Function at 0x1400a51eb
Capabilities:
Get disk information
Get local ipv4 addresses
Get logon sessions
Get memory capacity
List groups for user account
List user accounts

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x478
movaps xmmword [rsp + 0x460], xmm7
movaps xmmword [rsp + 0x450], xmm6
mov qword [rsp + 0x150], rcx
call fcn.14002dc75
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x48], rdx
lea rsi, [rsp + 0x50]
mov edx, 0x158
mov r8d, 0x1f4
mov rcx, rsi
call fcn.1400caf03
mov r14, qword [rsi + 8]
test r14, r14
je 0x1400a5267
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x1a0], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x158], rax
mov r15, qword [rsp + 0x68]
jmp 0x1400a527c
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x158], rax
mov r15, qword [rsp + 0x68]
xor r14d, r14d
mov ecx, 9
xor edx, edx
call fcn.140054d98
mov rbp, rax
mov r12, rdx
movabs rax, 0x5043206c61746f54
mov qword [rbp], rax
mov byte [rbp + 8], 0x55
mov ecx, 0x120
mov edx, 8
call fcn.1400c8c51
test rax, rax
je 0x1400a7409
mov rbx, rax
call fcn.14002dc75
mov rdi, rax
mov r13, rdx
call fcn.1400c2080
mov r8d, edx
lea rsi, [rsp + 0x50]
mov rcx, rsi
mov edx, eax
call fcn.1400c2110
cmp qword [rsi], 0
je 0x1400a52e7
xor esi, esi
jmp 0x1400a5305
mov rsi, qword [rsp + 0x58]
call sub.kernel32.dll_GetTickCount64
xor r8d, r8d
mov ecx, 0x3e8
xor edx, edx
div rcx
sub rsi, rax
cmovb rsi, r8
xorps xmm6, xmm6
movups xmmword [rsp + 0x3d0], xmm6
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x240], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x248], rax
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x250], rax
mov qword [rsp + 0x258], r14
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x260], rax
mov qword [rsp + 0x268], r15
movups xmmword [rsp + 0x270], xmm6
movups xmmword [rsp + 0x280], xmm6
mov qword [rsp + 0x290], rbp
mov qword [rsp + 0x298], r12
mov qword [rsp + 0x2a0], 9
and qword [rsp + 0x2a8], 0
mov eax, 1
mov qword [rsp + 0x2c0], rax
movups xmmword [rsp + 0x2c8], xmm6
mov qword [rsp + 0x2d8], rax
movups xmmword [rsp + 0x2e0], xmm6
movups xmmword [rsp + 0x2ec], xmm6
mov eax, 8
mov qword [rsp + 0x300], rax
movups xmmword [rsp + 0x308], xmm6
mov byte [rsp + 0x318], 0
mov qword [rsp + 0x320], rax
movups xmmword [rsp + 0x328], xmm6
mov qword [rsp + 0x338], rbx
mov qword [rsp + 0x340], 2
and qword [rsp + 0x348], 0
and qword [rsp + 0x378], 0
mov qword [rsp + 0x390], rdi
mov qword [rsp + 0x398], r13
and qword [rsp + 0x3a0], 0
lea r14, [0x140125fa0]
mov qword [rsp + 0x3a8], r14
movups xmmword [rsp + 0x3b0], xmm6
mov qword [rsp + 0x3c0], rsi
mov qword [rsp + 0x3c8], rax
lea rsi, [rsp + 0xc0]
movaps xmmword [rsi], xmm6
movaps xmmword [rsi + 0x30], xmm6
movaps xmmword [rsi + 0x20], xmm6
movaps xmmword [rsi + 0x10], xmm6
mov dword [rsi], 0x40
mov rcx, rsi
call sub.kernel32.dll_GlobalMemoryStatusEx
movdqu xmm0, xmmword [rsi + 8]
movdqu xmmword [rsp + 0x270], xmm0
lea r13, [rsp + 0x50]
movaps xmmword [r13 + 0x50], xmm6
movaps xmmword [r13 + 0x40], xmm6
movaps xmmword [r13 + 0x30], xmm6
movaps xmmword [r13 + 0x20], xmm6
movaps xmmword [r13 + 0x10], xmm6
movaps xmmword [r13], xmm6
and qword [r13 + 0x60], 0
mov rcx, r13
mov edx, 0x68
call sub.PSAPI.DLL_GetPerformanceInfo
cmp eax, 1
jne 0x1400a5512
mov rbp, qword [rsp + 0x60]
mov rbx, qword [rsp + 0x70]
xor r8d, r8d
sub rbp, rbx
cmovb rbp, r8
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
mul rbp
mov rbp, rax
mov rsi, 0xffffffffffffffff
cmovo rbp, rsi
mov rdi, qword [rsp + 0x58]
sub rdi, rbx
cmovb rdi, r8
mov rax, rcx
mul rdi
cmovo rax, rsi
mov qword [rsp + 0x280], rbp
mov qword [rsp + 0x288], rax
lea rbx, [rsp + 0x290]
lea rbp, [rsp + 0x350]
cmp qword [rbp + 0x28], 0
jne 0x1400a576e
lea r8, [rsp + 0xc0]
and qword [r8], 0
xor esi, esi
xor ecx, ecx
xor edx, edx
call sub.pdh.dll_PdhOpenQueryA
mov edi, eax
test eax, eax
je 0x1400a554c
jmp 0x1400a5566
mov r15, qword [rsp + 0xc0]
call fcn.14002dc75
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x50], xmm0
mov rsi, r14
and qword [rsp + 0x358], 0
and qword [rsp + 0x370], 0
mov qword [rsp + 0x350], r15
mov qword [rsp + 0x360], rax
mov qword [rsp + 0x368], rdx
mov qword [rsp + 0x378], rsi
movdqa xmm0, xmmword [rsp + 0x50]
movdqu xmmword [rsp + 0x380], xmm0
test edi, edi
jne 0x1400a5765
xor eax, eax
mov qword [rsp + 0x40], rax
mov ecx, 0x23
xor edx, edx
call fcn.140054d98
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rdx
movups xmm0, xmmword [str.Processor__Total___Processor_TimeProcessor____Processor_Time]
movups xmmword [rax], xmm0
movdqu xmm0, xmmword [0x1401256e8]
movdqu xmmword [rax + 0x10], xmm0
mov dword [rax + 0x1f], 0x656d6954
mov qword [rsp + 0xd0], 0x23
lea rdi, [rsp + 0x2a8]
mov ecx, 5
xor edx, edx
call fcn.140054d98
lea r9, [rsp + 0x50]
mov qword [r9], rax
mov qword [r9 + 8], rdx
mov dword [rax], 0x5f746f74
mov byte [rax + 4], 0x30
mov qword [r9 + 0x10], 5
lea rcx, [rsp + 0xc0]
mov rdx, rbp
mov r8, rdi
call fcn.1400ccb74
mov rcx, rbx
mov dl, 1
call fcn.1400ccee8
mov rdi, rax
mov qword [rsp + 0x48], rdx
mov esi, 2
mov ebp, 1
cmp rdi, qword [rsp + 0x48]
je 0x1400a5741
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x1b0], rax
inc rax
mov qword [rsp + 0x40], rax
lea rax, [0x140125718]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rsi
and qword [rsp + 0x60], 0
lea rbx, [rsp + 0x1b0]
mov qword [rsp + 0xc0], rbx
lea r12, [fcn.140022650]
mov qword [rsp + 0xc8], r12
lea r14, [rsp + 0xc0]
mov qword [rsp + 0x70], r14
mov qword [rsp + 0x78], rbp
lea r13, [rsp + 0x160]
mov rcx, r13
lea r15, [rsp + 0x50]
mov rdx, r15
call fcn.1400c81e3
lea rax, str._rustc_8b705839cd656d202e920efa8769cbe43a5ee269librarycore_src_sync_atomic.rsthere_is_no_such_thing_as_an_acquire_release_store
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rsi
and qword [rsp + 0x60], 0
mov qword [rsp + 0x110], rbx
mov qword [rsp + 0x118], r12
lea rax, [rsp + 0x110]
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbp
mov rcx, r14
mov rdx, r15
call fcn.1400c81e3
lea r8, [rdi + 0x18]
mov rcx, r13
lea rdx, [rsp + 0x350]
mov r9, r14
call fcn.1400ccb74
add rdi, 0x70
jmp 0x1400a565d
mov rsi, qword [rsp + 0x378]
lea r13, [rsp + 0x50]
lea r14, [0x140125fa0]
lea rbp, [rsp + 0x350]
lea rbx, [rsp + 0x290]
test rsi, rsi
je 0x1400a5873
mov rcx, qword [rsp + 0x350]
call sub.pdh.dll_PdhCollectQueryData
cmp qword [rsp + 0x2a8], 0
je 0x1400a57a7
lea rdx, [rsp + 0x2a8]
mov rcx, rbp
call fcn.1400ccf0a
test eax, eax
je 0x1400a7415
movd dword [rsp + 0x2f8], xmm0
mov rcx, rbx
mov dl, 1
call fcn.1400ccee8
mov rbx, rax
mov rdi, rdx
cmp rbx, rdi
je 0x1400a57e5
mov rsi, rbx
add rbx, 0x70
cmp qword [rsi + 0x18], 0
je 0x1400a57b7
lea rdx, [rsi + 0x18]
mov rcx, rbp
call fcn.1400ccf0a
test eax, eax
je 0x1400a73ef
movd dword [rsi + 0x68], xmm0
jmp 0x1400a57b7
cmp byte [rsp + 0x318], 0
jne 0x1400a5873
mov r12, r14
mov r15, qword [rsp + 0x310]
lea rdi, [rsp + 0x50]
mov rcx, rdi
mov rdx, r15
call fcn.1400cc366
mov r14, qword [rsp + 0x300]
mov rcx, qword [rdi]
mov rdx, qword [rdi + 8]
mov rax, qword [rdi + 0x10]
shl rax, 3
imul rbp, r15, 0x70
xor edi, edi
mov rbx, r14
test rbp, rbp
je 0x1400a584e
cmp rax, rdi
je 0x1400a584e
mov rsi, qword [rcx + rdi]
mov qword [rbx + 0x60], rsi
add rbx, 0x70
add rdi, 8
add rbp, 0xffffffffffffff90
jmp 0x1400a582e
call fcn.1400068ae
test r15, r15
je 0x1400a585e
mov rax, qword [r14 + 0x60]
jmp 0x1400a5860
xor eax, eax
mov r14, r12
mov qword [rsp + 0x2f0], rax
mov byte [rsp + 0x318], 1
lea r12, [rsp + 0xc0]
mov rcx, r12
call fcn.1400cc64a
cmp dword [r12], 2
je 0x1400a5aa4
mov rax, qword [rsp + 0xf0]
lea rdx, [rsp + 0x50]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0xc0]
movups xmm1, xmmword [rsp + 0xd0]
movups xmm2, xmmword [rsp + 0xe0]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0x160]
mov rcx, rsi
call fcn.1400cc676
cmp qword [rsi], 2
je 0x1400a5aa4
mov rax, qword [rsp + 0x190]
lea rdx, [rsp + 0x50]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x160]
movups xmm1, xmmword [rsp + 0x170]
movups xmm2, xmmword [rsp + 0x180]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0x110]
mov rcx, rsi
call fcn.1400cc6f0
cmp qword [rsi], 2
je 0x1400a5aa4
mov rax, qword [rsp + 0x140]
lea rdx, [rsp + 0x50]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x110]
movups xmm1, xmmword [rsp + 0x120]
movups xmm2, xmmword [rsp + 0x130]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0x1b0]
mov rcx, rsi
call fcn.1400cc782
cmp qword [rsi], 2
je 0x1400a5aa4
mov rax, qword [rsp + 0x1e0]
lea rdx, [rsp + 0x50]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x1b0]
movups xmm1, xmmword [rsp + 0x1c0]
movups xmm2, xmmword [rsp + 0x1d0]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0x1f8]
mov rcx, rsi
call fcn.1400cc847
cmp qword [rsi], 2
je 0x1400a5aa4
mov rax, qword [rsp + 0x228]
lea rdx, [rsp + 0x50]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x1f8]
movups xmm1, xmmword [rsp + 0x208]
movups xmm2, xmmword [rsp + 0x218]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0x3e0]
mov rcx, rsi
call fcn.1400cc8c3
mov rax, qword [rsi]
cmp rax, 2
je 0x1400a5aa4
movups xmm0, xmmword [rsp + 0x3e8]
movups xmm1, xmmword [rsp + 0x3f8]
movups xmm2, xmmword [rsp + 0x408]
lea rsi, [rsp + 0x418]
movups xmmword [rsi + 0x28], xmm2
movups xmmword [rsi + 0x18], xmm1
movups xmmword [rsi + 8], xmm0
mov qword [rsi], rax
lea rdi, [rsp + 0x160]
mov rcx, rdi
mov rdx, rsi
mov r8b, 1
call fcn.1400cc99d
mov rax, qword [rsi + 0x30]
mov qword [rsp + 0x80], rax
movdqu xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmm2, xmmword [rsi + 0x20]
movaps xmmword [rsp + 0x70], xmm2
movaps xmmword [rsp + 0x60], xmm1
movdqa xmmword [rsp + 0x50], xmm0
mov ebx, dword [rdi + 4]
cmp ebx, 2
jne 0x1400a72fb
lea rcx, [rsp + 0x50]
call fcn.1400caa29
mov esi, 8
xor ebp, ebp
mov rcx, qword [rsp + 0x320]
mov rdx, qword [rsp + 0x330]
call fcn.1400ca9df
mov rcx, qword [rsp + 0x320]
mov rdx, qword [rsp + 0x328]
call fcn.1400cab1d
mov qword [rsp + 0x320], rsi
mov qword [rsp + 0x328], rbp
mov qword [rsp + 0x330], rbp
lea rcx, [rsp + 0x100]
and qword [rcx], 0
call sub.iphlpapi.dll_GetIfTable2
test eax, eax
jne 0x1400a6707
lea rbp, [rsp + 0x3a0]
mov rax, qword [rbp]
mov rcx, qword [rbp + 8]
add rax, rcx
inc rax
movdqa xmm0, xmmword [rcx]
pmovmskb edx, xmm0
not edx
mov rbp, qword [rbp + 0x18]
lea rsi, [rsp + 0x50]
mov qword [rsi], rcx
add rcx, 0x10
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], dx
mov qword [rsi + 0x20], rbp
mov rcx, rsi
call fcn.1400cac2d
test rax, rax
je 0x1400a5b59
mov byte [rdx + 0x68], 0
jmp 0x1400a5b46
call fcn.14002dc75
pxor xmm0, xmm0
lea rcx, [rsp + 0x60]
movdqu xmmword [rcx + 0x10], xmm0
mov qword [rcx - 0x10], rax
mov qword [rcx - 8], rdx
and qword [rcx], 0
mov qword [rcx + 8], r14
lea rax, [rsp + 0x1b0]
mov qword [rax], 8
movdqu xmmword [rax + 8], xmm0
mov rbp, qword [rsp + 0x100]
lea rax, [rbp + 8]
mov qword [rsp + 0x40], rax
mov r14d, dword [rbp]
add rbp, 0x18
lea r15, [0x1400cafef]
xor r13d, r13d
cmp r14, r13
je 0x1400a5e1a
cmp qword [rbp + 0x498], 0
jne 0x1400a5bd4
cmp qword [rbp + 0x4a0], 0
je 0x1400a5df2
cmp dword [rbp + 0x47c], 2
je 0x1400a5df2
cmp dword [rbp + 0x410], 0
je 0x1400a5df2
mov ecx, 0x14
mov edx, 2
call fcn.1400c5c02
mov rsi, rax
mov r8d, dword [rbp]
movzx r9d, byte [rbp + 4]
movzx r10d, byte [rbp + 5]
movzx r11d, byte [rbp + 6]
movzx edi, byte [rbp + 7]
movzx eax, byte [rbp + 8]
movzx ecx, byte [rbp + 9]
movzx edx, byte [rbp + 0xa]
movzx ebx, byte [rbp + 0xb]
mov dword [rsi], r8d
mov word [rsi + 4], r9w
mov word [rsi + 6], r10w
mov word [rsi + 8], r11w
mov word [rsi + 0xa], di
mov word [rsi + 0xc], ax
mov word [rsi + 0xe], cx
mov word [rsi + 0x10], dx
mov word [rsi + 0x12], bx
mov ecx, 0xa
xor edx, edx
call fcn.1400c8aef
mov ecx, dword [rsi + 0x10]
mov dword [rax + 0x10], ecx
movdqu xmm0, xmmword [rsi]
movdqu xmmword [rax], xmm0
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], rdx
mov qword [rsp + 0xd0], 0xa
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov r9d, 0xa
mov r8, rax
call fcn.1400ca5d6
mov rdi, rax
mov qword [rsp + 0x110], r12
lea rax, [rsp + 0x110]
mov qword [rsp + 0x160], rax
lea rax, [rsp + 0x60]
mov qword [rsp + 0x168], rax
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov qword [rsp + 0x20], r15
mov r8, rdi
lea r9, [rsp + 0x160]
call fcn.1400c8f96
mov rbx, qword [rsp + 0x68]
test rax, rax
je 0x1400a5d14
test rbx, rbx
je 0x1400a5d14
shl rdx, 5
sub rbx, rdx
mov rcx, qword [rsp + 0xc0]
test rcx, rcx
je 0x1400a5d7d
mov rdx, qword [rsp + 0xc8]
call fcn.14009ade2
jmp 0x1400a5d7d
mov r12, r15
cmp qword [rsp + 0x70], 0
je 0x1400a5e01
movups xmm6, xmmword [rsp + 0xc0]
mov r15, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x60]
mov rdx, rbx
mov r8, rdi
call fcn.1400cac4d
mov rcx, qword [rsp + 0x68]
shl rax, 5
and dl, 1
movzx edx, dl
sub qword [rsp + 0x70], rdx
mov rbx, rcx
sub rbx, rax
movups xmmword [rbx - 0x20], xmm6
neg rax
mov qword [rcx + rax - 0x10], r15
and dword [rbx - 8], 0
inc qword [rsp + 0x78]
mov r15, r12
lea r12, [rsp + 0xc0]
mov eax, dword [rbx - 8]
inc eax
mov dword [rbx - 8], eax
cmp eax, 1
jle 0x1400a5d99
mov edx, 0xa
mov rcx, rsi
call fcn.14009ade2
jmp 0x1400a5df2
mov rdx, qword [rsp + 0x1c0]
cmp rdx, qword [rsp + 0x1b8]
jne 0x1400a5dc0
lea rcx, [rsp + 0x1b0]
call fcn.14009dbde
mov rdx, qword [rsp + 0x1c0]
mov rax, qword [rsp + 0x1b0]
mov rcx, rdx
shl rcx, 5
mov dword [rax + rcx], r13d
mov qword [rax + rcx + 8], rsi
mov ebx, 0xa
mov qword [rax + rcx + 0x10], rbx
mov qword [rax + rcx + 0x18], rbx
inc rdx
mov qword [rsp + 0x1c0], rdx
add rbp, 0x548
inc r13
jmp 0x1400a5bb3
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x50]
call fcn.1400e6b3f
mov rbx, qword [rsp + 0x68]
jmp 0x1400a5d23
mov rax, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0x1b8]
mov qword [rsp + 0x238], rcx
mov r15, qword [rsp + 0x1c0]
shl r15, 5
add r15, rax
lea rdi, [rsp + 0x118]
lea rbx, [0x140125430]
mov qword [rsp + 0x230], rax
lea r14, [rsp + 0x3a0]
cmp rax, r15
je 0x1400a6309
lea r13, [rax + 0x20]
mov esi, dword [rax]
mov r8, qword [rax + 8]
movups xmm0, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x3e0], xmm0
test r8, r8
je 0x1400a6306
mov qword [rsp + 0x110], r8
movdqa xmm0, xmmword [rsp + 0x3e0]
movdqu xmmword [rdi], xmm0
cmp qword [rsp + 0x78], 0
je 0x1400a5f2f
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov r9, qword [rsp + 0x120]
call fcn.1400ca5d6
lea rcx, [rsp + 0x110]
mov qword [rsp + 0x160], rcx
lea rcx, [rsp + 0x160]
mov qword [rsp + 0xc0], rcx
lea rcx, [rsp + 0x60]
mov qword [rsp + 0xc8], rcx
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
lea rbp, [0x1400cc617]
mov qword [rsp + 0x20], rbp
mov r8, rax
mov r9, r12
call fcn.1400c8f96
mov rbp, qword [rsp + 0x68]
shl rdx, 5
neg rdx
test rbp, rbp
lea rcx, [rbp + rdx - 0x20]
cmove rcx, rbp
test rax, rax
cmove rcx, rax
jmp 0x1400a5f31
xor ecx, ecx
lea rax, [rcx + 0x18]
test rcx, rcx
cmove rax, rbx
cmp dword [rax], 1
jg 0x1400a6150
imul rbp, rsi, 0x548
mov rax, qword [rsp + 0x40]
lea rsi, [rax + rbp]
lea rcx, [rax + rbp]
add rcx, 0x1c
xor r8d, r8d
cmp r8, 0x101
je 0x1400a5f76
cmp word [rcx + r8*2], 0
je 0x1400a5f7c
inc r8
jmp 0x1400a5f60
mov r8d, 0x101
mov edx, 0x101
lea r9, str.C:Users_tuxis.cargo_registry_srcgithub.com_1ecc6299db9ec823_sysinfo_0.28.4_srcwindows_network.rs4T
call fcn.1400c8cb8
mov r8, rdx
mov rcx, r12
mov rdx, rax
call fcn.14001e180
cmp qword [rsp + 0xc0], 0
je 0x1400a6149
mov r9, qword [rsp + 0xd0]
mov qword [rsp + 0x170], r9
movdqu xmm0, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0x160], xmm0
movdqa xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], r9
mov rcx, qword [rsp + 0x390]
mov rdx, qword [rsp + 0x398]
mov r8, qword [rsp + 0xc0]
call fcn.1400ca674
mov rdi, rax
mov qword [rsp + 0x418], r12
lea rax, [rsp + 0x418]
mov qword [rsp + 0x1f8], rax
mov qword [rsp + 0x200], r14
mov rcx, qword [rsp + 0x3a0]
mov rdx, qword [rsp + 0x3a8]
lea rax, [0x1400cb074]
mov qword [rsp + 0x20], rax
mov r8, rdi
lea r9, [rsp + 0x1f8]
call fcn.1400c8f96
mov rcx, rdx
mov rdx, qword [rsp + 0x3a8]
test rax, rax
je 0x1400a616d
test rdx, rdx
je 0x1400a616d
neg rcx
imul rdi, rcx, 0x88
mov rcx, qword [rsp + 0xc0]
mov r8, qword [rsp + 0xc8]
mov rsi, qword [rdx + rdi - 0x68]
mov rax, qword [rdx + rdi - 0x58]
mov qword [rdx + rdi - 0x60], rsi
mov rbx, qword [rsp + 0x40]
mov rsi, qword [rbx + rbp + 0x500]
mov qword [rdx + rdi - 0x68], rsi
mov qword [rdx + rdi - 0x50], rax
mov rax, qword [rbx + rbp + 0x4b8]
mov qword [rdx + rdi - 0x58], rax
mov rax, qword [rdx + rdi - 0x48]
mov qword [rdx + rdi - 0x40], rax
mov rax, qword [rbx + rbp + 0x4c0]
add rax, qword [rbx + rbp + 0x4c8]
mov rsi, 0xffffffffffffffff
cmovb rax, rsi
mov qword [rdx + rdi - 0x48], rax
mov rax, qword [rdx + rdi - 0x38]
mov qword [rdx + rdi - 0x30], rax
mov rax, qword [rbx + rbp + 0x508]
add rax, qword [rbx + rbp + 0x510]
cmovb rax, rsi
mov qword [rdx + rdi - 0x38], rax
mov rax, qword [rdx + rdi - 0x28]
mov qword [rdx + rdi - 0x20], rax
mov rax, qword [rbx + rbp + 0x4d8]
mov qword [rdx + rdi - 0x28], rax
mov rax, qword [rdx + rdi - 0x18]
mov qword [rdx + rdi - 0x10], rax
mov rax, qword [rbx + rbp + 0x520]
mov qword [rdx + rdi - 0x18], rax
mov byte [rdx + rdi - 8], 1
test rcx, rcx
je 0x1400a62bd
mov rdx, r8
call fcn.140021595
jmp 0x1400a62bd
lea rbx, [0x140125430]
mov rcx, qword [rsp + 0x110]
mov rdx, qword [rsp + 0x118]
call fcn.14009ade2
mov rax, r13
jmp 0x1400a5e60
mov qword [rsp + 0x48], rsi
cmp qword [rsp + 0x3b0], 0
je 0x1400a62e9
movaps xmm6, xmmword [rsp + 0xc0]
mov rax, qword [rsp + 0x40]
mov rsi, qword [rax + rbp + 0x4c0]
add rsi, qword [rax + rbp + 0x4c8]
mov rcx, 0xffffffffffffffff
cmovb rsi, rcx
mov rbx, qword [rsp + 0xd0]
mov qword [rsp + 0x158], rbx
mov r14, qword [rax + rbp + 0x508]
add r14, qword [rax + rbp + 0x510]
mov r12, qword [rax + rbp + 0x4b8]
cmovb r14, rcx
mov rcx, qword [rsp + 0x48]
mov rcx, qword [rcx]
mov qword [rsp + 0x1a0], rcx
mov rbx, qword [rax + rbp + 0x500]
mov rcx, qword [rax + rbp + 0x4d8]
mov qword [rsp + 0x48], rcx
mov rbp, qword [rax + rbp + 0x520]
mov rcx, qword [rsp + 0x3a0]
mov r8, rdi
call fcn.1400cac4d
mov rcx, qword [rsp + 0x3a8]
neg rax
and dl, 1
movzx edx, dl
sub qword [rsp + 0x3b0], rdx
imul rax, rax, 0x88
movups xmmword [rcx + rax - 0x88], xmm6
mov rdx, qword [rsp + 0x158]
mov qword [rcx + rax - 0x78], rdx
mov rdx, qword [rsp + 0x1a0]
mov qword [rcx + rax - 0x70], rdx
mov qword [rcx + rax - 0x68], rbx
mov qword [rcx + rax - 0x60], rbx
mov qword [rcx + rax - 0x58], r12
mov qword [rcx + rax - 0x50], r12
mov qword [rcx + rax - 0x48], rsi
mov qword [rcx + rax - 0x40], rsi
mov qword [rcx + rax - 0x38], r14
mov qword [rcx + rax - 0x30], r14
lea r14, [rsp + 0x3a0]
mov rdx, qword [rsp + 0x48]
mov qword [rcx + rax - 0x28], rdx
mov qword [rcx + rax - 0x20], rdx
mov qword [rcx + rax - 0x18], rbp
mov qword [rcx + rax - 0x10], rbp
mov byte [rcx + rax - 8], 1
and dword [rcx + rax - 7], 0
and word [rcx + rax - 3], 0
inc qword [rsp + 0x3b8]
lea r12, [rsp + 0xc0]
mov rcx, qword [rsp + 0x110]
mov rdx, qword [rsp + 0x118]
call fcn.14009ade2
mov rax, r13
lea rdi, [rsp + 0x118]
lea rbx, [0x140125430]
jmp 0x1400a5e60
mov rcx, r14
lea rdx, [rsp + 0x390]
call fcn.1400e6ccf
mov rdx, qword [rsp + 0x3a8]
jmp 0x1400a6181
mov rax, r13
sub r15, rax
lea r13, [rsp + 0x50]
test r15, r15
je 0x1400a6330
lea rsi, [rax + 0x20]
mov rcx, qword [rax + 8]
mov rdx, qword [rax + 0x10]
call fcn.14009ade2
add r15, 0xffffffffffffffe0
mov rax, rsi
jmp 0x1400a6311
mov rdx, qword [rsp + 0x238]
test rdx, rdx
je 0x1400a6354
shl rdx, 5
mov r8d, 8
mov rcx, qword [rsp + 0x230]
call fcn.140007750
mov rcx, qword [rsp + 0x100]
call sub.iphlpapi.dll_FreeMibTable
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400a63f0
mov rsi, qword [rsp + 0x78]
test rsi, rsi
je 0x1400a63da
mov rdi, qword [rsp + 0x68]
movdqa xmm0, xmmword [rdi]
pmovmskb eax, xmm0
not eax
lea rbx, [rdi + 0x10]
sub rsi, 1
jae 0x1400a63a9
jmp 0x1400a63d5
movdqa xmm0, xmmword [rbx]
pmovmskb eax, xmm0
not eax
add rdi, 0xfffffffffffffe00
add rbx, 0x10
test ax, ax
je 0x1400a6394
bsf cx, ax
movzx ecx, cx
lea ebp, [rax - 1]
and ebp, eax
shl rcx, 5
mov rax, rdi
sub rax, rcx
mov rcx, qword [rax - 0x20]
mov rdx, qword [rax - 0x18]
call fcn.14009ade2
mov eax, ebp
jmp 0x1400a638c
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov r8d, 0x20
mov r9d, 0x10
call fcn.1400a4ec7
mov rax, qword [rsp + 0x3a0]
mov rcx, qword [rsp + 0x3a8]
add rax, rcx
inc rax
movdqa xmm0, xmmword [rcx]
pmovmskb edx, xmm0
not edx
mov rbp, qword [rsp + 0x3b8]
lea rsi, [rsp + 0x50]
mov qword [rsi], rcx
add rcx, 0x10
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], dx
mov qword [rsi + 0x20], rbp
mov ebx, 0x88
mov rcx, rsi
call fcn.1400ca428
test rax, rax
je 0x1400a647c
mov rdi, rax
cmp byte [rax - 8], 0
jne 0x1400a6439
mov rax, qword [rsp + 0x3a8]
sub rax, rdi
cqo
idiv rbx
mov rcx, r14
mov rdx, rax
call fcn.1400cb1cf
mov rcx, qword [rdi - 0x88]
mov rdx, qword [rdi - 0x80]
call fcn.140021595
jmp 0x1400a6439
mov dword [rsp + 0x1b0], 0x3c00
and dword [rsp + 0x110], 0
mov edi, 3
lea rbx, [rsp + 0x1b0]
sub edi, 1
jb 0x1400a6567
mov ecx, dword [rsp + 0x1b0]
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
je 0x1400a650a
mov rsi, rax
mov qword [rsp + 0x20], rbx
xor ecx, ecx
mov edx, 0xe
xor r8d, r8d
mov r9, rax
call sub.iphlpapi.dll_GetAdaptersAddresses
mov dword [rsp + 0x110], eax
cmp eax, 0x6f
jne 0x1400a64e6
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp 0x1400a649c
test eax, eax
jne 0x1400a655f
mov qword [rsp + 0x168], rsi
mov qword [rsp + 0x170], rsi
and qword [rsp + 0x160], 0
xor ecx, ecx
jmp 0x1400a65be
mov ecx, 0x32
xor edx, edx
call fcn.140054d98
mov rcx, rax
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], rdx
movups xmm0, xmmword [str.failed_to_allocate_memory_for_IP_ADAPTER_ADDRESSESGetAdaptersAddresses___failed_with_code]
movups xmmword [rax], xmm0
movups xmm0, xmmword [0x14012587a]
movups xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [0x14012588a]
movdqu xmmword [rax + 0x20], xmm0
mov word [rax + 0x30], 0x5345
mov qword [rsp + 0x170], 0x32
jmp 0x1400a65be
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
lea rax, [rsp + 0x110]
mov qword [rsp + 0xc0], rax
lea rax, [0x1401258c8]
lea rdx, [rsp + 0x50]
mov qword [rdx], rax
mov eax, 1
mov qword [rdx + 8], rax
and qword [rdx + 0x10], 0
lea rcx, [0x140025280]
mov qword [rsp + 0xc8], rcx
mov qword [rdx + 0x20], r12
mov qword [rdx + 0x28], rax
lea rsi, [rsp + 0x160]
mov rcx, rsi
call fcn.1400c81e3
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400a65d5
mov rdx, qword [rsp + 0x168]
call fcn.140021595
jmp 0x1400a6707
movdqu xmm0, xmmword [rsp + 0x168]
lea rbp, [rsp + 0x1b0]
movdqu xmmword [rbp], xmm0
lea r14, [rsp + 0x68]
lea rsi, [rsp + 0x50]
lea rbx, [0x1400cb243]
lea rdi, [rsp + 0x110]
mov rcx, rsi
mov rdx, rbp
call fcn.1400cc4f4
cmp qword [rsp + 0x50], 0
je 0x1400a66fa
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xd0], rax
movdqu xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0xc0], xmm0
cmp qword [rsp + 0x3b8], 0
je 0x1400a66e0
mov rcx, qword [rsp + 0x390]
mov rdx, qword [rsp + 0x398]
mov r8, qword [rsp + 0xc0]
mov r9, qword [rsp + 0xd0]
call fcn.1400ca674
mov qword [rsp + 0x1f8], r12
lea rcx, [rsp + 0x1f8]
mov qword [rsp + 0x110], rcx
lea rcx, [rsp + 0x3a0]
mov qword [rsp + 0x118], rcx
mov rcx, qword [rsp + 0x3a0]
mov rdx, qword [rsp + 0x3a8]
mov qword [rsp + 0x20], rbx
mov r8, rax
mov r9, rdi
call fcn.1400c8f96
test rax, rax
je 0x1400a66e0
mov rax, qword [rsp + 0x3a8]
test rax, rax
je 0x1400a66e0
neg rdx
imul rcx, rdx, 0x88
movzx edx, word [r14 + 4]
mov word [rax + rcx - 3], dx
mov edx, dword [r14]
mov dword [rax + rcx - 7], edx
mov rcx, qword [rsp + 0xc0]
mov rdx, qword [rsp + 0xc8]
call fcn.140021595
jmp 0x1400a6604
mov rcx, qword [rsp + 0x1b0]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
lea rsi, [rsp + 0x338]
lea rcx, [rsp + 0x240]
mov edx, 0x10101
call fcn.1400cb274
call sub.kernel32.dll_GetLogicalDrives
mov dword [rsp + 0x1f8], eax
test eax, eax
je 0x1400a68d1
mov qword [rsp + 0x110], 8
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x118], xmm0
lea rax, [rsp + 0x1f8]
mov qword [rsp + 0x50], rax
movabs rax, 0x2000000000
mov qword [rsp + 0x58], rax
mov ecx, 0x20
call fcn.1400ca492
mov qword [rsp + 0x38], r13
and dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x20
mov qword [rsp + 0x20], 1
xor ebx, ebx
lea rsi, [rsp + 0x160]
mov edx, 0x20
mov rcx, rsi
xor r8d, r8d
mov r9, rax
call fcn.1400c956a
mov rbp, qword [rsi]
mov r15, qword [rsi + 8]
mov rsi, qword [rsi + 0x10]
mov rax, rbp
mov rcx, rsi
sub rcx, 1
jb 0x1400a67d1
test rax, rax
je 0x1400a67d1
add rbx, qword [rax + 0x20]
mov rax, qword [rax]
jmp 0x1400a67bd
lea rcx, [rsp + 0x110]
mov rdx, rbx
call fcn.1400ca708
lea rdi, [rsp + 0xc8]
mov qword [rdi - 8], rbp
mov qword [rdi], r15
lea r13, [rsp + 0xd0]
mov qword [r13], rsi
lea r15, [rsp + 0x58]
lea rbx, [rsp + 0x50]
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], rdi
mov qword [rsp + 0x60], r13
mov rcx, rbp
mov rdx, rbx
call fcn.1400c625e
test rbp, rbp
je 0x1400a68ba
mov rsi, qword [rbp + 0x10]
movups xmm0, xmmword [rbp + 0x18]
movaps xmmword [rsp + 0x1b0], xmm0
mov rcx, rbp
call fcn.140053520
test rsi, rsi
je 0x1400a68ba
mov qword [rsp + 0x50], rsi
movdqa xmm0, xmmword [rsp + 0x1b0]
movdqu xmmword [r15], xmm0
mov rbp, qword [rsp + 0x60]
lea rcx, [rsp + 0x110]
mov rdx, rbp
call fcn.1400ca708
mov r14, qword [rsp + 0x120]
imul rcx, r14, 0x90
add rcx, qword [rsp + 0x110]
imul r8, rbp, 0x90
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
add r14, rbp
mov qword [rsp + 0x120], r14
and qword [rsp + 0x60], 0
mov rcx, rbx
call fcn.1400c5c46
mov rbp, qword [rsp + 0xc0]
jmp 0x1400a6806
lea rcx, [rsp + 0xc0]
call fcn.1400c94f1
lea rsi, [rsp + 0x338]
jmp 0x1400a68ea
mov qword [rsp + 0x110], 8
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x118], xmm0
mov rcx, rsi
call fcn.1400c5c46
lea rcx, [rsp + 0x110]
mov rax, qword [rcx + 0x10]
mov qword [rsi + 0x10], rax
movdqu xmm0, xmmword [rcx]
movdqu xmmword [rsi], xmm0
lea r13, [rsp + 0x1f8]
mov qword [r13], 8
lea rax, [rsp + 0x1ec]
and dword [rax], 0
xorps xmm6, xmm6
movups xmmword [r13 + 8], xmm6
lea r12, [rsp + 0x168]
lea rbx, [rsp + 0x68]
lea rbp, [rsp + 0x418]
lea r14, [rsp + 0xc0]
and qword [rsp + 0x100], 0
and dword [rsp + 0x1ac], 0
and dword [rsp + 0x1f0], 0
lea rax, [rsp + 0x1ec]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x1f0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1ac]
mov qword [rsp + 0x28], rax
or dword [rsp + 0x20], 0xffffffff
xor ecx, ecx
xor edx, edx
mov r8d, 2
lea r9, [rsp + 0x100]
call sub.netapi32.dll_NetUserEnum
cmp eax, 0xea
je 0x1400a69b5
test eax, eax
jne 0x1400a6c9f
mov dword [rsp + 0x48], eax
mov r15, qword [rsp + 0x100]
mov eax, dword [rsp + 0x1ac]
lea rsi, [r15 + rax*8]
cmp r15, rsi
je 0x1400a6c83
mov rdi, r15
add r15, 8
cmp qword [rdi], 0
je 0x1400a69cc
and qword [rsp + 0x418], 0
mov rdx, qword [rdi]
xor ecx, ecx
mov r8d, 0x17
mov r9, rbp
call sub.netapi32.dll_NetUserGetInfo
test eax, eax
jne 0x1400a6c68
mov rax, qword [rsp + 0x418]
mov rdx, qword [rax + 0x20]
lea rcx, [rsp + 0x1b0]
call fcn.1400c848b
mov rdx, qword [rsp + 0x1b0]
test rdx, rdx
je 0x1400a6c68
lea rcx, [rsp + 0x50]
call fcn.1400cba93
cmp qword [rsp + 0x50], 0
je 0x1400a6a60
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x120], rax
movdqu xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x110], xmm0
jmp 0x1400a6a70
mov rdx, qword [rdi]
lea rcx, [rsp + 0x110]
call fcn.1400c58a2
mov rdx, qword [rdi]
and qword [rsp + 0x3e0], 0
and dword [rsp + 0x10c], 0
and dword [rsp + 0x1f4], 0
lea rax, [rsp + 0x1f4]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x10c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x3e0]
mov qword [rsp + 0x20], rax
or dword [rsp + 0x28], 0xffffffff
lea rcx, [0x140125868]
xor r8d, r8d
mov r9d, 1
call sub.netapi32.dll_NetUserGetLocalGroups
test eax, eax
je 0x1400a6ae7
movups xmmword [r12], xmm6
mov qword [rsp + 0x160], 8
jmp 0x1400a6bf6
mov ebp, dword [rsp + 0x10c]
test rbp, rbp
je 0x1400a6b0e
imul rdi, rbp, 0x18
mov edx, 8
mov rcx, rdi
call fcn.1400c8c51
test rax, rax
jne 0x1400a6b13
jmp 0x1400a73e0
mov eax, 8
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], rbp
and qword [rsp + 0x170], 0
mov rdi, qword [rsp + 0x3e0]
test rdi, rdi
je 0x1400a6b70
mov ebx, dword [rsp + 0x10c]
cmp ebp, ebx
jae 0x1400a6b7d
lea rcx, [rsp + 0x160]
xor edx, edx
mov r8, rbx
call fcn.1400c8d31
mov rcx, rax
call fcn.140007053
mov rax, qword [rsp + 0x160]
mov rbp, qword [rsp + 0x170]
jmp 0x1400a6b7f
lea rbp, [rsp + 0x418]
jmp 0x1400a6c08
xor ebp, ebp
imul r13, rbp, 0x18
add r13, rax
mov qword [rsp + 0x40], rbx
lea rbx, [rbx*8]
xor r12d, r12d
cmp rbx, r12
je 0x1400a6bcc
mov rdx, qword [rdi + r12]
mov rcx, r14
call fcn.1400c58a2
mov rax, qword [rsp + 0xd0]
mov qword [r13 + 0x10], rax
movdqu xmm0, xmmword [rsp + 0xc0]
movdqu xmmword [r13], xmm0
add r13, 0x18
add r12, 8
jmp 0x1400a6b96
add rbp, qword [rsp + 0x40]
mov qword [rsp + 0x170], rbp
lea r13, [rsp + 0x1f8]
lea r12, [rsp + 0x168]
lea rbx, [rsp + 0x68]
lea rbp, [rsp + 0x418]
mov rcx, qword [rsp + 0x3e0]
test rcx, rcx
je 0x1400a6c08
call sub.netapi32.dll_NetApiBufferFree
movups xmm0, xmmword [rsp + 0x1b0]
movaps xmmword [rsp + 0x50], xmm0
mov rax, qword [rsp + 0x1c0]
mov qword [rsp + 0x60], rax
and dword [rsp + 0x98], 0
mov rax, qword [rsp + 0x120]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [rsp + 0x110]
movups xmmword [rbx], xmm0
mov rax, qword [rsp + 0x170]
mov qword [rbx + 0x28], rax
movdqu xmm0, xmmword [rsp + 0x160]
movdqu xmmword [rbx + 0x18], xmm0
mov rcx, r13
lea rdx, [rsp + 0x50]
call fcn.1400cbb61
mov rcx, qword [rsp + 0x418]
test rcx, rcx
je 0x1400a69cc
call sub.netapi32.dll_NetApiBufferFree
jmp 0x1400a69cc
cmp dword [rsp + 0x48], 0xea
jne 0x1400a6c9f
mov rcx, qword [rsp + 0x100]
call fcn.1400cbba2
jmp 0x1400a694a
mov rcx, qword [rsp + 0x100]
call fcn.1400cbba2
lea rcx, [rsp + 0x3e0]
and dword [rcx], 0
lea rdx, [rsp + 0x1b0]
and qword [rdx], 0
call sub.secur32.dll_LsaEnumerateLogonSessions
test eax, eax
je 0x1400a7084
mov rcx, qword [rsp + 0x1b0]
test rcx, rcx
je 0x1400a6ce2
call sub.secur32.dll_LsaFreeReturnBuffer
lea rsi, [rsp + 0x240]
mov rcx, qword [rsi + 0x188]
mov rdx, qword [rsi + 0x198]
call fcn.1400ca992
mov rcx, qword [rsi + 0x188]
mov rdx, qword [rsi + 0x190]
call fcn.1400cab47
mov rax, qword [rsp + 0x208]
lea rcx, [rsp + 0x3c8]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rsp + 0x1f8]
movups xmmword [rcx], xmm0
mov rcx, rsi
mov edx, 0x10101
call fcn.1400cb274
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsi + 0x18]
add rax, rcx
inc rax
movdqa xmm0, xmmword [rcx]
pmovmskb edx, xmm0
not edx
lea rdi, [rsp + 0x50]
mov word [rdi + 0x18], dx
mov qword [rdi], rcx
add rcx, 0x10
mov qword [rdi + 8], rcx
mov qword [rdi + 0x10], rax
mov rax, qword [rsi + 0x28]
mov qword [rdi + 0x20], rax
lea rsi, str.LeagueClientUx.exe
mov rcx, rdi
call fcn.1400cabc3
test rax, rax
je 0x1400a706f
mov rbx, rax
mov rcx, qword [rax - 0x150]
mov rdx, qword [rax - 0x140]
mov r9d, 0x12
mov r8, rsi
call fcn.140020106
test al, al
je 0x1400a6d7b
mov rbp, qword [rbx - 0x138]
mov r12, qword [rbx - 0x128]
mov qword [rsp + 0x20], r12
lea rdx, [0x140120c24]
lea rsi, [rsp + 0x50]
mov r8d, 0x16
mov rcx, rsi
mov r9, rbp
call fcn.1400a742a
mov r15, qword [rsi]
test r15, r15
je 0x1400a7240
lea rbx, [rsp + 0x50]
movzx r13d, byte [rbx + 8]
movzx eax, byte [rbx + 0xf]
shl eax, 0x10
movzx ecx, word [rbx + 0xd]
or ecx, eax
shl rcx, 0x20
mov edi, dword [rbx + 9]
or rdi, rcx
mov r14, qword [rbx + 0x10]
mov qword [rsp + 0x20], r12
lea rdx, [0x140120c3a]
mov r8d, 0x18
mov rcx, rbx
mov r9, rbp
call fcn.1400a742a
mov rbx, qword [rbx]
test rbx, rbx
je 0x1400a7255
lea rsi, [rsp + 0x50]
mov al, byte [rsi + 8]
mov rcx, qword [rsi + 9]
mov qword [rsp + 0x1b9], rcx
mov rcx, qword [rsi + 0x10]
mov qword [rsp + 0x1c0], rcx
mov qword [rsp + 0x1b0], rbx
mov byte [rsp + 0x1b8], al
mov qword [rsp + 0x20], r12
lea rdx, [0x140120c52]
mov r8d, 0xb
mov rcx, rsi
mov r9, rbp
call fcn.1400a742a
mov rax, qword [rsi]
test rax, rax
je 0x1400a726a
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x158], r14
lea rsi, [rsp + 0x50]
movzx eax, byte [rsi + 8]
mov qword [rsp + 0x48], rax
movzx eax, byte [rsi + 0xf]
shl eax, 0x10
movzx ecx, word [rsi + 0xd]
or ecx, eax
shl rcx, 0x20
mov r14d, dword [rsi + 9]
or r14, rcx
mov rax, qword [rsi + 0x10]
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x20], r12
lea rdx, [0x140120c5d]
mov r8d, 0x16
mov rcx, rsi
mov r9, rbp
call fcn.1400a742a
mov rax, qword [rsi]
test rax, rax
je 0x1400a727f
lea rdx, [rsp + 0x50]
mov cl, byte [rdx + 8]
mov rbp, qword [rdx + 9]
mov qword [rsp + 0x119], rbp
mov rbp, qword [rdx + 0x10]
mov qword [rsp + 0x120], rbp
mov qword [rsp + 0x110], rax
mov byte [rsp + 0x118], cl
lea r12, [rsp + 0x160]
lea rax, [rsp + 0x1b0]
mov qword [r12], rax
lea rax, str.riot:
mov qword [rdx], rax
mov ebx, 1
mov qword [rdx + 8], rbx
and qword [rdx + 0x10], 0
lea rax, [0x140007730]
mov qword [r12 + 8], rax
lea rax, [rsp + 0x160]
mov qword [rdx + 0x20], rax
mov qword [rdx + 0x28], rbx
lea rsi, [rsp + 0xc0]
mov rcx, rsi
call fcn.1400a31a7
lea rbp, [rsp + 0x50]
mov rcx, rbp
mov rdx, rsi
call fcn.1400a4db1
mov qword [rbp + 0x18], r15
shl rdi, 8
or r13, rdi
mov qword [rbp + 0x20], r13
mov rax, qword [rsp + 0x158]
mov qword [rbp + 0x28], rax
lea rax, str.riot:
mov qword [rsi], rax
mov qword [rsi + 8], rbx
and qword [rsi + 0x10], 0
lea rax, [rsp + 0x110]
mov qword [rsp + 0x1f8], rax
lea rax, [0x140007730]
mov qword [rsp + 0x200], rax
lea rax, [rsp + 0x1f8]
mov qword [rsi + 0x20], rax
mov qword [rsi + 0x28], rbx
lea rdx, [rsp + 0xc0]
mov rcx, r12
call fcn.1400a31a7
lea rsi, [rsp + 0x80]
mov rcx, rsi
mov rdx, r12
call fcn.1400a4db1
mov rax, qword [rsp + 0x40]
mov qword [rsi + 0x18], rax
shl r14, 8
add r14, qword [rsp + 0x48]
mov qword [rsi + 0x20], r14
mov rax, qword [rsp + 0x1a0]
mov qword [rsi + 0x28], rax
mov ecx, 0xc
mov rdi, qword [rsp + 0x150]
mov rsi, rbp
rep movsq qword [rdi], qword [rsi]
mov rcx, qword [rsp + 0x110]
mov rdx, qword [rsp + 0x118]
call fcn.140021595
mov rcx, qword [rsp + 0x1b0]
mov rdx, qword [rsp + 0x1b8]
jmp 0x1400a72c5
mov rax, qword [rsp + 0x150]
mov byte [rax + 8], 0
and qword [rax], 0
jmp 0x1400a72ca
mov rcx, qword [rsp + 0x1b0]
mov eax, dword [rsp + 0x3e0]
lea rdi, [rcx + rax*8]
lea rsi, [rsp + 0x110]
lea r15, [rsp + 0x50]
xorps xmm6, xmm6
cmp rcx, rdi
je 0x1400a6cd0
lea r13, [rcx + 8]
and qword [rsp + 0x110], 0
mov rdx, rsi
call sub.secur32.dll_LsaGetLogonSessionData
test eax, eax
je 0x1400a70db
mov rcx, qword [rsp + 0x110]
call fcn.1400cbbac
mov rcx, r13
jmp 0x1400a70a7
mov rcx, qword [rsp + 0x110]
test rcx, rcx
je 0x1400a70c9
cmp dword [rcx + 0x40], 3
je 0x1400a70d1
movzx r12d, word [rcx + 0x10]
mov rbx, qword [rcx + 0x18]
mov rdx, qword [rcx + 0x48]
mov rcx, r15
call fcn.1400c848b
mov rbp, qword [rsp + 0x50]
test rbp, rbp
je 0x1400a70c9
mov qword [rsp + 0x48], rbx
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x40], rax
mov r14, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x1f8]
imul rbx, qword [rsp + 0x208], 0x50
test rbx, rbx
je 0x1400a716f
lea r15, [rdx + 0x50]
mov rcx, qword [rdx]
mov rdx, qword [rdx + 0x10]
mov r8, rbp
mov r9, r14
call fcn.140020106
add rbx, 0xffffffffffffffb0
mov rdx, r15
test al, al
je 0x1400a7132
mov rcx, rbp
mov rdx, qword [rsp + 0x40]
call fcn.140021595
lea r15, [rsp + 0x50]
jmp 0x1400a70c9
lea rcx, [rsp + 0xc0]
mov rdx, rbp
call fcn.1400cba93
mov rax, qword [rsp + 0xc0]
test rax, rax
je 0x1400a71a8
lea rcx, [rsp + 0xc8]
movdqu xmm0, xmmword [rcx]
movdqa xmmword [rsp + 0x160], xmm0
lea r15, [rsp + 0x50]
jmp 0x1400a71eb
shr r12, 1
lea r15, [rsp + 0x50]
mov rcx, r15
mov rdx, qword [rsp + 0x48]
mov r8, r12
call fcn.14001e180
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x1400a71de
lea rcx, [rsp + 0x58]
movdqu xmm0, xmmword [rcx]
movdqa xmmword [rsp + 0x160], xmm0
jmp 0x1400a71eb
movaps xmmword [rsp + 0x160], xmm6
mov eax, 1
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x50], rbp
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], r14
movdqa xmm0, xmmword [rsp + 0x160]
lea rcx, [rsp + 0x58]
movdqu xmmword [rcx + 0x18], xmm0
and dword [rcx + 0x40], 0
movups xmmword [rcx + 0x30], xmm6
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x80], 8
lea rcx, [rsp + 0x1f8]
mov rdx, r15
call fcn.1400cbb61
jmp 0x1400a70c9
mov al, byte [rsp + 0x58]
mov rcx, qword [rsp + 0x150]
mov byte [rcx + 8], al
and qword [rcx], 0
jmp 0x1400a72ca
mov al, byte [rsp + 0x58]
mov rcx, qword [rsp + 0x150]
mov byte [rcx + 8], al
and qword [rcx], 0
jmp 0x1400a72b8
mov al, byte [rsp + 0x58]
mov rcx, qword [rsp + 0x150]
mov byte [rcx + 8], al
and qword [rcx], 0
jmp 0x1400a72a8
mov al, byte [rsp + 0x58]
mov rcx, qword [rsp + 0x150]
mov byte [rcx + 8], al
and qword [rcx], 0
shl r14, 8
mov rdx, qword [rsp + 0x48]
or rdx, r14
mov rcx, qword [rsp + 0x40]
call fcn.140021595
mov rdx, qword [rsp + 0x1b8]
mov rcx, rbx
call fcn.140021595
shl rdi, 8
or rdi, r13
mov rcx, r15
mov rdx, rdi
call fcn.140021595
lea rcx, [rsp + 0x240]
call fcn.1400a74e9
movaps xmm6, xmmword [rsp + 0x450]
movaps xmm7, xmmword [rsp + 0x460]
add rsp, 0x478
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rdi, [rsp + 0x420]
movss xmm7, dword [rsp + 0x160]
movss xmm6, dword [rsp + 0x168]
xor ebp, ebp
mov esi, 8
mov ecx, 8
xor edx, edx
call fcn.140054d98
mov r15, rax
movabs rax, 0x72657475706d6f43
mov qword [r15], rax
mov r12, qword [rdi - 8]
movdqu xmm0, xmmword [rdi]
movups xmm1, xmmword [rdi + 0x10]
movups xmm2, xmmword [rdi + 0x20]
movaps xmmword [rsp + 0xe0], xmm2
movaps xmmword [rsp + 0xd0], xmm1
movdqa xmmword [rsp + 0xc0], xmm0
cmp r12, 3
je 0x1400a73cc
mov r14, rdx
mov ecx, 0x60
mov edx, 8
call fcn.1400c5c02
mov rsi, rax
mov qword [rax], r15
mov qword [rax + 8], r14
mov qword [rax + 0x10], 8
mov qword [rax + 0x18], r12
movdqa xmm0, xmmword [rsp + 0xc0]
movaps xmm1, xmmword [rsp + 0xd0]
movaps xmm2, xmmword [rsp + 0xe0]
movdqu xmmword [rax + 0x20], xmm0
movups xmmword [rax + 0x30], xmm1
movups xmmword [rax + 0x40], xmm2
movss dword [rax + 0x50], xmm7
movss dword [rax + 0x54], xmm7
mov dword [rax + 0x58], ebx
movss dword [rax + 0x5c], xmm6
mov ebp, 1
lea r12, [rsp + 0xc0]
lea r14, [0x140125fa0]
jmp 0x1400a5aab
mov edx, 8
mov rcx, rdi
call fcn.1400e3100
ud2
lea rcx, str.key_used_disappeared
lea r8, [0x140125810]
mov edx, 0x14
call fcn.1400e35b0
ud2
mov ecx, 0x120
mov edx, 8
jmp 0x1400a73e8
lea rcx, str.global_key_idle_disappearedC:Users_tuxis.cargo_registry_srcgithub.com_1ecc6299db9ec823_sysinfo_0.28.4_srcwindows_system.rs
lea r8, [0x1401257e0]
mov edx, 0x1b
jmp 0x1400a7402