Function at 0x180105300
Capabilities:
Connect to wmi namespace via wbemlocator
Enumerate processes via ntquerysysteminformation
Get disk information
Get disk size
Get local ipv4 addresses
Get logon sessions
Get memory capacity
Get system information on windows
List groups for user account
List user accounts
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x9b8
movdqa xmmword [rsp + 0x9a0], xmm8
movaps xmmword [rsp + 0x990], xmm7
movaps xmmword [rsp + 0x980], xmm6
mov qword [rsp + 0x48], rdx
mov rsi, rcx
mov eax, dword [0x18021a9d8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xa8], 0
jne 0x180105357
call fcn.180045f80
mov eax, dword [0x18021a9d8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xb0]
inc qword [rax + 0xb0]
mov rcx, qword [0x18021a960]
test rcx, rcx
jne 0x18010539d
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x18010952d
mov rcx, rax
mov qword [0x18021a960], rax
mov r8d, 0x56410
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x18010952d
mov rbx, rax
mov qword [rsp + 0x428], rsi
add rbx, 0x56000
mov r8d, 0x410
mov rcx, rbx
mov dl, 0xff
call fcn.1801723c0
mov rcx, qword [0x18021a960]
test rcx, rcx
je 0x1801053e9
mov rsi, qword [rsp + 0x48]
jmp 0x180105407
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
mov rsi, qword [rsp + 0x48]
je 0x180109539
mov rcx, rax
mov qword [0x18021a960], rax
mov r8d, 9
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x180109539
mov r14, rax
movabs rax, 0x5043206c61746f54
mov qword [r14], rax
mov byte [r14 + 8], 0x55
mov rcx, qword [0x18021a960]
test rcx, rcx
jne 0x180105458
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x18010954a
mov rcx, rax
mov qword [0x18021a960], rax
mov r8d, 0x120
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x18010954a
mov r15, rax
mov eax, dword [0x18021a9d8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xa8], 0
jne 0x180105494
call fcn.180045f80
mov eax, dword [0x18021a9d8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movdqu xmm7, xmmword [rax + 0xb0]
inc qword [rax + 0xb0]
movabs rdi, 0x19db1ded53e7fff
mov qword [rsp + 0x430], 0
mov rax, qword [0x180219030]
lea r12, [rsp + 0x430]
mov rcx, r12
call rax
mov rax, qword [rsp + 0x430]
cmp rax, rdi
jle 0x180105533
movabs rcx, 0xfe624e212ac18000
add rax, rcx
movabs rcx, 0xd6bf94d5e57a42bd
mul rcx
mov rdi, rdx
shr rdi, 0x17
call sub.KERNEL32.dll_GetTickCount64
shr rax, 3
movabs rcx, 0x20c49ba5e353f7cf
mul rcx
shr rdx, 4
xor eax, eax
sub rdi, rdx
cmovae rax, rdi
jmp 0x180105535
xor eax, eax
mov qword [rsp + 0x2a8], rbx
mov qword [rsp + 0x2b0], 0x3ff
mov qword [rsp + 0x2b8], 0x380
mov qword [rsp + 0x2c0], 0
movups xmmword [rsp + 0x2c8], xmm6
xorps xmm6, xmm6
movups xmmword [rsp + 0x308], xmm6
movups xmmword [rsp + 0x318], xmm6
mov qword [rsp + 0x378], r14
mov qword [rsp + 0x380], 9
mov qword [rsp + 0x388], 9
mov qword [rsp + 0x390], 1
movups xmmword [rsp + 0x398], xmm6
mov qword [rsp + 0x3a8], 1
movups xmmword [rsp + 0x3b0], xmm6
mov qword [rsp + 0x3c0], 0
mov qword [rsp + 0x3d8], 0
mov dword [rsp + 0x3e0], 0
mov qword [rsp + 0x3e8], 8
movups xmmword [rsp + 0x3f0], xmm6
mov byte [rsp + 0x400], 0
mov qword [rsp + 0x330], 8
movups xmmword [rsp + 0x338], xmm6
mov qword [rsp + 0x348], r15
mov qword [rsp + 0x350], 2
mov qword [rsp + 0x358], 0
mov qword [rsp + 0x268], 0
lea rcx, [0x1802039e0]
mov qword [rsp + 0x2d8], rcx
movups xmmword [rsp + 0x2e0], xmm6
mov qword [rsp + 0x2f0], 0
movdqu xmmword [rsp + 0x2f8], xmm7
mov qword [rsp + 0x328], rax
mov qword [rsp + 0x360], 8
movups xmmword [rsp + 0x368], xmm6
cmp byte [rsi + 4], 0
je 0x180105794
movaps xmmword [rsp + 0xf0], xmm6
movaps xmmword [rsp + 0x120], xmm6
movaps xmmword [rsp + 0x110], xmm6
movaps xmmword [rsp + 0x100], xmm6
mov dword [rsp + 0xf0], 0x40
lea rcx, [rsp + 0xf0]
call sub.KERNEL32.dll_GlobalMemoryStatusEx
movups xmm0, xmmword [rsp + 0xf8]
movups xmmword [rsp + 0x308], xmm0
movaps xmmword [rsp + 0x480], xmm6
movaps xmmword [rsp + 0x470], xmm6
movaps xmmword [rsp + 0x460], xmm6
movaps xmmword [rsp + 0x450], xmm6
movaps xmmword [rsp + 0x440], xmm6
movaps xmmword [rsp + 0x430], xmm6
mov qword [rsp + 0x490], 0
lea rcx, [rsp + 0x430]
mov edx, 0x68
call sub.psapi.dll_GetPerformanceInfo
cmp eax, 1
jne 0x180105794
mov r8, qword [rsp + 0x440]
mov r9, qword [rsp + 0x450]
xor r10d, r10d
sub r8, r9
cmovb r8, r10
mov rcx, qword [rsp + 0x480]
mov rax, rcx
mul r8
mov r8, rax
mov r11, 0xffffffffffffffff
cmovo r8, r11
mov rsi, qword [rsp + 0x438]
sub rsi, r9
cmovb rsi, r10
mov rax, rcx
mul rsi
mov rsi, qword [rsp + 0x48]
cmovo rax, r11
mov qword [rsp + 0x318], r8
mov qword [rsp + 0x320], rax
cmp byte [rsi + 0xb], 2
je 0x180105bdf
movzx ebp, byte [rsi + 0xc]
cmp qword [rsp + 0x268], 0
jne 0x180105b04
mov qword [rsp + 0xf0], 0
lea r8, [rsp + 0xf0]
xor ecx, ecx
xor edx, edx
call sub.pdh.dll_PdhOpenQueryA
test eax, eax
mov byte [rsp + 0x50], bpl
je 0x180105814
mov qword [rsp + 0x268], 0
movups xmm0, xmmword [rsp + 0x430]
movups xmmword [rsp + 0x270], xmm0
mov rax, qword [rsp + 0x440]
mov qword [rsp + 0x280], rax
mov qword [rsp + 0x2a0], 0
jmp 0x180105ae3
mov rsi, qword [rsp + 0xf0]
mov eax, dword [0x18021a9d8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xa8], 0
jne 0x18010583e
call fcn.180045f80
mov eax, dword [0x18021a9d8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm0, xmmword [rax + 0xb0]
inc qword [rax + 0xb0]
xorps xmm1, xmm1
lea rax, [0x1802039e0]
mov qword [rsp + 0x268], rax
movups xmmword [rsp + 0x270], xmm1
mov qword [rsp + 0x280], 0
movups xmmword [rsp + 0x288], xmm0
mov qword [rsp + 0x298], rsi
mov qword [rsp + 0x2a0], 0
mov rcx, qword [0x18021a960]
test rcx, rcx
jne 0x1801058c6
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x1801095aa
mov rcx, rax
mov qword [0x18021a960], rax
mov r8d, 0x1e
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x1801095aa
movups xmm0, xmmword [0x1801dfdd8]
movups xmmword [rax + 0xe], xmm0
movups xmm0, xmmword [0x1801dfdca]
movups xmmword [rax], xmm0
mov qword [rsp + 0xf0], rax
mov qword [rsp + 0xf8], 0x1e
mov qword [rsp + 0x100], 0x1e
mov rcx, qword [0x18021a960]
test rcx, rcx
jne 0x180105937
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x1801095bb
mov rcx, rax
mov qword [0x18021a960], rax
mov r8d, 5
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x1801095bb
mov edi, ebp
and dil, 1
lea r8, [rsp + 0x3c0]
mov byte [rax + 4], 0x30
mov dword [rax], 0x5f746f74
mov qword [rsp + 0x430], rax
mov qword [rsp + 0x438], 5
mov qword [rsp + 0x440], 5
lea rbx, [rsp + 0xf0]
lea rdx, [rsp + 0x268]
lea r9, [rsp + 0x430]
mov rcx, rbx
call fcn.180110c20
lea rcx, [rsp + 0x378]
mov edx, edi
call fcn.18010c030
mov rax, qword [rsp + 0x3f8]
test rax, rax
je 0x180105ae3
mov r14, qword [rsp + 0x3e8]
add r14, 0x48
imul r13, rax, 0x70
xor esi, esi
lea rbp, [rsp + 0xb0]
lea r12, [0x18002b500]
lea rdi, [rsp + 0x1c0]
lea r15, [rsp + 0x430]
nop word [rax + rax]
mov qword [rsp + 0xb0], rsi
inc rsi
mov qword [rsp + 0xf0], rbp
mov qword [rsp + 0xf8], r12
lea rax, [0x1801dfe00]
mov qword [rsp + 0x430], rax
mov qword [rsp + 0x438], 2
mov qword [rsp + 0x450], 0
mov qword [rsp + 0x440], rbx
mov qword [rsp + 0x448], 1
mov rcx, rdi
mov rdx, r15
call fcn.18001e000
mov qword [rsp + 0x80], rbp
mov qword [rsp + 0x88], r12
lea rax, str.description___is_deprecated__use_DisplayP_
mov qword [rsp + 0x430], rax
mov qword [rsp + 0x438], 2
mov qword [rsp + 0x450], 0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x440], rax
mov qword [rsp + 0x448], 1
mov rcx, rbx
mov rdx, r15
call fcn.18001e000
mov rcx, rdi
lea rdx, [rsp + 0x268]
mov r8, r14
mov r9, rbx
call fcn.180110c20
add r14, 0x70
add r13, 0xffffffffffffff90
jne 0x180105a00
cmp qword [rsp + 0x268], 0
mov rsi, qword [rsp + 0x48]
lea r12, [rsp + 0x430]
movzx ebp, byte [rsp + 0x50]
je 0x180105bdf
mov rcx, qword [rsp + 0x298]
call sub.pdh.dll_PdhCollectQueryData
mov rdx, qword [rsp + 0x3c0]
test rdx, rdx
je 0x180105b50
mov r8, qword [rsp + 0x3d0]
lea rcx, [rsp + 0x268]
call fcn.1801114b0
test eax, eax
je 0x180105bc2
movss xmm1, dword [0x18018cdd4]
subss xmm1, xmm0
movss dword [rsp + 0x3e0], xmm1
mov edx, ebp
and dl, 1
lea rcx, [rsp + 0x378]
call fcn.18010c030
mov rax, qword [rsp + 0x3f8]
test rax, rax
je 0x180105bc6
mov rsi, qword [rsp + 0x3e8]
imul rbx, rax, 0x70
xor r14d, r14d
lea rdi, [rsp + 0x268]
movss xmm6, dword [0x18018cdd4]
jmp 0x180105ba7
movaps xmm1, xmm6
subss xmm1, xmm0
movss dword [rsi + r14 + 0x68], xmm1
add r14, 0x70
cmp rbx, r14
je 0x180105bc6
mov rdx, qword [rsi + r14 + 0x48]
test rdx, rdx
je 0x180105b9e
mov r8, qword [rsi + r14 + 0x58]
mov rcx, rdi
call fcn.1801114b0
test eax, eax
jne 0x180105b90
ud2
test bpl, 1
mov rsi, qword [rsp + 0x48]
je 0x180105bdf
cmp byte [rsp + 0x400], 0
je 0x180105e62
cmp byte [rsi + 6], 0
je 0x180105fb4
xor ecx, ecx
xor edx, edx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebp, eax
cmp eax, 2
setb r14b
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov edx, 0xffffffff
xor r8d, r8d
xor r9d, r9d
call sub.ole32.dll_CoInitializeSecurity
test eax, eax
js 0x180105f1b
mov qword [rsp + 0x430], 0
mov qword [rsp + 0x20], r12
lea rcx, [0x180203308]
lea r9, [0x1802032ec]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x180105f1b
mov rbx, qword [rsp + 0x430]
mov qword [rsp + 0x430], 0
lea rcx, str.rootWMI
call sub.oleaut32.dll_SysAllocString
mov rdi, rax
mov rax, qword [rbx]
mov qword [rsp + 0x40], r12
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [rax + 0x18]
mov esi, eax
mov rcx, rdi
call sub.oleaut32.dll_SysFreeString
test esi, esi
js 0x180105f12
mov rsi, qword [rsp + 0x430]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
mov rcx, rsi
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call sub.ole32.dll_CoSetProxyBlanket
test eax, eax
js 0x180105f04
mov qword [rsp + 0x430], 1
mov qword [rsp + 0x438], rbx
mov qword [rsp + 0x440], 1
mov qword [rsp + 0x448], rsi
mov qword [rsp + 0x450], 0
mov byte [rsp + 0x460], r14b
lea rcx, [rsp + 0xf0]
lea rdx, [rsp + 0x430]
call fcn.180104ad0
mov rax, qword [rsp + 0xf0]
cmp rax, 2
je 0x180105f26
movups xmm0, xmmword [rsp + 0xf8]
movups xmm1, xmmword [rsp + 0x108]
movdqu xmm2, xmmword [rsp + 0x118]
movdqu xmmword [rsp + 0x1e8], xmm2
movups xmmword [rsp + 0x1d8], xmm1
movups xmmword [rsp + 0x1c8], xmm0
mov qword [rsp + 0x1c0], rax
lea rcx, [rsp + 0x430]
lea rdx, [rsp + 0x1c0]
mov r8b, 1
call fcn.180104bc0
mov r12, qword [rsp + 0x1c0]
mov r14, qword [rsp + 0x1c8]
mov rdi, qword [rsp + 0x1d0]
mov rbx, qword [rsp + 0x1d8]
mov r13, qword [rsp + 0x1e0]
mov r15, qword [rsp + 0x1e8]
movzx esi, byte [rsp + 0x1f0]
mov ebp, dword [rsp + 0x434]
cmp ebp, 2
jne 0x1801062de
test r13, r13
je 0x180105e2e
test r15, r15
je 0x180105e2e
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 0x10]
test rdi, rdi
je 0x180105e41
test rbx, rbx
je 0x180105e41
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
test r12, r12
je 0x180105e54
test r14, r14
je 0x180105e54
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x10]
test sil, sil
jne 0x180105f20
jmp 0x180105f26
mov rbx, qword [rsp + 0x3f8]
lea rcx, [rsp + 0x430]
mov rdx, rbx
call fcn.180110950
mov rsi, qword [rsp + 0x3e8]
mov r8, qword [rsp + 0x430]
mov rax, qword [rsp + 0x438]
test rbx, rbx
je 0x180105ede
mov rcx, qword [rsp + 0x440]
test rcx, rcx
je 0x180105ede
lea rcx, [rcx*8 - 8]
imul rdx, rbx, 0x70
add rdx, 0xffffffffffffff90
xor r9d, r9d
xor r10d, r10d
nop word [rax + rax]
mov r11, qword [r8 + r10]
mov qword [rsi + r9 + 0x60], r11
cmp rdx, r9
je 0x180105ede
lea r11, [r10 + 8]
add r9, 0x70
cmp rcx, r10
mov r10, r11
jne 0x180105ec0
test rax, rax
je 0x180105ef2
mov rcx, qword [0x18021a960]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
je 0x180105f93
mov rax, qword [rsi + 0x60]
jmp 0x180105f95
test rsi, rsi
je 0x180105f12
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x10]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
cmp ebp, 2
jae 0x180105f26
call qword [sym.imp.ole32.dll_CoUninitialize]
mov esi, 8
xor r14d, r14d
mov rdi, qword [rsp + 0x330]
mov r15, qword [rsp + 0x340]
test r15, r15
je 0x180106408
mov r12, qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, rdi
jmp 0x180105f6d
add rbx, 0x60
dec r15
je 0x180106408
cmp qword [rbx + 0x48], 0
je 0x180105f84
mov r8, qword [rbx + 0x40]
mov rcx, qword [0x18021a960]
xor edx, edx
call r12
cmp dword [rbx], 2
je 0x180105f60
mov rcx, rbx
call fcn.180104da0
jmp 0x180105f60
xor eax, eax
mov rsi, qword [rsp + 0x48]
mov qword [rsp + 0x3d8], rax
mov byte [rsp + 0x400], 1
cmp byte [rsi + 6], 0
jne 0x180105be9
cmp byte [rsi + 5], 0
je 0x18010643d
mov rax, qword [rsp + 0x340]
test rax, rax
je 0x18010643d
mov rsi, qword [rsp + 0x330]
lea r15, [rsp + 0x461]
shl rax, 5
lea rbp, [rax + rax*2]
mov r14, qword [sym.imp.ole32.dll_CoInitializeEx]
lea rdi, [rsp + 0xf0]
xorps xmm6, xmm6
jmp 0x18010600e
add rsi, 0x60
add rbp, 0xffffffffffffffa0
je 0x18010643d
mov rax, qword [rsi]
cmp rax, 2
jne 0x180106170
xor ecx, ecx
xor edx, edx
call r14
mov ebx, eax
cmp eax, 2
setb r12b
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov edx, 0xffffffff
xor r8d, r8d
xor r9d, r9d
call sub.ole32.dll_CoInitializeSecurity
test eax, eax
js 0x1801061f0
mov qword [rsp + 0xf0], 0
mov qword [rsp + 0x20], rdi
lea rcx, [0x180203308]
xor edx, edx
mov r8d, 1
lea r9, [0x1802032ec]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x1801061f0
mov r14, r15
mov r13, qword [rsp + 0xf0]
mov qword [rsp + 0xf0], 0
lea rcx, str.rootWMI
call sub.oleaut32.dll_SysAllocString
mov rcx, rdi
mov rdi, rax
mov rax, qword [r13]
mov qword [rsp + 0x40], rcx
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov rcx, r13
mov rdx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [rax + 0x18]
mov r15d, eax
mov rcx, rdi
call sub.oleaut32.dll_SysFreeString
test r15d, r15d
js 0x18010627f
mov rdi, qword [rsp + 0xf0]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
mov rcx, rdi
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call sub.ole32.dll_CoSetProxyBlanket
test eax, eax
mov r15, r14
js 0x1801062a9
mov eax, 1
mov ecx, 1
xor edx, edx
mov r14, qword [sym.imp.ole32.dll_CoInitializeEx]
jmp 0x180106185
mov r13, qword [rsi + 8]
mov rcx, qword [rsi + 0x10]
mov rdi, qword [rsi + 0x18]
mov rdx, qword [rsi + 0x20]
movzx r12d, byte [rsi + 0x30]
mov r8, qword [rsi + 0x28]
mov qword [rsp + 0x430], rax
mov qword [rsp + 0x438], r13
mov qword [rsp + 0x440], rcx
mov qword [rsp + 0x448], rdi
mov qword [rsp + 0x450], rdx
mov qword [rsp + 0x458], r8
mov byte [rsp + 0x460], r12b
mov eax, dword [rsi + 0x31]
mov ecx, dword [rsi + 0x34]
mov dword [r15 + 3], ecx
mov dword [r15], eax
lea rdi, [rsp + 0xf0]
mov rcx, rdi
lea rdx, [rsp + 0x430]
call fcn.180104ad0
jmp 0x180106207
cmp ebx, 2
jae 0x1801061fb
call qword [sym.imp.ole32.dll_CoUninitialize]
mov qword [rsp + 0xf0], 2
mov rax, qword [rsp + 0x120]
mov qword [rsi + 0x30], rax
movups xmm0, xmmword [rsp + 0xf0]
movups xmm1, xmmword [rsp + 0x100]
movdqu xmm2, xmmword [rsp + 0x110]
movdqu xmmword [rsi + 0x20], xmm2
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
cmp dword [rsi], 2
je 0x180106000
mov rcx, rdi
mov rdx, rsi
xor r8d, r8d
call fcn.180104bc0
cmp dword [rsp + 0xf4], 2
je 0x180106000
movss xmm0, dword [rsp + 0xf0]
movss dword [rsi + 0x58], xmm0
ucomiss xmm0, dword [rsi + 0x5c]
jbe 0x180106000
movss dword [rsi + 0x5c], xmm0
jmp 0x180106000
mov rax, qword [r13]
mov rcx, r13
call qword [rax + 0x10]
cmp ebx, 2
mov r15, r14
mov r14, qword [sym.imp.ole32.dll_CoInitializeEx]
lea rdi, [rsp + 0xf0]
jb 0x1801061f5
jmp 0x1801061fb
test rdi, rdi
mov r14, qword [sym.imp.ole32.dll_CoInitializeEx]
je 0x1801062be
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov rax, qword [r13]
mov rcx, r13
call qword [rax + 0x10]
cmp ebx, 2
lea rdi, [rsp + 0xf0]
jb 0x1801061f5
jmp 0x1801061fb
mov qword [rsp + 0x60], rdi
mov byte [rsp + 0x50], sil
movss xmm6, dword [rsp + 0x430]
movd xmm7, dword [rsp + 0x438]
mov rcx, qword [0x18021a960]
test rcx, rcx
jne 0x18010631f
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x1801095dd
mov rcx, rax
mov qword [0x18021a960], rax
mov esi, 8
mov r8d, 8
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x1801095dd
mov rdi, rax
lea rax, [rsp + 0x1f1]
movabs rcx, 0x72657475706d6f43
mov qword [rdi], rcx
mov ecx, dword [rax]
mov eax, dword [rax + 3]
mov dword [rsp + 0xf3], eax
mov dword [rsp + 0xf0], ecx
cmp r12, 3
je 0x180105f2b
mov ecx, 0x60
mov edx, 8
call fcn.18001d980
test rax, rax
je 0x1801095ee
mov rsi, rax
mov qword [rax], r12
mov qword [rax + 8], r14
mov rax, qword [rsp + 0x60]
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rbx
mov qword [rsi + 0x20], r13
mov qword [rsi + 0x28], r15
movzx eax, byte [rsp + 0x50]
mov byte [rsi + 0x30], al
mov eax, dword [rsp + 0xf0]
mov ecx, dword [rsp + 0xf3]
mov dword [rsi + 0x31], eax
mov dword [rsi + 0x34], ecx
mov dword [rsi + 0x38], ebp
movd dword [rsi + 0x3c], xmm7
mov qword [rsi + 0x40], rdi
mov qword [rsi + 0x48], 8
mov qword [rsi + 0x50], 8
movss dword [rsi + 0x58], xmm6
movss dword [rsi + 0x5c], xmm6
mov r14d, 1
mov rdi, qword [rsp + 0x330]
mov r15, qword [rsp + 0x340]
test r15, r15
jne 0x180105f47
cmp qword [rsp + 0x338], 0
je 0x180106425
mov rcx, qword [0x18021a960]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x330], rsi
mov qword [rsp + 0x338], r14
mov qword [rsp + 0x340], r14
mov rsi, qword [rsp + 0x48]
cmp byte [rsi + 1], 0
je 0x18010650f
mov qword [rsp + 0x80], 0
lea rcx, [rsp + 0x80]
call sub.iphlpapi.dll_GetIfTable2
test eax, eax
jne 0x180107828
mov rax, qword [rsp + 0x2f0]
test rax, rax
je 0x1801066a1
mov rcx, qword [rsp + 0x2d8]
lea rdx, [rcx + 0x10]
movdqa xmm0, xmmword [rcx]
pmovmskb r8d, xmm0
not r8d
jmp 0x1801064cf
lea r9d, [r8 - 1]
and r9d, r8d
tzcnt r8d, r8d
mov r10, r8
neg r10
shl r8, 3
shl r10, 7
sub r10, r8
mov byte [rcx + r10 - 2], 0
mov r8d, r9d
dec rax
je 0x1801066a1
test r8w, r8w
jne 0x1801064a0
nop word cs:[rax + rax]
movdqa xmm0, xmmword [rdx]
pmovmskb r8d, xmm0
add rcx, 0xfffffffffffff780
add rdx, 0x10
cmp r8w, 0xffff
je 0x1801064e0
mov r10d, 0xfffffffe
sub r10d, r8d
not r8d
mov r9d, r8d
and r9d, r10d
jmp 0x1801064a7
cmp byte [rsi], 0
je 0x180107828
lea rcx, [rsp + 0x430]
mov r8d, 0x548
xor edx, edx
call fcn.1801723c0
mov rdi, qword [rsp + 0x2f0]
test rdi, rdi
je 0x180106ade
mov rbx, qword [rsp + 0x2d8]
lea r14, [rbx + 0x10]
movdqa xmm0, xmmword [rbx]
pmovmskb eax, xmm0
not eax
lea rsi, [rsp + 0x430]
mov r15, 0xffffffffffffffff
jmp 0x18010657b
mov eax, ebp
test rdi, rdi
je 0x180106ade
test ax, ax
je 0x180106590
lea ebp, [rax - 1]
and ebp, eax
jmp 0x1801065b7
movdqa xmm0, xmmword [r14]
pmovmskb eax, xmm0
add rbx, 0xfffffffffffff780
add r14, 0x10
cmp ax, 0xffff
je 0x180106590
mov ecx, 0xfffffffe
sub ecx, eax
not eax
mov ebp, eax
and ebp, ecx
tzcnt eax, eax
mov r12, rax
neg r12
shl rax, 3
shl r12, 7
sub r12, rax
dec rdi
mov rax, qword [rbx + r12 - 0x70]
mov qword [rsp + 0x430], rax
mov dword [rsp + 0x438], 0
mov rcx, rsi
call sub.iphlpapi.dll_GetIfEntry2
test eax, eax
jne 0x180106570
add r12, rbx
mov rax, qword [r12 - 0x68]
mov rcx, qword [r12 - 0x58]
mov qword [r12 - 0x60], rax
mov rax, qword [rsp + 0x930]
mov qword [r12 - 0x68], rax
mov qword [r12 - 0x50], rcx
mov rax, qword [rsp + 0x8e8]
mov qword [r12 - 0x58], rax
mov rax, qword [r12 - 0x48]
mov qword [r12 - 0x40], rax
mov rax, qword [rsp + 0x8f0]
add rax, qword [rsp + 0x8f8]
cmovb rax, r15
mov qword [r12 - 0x48], rax
mov rax, qword [r12 - 0x38]
mov qword [r12 - 0x30], rax
mov rax, qword [rsp + 0x938]
add rax, qword [rsp + 0x940]
cmovb rax, r15
mov qword [r12 - 0x38], rax
mov rax, qword [r12 - 0x28]
mov qword [r12 - 0x20], rax
mov rax, qword [rsp + 0x908]
mov qword [r12 - 0x28], rax
mov rax, qword [r12 - 0x18]
mov qword [r12 - 0x10], rax
mov rax, qword [rsp + 0x950]
mov qword [r12 - 0x18], rax
jmp 0x180106570
mov eax, dword [0x18021a9d8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xa8], 0
jne 0x1801066c3
call fcn.180045f80
lea rax, [0x1802039e0]
mov qword [rsp + 0x430], rax
xorps xmm6, xmm6
movups xmmword [rsp + 0x438], xmm6
mov qword [rsp + 0x448], 0
mov eax, dword [0x18021a9d8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movdqu xmm0, xmmword [rax + 0xb0]
inc qword [rax + 0xb0]
movdqu xmmword [rsp + 0x450], xmm0
mov qword [rsp + 0x1c0], 8
movups xmmword [rsp + 0x1c8], xmm6
mov rax, qword [rsp + 0x80]
mov edi, dword [rax]
test rdi, rdi
je 0x180107237
mov qword [rsp + 0xe8], rax
lea rbx, [rax + 8]
xor r15d, r15d
mov r12, qword [sym.imp.KERNEL32.dll_HeapAlloc]
pcmpeqd xmm7, xmm7
mov qword [rsp + 0xa8], rbx
mov qword [rsp + 0x50], rdi
jmp 0x18010678c
mov rcx, qword [0x18021a960]
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
inc r15
cmp r15, rdi
je 0x180106af4
imul rsi, r15, 0x548
cmp qword [rbx + rsi + 0x4a8], 0
jne 0x1801067a9
cmp qword [rbx + rsi + 0x4b0], 0
je 0x180106780
cmp dword [rbx + rsi + 0x48c], 2
je 0x180106780
cmp dword [rbx + rsi + 0x420], 0
je 0x180106780
mov rax, qword [0x18021a960]
test rax, rax
jne 0x1801067df
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x180109515
mov qword [0x18021a960], rax
mov r8d, 0x14
mov rcx, rax
xor edx, edx
call r12
test rax, rax
je 0x180109515
mov r13, rax
mov eax, dword [rbx + rsi + 0x10]
movq xmm0, qword [rbx + rsi + 0x14]
punpcklbw xmm0, xmm6
mov dword [r13], eax
movdqu xmmword [r13 + 4], xmm0
mov rax, qword [0x18021a960]
test rax, rax
jne 0x180106833
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x180109515
mov qword [0x18021a960], rax
mov r8d, 0x14
mov rcx, rax
xor edx, edx
call r12
test rax, rax
je 0x180109515
mov r14, rax
mov rdi, r12
mov eax, dword [r13 + 0x10]
mov dword [r14 + 0x10], eax
movups xmm0, xmmword [r13]
movups xmmword [r14], xmm0
mov rcx, qword [rsp + 0x450]
mov rdx, qword [rsp + 0x458]
mov r9d, 0xa
mov r8, r14
call fcn.180104e60
mov rbp, rax
mov rsi, qword [rsp + 0x430]
mov rax, qword [rsp + 0x438]
mov rbx, rbp
shr rbx, 0x39
movd xmm0, ebx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
lea rcx, [rsi - 0x20]
xor edx, edx
mov r8, rbp
and r8, rax
movdqu xmm1, xmmword [rsi + r8]
movdqa xmm2, xmm0
pcmpeqb xmm2, xmm1
pmovmskb r9d, xmm2
test r9d, r9d
jne 0x180106900
pcmpeqb xmm1, xmm7
pmovmskb r9d, xmm1
test r9d, r9d
jne 0x1801069f3
add r8, rdx
add r8, 0x10
add rdx, 0x10
jmp 0x1801068b4
lea r10d, [r9 - 1]
and r10d, r9d
mov r9d, r10d
test r10w, r10w
je 0x1801068cf
tzcnt r12d, r9d
add r12, r8
and r12, rax
mov r10, r12
shl r10, 5
mov r11, rcx
sub r11, r10
cmp qword [r11 + 0x10], 0xa
jne 0x1801068f0
mov r10, qword [r11]
movdqu xmm2, xmmword [r10]
movdqu xmm3, xmmword [r14]
pcmpeqb xmm3, xmm2
movd xmm2, dword [r10 + 0x10]
movd xmm4, dword [r14 + 0x10]
pcmpeqb xmm4, xmm2
pand xmm4, xmm3
pmovmskb r10d, xmm4
cmp r10d, 0xffff
jne 0x1801068f0
neg r12
shl r12, 5
add rsi, r12
mov rcx, qword [0x18021a960]
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, rsi
mov r12, rdi
mov rdi, qword [rsp + 0x50]
mov ecx, dword [rax - 8]
inc ecx
mov dword [rax - 8], ecx
cmp ecx, 1
mov rbx, qword [rsp + 0xa8]
jg 0x180106764
mov rdx, qword [rsp + 0x1d0]
cmp rdx, qword [rsp + 0x1c8]
jne 0x1801069b9
lea rcx, [rsp + 0x1c0]
call fcn.180129870
mov rdx, qword [rsp + 0x1d0]
mov rax, qword [rsp + 0x1c0]
mov rcx, rdx
shl rcx, 5
mov dword [rax + rcx], r15d
mov qword [rax + rcx + 8], r13
mov qword [rax + rcx + 0x10], 0xa
mov qword [rax + rcx + 0x18], 0xa
inc rdx
mov qword [rsp + 0x1d0], rdx
jmp 0x180106780
cmp qword [rsp + 0x440], 0
je 0x180106ab4
and rbp, rax
movdqu xmm0, xmmword [rsi + rbp]
pmovmskb ecx, xmm0
test ecx, ecx
jne 0x180106a37
mov edx, 0x10
nop word [rax + rax]
add rbp, rdx
and rbp, rax
movdqu xmm0, xmmword [rsi + rbp]
pmovmskb ecx, xmm0
add rdx, 0x10
test ecx, ecx
je 0x180106a20
mov r12, rdi
tzcnt ecx, ecx
add rcx, rbp
and rcx, rax
movzx edx, byte [rsi + rcx]
test dl, dl
mov rdi, qword [rsp + 0x50]
js 0x180106a61
movdqa xmm0, xmmword [rsi]
pmovmskb ecx, xmm0
tzcnt ecx, ecx
movzx edx, byte [rsi + rcx]
lea r8, [rcx - 0x10]
and r8, rax
mov byte [rsi + rcx], bl
mov byte [r8 + rsi + 0x10], bl
shl rcx, 5
mov rax, rsi
sub rax, rcx
and dl, 1
movzx edx, dl
sub qword [rsp + 0x440], rdx
neg rcx
mov qword [rsi + rcx - 0x20], r14
mov qword [rax - 0x18], 0xa
mov qword [rax - 0x10], 0xa
mov dword [rax - 8], 0
inc qword [rsp + 0x448]
jmp 0x180106979
lea rcx, [rsp + 0x430]
lea rdx, [rsp + 0x450]
call fcn.180186ed0
mov rsi, qword [rsp + 0x430]
mov rax, qword [rsp + 0x438]
jmp 0x180106a02
mov rsi, qword [rsp + 0x48]
movzx eax, word [rsi + 8]
cmp al, 2
jne 0x180107834
jmp 0x1801082c0
mov rcx, qword [rsp + 0x1c0]
mov rax, qword [rsp + 0x1c8]
mov qword [rsp + 0x408], rax
mov rax, qword [rsp + 0x1d0]
mov r12, rax
shl r12, 5
add r12, rcx
mov qword [rsp + 0x248], rcx
mov r13, rcx
test rax, rax
je 0x1801071e1
mov rsi, qword [rsp + 0xe8]
add rsi, 0x2a
pcmpeqd xmm6, xmm6
mov r13, qword [rsp + 0x248]
mov qword [rsp + 0xe8], rsi
mov qword [rsp + 0x1a8], r12
jmp 0x180106b82
test rdi, rdi
je 0x180106b79
mov rcx, qword [0x18021a960]
xor edx, edx
mov r8, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp r13, r12
je 0x180107215
mov rax, r13
add r13, 0x20
mov rcx, qword [rax + 8]
mov qword [rsp + 0x50], rcx
test rcx, rcx
je 0x1801071e1
mov rdi, qword [rax + 0x10]
mov edx, dword [rax]
cmp qword [rsp + 0x448], 0
mov qword [rsp + 0x1b0], r13
mov qword [rsp + 0x260], rdi
je 0x180106cf0
mov qword [rsp + 0x68], rdx
mov rbx, qword [rax + 0x18]
mov rcx, qword [rsp + 0x450]
mov rdx, qword [rsp + 0x458]
mov r8, qword [rsp + 0x50]
mov r9, rbx
call fcn.180104e60
mov r14, rax
mov rcx, qword [rsp + 0x430]
mov rsi, qword [rsp + 0x438]
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
lea rdi, [rcx - 0x20]
lea r12, [rbx + rbx]
xor r15d, r15d
mov qword [rsp + 0x60], rcx
and r14, rsi
movdqu xmm8, xmmword [rcx + r14]
movdqa xmm0, xmm7
pcmpeqb xmm0, xmm8
pmovmskb r13d, xmm0
test r13d, r13d
jne 0x180106c6f
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x180106fe1
add r14, r15
add r14, 0x10
add r15, 0x10
mov rcx, qword [rsp + 0x60]
jmp 0x180106c1f
lea eax, [r13 - 1]
and eax, r13d
mov r13d, eax
test ax, ax
je 0x180106c3b
tzcnt ebp, r13d
add rbp, r14
and rbp, rsi
mov rcx, rbp
shl rcx, 5
mov rax, rdi
sub rax, rcx
cmp qword [rax + 0x10], rbx
jne 0x180106c60
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x50]
mov r8, r12
call fcn.180172760
test eax, eax
jne 0x180106c60
neg rbp
shl rbp, 5
mov rcx, qword [rsp + 0x60]
add rcx, rbp
lea rax, [rcx - 0x20]
test rcx, rcx
cmove rax, rcx
mov rsi, qword [rsp + 0xe8]
mov rbx, qword [rsp + 0xa8]
mov r12, qword [rsp + 0x1a8]
mov r13, qword [rsp + 0x1b0]
mov rdi, qword [rsp + 0x260]
mov rdx, qword [rsp + 0x68]
jmp 0x180106cf2
xor eax, eax
lea rcx, [rax + 0x18]
test rax, rax
lea rax, [0x1801dfd70]
cmove rcx, rax
cmp dword [rcx], 1
jg 0x180106b60
imul r14, rdx, 0x548
lea r15, [rbx + r14]
lea rdx, [rbx + r14]
add rdx, 0x1c
lea rax, [rsi + r14]
xor r8d, r8d
cmp word [rax + r8*2 - 6], 0
je 0x180106d79
cmp r8, 0x100
je 0x180106d62
cmp word [rax + r8*2 - 4], 0
je 0x180106d6a
cmp word [rax + r8*2 - 2], 0
je 0x180106d6f
cmp word [rax + r8*2], 0
je 0x180106d75
add r8, 4
cmp word [rax + r8*2 - 6], 0
jne 0x180106d30
jmp 0x180106d79
mov r8d, 0x101
jmp 0x180106d86
inc r8
jmp 0x180106d79
add r8, 2
jmp 0x180106d79
add r8, 3
cmp r8, 0x102
jae 0x180105bc2
lea rcx, [rsp + 0xf0]
call fcn.18001e3b0
mov rbp, qword [rsp + 0xf0]
test rbp, rbp
je 0x180106b60
mov qword [rsp + 0x420], r15
mov qword [rsp + 0x250], r14
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x258], rax
mov r14, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x2f8]
mov rdx, qword [rsp + 0x300]
mov r8, rbp
mov r9, r14
call fcn.18007ad30
mov r12, rax
mov rax, qword [rsp + 0x2d8]
mov rsi, qword [rsp + 0x2e0]
mov rcx, r12
shr rcx, 0x39
mov qword [rsp + 0x418], rcx
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
mov qword [rsp + 0x68], rax
lea r15, [rax - 0x88]
xor eax, eax
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x410], r12
and r12, rsi
mov rax, qword [rsp + 0x68]
movdqu xmm8, xmmword [rax + r12]
movdqa xmm0, xmm7
pcmpeqb xmm0, xmm8
pmovmskb ebx, xmm0
test ebx, ebx
jne 0x180106e8c
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x180106fe8
mov rax, qword [rsp + 0x60]
add r12, rax
add r12, 0x10
add rax, 0x10
mov qword [rsp + 0x60], rax
jmp 0x180106e36
lea eax, [rbx - 1]
and eax, ebx
mov ebx, eax
test ax, ax
je 0x180106e55
tzcnt ecx, ebx
add rcx, r12
and rcx, rsi
mov rdi, rcx
neg rdi
shl rcx, 3
mov r13, rdi
shl r13, 7
mov rax, r13
sub rax, rcx
cmp r14, qword [r15 + rax + 0x10]
jne 0x180106e80
add rax, r15
mov rcx, qword [rax]
mov rdx, rbp
mov r8, r14
call fcn.180172760
test eax, eax
jne 0x180106e80
lea rax, [rdi*8]
add rax, r13
mov r8, qword [rsp + 0x68]
mov rcx, qword [r8 + rax - 0x68]
mov rdx, qword [r8 + rax - 0x58]
mov qword [r8 + rax - 0x60], rcx
mov rbx, qword [rsp + 0xa8]
mov r9, qword [rsp + 0x250]
mov rcx, qword [rbx + r9 + 0x500]
mov qword [r8 + rax - 0x68], rcx
mov qword [r8 + rax - 0x50], rdx
mov rcx, qword [rbx + r9 + 0x4b8]
mov qword [r8 + rax - 0x58], rcx
mov rcx, qword [r8 + rax - 0x48]
mov qword [r8 + rax - 0x40], rcx
mov rcx, qword [rbx + r9 + 0x4c0]
add rcx, qword [rbx + r9 + 0x4c8]
mov rdx, 0xffffffffffffffff
cmovb rcx, rdx
mov qword [r8 + rax - 0x48], rcx
mov rcx, qword [r8 + rax - 0x38]
mov qword [r8 + rax - 0x30], rcx
mov rcx, qword [rbx + r9 + 0x508]
add rcx, qword [rbx + r9 + 0x510]
cmovb rcx, rdx
mov qword [r8 + rax - 0x38], rcx
mov rcx, qword [r8 + rax - 0x28]
mov qword [r8 + rax - 0x20], rcx
mov rcx, qword [rbx + r9 + 0x4d8]
mov qword [r8 + rax - 0x28], rcx
mov rcx, qword [r8 + rax - 0x18]
mov qword [r8 + rax - 0x10], rcx
mov rcx, qword [rbx + r9 + 0x520]
mov qword [r8 + rax - 0x18], rcx
mov byte [r8 + rax - 2], 1
cmp qword [rsp + 0x258], 0
mov r12, qword [rsp + 0x1a8]
mov r13, qword [rsp + 0x1b0]
je 0x180106fc5
mov rcx, qword [0x18021a960]
xor edx, edx
mov r8, rbp
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rsp + 0x260], 0
mov rsi, qword [rsp + 0xe8]
jne 0x180106b65
jmp 0x180106b79
xor ecx, ecx
jmp 0x180106cb0
cmp qword [rsp + 0x2e8], 0
mov rdi, qword [rsp + 0xa8]
mov r13, qword [rsp + 0x1b0]
mov r15, qword [rsp + 0x68]
je 0x1801071b7
mov r11, qword [rsp + 0x250]
mov rax, qword [rdi + r11 + 0x4c0]
add rax, qword [rdi + r11 + 0x4c8]
mov rdx, qword [rdi + r11 + 0x4b8]
mov r8, 0xffffffffffffffff
cmovb rax, r8
mov rcx, qword [rdi + r11 + 0x508]
add rcx, qword [rdi + r11 + 0x510]
cmovb rcx, r8
mov r8, qword [rsp + 0x420]
mov r8, qword [r8]
mov qword [rsp + 0x60], r8
mov r10, qword [rdi + r11 + 0x500]
mov r9, qword [rdi + r11 + 0x4d8]
mov r8, qword [rdi + r11 + 0x520]
mov r11, qword [rsp + 0x410]
and r11, rsi
movdqu xmm0, xmmword [r15 + r11]
pmovmskb edi, xmm0
test edi, edi
mov r12, qword [rsp + 0x1a8]
jne 0x1801070b8
mov ebx, 0x10
nop dword [rax]
add r11, rbx
and r11, rsi
movdqu xmm0, xmmword [r15 + r11]
pmovmskb edi, xmm0
add rbx, 0x10
test edi, edi
je 0x1801070a0
tzcnt edi, edi
add rdi, r11
and rdi, rsi
movzx ebx, byte [r15 + rdi]
test bl, bl
js 0x1801070dd
movdqa xmm0, xmmword [r15]
pmovmskb edi, xmm0
tzcnt edi, edi
movzx ebx, byte [r15 + rdi]
lea r11, [rdi - 0x10]
and r11, rsi
mov rsi, qword [rsp + 0x418]
mov byte [r15 + rdi], sil
mov byte [r11 + r15 + 0x10], sil
and bl, 1
movzx esi, bl
sub qword [rsp + 0x2e8], rsi
mov rsi, rdi
neg rsi
shl rdi, 3
shl rsi, 7
sub rsi, rdi
mov qword [r15 + rsi - 0x88], rbp
mov rdi, qword [rsp + 0x258]
mov qword [r15 + rsi - 0x80], rdi
mov qword [r15 + rsi - 0x78], r14
mov r11, qword [rsp + 0x60]
mov qword [r15 + rsi - 0x70], r11
mov qword [r15 + rsi - 0x68], r10
mov qword [r15 + rsi - 0x60], r10
mov qword [r15 + rsi - 0x58], rdx
mov qword [r15 + rsi - 0x50], rdx
mov qword [r15 + rsi - 0x48], rax
mov qword [r15 + rsi - 0x40], rax
mov qword [r15 + rsi - 0x38], rcx
mov qword [r15 + rsi - 0x30], rcx
mov qword [r15 + rsi - 0x28], r9
mov qword [r15 + rsi - 0x20], r9
mov qword [r15 + rsi - 0x18], r8
mov qword [r15 + rsi - 0x10], r8
mov dword [r15 + rsi - 8], 0
mov word [r15 + rsi - 4], 0
mov byte [r15 + rsi - 2], 1
inc qword [rsp + 0x2f0]
mov rbx, qword [rsp + 0xa8]
cmp qword [rsp + 0x260], 0
mov rsi, qword [rsp + 0xe8]
jne 0x180106b65
jmp 0x180106b79
lea rcx, [rsp + 0x2d8]
lea rdx, [rsp + 0x2f8]
call fcn.180187690
mov r15, qword [rsp + 0x2d8]
mov rsi, qword [rsp + 0x2e0]
jmp 0x18010700c
sub r12, r13
je 0x180107215
shr r12, 5
add r13, 0x10
jmp 0x1801071f9
add r13, 0x20
dec r12
je 0x180107215
cmp qword [r13], 0
je 0x1801071f0
mov r8, qword [r13 - 8]
mov rcx, qword [0x18021a960]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1801071f0
cmp qword [rsp + 0x408], 0
je 0x180107237
mov rcx, qword [0x18021a960]
xor edx, edx
mov r8, qword [rsp + 0x248]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x80]
call sub.iphlpapi.dll_FreeMibTable
mov rdi, qword [rsp + 0x438]
test rdi, rdi
je 0x180107332
mov rbx, qword [rsp + 0x448]
test rbx, rbx
je 0x180107301
mov rsi, qword [rsp + 0x430]
movdqa xmm0, xmmword [rsi]
pmovmskb eax, xmm0
not eax
lea r14, [rsi + 0x10]
mov r15, qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12, rsi
jmp 0x180107297
mov eax, ebp
test rbx, rbx
je 0x180107309
test ax, ax
je 0x1801072b0
lea ebp, [rax - 1]
and ebp, eax
jmp 0x1801072d7
movdqa xmm0, xmmword [r14]
pmovmskb eax, xmm0
add r12, 0xfffffffffffffe00
add r14, 0x10
cmp ax, 0xffff
je 0x1801072b0
mov ecx, 0xfffffffe
sub ecx, eax
not eax
mov ebp, eax
and ebp, ecx
tzcnt ecx, eax
shl rcx, 5
mov rax, r12
sub rax, rcx
dec rbx
cmp qword [rax - 0x18], 0
je 0x180107290
mov r8, qword [rax - 0x20]
mov rcx, qword [0x18021a960]
xor edx, edx
call r15
jmp 0x180107290
mov rsi, qword [rsp + 0x430]
mov rax, rdi
shl rax, 5
add rdi, rax
cmp rdi, 0xffffffffffffffcf
je 0x180107332
sub rsi, rax
add rsi, 0xffffffffffffffe0
mov rcx, qword [0x18021a960]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [rsp + 0x2f0]
test rsi, rsi
je 0x1801074a8
mov r13, qword [rsp + 0x2d8]
mov rbx, qword [rsp + 0x2e0]
lea r14, [r13 + 0x10]
movdqa xmm0, xmmword [r13]
pmovmskb ebp, xmm0
not ebp
mov r15, qword [rsp + 0x2e8]
pcmpeqd xmm6, xmm6
mov rdi, r13
mov r12, rsi
jmp 0x180107389
test rsi, rsi
je 0x1801074a8
test bp, bp
je 0x1801073a0
lea eax, [rbp - 1]
and eax, ebp
jmp 0x1801073c7
movdqa xmm0, xmmword [r14]
pmovmskb ebp, xmm0
add rdi, 0xfffffffffffff780
add r14, 0x10
cmp bp, 0xffff
je 0x1801073a0
mov ecx, 0xfffffffe
sub ecx, ebp
not ebp
mov eax, ebp
and eax, ecx
mov ecx, ebp
tzcnt ecx, ecx
mov ebp, eax
mov rax, rcx
neg rax
shl rcx, 3
shl rax, 7
sub rax, rcx
dec rsi
cmp byte [rdi + rax - 2], 0
jne 0x180107380
add rax, rdi
mov rcx, r13
sub rcx, rax
sar rcx, 3
movabs rdx, 0xf0f0f0f0f0f0f0f1
imul rcx, rdx
lea rdx, [rcx - 0x10]
and rdx, rbx
movdqu xmm0, xmmword [r13 + rdx]
pcmpeqb xmm0, xmm6
psllw xmm0, 7
pmovmskb r8d, xmm0
test r8d, r8d
je 0x180107431
bsr r8w, r8w
xor r8d, 0xf
jmp 0x180107436
mov r8w, 0x10
movdqu xmm0, xmmword [r13 + rcx]
pcmpeqb xmm0, xmm6
pmovmskb r9d, xmm0
or r9d, 0x10000
tzcnt r9d, r9d
add r8d, r9d
mov r9b, 0x80
cmp r8w, 0xf
ja 0x18010746d
inc r15
mov qword [rsp + 0x2e8], r15
mov r9b, 0xff
mov byte [r13 + rcx], r9b
mov byte [rdx + r13 + 0x10], r9b
dec r12
mov qword [rsp + 0x2f0], r12
cmp qword [rax - 0x80], 0
je 0x180107380
mov r8, qword [rax - 0x88]
mov rcx, qword [0x18021a960]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180107380
mov dword [rsp + 0xd0], 0x3c00
mov dword [rsp + 0xb0], 0
mov ebx, 4
xor esi, esi
lea r14, [rsp + 0xd0]
nop dword [rax]
dec ebx
je 0x180107776
mov edx, dword [rsp + 0xd0]
mov rcx, rsi
call fcn.1801750e8
test rax, rax
je 0x180107542
mov rdi, rax
mov qword [rsp + 0x20], r14
xor ecx, ecx
mov edx, 0xe
xor r8d, r8d
mov r9, rax
call sub.iphlpapi.dll_GetAdaptersAddresses
mov dword [rsp + 0xb0], eax
mov rsi, rdi
cmp eax, 0x6f
je 0x1801074d0
test eax, eax
jne 0x180107773
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0x100], rdi
xor edi, edi
mov rsi, qword [rsp + 0x48]
test rdi, rdi
jne 0x18010780b
jmp 0x1801075d7
mov rcx, qword [0x18021a960]
test rcx, rcx
jne 0x180107567
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x1801095cc
mov rcx, rax
mov qword [0x18021a960], rax
mov r8d, 0x32
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x1801095cc
mov rdi, rax
movups xmm0, xmmword [0x1801dfef8]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x1801dfee8]
movups xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [str.failed_to_allocate_memory_for_IP_ADAPTER_ADDRESSESGetAdaptersAddresses___failed_with_code]
movdqu xmmword [rax], xmm0
mov word [rax + 0x30], 0x5345
mov rcx, rsi
call fcn.1801750f0
mov qword [rsp + 0xf8], 0x32
mov qword [rsp + 0x100], 0x32
mov rsi, qword [rsp + 0x48]
test rdi, rdi
jne 0x18010780b
movdqu xmm0, xmmword [rsp + 0xf8]
movdqa xmmword [rsp + 0x1c0], xmm0
cmp qword [rsp + 0x2f0], 0
je 0x180109462
mov rax, qword [rsp + 0x2d8]
mov r12, qword [rsp + 0x2e0]
mov qword [rsp + 0x50], rax
lea rdi, [rax - 0x88]
mov rax, qword [rsp + 0x2f8]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x300]
mov qword [rsp + 0xa8], rax
pcmpeqd xmm6, xmm6
nop word cs:[rax + rax]
lea rcx, [rsp + 0x430]
lea rdx, [rsp + 0x1c0]
call fcn.180105000
mov r13, qword [rsp + 0x430]
test r13, r13
je 0x1801094b0
mov rax, qword [rsp + 0x438]
mov qword [rsp + 0x60], rax
mov rbx, qword [rsp + 0x440]
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0xa8]
mov r8, r13
mov r9, rbx
call fcn.18007ad30
mov rbp, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor r14d, r14d
and rbp, r12
mov rax, qword [rsp + 0x50]
movdqu xmm8, xmmword [rax + rbp]
movdqa xmm0, xmm7
pcmpeqb xmm0, xmm8
pmovmskb esi, xmm0
test esi, esi
jne 0x1801076fc
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x180107750
add rbp, r14
add rbp, 0x10
add r14, 0x10
jmp 0x1801076af
lea eax, [rsi - 1]
and eax, esi
mov esi, eax
test ax, ax
je 0x1801076ce
tzcnt eax, esi
add rax, rbp
and rax, r12
mov r15, rax
neg r15
shl rax, 3
shl r15, 7
sub r15, rax
cmp qword [rdi + r15 + 0x10], rbx
jne 0x1801076f0
add r15, rdi
mov rdx, qword [r15]
mov rcx, r13
mov r8, rbx
call fcn.180172760
test eax, eax
jne 0x1801076f0
lea rcx, [rsp + 0x448]
movzx eax, word [rcx + 4]
mov word [r15 + 0x84], ax
mov eax, dword [rcx]
mov dword [r15 + 0x80], eax
cmp qword [rsp + 0x60], 0
je 0x180107640
mov rcx, qword [0x18021a960]
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x180107640
mov rsi, rdi
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x1c0], rax
lea rax, [0x180029570]
mov qword [rsp + 0x1c8], rax
lea rax, [0x1801dff38]
mov qword [rsp + 0x430], rax
mov qword [rsp + 0x438], 1
mov qword [rsp + 0x450], 0
lea rax, [rsp + 0x1c0]
mov qword [rsp + 0x440], rax
mov qword [rsp + 0x448], 1
lea rcx, [rsp + 0xf0]
lea rdx, [rsp + 0x430]
call fcn.18001e000
mov rcx, rsi
call fcn.1801750f0
mov rdi, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0x48]
test rdi, rdi
je 0x1801075d7
cmp qword [rsp + 0xf8], 0
je 0x180107828
mov rcx, qword [0x18021a960]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
movzx eax, word [rsi + 8]
cmp al, 2
je 0x1801082c0
movzx ecx, byte [rsi + 0xa]
shl ecx, 0x10
or eax, ecx
mov word [rsp + 0x70], ax
shr eax, 0x10
mov byte [rsp + 0x72], al
mov rcx, qword [0x18021a960]
test rcx, rcx
jne 0x18010786e
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x18010955b
mov rcx, rax
mov qword [0x18021a960], rax
mov r13d, 0x80000
mov r8d, 0x80000
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x18010955b
mov rsi, rax
lea r12, [rsp + 0x2a8]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], 0x80000
mov qword [rsp + 0xc0], 0
xor edx, edx
lea rbx, [rsp + 0xb0]
lea r15, [rsp + 0x430]
mov rdi, qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov r14d, 0x80000
mov dword [rsp + 0x430], 0
sub r13, rdx
cmp r13, r14
jae 0x180107940
jmp 0x180107929
mov eax, dword [rsp + 0x430]
add r14, r14
lea ecx, [rax + 0x2800]
test eax, eax
cmovne r14, rcx
mov r13, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xc0]
mov dword [rsp + 0x430], 0
sub r13, rdx
cmp r13, r14
jae 0x180107940
mov rcx, rbx
mov r8, r14
call fcn.180181bc0
mov rsi, qword [rsp + 0xb0]
nop dword [rax]
mov ecx, 5
mov rdx, rsi
mov r8d, r14d
mov r9, r15
call rdi
cmp eax, 0xc0000004
je 0x1801078f0
test eax, eax
jne 0x180107a22
mov qword [rsp + 0xc0], r14
mov rcx, qword [0x18021a960]
test rcx, rcx
jne 0x18010798c
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x18010958a
mov rcx, rax
mov qword [0x18021a960], rax
mov r8d, 0xfa0
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x18010958a
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x88], 0x1f4
mov qword [rsp + 0x90], 0
xor edx, edx
lea rdi, [rsp + 0x80]
xor ebx, ebx
jmp 0x1801079fa
mov qword [rax + rdx*8], r14
inc rdx
mov qword [rsp + 0x90], rdx
mov ecx, dword [r14]
add rbx, rcx
test rcx, rcx
je 0x180107a42
lea r14, [rsi + rbx]
cmp rdx, qword [rsp + 0x88]
jne 0x1801079e0
mov rcx, rdi
call fcn.180073ab0
mov rax, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x90]
jmp 0x1801079e0
cmp qword [rsp + 0xb8], 0
je 0x1801082bb
mov rcx, qword [0x18021a960]
xor edx, edx
mov r8, rsi
jmp 0x1801082b5
mov qword [rsp + 0xa0], r12
cmp byte [rsp + 0x70], 0
je 0x180107a6a
lea rcx, [rsp + 0x378]
xor edx, edx
call fcn.18010c030
mov rax, qword [rsp + 0x3f8]
jmp 0x180107a6c
xor eax, eax
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x430], 0
mov rax, qword [0x180219030]
lea rcx, [rsp + 0x430]
call rax
mov rax, qword [rsp + 0x430]
movabs rcx, 0x19db1ded53e7fff
cmp rax, rcx
jle 0x180107ac5
movabs rcx, 0xfe624e212ac18000
add rax, rcx
movabs rcx, 0xd6bf94d5e57a42bd
mul rcx
shr rdx, 0x17
jmp 0x180107ac7
xor edx, edx
mov qword [rsp + 0xd0], rdx
mov rsi, qword [rsp + 0x90]
mov qword [rsp + 0x440], rsi
movdqu xmm0, xmmword [rsp + 0x80]
movdqa xmmword [rsp + 0x430], xmm0
mov qword [rsp + 0x1c0], 8
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x1c8], xmm0
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x448], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x450], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x458], rax
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x460], rax
mov rdi, qword [rsp + 0x438]
cmp rdi, rsi
jb 0x180105bc2
lea r14, [rsp + 0x448]
mov rbx, qword [rsp + 0x430]
mov eax, dword [0x18021a9d8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 0x50]
test rax, rax
je 0x180107b8c
add rax, 0x110
jmp 0x180107b91
call fcn.180075750
mov rax, qword [rax]
mov r9, qword [rax + 0x1f0]
xor eax, eax
cmp rsi, 0xffffffffffffffff
sete al
cmp rax, r9
cmova r9, rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 1
lea rcx, [rsp + 0xf0]
mov rdx, rsi
xor r8d, r8d
call fcn.18010cae0
test rdi, rdi
je 0x180107bed
mov rcx, qword [0x18021a960]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rsp + 0xf0]
mov rax, qword [rsp + 0x100]
test rax, rax
je 0x180107c2b
xor r8d, r8d
mov rcx, rbx
nop dword [rax + rax]
test rcx, rcx
je 0x180107c22
add r8, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
dec rax
jne 0x180107c10
test r8, r8
jne 0x1801094f8
test rbx, rbx
je 0x180107d07
mov r12, qword [sym.imp.KERNEL32.dll_HeapFree]
lea r14, [rsp + 0x1c0]
jmp 0x180107c5c
mov rbx, rsi
test rsi, rsi
je 0x180107d07
mov rsi, qword [rbx + 0x18]
test rsi, rsi
je 0x180107c6d
mov qword [rsi + 0x20], 0
mov rdi, qword [rbx]
mov r13, qword [rbx + 8]
mov r15, qword [rbx + 0x10]
mov rcx, qword [0x18021a960]
xor edx, edx
mov r8, rbx
call r12
test rdi, rdi
je 0x180107d02
mov rax, qword [rsp + 0x1c8]
mov rbx, qword [rsp + 0x1d0]
sub rax, rbx
cmp rax, r15
jb 0x180107cea
imul rcx, rbx, 0x150
add rcx, qword [rsp + 0x1c0]
imul r8, r15, 0x150
mov rdx, rdi
call fcn.180171d20
add rbx, r15
mov qword [rsp + 0x1d0], rbx
test r13, r13
je 0x180107c50
mov rcx, qword [0x18021a960]
xor edx, edx
mov r8, rdi
call r12
jmp 0x180107c50
mov rcx, r14
mov rdx, rbx
mov r8, r15
call fcn.1801887d0
mov rbx, qword [rsp + 0x1d0]
jmp 0x180107ca4
test rsi, rsi
jne 0x180107d77
mov rbx, qword [rsp + 0x1c0]
mov rax, qword [rsp + 0x1c8]
mov qword [rsp + 0x68], rax
mov rax, qword [rsp + 0x1d0]
imul rcx, rax, 0x150
add rcx, rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x60], rbx
test rax, rax
je 0x1801080eb
lea r15, [rsp + 0xf0]
lea r12, [rsp + 0x1c0]
pcmpeqd xmm6, xmm6
mov rbx, qword [rsp + 0x60]
jmp 0x180107e6b
mov rcx, qword [0x18021a960]
xor edx, edx
mov r8, rsi
call r12
mov rsi, rbx
test rbx, rbx
je 0x180107d07
mov rbx, qword [rsi + 0x18]
test rbx, rbx
je 0x180107d88
mov qword [rbx + 0x20], 0
mov r14, qword [rsi + 0x10]
test r14, r14
je 0x180107db4
mov rdi, qword [rsi]
nop word cs:[rax + rax]
mov rcx, rdi
call fcn.18010f0a0
add rdi, 0x150
dec r14
jne 0x180107da0
cmp qword [rsi + 8], 0
je 0x180107d60
mov r8, qword [rsi]
mov rcx, qword [0x18021a960]
xor edx, edx
call r12
jmp 0x180107d60
movzx edx, sil
sub qword [rsp + 0x2b8], rdx
lea rdx, [rcx - 0x10]
and rdx, rax
mov byte [rdi + rcx], r14b
mov byte [rdx + rdi + 0x10], r14b
inc qword [rsp + 0x2c0]
mov rdi, qword [rsp + 0x2a8]
neg rcx
imul r14, rcx, 0x158
mov qword [rdi + r14 - 0x158], r13
mov qword [rdi + r14 - 0x150], rbp
lea rcx, [rdi + r14]
add rcx, 0xfffffffffffffeb8
mov r8d, 0xb8
lea r15, [rsp + 0xf0]
mov rdx, r15
call fcn.180171d20
mov qword [rdi + r14 - 0x90], r13
lea rcx, [rdi + r14]
add rcx, 0xffffffffffffff78
mov r8d, 0x88
mov rdx, r12
call fcn.180171d20
nop word cs:[rax + rax]
cmp rbx, qword [rsp + 0x50]
je 0x180108124
mov rdx, rbx
add rbx, 0x150
mov rbp, qword [rdx]
cmp rbp, 2
je 0x1801080eb
lea rdi, [rdx + 0xc8]
mov r13, qword [rdx + 0xc0]
add rdx, 8
mov r8d, 0xb8
mov rcx, r15
call fcn.180171d20
mov r8d, 0x88
mov rsi, r12
mov rcx, r12
mov rdx, rdi
call fcn.180171d20
mov rcx, qword [rsp + 0x2c8]
mov rdx, qword [rsp + 0x2d0]
mov r8, r13
call fcn.18010f230
mov r15, rax
mov rdi, qword [rsp + 0x2a8]
mov rax, qword [rsp + 0x2b0]
mov r14, r15
shr r14, 0x39
movd xmm0, r14d
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
lea rcx, [rdi - 0x158]
xor edx, edx
mov r8, r15
and r8, rax
movdqu xmm1, xmmword [rdi + r8]
movdqa xmm2, xmm0
pcmpeqb xmm2, xmm1
pmovmskb r9d, xmm2
nop dword [rax]
test r9w, r9w
je 0x180107f50
lea r10d, [r9 - 1]
and r10d, r9d
tzcnt r9d, r9d
add r9, r8
and r9, rax
neg r9
imul r12, r9, 0x158
mov r9d, r10d
cmp qword [rcx + r12], r13
jne 0x180107f20
jmp 0x180107f70
pcmpeqb xmm1, xmm6
pmovmskb r9d, xmm1
test r9d, r9d
jne 0x180107ffc
add r8, rdx
add r8, 0x10
add rdx, 0x10
jmp 0x180107f07
lea rdx, [rdi + r12]
add rdx, 0xfffffffffffffeb0
mov r8d, 0x150
lea rcx, [rsp + 0x430]
call fcn.180171d20
mov qword [rdi + r12 - 0x150], rbp
lea rcx, [rdi + r12]
add rcx, 0xfffffffffffffeb8
mov r8d, 0xb8
lea r15, [rsp + 0xf0]
mov rdx, r15
call fcn.180171d20
mov qword [rdi + r12 - 0x90], r13
lea rcx, [rdi + r12]
add rcx, 0xffffffffffffff78
mov r8d, 0x88
mov r12, rsi
mov rdx, rsi
call fcn.180171d20
cmp qword [rsp + 0x430], 2
je 0x180107e60
lea rcx, [rsp + 0x430]
call fcn.18010f0a0
jmp 0x180107e60
mov rdx, rax
and rdx, r15
movdqu xmm0, xmmword [rdi + rdx]
pmovmskb ecx, xmm0
test ecx, ecx
je 0x180108014
mov r12, rsi
jmp 0x180108037
mov r8d, 0x10
mov r12, rsi
nop dword [rax]
add rdx, r8
and rdx, rax
movdqu xmm0, xmmword [rdi + rdx]
pmovmskb ecx, xmm0
add r8, 0x10
test ecx, ecx
je 0x180108020
tzcnt ecx, ecx
add rcx, rdx
and rcx, rax
movzx esi, byte [rdi + rcx]
test sil, sil
js 0x18010805a
movdqa xmm0, xmmword [rdi]
pmovmskb ecx, xmm0
tzcnt ecx, ecx
movzx esi, byte [rdi + rcx]
and sil, 1
je 0x180107dcc
cmp qword [rsp + 0x2b8], 0
jne 0x180107dcc
lea rcx, [rsp + 0x2a8]
lea rdx, [rsp + 0x2c8]
call fcn.1801888a0
mov rdi, qword [rsp + 0x2a8]
mov rax, qword [rsp + 0x2b0]
and r15, rax
movdqu xmm0, xmmword [rdi + r15]
pmovmskb ecx, xmm0
test ecx, ecx
jne 0x1801080c6
mov edx, 0x10
add r15, rdx
and r15, rax
movdqu xmm0, xmmword [rdi + r15]
pmovmskb ecx, xmm0
add rdx, 0x10
test ecx, ecx
je 0x1801080ae
tzcnt ecx, ecx
add rcx, r15
and rcx, rax
cmp byte [rdi + rcx], 0
js 0x180107dcc
movdqa xmm0, xmmword [rdi]
pmovmskb ecx, xmm0
tzcnt ecx, ecx
jmp 0x180107dcc
mov r8, qword [rsp + 0x50]
mov rax, r8
sub rax, rbx
shr rax, 4
movabs rcx, 0xc30c30c30c30c31
mul rcx
cmp r8, rbx
je 0x180108124
mov rdi, rdx
nop
mov rcx, rbx
call fcn.18010f0a0
add rbx, 0x150
dec rdi
jne 0x180108110
cmp qword [rsp + 0x68], 0
je 0x180108140
mov rcx, qword [0x18021a960]
xor edx, edx
mov r8, qword [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [rsp + 0x2c0]
test rsi, rsi
je 0x180108299
mov rdi, qword [rsp + 0x2a8]
mov rbx, qword [rsp + 0x2b0]
lea r14, [rdi + 0x10]
movdqa xmm0, xmmword [rdi]
pmovmskb eax, xmm0
not eax
mov r15, qword [rsp + 0x2b8]
pcmpeqd xmm6, xmm6
mov r13, rsi
mov rbp, rdi
jmp 0x1801081c0
lea rcx, [rax + rbp]
add rcx, 0xfffffffffffffeb0
mov byte [rdi + rdx], r9b
mov byte [r8 + rdi + 0x10], r9b
dec rsi
mov qword [rsp + 0x2c0], rsi
call fcn.18010f0a0
mov eax, r12d
test r13, r13
je 0x180108299
test ax, ax
je 0x1801081d0
lea r12d, [rax - 1]
and r12d, eax
jmp 0x1801081f9
movdqa xmm0, xmmword [r14]
pmovmskb eax, xmm0
add rbp, 0xffffffffffffea80
add r14, 0x10
cmp ax, 0xffff
je 0x1801081d0
mov ecx, 0xfffffffe
sub ecx, eax
not eax
mov r12d, eax
and r12d, ecx
tzcnt eax, eax
neg rax
imul rax, rax, 0x158
dec r13
cmp byte [rbp + rax - 4], 0
mov byte [rbp + rax - 4], 0
jne 0x1801081b4
mov rdx, rdi
sub rdx, rbp
sub rdx, rax
sar rdx, 3
movabs rcx, 0x82fa0be82fa0be83
imul rdx, rcx
lea r8, [rdx - 0x10]
and r8, rbx
movdqu xmm0, xmmword [rdi + r8]
pcmpeqb xmm0, xmm6
psllw xmm0, 7
pmovmskb ecx, xmm0
test ecx, ecx
je 0x180108258
bsr cx, cx
xor ecx, 0xf
jmp 0x18010825c
mov cx, 0x10
movdqu xmm0, xmmword [rdi + rdx]
pcmpeqb xmm0, xmm6
pmovmskb r9d, xmm0
or r9d, 0x10000
tzcnt r9d, r9d
add ecx, r9d
mov r9b, 0x80
cmp cx, 0xf
ja 0x180108190
inc r15
mov qword [rsp + 0x2b8], r15
mov r9b, 0xff
jmp 0x180108190
cmp qword [rsp + 0xb8], 0
je 0x1801082bb
mov r8, qword [rsp + 0xb0]
mov rcx, qword [0x18021a960]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [rsp + 0x48]
cmp byte [rsi + 2], 0
je 0x180108341
call sub.KERNEL32.dll_GetLogicalDrives
mov dword [rsp + 0x80], eax
test eax, eax
je 0x1801083cc
mov qword [rsp + 0xf0], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0xf8], xmm0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x1c0], rax
movabs rax, 0x2000000000
mov qword [rsp + 0x1c8], rax
mov eax, dword [0x18021a9d8]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 0x50]
test rax, rax
je 0x1801083e1
add rax, 0x110
jmp 0x1801083e6
cmp byte [rsi + 3], 0
je 0x1801085b5
mov rax, qword [rsp + 0x358]
test rax, rax
je 0x1801085b5
mov rdi, qword [rsp + 0x348]
shl rax, 4
lea rbx, [rax + rax*8]
xor r14d, r14d
lea rsi, [rsp + 0x430]
jmp 0x180108390
add r14, 0x90
cmp rbx, r14
je 0x1801085b5
cmp qword [rdi + r14 + 0x78], 0
je 0x180108380
mov qword [rsp + 0x430], 0
mov rcx, qword [rdi + r14 + 0x48]
xor edx, edx
xor r8d, r8d
mov r9, rsi
call sub.KERNEL32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x180108380
mov rax, qword [rsp + 0x430]
mov qword [rdi + r14 + 0x80], rax
jmp 0x180108380
xorps xmm0, xmm0
movaps xmmword [rsp + 0x430], xmm0
mov edi, 8
jmp 0x180108565
call fcn.180075750
mov rax, qword [rax]
mov r9, qword [rax + 0x1f0]
lea rax, [rsp + 0x1c0]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x20
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 1
lea rcx, [rsp + 0x430]
mov edx, 0x20
xor r8d, r8d
call fcn.180109600
mov r14, qword [rsp + 0x430]
mov rax, qword [rsp + 0x440]
test rax, rax
je 0x18010846b
xor r8d, r8d
mov rcx, r14
nop word cs:[rax + rax]
test rcx, rcx
je 0x180108462
add r8, qword [rcx + 0x10]
mov rcx, qword [rcx + 0x18]
dec rax
jne 0x180108450
test r8, r8
jne 0x1801094d3
lea r12, [rsp + 0xf8]
test r14, r14
je 0x180108550
mov r13, qword [sym.imp.KERNEL32.dll_HeapFree]
lea rbx, [rsp + 0xf0]
jmp 0x18010849c
mov r14, rsi
test rsi, rsi
je 0x180108550
mov rsi, qword [r14 + 0x18]
test rsi, rsi
je 0x1801084ad
mov qword [rsi + 0x20], 0
mov r15, qword [r14]
mov rbp, qword [r14 + 8]
mov rdi, qword [r14 + 0x10]
mov rcx, qword [0x18021a960]
xor edx, edx
mov r8, r14
call r13
test r15, r15
je 0x180108547
mov rax, qword [rsp + 0xf8]
mov r14, qword [rsp + 0x100]
sub rax, r14
cmp rax, rdi
jb 0x18010852f
lea rcx, [r14 + r14*8]
shl rcx, 4
add rcx, qword [rsp + 0xf0]
mov rax, rdi
shl rax, 4
lea r8, [rax + rax*8]
mov rdx, r15
call fcn.180171d20
add r14, rdi
mov qword [rsp + 0x100], r14
test rbp, rbp
je 0x180108490
mov rcx, qword [0x18021a960]
xor edx, edx
mov r8, r15
call r13
jmp 0x180108490
mov rcx, rbx
mov rdx, r14
mov r8, rdi
call fcn.1801881c0
mov r14, qword [rsp + 0x100]
jmp 0x1801084e4
test rsi, rsi
jne 0x180108dfb
mov rdi, qword [rsp + 0xf0]
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x430], xmm0
lea rbx, [rsp + 0x350]
mov rsi, qword [rsp + 0x348]
mov rdx, qword [rsp + 0x358]
mov rcx, rsi
call fcn.18010a4f0
cmp qword [rsp + 0x350], 0
je 0x1801085a2
mov rcx, qword [0x18021a960]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x348], rdi
movaps xmm0, xmmword [rsp + 0x430]
movups xmmword [rbx], xmm0
mov rax, qword [rsp + 0x48]
cmp byte [rax + 7], 0
je 0x180108fb7
mov qword [rsp + 0x1c0], 8
xorps xmm6, xmm6
movups xmmword [rsp + 0x1c8], xmm6
mov dword [rsp + 0x5c], 0
mov r14d, 8
xor ebx, ebx
lea rdi, [rsp + 0x5c]
mov r12, qword [sym.imp.KERNEL32.dll_HeapFree]
nop word [rax + rax]
mov qword [rsp + 0x70], 0
mov dword [rsp + 0xe4], 0
mov dword [rsp + 0x1b8], 0
mov qword [rsp + 0x38], rdi
lea rax, [rsp + 0x1b8]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xe4]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xffffffff
xor ecx, ecx
xor edx, edx
mov r8d, 2
lea r9, [rsp + 0x70]
call sub.netapi32.dll_NetUserEnum
mov ebp, eax
cmp eax, 0xea
je 0x18010866b
test ebp, ebp
jne 0x180108e30
mov r15, qword [rsp + 0x70]
mov eax, dword [rsp + 0xe4]
lea rsi, [r15 + rax*8]
mov rax, r15
nop
cmp rax, rsi
je 0x180108dc0
lea r15, [rax + 8]
cmp qword [rax], 0
mov rax, r15
je 0x180108680
mov qword [rsp + 0xa0], 0
mov rdx, qword [r15 - 8]
xor ecx, ecx
mov r8d, 0x17
lea r9, [rsp + 0xa0]
call sub.netapi32.dll_NetUserGetInfo
test eax, eax
je 0x1801086d3
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
je 0x18010867b
call sub.netapi32.dll_NetApiBufferFree
jmp 0x18010867b
mov rcx, qword [rsp + 0xa0]
mov rdi, qword [rcx + 0x20]
test rdi, rdi
je 0x180108891
mov rcx, rdi
call sub.ADVAPI32.dll_IsValidSid
test eax, eax
je 0x1801088a0
mov rcx, rdi
call sub.ADVAPI32.dll_GetLengthSid
test eax, eax
je 0x1801088aa
mov qword [rsp + 0x48], rbx
mov ebx, eax
mov rax, qword [0x18021a960]
test rax, rax
jne 0x180108731
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x180109526
mov qword [0x18021a960], rax
mov rcx, rax
mov edx, 8
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x180109526
mov r13, rax
mov qword [rsp + 0x50], rbx
mov ecx, ebx
mov rdx, rax
mov r8, rdi
call sub.ADVAPI32.dll_CopySid
test eax, eax
je 0x1801088cb
cmp byte [r13], 1
jne 0x180105bc2
mov dword [rsp + 0xd0], 0
mov dword [rsp + 0xb0], 0
mov dword [rsp + 0x80], 8
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, r13
xor r8d, r8d
lea r9, [rsp + 0xd0]
call sub.ADVAPI32.dll_LookupAccountSidW
test eax, eax
jne 0x1801087de
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x1801089d4
mov r14d, dword [rsp + 0xd0]
test r14, r14
je 0x1801088e9
lea rbx, [r14 + r14]
mov rax, qword [0x18021a960]
test rax, rax
jne 0x180108815
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x18010956c
mov qword [0x18021a960], rax
mov rcx, rax
mov edx, 8
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x18010956c
mov rdi, rax
mov dword [rsp + 0xb0], 0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, r13
mov r8, rdi
lea r9, [rsp + 0xd0]
call sub.ADVAPI32.dll_LookupAccountSidW
test eax, eax
jne 0x18010893c
mov rcx, qword [0x18021a960]
xor edx, edx
mov r8, rdi
call r12
jmp 0x1801089d4
lea rdi, [rsp + 0x5c]
call sub.netapi32.dll_NetApiBufferFree
jmp 0x18010867b
lea rdi, [rsp + 0x5c]
jmp 0x1801086bf
mov edx, 1
xor ecx, ecx
mov r8, rdi
call sub.ADVAPI32.dll_CopySid
test eax, eax
lea rdi, [rsp + 0x5c]
je 0x1801086bf
jmp 0x180105bc2
mov rcx, qword [0x18021a960]
xor edx, edx
mov r8, r13
call r12
lea rdi, [rsp + 0x5c]
mov rbx, qword [rsp + 0x48]
jmp 0x1801086bf
mov dword [rsp + 0xb0], 0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov edi, 2
mov r8d, 2
xor ecx, ecx
mov rdx, r13
lea r9, [rsp + 0xd0]
call sub.ADVAPI32.dll_LookupAccountSidW
test eax, eax
je 0x1801089d4
mov r8, 0xffffffffffffffff
nop word cs:[rax + rax]
cmp word [rdi + r8*2 + 2], 0
lea r8, [r8 + 1]
jne 0x180108950
lea rcx, [rsp + 0x430]
mov rdx, rdi
call fcn.18001e3b0
mov rax, qword [rsp + 0x430]
test rax, rax
je 0x180108a26
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x438]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xf0], xmm0
movaps xmm0, xmmword [rsp + 0xf0]
movaps xmmword [rsp + 0x430], xmm0
test r14, r14
je 0x1801089ba
mov rcx, qword [0x18021a960]
xor edx, edx
mov r8, rdi
call r12
movaps xmm0, xmmword [rsp + 0x430]
movaps xmmword [rsp + 0xd0], xmm0
lea rdi, [rsp + 0x5c]
jmp 0x180108a68
mov rdx, qword [r15 - 8]
mov r8, 0xffffffffffffffff
nop
cmp word [rdx + r8*2 + 2], 0
lea r8, [r8 + 1]
jne 0x1801089e0
lea rcx, [rsp + 0x430]
call fcn.18001e3b0
mov rax, qword [rsp + 0x430]
test rax, rax
lea rdi, [rsp + 0x5c]
je 0x180108a56
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x438]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xd0], xmm0
jmp 0x180108a68
movaps xmmword [rsp + 0xf0], xmm6
mov eax, 1
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0xf0]
movaps xmmword [rsp + 0x430], xmm0
test r14, r14
jne 0x1801089ab
jmp 0x1801089ba
movaps xmmword [rsp + 0xd0], xmm6
mov eax, 1
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0xd0]
movaps xmmword [rsp + 0xb0], xmm0
mov rdx, qword [r15 - 8]
mov qword [rsp + 0x78], 0
mov dword [rsp + 0xe0], 0
mov dword [rsp + 0x1bc], 0
lea rax, [rsp + 0x1bc]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xe0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0xffffffff
lea rcx, [0x180203246]
xor r8d, r8d
mov r9d, 1
call sub.netapi32.dll_NetUserGetLocalGroups
test eax, eax
je 0x180108afc
mov qword [rsp + 0xf0], 8
lea rax, [rsp + 0xf8]
movups xmmword [rax], xmm6
jmp 0x180108c4c
mov ebx, dword [rsp + 0xe0]
test rbx, rbx
je 0x180108b51
lea rax, [rbx*8]
lea r14, [rax + rax*2]
mov rax, qword [0x18021a960]
test rax, rax
jne 0x180108b36
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x18010959b
mov qword [0x18021a960], rax
mov rcx, rax
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x180108b56
jmp 0x18010959b
mov edi, 8
mov qword [rsp + 0xf0], rdi
mov qword [rsp + 0xf8], rbx
mov qword [rsp + 0x100], 0
mov r14, qword [rsp + 0x78]
test r14, r14
je 0x180108c8d
mov qword [rsp + 0x60], r13
mov r13d, dword [rsp + 0xe0]
cmp ebx, r13d
jb 0x180108d9b
mov eax, 0
mov ebx, 0
test r13, r13
je 0x180108c3a
lea r13, [r14 + r13*8]
mov rbx, rax
jmp 0x180108bf0
lea rcx, [rsp + 0x438]
movups xmm0, xmmword [rcx]
movaps xmmword [rsp + 0x80], xmm0
lea rcx, [rbx + rbx*2]
mov qword [rdi + rcx*8], rax
movaps xmm0, xmmword [rsp + 0x80]
movups xmmword [rdi + rcx*8 + 8], xmm0
inc rbx
cmp r14, r13
je 0x180108c3a
mov rdx, qword [r14]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rdx + r8*2 + 2], 0
lea r8, [r8 + 1]
jne 0x180108c00
add r14, 8
lea rcx, [rsp + 0x430]
call fcn.18001e3b0
mov rax, qword [rsp + 0x430]
test rax, rax
jne 0x180108bc0
movaps xmmword [rsp + 0x80], xmm6
mov eax, 1
jmp 0x180108bd3
mov qword [rsp + 0x100], rbx
lea rdi, [rsp + 0x5c]
mov r13, qword [rsp + 0x60]
mov rcx, qword [rsp + 0x78]
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x430], rax
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x438], rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x440], rax
test rcx, rcx
je 0x180108cc2
call sub.netapi32.dll_NetApiBufferFree
jmp 0x180108cc2
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x440], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x430], rax
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x438], rax
lea rdi, [rsp + 0x5c]
movaps xmm0, xmmword [rsp + 0xb0]
movaps xmmword [rsp + 0x80], xmm0
mov rax, qword [rsp + 0x430]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0x438]
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0x440]
mov qword [rsp + 0x100], rax
mov rbx, qword [rsp + 0x1d0]
cmp rbx, qword [rsp + 0x1c8]
jne 0x180108d2c
lea rcx, [rsp + 0x1c0]
mov rdx, rbx
call fcn.180141520
mov rbx, qword [rsp + 0x1d0]
mov rcx, qword [rsp + 0x50]
mov r14, qword [rsp + 0x1c0]
lea rax, [rbx + rbx*4]
shl rax, 4
mov qword [r14 + rax], r13
mov qword [r14 + rax + 8], rcx
mov qword [r14 + rax + 0x10], rcx
mov rcx, qword [rsp + 0x48]
mov qword [r14 + rax + 0x18], rcx
movaps xmm0, xmmword [rsp + 0x80]
movups xmmword [r14 + rax + 0x20], xmm0
movaps xmm0, xmmword [rsp + 0xf0]
movups xmmword [r14 + rax + 0x30], xmm0
mov rcx, qword [rsp + 0x100]
mov qword [r14 + rax + 0x40], rcx
mov dword [r14 + rax + 0x48], 0
inc rbx
mov qword [rsp + 0x1d0], rbx
jmp 0x1801086bf
lea rcx, [rsp + 0xf0]
mov rdx, r13
call fcn.180186e00
mov rdi, qword [rsp + 0xf0]
mov rax, qword [rsp + 0x100]
jmp 0x180108ba9
cmp ebp, 0xea
jne 0x180108e30
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x180108600
call sub.netapi32.dll_NetApiBufferFree
jmp 0x180108600
mov rcx, qword [0x18021a960]
xor edx, edx
mov r8, rsi
call r13
mov rsi, rdi
test rdi, rdi
je 0x180108550
mov rdi, qword [rsi + 0x18]
test rdi, rdi
je 0x180108e0c
mov qword [rdi + 0x20], 0
mov rcx, qword [rsi]
mov rdx, qword [rsi + 0x10]
call fcn.18010a4f0
cmp qword [rsi + 8], 0
je 0x180108de0
mov r8, qword [rsi]
mov rcx, qword [0x18021a960]
xor edx, edx
call r13
jmp 0x180108de0
mov rcx, qword [rsp + 0x70]
test rcx, rcx
je 0x180108e3f
call sub.netapi32.dll_NetApiBufferFree
mov dword [rsp + 0x70], 0
mov qword [rsp + 0xb0], 0
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0xb0]
call sub.Secur32.dll_LsaEnumerateLogonSessions
test eax, eax
je 0x180108fff
mov rsi, qword [rsp + 0xb0]
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0x440], rax
movups xmm0, xmmword [rsp + 0x1c0]
movaps xmmword [rsp + 0x430], xmm0
test rsi, rsi
je 0x180108ea2
mov rcx, rsi
call sub.Secur32.dll_LsaFreeReturnBuffer
mov rsi, qword [rsp + 0x360]
mov rdi, qword [rsp + 0x370]
test rdi, rdi
je 0x180108f7b
xor ebx, ebx
jmp 0x180108ec9
cmp rbx, rdi
je 0x180108f7b
lea r14, [rbx + rbx*4]
shl r14, 4
cmp qword [rsi + r14 + 8], 0
je 0x180108eec
lea rax, [rsi + r14]
mov r8, qword [rax]
mov rcx, qword [0x18021a960]
xor edx, edx
call r12
cmp qword [rsi + r14 + 0x20], 0
je 0x180108f05
mov r8, qword [rsi + r14 + 0x18]
mov rcx, qword [0x18021a960]
xor edx, edx
call r12
mov r15, qword [rsi + r14 + 0x40]
test r15, r15
je 0x180108f50
mov r13, qword [rsi + r14 + 0x30]
add r13, 8
jmp 0x180108f29
add r13, 0x18
dec r15
je 0x180108f50
cmp qword [r13], 0
je 0x180108f20
mov r8, qword [r13 - 8]
mov rcx, qword [0x18021a960]
xor edx, edx
call r12
jmp 0x180108f20
inc rbx
cmp qword [rsi + r14 + 0x38], 0
je 0x180108ec0
lea rax, [rsi + r14]
add rax, 0x30
mov r8, qword [rax]
mov rcx, qword [0x18021a960]
xor edx, edx
call r12
jmp 0x180108ec0
cmp qword [rsp + 0x368], 0
je 0x180108f98
mov rcx, qword [0x18021a960]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0x440]
lea rcx, [rsp + 0x360]
mov qword [rcx + 0x10], rax
movaps xmm0, xmmword [rsp + 0x430]
movups xmmword [rcx], xmm0
lea rdx, [rsp + 0x268]
mov r8d, 0x1a0
mov rcx, qword [rsp + 0x428]
call fcn.180171d20
movaps xmm6, xmmword [rsp + 0x980]
movaps xmm7, xmmword [rsp + 0x990]
movaps xmm8, xmmword [rsp + 0x9a0]
add rsp, 0x9b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, qword [rsp + 0xb0]
mov eax, dword [rsp + 0x70]
test rax, rax
je 0x180108e75
lea r15, [rsi + rax*8]
lea rdi, [rsp + 0x80]
xorps xmm6, xmm6
mov qword [rsp + 0x68], r15
jmp 0x180109042
call sub.Secur32.dll_LsaFreeReturnBuffer
add rsi, 8
cmp rsi, r15
je 0x180108e6d
mov qword [rsp + 0x80], 0
mov rcx, rsi
mov rdx, rdi
call sub.Secur32.dll_LsaGetLogonSessionData
mov rcx, qword [rsp + 0x80]
test eax, eax
jne 0x180109138
test rcx, rcx
je 0x180109138
cmp dword [rcx + 0x40], 3
je 0x180109130
movzx r13d, word [rcx + 0x10]
mov rax, qword [rcx + 0x18]
mov qword [rsp + 0x48], rax
mov rdx, qword [rcx + 0x48]
lea rcx, [rsp + 0x430]
call fcn.180105210
mov rbp, qword [rsp + 0x430]
test rbp, rbp
je 0x180109130
mov qword [rsp + 0x60], r13
mov rax, qword [rsp + 0x438]
mov qword [rsp + 0x50], rax
mov r13, qword [rsp + 0x440]
test rbx, rbx
je 0x180109146
mov rax, rbx
shl rax, 4
lea rdi, [rax + rax*4]
xor r15d, r15d
jmp 0x1801090e9
add r15, 0x50
cmp rdi, r15
je 0x180109146
cmp r13, qword [r14 + r15 + 0x10]
jne 0x1801090e0
mov rcx, qword [r14 + r15]
mov rdx, rbp
mov r8, r13
call fcn.180172760
test eax, eax
jne 0x1801090e0
cmp qword [rsp + 0x50], 0
mov r15, qword [rsp + 0x68]
lea rdi, [rsp + 0x80]
je 0x180109130
mov rcx, qword [0x18021a960]
xor edx, edx
mov r8, rbp
call r12
nop word [rax + rax]
mov rcx, qword [rsp + 0x80]
test rcx, rcx
jne 0x180109030
jmp 0x180109035
mov dword [rsp + 0xa0], 0
mov dword [rsp + 0x78], 0
mov dword [rsp + 0xd0], 8
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, rbp
xor r8d, r8d
lea r9, [rsp + 0xa0]
call sub.ADVAPI32.dll_LookupAccountSidW
test eax, eax
jne 0x1801091ab
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x18010933d
mov edi, dword [rsp + 0xa0]
test rdi, rdi
mov qword [rsp + 0xa8], rdi
je 0x180109261
lea r8, [rdi + rdi]
mov rax, qword [0x18021a960]
test rax, rax
jne 0x1801091ef
mov rdi, r8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x18010957b
mov qword [0x18021a960], rax
mov r8, rdi
mov rcx, rax
mov edx, 8
mov rdi, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x18010957b
mov r15, rax
mov dword [rsp + 0x78], 0
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, rbp
mov r8, r15
lea r9, [rsp + 0xa0]
call sub.ADVAPI32.dll_LookupAccountSidW
test eax, eax
jne 0x1801092af
mov rcx, qword [0x18021a960]
xor edx, edx
mov r8, r15
call r12
jmp 0x18010933d
mov dword [rsp + 0x78], 0
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov r15d, 2
mov r8d, 2
xor ecx, ecx
mov rdx, rbp
lea r9, [rsp + 0xa0]
call sub.ADVAPI32.dll_LookupAccountSidW
test eax, eax
je 0x18010933d
mov r8, 0xffffffffffffffff
nop word cs:[rax + rax]
cmp word [r15 + r8*2 + 2], 0
lea r8, [r8 + 1]
jne 0x1801092c0
lea rcx, [rsp + 0x430]
mov rdx, r15
call fcn.18001e3b0
mov rdi, qword [rsp + 0x430]
test rdi, rdi
je 0x180109379
lea rax, [rsp + 0x438]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xf0], xmm0
movaps xmm0, xmmword [rsp + 0xf0]
movaps xmmword [rsp + 0x430], xmm0
cmp qword [rsp + 0xa8], 0
je 0x18010932b
mov rcx, qword [0x18021a960]
xor edx, edx
mov r8, r15
call r12
movaps xmm0, xmmword [rsp + 0x430]
movaps xmmword [rsp + 0xf0], xmm0
jmp 0x1801093b4
mov r8, qword [rsp + 0x60]
shr r8, 1
lea rcx, [rsp + 0x430]
mov rdx, qword [rsp + 0x48]
call fcn.18001e3b0
mov rdi, qword [rsp + 0x430]
test rdi, rdi
je 0x1801093a7
lea rax, [rsp + 0x438]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0xf0], xmm0
jmp 0x1801093b4
movaps xmmword [rsp + 0xf0], xmm6
mov edi, 1
movaps xmm0, xmmword [rsp + 0xf0]
movaps xmmword [rsp + 0x430], xmm0
cmp qword [rsp + 0xa8], 0
jne 0x18010931c
jmp 0x18010932b
movaps xmmword [rsp + 0xf0], xmm6
mov edi, 1
mov r15, qword [rsp + 0x68]
movaps xmm0, xmmword [rsp + 0xf0]
movaps xmmword [rsp + 0x430], xmm0
cmp rbx, qword [rsp + 0x1c8]
jne 0x1801093f3
lea rcx, [rsp + 0x1c0]
mov rdx, rbx
call fcn.180141520
mov r14, qword [rsp + 0x1c0]
mov rbx, qword [rsp + 0x1d0]
lea rax, [rbx + rbx*4]
shl rax, 4
mov qword [r14 + rax], rbp
mov rcx, qword [rsp + 0x50]
mov qword [r14 + rax + 8], rcx
mov qword [r14 + rax + 0x10], r13
mov qword [r14 + rax + 0x18], rdi
movaps xmm0, xmmword [rsp + 0x430]
movups xmmword [r14 + rax + 0x20], xmm0
mov qword [r14 + rax + 0x30], 8
inc rbx
movups xmmword [r14 + rax + 0x38], xmm6
mov dword [r14 + rax + 0x48], 0
mov qword [rsp + 0x1d0], rbx
mov rcx, qword [rsp + 0x80]
lea rdi, [rsp + 0x80]
test rcx, rcx
jne 0x180109030
jmp 0x180109035
lea rsi, [rsp + 0x430]
lea rdi, [rsp + 0x1c0]
mov rbx, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
mov rcx, rsi
mov rdx, rdi
call fcn.180105000
mov r8, qword [rsp + 0x430]
test r8, r8
je 0x1801094b0
cmp qword [rsp + 0x438], 0
je 0x180109480
mov rcx, qword [0x18021a960]
xor edx, edx
call rbx
jmp 0x180109480
mov rcx, qword [rsp + 0x1c0]
call fcn.1801750f0
mov rsi, qword [rsp + 0x48]
movzx eax, word [rsi + 8]
cmp al, 2
jne 0x180107834
jmp 0x1801082c0
lea rcx, [rsp + 0xf0]
xor edx, edx
call fcn.1801881c0
lea r12, [rsp + 0xf8]
test r14, r14
jne 0x18010847c
jmp 0x180108550
lea rcx, [rsp + 0x1c0]
xor edx, edx
call fcn.1801887d0
test rbx, rbx
jne 0x180107c34
jmp 0x180107d07
mov ecx, 2
mov edx, 0x14
call fcn.18017f950
ud2
mov ecx, 1
jmp 0x180109571
mov ecx, 0x56410
call fcn.18004ca00
ud2
mov ecx, 1
mov edx, 9
call fcn.18017f950
ud2
mov ecx, 8
mov edx, 0x120
call fcn.18017f950
ud2
mov ecx, 1
mov edx, 0x80000
call fcn.18017f950
ud2
mov ecx, 2
mov rdx, rbx
call fcn.18017f950
ud2
mov ecx, 2
mov rdx, rdi
call fcn.18017f950
ud2
mov ecx, 8
mov edx, 0xfa0
call fcn.18017f950
ud2
mov ecx, 8
mov rdx, r14
call fcn.18017f950
ud2
mov ecx, 1
mov edx, 0x1e
call fcn.18017f950
ud2
mov ecx, 1
mov edx, 5
call fcn.18017f950
ud2
mov ecx, 1
mov edx, 0x32
call fcn.18017f950
ud2
mov ecx, 1
mov edx, 8
call fcn.18017f950
ud2
mov ecx, 8
mov edx, 0x60
call fcn.18017f950
ud2