Function at 0x14000bf0d
Capabilities:
Get disk information
Get local ipv4 addresses
Get logon sessions
List groups for user account
List user accounts
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4a8
movdqa xmmword [rsp + 0x490], xmm8
movdqa xmmword [rsp + 0x480], xmm7
movdqa xmmword [rsp + 0x470], xmm6
mov rbx, rcx
lea rsi, [rsp + 0x2d0]
mov rcx, rsi
call fcn.140005a91
mov rcx, rsi
call fcn.1400b5691
mov r12, rax
mov r15, rdx
lea rsi, [rsp + 0x2d0]
mov edx, 0x158
mov r8d, 0x1f4
mov rcx, rsi
call fcn.1400b52b4
mov rdi, qword [rsi]
test rdi, rdi
mov qword [rsp + 0x258], rbx
je 0x14000bfa7
mov r13, qword [rsp + 0x2d8]
mov rsi, qword [rsp + 0x2e0]
mov rax, qword [rsp + 0x2e8]
mov qword [rsp + 0x48], rax
jmp 0x14000bfb7
mov r13, qword [rsp + 0x2d8]
mov rsi, qword [rsp + 0x2e0]
mov ecx, 9
xor edx, edx
call fcn.1400572ff
mov r14, rax
mov rbp, rdx
movabs rax, 0x5043206c61746f54
mov qword [r14], rax
mov byte [r14 + 8], 0x55
mov ecx, 8
mov edx, 0x120
call fcn.140056125
test rax, rax
je 0x14000dbb7
mov rbx, rax
mov qword [rsp + 0x58], rbp
mov qword [rsp + 0x40], rsi
lea rsi, [rsp + 0x2d0]
mov rcx, rsi
call fcn.140005a91
mov rcx, rsi
call fcn.1400b5691
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rdx
call fcn.1400aca30
shl rdx, 0x20
mov eax, eax
or rax, rdx
movabs rcx, 0x19db1ded53e8000
cmp rax, rcx
jl 0x14000c073
movabs rcx, 0xfe624e212ac18000
add rax, rcx
xor esi, esi
mov ecx, 0x989680
xor edx, edx
div rcx
mov rbp, rax
call sub.KERNEL32.dll_GetTickCount64
mov ecx, 0x3e8
xor edx, edx
div rcx
sub rbp, rax
cmovb rbp, rsi
jmp 0x14000c075
xor ebp, ebp
mov rcx, qword [rsp + 0x48]
pxor xmm0, xmm0
lea rsi, [rsp + 0x2d0]
movdqu xmmword [rsi + 0x100], xmm0
mov qword [rsi + 0x40], rdi
mov qword [rsi + 0x48], r13
mov rax, qword [rsp + 0x40]
mov qword [rsi + 0x50], rax
mov qword [rsi + 0x58], rcx
mov qword [rsi + 0x60], r12
mov qword [rsi + 0x68], r15
movdqu xmmword [rsi + 0xa0], xmm0
movdqu xmmword [rsi + 0xb0], xmm0
mov qword [rsi + 0x110], r14
mov rax, qword [rsp + 0x58]
mov qword [rsi + 0x118], rax
mov qword [rsi + 0x120], 9
mov eax, 1
mov qword [rsi + 0x128], rax
movdqu xmmword [rsi + 0x130], xmm0
mov qword [rsi + 0x140], rax
and qword [rsi + 0x158], 0
movdqu xmmword [rsi + 0x148], xmm0
and qword [rsi + 0x170], 0
and dword [rsi + 0x178], 0
mov eax, 8
mov qword [rsi + 0x180], rax
movdqu xmmword [rsi + 0x188], xmm0
mov byte [rsi + 0x198], 0
mov qword [rsi + 0xc8], rax
movdqu xmmword [rsi + 0xd0], xmm0
mov qword [rsi + 0xe0], rbx
mov qword [rsi + 0xe8], 2
and qword [rsi + 0xf0], 0
and qword [rsi], 0
lea r14, [0x14013e9f0]
mov qword [rsi + 0x70], r14
movdqu xmmword [rsi + 0x78], xmm0
and qword [rsi + 0x88], 0
mov rcx, qword [rsp + 0x50]
mov qword [rsi + 0x90], rcx
mov rcx, qword [rsp + 0x60]
mov qword [rsi + 0x98], rcx
mov qword [rsi + 0xc0], rbp
mov qword [rsi + 0xf8], rax
mov rcx, rsi
call fcn.1400b56d3
mov rcx, rsi
mov dl, 1
call fcn.1400b57b8
lea rsi, [rsp + 0x100]
mov rcx, rsi
call fcn.1400b7130
cmp dword [rsi], 2
je 0x14000c3e0
mov rax, qword [rsp + 0x130]
lea rdx, [rsp + 0x70]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x100]
movups xmm1, xmmword [rsp + 0x110]
movups xmm2, xmmword [rsp + 0x120]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0xc0]
mov rcx, rsi
call fcn.1400b715c
cmp qword [rsi], 2
je 0x14000c3e0
mov rax, qword [rsp + 0xf0]
lea rdx, [rsp + 0x70]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0xc0]
movups xmm1, xmmword [rsp + 0xd0]
movups xmm2, xmmword [rsp + 0xe0]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0x170]
mov rcx, rsi
call fcn.1400b71d6
cmp qword [rsi], 2
je 0x14000c3e0
mov rax, qword [rsp + 0x1a0]
lea rdx, [rsp + 0x70]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x170]
movups xmm1, xmmword [rsp + 0x180]
movups xmm2, xmmword [rsp + 0x190]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0x1b0]
mov rcx, rsi
call fcn.1400b726c
cmp qword [rsi], 2
je 0x14000c3e0
mov rax, qword [rsp + 0x1e0]
lea rdx, [rsp + 0x70]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x1b0]
movups xmm1, xmmword [rsp + 0x1c0]
movups xmm2, xmmword [rsp + 0x1d0]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0x1f8]
mov rcx, rsi
call fcn.1400b7336
cmp qword [rsi], 2
je 0x14000c3e0
mov rax, qword [rsp + 0x228]
lea rdx, [rsp + 0x70]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x1f8]
movups xmm1, xmmword [rsp + 0x208]
movups xmm2, xmmword [rsp + 0x218]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0x260]
mov rcx, rsi
call fcn.1400b73b3
mov rax, qword [rsi]
cmp rax, 2
je 0x14000c3e0
movups xmm0, xmmword [rsp + 0x268]
movups xmm1, xmmword [rsp + 0x278]
movups xmm2, xmmword [rsp + 0x288]
lea rsi, [rsp + 0x298]
movups xmmword [rsi + 0x28], xmm2
movups xmmword [rsi + 0x18], xmm1
movups xmmword [rsi + 8], xmm0
mov qword [rsi], rax
lea rdi, [rsp + 0x170]
mov rcx, rdi
mov rdx, rsi
mov r8b, 1
call fcn.1400b7492
mov rax, qword [rsi + 0x30]
mov qword [rsp + 0xa0], rax
movdqu xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmm2, xmmword [rsi + 0x20]
movaps xmmword [rsp + 0x90], xmm2
movaps xmmword [rsp + 0x80], xmm1
movdqa xmmword [rsp + 0x70], xmm0
mov ebp, dword [rdi + 4]
cmp ebp, 2
jne 0x14000da9c
lea rcx, [rsp + 0x70]
call fcn.1400b50e8
mov esi, 8
xor r15d, r15d
mov rcx, qword [rsp + 0x398]
mov rdx, qword [rsp + 0x3a8]
call fcn.1400b50aa
mov rcx, qword [rsp + 0x398]
mov rdx, qword [rsp + 0x3a0]
call fcn.1400b518d
mov qword [rsp + 0x398], rsi
mov qword [rsp + 0x3a0], r15
mov qword [rsp + 0x3a8], r15
lea rcx, [rsp + 0x170]
and qword [rcx], 0
call sub.iphlpapi.dll_GetIfTable2
test eax, eax
jne 0x14000d235
lea r8, [rsp + 0x360]
mov rax, qword [r8 - 0x20]
mov rcx, qword [r8 - 0x18]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [r8 - 8]
lea rsi, [rsp + 0x70]
mov qword [rsi], rax
add rax, 0x10
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov word [rsi + 0x18], dx
mov qword [rsi + 0x20], r8
mov rcx, rsi
call fcn.1400b5260
test rax, rax
je 0x14000c496
mov byte [rdx + 0x6e], 0
jmp 0x14000c483
lea rsi, [rsp + 0x70]
mov rcx, rsi
call fcn.140005a91
mov rcx, rsi
call fcn.1400b5691
mov qword [rsi], r14
lea rcx, [rsp + 0x90]
pxor xmm0, xmm0
movdqu xmmword [rcx - 0x18], xmm0
and qword [rcx - 8], 0
mov qword [rcx], rax
mov qword [rcx + 8], rdx
lea rax, [rsp + 0xc0]
mov qword [rax], 8
movdqu xmmword [rax + 8], xmm0
mov r14, qword [rsp + 0x170]
mov r8d, dword [r14]
add r14, 8
lea r15, [rsp + 0x100]
pcmpeqd xmm6, xmm6
xor r10d, r10d
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x48], r8
cmp r10, r8
je 0x14000c7ef
mov rdi, r10
inc r10
imul rsi, rdi, 0x548
cmp qword [r14 + rsi + 0x4a8], 0
jne 0x14000c533
cmp qword [r14 + rsi + 0x4b0], 0
je 0x14000c507
cmp dword [r14 + rsi + 0x48c], 2
je 0x14000c507
cmp dword [r14 + rsi + 0x420], 0
je 0x14000c507
mov qword [rsp + 0x50], r10
mov ecx, 0x14
mov edx, 2
call fcn.140055bcc
mov r12, rax
mov eax, dword [r14 + rsi + 0x10]
movzx ecx, byte [r14 + rsi + 0x14]
movzx edx, byte [r14 + rsi + 0x15]
movzx r8d, byte [r14 + rsi + 0x16]
movzx r9d, byte [r14 + rsi + 0x17]
movzx r10d, byte [r14 + rsi + 0x18]
movzx r11d, byte [r14 + rsi + 0x19]
movzx ebx, byte [r14 + rsi + 0x1a]
movzx esi, byte [r14 + rsi + 0x1b]
mov dword [r12], eax
mov word [r12 + 4], cx
mov word [r12 + 6], dx
mov word [r12 + 8], r8w
mov word [r12 + 0xa], r9w
mov word [r12 + 0xc], r10w
mov word [r12 + 0xe], r11w
mov word [r12 + 0x10], bx
mov word [r12 + 0x12], si
mov ecx, 0xa
xor edx, edx
call fcn.1400b30b0
mov rbx, rax
mov qword [rsp + 0x58], rdx
movups xmm0, xmmword [r12]
movups xmmword [rax], xmm0
mov eax, dword [r12 + 0x10]
mov dword [rbx + 0x10], eax
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x98]
mov r9d, 0xa
mov r8, rbx
call fcn.1400b4b3d
mov r13, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov r14, rsi
and r14, rax
mov qword [rsp + 0x140], rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor eax, eax
mov qword [rsp + 0x40], rax
movdqu xmm8, xmmword [r13 + r14]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0x100], ax
mov rcx, r15
call fcn.14000e57a
test rax, rax
je 0x14000c695
add rdx, r14
and rdx, rsi
shl rdx, 5
mov rbp, r13
sub rbp, rdx
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x10]
mov r9d, 0xa
mov r8, rbx
call fcn.1400b4bd3
test al, al
je 0x14000c65c
jmp 0x14000c6c4
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x14000c76c
mov rax, qword [rsp + 0x40]
add r14, rax
add r14, 0x10
add rax, 0x10
mov qword [rsp + 0x40], rax
and r14, rsi
jmp 0x14000c640
mov rcx, rbx
mov rdx, qword [rsp + 0x58]
call fcn.1400c2035
mov eax, dword [rbp - 8]
inc eax
mov dword [rbp - 8], eax
cmp eax, 1
jle 0x14000c6ff
mov edx, 0xa
mov rcx, r12
call fcn.1400c2035
mov r14, qword [rsp + 0x60]
mov r8, qword [rsp + 0x48]
mov r10, qword [rsp + 0x50]
jmp 0x14000c507
mov rdx, qword [rsp + 0xd0]
cmp rdx, qword [rsp + 0xc8]
mov r14, qword [rsp + 0x60]
jne 0x14000c72b
lea rcx, [rsp + 0xc0]
call fcn.1400b4eaf
mov rdx, qword [rsp + 0xd0]
mov r8, qword [rsp + 0x48]
mov r10, qword [rsp + 0x50]
mov rax, qword [rsp + 0xc0]
mov rcx, rdx
shl rcx, 5
mov dword [rax + rcx], edi
mov qword [rax + rcx + 8], r12
mov r9d, 0xa
mov qword [rax + rcx + 0x10], r9
mov qword [rax + rcx + 0x18], r9
inc rdx
mov qword [rsp + 0xd0], rdx
jmp 0x14000c507
cmp qword [rsp + 0x80], 0
je 0x14000c7d1
mov rcx, r13
mov rdx, rsi
mov r8, qword [rsp + 0x140]
call fcn.1400b5280
mov rcx, qword [rsp + 0x70]
shl rax, 5
mov rbp, rcx
and dl, 1
movzx edx, dl
sub qword [rsp + 0x80], rdx
sub rbp, rax
neg rax
mov qword [rcx + rax - 0x20], rbx
mov rax, qword [rsp + 0x58]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], 0xa
and dword [rbp - 8], 0
inc qword [rsp + 0x88]
jmp 0x14000c6d1
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x90]
call fcn.140112656
mov r13, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
jmp 0x14000c777
mov rax, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0xc8]
mov qword [rsp + 0x248], rcx
mov r14, qword [rsp + 0xd0]
shl r14, 5
add r14, rax
lea rbp, [rsp + 0x100]
pcmpeqd xmm6, xmm6
mov qword [rsp + 0x240], rax
mov r15, rax
mov qword [rsp + 0x140], r14
mov rdi, r15
cmp r15, r14
je 0x14000cd85
lea r15, [rdi + 0x20]
mov rsi, qword [rdi + 8]
test rsi, rsi
je 0x14000cd82
mov r13, qword [rdi + 0x10]
mov edx, dword [rdi]
cmp qword [rsp + 0x88], 0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x58], r13
je 0x14000c979
mov qword [rsp + 0x48], rdx
mov rdi, qword [rdi + 0x18]
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x98]
mov r8, rsi
mov r9, rdi
call fcn.1400b4b3d
mov r12, qword [rsp + 0x70]
mov r13, qword [rsp + 0x78]
mov r14, r13
and r14, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor eax, eax
mov qword [rsp + 0x50], rax
movdqu xmm8, xmmword [r12 + r14]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0x100], ax
mov rcx, rbp
call fcn.14000e57a
mov rbx, rax
test rax, rax
je 0x14000c91c
mov r15, rdx
add r15, r14
and r15, r13
mov rax, r15
shl rax, 5
mov rcx, r12
sub rcx, rax
mov r8, qword [rcx - 0x20]
mov r9, qword [rcx - 0x10]
mov rcx, rsi
mov rdx, rdi
call fcn.1400b4bd3
test al, al
je 0x14000c8dd
jmp 0x14000c947
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x14000c947
mov rax, qword [rsp + 0x50]
add r14, rax
add r14, 0x10
add rax, 0x10
mov qword [rsp + 0x50], rax
and r14, r13
jmp 0x14000c8c2
shl r15, 5
sub r12, r15
test rbx, rbx
cmove r12, rbx
add r12, 0xffffffffffffffe0
test rbx, rbx
cmove r12, rbx
mov r14, qword [rsp + 0x140]
mov r15, qword [rsp + 0x40]
mov r13, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x48]
jmp 0x14000c97c
xor r12d, r12d
lea rax, [r12 + 0x18]
test r12, r12
lea rcx, [0x14013e520]
cmove rax, rcx
cmp dword [rax], 1
jg 0x14000cbe6
imul rdi, rdx, 0x548
mov rax, qword [rsp + 0x60]
lea r12, [rax + rdi]
lea rcx, [rax + rdi]
add rcx, 0x1c
xor r8d, r8d
cmp r8, 0x101
je 0x14000c9c9
cmp word [rcx + r8*2], 0
je 0x14000c9cf
inc r8
jmp 0x14000c9b3
mov r8d, 0x101
mov edx, 0x101
lea r9, str.libsinfo_0.1_srcwindows_network.rs_
call fcn.1400b31a5
mov r8, rdx
mov rcx, rbp
mov rdx, rax
call fcn.14002b360
mov rbx, qword [rsp + 0x100]
mov rdx, qword [rsp + 0x108]
test rbx, rbx
je 0x14000cbdf
mov qword [rsp + 0x158], r12
mov qword [rsp + 0x1f0], rdx
mov qword [rsp + 0x48], rdi
mov r15, qword [rsp + 0x110]
mov rcx, qword [rsp + 0x360]
mov rdx, qword [rsp + 0x368]
mov r8, rbx
mov r9, r15
call fcn.1400b4aa7
mov r12, qword [rsp + 0x340]
mov rdi, qword [rsp + 0x348]
mov r14, rdi
and r14, rax
mov qword [rsp + 0x250], rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor eax, eax
mov qword [rsp + 0x50], rax
movdqu xmm8, xmmword [r12 + r14]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0x100], ax
mov rcx, rbp
call fcn.14000e57a
test rax, rax
je 0x14000cad0
add rdx, r14
and rdx, rdi
neg rdx
imul r13, rdx, 0x88
mov rcx, qword [r12 + r13 - 0x88]
mov rdx, qword [r12 + r13 - 0x78]
mov r8, rbx
mov r9, r15
call fcn.140045f13
test al, al
je 0x14000ca95
jmp 0x14000caff
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x14000cbf6
mov rax, qword [rsp + 0x50]
add r14, rax
add r14, 0x10
add rax, 0x10
mov qword [rsp + 0x50], rax
and r14, rdi
jmp 0x14000ca7a
add r12, r13
mov rax, qword [r12 - 0x68]
mov rcx, qword [r12 - 0x58]
mov qword [r12 - 0x60], rax
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x48]
mov rax, qword [rdx + r8 + 0x500]
mov qword [r12 - 0x68], rax
mov qword [r12 - 0x50], rcx
mov rax, qword [rdx + r8 + 0x4b8]
mov qword [r12 - 0x58], rax
mov rax, qword [r12 - 0x48]
mov qword [r12 - 0x40], rax
mov rax, qword [rdx + r8 + 0x4c0]
add rax, qword [rdx + r8 + 0x4c8]
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov qword [r12 - 0x48], rax
mov rax, qword [r12 - 0x38]
mov qword [r12 - 0x30], rax
mov rax, qword [rdx + r8 + 0x508]
add rax, qword [rdx + r8 + 0x510]
cmovb rax, rcx
mov qword [r12 - 0x38], rax
mov rax, qword [r12 - 0x28]
mov qword [r12 - 0x20], rax
mov rax, qword [rdx + r8 + 0x4d8]
mov qword [r12 - 0x28], rax
mov rax, qword [r12 - 0x18]
mov qword [r12 - 0x10], rax
mov rax, qword [rdx + r8 + 0x520]
mov qword [r12 - 0x18], rax
mov byte [r12 - 2], 1
mov rcx, rbx
mov rdx, qword [rsp + 0x1f0]
call fcn.1400c2022
mov r14, qword [rsp + 0x140]
mov r15, qword [rsp + 0x40]
mov r13, qword [rsp + 0x58]
jmp 0x14000cbe6
xor ecx, ecx
call fcn.1400b7126
mov rcx, rsi
mov rdx, r13
call fcn.1400c2035
jmp 0x14000c835
cmp qword [rsp + 0x350], 0
je 0x14000cd58
mov rax, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x48]
mov r14, qword [rax + rdx + 0x4c0]
add r14, qword [rax + rdx + 0x4c8]
mov rcx, qword [rax + rdx + 0x4b8]
mov qword [rsp + 0x50], rcx
mov rcx, 0xffffffffffffffff
cmovb r14, rcx
mov r13, qword [rax + rdx + 0x508]
add r13, qword [rax + rdx + 0x510]
cmovb r13, rcx
mov rcx, qword [rsp + 0x158]
mov rcx, qword [rcx]
mov qword [rsp + 0x238], rcx
mov rcx, qword [rax + rdx + 0x500]
mov qword [rsp + 0x230], rcx
mov rcx, qword [rax + rdx + 0x4d8]
mov qword [rsp + 0x158], rcx
mov rax, qword [rax + rdx + 0x520]
mov qword [rsp + 0x48], rax
mov rcx, r12
mov rdx, rdi
mov r8, qword [rsp + 0x250]
call fcn.1400b5280
mov rcx, qword [rsp + 0x340]
neg rax
and dl, 1
movzx edx, dl
sub qword [rsp + 0x350], rdx
imul rax, rax, 0x88
mov qword [rcx + rax - 0x88], rbx
mov rdx, qword [rsp + 0x1f0]
mov qword [rcx + rax - 0x80], rdx
mov qword [rcx + rax - 0x78], r15
mov rdx, qword [rsp + 0x238]
mov qword [rcx + rax - 0x70], rdx
mov rdx, qword [rsp + 0x230]
mov qword [rcx + rax - 0x68], rdx
mov qword [rcx + rax - 0x60], rdx
mov rdx, qword [rsp + 0x50]
mov qword [rcx + rax - 0x58], rdx
mov qword [rcx + rax - 0x50], rdx
mov qword [rcx + rax - 0x48], r14
mov qword [rcx + rax - 0x40], r14
mov qword [rcx + rax - 0x38], r13
mov qword [rcx + rax - 0x30], r13
mov rdx, qword [rsp + 0x158]
mov qword [rcx + rax - 0x28], rdx
mov qword [rcx + rax - 0x20], rdx
mov rdx, qword [rsp + 0x48]
mov qword [rcx + rax - 0x18], rdx
mov qword [rcx + rax - 0x10], rdx
and dword [rcx + rax - 8], 0
and word [rcx + rax - 4], 0
mov byte [rcx + rax - 2], 1
inc qword [rsp + 0x358]
jmp 0x14000cbcb
lea rcx, [rsp + 0x340]
lea rdx, [rsp + 0x360]
call fcn.140112954
mov r12, qword [rsp + 0x340]
mov rdi, qword [rsp + 0x348]
jmp 0x14000cc05
mov rdi, r15
sub r14, rdi
shr r14, 5
add rdi, 0x10
sub r14, 1
jb 0x14000cda8
mov rcx, qword [rdi - 8]
mov rdx, qword [rdi]
call fcn.1400c2035
add rdi, 0x20
jmp 0x14000cd90
mov r8, qword [rsp + 0x248]
test r8, r8
je 0x14000cdcb
shl r8, 5
mov edx, 8
mov rcx, qword [rsp + 0x240]
call fcn.14000a512
mov rcx, qword [rsp + 0x170]
call sub.iphlpapi.dll_FreeMibTable
mov r8, qword [rsp + 0x78]
test r8, r8
je 0x14000cee3
mov rax, qword [rsp + 0x88]
test rax, rax
je 0x14000ceb8
mov rcx, qword [rsp + 0x70]
lea rdx, [r8 + rcx]
inc rdx
movdqa xmm0, xmmword [rcx]
pmovmskb r8d, xmm0
not r8d
lea rsi, [rsp + 0x118]
mov qword [rsi - 0x18], rcx
add rcx, 0x10
mov qword [rsi - 0x10], rcx
mov qword [rsi - 8], rdx
mov word [rsi], r8w
mov qword [rsi + 8], rax
mov edi, 1
test rdi, rdi
je 0x14000ceb3
mov rcx, rsi
call fcn.14000e57a
cmp rax, 1
je 0x14000ce7b
mov rax, qword [rsp + 0x108]
movdqa xmm0, xmmword [rax]
pmovmskb ecx, xmm0
not ecx
mov word [rsp + 0x118], cx
add qword [rsp + 0x100], 0xfffffffffffffe00
add rax, 0x10
mov qword [rsp + 0x108], rax
jmp 0x14000ce39
shl rdx, 5
mov rax, qword [rsp + 0x100]
mov rdi, qword [rsp + 0x120]
mov rcx, rax
sub rcx, rdx
dec rdi
mov qword [rsp + 0x120], rdi
mov rcx, qword [rcx - 0x20]
neg rdx
mov rdx, qword [rax + rdx - 0x18]
call fcn.1400c2035
jmp 0x14000ce34
mov r8, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x70]
lea rsi, [rsp + 0x100]
mov r9d, 0x20
mov rcx, rsi
call fcn.14000e6ec
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
call fcn.14000a512
mov rax, qword [rsp + 0x340]
mov rcx, qword [rsp + 0x348]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [rsp + 0x358]
lea rsi, [rsp + 0x70]
mov qword [rsi], rax
add rax, 0x10
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov word [rsi + 0x18], dx
mov qword [rsi + 0x20], r8
mov ebx, 0x88
mov rcx, rsi
call fcn.1400b4616
test rax, rax
je 0x14000cf74
mov rdi, rax
cmp byte [rax - 2], 0
jne 0x14000cf2c
mov rax, qword [rsp + 0x340]
sub rax, rdi
cqo
idiv rbx
lea rcx, [rsp + 0x340]
mov rdx, rax
call fcn.1400b561d
mov rcx, qword [rdi - 0x88]
mov rdx, qword [rdi - 0x80]
call fcn.1400c2022
jmp 0x14000cf2c
lea rdi, [rsp + 0x1f8]
mov dword [rdi], 0x3c00
and dword [rsp + 0x1b0], 0
mov ebx, 3
sub ebx, 1
jb 0x14000d05a
mov ecx, dword [rsp + 0x1f8]
call fcn.140102c10
test rax, rax
je 0x14000cffd
mov rsi, rax
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0xe
xor r8d, r8d
mov r9, rax
call sub.iphlpapi.dll_GetAdaptersAddresses
mov dword [rsp + 0x1b0], eax
cmp eax, 0x6f
jne 0x14000cfd9
mov rcx, rsi
call fcn.140102c18
jmp 0x14000cf8f
test eax, eax
jne 0x14000d052
mov qword [rsp + 0x108], rsi
mov qword [rsp + 0x110], rsi
and qword [rsp + 0x100], 0
xor ecx, ecx
jmp 0x14000d0b9
mov ecx, 0x32
xor edx, edx
call fcn.1400572ff
mov rcx, rax
movups xmm0, xmmword [str.failed_to_allocate_memory_for_IP_ADAPTER_ADDRESSESIndex_out_of_bounds]
movups xmmword [rax], xmm0
movups xmm0, xmmword [0x14013e8f0]
movups xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [0x14013e900]
movdqu xmmword [rax + 0x20], xmm0
mov word [rax + 0x30], 0x5345
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], rdx
mov qword [rsp + 0x110], 0x32
jmp 0x14000d0b9
mov rcx, rsi
call fcn.140102c18
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0xc0], rax
lea rax, str.GetAdaptersAddresses___failed_with_code
lea rdx, [rsp + 0x70]
mov qword [rdx], rax
mov eax, 1
mov qword [rdx + 8], rax
and qword [rdx + 0x20], 0
lea rcx, [fcn.1400303a0]
mov qword [rsp + 0xc8], rcx
lea rcx, [rsp + 0xc0]
mov qword [rdx + 0x10], rcx
mov qword [rdx + 0x18], rax
lea rsi, [rsp + 0x100]
mov rcx, rsi
call fcn.1400b0250
mov rcx, qword [rsi]
test rcx, rcx
je 0x14000d0d0
mov rdx, qword [rsp + 0x108]
call fcn.1400c2022
jmp 0x14000d235
movdqu xmm0, xmmword [rsp + 0x108]
lea rax, [rsp + 0xc0]
movdqu xmmword [rax], xmm0
lea rbx, [rsp + 0x1b0]
pcmpeqd xmm6, xmm6
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0xc0]
call fcn.1400b7066
mov r14, qword [rsp + 0x70]
test r14, r14
je 0x14000d228
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
cmp qword [rsp + 0x358], 0
je 0x14000d216
mov r12, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x360]
mov rdx, qword [rsp + 0x368]
mov r8, r14
mov r9, r12
call fcn.1400b4aa7
mov rbp, qword [rsp + 0x340]
mov rsi, qword [rsp + 0x348]
mov rdi, rsi
and rdi, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor r13d, r13d
movdqu xmm8, xmmword [rbp + rdi]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0x1b0], ax
mov rcx, rbx
call fcn.14000e57a
test rax, rax
je 0x14000d1d3
add rdx, rdi
and rdx, rsi
neg rdx
imul r15, rdx, 0x88
mov r8, qword [rbp + r15 - 0x88]
mov r9, qword [rbp + r15 - 0x78]
mov rcx, r14
mov rdx, r12
call fcn.140045f13
test al, al
je 0x14000d198
jmp 0x14000d1f1
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x14000d216
add rdi, r13
add rdi, 0x10
add r13, 0x10
and rdi, rsi
jmp 0x14000d17c
lea rax, [r15 + rbp]
add rax, 0xffffffffffffff78
lea rdx, [rsp + 0x88]
movzx ecx, word [rdx + 4]
mov word [rax + 0x84], cx
mov ecx, dword [rdx]
mov dword [rax + 0x80], ecx
mov rcx, r14
mov rdx, qword [rsp + 0x40]
call fcn.1400c2022
jmp 0x14000d0f1
mov rcx, qword [rsp + 0xc0]
call fcn.140102c18
lea rbx, [rsp + 0x3b0]
lea rcx, [rsp + 0x2d0]
mov edx, 0x10101
call fcn.1400b5f29
call sub.KERNEL32.dll_GetLogicalDrives
mov dword [rsp + 0x1f8], eax
test eax, eax
je 0x14000d3f8
lea r13, [rsp + 0x178]
mov qword [r13 - 8], 8
pxor xmm0, xmm0
movdqu xmmword [r13], xmm0
lea rax, [rsp + 0x1f8]
lea rdi, [rsp + 0x70]
mov qword [rdi], rax
movabs rax, 0x2000000000
mov qword [rdi + 8], rax
mov ecx, 0x20
call fcn.1400b4981
mov qword [rsp + 0x38], rdi
and dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x20
mov qword [rsp + 0x20], 1
xor ebx, ebx
lea rdi, [rsp + 0xc0]
mov edx, 0x20
mov rcx, rdi
xor r8d, r8d
mov r9, rax
call fcn.1400b352a
mov rax, qword [rdi + 0x10]
sub rax, 1
jb 0x14000d2f9
mov rdi, qword [rdi]
test rdi, rdi
je 0x14000d2f9
add rbx, qword [rdi + 0x10]
add rdi, 0x18
jmp 0x14000d2e1
lea rdi, [rsp + 0x170]
mov rcx, rdi
mov rdx, rbx
call fcn.1400b4bfb
mov rax, qword [rsp + 0xd0]
lea rbx, [rsp + 0x100]
mov qword [rbx + 0x10], rax
movups xmm0, xmmword [rsp + 0xc0]
movaps xmmword [rbx], xmm0
lea rbp, [rsp + 0x78]
lea r14, [rsp + 0x70]
mov rcx, rbx
call fcn.1400b3fdf
test rax, rax
je 0x14000d3cd
mov r15, qword [rax]
movups xmm0, xmmword [rax + 8]
movaps xmmword [rsp + 0x1b0], xmm0
mov rcx, rax
call fcn.140005ed0
test r15, r15
je 0x14000d3cd
mov qword [rsp + 0x70], r15
movaps xmm0, xmmword [rsp + 0x1b0]
movups xmmword [rbp], xmm0
mov r12, qword [rsp + 0x80]
mov rcx, rdi
mov rdx, r12
call fcn.1400b4bfb
mov rsi, qword [rsp + 0x180]
imul rcx, rsi, 0x90
add rcx, qword [rsp + 0x170]
imul r8, r12, 0x90
mov rdx, r15
call fcn.1400ffbc0
add rsi, r12
mov qword [rsp + 0x180], rsi
and qword [rsp + 0x80], 0
mov rcx, r14
call fcn.1400b0438
jmp 0x14000d335
lea rcx, [rsp + 0x100]
call fcn.1400b3fad
mov rdi, qword [rsp + 0x170]
movdqu xmm0, xmmword [r13]
movdqa xmmword [rsp + 0x70], xmm0
lea rbx, [rsp + 0x3b0]
jmp 0x14000d407
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
mov edi, 8
lea rsi, [rsp + 0x3c8]
mov rcx, rbx
call fcn.1400b0438
mov qword [rsi - 0x18], rdi
lea r13, [rsp + 0x88]
movaps xmm0, xmmword [r13 - 0x18]
movups xmmword [rsi - 0x10], xmm0
lea rbx, [rsp + 0x1f8]
mov qword [rbx], 8
lea rax, [rsp + 0x164]
and dword [rax], 0
pxor xmm6, xmm6
movdqu xmmword [rbx + 8], xmm6
lea r15, [rsp + 0x298]
lea r12, [rsp + 0x1b0]
lea rbp, [rsp + 0x100]
and qword [rsp + 0x150], 0
and dword [rsp + 0x14c], 0
and dword [rsp + 0x168], 0
lea rax, [rsp + 0x164]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x168]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x14c]
mov qword [rsp + 0x28], rax
or dword [rsp + 0x20], 0xffffffff
xor ecx, ecx
xor edx, edx
mov r8d, 2
lea r9, [rsp + 0x150]
call sub.netapi32.dll_NetUserEnum
cmp eax, 0xea
je 0x14000d4d2
test eax, eax
jne 0x14000d7ee
mov dword [rsp + 0x40], eax
mov rdi, qword [rsp + 0x150]
mov eax, dword [rsp + 0x14c]
lea r14, [rdi + rax*8]
cmp rdi, r14
je 0x14000d7d2
mov rsi, rdi
add rdi, 8
cmp qword [rsi], 0
je 0x14000d4e9
and qword [rsp + 0x298], 0
mov rdx, qword [rsi]
xor ecx, ecx
mov r8d, 0x17
mov r9, r15
call sub.netapi32.dll_NetUserGetInfo
test eax, eax
jne 0x14000d7b7
mov rax, qword [rsp + 0x298]
mov rdx, qword [rax + 0x20]
mov rcx, r12
call fcn.1400b2b07
mov rdx, qword [rsp + 0x1b0]
test rdx, rdx
je 0x14000d7b7
lea rcx, [rsp + 0x70]
call fcn.1400b6681
cmp qword [rsp + 0x70], 0
je 0x14000d579
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x180], rax
movups xmm0, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0x170], xmm0
jmp 0x14000d589
mov rdx, qword [rsi]
lea rcx, [rsp + 0x170]
call fcn.1400b01f8
mov rdx, qword [rsi]
and qword [rsp + 0x260], 0
and dword [rsp + 0x6c], 0
and dword [rsp + 0x16c], 0
lea rax, [rsp + 0x16c]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x260]
mov qword [rsp + 0x20], rax
or dword [rsp + 0x28], 0xffffffff
lea rcx, [0x1401543b0]
xor r8d, r8d
mov r9d, 1
call sub.netapi32.dll_NetUserGetLocalGroups
test eax, eax
je 0x14000d601
lea rax, [rsp + 0xc8]
movdqu xmmword [rax], xmm6
mov qword [rsp + 0xc0], 8
jmp 0x14000d736
mov ebx, dword [rsp + 0x6c]
test rbx, rbx
je 0x14000d628
imul rsi, rbx, 0x18
mov ecx, 8
mov rdx, rsi
call fcn.140056125
mov r12, rax
test rax, rax
jne 0x14000d62e
jmp 0x14000dba8
mov r12d, 8
mov qword [rsp + 0xc0], r12
mov qword [rsp + 0xc8], rbx
and qword [rsp + 0xd0], 0
mov r15, qword [rsp + 0x260]
test r15, r15
je 0x14000d688
mov esi, dword [rsp + 0x6c]
cmp ebx, esi
jae 0x14000d6c9
lea rcx, [rsp + 0xc0]
xor edx, edx
mov r8, rsi
call fcn.1400b321e
mov rcx, rax
call fcn.14000936a
mov r12, qword [rsp + 0xc0]
mov rbx, qword [rsp + 0xd0]
jmp 0x14000d6cb
mov rax, qword [rsp + 0xd0]
mov qword [r13 + 0x28], rax
mov rax, qword [rsp + 0xc0]
mov qword [r13 + 0x18], rax
mov rax, qword [rsp + 0xc8]
mov qword [r13 + 0x20], rax
lea rbx, [rsp + 0x1f8]
lea r15, [rsp + 0x298]
lea r12, [rsp + 0x1b0]
jmp 0x14000d76c
xor ebx, ebx
test esi, esi
je 0x14000d716
imul rax, rbx, 0x18
add r12, rax
xor r13d, r13d
mov rdx, qword [r15 + r13*8]
mov rcx, rbp
call fcn.1400b01f8
mov rax, qword [rsp + 0x110]
mov qword [r12 + 0x10], rax
movups xmm0, xmmword [rsp + 0x100]
movups xmmword [r12], xmm0
inc r13
add r12, 0x18
cmp rsi, r13
jne 0x14000d6d9
add rbx, r13
lea r13, [rsp + 0x88]
mov qword [rsp + 0xd0], rbx
lea rbx, [rsp + 0x1f8]
lea r15, [rsp + 0x298]
lea r12, [rsp + 0x1b0]
mov rcx, qword [rsp + 0x260]
mov rax, qword [rsp + 0xd0]
mov qword [r13 + 0x28], rax
mov rax, qword [rsp + 0xc0]
mov qword [r13 + 0x18], rax
mov rax, qword [rsp + 0xc8]
mov qword [r13 + 0x20], rax
test rcx, rcx
je 0x14000d76c
call sub.netapi32.dll_NetApiBufferFree
movups xmm0, xmmword [rsp + 0x1b0]
movaps xmmword [rsp + 0x70], xmm0
mov rax, qword [rsp + 0x1c0]
mov qword [rsp + 0x80], rax
and dword [rsp + 0xb8], 0
mov rax, qword [rsp + 0x180]
mov qword [r13 + 0x10], rax
movaps xmm0, xmmword [rsp + 0x170]
movups xmmword [r13], xmm0
mov rcx, rbx
lea rdx, [rsp + 0x70]
call fcn.1400b674f
mov rcx, qword [rsp + 0x298]
test rcx, rcx
je 0x14000d4e9
call sub.netapi32.dll_NetApiBufferFree
jmp 0x14000d4e9
cmp dword [rsp + 0x40], 0xea
jne 0x14000d7ee
mov rcx, qword [rsp + 0x150]
call fcn.1400b666d
jmp 0x14000d467
mov rcx, qword [rsp + 0x150]
call fcn.1400b666d
lea rcx, [rsp + 0x260]
and dword [rcx], 0
lea rdx, [rsp + 0x1b0]
and qword [rdx], 0
call sub.Secur32.dll_LsaEnumerateLogonSessions
test eax, eax
je 0x14000d8db
mov rax, qword [rsp + 0x208]
mov qword [rsp + 0x80], rax
movups xmm0, xmmword [rsp + 0x1f8]
movaps xmmword [rsp + 0x70], xmm0
mov rcx, qword [rsp + 0x1b0]
test rcx, rcx
je 0x14000d84e
call sub.Secur32.dll_LsaFreeReturnBuffer
lea rsi, [rsp + 0x2d0]
mov rcx, qword [rsi + 0xf8]
mov rdx, qword [rsi + 0x108]
call fcn.1400b5065
mov rcx, qword [rsi + 0xf8]
mov rdx, qword [rsi + 0x100]
call fcn.1400b5179
mov rax, qword [rsp + 0x80]
lea rcx, [rsp + 0x3c8]
mov qword [rcx + 0x10], rax
movaps xmm0, xmmword [rsp + 0x70]
movups xmmword [rcx], xmm0
mov r8d, 0x1a0
mov rcx, qword [rsp + 0x258]
mov rdx, rsi
call fcn.1400ffbc0
movaps xmm6, xmmword [rsp + 0x470]
movaps xmm7, xmmword [rsp + 0x480]
movaps xmm8, xmmword [rsp + 0x490]
add rsp, 0x4a8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, qword [rsp + 0x1b0]
mov eax, dword [rsp + 0x260]
lea r14, [rcx + rax*8]
lea rsi, [rsp + 0x170]
lea rbx, [rsp + 0x70]
pxor xmm6, xmm6
cmp rcx, r14
je 0x14000d81f
lea rdi, [rcx + 8]
and qword [rsp + 0x170], 0
mov rdx, rsi
call sub.Secur32.dll_LsaGetLogonSessionData
test eax, eax
je 0x14000d933
mov rcx, qword [rsp + 0x170]
call fcn.1400b6677
mov rcx, rdi
jmp 0x14000d8ff
mov rcx, qword [rsp + 0x170]
test rcx, rcx
je 0x14000d921
cmp dword [rcx + 0x40], 3
je 0x14000d929
movzx ebp, word [rcx + 0x10]
mov r12, qword [rcx + 0x18]
mov rdx, qword [rcx + 0x48]
mov rcx, rbx
call fcn.1400b2b07
mov r15, qword [rsp + 0x70]
test r15, r15
je 0x14000d921
mov qword [rsp + 0x58], r12
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov r13, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x1f8]
imul r12, qword [rsp + 0x208], 0x50
test r12, r12
je 0x14000d9c9
lea rbx, [rdx + 0x50]
mov rcx, qword [rdx]
mov rdx, qword [rdx + 0x10]
mov r8, r15
mov r9, r13
call fcn.14005fc6d
add r12, 0xffffffffffffffb0
mov rdx, rbx
test al, al
je 0x14000d98c
mov rcx, r15
mov rdx, qword [rsp + 0x40]
call fcn.1400c2022
lea rbx, [rsp + 0x70]
jmp 0x14000d921
lea rcx, [rsp + 0x100]
mov rdx, r15
call fcn.1400b6681
mov rax, qword [rsp + 0x100]
test rax, rax
je 0x14000da00
lea rcx, [rsp + 0x108]
movups xmm0, xmmword [rcx]
movaps xmmword [rsp + 0xc0], xmm0
lea rbx, [rsp + 0x70]
jmp 0x14000da42
shr rbp, 1
lea rbx, [rsp + 0x70]
mov rcx, rbx
mov rdx, qword [rsp + 0x58]
mov r8, rbp
call fcn.14002b360
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x14000da34
lea rcx, [rsp + 0x78]
movups xmm0, xmmword [rcx]
movaps xmmword [rsp + 0xc0], xmm0
jmp 0x14000da42
movdqa xmmword [rsp + 0xc0], xmm6
mov eax, 1
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], rcx
mov qword [rsp + 0x80], r13
movaps xmm0, xmmword [rsp + 0xc0]
lea rcx, [rsp + 0x78]
movups xmmword [rcx + 0x18], xmm0
and dword [rcx + 0x40], 0
movdqu xmmword [rcx + 0x30], xmm6
mov qword [rsp + 0x88], rax
mov qword [rsp + 0xa0], 8
lea rcx, [rsp + 0x1f8]
mov rdx, rbx
call fcn.1400b674f
jmp 0x14000d921
lea rax, [rsp + 0x2a0]
movd xmm6, dword [rsp + 0x170]
movd xmm7, dword [rsp + 0x178]
mov r12, qword [rax - 8]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmm2, xmmword [rax + 0x20]
movaps xmmword [rsp + 0x100], xmm0
movaps xmmword [rsp + 0x110], xmm1
movaps xmmword [rsp + 0x120], xmm2
xor r15d, r15d
mov esi, 8
mov ecx, 8
xor edx, edx
call fcn.1400572ff
mov rdi, rax
movabs rax, 0x72657475706d6f43
mov qword [rdi], rax
movdqa xmm0, xmmword [rsp + 0x100]
movaps xmm1, xmmword [rsp + 0x110]
movaps xmm2, xmmword [rsp + 0x120]
movdqa xmmword [rsp + 0xc0], xmm0
movaps xmmword [rsp + 0xd0], xmm1
movaps xmmword [rsp + 0xe0], xmm2
cmp r12, 3
je 0x14000c3e8
mov rbx, rdx
mov ecx, 0x60
mov edx, 8
call fcn.140055bcc
mov rsi, rax
mov qword [rax], r12
movdqa xmm0, xmmword [rsp + 0xc0]
movaps xmm1, xmmword [rsp + 0xd0]
movaps xmm2, xmmword [rsp + 0xe0]
movdqu xmmword [rax + 8], xmm0
movups xmmword [rax + 0x18], xmm1
movups xmmword [rax + 0x28], xmm2
mov dword [rax + 0x38], ebp
movd dword [rax + 0x3c], xmm7
mov qword [rax + 0x40], rdi
mov qword [rax + 0x48], rbx
mov qword [rax + 0x50], 8
movd dword [rax + 0x58], xmm6
movd dword [rax + 0x5c], xmm6
mov r15d, 1
jmp 0x14000c3e8
mov ecx, 8
mov rdx, rsi
call fcn.14010e7f0
ud2
mov ecx, 8
mov edx, 0x120
jmp 0x14000dbb0