Function at 0x140002e21
Capabilities:
Check for debugger via api
Get disk information
Get local ipv4 addresses
Get logon sessions
Get memory capacity
Get system information on windows
List groups for user account
List user accounts
Resolve function by parsing pe exports

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xcd8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0xc40], xmm15
movaps xmmword [rbp + 0xc30], xmm14
movaps xmmword [rbp + 0xc20], xmm13
movaps xmmword [rbp + 0xc10], xmm12
movdqa xmmword [rbp + 0xc00], xmm11
movaps xmmword [rbp + 0xbf0], xmm10
movdqa xmmword [rbp + 0xbe0], xmm9
movdqa xmmword [rbp + 0xbd0], xmm8
movdqa xmmword [rbp + 0xbc0], xmm7
movdqa xmmword [rbp + 0xbb0], xmm6
and rsp, 0xffffffffffffffe0
mov eax, 0x40000000
cpuid
mov eax, ebx
mov r12d, ecx
mov r15d, edx
mov ebx, eax
push 0xc
pop r14
push 1
pop rsi
mov rcx, r14
mov rdx, rsi
call fcn.140001c52
mov rdi, rax
mov eax, ebx
mov ecx, ebx
mov byte [rdi], bl
mov byte [rdi + 1], bh
shr eax, 0x10
shr ecx, 0x18
mov edx, r12d
mov r8d, r12d
mov byte [rdi + 2], al
mov byte [rdi + 3], cl
mov byte [rdi + 4], r12b
mov eax, r12d
mov byte [rdi + 5], ah
shr edx, 0x10
shr r8d, 0x18
mov eax, r15d
mov ecx, r15d
mov byte [rdi + 6], dl
mov byte [rdi + 7], r8b
mov byte [rdi + 8], r15b
mov edx, r15d
mov byte [rdi + 9], dh
shr eax, 0x10
shr ecx, 0x18
mov byte [rdi + 0xa], al
mov byte [rdi + 0xb], cl
lea r8, [0x140022824]
mov rcx, rdi
mov rdx, r14
call fcn.140001c3c
test al, al
je 0x140002f4b
lea r8, [0x140022830]
push 0xc
pop rbx
mov rcx, rdi
mov rdx, rbx
call fcn.140001c3c
mov r14d, eax
mov rcx, rdi
mov rdx, rbx
call fcn.140007b8f
test r14b, r14b
je 0x140002f56
jmp 0x1400073de
push 0xc
pop rdx
mov rcx, rdi
call fcn.140007b8f
push 0x60
pop rax
mov rax, qword gs:[eax]
cmp byte [rax + 2], 1
je 0x1400073de
lea rdi, [rsp + 0x760]
and dword [rdi], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov rcx, rax
mov rdx, rdi
call sub.KERNEL32.dll_CheckRemoteDebuggerPresent
cmp dword [rdi], 0
jne 0x1400073de
lea rdi, [rsp + 0x140]
mov qword [rdi], 1
xorps xmm0, xmm0
movups xmmword [rdi + 8], xmm0
xor ebx, ebx
lea r14, [0x140022848]
xor edx, edx
cmp rbx, 0x2eb
je 0x140002ff8
mov r15b, byte [rbx + r14]
cmp rdx, qword [rsp + 0x148]
jne 0x140002fdc
mov rcx, rdi
call fcn.1400078e1
mov rsi, qword [rsp + 0x140]
mov rdx, qword [rsp + 0x150]
mov byte [rsi + rdx], r15b
mov rdx, qword [rsp + 0x150]
inc rdx
mov qword [rsp + 0x150], rdx
inc rbx
jmp 0x140002fad
mov qword [rsp + 0x160], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x168], xmm0
call fcn.14001829d
mov r14, rax
mov r13, rdx
lea rsi, [rsp + 0x760]
mov edx, 0x158
mov r8d, 0x1f4
mov rcx, rsi
call fcn.1400173dc
movdqu xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x4b0], xmm1
movdqa xmmword [rsp + 0x4a0], xmm0
push 9
pop rcx
call fcn.14000fa49
mov rbx, rax
mov rdi, rdx
movabs rax, 0x5043206c61746f54
mov qword [rbx], rax
mov byte [rbx + 8], 0x55
push 8
pop rcx
mov edx, 0x120
mov qword [rsp + 0x80], rcx
call fcn.1400078d9
test rax, rax
je 0x1400073fa
mov r15, rax
movabs rsi, 0x19db1ded53e8000
call fcn.14001829d
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rdx
call fcn.140011a18
shl rdx, 0x20
mov eax, eax
or rax, rdx
movabs rcx, 0xfe624e212ac18000
cmp rax, rsi
jge 0x1400030cc
mov rsi, r14
xor r14d, r14d
jmp 0x1400030f8
mov rsi, r14
add rax, rcx
xor r12d, r12d
mov ecx, 0x989680
xor edx, edx
div rcx
mov r14, rax
call sub.KERNEL32.dll_GetTickCount64
mov ecx, 0x3e8
xor edx, edx
div rcx
sub r14, rax
cmovb r14, r12
pxor xmm8, xmm8
movdqu xmmword [rsp + 0x860], xmm8
lea r12, [rsp + 0x4a0]
movaps xmm0, xmmword [r12]
movaps xmm1, xmmword [r12 + 0x10]
movups xmmword [rsp + 0x7a0], xmm0
movups xmmword [rsp + 0x7b0], xmm1
mov qword [rsp + 0x7c0], rsi
mov qword [rsp + 0x7c8], r13
movdqu xmmword [rsp + 0x800], xmm8
movdqu xmmword [rsp + 0x810], xmm8
mov qword [rsp + 0x870], rbx
mov qword [rsp + 0x878], rdi
mov qword [rsp + 0x880], 9
push 1
pop rax
mov qword [rsp + 0x888], rax
movdqu xmmword [rsp + 0x890], xmm8
mov qword [rsp + 0x8a0], rax
and qword [rsp + 0x8b8], 0
movdqu xmmword [rsp + 0x8a8], xmm8
lea rdi, [rsp + 0x360]
movups xmm0, xmmword [rdi]
movups xmmword [rsp + 0x8c0], xmm0
and qword [rsp + 0x8d0], 0
and dword [rsp + 0x8d8], 0
push 8
pop rax
mov qword [rsp + 0x8e0], rax
movdqu xmmword [rsp + 0x8e8], xmm8
mov byte [rsp + 0x8f8], 0
mov qword [rsp + 0x828], rax
movdqu xmmword [rsp + 0x830], xmm8
mov qword [rsp + 0x840], r15
mov qword [rsp + 0x848], 2
and qword [rsp + 0x850], 0
and qword [rsp + 0x760], 0
movdqu xmm6, xmmword [0x140023410]
movdqu xmmword [rsp + 0x7e0], xmm6
movdqu xmm7, xmmword [0x140023400]
movdqu xmmword [rsp + 0x7d0], xmm7
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x7f0], rcx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x7f8], rcx
mov qword [rsp + 0x820], r14
mov qword [rsp + 0x858], rax
movdqa xmmword [rdi], xmm8
movdqa xmmword [rdi + 0x30], xmm8
movdqa xmmword [rdi + 0x20], xmm8
movdqa xmmword [rdi + 0x10], xmm8
mov dword [rdi], 0x40
mov rcx, rdi
call sub.KERNEL32.dll_GlobalMemoryStatusEx
movdqu xmm0, xmmword [rdi + 8]
movdqu xmmword [rsp + 0x800], xmm0
movdqa xmmword [r12 + 0x50], xmm8
movdqa xmmword [r12 + 0x40], xmm8
movdqa xmmword [r12 + 0x30], xmm8
movdqa xmmword [r12 + 0x20], xmm8
movdqa xmmword [r12 + 0x10], xmm8
movdqa xmmword [r12], xmm8
and qword [r12 + 0x60], 0
push 0x68
pop rdx
mov rcx, r12
call sub.PSAPI.DLL_GetPerformanceInfo
cmp eax, 1
jne 0x14000332d
mov rdx, qword [rsp + 0x4b0]
mov r9, qword [rsp + 0x4c0]
xor r10d, r10d
sub rdx, r9
cmovb rdx, r10
mov rcx, qword [rsp + 0x4f0]
mov rax, rcx
mul rdx
mov r8, rax
push 0xffffffffffffffff
pop r11
cmovo r8, r11
mov rdx, qword [rsp + 0x4a8]
sub rdx, r9
cmovb rdx, r10
mov rax, rcx
mul rdx
cmovo rax, r11
mov qword [rsp + 0x810], r8
mov qword [rsp + 0x818], rax
lea rax, [rsp + 0x870]
cmp qword [rax - 0x110], 0
je 0x140003439
mov rcx, qword [rsp + 0x790]
call sub.pdh.dll_PdhCollectQueryData
cmp qword [rsp + 0x8b8], 0
je 0x140003381
lea rdx, [rsp + 0x8b8]
lea rcx, [rsp + 0x760]
call fcn.14001959d
test eax, eax
je 0x1400073fa
movd dword [rsp + 0x8d8], xmm0
lea rcx, [rsp + 0x870]
mov dl, 1
call fcn.14001957b
mov rdi, rax
mov rbx, rdx
add rdi, 0x48
lea r14, [rsp + 0x760]
lea rax, [rdi - 0x48]
cmp rax, rbx
je 0x1400033cf
cmp qword [rdi], 0
je 0x1400033c9
mov rcx, r14
mov rdx, rdi
call fcn.14001959d
test eax, eax
je 0x1400073fa
movd dword [rdi + 0x20], xmm0
add rdi, 0x70
jmp 0x1400033a2
cmp byte [rsp + 0x8f8], 0
jne 0x1400036ba
mov rdi, qword [rsp + 0x8f0]
lea rbx, [rsp + 0x4a0]
mov rcx, rbx
mov rdx, rdi
call fcn.140018ae4
mov rsi, qword [rsp + 0x8e0]
mov rcx, qword [rbx]
mov rdx, qword [rbx + 8]
mov rax, qword [rbx + 0x10]
shl rax, 3
imul r8, rdi, 0x70
xor r9d, r9d
mov r10, rsi
test r8, r8
je 0x140003454
cmp rax, r9
je 0x140003454
mov r11, qword [rcx + r9]
mov qword [r10 + 0x60], r11
add r10, 0x70
add r9, 8
add r8, 0xffffffffffffff90
jmp 0x140003419
lea r8, [rsp + 0x4a0]
and qword [r8], 0
xor ecx, ecx
xor edx, edx
call sub.pdh.dll_PdhOpenQueryA
test eax, eax
je 0x14000346b
jmp 0x14000348f
call fcn.1400168bc
test rdi, rdi
je 0x1400036a8
mov rax, qword [rsi + 0x60]
jmp 0x1400036aa
mov rsi, qword [rsp + 0x4a0]
call fcn.14001829d
lea rcx, [0x1400233f0]
mov qword [rsp + 0x360], rcx
lea rdi, [rsp + 0x210]
and qword [rdi], 0
mov rcx, qword [rsp + 0x360]
mov qword [rsp + 0x760], rcx
and qword [rsp + 0x778], 0
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x768], xmm0
mov qword [rsp + 0x780], rax
mov qword [rsp + 0x788], rdx
mov qword [rsp + 0x790], rsi
mov rax, qword [rsp + 0x210]
mov qword [rsp + 0x798], rax
test rcx, rcx
je 0x1400036ba
push 0x23
pop rcx
call fcn.14000fa49
movups xmm0, xmmword [0x140023613]
movups xmmword [rax], xmm0
movdqu xmm0, xmmword [0x140023623]
movdqu xmmword [rax + 0x10], xmm0
mov dword [rax + 0x1f], 0x656d6954
lea rsi, [rsp + 0x360]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], 0x23
lea r15, [rsp + 0x8b8]
push 5
pop rcx
call fcn.14000fa49
mov dword [rax], 0x5f746f74
mov byte [rax + 4], 0x30
lea r9, [rsp + 0x4a0]
mov qword [r9], rax
mov qword [r9 + 8], rdx
mov qword [r9 + 0x10], 5
lea rdx, [rsp + 0x760]
mov rcx, rsi
mov r8, r15
call fcn.140019246
lea rcx, [rsp + 0x870]
mov dl, 1
call fcn.14001957b
mov r15, rax
mov qword [rsp + 0x78], rdx
xor eax, eax
mov qword [rsp + 0x70], rax
push 1
pop rsi
cmp r15, qword [rsp + 0x78]
je 0x140003697
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x100], rax
inc rax
mov qword [rsp + 0x70], rax
lea rax, [0x140023658]
mov qword [rsp + 0x4a0], rax
push 2
pop r12
mov qword [rsp + 0x4a8], r12
and qword [rsp + 0x4c0], 0
lea rbx, [rsp + 0x100]
mov qword [rsp + 0xc0], rbx
lea r14, [0x1400088bb]
mov qword [rsp + 0xc8], r14
lea r13, [rsp + 0xc0]
mov qword [rsp + 0x4b0], r13
mov qword [rsp + 0x4b8], rsi
lea rcx, [rsp + 0x210]
lea rdi, [rsp + 0x4a0]
mov rdx, rdi
call fcn.140012762
lea rax, [0x140023680]
mov qword [rsp + 0x4a0], rax
mov qword [rsp + 0x4a8], r12
and qword [rsp + 0x4c0], 0
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0xc8], r14
mov qword [rsp + 0x4b0], r13
mov qword [rsp + 0x4b8], rsi
lea r12, [rsp + 0x360]
mov rcx, r12
mov rdx, rdi
call fcn.140012762
lea r8, [r15 + 0x48]
lea rcx, [rsp + 0x210]
lea rdx, [rsp + 0x760]
mov r9, r12
call fcn.140019246
add r15, 0x70
jmp 0x14000358c
cmp qword [rsp + 0x760], 0
jne 0x140003343
jmp 0x1400036ba
xor eax, eax
mov qword [rsp + 0x8d0], rax
mov byte [rsp + 0x8f8], 1
lea rdi, [rsp + 0x360]
mov rcx, rdi
call fcn.140018d0f
cmp dword [rdi], 2
je 0x14000396c
mov rax, qword [rsp + 0x390]
lea rdx, [rsp + 0x4a0]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x360]
movups xmm1, xmmword [rsp + 0x370]
movups xmm2, xmmword [rsp + 0x380]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rdi, [rsp + 0x210]
mov rcx, rdi
call fcn.140018d3b
cmp qword [rdi], 2
je 0x14000396c
mov rax, qword [rsp + 0x240]
lea rdx, [rsp + 0x4a0]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x210]
movups xmm1, xmmword [rsp + 0x220]
movups xmm2, xmmword [rsp + 0x230]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rdi, [rsp + 0xc0]
mov rcx, rdi
call fcn.140018db5
cmp qword [rdi], 2
je 0x14000396c
mov rax, qword [rsp + 0xf0]
lea rdx, [rsp + 0x4a0]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0xc0]
movups xmm1, xmmword [rsp + 0xd0]
movups xmm2, xmmword [rsp + 0xe0]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rdi, [rsp + 0x100]
mov rcx, rdi
call fcn.140018e4b
cmp qword [rdi], 2
je 0x14000396c
mov rax, qword [rsp + 0x130]
lea rdx, [rsp + 0x4a0]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x100]
movups xmm1, xmmword [rsp + 0x110]
movups xmm2, xmmword [rsp + 0x120]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rdi, [rsp + 0x1a0]
mov rcx, rdi
call fcn.140018f15
cmp qword [rdi], 2
je 0x14000396c
mov rax, qword [rsp + 0x1d0]
lea rdx, [rsp + 0x4a0]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x1a0]
movups xmm1, xmmword [rsp + 0x1b0]
movups xmm2, xmmword [rsp + 0x1c0]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rdi, [rsp + 0x300]
mov rcx, rdi
call fcn.140018f92
mov rax, qword [rdi]
cmp rax, 2
je 0x14000396c
movups xmm0, xmmword [rsp + 0x308]
movups xmm1, xmmword [rsp + 0x318]
movups xmm2, xmmword [rsp + 0x328]
lea rdi, [rsp + 0x720]
movups xmmword [rdi + 0x28], xmm2
movups xmmword [rdi + 0x18], xmm1
movups xmmword [rdi + 8], xmm0
mov qword [rdi], rax
lea rbx, [rsp + 0x210]
mov rcx, rbx
mov rdx, rdi
mov r8b, 1
call fcn.140019071
mov rax, qword [rdi + 0x30]
mov qword [rsp + 0x4d0], rax
movdqu xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmm2, xmmword [rdi + 0x20]
movaps xmmword [rsp + 0x4c0], xmm2
movaps xmmword [rsp + 0x4b0], xmm1
movdqa xmmword [rsp + 0x4a0], xmm0
mov esi, dword [rbx + 4]
cmp esi, 2
jne 0x140003902
lea rcx, [rsp + 0x4a0]
call fcn.140016d65
jmp 0x14000396c
lea r15, [rsp + 0x728]
movd xmm8, dword [rsp + 0x210]
movd xmm9, dword [rsp + 0x218]
push 8
pop rcx
call fcn.14000fa49
mov rdi, rax
movabs rax, 0x72657475706d6f43
mov qword [rdi], rax
mov r14, qword [r15 - 8]
movdqu xmm0, xmmword [r15]
movups xmm1, xmmword [r15 + 0x10]
movups xmm2, xmmword [r15 + 0x20]
movaps xmmword [rsp + 0x380], xmm2
movaps xmmword [rsp + 0x370], xmm1
movdqa xmmword [rsp + 0x360], xmm0
cmp r14, 3
jne 0x140007372
xor esi, esi
mov rcx, qword [rsp + 0x828]
mov rdx, qword [rsp + 0x838]
call fcn.140016d27
mov rcx, qword [rsp + 0x828]
mov rdx, qword [rsp + 0x830]
call fcn.140016e91
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x828], rax
mov qword [rsp + 0x830], rsi
mov qword [rsp + 0x838], rsi
lea rcx, [rsp + 0xc0]
and qword [rcx], 0
call sub.IPHLPAPI.DLL_GetIfTable2
test eax, eax
jne 0x1400047ea
lea r8, [rsp + 0x7f0]
mov rax, qword [r8 - 0x20]
mov rcx, qword [r8 - 0x18]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [r8 - 8]
lea rdi, [rsp + 0x4a0]
mov qword [rdi], rax
add rax, 0x10
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rcx
mov word [rdi + 0x18], dx
mov qword [rdi + 0x20], r8
mov rcx, rdi
call fcn.140016fb4
test rax, rax
je 0x140003a27
mov byte [rdx + 0x6e], 0
jmp 0x140003a14
call fcn.14001829d
lea rcx, [rsp + 0x4c0]
movdqa xmmword [rcx - 0x20], xmm7
movdqa xmmword [rcx - 0x10], xmm6
mov qword [rcx], rax
mov qword [rcx + 8], rdx
lea rax, [rsp + 0x210]
mov qword [rax], 8
pxor xmm0, xmm0
movdqu xmmword [rax + 8], xmm0
mov r13, qword [rsp + 0xc0]
mov r8d, dword [r13]
add r13, 8
push 0xa
pop r12
pcmpeqd xmm6, xmm6
xor r9d, r9d
mov qword [rsp + 0xa0], r13
mov qword [rsp + 0x90], r8
cmp r9, r8
je 0x140003d91
mov r14, r9
inc r9
imul rsi, r14, 0x548
cmp qword [r13 + rsi + 0x4a8], 0
jne 0x140003ab4
cmp qword [r13 + rsi + 0x4b0], 0
je 0x140003a88
cmp dword [r13 + rsi + 0x48c], 2
je 0x140003a88
cmp dword [r13 + rsi + 0x420], 0
je 0x140003a88
mov qword [rsp + 0x78], r9
push 0x14
pop rcx
push 2
pop rdx
call fcn.140012a3e
mov r15, rax
mov eax, dword [r13 + rsi + 0x10]
movzx ecx, byte [r13 + rsi + 0x14]
movzx edx, byte [r13 + rsi + 0x15]
movzx r8d, byte [r13 + rsi + 0x16]
movzx r9d, byte [r13 + rsi + 0x17]
movzx r10d, byte [r13 + rsi + 0x18]
movzx r11d, byte [r13 + rsi + 0x19]
movzx edi, byte [r13 + rsi + 0x1a]
movzx esi, byte [r13 + rsi + 0x1b]
mov dword [r15], eax
mov word [r15 + 4], cx
mov word [r15 + 6], dx
mov word [r15 + 8], r8w
mov word [r15 + 0xa], r9w
mov word [r15 + 0xc], r10w
mov word [r15 + 0xe], r11w
mov word [r15 + 0x10], di
mov word [r15 + 0x12], si
mov rcx, r12
xor edx, edx
call fcn.14000f33c
mov rbx, rax
mov qword [rsp + 0x88], rdx
movups xmm0, xmmword [r15]
movups xmmword [rax], xmm0
mov qword [rsp + 0x80], r15
mov eax, dword [r15 + 0x10]
mov dword [rbx + 0x10], eax
mov rcx, qword [rsp + 0x4c0]
mov rdx, qword [rsp + 0x4c8]
mov r8, rbx
mov r9, r12
call fcn.1400168d3
mov r13, qword [rsp + 0x4a0]
mov r15, qword [rsp + 0x4a8]
mov rsi, r15
and rsi, rax
mov qword [rsp + 0xa8], rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor eax, eax
mov qword [rsp + 0x70], rax
movdqu xmm8, xmmword [r13 + rsi]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0x360], ax
lea rcx, [rsp + 0x360]
call fcn.140013230
test rax, rax
je 0x140003c15
add rdx, rsi
and rdx, r15
shl rdx, 5
mov rdi, r13
sub rdi, rdx
mov rcx, qword [rdi - 0x20]
mov rdx, qword [rdi - 0x10]
mov r8, rbx
mov r9, r12
call fcn.1400169ff
test al, al
je 0x140003bda
jmp 0x140003c44
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x140003cf9
mov rax, qword [rsp + 0x70]
add rsi, rax
add rsi, 0x10
add rax, 0x10
mov qword [rsp + 0x70], rax
and rsi, r15
jmp 0x140003bbe
mov rcx, rbx
mov rdx, qword [rsp + 0x88]
call fcn.14000fafd
mov eax, dword [rdi - 8]
inc eax
mov dword [rdi - 8], eax
cmp eax, 1
mov r13, qword [rsp + 0xa0]
jle 0x140003c8b
mov rcx, qword [rsp + 0x80]
mov rdx, r12
call fcn.14000fafd
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x78]
jmp 0x140003a88
mov rdx, qword [rsp + 0x220]
cmp rdx, qword [rsp + 0x218]
jne 0x140003cb2
lea rcx, [rsp + 0x210]
call fcn.140016c84
mov rdx, qword [rsp + 0x220]
mov r8, qword [rsp + 0x90]
mov r9, qword [rsp + 0x78]
mov rax, qword [rsp + 0x210]
mov rcx, rdx
shl rcx, 5
mov dword [rax + rcx], r14d
mov r10, qword [rsp + 0x80]
mov qword [rax + rcx + 8], r10
mov qword [rax + rcx + 0x10], r12
mov qword [rax + rcx + 0x18], r12
inc rdx
mov qword [rsp + 0x220], rdx
jmp 0x140003a88
cmp qword [rsp + 0x4b0], 0
je 0x140003d67
mov rcx, r13
mov rdx, r15
mov r8, qword [rsp + 0xa8]
call fcn.140016fd4
mov rcx, qword [rsp + 0x4a0]
shl rax, 5
mov rdi, rcx
and dl, 1
neg dl
movsx rdx, dl
add qword [rsp + 0x4b0], rdx
sub rdi, rax
neg rax
mov qword [rcx + rax - 0x20], rbx
mov rax, qword [rsp + 0x88]
mov qword [rdi - 0x18], rax
mov qword [rdi - 0x10], 0xa
and dword [rdi - 8], 0
inc qword [rsp + 0x4b8]
jmp 0x140003c54
lea rcx, [rsp + 0x4a0]
lea rdx, [rsp + 0x4c0]
call fcn.140017501
mov r13, qword [rsp + 0x4a0]
mov r15, qword [rsp + 0x4a8]
jmp 0x140003d04
mov rcx, qword [rsp + 0x210]
mov rax, qword [rsp + 0x218]
mov qword [rsp + 0xb0], rax
mov rdi, qword [rsp + 0x220]
shl rdi, 5
add rdi, rcx
pcmpeqd xmm6, xmm6
mov qword [rsp + 0x198], rcx
mov rbx, rcx
mov qword [rsp + 0x90], rdi
mov rsi, rbx
cmp rbx, rdi
je 0x140004347
lea rbx, [rsi + 0x20]
mov r15, qword [rsi + 8]
test r15, r15
je 0x140004344
mov r12, qword [rsi + 0x10]
mov edx, dword [rsi]
cmp qword [rsp + 0x4b8], 0
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], r12
je 0x140003f13
mov qword [rsp + 0x88], rdx
mov rdi, qword [rsi + 0x18]
mov rcx, qword [rsp + 0x4c0]
mov rdx, qword [rsp + 0x4c8]
mov r8, r15
mov r9, rdi
call fcn.1400168d3
mov rbx, qword [rsp + 0x4a0]
mov r14, qword [rsp + 0x4a8]
mov r12, r14
and r12, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor eax, eax
mov qword [rsp + 0x80], rax
movdqu xmm8, xmmword [rbx + r12]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0x360], ax
lea rcx, [rsp + 0x360]
call fcn.140013230
test rax, rax
je 0x140003ebe
add rdx, r12
and rdx, r14
shl rdx, 5
mov rsi, rbx
sub rsi, rdx
mov r8, qword [rsi - 0x20]
mov r9, qword [rsi - 0x10]
mov rcx, r15
mov rdx, rdi
call fcn.1400169ff
test al, al
je 0x140003e83
jmp 0x140003ef3
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x140004190
mov rax, qword [rsp + 0x80]
add r12, rax
add r12, 0x10
add rax, 0x10
mov qword [rsp + 0x80], rax
and r12, r14
jmp 0x140003e68
add rsi, 0xffffffffffffffe0
mov rdi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x88]
jmp 0x140003f15
xor esi, esi
lea rax, [rsi + 0x18]
test rsi, rsi
lea rcx, [0x140023590]
cmove rax, rcx
cmp dword [rax], 1
jg 0x140004180
imul rsi, rdx, 0x548
lea rax, [rsi + r13]
lea rdx, [rsi + r13]
add rdx, 0x1c
xor r8d, r8d
mov qword [rsp + 0x98], rax
cmp r8, 0x101
je 0x140003f64
cmp word [rdx + r8*2], 0
je 0x140003f6c
inc r8
jmp 0x140003f4e
mov r8d, 0x101
jmp 0x140003f79
cmp r8, 0x102
jae 0x1400073fa
lea rcx, [rsp + 0x360]
call fcn.140007d61
mov r14, qword [rsp + 0x360]
test r14, r14
je 0x140004180
mov qword [rsp + 0x88], rsi
mov rax, qword [rsp + 0x368]
mov qword [rsp + 0xa8], rax
mov rdi, qword [rsp + 0x370]
mov rcx, qword [rsp + 0x7f0]
mov rdx, qword [rsp + 0x7f8]
mov r8, r14
mov r9, rdi
call fcn.140016969
mov r12, qword [rsp + 0x7d0]
mov rbx, qword [rsp + 0x7d8]
mov rsi, rbx
and rsi, rax
mov qword [rsp + 0xb8], rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor eax, eax
mov qword [rsp + 0x80], rax
movdqu xmm8, xmmword [r12 + rsi]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0x360], ax
lea rcx, [rsp + 0x360]
call fcn.140013230
test rax, rax
je 0x14000406b
add rdx, rsi
and rdx, rbx
neg rdx
imul r13, rdx, 0x88
mov rcx, qword [r12 + r13 - 0x88]
mov rdx, qword [r12 + r13 - 0x78]
mov r8, r14
mov r9, rdi
call fcn.140008a60
test al, al
je 0x14000402b
jmp 0x1400040a0
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x140004197
mov rax, qword [rsp + 0x80]
add rsi, rax
add rsi, 0x10
add rax, 0x10
mov qword [rsp + 0x80], rax
and rsi, rbx
jmp 0x140004010
add r12, r13
mov rax, qword [r12 - 0x68]
mov rcx, qword [r12 - 0x58]
mov qword [r12 - 0x60], rax
mov r13, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0x88]
mov rax, qword [r13 + rdx + 0x500]
mov qword [r12 - 0x68], rax
mov qword [r12 - 0x50], rcx
mov rax, qword [r13 + rdx + 0x4b8]
mov qword [r12 - 0x58], rax
mov rax, qword [r12 - 0x48]
mov qword [r12 - 0x40], rax
mov rax, qword [r13 + rdx + 0x4c0]
add rax, qword [r13 + rdx + 0x4c8]
push 0xffffffffffffffff
pop rcx
cmovb rax, rcx
mov qword [r12 - 0x48], rax
mov rax, qword [r12 - 0x38]
mov qword [r12 - 0x30], rax
mov rax, qword [r13 + rdx + 0x508]
add rax, qword [r13 + rdx + 0x510]
cmovb rax, rcx
mov qword [r12 - 0x38], rax
mov rax, qword [r12 - 0x28]
mov qword [r12 - 0x20], rax
mov rax, qword [r13 + rdx + 0x4d8]
mov qword [r12 - 0x28], rax
mov rax, qword [r12 - 0x18]
mov qword [r12 - 0x10], rax
mov rax, qword [r13 + rdx + 0x520]
mov qword [r12 - 0x18], rax
mov byte [r12 - 2], 1
mov rcx, r14
mov rdx, qword [rsp + 0xa8]
call fcn.140007b8f
mov rdi, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x70]
mov r12, qword [rsp + 0x78]
mov rcx, r15
mov rdx, r12
call fcn.14000fafd
jmp 0x140003dcf
xor esi, esi
jmp 0x140003ef7
cmp qword [rsp + 0x7e0], 0
je 0x14000431a
mov r13, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x88]
mov rdx, qword [r13 + rcx + 0x4c0]
add rdx, qword [r13 + rcx + 0x4c8]
mov rax, qword [r13 + rcx + 0x4b8]
mov qword [rsp + 0x80], rax
push 0xffffffffffffffff
pop rax
cmovb rdx, rax
mov qword [rsp + 0x190], rdx
mov rsi, qword [r13 + rcx + 0x508]
add rsi, qword [r13 + rcx + 0x510]
cmovb rsi, rax
mov rax, qword [rsp + 0x98]
mov rax, qword [rax]
mov qword [rsp + 0x350], rax
mov rax, qword [r13 + rcx + 0x500]
mov qword [rsp + 0x188], rax
mov rax, qword [r13 + rcx + 0x4d8]
mov qword [rsp + 0x98], rax
mov rax, qword [r13 + rcx + 0x520]
mov qword [rsp + 0x88], rax
mov rcx, r12
mov rdx, rbx
mov r8, qword [rsp + 0xb8]
call fcn.140016fd4
mov rcx, qword [rsp + 0x7d0]
neg rax
and dl, 1
neg dl
movsx rdx, dl
add qword [rsp + 0x7e0], rdx
imul rax, rax, 0x88
mov qword [rcx + rax - 0x88], r14
mov rdx, qword [rsp + 0xa8]
mov qword [rcx + rax - 0x80], rdx
mov qword [rcx + rax - 0x78], rdi
mov rdx, qword [rsp + 0x350]
mov qword [rcx + rax - 0x70], rdx
mov rdx, qword [rsp + 0x188]
mov qword [rcx + rax - 0x68], rdx
mov qword [rcx + rax - 0x60], rdx
mov rdx, qword [rsp + 0x80]
mov qword [rcx + rax - 0x58], rdx
mov qword [rcx + rax - 0x50], rdx
mov rdx, qword [rsp + 0x190]
mov qword [rcx + rax - 0x48], rdx
mov qword [rcx + rax - 0x40], rdx
mov qword [rcx + rax - 0x38], rsi
mov qword [rcx + rax - 0x30], rsi
mov rdx, qword [rsp + 0x98]
mov qword [rcx + rax - 0x28], rdx
mov qword [rcx + rax - 0x20], rdx
mov rdx, qword [rsp + 0x88]
mov qword [rcx + rax - 0x18], rdx
mov qword [rcx + rax - 0x10], rdx
and dword [rcx + rax - 8], 0
and word [rcx + rax - 4], 0
mov byte [rcx + rax - 2], 1
inc qword [rsp + 0x7e8]
jmp 0x14000416e
lea rcx, [rsp + 0x7d0]
lea rdx, [rsp + 0x7f0]
call fcn.14001708d
mov r12, qword [rsp + 0x7d0]
mov rbx, qword [rsp + 0x7d8]
jmp 0x1400041a6
mov rsi, rbx
sub rdi, rsi
shr rdi, 5
add rsi, 0x10
sub rdi, 1
jb 0x14000436a
mov rcx, qword [rsi - 8]
mov rdx, qword [rsi]
call fcn.14000fafd
add rsi, 0x20
jmp 0x140004352
mov r8, qword [rsp + 0xb0]
test r8, r8
je 0x14000438b
shl r8, 5
push 8
pop rdx
mov rcx, qword [rsp + 0x198]
call fcn.14000c034
mov rcx, qword [rsp + 0xc0]
call sub.IPHLPAPI.DLL_FreeMibTable
mov rdx, qword [rsp + 0x4a8]
test rdx, rdx
je 0x14000448f
mov rcx, qword [rsp + 0x4a0]
mov rax, qword [rsp + 0x4b8]
test rax, rax
je 0x140004486
add rdx, rcx
inc rdx
movdqa xmm0, xmmword [rcx]
pmovmskb r8d, xmm0
not r8d
lea rdi, [rsp + 0x378]
mov qword [rdi - 0x18], rcx
add rcx, 0x10
mov qword [rdi - 0x10], rcx
mov qword [rdi - 8], rdx
mov word [rdi], r8w
mov qword [rdi + 8], rax
push 1
pop rsi
test rsi, rsi
je 0x140004476
mov rcx, rdi
call fcn.140013230
cmp rax, 1
je 0x14000443e
mov rax, qword [rsp + 0x368]
movdqa xmm0, xmmword [rax]
pmovmskb ecx, xmm0
not ecx
mov word [rsp + 0x378], cx
add qword [rsp + 0x360], 0xfffffffffffffe00
add rax, 0x10
mov qword [rsp + 0x368], rax
jmp 0x1400043fc
shl rdx, 5
mov rax, qword [rsp + 0x360]
mov rsi, qword [rsp + 0x380]
mov rcx, rax
sub rcx, rdx
dec rsi
mov qword [rsp + 0x380], rsi
mov rcx, qword [rcx - 0x20]
neg rdx
mov rdx, qword [rax + rdx - 0x18]
call fcn.14000fafd
jmp 0x1400043f7
mov rcx, qword [rsp + 0x4a0]
mov rdx, qword [rsp + 0x4a8]
push 0x20
pop r8
call fcn.140016ecd
mov rax, qword [rsp + 0x7d0]
mov rcx, qword [rsp + 0x7d8]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [rsp + 0x7e8]
lea rdi, [rsp + 0x4a0]
mov qword [rdi], rax
add rax, 0x10
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rcx
mov word [rdi + 0x18], dx
mov qword [rdi + 0x20], r8
mov esi, 0x88
mov rcx, rdi
call fcn.140016838
test rax, rax
je 0x140004523
mov rbx, rax
cmp byte [rax - 2], 0
jne 0x1400044db
mov rax, qword [rsp + 0x7d0]
sub rax, rbx
cqo
idiv rsi
lea rcx, [rsp + 0x7d0]
mov rdx, rax
call fcn.140018229
mov rcx, qword [rbx - 0x88]
mov rdx, qword [rbx - 0x80]
call fcn.140007b8f
jmp 0x1400044db
and dword [rsp + 0x100], 0
lea rsi, [rsp + 0x1a0]
mov dword [rsi], 0x3c00
push 3
pop r14
push 0xe
pop rdi
sub r14d, 1
jb 0x140004605
mov ecx, dword [rsp + 0x1a0]
call sub.msvcrt.dll_malloc
test rax, rax
je 0x1400045ac
mov rbx, rax
mov qword [rsp + 0x20], rsi
xor ecx, ecx
mov edx, edi
xor r8d, r8d
mov r9, rax
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
mov dword [rsp + 0x100], eax
cmp eax, 0x6f
jne 0x140004588
mov rcx, rbx
call sub.msvcrt.dll_free
jmp 0x140004540
test eax, eax
jne 0x1400045fd
mov qword [rsp + 0x368], rbx
mov qword [rsp + 0x370], rbx
and qword [rsp + 0x360], 0
xor ecx, ecx
jmp 0x140004665
push 0x32
pop rcx
call fcn.14000fa49
mov rcx, rax
movups xmm0, xmmword [str.failed_to_allocate_memory_for_IP_ADAPTER_ADDRESSES]
movups xmmword [rax], xmm0
movups xmm0, xmmword [0x140023730]
movups xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [0x140023740]
movdqu xmmword [rax + 0x20], xmm0
mov word [rax + 0x30], 0x5345
mov qword [rsp + 0x360], rax
mov qword [rsp + 0x368], rdx
mov qword [rsp + 0x370], 0x32
jmp 0x140004665
mov rcx, rbx
call sub.msvcrt.dll_free
lea rax, [rsp + 0x100]
mov qword [rsp + 0x210], rax
lea rax, str.GetAdaptersAddresses___failed_with_code
lea rdx, [rsp + 0x4a0]
mov qword [rdx], rax
push 1
pop rax
mov qword [rdx + 8], rax
and qword [rdx + 0x20], 0
lea rcx, [0x14000858d]
mov qword [rsp + 0x218], rcx
lea rcx, [rsp + 0x210]
mov qword [rdx + 0x10], rcx
mov qword [rdx + 0x18], rax
lea rdi, [rsp + 0x360]
mov rcx, rdi
call fcn.140012762
mov rcx, qword [rdi]
test rcx, rcx
je 0x14000467c
mov rdx, qword [rsp + 0x368]
call fcn.140007b8f
jmp 0x1400047ea
movdqu xmm0, xmmword [rsp + 0x368]
lea rax, [rsp + 0x210]
movdqu xmmword [rax], xmm0
lea r14, [rsp + 0x100]
pcmpeqd xmm6, xmm6
lea rcx, [rsp + 0x4a0]
lea rdx, [rsp + 0x210]
call fcn.140018c4d
mov r15, qword [rsp + 0x4a0]
test r15, r15
je 0x1400047dd
mov rax, qword [rsp + 0x4a8]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x7e8], 0
je 0x1400047cb
mov r13, qword [rsp + 0x4b0]
mov rcx, qword [rsp + 0x7f0]
mov rdx, qword [rsp + 0x7f8]
mov r8, r15
mov r9, r13
call fcn.140016969
mov rdi, qword [rsp + 0x7d0]
mov rbx, qword [rsp + 0x7d8]
mov rsi, rbx
and rsi, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor eax, eax
mov qword [rsp + 0x78], rax
movdqu xmm8, xmmword [rdi + rsi]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0x100], ax
mov rcx, r14
call fcn.140013230
test rax, rax
je 0x14000478b
add rdx, rsi
and rdx, rbx
neg rdx
imul r12, rdx, 0x88
mov r8, qword [rdi + r12 - 0x88]
mov r9, qword [rdi + r12 - 0x78]
mov rcx, r15
mov rdx, r13
call fcn.140008a60
test al, al
je 0x140004750
jmp 0x1400047b3
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x1400047cb
mov rax, qword [rsp + 0x78]
add rsi, rax
add rsi, 0x10
add rax, 0x10
mov qword [rsp + 0x78], rax
and rsi, rbx
jmp 0x140004735
add rdi, r12
lea rcx, [rsp + 0x4b8]
movzx eax, word [rcx + 4]
mov word [rdi - 4], ax
mov eax, dword [rcx]
mov dword [rdi - 8], eax
mov rcx, r15
mov rdx, qword [rsp + 0x70]
call fcn.140007b8f
jmp 0x14000469d
mov rcx, qword [rsp + 0x210]
call sub.msvcrt.dll_free
mov byte [rsp + 0x2a2], 1
mov word [rsp + 0x2a0], 0x101
call fcn.140011a18
shl rdx, 0x20
mov eax, eax
or rax, rdx
movabs rcx, 0x19db1ded53e8000
cmp rax, rcx
jge 0x14000481d
xor eax, eax
jmp 0x140004834
movabs rcx, 0xfe624e212ac18000
add rax, rcx
mov ecx, 0x989680
xor edx, edx
div rcx
mov qword [rsp + 0x1e0], rax
mov r14d, 0x80000
push 5
pop rbx
lea r13, [rsp + 0x2c0]
mov rcx, r14
xor edx, edx
call fcn.140007ba3
mov r15, rax
mov rdi, rdx
and dword [rsp + 0x2c0], 0
mov ecx, ebx
mov rdx, rax
mov r8d, r14d
mov r9, r13
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
jne 0x1400048a1
mov eax, dword [rsp + 0x2c0]
test eax, eax
je 0x140004891
add eax, 0x2800
mov r14, rax
jmp 0x140004894
add r14, r14
mov rcx, r15
mov rdx, rdi
call fcn.140007b8f
jmp 0x14000484d
push 8
pop rcx
mov edx, 0xfa0
call fcn.1400078d9
test rax, rax
je 0x1400073fa
lea rbx, [rsp + 0x100]
mov qword [rbx], rax
mov qword [rbx + 8], 0x1f4
and qword [rbx + 0x10], 0
xor edx, edx
xor esi, esi
cmp rdx, qword [rsp + 0x108]
jne 0x1400048f5
mov rcx, rbx
call fcn.140009d67
mov rax, qword [rsp + 0x100]
mov rdx, qword [rsp + 0x110]
lea rcx, [r15 + rsi]
mov qword [rax + rdx*8], rcx
mov rdx, qword [rsp + 0x110]
inc rdx
mov qword [rsp + 0x110], rdx
mov ecx, dword [rcx]
add rsi, rcx
test rcx, rcx
jne 0x1400048d3
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x78], rdi
lea rsi, [rsp + 0x720]
lea rax, [rsp + 0x7a0]
mov qword [rsi], rax
lea rcx, [rsp + 0x870]
xor edx, edx
call fcn.1400183e9
mov rax, qword [rsp + 0x8f0]
lea rcx, [rsp + 0x300]
mov qword [rcx], rax
mov r15, qword [rsp + 0x110]
mov qword [rsp + 0x4b0], r15
movdqu xmm0, xmmword [rsp + 0x100]
movdqa xmmword [rsp + 0x4a0], xmm0
mov qword [rsp + 0xc0], 8
pxor xmm0, xmm0
movdqu xmmword [rsp + 0xc8], xmm0
mov qword [rsp + 0x4b8], rsi
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x4c0], rax
mov qword [rsp + 0x4c8], rcx
lea rax, [rsp + 0x1e0]
mov qword [rsp + 0x4d0], rax
mov r14, qword [rsp + 0x4a8]
cmp r14, r15
jb 0x1400073fa
lea rsi, [rsp + 0x4b8]
mov r12, qword [rsi - 0x18]
mov rcx, r15
call fcn.140016899
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], 1
lea rbx, [rsp + 0x210]
mov rcx, rbx
mov rdx, r15
xor r8d, r8d
mov r9, rax
call fcn.1400146b5
test r14, r14
je 0x140004a34
shl r14, 3
push 8
pop rdx
mov rcx, r12
mov r8, r14
call fcn.14000c034
mov rax, qword [rsp + 0x220]
xor edx, edx
sub rax, 1
jb 0x140004a56
mov rbx, qword [rbx]
test rbx, rbx
je 0x140004a56
add rdx, qword [rbx + 0x10]
add rbx, 0x18
jmp 0x140004a3e
lea rdi, [rsp + 0xc0]
mov rcx, rdi
call fcn.140016a27
mov rax, qword [rsp + 0x220]
lea rbx, [rsp + 0x360]
mov qword [rbx + 0x10], rax
movdqu xmm0, xmmword [rsp + 0x210]
movdqa xmmword [rbx], xmm0
lea r14, [rsp + 0x4a0]
mov rcx, rbx
call fcn.14001376b
test rax, rax
je 0x140004b35
mov r15, qword [rax]
movdqu xmm0, xmmword [rax + 8]
movdqa xmmword [rsp + 0x1a0], xmm0
mov rcx, rax
call fcn.1400146ab
test r15, r15
je 0x140004b35
mov qword [rsp + 0x4a0], r15
movdqa xmm0, xmmword [rsp + 0x1a0]
lea rax, [rsp + 0x4a8]
movdqu xmmword [rax], xmm0
mov r12, qword [rsp + 0x4b0]
mov rcx, rdi
mov rdx, r12
call fcn.140016a27
mov rsi, qword [rsp + 0xd0]
imul rcx, rsi, 0x150
add rcx, qword [rsp + 0xc0]
imul r8, r12, 0x150
mov rdx, r15
call sub.msvcrt.dll_memcpy
add rsi, r12
mov qword [rsp + 0xd0], rsi
and qword [rsp + 0x4b0], 0
mov rcx, r14
call fcn.140012268
jmp 0x140004a8f
lea rcx, [rsp + 0x360]
call fcn.140014679
mov r14, qword [rsp + 0xc0]
imul rcx, qword [rsp + 0xd0], 0x150
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x90], rax
lea rax, [r14 + rcx]
mov qword [rsp + 0xa0], rax
lea r15, [rsp + 0x210]
lea rsi, [rsp + 0x4a0]
mov qword [rsp + 0x88], r14
test rcx, rcx
je 0x140004df5
mov r13, qword [r14]
cmp r13, 2
je 0x140004de6
mov qword [rsp + 0x70], rcx
lea r12, [r14 + 0xc8]
mov rbx, qword [r14 + 0xc0]
lea rdx, [r14 + 8]
mov r8d, 0xb8
lea rcx, [rsp + 0x360]
call sub.msvcrt.dll_memcpy
mov r8d, 0x88
mov rcx, r15
mov rdx, r12
call sub.msvcrt.dll_memcpy
mov qword [rsp + 0x1a0], rbx
mov rcx, qword [rsp + 0x7c0]
mov rdx, qword [rsp + 0x7c8]
mov r8, rbx
call fcn.1400131b5
mov r12, rax
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0xc0], rax
cmp qword [rsp + 0x7b0], 0
je 0x140004dcc
mov qword [rsp + 0x4a0], rdi
lea rax, [rsp + 0x7a0]
mov qword [rsp + 0x4a8], rax
mov rcx, qword [rsp + 0x7a0]
mov rdx, qword [rsp + 0x7a8]
lea rax, [0x140017af8]
mov qword [rsp + 0x20], rax
mov r8, r12
mov r9, rsi
call fcn.140017994
test rax, rax
je 0x140004d12
mov rax, qword [rsp + 0x1a0]
mov rcx, qword [rsp + 0x7a0]
movzx r8d, byte [rcx + rdx]
and r8d, 1
sub qword [rsp + 0x7b0], r8
shr r12, 0x39
lea r8, [rdx - 0x10]
and r8, qword [rsp + 0x7a8]
mov byte [rcx + rdx], r12b
mov byte [r8 + rcx + 0x10], r12b
inc qword [rsp + 0x7b8]
mov rsi, qword [rsp + 0x7a0]
neg rdx
imul rdi, rdx, 0x158
lea r12, [rsi + rdi]
add r12, 0xfffffffffffffeb8
mov qword [r12 - 0x10], rax
mov qword [r12 - 8], r13
mov r8d, 0xb8
mov rcx, r12
lea rdx, [rsp + 0x360]
call sub.msvcrt.dll_memcpy
mov qword [r12 + 0xb8], rbx
lea rcx, [rsi + rdi]
add rcx, 0xffffffffffffff78
mov r8d, 0x88
mov rdx, r15
call sub.msvcrt.dll_memcpy
lea rsi, [rsp + 0x4a0]
jmp 0x140004da4
mov rax, rsi
mov rsi, qword [rsp + 0x7a0]
neg rdx
imul rdi, rdx, 0x158
lea r12, [rsi + rdi]
add r12, 0xfffffffffffffeb0
mov r8d, 0x150
mov rcx, rax
mov rdx, r12
call sub.msvcrt.dll_memcpy
mov qword [r12], r13
lea r12, [rsi + rdi]
add r12, 0xfffffffffffffeb8
mov r8d, 0xb8
mov rcx, r12
lea rdx, [rsp + 0x360]
call sub.msvcrt.dll_memcpy
mov qword [r12 + 0xb8], rbx
lea rcx, [rsi + rdi]
add rcx, 0xffffffffffffff78
mov r8d, 0x88
mov rdx, r15
call sub.msvcrt.dll_memcpy
cmp qword [rsp + 0x4a0], 2
lea rsi, [rsp + 0x4a0]
je 0x140004da4
mov rcx, rsi
call fcn.1400122d3
add r14, 0x150
mov rcx, qword [rsp + 0x70]
add rcx, 0xfffffffffffffeb0
lea r13, [rsp + 0x2c0]
lea rdi, [rsp + 0xc0]
jmp 0x140004b8a
lea rcx, [rsp + 0x7a0]
lea rdx, [rsp + 0x7c0]
call fcn.140017b1e
jmp 0x140004c1d
add r14, 0x150
lea r13, [rsp + 0x2c0]
mov rax, qword [rsp + 0xa0]
sub rax, r14
mov ecx, 0x150
xor edx, edx
div rcx
mov rcx, r14
mov rdx, rax
call fcn.1400122a9
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rsp + 0x90]
call fcn.140012292
mov rax, qword [rsp + 0x7a0]
mov rcx, qword [rsp + 0x7a8]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [rsp + 0x7b8]
lea rbx, [rsp + 0x4a0]
mov qword [rbx], rax
add rax, 0x10
mov qword [rbx + 8], rax
mov qword [rbx + 0x10], rcx
mov word [rbx + 0x18], dx
mov qword [rbx + 0x20], r8
mov esi, 0x158
mov rcx, rbx
call fcn.140016f53
test rax, rax
je 0x140004ec1
mov r14, rax
cmp byte [rax - 4], 0
mov byte [rax - 4], 0
jne 0x140004e76
mov rax, qword [rsp + 0x7a0]
sub rax, r14
cqo
idiv rsi
lea rcx, [rsp + 0x7a0]
mov rdx, rax
call fcn.140018229
add r14, 0xfffffffffffffeb0
mov rcx, r14
call fcn.1400122d3
jmp 0x140004e76
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
call fcn.140007b8f
call sub.KERNEL32.dll_GetLogicalDrives
mov dword [rsp + 0x1a0], eax
test eax, eax
je 0x140005088
lea r13, [rsp + 0xc8]
mov qword [r13 - 8], 8
pxor xmm0, xmm0
movdqu xmmword [r13], xmm0
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x4a0], rax
movabs rax, 0x2000000000
mov qword [rsp + 0x4a8], rax
push 0x20
pop rdi
mov rcx, rdi
call fcn.140016899
and dword [rsp + 0x28], 0
mov qword [rsp + 0x38], rbx
mov dword [rsp + 0x30], 0x20
mov qword [rsp + 0x20], 1
xor ebx, ebx
mov rcx, r15
mov rdx, rdi
xor r8d, r8d
mov r9, rax
call fcn.140013799
mov rax, qword [rsp + 0x220]
sub rax, 1
jb 0x140004f7c
mov r15, qword [r15]
test r15, r15
je 0x140004f7c
add rbx, qword [r15 + 0x10]
add r15, 0x18
jmp 0x140004f64
lea rdi, [rsp + 0xc0]
mov rcx, rdi
mov rdx, rbx
call fcn.140016a5e
mov rax, qword [rsp + 0x220]
lea rbx, [rsp + 0x360]
mov qword [rbx + 0x10], rax
movups xmm0, xmmword [rsp + 0x210]
movaps xmmword [rbx], xmm0
lea r14, [rsp + 0x4a0]
mov rcx, rbx
call fcn.14001376b
test rax, rax
je 0x14000505a
mov r15, qword [rax]
movups xmm0, xmmword [rax + 8]
movaps xmmword [rsp + 0x100], xmm0
mov rcx, rax
call fcn.1400146ab
test r15, r15
je 0x14000505a
mov qword [rsp + 0x4a0], r15
movdqa xmm0, xmmword [rsp + 0x100]
lea rax, [rsp + 0x4a8]
movdqu xmmword [rax], xmm0
mov r12, qword [rsp + 0x4b0]
mov rcx, rdi
mov rdx, r12
call fcn.140016a5e
mov rsi, qword [rsp + 0xd0]
imul rcx, rsi, 0x90
add rcx, qword [rsp + 0xc0]
imul r8, r12, 0x90
mov rdx, r15
call sub.msvcrt.dll_memcpy
add rsi, r12
mov qword [rsp + 0xd0], rsi
and qword [rsp + 0x4b0], 0
mov rcx, r14
call fcn.1400121ce
jmp 0x140004fb6
lea rcx, [rsp + 0x360]
call fcn.140013739
mov rsi, qword [rsp + 0xc0]
movdqu xmm0, xmmword [r13]
movdqa xmmword [rsp + 0x4a0], xmm0
lea r13, [rsp + 0x2c0]
jmp 0x140005098
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x4a0], xmm0
push 8
pop rsi
lea rcx, [rsp + 0x840]
call fcn.1400121ce
mov qword [rsp + 0x840], rsi
lea rax, [rsp + 0x4d0]
movdqa xmm0, xmmword [rax - 0x30]
movdqu xmmword [rsp + 0x848], xmm0
lea rbx, [rsp + 0x1a0]
mov qword [rbx], 8
pxor xmm6, xmm6
lea rax, [rsp + 0xae0]
and dword [rax], 0
movdqu xmmword [rbx + 8], xmm6
lea r15, [rsp + 0x100]
lea r12, [rsp + 0x360]
and qword [rsp + 0x1e0], 0
and dword [rsp + 0x2e0], 0
and dword [rsp + 0x6e0], 0
lea rax, [rsp + 0xae0]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x6e0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x2e0]
mov qword [rsp + 0x28], rax
or dword [rsp + 0x20], 0xffffffff
xor ecx, ecx
xor edx, edx
push 2
pop r8
lea r9, [rsp + 0x1e0]
call sub.NETAPI32.dll_NetUserEnum
test eax, eax
je 0x14000515f
cmp eax, 0xea
jne 0x1400054b3
mov dword [rsp + 0x70], eax
mov rdi, qword [rsp + 0x1e0]
mov eax, dword [rsp + 0x2e0]
lea r14, [rdi + rax*8]
cmp rdi, r14
je 0x140005497
mov rsi, rdi
add rdi, 8
cmp qword [rsi], 0
je 0x140005176
and qword [rsp + 0x720], 0
mov rdx, qword [rsi]
xor ecx, ecx
push 0x17
pop r8
lea r9, [rsp + 0x720]
call sub.NETAPI32.dll_NetUserGetInfo
test eax, eax
jne 0x14000547c
mov rax, qword [rsp + 0x720]
mov rdx, qword [rax + 0x20]
mov rcx, r15
call fcn.140012a89
mov rdx, qword [rsp + 0x100]
test rdx, rdx
je 0x14000547c
lea rcx, [rsp + 0x4a0]
call fcn.1400182db
cmp qword [rsp + 0x4a0], 0
je 0x140005214
mov rax, qword [rsp + 0x4b0]
mov qword [rsp + 0xd0], rax
movdqu xmm0, xmmword [rsp + 0x4a0]
movdqa xmmword [rsp + 0xc0], xmm0
jmp 0x140005224
mov rdx, qword [rsi]
lea rcx, [rsp + 0xc0]
call fcn.140011f98
mov rdx, qword [rsi]
and qword [rsp + 0x300], 0
and dword [rsp + 0x2a0], 0
and dword [rsp + 0x2c0], 0
mov qword [rsp + 0x38], r13
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x300]
mov qword [rsp + 0x20], rax
or dword [rsp + 0x28], 0xffffffff
lea rcx, [0x1400236e0]
xor r8d, r8d
push 1
pop r9
call sub.NETAPI32.dll_NetUserGetLocalGroups
test eax, eax
je 0x140005298
lea rax, [rsp + 0x218]
movdqu xmmword [rax], xmm6
mov qword [rsp + 0x210], 8
jmp 0x1400053e6
mov r12d, dword [rsp + 0x2a0]
push 8
pop rcx
mov rax, rcx
test r12, r12
je 0x1400052bd
imul rdx, r12, 0x18
call fcn.1400078d9
test rax, rax
je 0x1400073fa
mov qword [rsp + 0x210], rax
mov qword [rsp + 0x218], r12
and qword [rsp + 0x220], 0
mov rsi, qword [rsp + 0x300]
test rsi, rsi
je 0x140005326
mov ebx, dword [rsp + 0x2a0]
cmp r12d, ebx
jae 0x14000535e
lea rcx, [rsp + 0x210]
xor edx, edx
mov r8, rbx
call fcn.14001306a
movabs rcx, 0x8000000000000001
cmp rax, rcx
jne 0x1400073f7
mov rax, qword [rsp + 0x210]
mov rdx, qword [rsp + 0x220]
jmp 0x14000536d
mov rax, qword [rsp + 0x220]
lea rcx, [rsp + 0x4d0]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x210]
mov qword [rcx], rax
mov rax, qword [rsp + 0x218]
mov qword [rcx + 8], rax
lea r12, [rsp + 0x360]
jmp 0x140005423
mov edx, 0
mov ecx, 0
test rbx, rbx
je 0x1400053c6
mov qword [rsp + 0x78], rdx
imul r15, rdx, 0x18
add r15, rax
xor r13d, r13d
lea r12, [rsp + 0x360]
mov rdx, qword [rsi + r13*8]
mov rcx, r12
call fcn.140011f98
mov rax, qword [rsp + 0x370]
mov qword [r15 + 0x10], rax
movdqu xmm0, xmmword [rsp + 0x360]
movdqu xmmword [r15], xmm0
inc r13
add r15, 0x18
cmp rbx, r13
jne 0x140005384
mov rcx, qword [rsp + 0x78]
add rcx, r13
lea r13, [rsp + 0x2c0]
mov qword [rsp + 0x220], rcx
lea rbx, [rsp + 0x1a0]
lea r15, [rsp + 0x100]
lea r12, [rsp + 0x360]
mov rcx, qword [rsp + 0x300]
mov rax, qword [rsp + 0x220]
lea rdx, [rsp + 0x4d0]
mov qword [rdx + 0x10], rax
mov rax, qword [rsp + 0x210]
mov qword [rdx], rax
mov rax, qword [rsp + 0x218]
mov qword [rdx + 8], rax
test rcx, rcx
je 0x140005423
call sub.NETAPI32.dll_NetApiBufferFree
movups xmm0, xmmword [rsp + 0x100]
movaps xmmword [rsp + 0x4a0], xmm0
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x4b0], rax
and dword [rsp + 0x4e8], 0
mov rax, qword [rsp + 0xd0]
lea rcx, [rsp + 0x4b8]
mov qword [rcx + 0x10], rax
movdqa xmm0, xmmword [rsp + 0xc0]
movdqu xmmword [rcx], xmm0
mov rcx, rbx
lea rdx, [rsp + 0x4a0]
call fcn.1400183a8
mov rcx, qword [rsp + 0x720]
test rcx, rcx
je 0x140005176
call sub.NETAPI32.dll_NetApiBufferFree
jmp 0x140005176
mov rcx, qword [rsp + 0x1e0]
cmp dword [rsp + 0x70], 0xea
jne 0x1400054bb
call fcn.1400182c7
jmp 0x1400050f6
mov rcx, qword [rsp + 0x1e0]
call fcn.1400182c7
lea rcx, [rsp + 0x720]
and dword [rcx], 0
lea rdi, [rsp + 0x300]
and qword [rdi], 0
mov rdx, rdi
call sub.Secur32.dll_LsaEnumerateLogonSessions
mov rcx, qword [rdi]
test eax, eax
jne 0x1400056f4
mov eax, dword [rsp + 0x720]
lea r14, [rcx + rax*8]
lea rdi, [rsp + 0x100]
lea rsi, [rsp + 0x4a0]
pxor xmm6, xmm6
cmp rcx, r14
je 0x1400056ec
lea rbx, [rcx + 8]
and qword [rsp + 0x100], 0
mov rdx, rdi
call sub.Secur32.dll_LsaGetLogonSessionData
mov rcx, qword [rsp + 0x100]
test eax, eax
je 0x14000553d
call fcn.1400182d1
mov rcx, rbx
jmp 0x140005509
test rcx, rcx
je 0x1400055ed
cmp dword [rcx + 0x40], 3
je 0x140005533
movzx r15d, word [rcx + 0x10]
mov rax, qword [rcx + 0x18]
mov qword [rsp + 0x78], rax
mov rdx, qword [rcx + 0x48]
mov rcx, rsi
call fcn.140012a89
mov r13, qword [rsp + 0x4a0]
test r13, r13
je 0x1400056df
mov qword [rsp + 0x80], r15
mov rax, qword [rsp + 0x4a8]
mov qword [rsp + 0x70], rax
mov r15, qword [rsp + 0x4b0]
mov rdx, qword [rsp + 0x1a0]
imul rsi, qword [rsp + 0x1b0], 0x50
test rsi, rsi
je 0x1400055f4
lea r12, [rdx + 0x50]
mov rcx, qword [rdx]
mov rdx, qword [rdx + 0x10]
mov r8, r13
mov r9, r15
call fcn.140008a60
add rsi, 0xffffffffffffffb0
mov rdx, r12
lea r12, [rsp + 0x360]
test al, al
je 0x1400055a5
mov rcx, r13
mov rdx, qword [rsp + 0x70]
call fcn.140007b8f
lea rsi, [rsp + 0x4a0]
jmp 0x1400056df
xor ecx, ecx
jmp 0x140005533
lea rcx, [rsp + 0x360]
mov rdx, r13
call fcn.1400182db
mov rax, qword [rsp + 0x360]
test rax, rax
je 0x140005630
lea rcx, [rsp + 0x368]
movdqu xmm0, xmmword [rcx]
movdqa xmmword [rsp + 0x210], xmm0
lea rsi, [rsp + 0x4a0]
jmp 0x140005680
mov r8, qword [rsp + 0x80]
shr r8d, 1
lea rsi, [rsp + 0x4a0]
mov rcx, rsi
mov rdx, qword [rsp + 0x78]
call fcn.140007d61
mov rax, qword [rsp + 0x4a0]
test rax, rax
je 0x140005674
lea rcx, [rsp + 0x4a8]
movdqu xmm0, xmmword [rcx]
movdqa xmmword [rsp + 0x210], xmm0
jmp 0x140005680
movdqa xmmword [rsp + 0x210], xmm6
push 1
pop rax
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x4a0], r13
mov qword [rsp + 0x4a8], rcx
mov qword [rsp + 0x4b0], r15
lea rcx, [rsp + 0x4c0]
movdqu xmmword [rcx + 0x18], xmm6
and dword [rcx + 0x28], 0
mov qword [rsp + 0x4b8], rax
movdqa xmm0, xmmword [rsp + 0x210]
movdqu xmmword [rcx], xmm0
mov qword [rsp + 0x4d0], 8
lea rcx, [rsp + 0x1a0]
mov rdx, rsi
call fcn.1400183a8
mov rcx, qword [rsp + 0x100]
jmp 0x140005533
mov rcx, qword [rsp + 0x300]
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x4b0], rax
movups xmm0, xmmword [rsp + 0x1a0]
movaps xmmword [rsp + 0x4a0], xmm0
test rcx, rcx
je 0x14000571e
call fcn.14001ec58
mov rcx, qword [rsp + 0x858]
mov rdx, qword [rsp + 0x868]
call fcn.140016df6
mov rcx, qword [rsp + 0x858]
mov rdx, qword [rsp + 0x860]
call fcn.140016eb9
mov rax, qword [rsp + 0x4b0]
lea rcx, [rsp + 0x858]
mov qword [rcx + 0x10], rax
movaps xmm0, xmmword [rsp + 0x4a0]
movups xmmword [rcx], xmm0
mov rax, qword [rsp + 0x760]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x768]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x778]
mov qword [rsp + 0x80], rax
mov rax, qword [rsp + 0x790]
mov qword [rsp + 0xa78], rax
mov rax, qword [rsp + 0x798]
mov qword [rsp + 0xa70], rax
mov rbx, qword [rsp + 0x7a0]
mov rcx, qword [rsp + 0x7a8]
mov rdi, qword [rsp + 0x7b8]
mov rax, qword [rsp + 0x7d0]
mov qword [rsp + 0xa88], rax
mov rax, qword [rsp + 0x7d8]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x7e8]
mov qword [rsp + 0xa80], rax
mov rax, qword [rsp + 0x828]
mov qword [rsp + 0xb8], rax
movdqa xmm0, xmmword [rbx]
pmovmskb esi, xmm0
not esi
mov rax, qword [rsp + 0x830]
mov qword [rsp + 0x350], rax
mov rax, qword [rsp + 0x838]
mov qword [rsp + 0x188], rax
mov rax, qword [rsp + 0x840]
mov qword [rsp + 0x198], rax
mov rax, qword [rsp + 0x848]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x850]
mov qword [rsp + 0x190], rax
mov rax, qword [rsp + 0x858]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x860]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x868]
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0x870]
mov qword [rsp + 0xa90], rax
mov rax, qword [rsp + 0x878]
mov qword [rsp + 0xa98], rax
mov rax, qword [rsp + 0x888]
mov qword [rsp + 0xaa8], rax
mov rax, qword [rsp + 0x890]
mov qword [rsp + 0xab0], rax
mov rax, qword [rsp + 0x8a0]
mov qword [rsp + 0xab8], rax
mov rax, qword [rsp + 0x8a8]
mov qword [rsp + 0xac0], rax
mov rax, qword [rsp + 0x8b8]
mov qword [rsp + 0xaa0], rax
mov rax, qword [rsp + 0x8c0]
mov qword [rsp + 0xa68], rax
mov rax, qword [rsp + 0x8e0]
mov qword [rsp + 0xad0], rax
mov rax, qword [rsp + 0x8e8]
mov qword [rsp + 0xad8], rax
mov rax, qword [rsp + 0x8f0]
mov qword [rsp + 0xac8], rax
mov qword [rsp + 0x78], rcx
lea r15, [rcx + rbx + 1]
lea r13, [rbx + 0x10]
push 0x38
pop rcx
push 8
pop rdx
call fcn.140001c52
mov r14, rax
mov qword [rax], rbx
mov qword [rsp + 0xa48], r13
mov qword [rax + 8], r13
mov qword [rsp + 0xa50], r15
mov qword [rax + 0x10], r15
mov word [rax + 0x18], si
mov qword [rsp + 0xa60], rdi
mov qword [rax + 0x20], rdi
lea r15, [0x14002283d]
mov qword [rax + 0x28], r15
mov qword [rax + 0x30], 0xb
push 0xb
pop r13
mov rcx, r14
call fcn.140016f53
test rax, rax
je 0x140005a2a
mov rdi, rax
add rax, 0xfffffffffffffeb0
je 0x140005a2a
mov rcx, qword [rdi - 0xd8]
mov rdx, qword [rdi - 0xc8]
mov r8, r15
mov r9, r13
call fcn.140008a65
test al, al
je 0x1400059a4
mov esi, dword [rdi - 0x90]
mov rdx, qword [rsp + 0x170]
cmp rdx, qword [rsp + 0x168]
jne 0x140005a06
lea rcx, [rsp + 0x160]
call fcn.140009d67
mov rdx, qword [rsp + 0x170]
mov rax, qword [rsp + 0x160]
mov qword [rax + rdx*8], rsi
inc rdx
mov qword [rsp + 0x170], rdx
mov r15, qword [r14 + 0x28]
mov r13, qword [r14 + 0x30]
jmp 0x1400059a4
push 8
pop rdx
mov rcx, r14
call fcn.1400074b0
mov r15, qword [rsp + 0x160]
mov rax, qword [rsp + 0x168]
mov qword [rsp + 0xa58], rax
mov r14, qword [rsp + 0x170]
cmp qword [rsp + 0x78], 0
mov r13, qword [rsp + 0x98]
je 0x140005ad7
mov rcx, qword [rsp + 0xa60]
test rcx, rcx
je 0x140005ac4
movdqa xmm0, xmmword [rbx]
pmovmskb eax, xmm0
not eax
lea rdi, [rsp + 0x760]
mov word [rdi + 0x18], ax
mov qword [rdi], rbx
mov rax, qword [rsp + 0xa48]
mov qword [rdi + 8], rax
mov rax, qword [rsp + 0xa50]
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x20], rcx
mov rcx, rdi
call fcn.140016f53
test rax, rax
je 0x140005ac4
add rax, 0xfffffffffffffeb0
mov rcx, rax
call fcn.1400122d3
jmp 0x140005aa7
mov r8d, 0x158
mov rcx, rbx
mov rdx, qword [rsp + 0x78]
call fcn.140002df6
mov rcx, qword [rsp + 0xa90]
mov rdx, qword [rsp + 0xa98]
call fcn.140007b8f
mov rcx, qword [rsp + 0xaa0]
test rcx, rcx
je 0x140005b06
mov rdx, qword [rsp + 0xa68]
call fcn.140007b8f
mov rcx, qword [rsp + 0xaa8]
mov rdx, qword [rsp + 0xab0]
call fcn.140007b8f
mov rcx, qword [rsp + 0xab8]
mov rdx, qword [rsp + 0xac0]
call fcn.140007b8f
mov rsi, qword [rsp + 0xad0]
mov rcx, rsi
mov rdx, qword [rsp + 0xac8]
call fcn.140016e3b
mov rcx, rsi
mov rdx, qword [rsp + 0xad8]
call fcn.140016ea5
mov rsi, qword [rsp + 0xb8]
mov rcx, rsi
mov rdx, qword [rsp + 0x188]
call fcn.140016d27
mov rcx, rsi
mov rdx, qword [rsp + 0x350]
call fcn.140016e91
mov rsi, qword [rsp + 0x198]
mov rcx, rsi
mov rdx, qword [rsp + 0x190]
call fcn.1400121f8
mov rcx, rsi
mov rdx, qword [rsp + 0xb0]
call fcn.140012251
test r13, r13
je 0x140005c95
mov rax, qword [rsp + 0x70]
lea rsi, [rax + r13]
inc rsi
movdqa xmm0, xmmword [r13]
pmovmskb eax, xmm0
not eax
lea rbx, [r13 + 0x10]
lea rdi, [rsp + 0x760]
mov qword [rdi], r13
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rsi
mov word [rdi + 0x18], ax
mov rax, qword [rsp + 0x80]
mov qword [rdi + 0x20], rax
mov rcx, rdi
call fcn.140016ef5
test rax, rax
je 0x140005c08
mov rcx, qword [rax - 8]
call sub.pdh.dll_PdhRemoveCounter
jmp 0x140005bf0
mov rcx, qword [rsp + 0xa70]
test rcx, rcx
je 0x140005c1a
call sub.KERNEL32.dll_CloseHandle
mov rcx, qword [rsp + 0xa78]
test rcx, rcx
je 0x140005c2c
call sub.pdh.dll_PdhCloseQuery
cmp qword [rsp + 0x70], 0
je 0x140005c95
mov rcx, qword [rsp + 0x80]
test rcx, rcx
je 0x140005c84
movdqa xmm0, xmmword [r13]
pmovmskb eax, xmm0
not eax
lea rdi, [rsp + 0x760]
mov qword [rdi], r13
mov qword [rdi + 8], rbx
mov qword [rdi + 0x10], rsi
mov word [rdi + 0x18], ax
mov qword [rdi + 0x20], rcx
mov rcx, rdi
call fcn.140016ef5
test rax, rax
je 0x140005c84
mov rcx, qword [rax - 0x20]
mov rdx, qword [rax - 0x18]
call fcn.140007b8f
jmp 0x140005c68
push 0x20
pop r8
mov rcx, r13
mov rdx, qword [rsp + 0x70]
call fcn.140016ecd
mov rbx, qword [rsp + 0x88]
test rbx, rbx
je 0x140005d17
mov r8, qword [rsp + 0xa80]
test r8, r8
mov rsi, qword [rsp + 0xa88]
je 0x140005d06
lea rax, [rbx + rsi]
inc rax
movdqa xmm0, xmmword [rsi]
pmovmskb ecx, xmm0
not ecx
lea rdx, [rsi + 0x10]
lea rdi, [rsp + 0x760]
mov qword [rdi], rsi
mov qword [rdi + 8], rdx
mov qword [rdi + 0x10], rax
mov word [rdi + 0x18], cx
mov qword [rdi + 0x20], r8
mov rcx, rdi
call fcn.140016838
test rax, rax
je 0x140005d06
mov rcx, qword [rax - 0x88]
mov rdx, qword [rax - 0x80]
call fcn.140007b8f
jmp 0x140005ce7
mov r8d, 0x88
mov rcx, rsi
mov rdx, rbx
call fcn.140002df6
mov rsi, qword [rsp + 0xa0]
mov rcx, rsi
mov rdx, qword [rsp + 0xa8]
call fcn.140016df6
mov rcx, rsi
mov rdx, qword [rsp + 0x90]
call fcn.140016eb9
test r14, r14
je 0x1400073de
lea rax, [r15 + r14*8]
mov qword [rsp + 0x190], rax
lea rbx, [rsp + 0x212]
pxor xmm6, xmm6
movdqa xmm7, xmmword [str.ZGv]
movdqa xmm8, xmmword [0x1400221a0]
lea r13, [rsp + 0x4a0]
lea rdi, [rsp + 0x210]
mov rax, r15
push 0x10
pop r15
mov qword [rsp + 0x188], rax
cmp rax, qword [rsp + 0x190]
je 0x1400072e0
mov qword [rsp + 0x80], rax
mov rdx, qword [rsp + 0x140]
mov r8, qword [rsp + 0x150]
lea rcx, [rsp + 0x760]
mov qword [rsp + 0x70], rdx
call fcn.140008cd8
cmp qword [rsp + 0x760], 0
jne 0x1400073fa
mov rax, qword [rsp + 0x80]
add rax, 8
mov qword [rsp + 0x90], rax
mov rdx, qword [rsp + 0x768]
mov r8, qword [rsp + 0x770]
mov qword [rsp + 0x360], 1
lea rax, [rsp + 0x368]
movdqu xmmword [rax], xmm6
mov qword [rsp + 0x20], 2
mov rcx, r13
lea r9, [0x140022bec]
call fcn.140001a55
mov rcx, r13
call fcn.140002b1c
test rax, rax
je 0x140005f46
mov r8, rdx
mov qword [rsp + 0x20], 1
lea rcx, [rsp + 0x760]
mov rdx, rax
lea r9, str.:dllhost.exe6fdb:7b6f:c71d:3db9:c86a:5f57:9a95:33f1__74e7:08d5:a34e:489b:43eb:187d:d6b4:9fc9__b063:14f3:38ed:41d4:36c2:e4b7:5f84:9ffa__f2eb:3056:a0f4:bbf4:499f:a706:1df9:25ea__eac7:907b:f021:35b0:daa0:4572:f253:b1a9__06f9:e5bb:e3e6:8df5:ccbe:1f4d:f1b7:62ed__f13f:679e:4898:1a77:cbd6:270d:9eb7:d3fc__c7fa:18f9:3cc6:eb0a:49dc:8b73:3e8b:dbc9__0320:55f8:73ea:d36d:9faa:7469:9c01:2cb5__a1c8:70f3:cfed:079a:a45c:f558:2073:9fd2__eaf6:8adc:c897:61e7:3207:2584:9da7:df50__8adb:cd0b:38cb:b3eb:d206:9902:8146:28d1__b010:dadb:cf70:0dd8:0338:b533:39b0:31c0__ea14:f1af:8f9f:c1da:7ebc:d729:da27:e43d__1bb9:3b6d:9b7c:40bf:b994:44c4:41f2:d948__a306:4f65:9249:649e:1620:ba56:82a6:6a8d__290e:1a8d:8f90:157c:d3a9:d0c0:1ce5:565d__4a22:7cc3:d7bd:f9a2:6b80:c0ec:4c23:5a77__3c7a:da10
call fcn.140001a55
lea rcx, [rsp + 0x760]
call fcn.140002b1c
test rax, rax
je 0x140005f39
mov r14, rdx
test rdx, rdx
je 0x1400073fa
mov r13, rax
movzx eax, byte [rax]
cmp eax, 0x2d
je 0x140005e9f
cmp eax, 0x2b
jne 0x140005ea9
dec r14
je 0x1400073fa
inc r13
jmp 0x140005ea9
cmp r14, 1
je 0x1400073fa
xor r12d, r12d
xor esi, esi
cmp r14, 5
jae 0x140005ed9
cmp r14, r12
je 0x140005f12
movzx ecx, byte [r13 + r12]
mov edx, r15d
call fcn.140009090
test eax, eax
je 0x1400073fa
shl esi, 4
add esi, edx
inc r12
jmp 0x140005eb4
cmp r14, r12
je 0x140005f12
movzx ecx, byte [r13 + r12]
mov edx, r15d
call fcn.140009090
test eax, eax
je 0x1400073fa
cmp si, 0xfff
ja 0x1400073fa
shl esi, 4
add dx, si
jb 0x1400073fa
inc r12
mov esi, edx
jmp 0x140005ed9
rol si, 8
mov word [rsp + 0x210], si
lea r12, [rsp + 0x360]
mov rcx, r12
mov rdx, rdi
mov r8, rbx
call fcn.140007701
jmp 0x140005e5f
lea r13, [rsp + 0x4a0]
jmp 0x140005e2b
movups xmm0, xmmword [rsp + 0x360]
movaps xmmword [rsp + 0x760], xmm0
mov rax, qword [rsp + 0x370]
mov qword [rsp + 0x770], rax
mov rdx, qword [rsp + 0x148]
mov rcx, qword [rsp + 0x70]
call fcn.140007b8f
mov rsi, qword [rsp + 0x770]
mov qword [rsp + 0x150], rsi
movdqa xmm0, xmmword [rsp + 0x760]
movdqa xmmword [rsp + 0x140], xmm0
movabs rax, 0xa5ca14295f5cf389
mov qword [rsp + 0x494], rax
mov dword [rsp + 0x49c], 0x2c9d54ca
movdqu xmmword [rsp + 0xb80], xmm7
movdqu xmmword [rsp + 0xb90], xmm8
mov r14, qword [rsp + 0x140]
mov rcx, rsi
call fcn.14000fa49
mov qword [rsp + 0xa0], rdx
mov rcx, rax
mov rdx, r14
mov r14, rax
mov r8, rsi
call sub.msvcrt.dll_memcpy
cmp rsi, 0x10
jb 0x1400073e5
lea rax, [rsi - 0x10]
mov qword [rsp + 0x78], rax
lea rax, [r14 + rsi]
add rax, 0xfffffffffffffff0
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0x370]
movdqu xmmword [rdx + 0x20], xmm6
movdqu xmmword [rdx + 0x10], xmm6
movdqu xmmword [rdx], xmm6
movdqu xmm0, xmmword [str.expand_32_byte_kMicrosoft_Hv]
movdqa xmmword [rsp + 0x360], xmm0
lea rax, [rsp + 0xb80]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 0x20
lea rax, [rsp + 0xba0]
mov qword [rsp + 0x110], rax
and qword [rsp + 0x118], 0
mov qword [rsp + 0x120], 4
mov rcx, r13
lea r8, [rsp + 0x390]
lea r9, [rsp + 0x100]
call fcn.140001bcf
mov rax, qword [rsp + 0x4a0]
mov rcx, qword [rsp + 0x4b0]
mov rdx, qword [rsp + 0x4d0]
mov r8, qword [rsp + 0x4d8]
mov r9, qword [rsp + 0x4e0]
cmp r8, r9
jae 0x1400060d7
cmp rdx, 4
jne 0x1400073fa
mov r10d, dword [rcx + r8*4]
mov dword [rax + r8*4], r10d
inc r8
jmp 0x1400060bb
lea rax, [rsp + 0x494]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], 0xc
lea rax, [rsp + 0x4a0]
mov qword [rsp + 0xd0], rax
and qword [rsp + 0xd8], 0
mov qword [rsp + 0xe0], 4
mov rcx, r13
lea rdx, [rsp + 0x394]
lea r8, [rsp + 0x3a0]
lea r9, [rsp + 0xc0]
call fcn.140001bcf
mov rax, qword [rsp + 0x4a0]
mov rcx, qword [rsp + 0x4b0]
mov rdx, qword [rsp + 0x4d0]
mov r8, qword [rsp + 0x4d8]
mov r9, qword [rsp + 0x4e0]
cmp r8, r9
jae 0x14000617c
cmp rdx, 4
jne 0x1400073fa
mov r10d, dword [rcx + r8*4]
mov dword [rax + r8*4], r10d
inc r8
jmp 0x140006160
mov al, byte [0x140021010]
cmp al, 0xff
mov qword [rsp + 0x88], r14
mov qword [rsp + 0xa8], rsi
jne 0x1400061e9
lea rcx, [rsp + 0x1a0]
call fcn.140007ee6
mov rcx, r13
call fcn.140007f08
mov esi, dword [rsp + 0x1a8]
mov r14d, dword [rsp + 0x4a4]
mov eax, esi
not eax
test eax, 0xc000000
jne 0x1400061d3
call fcn.140001c2f
not eax
test al, 6
sete al
jmp 0x1400061d5
xor eax, eax
shr r14b, 5
and r14b, al
shr esi, 0x1c
and sil, r14b
mov byte [0x140021010], sil
movaps xmm0, xmmword [rsp + 0x360]
movaps xmm1, xmmword [rsp + 0x370]
movaps xmm2, xmmword [rsp + 0x380]
movaps xmm3, xmmword [rsp + 0x390]
movaps xmmword [rsp + 0x240], xmm3
movaps xmmword [rsp + 0x230], xmm2
movaps xmmword [rsp + 0x220], xmm1
movaps xmmword [rsp + 0x210], xmm0
lea rax, [rsp + 0x250]
movdqu xmmword [rax + 0x30], xmm6
movdqu xmmword [rax + 0x20], xmm6
movdqu xmmword [rax + 0x10], xmm6
movdqu xmmword [rax], xmm6
mov byte [rax + 0x40], 0
movdqa xmmword [rsp + 0x480], xmm6
movdqa xmmword [rsp + 0x470], xmm6
mov rcx, rdi
lea rdx, [rsp + 0x470]
push 0x20
pop r8
call fcn.140001c6f
mov al, byte [0x140021038]
cmp al, 0xff
je 0x140006a10
cmp al, 1
jne 0x140006a64
mov rcx, r13
lea rdx, [rsp + 0x470]
call fcn.14000bf0f
movaps xmm0, xmmword [rsp + 0x4a0]
movaps xmmword [rsp + 0x350], xmm0
movaps xmm10, xmmword [rsp + 0x4b0]
lea rax, [rsp + 0x4c0]
movaps xmm0, xmmword [rax]
movaps xmm1, xmmword [rax + 0x10]
movaps xmm2, xmmword [rax + 0x20]
movaps xmm3, xmmword [rax + 0x30]
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0x110], xmm1
movaps xmmword [rsp + 0x120], xmm2
movaps xmmword [rsp + 0x130], xmm3
lea rcx, [rsp + 0xc0]
lea rdx, [rsp + 0x100]
mov r8, rdx
call fcn.14000a026
movaps xmm13, xmmword [rsp + 0xc0]
movaps xmm14, xmmword [rsp + 0xd0]
movaps xmm11, xmmword [rsp + 0xe0]
movaps xmm12, xmmword [rsp + 0xf0]
mov eax, 0x3ffffff
mov qword [rsp + 0x20], rax
mov r8d, 0x3ffffff
mov r9d, 0x3ffffff
lea r14, [rsp + 0xbe0]
mov rcx, r14
push 0xffffffffffffffff
pop rdx
call fcn.14000a5a9
movaps xmmword [rsp + 0xb10], xmm14
movaps xmmword [rsp + 0xb00], xmm13
lea rcx, [rsp + 0xba0]
lea rdx, [rsp + 0xb00]
mov r8, r14
call fcn.14000a849
push 0x1a
pop r8
mov qword [rsp + 0x20], r8
lea rsi, [rsp + 0xc00]
mov rcx, rsi
push 0x40
pop rdx
mov r9, r8
call fcn.14000a5a9
movaps xmmword [rsp + 0xb30], xmm14
movaps xmmword [rsp + 0xb20], xmm13
lea r14, [rsp + 0xb60]
mov rcx, r14
lea rdx, [rsp + 0xb20]
mov r8, rsi
call fcn.14000bf8d
lea rsi, [rsp + 0xae0]
mov rcx, rsi
mov rdx, r14
call fcn.14000a85a
lea rcx, [rsp + 0x160]
lea rdx, [rsp + 0xba0]
mov r8, rsi
call fcn.14000a5fa
movaps xmm13, xmmword [rsp + 0x160]
movaps xmm14, xmmword [rsp + 0x170]
movaps xmmword [rsp + 0x2f0], xmm14
movaps xmmword [rsp + 0x2e0], xmm13
lea rsi, [rsp + 0x6e0]
mov rcx, rsi
lea rdx, [rsp + 0x2e0]
call fcn.14000be8e
lea r14, [rsp + 0x2c0]
mov rcx, r14
mov rdx, rsi
call fcn.14000a85a
movaps xmmword [rsp + 0x2b0], xmm12
movaps xmmword [rsp + 0x2a0], xmm11
lea r13, [rsp + 0x4a0]
mov rcx, r13
lea rsi, [rsp + 0x2a0]
mov rdx, rsi
mov r8, r14
call fcn.14000a5fa
or qword [rsp + 0x20], 0xffffffffffffffff
mov edx, 0x3ffffff
lea r14, [rsp + 0x160]
mov rcx, r14
push 0xffffffffffffffff
pop r8
mov r9, r8
call fcn.14000a5a9
movaps xmmword [rsp + 0x1f0], xmm14
movaps xmmword [rsp + 0x1e0], xmm13
lea rcx, [rsp + 0x4c0]
lea rdx, [rsp + 0x1e0]
mov r8, r14
call fcn.14000a849
movaps xmm11, xmmword [rsp + 0x4a0]
movaps xmm12, xmmword [rsp + 0x4b0]
movaps xmm13, xmmword [rsp + 0x4c0]
movaps xmm14, xmmword [rsp + 0x4d0]
push 0x1a
pop rax
mov qword [rsp + 0x20], rax
lea r14, [rsp + 0xba0]
mov rcx, r14
push 0x40
pop rdx
mov r8, rdx
mov r9, rdx
call fcn.14000a5a9
movaps xmmword [rsp + 0xb70], xmm12
movaps xmmword [rsp + 0xb60], xmm11
mov rcx, r13
lea rdx, [rsp + 0xb60]
mov r8, r14
call fcn.14000bf8d
movaps xmm15, xmmword [rsp + 0x4a0]
movdqa xmm9, xmm8
movdqa xmm8, xmm7
movaps xmm7, xmmword [rsp + 0x4b0]
movaps xmmword [rsp + 0xaf0], xmm14
movaps xmmword [rsp + 0xae0], xmm13
movaps xmmword [rsp + 0x2f0], xmm7
movaps xmmword [rsp + 0x2e0], xmm15
mov rcx, rsi
lea rdx, [rsp + 0xae0]
lea r8, [rsp + 0x2e0]
call fcn.14000a5fa
movaps xmmword [rsp + 0x6f0], xmm7
movaps xmmword [rsp + 0x6e0], xmm15
lea r14, [rsp + 0x2c0]
mov rcx, r14
lea rdx, [rsp + 0x6e0]
call fcn.14000bf9e
mov rcx, r13
mov rdx, rsi
mov r8, r14
call fcn.14000a5fa
movaps xmm13, xmmword [rsp + 0x4a0]
movaps xmm14, xmmword [rsp + 0x4b0]
mov esi, 0x3ffffff
mov qword [rsp + 0x20], rsi
lea r14, [rsp + 0x160]
mov rcx, r14
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call fcn.14000a5a9
movaps xmmword [rsp + 0x1f0], xmm12
movaps xmmword [rsp + 0x1e0], xmm11
mov rcx, r13
lea rdx, [rsp + 0x1e0]
mov r8, r14
call fcn.14000a849
movaps xmm11, xmmword [rsp + 0x4a0]
movaps xmm12, xmmword [rsp + 0x4b0]
mov qword [rsp + 0x20], rsi
mov r8d, 0x3ffffff
mov r9d, 0x3ffffff
lea rsi, [rsp + 0xbe0]
mov rcx, rsi
push 0xffffffffffffffff
pop rdx
call fcn.14000a5a9
movaps xmmword [rsp + 0xb10], xmm14
movaps xmmword [rsp + 0xb00], xmm13
lea r14, [rsp + 0xba0]
mov rcx, r14
lea rdx, [rsp + 0xb00]
mov r8, rsi
call fcn.14000a849
push 0x1a
pop r8
mov qword [rsp + 0x20], r8
lea rsi, [rsp + 0xc00]
mov rcx, rsi
push 0x40
pop rdx
mov r9, r8
call fcn.14000a5a9
movaps xmmword [rsp + 0xb30], xmm14
movaps xmmword [rsp + 0xb20], xmm13
lea r13, [rsp + 0xb60]
mov rcx, r13
lea rdx, [rsp + 0xb20]
mov r8, rsi
call fcn.14000bf8d
lea rsi, [rsp + 0xae0]
mov rcx, rsi
mov rdx, r13
call fcn.14000a85a
lea r13, [rsp + 0x160]
mov rcx, r13
mov rdx, r14
mov r8, rsi
call fcn.14000a5fa
movaps xmm7, xmmword [rsp + 0x160]
movaps xmm13, xmmword [rsp + 0x170]
movaps xmmword [rsp + 0x2f0], xmm13
movaps xmmword [rsp + 0x2e0], xmm7
lea r14, [rsp + 0x6e0]
mov rcx, r14
lea rdx, [rsp + 0x2e0]
call fcn.14000be8e
lea rsi, [rsp + 0x2c0]
mov rcx, rsi
mov rdx, r14
call fcn.14000a85a
movaps xmmword [rsp + 0x2b0], xmm12
movaps xmmword [rsp + 0x2a0], xmm11
lea rcx, [rsp + 0x4a0]
lea rdx, [rsp + 0x2a0]
mov r8, rsi
call fcn.14000a5fa
or qword [rsp + 0x20], 0xffffffffffffffff
mov edx, 0x3ffffff
mov rcx, r13
push 0xffffffffffffffff
pop r8
mov r9, r8
call fcn.14000a5a9
movaps xmmword [rsp + 0x1f0], xmm13
movaps xmmword [rsp + 0x1e0], xmm7
lea rcx, [rsp + 0x4c0]
lea rdx, [rsp + 0x1e0]
mov r8, r13
call fcn.14000a849
movdqa xmm11, xmmword [rsp + 0x4a0]
movaps xmm12, xmmword [rsp + 0x4b0]
movaps xmm7, xmmword [rsp + 0x4c0]
movaps xmm13, xmmword [rsp + 0x4d0]
push 2
pop rax
mov dword [rsp + 0x38], eax
push 4
pop r13
mov dword [rsp + 0x30], r13d
and dword [rsp + 0x40], 0
push 6
pop r14
mov dword [rsp + 0x28], r14d
and dword [rsp + 0x20], 0
lea rsi, [rsp + 0x2a0]
mov rcx, rsi
xor edx, edx
mov r8d, r14d
mov r9d, r13d
call fcn.140009fb5
movaps xmmword [rsp + 0x6f0], xmm13
movaps xmmword [rsp + 0x6e0], xmm7
movdqa xmm7, xmm8
movdqa xmm8, xmm9
lea rcx, [rsp + 0x160]
lea rdx, [rsp + 0x6e0]
mov r8, rsi
call fcn.140009ff5
push 2
pop rax
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], r13d
and dword [rsp + 0x40], 0
mov dword [rsp + 0x28], r14d
and dword [rsp + 0x20], 0
lea rcx, [rsp + 0x1e0]
xor edx, edx
mov r8d, r14d
mov r9d, r13d
call fcn.140009fb5
movaps xmmword [rsp + 0x2d0], xmm12
movdqa xmmword [rsp + 0x2c0], xmm11
lea rsi, [rsp + 0x4a0]
mov rcx, rsi
lea rdx, [rsp + 0x2c0]
lea r8, [rsp + 0x1e0]
call fcn.140009ff5
lea r14, [rsp + 0x2e0]
mov rcx, r14
lea r13, [rsp + 0x160]
mov rdx, r13
mov r8, rsi
call fcn.14000bfaf
lea rcx, [rsp + 0xc0]
mov rdx, r14
call fcn.14000bd50
mov rcx, r13
call fcn.140009f49
xor eax, eax
cmp rax, 0x40
je 0x1400068e2
movdqu xmm0, xmmword [rsp + 0x160]
movdqu xmmword [rsp + rax + 0x4a0], xmm0
add rax, 0x10
jmp 0x1400068c4
movaps xmm0, xmmword [rsp + 0x100]
movaps xmm1, xmmword [rsp + 0x110]
movaps xmm2, xmmword [rsp + 0x120]
movaps xmm3, xmmword [rsp + 0x130]
movaps xmmword [rsp + 0x1a0], xmm0
movaps xmmword [rsp + 0x1b0], xmm1
movaps xmmword [rsp + 0x1c0], xmm2
movaps xmmword [rsp + 0x1d0], xmm3
movaps xmm0, xmmword [rsp + 0xc0]
movaps xmm1, xmmword [rsp + 0xd0]
movaps xmm2, xmmword [rsp + 0xe0]
movaps xmm3, xmmword [rsp + 0xf0]
movaps xmmword [rsp + 0x300], xmm0
movaps xmmword [rsp + 0x310], xmm1
movaps xmmword [rsp + 0x320], xmm2
movaps xmmword [rsp + 0x330], xmm3
movups xmm0, xmmword [rsp + 0x4a0]
movups xmm1, xmmword [rsp + 0x4b0]
movups xmm2, xmmword [rsp + 0x4c0]
movups xmm3, xmmword [rsp + 0x4d0]
movaps xmmword [rsp + 0x750], xmm3
movaps xmmword [rsp + 0x740], xmm2
movaps xmmword [rsp + 0x730], xmm1
movaps xmmword [rsp + 0x720], xmm0
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0x710], eax
movups xmm0, xmmword [rsp + 0x100]
movaps xmmword [rsp + 0x700], xmm0
mov r8d, 0x108
mov rcx, r12
lea rdx, [rsp + 0x4a0]
call sub.msvcrt.dll_memcpy
movups xmm0, xmmword [rsp + 0xc0]
movaps xmmword [rsp + 0xb40], xmm0
mov rax, qword [rsp + 0xcf]
mov qword [rsp + 0xb4f], rax
mov dword [rsp + 0x98], 0
movdqa xmm9, xmmword [rsp + 0x350]
jmp 0x140006b02
mov rcx, r12
call fcn.140007ee6
mov rcx, r13
call fcn.140007f08
mov esi, dword [rsp + 0x368]
mov r14d, dword [rsp + 0x4a4]
mov eax, esi
not eax
test eax, 0xc000000
jne 0x140006a48
call fcn.140001c2f
not eax
test al, 6
sete al
jmp 0x140006a4a
xor eax, eax
shr r14b, 5
and r14b, al
shr esi, 0x1c
and sil, r14b
mov byte [0x140021038], sil
jne 0x140006284
and dword [rsp + 0x710], 0
movdqa xmmword [rsp + 0x700], xmm6
mov ecx, dword [rsp + 0x470]
mov eax, 0x3ffffff
and ecx, eax
mov dword [rsp + 0xb8], ecx
mov eax, dword [rsp + 0x473]
mov ecx, dword [rsp + 0x476]
shr eax, 2
and eax, 0x3ffff03
mov dword [rsp + 0xb0], eax
shr ecx, 4
and ecx, 0x3ffc0ff
mov dword [rsp + 0x198], ecx
mov esi, dword [rsp + 0x479]
shr esi, 6
and esi, 0x3f03fff
mov r14d, dword [rsp + 0x47c]
shr r14d, 8
and r14d, 0xfffff
movdqa xmm11, xmmword [rsp + 0x480]
movdqa xmmword [rsp + 0xbd0], xmm11
mov al, byte [rsp + 0xbd0]
mov dword [rsp + 0x98], eax
psrldq xmm11, 1
mov eax, dword [rsp + 0x710]
lea r13, [rsp + 0x9a0]
mov dword [r13 - 0x20c], eax
movaps xmm0, xmmword [rsp + 0x700]
movups xmmword [r13 - 0x21c], xmm0
mov r8d, 0x108
lea rcx, [rsp + 0x798]
mov rdx, r12
call sub.msvcrt.dll_memcpy
movaps xmm0, xmmword [rsp + 0x1a0]
movaps xmm1, xmmword [rsp + 0x1b0]
movaps xmm2, xmmword [rsp + 0x1c0]
movaps xmm3, xmmword [rsp + 0x1d0]
movaps xmmword [r13 - 0xc0], xmm2
movaps xmmword [r13 - 0xe0], xmm0
movaps xmmword [r13 - 0xb0], xmm3
movaps xmmword [r13 - 0xd0], xmm1
movaps xmm0, xmmword [rsp + 0x300]
movaps xmm1, xmmword [rsp + 0x320]
movaps xmmword [r13 - 0x80], xmm1
movaps xmmword [r13 - 0xa0], xmm0
movaps xmm0, xmmword [rsp + 0x310]
movaps xmm1, xmmword [rsp + 0x330]
movaps xmmword [r13 - 0x70], xmm1
movaps xmmword [r13 - 0x90], xmm0
movaps xmm0, xmmword [rsp + 0x720]
movaps xmm1, xmmword [rsp + 0x740]
movaps xmmword [r13 - 0x40], xmm1
movaps xmm1, xmmword [rsp + 0x730]
movaps xmm2, xmmword [rsp + 0x750]
movaps xmmword [r13 - 0x50], xmm1
movaps xmmword [r13 - 0x60], xmm0
movaps xmmword [r13 - 0x30], xmm2
mov rax, qword [rsp + 0xb4f]
mov qword [r13 - 8], rax
movaps xmm0, xmmword [rsp + 0xb40]
movups xmmword [r13 - 0x17], xmm0
mov eax, dword [rsp + 0x98]
mov byte [rsp + 0x760], al
movdqa xmmword [rsp + 0xbc0], xmm11
mov al, byte [rsp + 0xbce]
mov byte [rsp + 0x76f], al
pextrw eax, xmm11, 6
mov word [rsp + 0x76d], ax
pshufd xmm0, xmm11, 0xee
movd dword [rsp + 0x769], xmm0
movq qword [rsp + 0x761], xmm11
mov eax, dword [rsp + 0xb8]
mov dword [rsp + 0x770], eax
mov eax, dword [rsp + 0xb0]
mov dword [rsp + 0x774], eax
mov eax, dword [rsp + 0x198]
mov dword [rsp + 0x778], eax
mov dword [rsp + 0x77c], esi
mov dword [rsp + 0x780], r14d
movaps xmmword [rsp + 0x8b0], xmm10
movdqa xmmword [rsp + 0x8a0], xmm9
and qword [rsp + 0x980], 0
xor esi, esi
mov byte [rsp + 0x988], sil
lea rcx, [rsp + 0x470]
push 0x20
pop rdx
call fcn.1400195de
mov dword [rsp + 0x240], 1
mov byte [rsp + 0x290], sil
mov r8d, 0x84
mov rcx, r13
mov rdx, rdi
call sub.msvcrt.dll_memcpy
movabs rax, 0x3fffffffbf
cmp qword [rsp + 0x78], rax
lea r13, [rsp + 0x4a0]
mov r14, qword [rsp + 0x88]
ja 0x140006ff6
lea rsi, [rsp + 0x760]
mov rcx, rsi
lea rdx, [0x1400233d8]
xor r8d, r8d
call fcn.140001560
mov rcx, rsi
mov rdx, r14
mov r14, qword [rsp + 0x78]
mov r8, r14
call fcn.140001560
mov rcx, r12
call fcn.140009f49
and qword [rsp + 0x360], 0
mov qword [rsp + 0x368], r14
mov rax, qword [rsp + 0x360]
mov qword [rsp + 0x4a0], rax
mov rax, qword [rsp + 0x368]
mov qword [rsp + 0x4a8], rax
mov rcx, rsi
mov rdx, r13
push 1
pop r8
call fcn.1400015c2
mov r8d, 0x240
mov rcx, r13
mov rdx, rsi
call sub.msvcrt.dll_memcpy
mov al, byte [0x140021038]
cmp al, 1
jne 0x140006daa
mov rcx, rdi
mov rdx, r13
call fcn.14000a868
jmp 0x140006f88
mov r11d, dword [rsp + 0x4c8]
mov r8d, r11d
shr r8d, 0x1a
mov r10d, 0x3ffffff
and r11d, r10d
add r8d, dword [rsp + 0x4cc]
mov ecx, r8d
shr ecx, 0x1a
and r8d, r10d
add ecx, dword [rsp + 0x4d0]
mov eax, ecx
shr eax, 0x1a
and ecx, r10d
add eax, dword [rsp + 0x4d4]
mov dword [rsp + 0xb8], eax
mov r9d, eax
shr r9d, 0x1a
mov edx, eax
and edx, r10d
mov eax, 0x3ffffff
lea r10d, [r9 + r9*4]
add r10d, dword [rsp + 0x4c4]
mov r9d, r10d
shr r9d, 0x1a
add r9d, r11d
and r10d, eax
lea r11d, [r10 + 5]
mov dword [rsp + 0x98], r11d
shr r11d, 0x1a
add r11d, r9d
mov esi, r11d
shr esi, 0x1a
add esi, r8d
mov r13d, esi
shr r13d, 0x1a
add r13d, ecx
mov r12d, r13d
shr r12d, 0x1a
lea eax, [r12 + rdx]
add eax, 0xfc000000
mov r14d, r12d
add r14d, edx
mov dword [rsp + 0xb0], r14d
mov edx, eax
shr eax, 0x1f
dec eax
mov r12d, eax
mov r14d, 0x3ffffff
and r12d, r14d
and dword [rsp + 0x98], r12d
and r11d, r12d
and esi, r12d
and r12d, r13d
and eax, dword [rsp + 0xb0]
sar edx, 0x1f
and r10d, edx
or r10d, dword [rsp + 0x98]
and r9d, edx
or r9d, r11d
and r8d, edx
or r8d, esi
and ecx, edx
or ecx, r12d
and edx, dword [rsp + 0xb8]
or edx, eax
mov esi, r9d
shl esi, 0x1a
or esi, r10d
shr r9d, 6
mov eax, r8d
shl eax, 0x14
or eax, r9d
shr r8d, 0xc
mov r9d, ecx
shl r9d, 0xe
or r9d, r8d
shr ecx, 0x12
shl edx, 8
or edx, ecx
add esi, dword [rsp + 0x4a0]
mov r14d, dword [rsp + 0x4a4]
adc r14, rax
mov eax, dword [rsp + 0x4a8]
add rax, r9
mov r12, r14
shr r12, 0x20
add edx, dword [rsp + 0x4ac]
add r12, rax
mov r13, r12
shr r13, 0x20
add r13d, edx
lea rcx, [rsp + 0x360]
call fcn.140009f49
mov dword [rsp + 0x360], esi
mov dword [rsp + 0x364], r14d
mov dword [rsp + 0x368], r12d
lea r12, [rsp + 0x360]
mov dword [rsp + 0x36c], r13d
lea r13, [rsp + 0x4a0]
mov eax, dword [rsp + 0x360]
mov dword [rsp + 0x210], eax
mov eax, dword [rsp + 0x364]
mov dword [rsp + 0x214], eax
mov eax, dword [rsp + 0x368]
mov dword [rsp + 0x218], eax
mov eax, dword [rsp + 0x36c]
mov dword [rsp + 0x21c], eax
mov r14b, 1
xor eax, eax
cmp rax, 0x10
je 0x140006fbe
lea rsi, [rax + 1]
mov rcx, qword [rsp + 0x70]
mov dl, byte [rcx + rax]
xor dl, byte [rsp + rax + 0x210]
mov ecx, edx
neg cl
or cl, dl
not cl
shr cl, 7
call fcn.140011f8d
and r14b, al
mov rax, rsi
jmp 0x140006f8d
mov ecx, r14d
call fcn.140011f8d
test al, al
je 0x140006fec
lea rcx, [rsp + 0x9a0]
mov r14, qword [rsp + 0x88]
mov rdx, r14
mov r8, qword [rsp + 0x78]
call fcn.140001c6f
mov sil, 1
jmp 0x140006ff6
xor esi, esi
mov r14, qword [rsp + 0x88]
lea rcx, [rsp + 0x9e0]
push 0x40
pop rdx
call fcn.1400195de
mov byte [rsp + 0xa20], 0
mov eax, 0x90
cmp rax, 0xa0
je 0x14000702b
mov dword [rsp + rax*4 + 0x760], 0
inc rax
jmp 0x140007013
test sil, sil
mov rax, qword [rsp + 0xa8]
je 0x1400073e5
cmp rax, 0x10
mov rsi, qword [rsp + 0x78]
cmovb rsi, rax
lea rcx, [rsp + 0xb80]
push 0x20
pop rdx
call fcn.1400195de
mov rcx, qword [rsp + 0x140]
mov rdx, qword [rsp + 0x148]
call fcn.140007b8f
mov qword [rsp + 0x140], r14
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x150], rsi
mov rcx, r13
mov rdx, r14
mov r8, rsi
call fcn.140007df7
mov rax, qword [rsp + 0x80]
mov rax, qword [rax]
mov qword [rsp + 0x300], rax
movdqa xmmword [rsp + 0x780], xmm6
movdqa xmmword [rsp + 0x770], xmm6
movdqa xmmword [rsp + 0x760], xmm6
mov qword [rsp + 0x360], rax
and qword [rsp + 0x368], 0
mov ecx, 0x4b82f718
call fcn.14000f143
mov qword [rsp + 0x30], r12
lea rcx, [rsp + 0x760]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x7f
mov ecx, eax
push 4
pop r8
lea r9, [rsp + 0x300]
call fcn.140001510
test eax, eax
js 0x1400073de
and qword [rsp + 0x1a0], 0
mov rsi, qword [rsp + 0x4b0]
mov qword [rsp + 0x100], rsi
mov ecx, 0xf783b8ec
call fcn.14000f143
mov r9, qword [rsp + 0x300]
lea rcx, [rsp + 0x100]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x1a0]
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x40], 4
mov dword [rsp + 0x38], 0x3000
and dword [rsp + 0x28], 0
mov ecx, eax
push 6
pop r8
call fcn.140001510
test eax, eax
push 5
pop r13
js 0x1400073de
and dword [rsp + 0x160], 0
mov r14, qword [rsp + 0x4a0]
mov qword [rsp + 0xc0], rsi
mov ecx, 0xc3170192
call fcn.14000f143
mov r9, qword [rsp + 0x300]
mov rcx, qword [rsp + 0x1a0]
lea r8, [rsp + 0x160]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rcx
mov ecx, eax
mov r8d, r13d
call fcn.140001510
test eax, eax
js 0x1400073de
mov esi, r13d
mov r13d, eax
mov dword [rsp + 0x720], 4
mov ecx, 0x50e92888
call fcn.14000f143
mov r9, qword [rsp + 0x300]
lea rcx, [rsp + 0x720]
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0xc0]
mov qword [rsp + 0x28], rcx
lea rcx, [rsp + 0x1a0]
mov qword [rsp + 0x20], rcx
mov dword [rsp + 0x30], 0x40
mov ecx, eax
mov r8d, esi
call fcn.140001510
test eax, eax
js 0x1400073de
and qword [rsp + 0x210], 0
mov rsi, qword [rsp + 0x300]
mov ecx, 0xaf18cfb0
call fcn.14000f143
mov rcx, qword [rsp + 0x1a0]
movdqu xmmword [rsp + 0x60], xmm6
movdqu xmmword [rsp + 0x50], xmm6
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x48], 4
and qword [rsp + 0x40], 0
and qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1fffff
mov ecx, eax
push 0xb
pop r8
mov r9, rdi
call fcn.140001510
test r13d, r13d
jne 0x1400073de
mov rdx, qword [rsp + 0x4a8]
mov rcx, r14
call fcn.140007b8f
mov rax, qword [rsp + 0x90]
lea r13, [rsp + 0x4a0]
jmp 0x140005d90
cmp qword [rsp + 0xa58], 0
je 0x1400072fb
push 8
pop rdx
mov rcx, qword [rsp + 0x188]
call fcn.1400074b0
mov rcx, qword [rsp + 0x140]
mov rdx, qword [rsp + 0x148]
call fcn.140007b8f
movaps xmm6, xmmword [rbp + 0xbb0]
movaps xmm7, xmmword [rbp + 0xbc0]
movaps xmm8, xmmword [rbp + 0xbd0]
movaps xmm9, xmmword [rbp + 0xbe0]
movaps xmm10, xmmword [rbp + 0xbf0]
movaps xmm11, xmmword [rbp + 0xc00]
movaps xmm12, xmmword [rbp + 0xc10]
movaps xmm13, xmmword [rbp + 0xc20]
movaps xmm14, xmmword [rbp + 0xc30]
movaps xmm15, xmmword [rbp + 0xc40]
lea rsp, [rbp + 0xc58]
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rbx, rdx
push 0x60
pop rcx
push 8
pop rdx
call fcn.140012a3e
mov qword [rax], r14
movdqa xmm0, xmmword [rsp + 0x360]
movaps xmm1, xmmword [rsp + 0x370]
movaps xmm2, xmmword [rsp + 0x380]
movdqu xmmword [rax + 8], xmm0
movups xmmword [rax + 0x18], xmm1
movups xmmword [rax + 0x28], xmm2
mov dword [rax + 0x38], esi
movd dword [rax + 0x3c], xmm9
mov qword [rax + 0x40], rdi
mov qword [rax + 0x48], rbx
mov qword [rax + 0x50], 8
movd dword [rax + 0x58], xmm8
mov qword [rsp + 0x80], rax
movd dword [rax + 0x5c], xmm8
push 1
pop rsi
jmp 0x14000396e
call fcn.1400119fb
ud2
mov rcx, r14
mov rdx, qword [rsp + 0xa0]
call fcn.140007b8f
jmp 0x1400073fa
test rax, rax
ud2