Function at 0x140164037
Capabilities:
Enumerate process modules

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xfd8
movaps xmmword [rsp + 0xfc0], xmm6
mov rdi, rdx
mov qword [rsp + 0x110], rcx
mov r12, qword [rsp + 0x1058]
mov rbp, qword [rsp + 0x1050]
mov r15, qword [rsp + 0x1048]
mov rax, qword [rsp + 0x1040]
mov qword [rsp + 0xb0], rdx
lea rbx, [rsp + 0x3d0]
mov qword [rbx], r9
mov qword [rbx + 8], rax
mov rcx, rbx
call fcn.140162d44
test al, al
je 0x1401641ac
shr rdi, 1
mov qword [rsp + 0xd0], rdi
cmp rdi, rbp
ja 0x1401658b5
mov rsi, r15
lea r13, [r15 + rdi*8]
sub rbp, rdi
call fcn.1400e8a9b
test rax, rax
je 0x14016565a
lea rdx, [rsp + 0x7f0]
mov qword [rdx], r13
mov qword [rdx + 8], rbp
lea rcx, [rsp + 0xb0]
mov qword [rdx + 0x10], rcx
lea rcx, [rsp + 0xd0]
mov qword [rdx + 0x18], rcx
mov qword [rdx + 0x20], rbx
mov qword [rdx + 0x28], r12
mov qword [rdx + 0x30], rsi
mov qword [rdx + 0x38], rdi
mov qword [rdx + 0x40], rcx
mov qword [rdx + 0x48], rbx
mov qword [rdx + 0x50], r12
lea rcx, [rsp + 0x70]
mov r8, rax
xor r9d, r9d
call fcn.140163c46
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x350], rax
movaps xmm0, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0x340], xmm0
mov rcx, qword [rsp + 0x98]
mov qword [rsp + 0x1c0], rcx
movups xmm1, xmmword [rsp + 0x88]
movaps xmmword [rsp + 0x1b0], xmm1
lea rsi, [rsp + 0x3e0]
mov qword [rsi + 0x10], rax
movaps xmmword [rsi], xmm0
lea rdi, [rsp + 0x7f0]
mov qword [rdi + 0x10], rcx
movaps xmmword [rdi], xmm1
mov rcx, rsi
mov rdx, rdi
call fcn.1401658fd
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsp + 0x110]
mov qword [rcx + 0x10], rax
movaps xmm0, xmmword [rsi]
movups xmmword [rcx], xmm0
mov rcx, rdi
call fcn.140163f91
jmp 0x14016563e
lea rax, [r15 + rbp*8]
mov qword [rsp + 0x330], rax
lea r13, [rsp + 0x3e0]
xorps xmm6, xmm6
xor ebx, ebx
mov ebp, 8
xor eax, eax
mov qword [rsp + 0x118], rax
mov rdi, r15
cmp rdi, qword [rsp + 0x330]
je 0x140165595
mov qword [rsp + 0x160], rbp
mov qword [rsp + 0x168], rbx
mov rax, qword [rdi]
movzx ebx, word [rax + 0x38]
mov rbp, qword [rax + 0x40]
mov r8, qword [rax + 0x50]
mov rcx, qword [rax + 0x58]
mov qword [rsp + 0x120], rcx
mov r14, qword [rax + 0x78]
mov r15, qword [rax + 0x90]
mov qword [rsp + 0x128], r8
mov rax, qword [r12]
mov rsi, qword [rax]
cmp qword [rsi + 0x10], 0
je 0x1401642cb
mov rcx, qword [rsi + 0x20]
mov rdx, qword [rsi + 0x28]
call fcn.140163b1f
mov rcx, rsi
mov rdx, rax
lea r8, [rsp + 0x128]
call fcn.140163b9c
test rax, rax
je 0x1401642c3
mov rsi, rax
mov rcx, rax
add rcx, 8
mov rax, r15
xor edx, edx
mov ebp, 0x3e8
div rbp
mov qword [rsi + 0xb0], rax
mov rax, r14
xor edx, edx
div rbp
mov qword [rsi + 0xb8], rax
mov rax, qword [r12 + 8]
mov rbp, qword [r12 + 0x10]
movzx ebx, word [rax]
movzx edx, byte [rax + 2]
shl edx, 0x10
or edx, ebx
mov r8, qword [rbp]
mov rax, qword [r12 + 0x18]
mov r9, qword [rax]
call fcn.140162f7d
mov rbx, qword [rsp + 0x168]
mov rbp, qword [rsp + 0x160]
jmp 0x140164e7f
mov r8, qword [rsp + 0x128]
mov qword [rsp + 0x1b0], r8
test rbp, rbp
mov qword [rsp + 0x158], rdi
je 0x1401645b0
shr rbx, 1
lea rcx, [rsp + 0x130]
mov rdx, rbp
mov r8, rbx
call fcn.140163177
mov rdi, qword [rsp + 0x128]
xor ebp, ebp
cmp qword [rsp + 0x120], 0
setne bpl
mov rax, r15
xor edx, edx
mov ecx, 0x3e8
div rcx
mov qword [rsp + 0x150], rax
mov rax, r14
xor edx, edx
div rcx
mov qword [rsp + 0x148], rax
mov rbx, qword [r12 + 8]
mov r13, qword [r12 + 0x18]
test rdi, rdi
je 0x140164465
mov r14, qword [r13]
movzx eax, word [rbx]
mov dword [rsp + 0x50], eax
movzx r15d, byte [rbx + 2]
mov ecx, 0x410
xor edx, edx
mov qword [rsp + 0xa8], rdi
mov r8, qword [rsp + 0xa8]
call sub.KERNEL32.dll_OpenProcess
mov rsi, rax
test rax, rax
jne 0x1401643a5
mov ecx, 0x1000
xor edx, edx
mov r8, qword [rsp + 0xa8]
call sub.KERNEL32.dll_OpenProcess
mov rdi, qword [rsp + 0xa8]
mov rsi, rax
test rax, rax
je 0x140164465
mov qword [rsp + 0x318], rbp
mov qword [rsp + 0x320], rbx
mov qword [rsp + 0x328], r13
and qword [rsp + 0x170], 0
shl r15d, 0x10
and dword [rsp + 0x7f0], 0
mov dword [rsp + 0x20], 3
mov rcx, rsi
lea rdx, [rsp + 0x170]
mov r8d, 4
lea r13, [rsp + 0x7f0]
mov r9, r13
call sub.psapi.dll_EnumProcessModulesEx
test eax, eax
mov rbx, rsi
je 0x1401645fa
mov rsi, qword [rsp + 0x170]
mov r8d, 0x20a
mov rcx, r13
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rcx, rbx
mov rdx, rsi
mov r8, r13
mov r9d, 0x105
call sub.psapi.dll_GetModuleFileNameExW
mov r8d, 0x105
lea rcx, [rsp + 0x3e0]
mov rdx, r13
call fcn.140163679
mov r12, qword [rsp + 0x3e0]
mov rdi, qword [rsp + 0x3e8]
mov rbp, qword [rsp + 0x3f0]
jmp 0x140164604
and qword [rsp + 0x1d0], 0
mov eax, 1
mov qword [rsp + 0x1d8], rax
and qword [rsp + 0x1e0], 0
mov dl, 1
mov byte [rsp + 0x1e8], dl
and qword [rsp + 0x1f0], 0
mov qword [rsp + 0x1f8], rax
and qword [rsp + 0x200], 0
mov byte [rsp + 0x208], dl
and qword [rsp + 0x210], 0
mov qword [rsp + 0x218], rax
and qword [rsp + 0x220], 0
mov byte [rsp + 0x228], dl
movaps xmmword [rsp + 0x1b0], xmm6
movaps xmmword [rsp + 0x1c0], xmm6
mov rax, qword [rsp + 0x140]
lea rcx, [rsp + 0x209]
mov qword [rcx + 0xa7], rax
movups xmm0, xmmword [rsp + 0x130]
movups xmmword [rcx + 0x97], xmm0
and qword [rsp + 0x2b8], 0
mov eax, 8
mov qword [rsp + 0x2c0], rax
movups xmmword [rsp + 0x2c8], xmm6
mov qword [rsp + 0x250], rdi
and qword [rsp + 0x230], 0
mov qword [rsp + 0x2d8], rax
and qword [rsp + 0x2e0], 0
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x258], rax
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x260], rax
mov qword [rsp + 0x240], rbp
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x248], rax
mov dword [rsp + 0x2e8], 1
and dword [rsp + 0x2f0], 0
and qword [rcx + 0x6f], 0
movups xmmword [rcx + 0x5f], xmm6
mov byte [rsp + 0x2f4], dl
movups xmmword [rcx + 0x87], xmm6
movups xmmword [rcx + 0x77], xmm6
jmp 0x140164d4b
test r8, r8
je 0x140164ab6
cmp r8, 4
jne 0x140164ae7
mov ecx, 6
call fcn.1400e77e3
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x138], rdx
mov dword [rdx], 0x74737953
mov word [rdx + 4], 0x6d65
mov qword [rsp + 0x140], 6
jmp 0x1401642fa
mov edi, 1
xor ebp, ebp
xor r12d, r12d
mov rsi, rbx
add dword [rsp + 0x50], r15d
mov rcx, rbp
call fcn.1400e77e3
mov qword [rsp + 0x300], rax
mov rbx, rdx
mov rcx, rdx
mov rdx, rdi
mov r8, rbp
call fcn.1403318a0
mov r15, rbx
mov rcx, rbx
mov rdx, rbp
call fcn.140156a50
cmp rbp, rdx
cmovb rdx, rbp
test rax, rax
mov rbx, rbp
cmove rdx, rbp
mov qword [rsp + 0x2f8], rdx
and qword [rsp + 0x20], 0
mov rcx, rsi
mov edx, 0x1a
lea r8, [rsp + 0x338]
mov r9d, 8
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
mov qword [rsp + 0x310], rdi
mov qword [rsp + 0x308], r12
js 0x140164828
mov rdx, qword [rsp + 0x338]
test rdx, rdx
je 0x140164749
and qword [rsp + 0x20], 0
mov r9d, 0x470
mov rcx, rsi
mov r8, r13
call sub.KERNEL32.dll_ReadProcessMemory
cmp eax, 1
jne 0x140164828
mov edx, dword [rsp + 0x800]
and qword [rsp + 0x20], 0
mov r9d, 0x2a4
mov rcx, rsi
lea r8, [rsp + 0x3e0]
call sub.KERNEL32.dll_ReadProcessMemory
cmp eax, 1
jne 0x140164828
movzx eax, word [rsp + 0x404]
mov qword [rsp + 0x38], rax
mov eax, dword [rsp + 0x408]
mov qword [rsp + 0x48], rax
mov edi, dword [rsp + 0x424]
movzx ebp, word [rsp + 0x420]
mov r12d, dword [rsp + 0x428]
call fcn.14016336f
cmp byte [reloc.WS2_32.dll_bind], 0
je 0x140164e88
lea rcx, [rsp + 0xb8]
mov rdx, rsi
call fcn.140163483
mov rdi, rsi
mov esi, dword [rsp + 0x50]
jmp 0x140164f86
and qword [rsp + 0x20], 0
mov rcx, rsi
xor edx, edx
lea r8, [rsp + 0x340]
mov r9d, 0x30
call qword [sym.imp.ntdll.dll_NtQueryInformationProcess]
test eax, eax
js 0x140164828
mov rdx, qword [rsp + 0x348]
and qword [rsp + 0x20], 0
mov r9d, 0x7c8
mov rcx, rsi
mov r8, r13
call sub.KERNEL32.dll_ReadProcessMemory
cmp eax, 1
jne 0x140164828
mov rdx, qword [rsp + 0x810]
and qword [rsp + 0x20], 0
mov r9d, 0x410
mov r13, rsi
mov rcx, rsi
lea r8, [rsp + 0x3e0]
call sub.KERNEL32.dll_ReadProcessMemory
cmp eax, 1
mov esi, dword [rsp + 0x50]
jne 0x140164ed7
movzx eax, word [rsp + 0x418]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x420]
mov qword [rsp + 0x48], rax
mov rdi, qword [rsp + 0x458]
movzx ebp, word [rsp + 0x450]
mov r12, qword [rsp + 0x460]
call fcn.14016336f
cmp byte [reloc.WS2_32.dll_bind], 0
je 0x140164f16
lea rcx, [rsp + 0x178]
mov rdi, r13
mov rdx, r13
call fcn.140163483
jmp 0x14016529d
mov r13, rsi
mov eax, 8
mov qword [rsp + 0x38], rax
mov edi, 1
xor r12d, r12d
xor ebp, ebp
xor eax, eax
mov qword [rsp + 0x48], rax
xor eax, eax
mov qword [rsp + 0x68], rax
xor eax, eax
mov qword [rsp + 0x60], rax
mov eax, 8
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x58], rax
mov esi, dword [rsp + 0x50]
mov qword [rsp + 0x1f0], r12
mov qword [rsp + 0x1f8], rdi
mov qword [rsp + 0x200], rbp
mov byte [rsp + 0x208], 1
mov eax, dword [rsp + 0x3e0]
mov ecx, dword [rsp + 0x3e3]
lea rdx, [rsp + 0x209]
mov dword [rdx + 3], ecx
and qword [rsp + 0x3e0], 0
mov dword [rdx], eax
and qword [rsp + 0x7f0], 0
lea r8, [rsp + 0x7f0]
mov qword [rsp + 0x20], r8
mov rcx, r13
lea rdx, [rsp + 0x3e0]
mov r9, r8
call sub.KERNEL32.dll_GetProcessTimes
mov rax, qword [rsp + 0x3e0]
xor edx, edx
mov ecx, 0x989680
div rcx
mov r12, rax
movabs rax, 0xfffffffd49ef6f00
add r12, rax
cmp r12, r14
mov rax, r12
mov ecx, 0
cmova rax, rcx
sub r14, rax
and esi, 0xffffff
mov ebp, 0
cmp esi, 0x10000
mov rsi, r13
jb 0x140164b6b
mov r13, r14
and qword [rsp + 0x70], 0
mov rcx, rsi
mov edx, 8
lea r8, [rsp + 0x70]
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140164b66
mov r14, qword [rsp + 0x70]
test r14, r14
je 0x140164b66
and dword [rsp + 0xf0], 0
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov rcx, r14
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call sub.ADVAPI32.dll_GetTokenInformation
test eax, eax
jne 0x140164990
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x140164b5d
mov edi, dword [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov edx, 8
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x140164b5d
mov rbp, rax
mov r9d, dword [rsp + 0xf0]
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x20], rax
mov rcx, r14
mov edx, 1
mov r8, rbp
call sub.ADVAPI32.dll_GetTokenInformation
test eax, eax
je 0x140164b55
mov qword [rsp + 0x108], r15
and dword [rsp + 0x190], 0
mov r8d, 0x200
lea r15, [rsp + 0x3e0]
mov rcx, r15
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov r8d, 0x200
lea rdi, [rsp + 0x7f0]
mov rcx, rdi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rsp + 0xd0], 0x100
mov qword [rsp + 0x50], rbp
mov rdx, qword [rbp]
lea rax, [rsp + 0x190]
mov qword [rsp + 0x30], rax
lea r9, [rsp + 0xd0]
mov qword [rsp + 0x28], r9
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov r8, r15
call sub.ADVAPI32.dll_LookupAccountSidW
mov ebp, 0
test eax, eax
je 0x140164a93
lea rdi, [rsp + 0x340]
mov rcx, rdi
lea rdx, [rsp + 0x3e0]
call fcn.140163a4d
mov rcx, rdi
call fcn.140163aa9
mov rbp, rax
mov rdi, rdx
mov rcx, qword [rsp + 0x50]
call fcn.140163a1f
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r14, r13
mov r15, qword [rsp + 0x108]
jmp 0x140164b6b
mov ecx, 4
call fcn.1400e77e3
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x138], rdx
mov dword [rdx], 0x656c6449
mov qword [rsp + 0x140], 4
jmp 0x1401642fa
lea rax, str._no_name__Process
mov qword [rsp + 0x800], rax
mov ecx, 1
mov qword [rsp + 0x808], rcx
and qword [rsp + 0x7f0], 0
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0x3e0], rax
lea rax, [0x1401632ba]
mov qword [rsp + 0x3e8], rax
mov qword [rsp + 0x810], r13
mov qword [rsp + 0x818], rcx
lea rcx, [rsp + 0x130]
lea rdx, [rsp + 0x7f0]
call fcn.140163308
jmp 0x1401642fa
mov rcx, rbp
call fcn.140163a1f
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebp, ebp
mov r14, r13
mov ecx, 0x18
mov edx, 8
call fcn.1400607fe
mov ecx, 1
mov qword [rax], rcx
mov qword [rax + 8], rcx
mov qword [rax + 0x10], rsi
mov rcx, qword [rsp + 0x140]
lea rdx, [rsp + 0x209]
mov qword [rdx + 0xa7], rcx
movups xmm0, xmmword [rsp + 0x130]
movups xmmword [rdx + 0x97], xmm0
mov rcx, qword [rsp + 0x308]
mov qword [rsp + 0x1d0], rcx
mov rcx, qword [rsp + 0x310]
mov qword [rsp + 0x1d8], rcx
mov qword [rsp + 0x1e0], rbx
mov bl, 1
mov byte [rsp + 0x1e8], bl
mov ecx, dword [rsp + 0x3e3]
mov dword [rdx - 0x1d], ecx
mov ecx, dword [rsp + 0x3e0]
mov dword [rdx - 0x20], ecx
mov rcx, qword [rsp + 0x300]
mov qword [rsp + 0x210], rcx
mov qword [rsp + 0x218], r15
mov rcx, qword [rsp + 0x2f8]
mov qword [rsp + 0x220], rcx
mov byte [rsp + 0x228], bl
mov ecx, dword [rsp + 0x7f0]
mov dword [rdx + 0x20], ecx
mov ecx, dword [rsp + 0x7f3]
mov dword [rdx + 0x23], ecx
movaps xmmword [rsp + 0x1c0], xmm6
movaps xmmword [rsp + 0x1b0], xmm6
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x2b8], rcx
mov rcx, qword [rsp + 0x38]
mov qword [rsp + 0x2c0], rcx
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x2c8], rcx
mov rcx, qword [rsp + 0xa8]
mov qword [rsp + 0x250], rcx
mov qword [rsp + 0x230], rbp
mov qword [rsp + 0x238], rdi
mov rcx, qword [rsp + 0x60]
mov qword [rsp + 0x2d0], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsp + 0x2d8], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0x2e0], rcx
mov rcx, qword [rsp + 0x150]
mov qword [rsp + 0x258], rcx
mov rcx, qword [rsp + 0x148]
mov qword [rsp + 0x260], rcx
mov rcx, qword [rsp + 0x318]
mov qword [rsp + 0x240], rcx
mov rcx, qword [rsp + 0x120]
mov qword [rsp + 0x248], rcx
mov dword [rsp + 0x2e8], 1
mov qword [rsp + 0x268], rax
mov qword [rsp + 0x270], r12
mov qword [rsp + 0x278], r14
and dword [rsp + 0x2f0], 0
mov byte [rsp + 0x2f4], bl
movups xmmword [rdx + 0x87], xmm6
movups xmmword [rdx + 0x77], xmm6
mov r12, qword [rsp + 0x1058]
mov r13, qword [rsp + 0x328]
mov rbx, qword [rsp + 0x320]
movzx eax, word [rbx]
movzx edx, byte [rbx + 2]
shl edx, 0x10
or edx, eax
mov rax, qword [r12 + 0x10]
mov r8, qword [rax]
mov r9, qword [r13]
lea rsi, [rsp + 0x1b0]
mov rcx, rsi
call fcn.140162f7d
mov r8d, 0x90
lea rcx, [rsp + 0x340]
mov rdx, rsi
call fcn.1403318a0
mov rsi, qword [rsp + 0x240]
mov r8d, 0xb0
lea r13, [rsp + 0x3e0]
mov rcx, r13
lea rdx, [rsp + 0x248]
call fcn.1403318a0
cmp rsi, 2
mov rbx, qword [rsp + 0x168]
mov rbp, qword [rsp + 0x160]
je 0x140164e77
mov rdi, qword [rsp + 0x118]
mov qword [rsp + 0x1b0], rdi
mov qword [rsp + 0x1b8], rbp
mov qword [rsp + 0x1c0], rbx
mov r8d, 0xb0
lea rcx, [rsp + 0x7f0]
mov rdx, r13
call fcn.1403318a0
cmp rbx, rdi
jne 0x140164e34
lea rcx, [rsp + 0x1b0]
mov rdx, rbx
call fcn.140162895
mov rbx, qword [rsp + 0x1c0]
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x118], rax
mov rbp, qword [rsp + 0x1b8]
imul rdi, rbx, 0x148
lea rcx, [rdi + rbp]
mov r8d, 0x90
lea rdx, [rsp + 0x340]
call sub.VCRUNTIME140.dll_memmove
lea rcx, [rdi + rbp]
add rcx, 0x98
mov qword [rcx - 8], rsi
mov r8d, 0xb0
lea rdx, [rsp + 0x7f0]
call fcn.1403318a0
inc rbx
mov rdi, qword [rsp + 0x158]
add rdi, 8
jmp 0x1401641d7
lea rcx, [rsp + 0x340]
mov r13, rsi
mov rdx, rsi
mov r8, rdi
mov r9, rbp
call fcn.140163739
cmp qword [rsp + 0x340], 0
mov esi, dword [rsp + 0x50]
je 0x140164f58
and qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 8
and qword [rsp + 0xc8], 0
jmp 0x140164f83
mov eax, 8
mov qword [rsp + 0x38], rax
mov edi, 1
xor r12d, r12d
xor ebp, ebp
xor eax, eax
mov qword [rsp + 0x48], rax
xor eax, eax
mov qword [rsp + 0x68], rax
xor eax, eax
mov qword [rsp + 0x60], rax
mov eax, 8
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x58], rax
jmp 0x140164869
lea rcx, [rsp + 0x70]
mov rdx, r13
mov r8, rdi
mov r9, rbp
call fcn.140163739
cmp qword [rsp + 0x70], 0
je 0x140165272
and qword [rsp + 0x178], 0
mov qword [rsp + 0x180], 8
and qword [rsp + 0x188], 0
jmp 0x14016529a
mov rdi, qword [rsp + 0x348]
mov rbp, qword [rsp + 0x350]
lea rcx, [rsp + 0xb8]
mov rdx, rbp
call fcn.1401633c5
mov rcx, rdi
mov rdx, rbp
call fcn.140141b5c
mov rdi, r13
lea rcx, [rsp + 0x340]
mov rdx, rdi
mov r8, r12
call fcn.1401637d9
mov rax, qword [rsp + 0x340]
mov r9, qword [rsp + 0x348]
test rax, rax
je 0x140164fc3
mov r13, rdi
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe0], r9
jmp 0x140164fe8
lea rcx, [rsp + 0xd0]
mov r13, rdi
mov rdx, rdi
mov r8, r12
call fcn.140163739
cmp qword [rsp + 0xd0], 0
je 0x1401650a5
mov eax, 8
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x60], rax
xor eax, eax
mov qword [rsp + 0x58], rax
mov r9, qword [rsp + 0x38]
mov r8, qword [rsp + 0x48]
lea rcx, [rsp + 0x340]
mov rdx, r13
call fcn.140163739
cmp qword [rsp + 0x340], 0
je 0x140165031
mov edi, 1
xor r12d, r12d
xor ebp, ebp
jmp 0x14016507e
mov rax, qword [rsp + 0x348]
mov qword [rsp + 0x50], rax
mov rdx, qword [rsp + 0x350]
mov qword [rsp + 0x38], rdx
mov r8, qword [rsp + 0x358]
lea rcx, [rsp + 0x70]
call fcn.140163679
mov r12, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x38]
call fcn.140141b5c
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0xc8]
jmp 0x1401653a8
lea rax, [0x140414773]
mov qword [rsp + 0x340], rax
lea rax, [0x140414772]
mov qword [rsp + 0x348], rax
and word [rsp + 0x350], 0
lea rcx, [rsp + 0x340]
call fcn.14016357d
mov ebp, edx
mov ecx, eax
call fcn.1401635e8
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x68], rax
mov rcx, qword [rsp + 0xe0]
mov rdx, qword [rsp + 0xe8]
and qword [rsp + 0xf0], 0
mov qword [rsp + 0xf8], 8
and qword [rsp + 0x100], 0
xor r12d, r12d
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x40], rdx
mov r8, r12
call fcn.140163610
add rdx, rdx
xor ecx, ecx
xor edi, edi
cmp rdx, rdi
je 0x140165237
cmp word [rax + rdi], 0
je 0x140165152
add rdi, 2
dec rcx
jmp 0x140165139
mov r9, r12
sub r9, rcx
lea rax, str.C:Users_root.cargo_registry_srcgithub.com_1ecc6299db9ec823_sysinfo_0.24.7_srcwindowsprocess.rsUnable_to_read_process_memory_informationUnable_to_read_process_data
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x40]
mov r8, r12
mov qword [rsp + 0x60], r9
call fcn.14016363c
add rdx, rdx
xor ecx, ecx
cmp rdx, rcx
je 0x140165237
lea rdi, [rcx + 2]
cmp word [rax + rcx], bp
mov rcx, rdi
jne 0x140165180
lea rax, str.C:Users_root.cargo_registry_srcgithub.com_1ecc6299db9ec823_sysinfo_0.24.7_srcwindowsprocess.rsUnable_to_read_process_memory_informationUnable_to_read_process_data
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x40]
mov r8, r12
mov r12, qword [rsp + 0x60]
mov r9, r12
call fcn.14016363c
mov r8, rdx
lea rcx, [rsp + 0x340]
mov rdx, rax
call fcn.14014f340
mov rdx, qword [rsp + 0x348]
mov qword [rsp + 0x58], rdx
mov r8, qword [rsp + 0x350]
lea rcx, [rsp + 0x70]
call fcn.14015bd30
lea rdi, [rsp + 0x190]
mov rcx, rdi
lea rdx, [rsp + 0x70]
call fcn.140163653
lea rcx, [rsp + 0xf0]
mov rdx, rdi
call fcn.1400f6dfd
mov rcx, qword [rsp + 0x340]
mov rdx, qword [rsp + 0x58]
call fcn.140059ae6
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x50]
inc r12
jmp 0x14016512a
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x50]
call fcn.140141b5c
jmp 0x140165000
mov rdi, qword [rsp + 0x78]
mov rbp, qword [rsp + 0x80]
lea rcx, [rsp + 0x178]
mov rdx, rbp
call fcn.1401633c5
mov rcx, rdi
mov rdx, rbp
call fcn.140141b5c
mov rdi, r13
lea rcx, [rsp + 0x70]
mov rdx, rdi
mov r8, r12
call fcn.1401637d9
mov rax, qword [rsp + 0x70]
mov r9, qword [rsp + 0x78]
test rax, rax
je 0x1401652ce
mov qword [rsp + 0x198], rax
mov qword [rsp + 0x1a0], r9
jmp 0x1401652f0
lea rcx, [rsp + 0x190]
mov rdx, rdi
mov r8, r12
call fcn.140163739
cmp qword [rsp + 0x190], 0
je 0x1401653ce
mov eax, 8
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x60], rax
xor eax, eax
mov qword [rsp + 0x58], rax
mov r9, qword [rsp + 0x38]
mov r8, qword [rsp + 0x48]
lea rcx, [rsp + 0x70]
mov rdx, r13
call fcn.140163739
cmp qword [rsp + 0x70], 0
je 0x140165333
mov edi, 1
xor r12d, r12d
xor ebp, ebp
jmp 0x140165386
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x38], rax
mov rdx, qword [rsp + 0x80]
mov qword [rsp + 0x48], rdx
mov r8, qword [rsp + 0x88]
lea rcx, [rsp + 0xd0]
call fcn.140163679
mov r12, qword [rsp + 0xd0]
mov rdi, qword [rsp + 0xd8]
mov rbp, qword [rsp + 0xe0]
mov rcx, qword [rsp + 0x38]
mov rdx, qword [rsp + 0x48]
call fcn.140141b5c
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x188]
mov qword [rsp + 0x68], rax
mov eax, dword [rsp + 0x7f0]
mov ecx, dword [rsp + 0x7f3]
mov dword [rsp + 0x3e3], ecx
mov dword [rsp + 0x3e0], eax
jmp 0x140164869
lea rax, [0x140414773]
mov qword [rsp + 0x70], rax
lea rax, [0x140414772]
mov qword [rsp + 0x78], rax
and word [rsp + 0x80], 0
lea rcx, [rsp + 0x70]
call fcn.14016357d
mov ebp, edx
mov ecx, eax
call fcn.1401635e8
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x108], rax
mov rcx, qword [rsp + 0x1a0]
mov rdx, qword [rsp + 0x1a8]
and qword [rsp + 0xb8], 0
mov qword [rsp + 0xc0], 8
and qword [rsp + 0xc8], 0
xor r12d, r12d
mov qword [rsp + 0x68], rcx
mov qword [rsp + 0x40], rdx
mov r8, r12
call fcn.140163610
add rdx, rdx
xor ecx, ecx
xor edi, edi
cmp rdx, rdi
je 0x140165557
cmp word [rax + rdi], 0
je 0x140165475
add rdi, 2
dec rcx
jmp 0x14016545c
mov r9, r12
sub r9, rcx
lea rax, str.C:Users_root.cargo_registry_srcgithub.com_1ecc6299db9ec823_sysinfo_0.24.7_srcwindowsprocess.rsUnable_to_read_process_memory_informationUnable_to_read_process_data
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x40]
mov r8, r12
mov qword [rsp + 0x60], r9
call fcn.14016363c
add rdx, rdx
xor ecx, ecx
cmp rdx, rcx
je 0x140165557
lea rdi, [rcx + 2]
cmp word [rax + rcx], bp
mov rcx, rdi
jne 0x1401654a3
lea rax, str.C:Users_root.cargo_registry_srcgithub.com_1ecc6299db9ec823_sysinfo_0.24.7_srcwindowsprocess.rsUnable_to_read_process_memory_informationUnable_to_read_process_data
mov qword [rsp + 0x20], rax
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x40]
mov r8, r12
mov r12, qword [rsp + 0x60]
mov r9, r12
call fcn.14016363c
mov r8, rdx
lea rcx, [rsp + 0x70]
mov rdx, rax
call fcn.14014f340
mov rdx, qword [rsp + 0x78]
mov qword [rsp + 0x58], rdx
mov r8, qword [rsp + 0x80]
lea rcx, [rsp + 0xd0]
call fcn.14015bd30
lea rdi, [rsp + 0xf0]
mov rcx, rdi
lea rdx, [rsp + 0xd0]
call fcn.140163653
lea rcx, [rsp + 0xb8]
mov rdx, rdi
call fcn.1400f6dfd
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x58]
call fcn.140059ae6
mov rdx, qword [rsp + 0x40]
mov rcx, qword [rsp + 0x68]
inc r12
jmp 0x14016544d
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x40], rax
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x58], rax
mov rcx, qword [rsp + 0x108]
mov rdx, qword [rsp + 0x68]
call fcn.140141b5c
jmp 0x140165308
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x1b0], rax
mov qword [rsp + 0x1b8], rbp
mov qword [rsp + 0x1c0], rbx
xorps xmm0, xmm0
movaps xmmword [rsp + 0x3e0], xmm0
and qword [rsp + 0x3f0], 0
test rbx, rbx
je 0x140165621
mov rax, qword [rsp + 0x1c0]
lea rdx, [rsp + 0x7f0]
mov qword [rdx + 0x10], rax
mov rax, qword [rsp + 0x1b0]
mov qword [rdx], rax
mov rax, qword [rsp + 0x1b8]
mov qword [rdx + 8], rax
lea rsi, [rsp + 0x3e0]
mov rcx, rsi
call fcn.140162a3f
mov rax, qword [rsi + 0x10]
mov rcx, qword [rsp + 0x110]
mov qword [rcx + 0x10], rax
movaps xmm0, xmmword [rsi]
movups xmmword [rcx], xmm0
jmp 0x14016563e
mov rax, qword [rsp + 0x110]
movups xmmword [rax], xmm0
and qword [rax + 0x10], 0
lea rcx, [rsp + 0x1b0]
call fcn.140162b55
movaps xmm6, xmmword [rsp + 0xfc0]
add rsp, 0xfd8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
call fcn.1400e78af
mov rsi, qword [rax]
lea r14, [rsi + 0x80]
call fcn.1400e8a9b
test rax, rax
je 0x140165768
mov r12, rax
cmp qword [rax + 0x140], rsi
je 0x14016585d
mov rax, qword [r12 + 0x130]
lea rsi, [rsp + 0x7f0]
mov qword [rsi + 0x20], r13
mov qword [rsi + 0x28], rbp
lea rcx, [rsp + 0xb0]
mov qword [rsi + 0x30], rcx
lea rcx, [rsp + 0xd0]
mov qword [rsi + 0x38], rcx
mov qword [rsi + 0x40], rbx
mov rdx, qword [rsp + 0x1058]
mov qword [rsi + 0x48], rdx
mov qword [rsi + 0x50], r15
mov qword [rsi + 0x58], rdi
mov qword [rsi + 0x60], rcx
mov qword [rsi + 0x68], rbx
mov qword [rsi + 0x70], rdx
and qword [rsi], 0
mov rcx, r12
add rcx, 0x140
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov byte [rsi + 0x18], 1
and qword [rsi + 0x78], 0
lea r8, [0x14016596c]
mov rcx, r14
mov rdx, rsi
call fcn.1400e8b22
mov rcx, r12
mov rdx, rsi
call fcn.140162e79
lea rsi, [rsp + 0x850]
lea rax, [rsp + 0x3e0]
mov ecx, 0xa
mov rdi, rax
rep movsq qword [rdi], qword [rsi]
mov rcx, qword [rax + 0x48]
lea rdx, [rsp + 0x1b0]
mov qword [rdx + 0x30], rcx
movups xmm0, xmmword [rax + 0x18]
movups xmm1, xmmword [rax + 0x28]
movups xmm2, xmmword [rax + 0x38]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rcx, [rsp + 0x70]
call fcn.140162c9e
jmp 0x140164123
xor ecx, ecx
call fcn.1400e8d5d
test rax, rax
je 0x1401658cf
lea rsi, [rsp + 0x838]
mov qword [rsi - 0x40], r13
mov qword [rsi - 0x38], rbp
lea rcx, [rsp + 0xb0]
mov qword [rsi - 0x30], rcx
lea rcx, [rsp + 0xd0]
mov qword [rsi - 0x28], rcx
mov qword [rsi - 0x20], rbx
mov rdx, qword [rsp + 0x1058]
mov qword [rsi - 0x18], rdx
mov qword [rsi - 0x10], r15
mov qword [rsi - 8], rdi
mov qword [rsi], rcx
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rdx
mov qword [rsi - 0x48], rax
and qword [rsi + 0x18], 0
lea r8, [0x140165acb]
lea rdi, [rsp + 0x7f0]
mov rcx, r14
mov rdx, rdi
call fcn.1400e8b22
mov rcx, qword [rdi]
call fcn.1400e783e
lea rax, [rsp + 0x3e0]
mov ecx, 0xa
mov rdi, rax
rep movsq qword [rdi], qword [rsi]
lea rsi, [rsp + 0x348]
mov rcx, qword [rax + 0x48]
lea rdx, [rsp + 0x1b0]
mov qword [rdx + 0x30], rcx
movups xmm0, xmmword [rax + 0x18]
movups xmm1, xmmword [rax + 0x28]
movups xmm2, xmmword [rax + 0x38]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
mov rcx, rsi
call fcn.140162c9e
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmm2, xmmword [rsi + 0x20]
movaps xmmword [rsp + 0x70], xmm0
movaps xmmword [rsp + 0x80], xmm1
movaps xmmword [rsp + 0x90], xmm2
jmp 0x140164123
lea rdx, [rsp + 0x7f0]
mov qword [rdx], r13
mov qword [rdx + 8], rbp
lea rax, [rsp + 0xb0]
mov qword [rdx + 0x10], rax
lea rax, [rsp + 0xd0]
mov qword [rdx + 0x18], rax
mov qword [rdx + 0x20], rbx
mov rcx, qword [rsp + 0x1058]
mov qword [rdx + 0x28], rcx
mov qword [rdx + 0x30], r15
mov qword [rdx + 0x38], rdi
mov qword [rdx + 0x40], rax
mov qword [rdx + 0x48], rbx
mov qword [rdx + 0x50], rcx
lea rcx, [rsp + 0x70]
mov r8, r12
jmp 0x14016411b
lea rcx, str.assertion_failed:_mid___self.len__
lea r8, [0x14040bde8]
mov edx, 0x23
call fcn.140332d10
ud2
lea rax, [0x140412428]
mov qword [rsp + 0x20], rax
lea rcx, str.cannot_access_a_Thread_Local_Storage_value_during_or_after_destruction_rustc_2c8cc343237b8f7d5a3c3703e3a87f2eb2c54a74library_std_src_threadlocal.rs
lea r9, [0x14040bc78]
lea r8, [rsp + 0x7f0]
mov edx, 0x46
call fcn.140333090
ud2