Function at 0x1401736c0
Capabilities:
Connect to wmi namespace via wbemlocator
Enumerate processes via ntquerysysteminformation
Get disk information
Get disk size
Get local ipv4 addresses
Get logon sessions
Get memory capacity
Get system information on windows
List groups for user account
List user accounts

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x978
movaps xmmword [rsp + 0x960], xmm9
movaps xmmword [rsp + 0x950], xmm8
movdqa xmmword [rsp + 0x940], xmm7
movdqa xmmword [rsp + 0x930], xmm6
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x3d0], rcx
xor ecx, ecx
call fcn.14014bae0
test rax, rax
je 0x140173bd4
movdqu xmm6, xmmword [rax]
inc qword [rax]
movzx eax, byte [0x141af8129]
mov edx, 0x56410
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x140173bd4
mov rsi, rax
add rsi, 0x56000
mov r8d, 0x410
mov rcx, rsi
mov dl, 0xff
call sub.msvcrt.dll_memset
movzx eax, byte [0x141af8129]
mov edx, 9
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x140173bd4
mov r14, rax
movabs rax, 0x5043206c61746f54
mov qword [r14], rax
mov byte [r14 + 8], 0x55
movzx eax, byte [0x141af8129]
mov edx, 0x120
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x140173bd4
mov rdi, rax
xor ecx, ecx
call fcn.14014bae0
test rax, rax
je 0x140173bd4
movabs rbx, 0x19db1ded53e8000
movups xmm8, xmmword [rax]
inc qword [rax]
mov qword [rsp + 0x3e0], 0
lea rcx, [rsp + 0x3e0]
call sub.KERNEL32.dll_GetSystemTimePreciseAsFileTime
mov rax, qword [rsp + 0x3e0]
cmp rax, rbx
jge 0x1401737ec
xor eax, eax
jmp 0x140173830
movabs rcx, 0xfe624e212ac18000
add rax, rcx
movabs rcx, 0xd6bf94d5e57a42bd
mul rcx
mov r15, rdx
shr r15, 0x17
call sub.KERNEL32.dll_GetTickCount64
shr rax, 3
movabs rcx, 0x20c49ba5e353f7cf
mul rcx
shr rdx, 4
xor eax, eax
sub r15, rdx
cmovae rax, r15
movabs r13, 0x8000000000000000
mov qword [rsp + 0x300], rsi
mov qword [rsp + 0x308], 0x3ff
mov qword [rsp + 0x310], 0x380
mov qword [rsp + 0x318], 0
movdqu xmmword [rsp + 0x320], xmm6
xorps xmm9, xmm9
movups xmmword [rsp + 0x360], xmm9
movups xmmword [rsp + 0x370], xmm9
mov qword [rsp + 0x228], 9
mov qword [rsp + 0x230], r14
mov qword [rsp + 0x238], 9
mov qword [rsp + 0x240], 0
mov qword [rsp + 0x248], 1
movups xmmword [rsp + 0x250], xmm9
mov qword [rsp + 0x260], 1
mov qword [rsp + 0x268], 0
mov qword [rsp + 0x270], r13
mov qword [rsp + 0x288], 0
mov dword [rsp + 0x290], 0
mov qword [rsp + 0x298], 0
mov qword [rsp + 0x2a0], 8
mov qword [rsp + 0x2a8], 0
mov byte [rsp + 0x2b0], 0
mov qword [rsp + 0x2b8], 0
mov qword [rsp + 0x2c0], 8
mov qword [rsp + 0x2c8], 0
mov qword [rsp + 0x2d0], 2
mov qword [rsp + 0x2d8], rdi
mov qword [rsp + 0x2e0], 0
mov qword [rsp + 0x380], 0
movdqu xmm6, xmmword [0x141ab3050]
movdqu xmmword [rsp + 0x340], xmm6
movdqu xmm7, xmmword [0x141ab3040]
movdqu xmmword [rsp + 0x330], xmm7
movups xmmword [rsp + 0x350], xmm8
mov qword [rsp + 0x3c0], rax
mov qword [rsp + 0x2e8], 0
mov qword [rsp + 0x2f0], 8
mov qword [rsp + 0x2f8], 0
mov rax, qword [rsp + 0x58]
cmp byte [rax + 4], 0
je 0x140173aea
movaps xmmword [rsp + 0xc0], xmm9
movaps xmmword [rsp + 0xf0], xmm9
movaps xmmword [rsp + 0xe0], xmm9
movaps xmmword [rsp + 0xd0], xmm9
mov dword [rsp + 0xc0], 0x40
lea rcx, [rsp + 0xc0]
call sub.KERNEL32.dll_GlobalMemoryStatusEx
movdqu xmm0, xmmword [rsp + 0xc8]
movdqu xmmword [rsp + 0x360], xmm0
movaps xmmword [rsp + 0x430], xmm9
movaps xmmword [rsp + 0x420], xmm9
movaps xmmword [rsp + 0x410], xmm9
movaps xmmword [rsp + 0x400], xmm9
movaps xmmword [rsp + 0x3f0], xmm9
movaps xmmword [rsp + 0x3e0], xmm9
mov qword [rsp + 0x440], 0
lea rcx, [rsp + 0x3e0]
mov edx, 0x68
call sub.psapi.dll_GetPerformanceInfo
cmp eax, 1
jne 0x140173ae5
mov rdx, qword [rsp + 0x3f0]
mov r9, qword [rsp + 0x400]
xor r10d, r10d
sub rdx, r9
cmovb rdx, r10
mov rcx, qword [rsp + 0x430]
mov rax, rcx
mul rdx
mov r8, rax
mov r11, 0xffffffffffffffff
cmovo r8, r11
mov rdx, qword [rsp + 0x3e8]
sub rdx, r9
cmovb rdx, r10
mov rax, rcx
mul rdx
cmovo rax, r11
mov qword [rsp + 0x370], r8
mov qword [rsp + 0x378], rax
mov rax, qword [rsp + 0x58]
cmp byte [rax + 0xb], 2
je 0x140174085
lea r15, [rsp + 0x380]
movzx ebp, byte [rax + 0xc]
cmp qword [rsp + 0x380], 0
je 0x140173c87
mov rcx, qword [rsp + 0x3b0]
call sub.pdh.dll_PdhCollectQueryData
cmp qword [rsp + 0x270], r13
je 0x140173b5b
mov rdx, qword [rsp + 0x278]
mov r8, qword [rsp + 0x280]
mov rcx, r15
call fcn.14017a610
test eax, eax
je 0x140173bd4
movss xmm1, dword [0x14021b958]
subss xmm1, xmm0
movss dword [rsp + 0x290], xmm1
mov edx, ebp
and dl, 1
lea rcx, [rsp + 0x228]
call fcn.14017a780
mov rax, qword [rsp + 0x2a8]
test rax, rax
je 0x140173bd6
mov rsi, qword [rsp + 0x2a0]
imul rdi, rax, 0x70
xor ebx, ebx
movss xmm8, dword [0x14021b958]
jmp 0x140173bb7
movaps xmm1, xmm8
subss xmm1, xmm0
movss dword [rsi + rbx + 0x68], xmm1
add rbx, 0x70
cmp rdi, rbx
je 0x140173bd6
cmp qword [rsi + rbx + 0x48], r13
je 0x140173bae
mov rdx, qword [rsi + rbx + 0x50]
mov r8, qword [rsi + rbx + 0x58]
mov rcx, r15
call fcn.14017a610
test eax, eax
jne 0x140173ba0
ud2
test bpl, 1
mov rax, qword [rsp + 0x58]
je 0x140174085
cmp byte [rsp + 0x2b0], 0
jne 0x140174085
mov rsi, qword [rsp + 0x2a8]
lea rcx, [rsp + 0x3e0]
mov rdx, rsi
call fcn.14017b0e0
mov rax, qword [rsp + 0x3e0]
mov r8, qword [rsp + 0x3e8]
test rsi, rsi
je 0x140174425
mov rdi, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x3f0]
shl rcx, 3
imul rdx, rsi, 0x70
xor r9d, r9d
xor r10d, r10d
nop word cs:[rax + rax]
cmp rcx, r10
je 0x140173c6b
mov r11, qword [r8 + r10]
mov qword [rdi + r9 + 0x60], r11
add r10, 8
add r9, 0x70
cmp rdx, r9
jne 0x140173c50
test rax, rax
je 0x140173c7e
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov rsi, qword [rdi + 0x60]
jmp 0x140177732
mov qword [rsp + 0x3e0], 0
lea r8, [rsp + 0x3e0]
xor ecx, ecx
xor edx, edx
call sub.pdh.dll_PdhOpenQueryA
test eax, eax
je 0x140173cc7
lea rax, [rsp + 0xc0]
mov qword [rax], 0
cmp qword [rsp + 0x380], 0
jne 0x140173d13
jmp 0x140173e01
mov rsi, qword [rsp + 0x3e0]
xor ecx, ecx
call fcn.14014bae0
test rax, rax
je 0x140173bd4
movups xmm8, xmmword [rax]
inc qword [rax]
lea rax, [0x141ab3030]
mov qword [rsp + 0xc0], rax
lea rax, [rsp + 0x80]
mov qword [rax], 0
cmp qword [rsp + 0x380], 0
je 0x140173e01
mov rcx, r15
call fcn.14017a550
mov r14, qword [rsp + 0x388]
test r14, r14
je 0x140173e01
mov rdi, qword [rsp + 0x380]
mov r15, qword [rsp + 0x398]
test r15, r15
je 0x140173dc7
movdqa xmm0, xmmword [rdi]
pmovmskb ebx, xmm0
not ebx
lea r12, [rdi + 0x10]
mov r13, rdi
jmp 0x140173d6f
dec r15
lea eax, [rbx - 1]
and eax, ebx
mov ebx, eax
test r15, r15
je 0x140173dc7
test bx, bx
jne 0x140173d9f
nop word cs:[rax + rax]
movdqa xmm0, xmmword [r12]
pmovmskb ebx, xmm0
add r13, 0xfffffffffffffe00
add r12, 0x10
cmp ebx, 0xffff
je 0x140173d80
not ebx
tzcnt ecx, ebx
shl ecx, 5
mov rax, r13
sub rax, rcx
cmp qword [rax - 0x20], 0
je 0x140173d60
mov r8, qword [rax - 0x18]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x140173d60
mov rax, r14
shl rax, 5
add r14, rax
cmp r14, 0xffffffffffffffcf
movabs r13, 0x8000000000000000
lea r15, [rsp + 0x380]
je 0x140173e01
sub rdi, rax
add rdi, 0xffffffffffffffe0
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x380], rax
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x388], xmm0
mov qword [rsp + 0x398], 0
movups xmmword [rsp + 0x3a0], xmm8
mov qword [rsp + 0x3b0], rsi
mov rcx, qword [rsp + 0x80]
mov qword [rsp + 0x3b8], rcx
test rax, rax
mov rax, qword [rsp + 0x58]
je 0x140174085
movzx eax, byte [0x141af8129]
mov edx, 0x1e
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x140173bd4
movups xmm0, xmmword [0x141a7bca3]
movups xmmword [rax + 0xe], xmm0
movdqu xmm0, xmmword [0x141a7bc95]
movdqu xmmword [rax], xmm0
mov qword [rsp + 0xc0], 0x1e
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], 0x1e
movzx eax, byte [0x141af8129]
mov edx, 5
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x140173bd4
lea r8, [rsp + 0x270]
mov byte [rsp + 0x50], bpl
mov edi, ebp
and dil, 1
mov byte [rax + 4], 0x30
mov dword [rax], 0x5f746f74
mov qword [rsp + 0x3e0], 5
mov qword [rsp + 0x3e8], rax
mov qword [rsp + 0x3f0], 5
lea rcx, [rsp + 0xc0]
lea r9, [rsp + 0x3e0]
mov rdx, r15
call fcn.1401815c0
lea rcx, [rsp + 0x228]
mov edx, edi
call fcn.14017a780
mov rax, qword [rsp + 0x2a8]
test rax, rax
je 0x14017405a
mov rdi, qword [rsp + 0x2a0]
add rdi, 0x48
imul rbx, rax, 0x70
xor r13d, r13d
mov qword [rsp + 0x190], r13
inc r13
lea rsi, [rsp + 0x190]
mov qword [rsp + 0x140], rsi
lea rbp, [0x140040fe0]
mov qword [rsp + 0x148], rbp
lea rax, [0x141a7bcd0]
mov qword [rsp + 0x3e0], rax
mov qword [rsp + 0x3e8], 2
mov qword [rsp + 0x400], 0
lea r14, [rsp + 0x140]
mov qword [rsp + 0x3f0], r14
mov qword [rsp + 0x3f8], 1
lea r15, [rsp + 0x80]
mov rcx, r15
lea r12, [rsp + 0x3e0]
mov rdx, r12
call fcn.140034eb0
mov qword [rsp + 0x140], rsi
mov qword [rsp + 0x148], rbp
lea rax, [0x141a7bcf8]
mov qword [rsp + 0x3e0], rax
mov qword [rsp + 0x3e8], 2
mov qword [rsp + 0x400], 0
mov qword [rsp + 0x3f0], r14
mov qword [rsp + 0x3f8], 1
lea rsi, [rsp + 0xc0]
mov rcx, rsi
mov rdx, r12
call fcn.140034eb0
mov rcx, r15
lea rdx, [rsp + 0x380]
mov r8, rdi
mov r9, rsi
call fcn.1401815c0
add rdi, 0x70
add rbx, 0xffffffffffffff90
jne 0x140173f50
cmp qword [rsp + 0x380], 0
movabs r13, 0x8000000000000000
mov rax, qword [rsp + 0x58]
movzx ebp, byte [rsp + 0x50]
lea r15, [rsp + 0x380]
jne 0x140173b0f
cmp byte [rax + 6], 0
je 0x140177751
xor ecx, ecx
xor edx, edx
call sub.ole32.dll_CoInitializeEx
mov esi, eax
cmp eax, 2
setb bl
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov edx, 0xffffffff
xor r8d, r8d
xor r9d, r9d
call sub.ole32.dll_CoInitializeSecurity
test eax, eax
js 0x1401742d3
mov qword [rsp + 0x70], 0
lea rax, [rsp + 0x70]
mov qword [rsp + 0x20], rax
lea rcx, [0x141ab5c70]
lea r9, [0x141ab5c54]
xor edx, edx
mov r8d, 1
call sub.ole32.dll_CoCreateInstance
test eax, eax
js 0x1401742d3
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x140], 1
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x150], 0
mov qword [rsp + 0x160], 0
mov byte [rsp + 0x170], bl
lea rcx, [rsp + 0x3e0]
lea rdx, [rsp + 0x140]
call fcn.14017ee40
mov r14, qword [rsp + 0x3e0]
cmp r14, 2
je 0x1401742dd
mov rsi, qword [rsp + 0x3e8]
mov r15, qword [rsp + 0x3f0]
mov rdi, qword [rsp + 0x3f8]
mov r12, qword [rsp + 0x400]
mov rbx, qword [rsp + 0x408]
movzx ebp, byte [rsp + 0x410]
test r15, r15
je 0x1401743de
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
mov rcx, rdi
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call sub.ole32.dll_CoSetProxyBlanket
test eax, eax
js 0x1401743de
lea rax, [rsp + 0x411]
mov ecx, dword [rax]
mov eax, dword [rax + 3]
mov dword [rsp + 0xb4], eax
mov dword [rsp + 0xb1], ecx
mov qword [rsp + 0x80], r14
mov qword [rsp + 0x88], rsi
mov qword [rsp + 0x90], r15
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xa0], r12
mov qword [rsp + 0xa8], rbx
mov byte [rsp + 0xb0], bpl
lea rcx, [rsp + 0xc0]
lea rdx, [rsp + 0x80]
call fcn.14017ef80
cmp dword [rsp + 0xc0], 2
je 0x1401742dd
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x1c0], rax
movups xmm0, xmmword [rsp + 0xc0]
movups xmm1, xmmword [rsp + 0xd0]
movdqu xmm2, xmmword [rsp + 0xe0]
movdqa xmmword [rsp + 0x1b0], xmm2
movaps xmmword [rsp + 0x1a0], xmm1
movaps xmmword [rsp + 0x190], xmm0
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x190]
mov r8b, 1
call fcn.14017f0d0
mov edi, dword [rsp + 0x74]
cmp edi, 2
jne 0x140174443
lea rcx, [rsp + 0x190]
call fcn.14017f2b0
jmp 0x1401742dd
cmp esi, 2
jae 0x1401742dd
call sub.ole32.dll_CoUninitialize
mov esi, 8
xor edi, edi
mov rbx, qword [rsp + 0x2c8]
test rbx, rbx
je 0x14017459f
mov r14, qword [rsp + 0x2c0]
jmp 0x14017430d
add r14, 0x60
dec rbx
je 0x14017459f
cmp qword [r14 + 0x38], 0
je 0x140174326
mov r8, qword [r14 + 0x40]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp dword [r14], 2
je 0x140174300
mov rcx, qword [r14 + 0x28]
cmp qword [r14 + 0x20], 0
mov qword [r14 + 0x20], 0
je 0x14017434a
test rcx, rcx
je 0x14017434a
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [r14 + 0x18]
cmp qword [r14 + 0x10], 0
mov qword [r14 + 0x10], 0
je 0x140174368
test rcx, rcx
je 0x140174368
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [r14 + 8]
cmp qword [r14], 0
mov qword [r14], 0
je 0x140174384
test rcx, rcx
je 0x140174384
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp byte [r14 + 0x30], 0
je 0x140174390
call sub.ole32.dll_CoUninitialize
cmp qword [r14], 0
je 0x1401743a5
mov rcx, qword [r14 + 8]
test rcx, rcx
je 0x1401743a5
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp qword [r14 + 0x10], 0
je 0x1401743bb
mov rcx, qword [r14 + 0x18]
test rcx, rcx
je 0x1401743bb
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp qword [r14 + 0x20], 0
je 0x140174300
mov rcx, qword [r14 + 0x28]
test rcx, rcx
je 0x140174300
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x140174300
test r12, r12
je 0x1401743f1
test rbx, rbx
je 0x1401743f1
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
test r15, r15
je 0x140174404
test rdi, rdi
je 0x140174404
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
test r14, r14
je 0x140174417
test rsi, rsi
je 0x140174417
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x10]
test bpl, bpl
jne 0x1401742d8
jmp 0x1401742dd
test rax, rax
je 0x140177730
mov rcx, qword [0x141af8068]
xor esi, esi
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x140177732
movss xmm8, dword [rsp + 0x70]
movss xmm9, dword [rsp + 0x78]
lea rcx, [rsp + 0x418]
call fcn.14017f330
movaps xmm0, xmmword [rsp + 0x190]
movaps xmm1, xmmword [rsp + 0x1a0]
movdqa xmm2, xmmword [rsp + 0x1b0]
movaps xmmword [rsp + 0x3e0], xmm0
movaps xmmword [rsp + 0x3f0], xmm1
movdqa xmmword [rsp + 0x400], xmm2
mov rax, qword [rsp + 0x1c0]
mov qword [rsp + 0x410], rax
mov rbx, qword [rsp + 0x3e0]
movups xmm0, xmmword [rsp + 0x418]
movaps xmmword [rsp + 0xf0], xmm0
mov rax, qword [rsp + 0x428]
mov qword [rsp + 0x100], rax
movups xmm0, xmmword [rsp + 0x3e8]
movaps xmmword [rsp + 0xc0], xmm0
movups xmm0, xmmword [rsp + 0x3f8]
movaps xmmword [rsp + 0xd0], xmm0
mov rax, qword [rsp + 0x408]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x410]
mov qword [rsp + 0xe8], rax
cmp rbx, 3
je 0x1401742dd
movzx eax, byte [0x141af8129]
mov edx, 0x60
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x140173bd4
mov rsi, rax
mov qword [rax], rbx
movaps xmm0, xmmword [rsp + 0xc0]
movaps xmm1, xmmword [rsp + 0xd0]
movdqa xmm2, xmmword [rsp + 0xe0]
movdqa xmm3, xmmword [rsp + 0xf0]
movups xmmword [rax + 8], xmm0
movups xmmword [rax + 0x18], xmm1
movdqu xmmword [rax + 0x28], xmm2
movdqu xmmword [rax + 0x38], xmm3
mov rax, qword [rsp + 0x100]
mov qword [rsi + 0x48], rax
mov dword [rsi + 0x50], edi
movss dword [rsi + 0x54], xmm9
movss dword [rsi + 0x58], xmm8
movss dword [rsi + 0x5c], xmm8
mov edi, 1
mov rbx, qword [rsp + 0x2c8]
test rbx, rbx
jne 0x1401742f5
cmp qword [rsp + 0x2b8], 0
je 0x1401745c0
mov r8, qword [rsp + 0x2c0]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov qword [rsp + 0x2b8], rdi
mov qword [rsp + 0x2c0], rsi
mov qword [rsp + 0x2c8], rdi
mov rax, qword [rsp + 0x58]
cmp byte [rax + 1], 0
je 0x140174691
mov qword [rsp + 0x140], 0
lea rcx, [rsp + 0x140]
call sub.iphlpapi.dll_GetIfTable2
test eax, eax
jne 0x1401758e2
mov rax, qword [rsp + 0x330]
mov rcx, qword [rsp + 0x348]
movdqa xmm0, xmmword [rax]
pmovmskb r8d, xmm0
not r8d
lea rdx, [rax + 0x10]
jmp 0x140174656
tzcnt r9d, r8d
mov r10, r9
neg r10
shl r9d, 3
shl r10, 7
sub r10, r9
lea r9d, [r8 - 1]
and r9d, r8d
mov byte [rax + r10 - 2], 0
mov r8d, r9d
sub rcx, 1
jb 0x1401747f0
test r8w, r8w
jne 0x140174630
nop word cs:[rax + rax]
movdqa xmm0, xmmword [rdx]
pmovmskb r8d, xmm0
add rax, 0xfffffffffffff780
add rdx, 0x10
cmp r8d, 0xffff
je 0x140174670
not r8d
jmp 0x140174630
cmp byte [rax], 0
je 0x140175e74
lea rsi, [rsp + 0x3e0]
mov r8d, 0x548
mov rcx, rsi
xor edx, edx
call sub.msvcrt.dll_memset
mov rdi, qword [rsp + 0x330]
mov rbx, qword [rsp + 0x348]
movdqa xmm0, xmmword [rdi]
pmovmskb r12d, xmm0
not r12d
lea r14, [rdi + 0x10]
mov r15, 0xffffffffffffffff
nop dword [rax]
test rbx, rbx
je 0x140174bd5
test r12w, r12w
jne 0x140174711
nop
movdqa xmm0, xmmword [r14]
pmovmskb r12d, xmm0
add rdi, 0xfffffffffffff780
add r14, 0x10
cmp r12d, 0xffff
je 0x1401746f0
not r12d
tzcnt eax, r12d
lea ecx, [r12 - 1]
and ecx, r12d
mov r12d, ecx
mov r13, rax
neg r13
shl eax, 3
shl r13, 7
sub r13, rax
dec rbx
mov rax, qword [rdi + r13 - 0x70]
mov qword [rsp + 0x3e0], rax
mov dword [rsp + 0x3e8], 0
mov rcx, rsi
call sub.iphlpapi.dll_GetIfEntry2
test eax, eax
jne 0x1401746e0
add r13, rdi
mov rax, qword [r13 - 0x68]
mov rcx, qword [r13 - 0x58]
mov qword [r13 - 0x60], rax
mov rax, qword [rsp + 0x8e0]
mov qword [r13 - 0x68], rax
mov qword [r13 - 0x50], rcx
mov rax, qword [rsp + 0x898]
mov qword [r13 - 0x58], rax
mov rax, qword [r13 - 0x48]
mov qword [r13 - 0x40], rax
mov rax, qword [rsp + 0x8a0]
add rax, qword [rsp + 0x8a8]
cmovb rax, r15
mov qword [r13 - 0x48], rax
mov rax, qword [r13 - 0x38]
mov qword [r13 - 0x30], rax
mov rax, qword [rsp + 0x8e8]
add rax, qword [rsp + 0x8f0]
cmovb rax, r15
mov qword [r13 - 0x38], rax
mov rax, qword [r13 - 0x28]
mov qword [r13 - 0x20], rax
mov rax, qword [rsp + 0x8b8]
mov qword [r13 - 0x28], rax
mov rax, qword [r13 - 0x18]
mov qword [r13 - 0x10], rax
mov rax, qword [rsp + 0x900]
mov qword [r13 - 0x18], rax
jmp 0x1401746e0
xor ecx, ecx
call fcn.14014bae0
test rax, rax
je 0x140173bd4
movdqa xmmword [rsp + 0x3f0], xmm6
movdqa xmmword [rsp + 0x3e0], xmm7
movdqu xmm0, xmmword [rax]
inc qword [rax]
movdqa xmmword [rsp + 0x400], xmm0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 8
mov qword [rsp + 0x90], 0
mov rax, qword [rsp + 0x140]
mov r14d, dword [rax]
test r14, r14
je 0x140175354
mov qword [rsp + 0x1d8], rax
lea rbx, [rax + 8]
xor ebp, ebp
pxor xmm6, xmm6
pcmpeqd xmm7, xmm7
lea rdi, [rsp + 0x80]
mov qword [rsp + 0x68], rbx
jmp 0x1401748cc
mov rax, qword [rsp + 0x88]
mov rcx, rsi
shl rcx, 5
mov dword [rax + rcx], ebp
mov qword [rax + rcx + 8], 0xa
mov qword [rax + rcx + 0x10], r15
mov qword [rax + rcx + 0x18], 0xa
inc rsi
mov qword [rsp + 0x90], rsi
nop word cs:[rax + rax]
inc rbp
cmp rbp, r14
je 0x140174bf7
imul rax, rbp, 0x548
lea rsi, [rbx + rax]
cmp qword [rbx + rax + 0x4a8], 0
jne 0x1401748ec
cmp qword [rsi + 0x4b0], 0
je 0x1401748c0
cmp dword [rsi + 0x48c], 2
je 0x1401748c0
cmp dword [rsi + 0x420], 0
je 0x1401748c0
movzx eax, byte [0x141af8129]
mov edx, 0x14
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x140173bd4
mov r15, rax
mov eax, dword [rsi + 0x10]
movq xmm0, qword [rsi + 0x14]
punpcklbw xmm0, xmm6
mov dword [r15], eax
movdqu xmmword [r15 + 4], xmm0
movzx eax, byte [0x141af8129]
mov edx, 0x14
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x140173bd4
mov r12, rax
mov eax, dword [r15 + 0x10]
mov dword [r12 + 0x10], eax
movups xmm0, xmmword [r15]
movups xmmword [r12], xmm0
mov rcx, qword [rsp + 0x400]
mov rdx, qword [rsp + 0x408]
mov r9d, 0xa
mov r8, r12
call fcn.14017bcc0
mov rbx, rax
shr rbx, 0x39
mov rcx, qword [rsp + 0x3e0]
mov rdx, qword [rsp + 0x3e8]
mov r8, rdx
and r8, rax
movd xmm0, ebx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
mov r9, r8
xor r10d, r10d
movdqu xmm1, xmmword [rcx + r9]
movdqa xmm2, xmm1
pcmpeqb xmm2, xmm0
pmovmskb r11d, xmm2
nop dword [rax]
test r11w, r11w
je 0x140174a40
tzcnt r13d, r11d
lea esi, [r11 - 1]
and esi, r11d
mov r11d, esi
add r13, r9
and r13, rdx
shl r13, 5
mov rsi, rcx
sub rsi, r13
cmp qword [rsi - 0x10], 0xa
jne 0x1401749d0
mov r13, qword [rsi - 0x18]
movdqu xmm2, xmmword [r13]
movdqu xmm3, xmmword [r12]
pcmpeqb xmm3, xmm2
movd xmm2, dword [r13 + 0x10]
movd xmm4, dword [r12 + 0x10]
pcmpeqb xmm4, xmm2
pand xmm4, xmm3
pmovmskb r13d, xmm4
cmp r13d, 0xffff
jne 0x1401749d0
jmp 0x140174a70
pcmpeqb xmm1, xmm7
pmovmskb r11d, xmm1
test r11d, r11d
jne 0x140174ad6
add r9, r10
add r9, 0x10
add r10, 0x10
and r9, rdx
jmp 0x1401749b6
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, r12
call sub.KERNEL32.dll_HeapFree
movabs r13, 0x8000000000000000
mov eax, dword [rsi - 8]
inc eax
mov dword [rsi - 8], eax
cmp eax, 1
mov rbx, qword [rsp + 0x68]
jle 0x140174ab3
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, r15
call sub.KERNEL32.dll_HeapFree
jmp 0x1401748c0
mov rsi, qword [rsp + 0x90]
cmp rsi, qword [rsp + 0x80]
jne 0x14017487f
mov rcx, rdi
call fcn.140106ea0
jmp 0x14017487f
cmp qword [rsp + 0x3f0], 0
je 0x140174ba2
movdqu xmm0, xmmword [rcx + r8]
pmovmskb eax, xmm0
test eax, eax
movabs r13, 0x8000000000000000
jne 0x140174b28
mov r9d, 0x10
nop word cs:[rax + rax]
add r8, r9
and r8, rdx
movdqu xmm0, xmmword [rcx + r8]
pmovmskb eax, xmm0
add r9, 0x10
test eax, eax
je 0x140174b10
tzcnt eax, eax
add rax, r8
and rax, rdx
movzx r8d, byte [rcx + rax]
test r8b, r8b
js 0x140174b4d
movdqa xmm0, xmmword [rcx]
pmovmskb eax, xmm0
tzcnt eax, eax
movzx r8d, byte [rcx + rax]
lea r9, [rax - 0x10]
and r9, rdx
mov byte [rcx + rax], bl
mov byte [rcx + r9 + 0x10], bl
shl rax, 5
mov rsi, rcx
sub rsi, rax
and r8b, 1
movzx edx, r8b
sub qword [rsp + 0x3f0], rdx
neg rax
mov qword [rcx + rax - 0x20], 0xa
mov qword [rsi - 0x18], r12
mov qword [rsi - 0x10], 0xa
mov dword [rsi - 8], 0
inc qword [rsp + 0x3f8]
jmp 0x140174a8b
lea rcx, [rsp + 0x3e0]
lea rdx, [rsp + 0x400]
mov rsi, rax
call fcn.140179740
mov rcx, qword [rsp + 0x3e0]
mov rdx, qword [rsp + 0x3e8]
and rsi, rdx
mov r8, rsi
jmp 0x140174ae5
movabs r13, 0x8000000000000000
mov rax, qword [rsp + 0x58]
movzx ebp, byte [rax + 8]
cmp bpl, 2
je 0x140175e82
jmp 0x1401758f5
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x1e8], rax
mov rcx, qword [rsp + 0x88]
mov rax, qword [rsp + 0x90]
mov rsi, rax
shl rsi, 5
add rsi, rcx
mov qword [rsp + 0x1c8], rcx
mov rdi, rcx
test rax, rax
je 0x1401752f2
add qword [rsp + 0x1d8], 0x2a
pcmpeqd xmm6, xmm6
mov rdi, qword [rsp + 0x1c8]
mov qword [rsp + 0x1e0], rsi
jmp 0x140174c7f
test r14, r14
je 0x140174c76
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, r15
call sub.KERNEL32.dll_HeapFree
cmp rdi, rsi
je 0x140175333
mov rax, rdi
add rdi, 0x20
mov r14, qword [rax + 8]
cmp r14, r13
je 0x1401752f2
mov r15, qword [rax + 0x10]
mov edx, dword [rax]
cmp qword [rsp + 0x3f8], 0
je 0x140174e20
mov qword [rsp + 0x130], rdx
mov qword [rsp + 0x178], r14
mov qword [rsp + 0x138], rdi
mov rsi, qword [rax + 0x18]
mov rcx, qword [rsp + 0x400]
mov rdx, qword [rsp + 0x408]
mov qword [rsp + 0x50], r15
mov r8, r15
mov r9, rsi
call fcn.14017bcc0
mov rdi, rax
mov rcx, qword [rsp + 0x3e0]
mov rbx, qword [rsp + 0x3e8]
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
lea r15, [rcx - 0x20]
lea rbp, [rsi + rsi]
xor r14d, r14d
mov qword [rsp + 0x60], rcx
and rdi, rbx
movdqu xmm8, xmmword [rcx + rdi]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb r13d, xmm0
nop word cs:[rax + rax]
test r13w, r13w
je 0x140174d90
tzcnt r12d, r13d
lea eax, [r13 - 1]
and eax, r13d
mov r13d, eax
add r12, rdi
and r12, rbx
mov rcx, r12
shl rcx, 5
mov rax, r15
sub rax, rcx
cmp rsi, qword [rax + 0x10]
jne 0x140174d40
mov rdx, qword [rax + 8]
mov rcx, qword [rsp + 0x50]
mov r8, rbp
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x140174d40
jmp 0x140174dc0
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x14017512b
add rdi, r14
add rdi, 0x10
add r14, 0x10
mov rcx, qword [rsp + 0x60]
jmp 0x140174d1d
neg r12
shl r12, 5
mov rcx, qword [rsp + 0x60]
add rcx, r12
mov rdx, qword [rsp + 0x130]
lea rax, [rcx - 0x20]
test rcx, rcx
cmove rax, rcx
add rax, 0x18
test rcx, rcx
cmove rax, rcx
movabs r13, 0x8000000000000000
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x1e0]
mov rdi, qword [rsp + 0x138]
mov r15, qword [rsp + 0x50]
mov r14, qword [rsp + 0x178]
jmp 0x140174e22
xor eax, eax
test rax, rax
lea rcx, [0x141a7bf90]
cmove rax, rcx
cmp dword [rax], 1
jg 0x140174c60
imul rax, rdx, 0x548
lea r12, [rbx + rax]
lea rdx, [r12 + 0x1c]
add rax, qword [rsp + 0x1d8]
mov ecx, 0x200
xor r8d, r8d
cmp word [rax + r8*2 - 6], 0
je 0x140174eba
nop word cs:[rax + rax]
test rcx, rcx
je 0x140174ea2
cmp word [rax + r8*2 - 4], 0
je 0x140174eaa
cmp word [rax + r8*2 - 2], 0
je 0x140174eb0
cmp word [rax + r8*2], 0
je 0x140174eb6
add r8, 4
add rcx, 0xfffffffffffffff8
cmp word [rax + r8*2 - 6], 0
jne 0x140174e70
jmp 0x140174eba
mov r8d, 0x101
jmp 0x140174ec7
or r8, 1
jmp 0x140174eba
or r8, 2
jmp 0x140174eba
or r8, 3
cmp r8, 0x101
ja 0x140173bd4
lea rcx, [rsp + 0xc0]
call fcn.140034b10
mov rax, qword [rsp + 0xc0]
cmp rax, r13
je 0x140174c60
mov qword [rsp + 0x1d0], r12
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x178], r14
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x138], rdi
mov r8, qword [rsp + 0xc8]
mov rbp, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x350]
mov rdx, qword [rsp + 0x358]
mov qword [rsp + 0x60], r8
mov r9, rbp
call fcn.14017be60
mov rcx, rax
shr rcx, 0x39
mov rbx, qword [rsp + 0x330]
mov r14, qword [rsp + 0x338]
mov rdi, r14
mov qword [rsp + 0x1f0], rax
and rdi, rax
mov qword [rsp + 0x200], rcx
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
mov qword [rsp + 0x1f8], rdi
xor edx, edx
movdqu xmm8, xmmword [rbx + rdi]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb r15d, xmm0
nop word cs:[rax + rax]
test r15w, r15w
je 0x140175000
tzcnt eax, r15d
lea ecx, [r15 - 1]
and ecx, r15d
mov r15d, ecx
add rax, rdi
and rax, r14
mov r12, rax
neg r12
shl rax, 3
shl r12, 7
sub r12, rax
cmp qword [rbx + r12 - 0x78], rbp
jne 0x140174fa0
add r12, rbx
mov rcx, qword [r12 - 0x80]
mov rsi, r13
mov r13, rdx
mov rdx, qword [rsp + 0x60]
mov r8, rbp
call sub.msvcrt.dll_memcmp
mov rdx, r13
mov r13, rsi
test eax, eax
jne 0x140174fa0
jmp 0x140175030
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x140175132
add rdi, rdx
add rdi, 0x10
add rdx, 0x10
and rdi, r14
jmp 0x140174f80
mov rax, qword [r12 - 0x68]
mov rcx, qword [r12 - 0x58]
mov qword [r12 - 0x60], rax
mov rdx, qword [rsp + 0x1d0]
mov rax, qword [rdx + 0x500]
mov qword [r12 - 0x68], rax
mov qword [r12 - 0x50], rcx
mov rax, qword [rdx + 0x4b8]
mov qword [r12 - 0x58], rax
mov rax, qword [r12 - 0x48]
mov qword [r12 - 0x40], rax
mov rax, qword [rdx + 0x4c0]
add rax, qword [rdx + 0x4c8]
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov qword [r12 - 0x48], rax
mov rax, qword [r12 - 0x38]
mov qword [r12 - 0x30], rax
mov rax, qword [rdx + 0x508]
add rax, qword [rdx + 0x510]
cmovb rax, rcx
mov qword [r12 - 0x38], rax
mov rax, qword [r12 - 0x28]
mov qword [r12 - 0x20], rax
mov rax, qword [rdx + 0x4d8]
mov qword [r12 - 0x28], rax
mov rax, qword [r12 - 0x18]
mov qword [r12 - 0x10], rax
mov rax, qword [rdx + 0x520]
mov qword [r12 - 0x18], rax
mov byte [r12 - 2], 1
cmp qword [rsp + 0x130], 0
je 0x1401750fd
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, qword [rsp + 0x60]
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x178], 0
mov rbx, qword [rsp + 0x68]
mov rsi, qword [rsp + 0x1e0]
mov rdi, qword [rsp + 0x138]
mov r15, qword [rsp + 0x50]
jne 0x140174c65
jmp 0x140174c76
xor ecx, ecx
jmp 0x140174dcf
cmp qword [rsp + 0x340], 0
mov rdi, qword [rsp + 0x1d0]
mov r15, qword [rsp + 0x1f8]
je 0x1401752bd
mov rax, qword [rdi + 0x4c0]
add rax, qword [rdi + 0x4c8]
mov rdx, 0xffffffffffffffff
cmovb rax, rdx
mov rcx, qword [rdi + 0x508]
add rcx, qword [rdi + 0x510]
cmovb rcx, rdx
mov r11, qword [rdi]
mov r10, qword [rdi + 0x500]
mov r9, qword [rdi + 0x4b8]
mov r8, qword [rdi + 0x4d8]
mov rdx, qword [rdi + 0x520]
movdqu xmm0, xmmword [rbx + r15]
pmovmskb edi, xmm0
test edi, edi
jne 0x1401751db
mov r12, r15
mov r15d, 0x10
nop word cs:[rax + rax]
add r12, r15
and r12, r14
movdqu xmm0, xmmword [rbx + r12]
pmovmskb edi, xmm0
add r15, 0x10
test edi, edi
je 0x1401751c0
mov r15, r12
tzcnt edi, edi
add rdi, r15
and rdi, r14
movzx r15d, byte [rbx + rdi]
test r15b, r15b
js 0x140175200
movdqa xmm0, xmmword [rbx]
pmovmskb edi, xmm0
tzcnt edi, edi
movzx r15d, byte [rbx + rdi]
lea r12, [rdi - 0x10]
and r12, r14
mov r14, qword [rsp + 0x200]
mov byte [rbx + rdi], r14b
mov byte [rbx + r12 + 0x10], r14b
and r15b, 1
movzx r14d, r15b
sub qword [rsp + 0x340], r14
mov r14, rdi
neg r14
shl rdi, 3
shl r14, 7
sub r14, rdi
mov rdi, qword [rsp + 0x130]
mov qword [rbx + r14 - 0x88], rdi
mov rsi, qword [rsp + 0x60]
mov qword [rbx + r14 - 0x80], rsi
mov qword [rbx + r14 - 0x78], rbp
mov qword [rbx + r14 - 0x70], r11
mov qword [rbx + r14 - 0x68], r10
mov qword [rbx + r14 - 0x60], r10
mov qword [rbx + r14 - 0x58], r9
mov qword [rbx + r14 - 0x50], r9
mov qword [rbx + r14 - 0x48], rax
mov qword [rbx + r14 - 0x40], rax
mov qword [rbx + r14 - 0x38], rcx
mov qword [rbx + r14 - 0x30], rcx
mov qword [rbx + r14 - 0x28], r8
mov qword [rbx + r14 - 0x20], r8
mov qword [rbx + r14 - 0x18], rdx
mov qword [rbx + r14 - 0x10], rdx
mov dword [rbx + r14 - 8], 0
mov word [rbx + r14 - 4], 0
mov byte [rbx + r14 - 2], 1
inc qword [rsp + 0x348]
jmp 0x1401750fd
lea rcx, [rsp + 0x330]
lea rdx, [rsp + 0x350]
call fcn.1401783e0
mov rbx, qword [rsp + 0x330]
mov r14, qword [rsp + 0x338]
mov r15, qword [rsp + 0x1f0]
and r15, r14
jmp 0x140175151
sub rsi, rdi
je 0x140175333
shr rsi, 5
add rdi, 0x10
jmp 0x140175319
add rdi, 0x20
dec rsi
je 0x140175333
cmp qword [rdi - 8], 0
je 0x140175310
mov r8, qword [rdi]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x140175310
cmp qword [rsp + 0x1e8], 0
je 0x140175354
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, qword [rsp + 0x1c8]
call sub.KERNEL32.dll_HeapFree
mov rcx, qword [rsp + 0x140]
call sub.iphlpapi.dll_FreeMibTable
mov rdi, qword [rsp + 0x3e8]
test rdi, rdi
je 0x140175432
mov rsi, qword [rsp + 0x3e0]
mov rbx, qword [rsp + 0x3f8]
test rbx, rbx
je 0x14017540a
movdqa xmm0, xmmword [rsi]
pmovmskb r12d, xmm0
not r12d
lea r14, [rsi + 0x10]
mov r15, rsi
jmp 0x1401753b3
dec rbx
lea eax, [r12 - 1]
and eax, r12d
mov r12d, eax
test rbx, rbx
je 0x14017540a
test r12w, r12w
jne 0x1401753e1
nop dword [rax]
movdqa xmm0, xmmword [r14]
pmovmskb r12d, xmm0
add r15, 0xfffffffffffffe00
add r14, 0x10
cmp r12d, 0xffff
je 0x1401753c0
not r12d
tzcnt ecx, r12d
shl ecx, 5
mov rax, r15
sub rax, rcx
cmp qword [rax - 0x20], 0
je 0x1401753a0
mov r8, qword [rax - 0x18]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x1401753a0
mov rax, rdi
shl rax, 5
add rdi, rax
cmp rdi, 0xffffffffffffffcf
je 0x140175432
sub rsi, rax
add rsi, 0xffffffffffffffe0
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov rsi, qword [rsp + 0x330]
mov rdi, qword [rsp + 0x348]
movdqa xmm0, xmmword [rsi]
pmovmskb r15d, xmm0
not r15d
lea rbx, [rsi + 0x10]
movabs r14, 0xf0f0f0f0f0f0f0f1
pcmpeqd xmm6, xmm6
test rdi, rdi
je 0x14017556f
test r15w, r15w
jne 0x140175490
nop
movdqa xmm0, xmmword [rbx]
pmovmskb r15d, xmm0
add rsi, 0xfffffffffffff780
add rbx, 0x10
cmp r15d, 0xffff
je 0x140175470
not r15d
tzcnt ecx, r15d
lea eax, [r15 - 1]
and eax, r15d
mov r15d, eax
mov rax, rcx
neg rax
shl ecx, 3
shl rax, 7
sub rax, rcx
dec rdi
cmp byte [rsi + rax - 2], 0
jne 0x140175460
add rax, rsi
mov rcx, qword [rsp + 0x330]
mov rdx, rcx
sub rdx, rax
sar rdx, 3
imul rdx, r14
lea r8, [rdx - 0x10]
and r8, qword [rsp + 0x338]
movdqu xmm0, xmmword [rcx + r8]
pcmpeqb xmm0, xmm6
psllw xmm0, 7
pmovmskb r9d, xmm0
test r9d, r9d
je 0x140175502
bsr r9w, r9w
xor r9d, 0xf
jmp 0x140175507
mov r9w, 0x10
movdqu xmm0, xmmword [rcx + rdx]
pcmpeqb xmm0, xmm6
pmovmskb r10d, xmm0
or r10d, 0x10000
tzcnt r10d, r10d
add r9d, r10d
mov r10b, pe_nt_image_headers64
cmp r9w, 0xf
ja 0x140175539
inc qword [rsp + 0x340]
mov r10b, 0xff
mov byte [rcx + rdx], r10b
mov byte [rcx + r8 + 0x10], r10b
dec qword [rsp + 0x348]
cmp qword [rax - 0x88], 0
je 0x140175460
mov r8, qword [rax - 0x80]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x140175460
mov dword [rsp + 0x70], 0x3c00
mov dword [rsp + 0x190], 0
xor edi, edi
lea rbx, [rsp + 0x70]
xor ebp, ebp
nop dword [rax + rax]
mov edx, dword [rsp + 0x70]
mov rcx, rdi
call sub.msvcrt.dll_realloc
test rax, rax
je 0x140175677
mov rsi, rax
mov qword [rsp + 0x20], rbx
xor ecx, ecx
mov edx, 0xe
xor r8d, r8d
mov r9, rax
call sub.iphlpapi.dll_GetAdaptersAddresses
mov dword [rsp + 0x190], eax
test eax, eax
je 0x140175e4b
cmp ebp, 1
ja 0x1401755dd
inc ebp
mov rdi, rsi
cmp eax, 0x6f
je 0x140175590
lea rax, [rsp + 0x190]
mov qword [rsp + 0x80], rax
lea rax, [0x140040d90]
mov qword [rsp + 0x88], rax
lea rax, [0x141a7bf40]
mov qword [rsp + 0x3e0], rax
mov qword [rsp + 0x3e8], 1
mov qword [rsp + 0x400], 0
lea rax, [rsp + 0x80]
mov qword [rsp + 0x3f0], rax
mov qword [rsp + 0x3f8], 1
lea rcx, [rsp + 0xc0]
lea rdx, [rsp + 0x3e0]
call fcn.140034eb0
mov rcx, rsi
call sub.msvcrt.dll_free
mov rbx, qword [rsp + 0xc0]
mov rax, qword [rsp + 0x58]
test rbx, rbx
jne 0x1401756f9
jmp 0x140175e74
movzx eax, byte [0x141af8129]
mov ebx, 0x32
mov edx, 0x32
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x140173bd4
mov rsi, rax
movups xmm0, xmmword [0x141a7bf06]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x141a7bef6]
movups xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [0x141a7bee6]
movdqu xmmword [rax], xmm0
mov word [rax + 0x30], 0x5345
mov rcx, rdi
call sub.msvcrt.dll_free
mov qword [rsp + 0xc0], 0x32
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0xd0], 0x32
mov rax, qword [rsp + 0x58]
test rbx, rbx
je 0x140175e74
movabs rax, 0x8000000000000000
cmp rbx, rax
jne 0x140175e21
movdqu xmm0, xmmword [rsp + 0xc8]
movdqa xmmword [rsp + 0x80], xmm0
pcmpeqd xmm6, xmm6
nop word cs:[rax + rax]
lea rcx, [rsp + 0x3e0]
lea rdx, [rsp + 0x80]
call fcn.14017f380
mov rax, qword [rsp + 0x3e0]
cmp rax, r13
je 0x1401758d5
mov qword [rsp + 0x68], rax
mov rbx, qword [rsp + 0x3e8]
cmp qword [rsp + 0x348], 0
je 0x1401758b3
mov r14, qword [rsp + 0x3f0]
mov rcx, qword [rsp + 0x350]
mov rdx, qword [rsp + 0x358]
mov r8, rbx
mov r9, r14
call fcn.14017be60
mov r15, rax
mov rcx, qword [rsp + 0x330]
mov rsi, qword [rsp + 0x338]
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
lea rdi, [rcx - 0x88]
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], rcx
and r15, rsi
movdqu xmm8, xmmword [rcx + r15]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb ebp, xmm0
nop word [rax + rax]
test bp, bp
je 0x140175840
tzcnt ecx, ebp
lea eax, [rbp - 1]
and eax, ebp
mov ebp, eax
add rcx, r15
and rcx, rsi
mov r12, rcx
neg r12
shl rcx, 3
mov r13, r12
shl r13, 7
mov rax, r13
sub rax, rcx
cmp r14, qword [rdi + rax + 0x10]
jne 0x1401757f0
add rax, rdi
mov rdx, qword [rax + 8]
mov rcx, rbx
mov r8, r14
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x1401757f0
jmp 0x140175880
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
movabs r13, 0x8000000000000000
jne 0x1401758b3
mov rax, qword [rsp + 0x50]
add r15, rax
add r15, 0x10
add rax, 0x10
mov qword [rsp + 0x50], rax
mov rcx, qword [rsp + 0x60]
jmp 0x1401757d1
lea rax, [r12*8]
add rax, r13
lea rdx, [rsp + 0x3f8]
movzx ecx, word [rdx + 4]
mov r8, qword [rsp + 0x60]
mov word [r8 + rax - 4], cx
mov ecx, dword [rdx]
mov dword [r8 + rax - 8], ecx
movabs r13, 0x8000000000000000
cmp qword [rsp + 0x68], 0
je 0x140175730
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
jmp 0x140175730
mov rcx, qword [rsp + 0x80]
call sub.msvcrt.dll_free
mov rax, qword [rsp + 0x58]
movzx ebp, byte [rax + 8]
cmp bpl, 2
je 0x140175e82
movzx eax, word [rax + 9]
mov byte [rsp + 0xbe], ah
shl eax, 8
movzx ecx, bpl
or ecx, eax
mov word [rsp + 0xbc], cx
movzx eax, byte [0x141af8129]
mov r12d, 0x80000
mov edx, 0x80000
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x140173bd4
mov rsi, rax
lea r15, [rsp + 0x300]
mov qword [rsp + 0x190], 0x80000
mov qword [rsp + 0x198], rax
mov qword [rsp + 0x1a0], 0
xor edx, edx
lea rdi, [rsp + 0x190]
lea r14, [rsp + 0x3e0]
mov ebx, 0x80000
mov dword [rsp + 0x3e0], 0
sub r12, rdx
cmp r12, rbx
jae 0x1401759e0
jmp 0x1401759c9
mov eax, dword [rsp + 0x3e0]
add rbx, rbx
lea ecx, [rax + 0x2800]
test eax, eax
cmovne rbx, rcx
mov r12, qword [rsp + 0x190]
mov rdx, qword [rsp + 0x1a0]
mov dword [rsp + 0x3e0], 0
sub r12, rdx
cmp r12, rbx
jae 0x1401759e0
mov rcx, rdi
mov r8, rbx
call fcn.140106b90
mov rsi, qword [rsp + 0x198]
nop dword [rax]
mov ecx, 5
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
je 0x140175990
test eax, eax
jne 0x140177664
mov qword [rsp + 0x1a0], rbx
movzx eax, byte [0x141af8129]
mov edx, 0xfa0
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x140173bd4
mov qword [rsp + 0x140], 0x1f4
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x150], 0
mov rdi, qword [rsp + 0x198]
xor ebx, ebx
lea rsi, [rsp + 0x140]
xor r14d, r14d
jmp 0x140175a7d
lea rcx, [rdi + r14]
mov qword [rax + rbx*8], rcx
inc rbx
mov qword [rsp + 0x150], rbx
mov ecx, dword [rcx]
add r14, rcx
test rcx, rcx
je 0x140175a99
cmp rbx, qword [rsp + 0x140]
jne 0x140175a60
mov rcx, rsi
call fcn.14016bf60
mov rax, qword [rsp + 0x148]
jmp 0x140175a60
mov qword [rsp + 0x180], r15
test bpl, bpl
je 0x140175abf
lea rcx, [rsp + 0x228]
xor edx, edx
call fcn.14017a780
mov rax, qword [rsp + 0x2a8]
jmp 0x140175ac1
xor eax, eax
movabs rsi, 0x19db1ded53e8000
mov qword [rsp + 0x208], rax
mov qword [rsp + 0x3e0], 0
lea rcx, [rsp + 0x3e0]
call sub.KERNEL32.dll_GetSystemTimePreciseAsFileTime
mov rax, qword [rsp + 0x3e0]
cmp rax, rsi
jge 0x140175afd
xor edx, edx
jmp 0x140175b1b
movabs rcx, 0xfe624e212ac18000
add rax, rcx
movabs rcx, 0xd6bf94d5e57a42bd
mul rcx
shr rdx, 0x17
mov qword [rsp + 0x70], rdx
mov rsi, qword [rsp + 0x150]
mov qword [rsp + 0x3f0], rsi
movups xmm0, xmmword [rsp + 0x140]
movaps xmmword [rsp + 0x3e0], xmm0
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 8
mov qword [rsp + 0x90], 0
lea rax, [rsp + 0x180]
mov qword [rsp + 0x3f8], rax
lea rax, [rsp + 0xbc]
mov qword [rsp + 0x400], rax
lea rax, [rsp + 0x208]
mov qword [rsp + 0x408], rax
lea rax, [rsp + 0x70]
mov qword [rsp + 0x410], rax
mov r14, qword [rsp + 0x3e0]
cmp r14, rsi
jb 0x140173bd4
mov rdi, qword [rsp + 0x3e8]
xor ecx, ecx
call fcn.140064bd0
test rax, rax
je 0x140173bd4
lea rbx, [rsp + 0x3f8]
mov rax, qword [rax]
test rax, rax
je 0x140175be2
add rax, 0x110
jmp 0x140175be7
call fcn.140064ce0
mov rax, qword [rax]
mov r9, qword [rax + 0x208]
xor eax, eax
cmp rsi, 0xffffffffffffffff
sete al
cmp rax, r9
cmova r9, rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 1
lea rbx, [rsp + 0xc0]
mov rcx, rbx
mov rdx, rsi
xor r8d, r8d
call fcn.14017bff0
test r14, r14
je 0x140175c45
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, rdi
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsp + 0xd0]
test rax, rax
je 0x140175c91
xor r8d, r8d
nop word cs:[rax + rax]
mov rbx, qword [rbx]
test rbx, rbx
je 0x140175c75
add r8, qword [rbx + 0x10]
add rbx, 0x18
dec rax
jne 0x140175c60
mov rax, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x90]
sub rax, rdx
cmp rax, r8
jb 0x140177b82
mov r8, qword [rsp + 0xc0]
lea rdi, [rsp + 0x80]
nop word cs:[rax + rax]
test r8, r8
je 0x140175d79
mov rsi, qword [r8 + 0x18]
test rsi, rsi
je 0x140175cca
mov qword [rsi + 0x20], 0
mov r12, qword [r8]
mov rbx, qword [r8 + 8]
mov r14, qword [r8 + 0x10]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp r12, r13
je 0x140175d74
mov rax, qword [rsp + 0x80]
mov r15, qword [rsp + 0x90]
sub rax, r15
cmp rax, r14
jb 0x140175d5c
imul rcx, r15, 0x150
add rcx, qword [rsp + 0x88]
imul r8, r14, 0x150
mov rdx, rbx
call sub.msvcrt.dll_memcpy
add r15, r14
mov qword [rsp + 0x90], r15
mov rcx, rbx
xor edx, edx
call fcn.140179f30
mov r8, rsi
test r12, r12
je 0x140175cb0
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
mov r8, rsi
jmp 0x140175cb0
mov rcx, rdi
mov rdx, r15
mov r8, r14
call fcn.14016beb0
mov r15, qword [rsp + 0x90]
jmp 0x140175d04
test rsi, rsi
jne 0x140175de9
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x3c8], rax
mov rcx, qword [rsp + 0x88]
mov rax, qword [rsp + 0x90]
imul rdx, rax, 0x150
add rdx, rcx
mov qword [rsp + 0x220], rdx
mov qword [rsp + 0x218], rcx
mov rbp, rcx
test rax, rax
je 0x14017718d
pcmpeqd xmm6, xmm6
mov rdi, qword [rsp + 0x218]
jmp 0x140176c8d
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov rsi, rdi
test rdi, rdi
je 0x140175d79
mov rdi, qword [rsi + 0x18]
test rdi, rdi
je 0x140175dfa
mov qword [rdi + 0x20], 0
mov rcx, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
call fcn.140179f30
cmp qword [rsi], 0
je 0x140175dd0
mov r8, qword [rsi + 8]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x140175dd0
mov r8, qword [rsp + 0xc8]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsp + 0x58]
movzx ebp, byte [rax + 8]
cmp bpl, 2
je 0x140175e82
jmp 0x1401758f5
mov qword [rsp + 0xc8], rsi
mov qword [rsp + 0xd0], rsi
mov qword [rsp + 0xc0], r13
mov rbx, r13
mov rax, qword [rsp + 0x58]
test rbx, rbx
jne 0x1401756f9
movzx ebp, byte [rax + 8]
cmp bpl, 2
jne 0x1401758f5
cmp byte [rax + 2], 0
je 0x140177694
call sub.KERNEL32.dll_GetLogicalDrives
mov dword [rsp + 0x140], eax
test eax, eax
je 0x140175f02
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 8
mov qword [rsp + 0xd0], 0
lea rax, [rsp + 0x140]
mov qword [rsp + 0x80], rax
movabs rax, 0x2000000000
mov qword [rsp + 0x88], rax
xor ecx, ecx
call fcn.140064bd0
test rax, rax
je 0x140173bd4
mov rax, qword [rax]
test rax, rax
je 0x140175f10
add rax, 0x110
jmp 0x140175f15
mov esi, 8
xor edi, edi
xor ebx, ebx
jmp 0x140176080
call fcn.140064ce0
mov rax, qword [rax]
mov r9, qword [rax + 0x208]
lea rax, [rsp + 0x80]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x20
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 1
lea rsi, [rsp + 0x3e0]
mov edx, 0x20
mov rcx, rsi
xor r8d, r8d
call fcn.14017dc50
mov rax, qword [rsp + 0x3f0]
test rax, rax
je 0x140175f8e
xor r8d, r8d
nop dword [rax]
mov rsi, qword [rsi]
test rsi, rsi
je 0x140175f85
add r8, qword [rsi + 0x10]
add rsi, 0x18
dec rax
jne 0x140175f70
test r8, r8
jne 0x14017771c
mov r8, qword [rsp + 0x3e0]
lea rdi, [rsp + 0xc0]
nop
test r8, r8
je 0x140176068
mov rsi, qword [r8 + 0x18]
test rsi, rsi
je 0x140175fba
mov qword [rsi + 0x20], 0
mov r12, qword [r8]
mov rbx, qword [r8 + 8]
mov r14, qword [r8 + 0x10]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp r12, r13
je 0x14017605f
mov rax, qword [rsp + 0xc0]
mov r15, qword [rsp + 0xd0]
sub rax, r15
cmp rax, r14
jb 0x140176047
lea rcx, [r15 + r15*8]
shl rcx, 4
add rcx, qword [rsp + 0xc8]
mov rax, r14
shl rax, 4
lea r8, [rax + rax*8]
mov rdx, rbx
call sub.msvcrt.dll_memcpy
add r15, r14
mov qword [rsp + 0xd0], r15
mov r8, rsi
test r12, r12
je 0x140175fa0
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, rbx
call sub.KERNEL32.dll_HeapFree
mov r8, rsi
jmp 0x140175fa0
mov rcx, rdi
mov rdx, r15
mov r8, r14
call fcn.140172b60
mov r15, qword [rsp + 0xd0]
jmp 0x140175ff4
test rsi, rsi
jne 0x1401766ed
mov rbx, qword [rsp + 0xc0]
mov rsi, qword [rsp + 0xc8]
mov rdi, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0x2d8]
mov rdx, qword [rsp + 0x2e0]
call fcn.14017a110
cmp qword [rsp + 0x2d0], 0
je 0x1401760b6
mov r8, qword [rsp + 0x2d8]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov qword [rsp + 0x2d0], rbx
mov qword [rsp + 0x2d8], rsi
mov qword [rsp + 0x2e0], rdi
mov rax, qword [rsp + 0x58]
cmp byte [rax + 7], 0
je 0x140176b52
mov qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 8
mov qword [rsp + 0x90], 0
mov dword [rsp + 0x214], 0
lea rsi, [rsp + 0x190]
nop word cs:[rax + rax]
mov qword [rsp + 0x70], 0
mov dword [rsp + 0x18c], 0
mov dword [rsp + 0xbc], 0
lea rax, [rsp + 0x214]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xbc]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x18c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xffffffff
xor ecx, ecx
xor edx, edx
mov r8d, 2
lea r9, [rsp + 0x70]
call sub.netapi32.dll_NetUserEnum
test eax, eax
je 0x140176191
cmp eax, 0xea
jne 0x140176725
mov rbp, qword [rsp + 0x70]
mov ecx, dword [rsp + 0x18c]
test rcx, rcx
je 0x1401766ac
mov dword [rsp + 0x138], eax
lea r15, [rcx*8]
add r15, rbp
jmp 0x1401761cd
add rbp, 8
cmp rbp, r15
je 0x1401766a0
mov r14, qword [rbp]
test r14, r14
je 0x1401761c0
mov qword [rsp + 0x190], 0
xor ecx, ecx
mov rdx, r14
mov r8d, 0x17
mov r9, rsi
call sub.netapi32.dll_NetUserGetInfo
mov rcx, qword [rsp + 0x190]
test eax, eax
je 0x140176210
test rcx, rcx
jne 0x140176661
jmp 0x1401761c0
mov rdi, qword [rcx + 0x20]
test rdi, rdi
je 0x140176650
mov rcx, rdi
call sub.advapi32.dll_IsValidSid
test eax, eax
je 0x140176650
mov rcx, rdi
call sub.advapi32.dll_GetLengthSid
mov ebx, eax
test eax, eax
je 0x1401762fa
mov ecx, 8
mov rdx, rbx
call fcn.140146820
test rax, rax
je 0x140173bd4
mov r12, rax
mov ecx, ebx
mov rdx, rax
mov r8, rdi
call sub.advapi32.dll_CopySid
test eax, eax
je 0x140176316
cmp byte [r12], 1
jne 0x140173bd4
lea rcx, [rsp + 0xc0]
mov rdx, r12
call fcn.140181450
mov rdi, qword [rsp + 0xc0]
cmp rdi, r13
jne 0x140176335
mov r8, 0xffffffffffffffff
cmp word [r14 + r8*2 + 2], 0
lea r8, [r8 + 1]
jne 0x1401762a0
lea rcx, [rsp + 0x3e0]
mov rdx, r14
call fcn.140034b10
mov rdi, qword [rsp + 0x3e0]
cmp rdi, r13
mov eax, 0
cmove rdi, rax
mov rdx, qword [rsp + 0x3e8]
mov ecx, 1
cmove rdx, rcx
mov qword [rsp + 0x58], rdx
mov rcx, qword [rsp + 0x3f0]
cmove rcx, rax
mov qword [rsp + 0x68], rcx
jmp 0x14017634f
mov edx, 1
mov ecx, ebx
mov r8, rdi
call sub.advapi32.dll_CopySid
test eax, eax
je 0x140176650
jmp 0x140173bd4
test rbx, rbx
je 0x140176650
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, r12
call sub.KERNEL32.dll_HeapFree
jmp 0x140176650
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x68], rax
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x140], 0
mov dword [rsp + 0x180], 0
mov dword [rsp + 0x208], 0
lea rax, [rsp + 0x208]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x180]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x140]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0xffffffff
lea rcx, [0x141ab5c50]
mov rdx, r14
xor r8d, r8d
mov r9d, 1
call sub.netapi32.dll_NetUserGetLocalGroups
test eax, eax
mov qword [rsp + 0x60], rdi
je 0x14017642d
mov qword [rsp + 0xc0], 0
mov qword [rsp + 0xc8], 8
xor esi, esi
mov rcx, qword [rsp + 0x140]
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x3e0], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x3e8], rax
mov qword [rsp + 0x3f0], rsi
test rcx, rcx
movabs r13, 0x8000000000000000
je 0x14017657c
call sub.netapi32.dll_NetApiBufferFree
jmp 0x14017657c
mov esi, dword [rsp + 0x180]
test rsi, rsi
je 0x140176461
lea rax, [rsi*8]
lea rdx, [rax + rax*2]
movzx eax, byte [0x141af8129]
xor ecx, ecx
call fcn.140146820
test rax, rax
je 0x140173bd4
mov r14, rax
jmp 0x140176469
mov r14d, 8
xor esi, esi
mov qword [rsp + 0xc0], rsi
mov qword [rsp + 0xc8], r14
mov qword [rsp + 0xd0], 0
mov rbx, qword [rsp + 0x140]
test rbx, rbx
je 0x14017654c
mov edi, dword [rsp + 0x180]
cmp rsi, rdi
jb 0x14017666b
xor esi, esi
test rdi, rdi
je 0x1401763e0
xor r13d, r13d
nop word cs:[rax + rax]
mov rdx, qword [rbx + r13*8]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
cmp word [rdx + r8*2 + 2], 0
lea r8, [r8 + 1]
jne 0x1401764d0
lea rcx, [rsp + 0x3e0]
call fcn.140034b10
mov rax, qword [rsp + 0x3e0]
movabs rcx, 0x8000000000000000
cmp rax, rcx
mov r8d, 0
cmove rax, r8
mov rcx, qword [rsp + 0x3e8]
mov edx, 1
cmove rcx, rdx
mov rdx, qword [rsp + 0x3f0]
cmove rdx, r8
lea r8, [rsi + rsi*2]
mov qword [r14 + r8*8], rax
mov qword [r14 + r8*8 + 8], rcx
mov qword [r14 + r8*8 + 0x10], rdx
inc rsi
inc r13
cmp r13, rdi
jne 0x1401764c0
jmp 0x1401763e0
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x3f0], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x3e0], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x3e8], rax
mov rax, qword [rsp + 0x3e0]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x3e8]
mov qword [rsp + 0xc8], rax
mov rax, qword [rsp + 0x3f0]
mov qword [rsp + 0xd0], rax
mov rsi, qword [rsp + 0x90]
cmp rsi, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x50]
jne 0x1401765d0
lea rcx, [rsp + 0x80]
call fcn.140172ca0
mov rax, qword [rsp + 0x88]
lea rcx, [rsi + rsi*4]
shl rcx, 4
mov qword [rax + rcx], rdi
mov qword [rax + rcx + 8], r12
mov qword [rax + rcx + 0x10], rdi
mov rdx, qword [rsp + 0x60]
mov qword [rax + rcx + 0x18], rdx
mov rdx, qword [rsp + 0x58]
mov qword [rax + rcx + 0x20], rdx
mov rdx, qword [rsp + 0x68]
mov qword [rax + rcx + 0x28], rdx
movaps xmm0, xmmword [rsp + 0xc0]
movups xmmword [rax + rcx + 0x30], xmm0
mov rdx, qword [rsp + 0xd0]
mov qword [rax + rcx + 0x40], rdx
mov dword [rax + rcx + 0x48], 0
inc rsi
mov qword [rsp + 0x90], rsi
lea rsi, [rsp + 0x190]
nop word cs:[rax + rax]
mov rcx, qword [rsp + 0x190]
test rcx, rcx
je 0x1401761c0
call sub.netapi32.dll_NetApiBufferFree
jmp 0x1401761c0
lea rcx, [rsp + 0xc0]
xor edx, edx
mov r8, rdi
call fcn.140068c90
mov r14, qword [rsp + 0xc8]
mov rsi, qword [rsp + 0xd0]
test rdi, rdi
jne 0x1401764b1
jmp 0x1401763e0
mov rbp, qword [rsp + 0x70]
mov eax, dword [rsp + 0x138]
cmp eax, 0xea
jne 0x14017672a
test rbp, rbp
je 0x140176120
mov rcx, rbp
call sub.netapi32.dll_NetApiBufferFree
jmp 0x140176120
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, rsi
call sub.KERNEL32.dll_HeapFree
mov rsi, rdi
test rdi, rdi
je 0x140176068
mov rdi, qword [rsi + 0x18]
test rdi, rdi
je 0x1401766fe
mov qword [rdi + 0x20], 0
mov rcx, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
call fcn.14017a110
cmp qword [rsi], 0
je 0x1401766d0
mov r8, qword [rsi + 8]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x1401766d0
mov rbp, qword [rsp + 0x70]
test rbp, rbp
je 0x140176737
mov rcx, rbp
call sub.netapi32.dll_NetApiBufferFree
mov dword [rsp + 0x70], 0
mov qword [rsp + 0x190], 0
lea rcx, [rsp + 0x70]
lea rdx, [rsp + 0x190]
call sub.secur32.dll_LsaEnumerateLogonSessions
mov rsi, qword [rsp + 0x190]
test eax, eax
jne 0x140176a09
mov eax, dword [rsp + 0x70]
test rax, rax
je 0x140176a09
lea rdi, [rsi + rax*8]
lea rbx, [rsp + 0x140]
lea r15, [rsp + 0x3e0]
mov qword [rsp + 0x68], rdi
jmp 0x1401767b4
mov rcx, qword [rsp + 0x140]
test rcx, rcx
je 0x1401767a7
call sub.secur32.dll_LsaFreeReturnBuffer
add rsi, 8
cmp rsi, rdi
je 0x140176a01
mov qword [rsp + 0x140], 0
mov rcx, rsi
mov rdx, rbx
call sub.secur32.dll_LsaGetLogonSessionData
mov rcx, qword [rsp + 0x140]
test eax, eax
jne 0x14017679d
test rcx, rcx
je 0x14017679d
cmp dword [rcx + 0x40], 3
je 0x1401767a2
movzx r14d, word [rcx + 0x10]
mov r12, qword [rcx + 0x18]
mov rdx, qword [rcx + 0x48]
mov rcx, r15
call fcn.140181390
mov rax, qword [rsp + 0x3e0]
cmp rax, r13
je 0x140176795
mov qword [rsp + 0x58], r12
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x50], rax
mov r12, qword [rsp + 0x3e8]
mov r13, qword [rsp + 0x3f0]
mov rdi, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x90]
mov rax, rbx
shl rax, 4
lea rbp, [rax + rax*4]
xor r14d, r14d
mov r15, rdi
jmp 0x140176858
add r15, 0x50
add r14, 0x50
cmp rbp, r14
je 0x1401768b8
cmp qword [r15 + 0x10], r13
jne 0x140176850
mov rcx, qword [rdi + r14 + 8]
mov rdx, r12
mov r8, r13
call sub.msvcrt.dll_memcmp
test eax, eax
jne 0x140176850
cmp qword [rsp + 0x50], 0
movabs r13, 0x8000000000000000
mov rdi, qword [rsp + 0x68]
lea rbx, [rsp + 0x140]
lea r15, [rsp + 0x3e0]
je 0x140176795
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, r12
call sub.KERNEL32.dll_HeapFree
jmp 0x140176795
lea rcx, [rsp + 0xc0]
mov rdx, r12
call fcn.140181450
mov rbp, qword [rsp + 0xc0]
movabs r14, 0x8000000000000000
cmp rbp, r14
jne 0x14017693e
mov r8, qword [rsp + 0x60]
shr r8d, 1
lea r15, [rsp + 0x3e0]
mov rcx, r15
mov rdx, qword [rsp + 0x58]
call fcn.140034b10
mov rbp, qword [rsp + 0x3e0]
cmp rbp, r14
mov eax, 0
cmove rbp, rax
mov rdx, qword [rsp + 0x3e8]
mov ecx, 1
cmove rdx, rcx
mov rcx, qword [rsp + 0x3f0]
cmove rcx, rax
mov r14, qword [rsp + 0x50]
cmp rbx, qword [rsp + 0x80]
je 0x140176965
jmp 0x14017698a
mov rdx, qword [rsp + 0xc8]
mov rcx, qword [rsp + 0xd0]
lea r15, [rsp + 0x3e0]
mov r14, qword [rsp + 0x50]
cmp rbx, qword [rsp + 0x80]
jne 0x14017698a
mov qword [rsp + 0x50], rcx
lea rcx, [rsp + 0x80]
mov rdi, rdx
call fcn.140172ca0
mov rcx, qword [rsp + 0x50]
mov rdx, rdi
mov rdi, qword [rsp + 0x88]
lea rax, [rbx + rbx*4]
shl rax, 4
mov qword [rdi + rax], r14
mov qword [rdi + rax + 8], r12
mov qword [rdi + rax + 0x10], r13
mov qword [rdi + rax + 0x18], rbp
mov qword [rdi + rax + 0x20], rdx
mov qword [rdi + rax + 0x28], rcx
mov qword [rdi + rax + 0x30], 0
mov qword [rdi + rax + 0x38], 8
mov qword [rdi + rax + 0x40], 0
mov dword [rdi + rax + 0x48], 0
inc rbx
mov qword [rsp + 0x90], rbx
mov rcx, qword [rsp + 0x140]
movabs r13, 0x8000000000000000
mov rdi, qword [rsp + 0x68]
lea rbx, [rsp + 0x140]
jmp 0x14017679d
mov rsi, qword [rsp + 0x190]
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x3f0], rax
movups xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x3e0], xmm0
test rsi, rsi
je 0x140176a36
mov rcx, rsi
call sub.secur32.dll_LsaFreeReturnBuffer
mov rsi, qword [rsp + 0x2f8]
test rsi, rsi
je 0x140176b12
mov rdi, qword [rsp + 0x2f0]
xor ebx, ebx
jmp 0x140176a6c
inc rbx
cmp rbx, rsi
je 0x140176b12
lea rax, [rbx + rbx*4]
shl rax, 4
lea r14, [rdi + rax]
cmp qword [rdi + rax], 0
je 0x140176a91
mov r8, qword [r14 + 8]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp qword [r14 + 0x18], 0
je 0x140176aaa
mov r8, qword [r14 + 0x20]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov r15, qword [r14 + 0x40]
test r15, r15
je 0x140176af0
mov r12, qword [r14 + 0x38]
add r12, 8
jmp 0x140176ac9
add r12, 0x18
dec r15
je 0x140176af0
cmp qword [r12 - 8], 0
je 0x140176ac0
mov r8, qword [r12]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x140176ac0
cmp qword [r14 + 0x30], 0
je 0x140176a60
mov r8, qword [r14 + 0x38]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x140176a60
cmp qword [rsp + 0x2e8], 0
je 0x140176b33
mov r8, qword [rsp + 0x2f0]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsp + 0x3f0]
lea rcx, [rsp + 0x2e8]
mov qword [rcx + 0x10], rax
movaps xmm0, xmmword [rsp + 0x3e0]
movups xmmword [rcx], xmm0
lea rdx, [rsp + 0x228]
mov r8d, 0x1a0
mov rcx, qword [rsp + 0x3d0]
call sub.msvcrt.dll_memcpy
movaps xmm6, xmmword [rsp + 0x930]
movaps xmm7, xmmword [rsp + 0x940]
movaps xmm8, xmmword [rsp + 0x950]
movaps xmm9, xmmword [rsp + 0x960]
add rsp, 0x978
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
and al, 1
movzx eax, al
sub qword [rsp + 0x310], rax
lea rax, [r8 - 0x10]
and rcx, rax
mov byte [r15 + r8], dl
mov byte [r15 + rcx + 0x10], dl
inc qword [rsp + 0x318]
neg r8
imul rdi, r8, 0x158
mov qword [r15 + rdi - 0x158], rsi
mov qword [r15 + rdi - 0x150], r12
lea rcx, [r15 + rdi]
add rcx, 0xfffffffffffffeb8
mov r8d, 0xd0
lea rdx, [rsp + 0x3e0]
call sub.msvcrt.dll_memcpy
mov qword [r15 + rdi - 0x78], rsi
movaps xmm0, xmmword [rsp + 0xc0]
movaps xmm1, xmmword [rsp + 0xd0]
movdqa xmm2, xmmword [rsp + 0xe0]
movdqa xmm3, xmmword [rsp + 0xf0]
movups xmmword [r15 + rdi - 0x70], xmm0
movups xmmword [r15 + rdi - 0x60], xmm1
movdqu xmmword [r15 + rdi - 0x50], xmm2
movdqu xmmword [r15 + rdi - 0x40], xmm3
movaps xmm0, xmmword [rsp + 0x100]
movups xmmword [r15 + rdi - 0x30], xmm0
movaps xmm0, xmmword [rsp + 0x110]
movups xmmword [r15 + rdi - 0x20], xmm0
movaps xmm0, xmmword [rsp + 0x120]
movups xmmword [r15 + rdi - 0x10], xmm0
nop dword [rax + rax]
mov rdi, qword [rsp + 0x50]
cmp rdi, qword [rsp + 0x220]
movabs r13, 0x8000000000000000
je 0x14017735f
lea rbp, [rdi + 0x150]
mov r12, qword [rdi]
cmp r12, 2
je 0x14017718d
lea rdx, [rdi + 8]
mov r8d, 0xd0
lea rcx, [rsp + 0x3e0]
call sub.msvcrt.dll_memcpy
mov rsi, qword [rdi + 0xd8]
movups xmm0, xmmword [rdi + 0xe0]
movaps xmmword [rsp + 0xc0], xmm0
movups xmm0, xmmword [rdi + 0xf0]
movaps xmmword [rsp + 0xd0], xmm0
movups xmm0, xmmword [rdi + 0x100]
movaps xmmword [rsp + 0xe0], xmm0
movups xmm0, xmmword [rdi + 0x110]
movaps xmmword [rsp + 0xf0], xmm0
movups xmm0, xmmword [rdi + 0x120]
movaps xmmword [rsp + 0x100], xmm0
movups xmm0, xmmword [rdi + 0x130]
movaps xmmword [rsp + 0x110], xmm0
movups xmm0, xmmword [rdi + 0x140]
movaps xmmword [rsp + 0x120], xmm0
mov rcx, qword [rsp + 0x320]
mov rdx, qword [rsp + 0x328]
mov r8, rsi
call fcn.14016ccd0
cmp qword [rsp + 0x310], 0
je 0x140177148
mov qword [rsp + 0x50], rbp
mov r15, qword [rsp + 0x300]
mov rcx, qword [rsp + 0x308]
mov rdx, rax
shr rdx, 0x39
movd xmm0, edx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
lea r9, [r15 - 0x158]
xor r10d, r10d
xor r11d, r11d
and rax, rcx
movdqu xmm1, xmmword [r15 + rax]
movdqa xmm2, xmm1
pcmpeqb xmm2, xmm0
pmovmskb edi, xmm2
nop
test di, di
je 0x140176dd0
tzcnt ebx, edi
lea ebp, [rdi - 1]
and ebp, edi
add rbx, rax
and rbx, rcx
neg rbx
imul r14, rbx, 0x158
mov edi, ebp
cmp rsi, qword [r9 + r14]
jne 0x140176da0
jmp 0x140176e20
cmp r11, 1
mov r11d, 1
je 0x140176df6
pmovmskb r8d, xmm1
xor r11d, r11d
test r8d, r8d
setne r11b
tzcnt r8d, r8d
add r8, rax
and r8, rcx
pcmpeqb xmm1, xmm6
pmovmskb edi, xmm1
test edi, edi
jne 0x140177168
add rax, r10
add rax, 0x10
add r10, 0x10
jmp 0x140176d8a
mov r13, qword [r15 + r14 - 0x150]
mov rax, qword [r15 + r14 - 0x140]
mov qword [rsp + 0x200], rax
mov rax, qword [r15 + r14 - 0x138]
mov qword [rsp + 0x1e8], rax
mov rax, qword [r15 + r14 - 0x128]
mov qword [rsp + 0x1d0], rax
mov rax, qword [r15 + r14 - 0x120]
mov qword [rsp + 0x1d8], rax
mov rbp, qword [r15 + r14 - 0x118]
mov rax, qword [r15 + r14 - 0x110]
mov qword [rsp + 0x1e0], rax
mov rax, qword [r15 + r14 - 0x108]
mov qword [rsp + 0x1c8], rax
mov rax, qword [r15 + r14 - 0xf0]
mov qword [rsp + 0x178], rax
mov rax, qword [r15 + r14 - 0xe8]
mov qword [rsp + 0x138], rax
mov rdi, qword [r15 + r14 - 0xe0]
mov rax, qword [r15 + r14 - 0xd8]
mov qword [rsp + 0x68], rax
mov rax, qword [r15 + r14 - 0xd0]
mov qword [rsp + 0x1f0], rax
mov rax, qword [r15 + r14 - 0xb8]
mov qword [rsp + 0x60], rax
mov rax, qword [r15 + r14 - 0xb0]
mov qword [rsp + 0x1f8], rax
mov rax, qword [r15 + r14 - 0x98]
mov qword [rsp + 0x130], rax
mov rax, qword [r15 + r14 - 0x90]
mov qword [rsp + 0x3d8], rax
mov rbx, qword [r15 + r14 - 0x60]
mov qword [r15 + r14 - 0x150], r12
lea rcx, [r15 + r14]
add rcx, 0xfffffffffffffeb8
mov r8d, 0xd0
lea rdx, [rsp + 0x3e0]
call sub.msvcrt.dll_memcpy
mov qword [r15 + r14 - 0x78], rsi
movaps xmm0, xmmword [rsp + 0xc0]
movaps xmm1, xmmword [rsp + 0xd0]
movdqa xmm2, xmmword [rsp + 0xe0]
movdqa xmm3, xmmword [rsp + 0xf0]
movups xmmword [r15 + r14 - 0x70], xmm0
movups xmmword [r15 + r14 - 0x60], xmm1
movdqu xmmword [r15 + r14 - 0x50], xmm2
movdqu xmmword [r15 + r14 - 0x40], xmm3
movaps xmm0, xmmword [rsp + 0x100]
movups xmmword [r15 + r14 - 0x30], xmm0
movaps xmm0, xmmword [rsp + 0x110]
movups xmmword [r15 + r14 - 0x20], xmm0
movaps xmm0, xmmword [rsp + 0x120]
movups xmmword [r15 + r14 - 0x10], xmm0
cmp r13, 2
je 0x140176c70
cmp qword [rsp + 0x200], 0
je 0x140176fd3
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, qword [rsp + 0x1e8]
call sub.KERNEL32.dll_HeapFree
test rbp, rbp
mov r14, qword [rsp + 0x138]
mov r15, qword [rsp + 0x1d8]
je 0x140177020
lea rsi, [r15 + 8]
jmp 0x140176ff9
add rsi, 0x18
dec rbp
je 0x140177020
cmp qword [rsi - 8], 0
je 0x140176ff0
mov r8, qword [rsi]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x140176ff0
cmp qword [rsp + 0x1d0], 0
je 0x14017703c
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, r15
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x1e0], 0
je 0x14017705d
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, qword [rsp + 0x1c8]
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsp + 0x130]
shl rax, 1
test rax, rax
jne 0x140177074
test rdi, rdi
jne 0x14017708f
jmp 0x1401770d0
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, qword [rsp + 0x3d8]
call sub.KERNEL32.dll_HeapFree
test rdi, rdi
je 0x1401770d0
lea rsi, [r14 + 8]
jmp 0x1401770a9
add rsi, 0x18
dec rdi
je 0x1401770d0
cmp qword [rsi - 8], 0
je 0x1401770a0
mov r8, qword [rsi]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x1401770a0
cmp qword [rsp + 0x178], 0
je 0x1401770ec
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, r14
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x68], 0
je 0x14017710a
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, qword [rsp + 0x1f0]
call sub.KERNEL32.dll_HeapFree
cmp qword [rsp + 0x60], 0
je 0x140177128
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, qword [rsp + 0x1f8]
call sub.KERNEL32.dll_HeapFree
test rbx, rbx
je 0x140176c70
lock dec qword [rbx]
jne 0x140176c70
mov rcx, rbx
call fcn.14017f810
jmp 0x140176c70
lea rcx, [rsp + 0x300]
lea rdx, [rsp + 0x320]
mov rdi, rax
call fcn.140178d90
mov rax, rdi
jmp 0x140176d4f
movzx eax, byte [r15 + r8]
test al, al
js 0x140176ba3
movdqa xmm0, xmmword [r15]
pmovmskb eax, xmm0
tzcnt r8d, eax
movzx eax, byte [r15 + r8]
jmp 0x140176ba3
mov r8, qword [rsp + 0x220]
mov rax, r8
sub rax, rbp
shr rax, 4
movabs rcx, 0xc30c30c30c30c31
mul rcx
cmp r8, rbp
je 0x14017735f
mov rsi, rdx
xor edi, edi
jmp 0x1401771cc
inc rdi
cmp rdi, rsi
je 0x14017735f
imul rax, rdi, 0x150
lea rbx, [rax + rbp]
cmp qword [rbp + rax + 0x10], 0
je 0x1401771f1
mov r8, qword [rbx + 0x18]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov r14, qword [rbx + 0x38]
test r14, r14
je 0x140177240
mov r15, qword [rbx + 0x30]
add r15, 8
jmp 0x140177219
add r15, 0x18
dec r14
je 0x140177240
cmp qword [r15 - 8], 0
je 0x140177210
mov r8, qword [r15]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x140177210
cmp qword [rbx + 0x28], 0
je 0x140177259
mov r8, qword [rbx + 0x30]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp qword [rbx + 0x40], 0
je 0x140177272
mov r8, qword [rbx + 0x48]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rbx + 0xb8]
cmp rax, r13
je 0x140177298
test rax, rax
je 0x140177298
mov r8, qword [rbx + 0xc0]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov r14, qword [rbx + 0x70]
test r14, r14
je 0x1401772e0
mov r15, qword [rbx + 0x68]
add r15, 8
jmp 0x1401772b9
add r15, 0x18
dec r14
je 0x1401772e0
cmp qword [r15 - 8], 0
je 0x1401772b0
mov r8, qword [r15]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x1401772b0
cmp qword [rbx + 0x60], 0
je 0x1401772f9
mov r8, qword [rbx + 0x68]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp qword [rbx + 0x78], 0
je 0x140177315
mov r8, qword [rbx + 0x80]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp qword [rbx + 0x98], 0
je 0x140177334
mov r8, qword [rbx + 0xa0]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rbx + 0xf0]
test rax, rax
je 0x1401771c0
lock dec qword [rax]
jne 0x1401771c0
mov rcx, qword [rbx + 0xf0]
call fcn.14017f810
jmp 0x1401771c0
cmp qword [rsp + 0x3c8], 0
je 0x140177380
mov rcx, qword [0x141af8068]
xor edx, edx
mov r8, qword [rsp + 0x218]
call sub.KERNEL32.dll_HeapFree
mov rsi, qword [rsp + 0x300]
mov rdi, qword [rsp + 0x318]
movdqa xmm0, xmmword [rsi]
pmovmskb r15d, xmm0
not r15d
lea rbx, [rsi + 0x10]
movabs r14, 0x82fa0be82fa0be83
pcmpeqd xmm6, xmm6
nop
test rdi, rdi
je 0x140177664
test r15w, r15w
jne 0x1401773e0
nop
movdqa xmm0, xmmword [rbx]
pmovmskb r15d, xmm0
add rsi, 0xffffffffffffea80
add rbx, 0x10
cmp r15d, 0xffff
je 0x1401773c0
not r15d
tzcnt eax, r15d
lea ecx, [r15 - 1]
and ecx, r15d
mov r15d, ecx
neg rax
imul r12, rax, 0x158
dec rdi
cmp byte [rsi + r12 - 4], 0
mov byte [rsi + r12 - 4], 0
jne 0x1401773b0
add r12, rsi
mov rax, qword [rsp + 0x300]
mov rcx, rax
sub rcx, r12
sar rcx, 3
imul rcx, r14
lea rdx, [rcx - 0x10]
and rdx, qword [rsp + 0x308]
movdqu xmm0, xmmword [rax + rdx]
pcmpeqb xmm0, xmm6
psllw xmm0, 7
pmovmskb r8d, xmm0
test r8d, r8d
je 0x140177452
bsr r8w, r8w
xor r8d, 0xf
jmp 0x140177457
mov r8w, 0x10
movdqu xmm0, xmmword [rax + rcx]
pcmpeqb xmm0, xmm6
pmovmskb r9d, xmm0
or r9d, 0x10000
tzcnt r9d, r9d
add r8d, r9d
mov r9b, pe_nt_image_headers64
cmp r8w, 0xf
ja 0x140177489
inc qword [rsp + 0x310]
mov r9b, 0xff
mov byte [rax + rcx], r9b
mov byte [rax + rdx + 0x10], r9b
dec qword [rsp + 0x318]
cmp qword [r12 - 0x140], 0
je 0x1401774bb
mov r8, qword [r12 - 0x138]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov r13, qword [r12 - 0x118]
test r13, r13
je 0x140177510
mov rbp, qword [r12 - 0x120]
add rbp, 8
jmp 0x1401774e9
add rbp, 0x18
dec r13
je 0x140177510
cmp qword [rbp - 8], 0
je 0x1401774e0
mov r8, qword [rbp]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x1401774e0
cmp qword [r12 - 0x128], 0
je 0x140177531
mov r8, qword [r12 - 0x120]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp qword [r12 - 0x110], 0
movabs r13, 0x8000000000000000
je 0x14017755c
mov r8, qword [r12 - 0x108]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov rax, qword [r12 - 0x98]
cmp rax, r13
je 0x140177584
test rax, rax
je 0x140177584
mov r8, qword [r12 - 0x90]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov r13, qword [r12 - 0xe0]
test r13, r13
je 0x1401775d0
mov rbp, qword [r12 - 0xe8]
add rbp, 8
jmp 0x1401775a9
add rbp, 0x18
dec r13
je 0x1401775d0
cmp qword [rbp - 8], 0
je 0x1401775a0
mov r8, qword [rbp]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
jmp 0x1401775a0
cmp qword [r12 - 0xf0], 0
je 0x1401775f1
mov r8, qword [r12 - 0xe8]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp qword [r12 - 0xd8], 0
movabs r13, 0x8000000000000000
je 0x14017761c
mov r8, qword [r12 - 0xd0]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
cmp qword [r12 - 0xb8], 0
je 0x14017763d
mov r8, qword [r12 - 0xb0]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov rax, qword [r12 - 0x60]
test rax, rax
je 0x1401773b0
lock dec qword [rax]
jne 0x1401773b0
mov rcx, qword [r12 - 0x60]
call fcn.14017f810
jmp 0x1401773b0
cmp qword [rsp + 0x190], 0
je 0x140177685
mov r8, qword [rsp + 0x198]
mov rcx, qword [0x141af8068]
xor edx, edx
call sub.KERNEL32.dll_HeapFree
mov rax, qword [rsp + 0x58]
cmp byte [rax + 2], 0
jne 0x140175e8c
cmp byte [rax + 3], 0
je 0x1401760ce
mov rax, qword [rsp + 0x2e0]
test rax, rax
je 0x1401760ce
mov rdi, qword [rsp + 0x2d8]
shl rax, 4
lea rbx, [rax + rax*8]
xor r14d, r14d
lea rsi, [rsp + 0x3e0]
jmp 0x1401776e0
add r14, 0x90
cmp rbx, r14
je 0x1401760ce
cmp qword [rdi + r14 + 0x78], 0
je 0x1401776d0
mov qword [rsp + 0x3e0], 0
mov rcx, qword [rdi + r14 + 0x50]
xor edx, edx
xor r8d, r8d
mov r9, rsi
call sub.KERNEL32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x1401776d0
mov rax, qword [rsp + 0x3e0]
mov qword [rdi + r14 + 0x80], rax
jmp 0x1401776d0
lea rcx, [rsp + 0xc0]
xor edx, edx
call fcn.140172b60
jmp 0x140175f8e
xor esi, esi
mov qword [rsp + 0x288], rsi
mov byte [rsp + 0x2b0], 1
mov rax, qword [rsp + 0x58]
cmp byte [rax + 6], 0
jne 0x14017408f
cmp byte [rax + 5], 0
je 0x1401745d8
mov rax, qword [rsp + 0x2c8]
test rax, rax
je 0x1401745d8
mov rsi, qword [rsp + 0x2c0]
shl rax, 5
lea rbx, [rax + rax*2]
jmp 0x14017778e
add rsi, 0x60
add rbx, 0xffffffffffffffa0
je 0x1401745d8
mov r12, qword [rsi]
cmp r12, 2
jne 0x1401778a0
xor ecx, ecx
xor edx, edx
call sub.ole32.dll_CoInitializeEx
mov edi, eax
cmp eax, 2
setb bpl
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov edx, 0xffffffff
xor r8d, r8d
xor r9d, r9d
call sub.ole32.dll_CoInitializeSecurity
test eax, eax
js 0x1401778e0
mov qword [rsp + 0x3e0], 0
lea r14, [rsp + 0x3e0]
mov qword [rsp + 0x20], r14
lea rcx, [0x141ab5c70]
xor edx, edx
mov r8d, 1
lea r9, [0x141ab5c54]
call sub.ole32.dll_CoCreateInstance
test eax, eax
js 0x1401778e0
mov rax, qword [rsp + 0x3e0]
mov qword [rsp + 0x3e0], 1
mov qword [rsp + 0x3e8], rax
mov qword [rsp + 0x3f0], 0
mov qword [rsp + 0x400], 0
mov byte [rsp + 0x410], bpl
lea rcx, [rsp + 0x80]
mov rdx, r14
call fcn.14017ee40
mov r12, qword [rsp + 0x80]
cmp r12, 2
jne 0x140177a7f
mov r12d, 2
jmp 0x1401778f0
mov rcx, qword [rsi + 8]
mov r13, qword [rsi + 0x10]
mov rdi, qword [rsi + 0x18]
mov r15, qword [rsi + 0x20]
mov r14, qword [rsi + 0x28]
movzx ebp, byte [rsi + 0x30]
mov eax, dword [rsi + 0x31]
mov edx, dword [rsi + 0x34]
mov dword [rsp + 0x143], edx
mov dword [rsp + 0x140], eax
jmp 0x140177990
mov r12d, 2
cmp edi, 1
ja 0x1401778f0
call sub.ole32.dll_CoUninitialize
mov qword [rsi], r12
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], rdi
mov qword [rsi + 0x20], r15
mov qword [rsi + 0x28], r14
mov byte [rsi + 0x30], bpl
mov eax, dword [rsp + 0x140]
mov edx, dword [rsp + 0x143]
mov dword [rsi + 0x31], eax
mov dword [rsi + 0x34], edx
mov eax, dword [rsi + 0x31]
mov edx, dword [rsi + 0x34]
mov dword [rsp + 0x143], edx
mov dword [rsp + 0x140], eax
cmp r12, 2
jne 0x140177990
mov qword [rsp + 0x80], 2
mov rax, qword [rsp + 0xb0]
mov qword [rsi + 0x30], rax
movups xmm0, xmmword [rsp + 0x90]
movups xmm1, xmmword [rsp + 0xa0]
movups xmmword [rsi + 0x20], xmm1
movups xmmword [rsi + 0x10], xmm0
movups xmm0, xmmword [rsp + 0x80]
movups xmmword [rsi], xmm0
cmp dword [rsi], 2
movabs r13, 0x8000000000000000
je 0x140177780
jmp 0x140177a3c
mov qword [rsp + 0xc0], r12
mov qword [rsp + 0xc8], rcx
mov qword [rsp + 0xd0], r13
mov qword [rsp + 0xd8], rdi
mov qword [rsp + 0xe0], r15
mov qword [rsp + 0xe8], r14
mov byte [rsp + 0xf0], bpl
mov eax, dword [rsp + 0x140]
mov ecx, dword [rsp + 0x143]
lea rdx, [rsp + 0xf1]
mov dword [rdx + 3], ecx
mov dword [rdx], eax
lea rcx, [rsp + 0x80]
lea rdx, [rsp + 0xc0]
call fcn.14017ef80
mov rax, qword [rsp + 0xb0]
mov qword [rsi + 0x30], rax
movups xmm0, xmmword [rsp + 0x80]
movups xmm1, xmmword [rsp + 0x90]
movdqu xmm2, xmmword [rsp + 0xa0]
movdqu xmmword [rsi + 0x20], xmm2
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
cmp dword [rsi], 2
movabs r13, 0x8000000000000000
je 0x140177780
lea rcx, [rsp + 0x80]
mov rdx, rsi
xor r8d, r8d
call fcn.14017f0d0
cmp dword [rsp + 0x84], 2
je 0x140177780
movss xmm0, dword [rsp + 0x80]
movss dword [rsi + 0x58], xmm0
ucomiss xmm0, dword [rsi + 0x5c]
jbe 0x140177780
movss dword [rsi + 0x5c], xmm0
jmp 0x140177780
mov rcx, qword [rsp + 0x88]
mov r13, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x98]
mov r15, qword [rsp + 0xa0]
mov r14, qword [rsp + 0xa8]
movzx ebp, byte [rsp + 0xb0]
test r13, r13
mov qword [rsp + 0x50], rcx
je 0x140177b16
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
mov rcx, rdi
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call sub.ole32.dll_CoSetProxyBlanket
mov rcx, qword [rsp + 0x50]
test eax, eax
js 0x140177b16
lea rdx, [rsp + 0xb1]
mov eax, dword [rdx]
mov edx, dword [rdx + 3]
mov dword [rsp + 0x143], edx
mov dword [rsp + 0x140], eax
jmp 0x1401778f0
test r15, r15
je 0x140177b2e
test r14, r14
je 0x140177b2e
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
test r13, r13
je 0x140177b46
test rdi, rdi
je 0x140177b46
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
test r12, r12
je 0x140177b5b
test rcx, rcx
je 0x140177b5b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
test bpl, bpl
je 0x140177b75
call sub.ole32.dll_CoUninitialize
mov rcx, qword [rsp + 0x50]
mov r12d, 2
jmp 0x1401778f0
xor ebp, ebp
mov r12d, 2
jmp 0x1401778f0
lea rcx, [rsp + 0x80]
call fcn.14016beb0
jmp 0x140175c91