x140003dc2
mov r8d, 0x88
mov rcx, rdi
mov rdx, rbx
call fcn.140001050
mov rsi, qword [rsp + 0x6a8]
mov rcx, rsi
mov rdx, qword [rsp + 0x6a0]
call fcn.14001169a
mov rcx, rsi
mov rdx, rbp
call fcn.1400116f3
test r12, r12
je 0x1400042bd
lea rdi, [r15 + r12*8]
mov rbx, r15
mov r13, qword [rsp + 0x110]
mov r12, qword [rsp + 0x120]
pxor xmm6, xmm6
lea rsi, [rsp + 0x450]
mov qword [rsp + 0x78], r15
cmp rbx, rdi
je 0x140004177
mov qword [rsp + 0x1f0], 1
lea rax, [rsp + 0x1f8]
movdqu xmmword [rax], xmm6
test r12, r12
je 0x140003ec7
lea rcx, [rsp + 0x1f0]
mov rdx, r12
call fcn.1400049c8
mov r14, qword [rsp + 0x1f0]
mov rbp, qword [rsp + 0x200]
lea rax, [r14 + rbp]
mov ecx, 1
mov byte [rax + rcx - 1], 0
cmp r12, rcx
je 0x140003ea4
inc rcx
jmp 0x140003e95
add rbp, r12
mov qword [rsp + 0x200], rbp
mov qword [rsp + 0x20], rbp
mov rcx, rsi
mov rdx, r13
mov r8, r12
mov r9, r14
call fcn.140005007
jmp 0x140003ee9
and qword [rsp + 0x20], 0
mov r14d, 1
mov r9d, 1
mov rcx, rsi
mov rdx, r13
xor r8d, r8d
call fcn.140005007
xor ebp, ebp
cmp dword [rsp + 0x450], 3
jne 0x1400042c4
mov r12, qword [rsp + 0x458]
cmp rbp, r12
cmovb r12, rbp
mov r15, qword [rsp + 0x1f8]
mov rdx, qword [rsp + 0x118]
mov rcx, r13
call fcn.140004bb8
mov qword [rsp + 0x118], r15
mov rcx, rsi
mov rdx, r14
mov r8, r12
call fcn.140004f18
mov rax, qword [rbx]
mov qword [rsp + 0x418], rax
movdqa xmmword [rsp + 0x210], xmm6
movdqa xmmword [rsp + 0x200], xmm6
movdqa xmmword [rsp + 0x1f0], xmm6
mov qword [rsp + 0x5a0], rax
and qword [rsp + 0x5a8], 0
mov ecx, 0x4b82f718
call fcn.140009b9d
lea rcx, [rsp + 0x5a0]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x1f0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x7f
mov ecx, eax
mov r8d, 4
lea r9, [rsp + 0x418]
call section..text
test eax, eax
js 0x1400042bd
and qword [rsp + 0x1b0], 0
mov r15, qword [rsp + 0x460]
mov qword [rsp + 0x140], r15
mov ecx, 0xf783b8ec
call fcn.140009b9d
mov r9, qword [rsp + 0x418]
lea rcx, [rsp + 0x140]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x1b0]
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x40], 4
mov dword [rsp + 0x38], 0x3000
and dword [rsp + 0x28], 0
mov ecx, eax
mov r8d, 6
call section..text
test eax, eax
js 0x1400042bd
and dword [rsp + 0x128], 0
mov r13, qword [rsp + 0x450]
mov qword [rsp + 0xd0], r15
mov ecx, 0xc3170192
call fcn.140009b9d
mov r9, qword [rsp + 0x418]
mov rcx, qword [rsp + 0x1b0]
lea r8, [rsp + 0x128]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rcx
mov ecx, eax
mov r8d, 5
call section..text
test eax, eax
js 0x1400042bd
mov ebp, eax
mov dword [rsp + 0x6e8], 4
mov ecx, 0x50e92888
call fcn.140009b9d
mov r9, qword [rsp + 0x418]
lea rcx, [rsp + 0x6e8]
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0xd0]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x1b0]
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0x40
mov ecx, eax
mov r8d, 5
call section..text
test eax, eax
js 0x1400042bd
and qword [rsp + 0x390], 0
mov r15, qword [rsp + 0x418]
mov ecx, 0xaf18cfb0
call fcn.140009b9d
mov rcx, qword [rsp + 0x1b0]
movdqu xmmword [rsp + 0x60], xmm6
movdqu xmmword [rsp + 0x50], xmm6
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x48], 4
and qword [rsp + 0x40], 0
and qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1fffff
mov ecx, eax
mov r8d, 0xb
lea r9, [rsp + 0x390]
call section..text
test ebp, ebp
jne 0x1400042bd
add rbx, 8
mov rdx, qword [rsp + 0x458]
mov rcx, r13
call fcn.140004bb8
mov r13, r14
jmp 0x140003e46
mov qword [rsp + 0x110], r13
mov qword [rsp + 0x120], r12
cmp qword [rsp + 0x688], 0
je 0x1400041a1
mov edx, 8
mov rcx, qword [rsp + 0x78]
call fcn.140004530
mov rdx, qword [rsp + 0x118]
mov rcx, r13
call fcn.140004bb8
movaps xmm6, xmmword [rsp + 0x720]
movaps xmm7, xmmword [rsp + 0x730]
movaps xmm8, xmmword [rsp + 0x740]
add rsp, 0x758
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r12, r14
lea r15, [rsp + 0x6f0]
movd xmm6, dword [rsp + 0x390]
movd xmm7, dword [rsp + 0x398]
mov esi, 8
mov ecx, 8
call fcn.140004cd1
mov rdi, rax
movabs rax, 0x72657475706d6f43
mov qword [rdi], rax
mov r14, qword [r15 - 8]
movdqu xmm0, xmmword [r15]
movups xmm1, xmmword [r15 + 0x10]
movups xmm2, xmmword [r15 + 0x20]
movaps xmmword [rsp + 0x5c0], xmm2
movaps xmmword [rsp + 0x5b0], xmm1
movdqa xmmword [rsp + 0x5a0], xmm0
cmp r14, 3
jne 0x140004250
xor edi, edi
jmp 0x1400042b5
mov rbx, rdx
mov ecx, 0x60
mov edx, 8
call fcn.14000bcae
mov rsi, rax
mov qword [rax], r14
movdqa xmm0, xmmword [rsp + 0x5a0]
movaps xmm1, xmmword [rsp + 0x5b0]
movaps xmm2, xmmword [rsp + 0x5c0]
movdqu xmmword [rax + 8], xmm0
movups xmmword [rax + 0x18], xmm1
movups xmmword [rax + 0x28], xmm2
mov dword [rax + 0x38], ebp
movd dword [rax + 0x3c], xmm7
mov qword [rax + 0x40], rdi
mov qword [rax + 0x48], rbx
mov qword [rax + 0x50], 8
movd dword [rax + 0x58], xmm6
movd dword [rax + 0x5c], xmm6
mov edi, 1
mov r14, r12
jmp 0x140001a57
call fcn.14000c3c9
ud2
mov rdx, qword [rsp + 0x1f8]
mov rcx, r14
call fcn.140004bb8
ud2
mov ecx, 8
mov rdx, r12
call fcn.140021a06
ud2
mov ecx, 8
mov edx, 0x120
jmp 0x1400042e0
mov ecx, 8
mov edx, 0xfa0
jmp 0x1400042e0
mov ecx, 8
mov edx, 0x38
jmp 0x1400042e0