Function at 0x14002d435
Capabilities:
Enumerate processes via ntquerysysteminformation
Get disk information
Get disk size
Get local ipv4 addresses
Get logon sessions
Get memory capacity
Get system information on windows
List groups for user account
List user accounts

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x948
movdqa xmmword [rsp + 0x930], xmm8
movdqa xmmword [rsp + 0x920], xmm7
movaps xmmword [rsp + 0x910], xmm6
mov rbx, rdx
mov rdi, rcx
cmp byte [rdx + 4], 0
je 0x14002d541
xorps xmm6, xmm6
lea rsi, [rsp + 0x200]
movaps xmmword [rsi], xmm6
movaps xmmword [rsi + 0x30], xmm6
movaps xmmword [rsi + 0x20], xmm6
movaps xmmword [rsi + 0x10], xmm6
mov dword [rsi], 0x40
mov rcx, rsi
call sub.kernel32.dll_GlobalMemoryStatusEx
mov rax, qword [rsi + 8]
mov qword [rdi + 0x138], rax
mov rax, qword [rsi + 0x10]
mov qword [rdi + 0x140], rax
lea rcx, [rsp + 0x370]
movaps xmmword [rcx + 0x50], xmm6
movaps xmmword [rcx + 0x40], xmm6
movaps xmmword [rcx + 0x30], xmm6
movaps xmmword [rcx + 0x20], xmm6
movaps xmmword [rcx + 0x10], xmm6
movaps xmmword [rcx], xmm6
and qword [rcx + 0x60], 0
mov edx, 0x68
call sub.psapi.dll_GetPerformanceInfo
cmp eax, 1
jne 0x14002d541
mov rdx, qword [rsp + 0x380]
mov r9, qword [rsp + 0x390]
xor r10d, r10d
sub rdx, r9
cmovb rdx, r10
mov rcx, qword [rsp + 0x3c0]
mov rax, rcx
mul rdx
mov r8, rax
mov r11, 0xffffffffffffffff
cmovo r8, r11
mov rdx, qword [rsp + 0x378]
sub rdx, r9
cmovb rdx, r10
mov rax, rcx
mul rdx
cmovo rax, r11
mov qword [rdi + 0x148], r8
mov qword [rdi + 0x150], rax
cmp byte [rbx + 0xb], 2
movabs rsi, 0x8000000000000000
mov qword [rsp + 0x48], rdi
mov qword [rsp + 0x78], rbx
je 0x14002d93e
mov bpl, byte [rbx + 0xc]
lea r15, [rdi + 0x158]
cmp qword [rdi + 0x158], 0
je 0x14002d674
mov rcx, qword [rdi + 0x188]
call sub.pdh.dll_PdhCollectQueryData
cmp qword [rdi + 0x48], rsi
je 0x14002d5af
lea rdx, [rdi + 0x48]
mov rcx, r15
call fcn.140030bd6
test eax, eax
je 0x14003020d
movss xmm1, dword [0x14003b820]
subss xmm1, xmm0
movss dword [rdi + 0x68], xmm1
mov edx, ebp
and dl, 1
mov rcx, rdi
call fcn.14003134c
mov rdi, rax
mov rbx, rdx
add rdi, 0x48
movss xmm6, dword [0x14003b820]
lea rax, [rdi - 0x48]
cmp rax, rbx
je 0x14002d601
cmp qword [rdi], rsi
je 0x14002d5fb
mov rcx, r15
mov rdx, rdi
call fcn.140030bd6
test eax, eax
je 0x140030189
movaps xmm1, xmm6
subss xmm1, xmm0
movss dword [rdi + 0x20], xmm1
add rdi, 0x70
jmp 0x14002d5ce
test bpl, 1
mov rbx, qword [rsp + 0x48]
je 0x14002d939
cmp byte [rbx + 0x88], 0
jne 0x14002d939
mov rsi, qword [rbx + 0x80]
lea rdi, [rsp + 0x370]
mov rcx, rdi
mov rdx, rsi
call fcn.14003136e
mov rbx, qword [rbx + 0x78]
mov rcx, qword [rdi]
mov rdx, qword [rdi + 8]
mov rax, qword [rdi + 0x10]
shl rax, 3
imul r8, rsi, 0x70
xor r9d, r9d
mov r10, rbx
test r8, r8
je 0x14002d69a
cmp rax, r9
je 0x14002d69a
mov r11, qword [rdx + r9]
mov qword [r10 + 0x60], r11
add r10, 0x70
add r9, 8
add r8, 0xffffffffffffff90
jmp 0x14002d654
lea r8, [rsp + 0x370]
and qword [r8], 0
xor ecx, ecx
xor edx, edx
call sub.pdh.dll_PdhOpenQueryA
test eax, eax
je 0x14002d6b1
lea rax, [rsp + 0x200]
jmp 0x14002d71c
call fcn.14003229c
test rsi, rsi
je 0x14002d927
mov rax, qword [rbx + 0x60]
jmp 0x14002d929
mov rdi, qword [rsp + 0x370]
mov eax, dword [0x14004a280]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x70], 0
je 0x140030172
mov eax, dword [0x14004a280]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rbx, qword [rax + 0x78]
mov rsi, qword [rax + 0x80]
lea rcx, [rbx + 1]
mov qword [rax + 0x78], rcx
lea rax, [0x140041cc0]
mov qword [rsp + 0x200], rax
lea rax, [rsp + 0x120]
and qword [rax], 0
cmp qword [r15], 0
je 0x14002d736
mov rcx, r15
call fcn.140030b54
mov rcx, r15
call fcn.14003030d
mov rax, qword [rsp + 0x200]
mov rcx, qword [rsp + 0x48]
mov qword [rcx + 0x158], rax
and qword [rcx + 0x170], 0
xorps xmm0, xmm0
movups xmmword [rcx + 0x160], xmm0
mov qword [rcx + 0x178], rbx
mov rbx, rcx
mov qword [rcx + 0x180], rsi
mov qword [rcx + 0x188], rdi
mov rcx, qword [rsp + 0x120]
mov qword [rbx + 0x190], rcx
test rax, rax
je 0x14002d939
mov byte [rsp + 0x60], bpl
and bpl, 1
lea rdx, [0x14004165e]
lea rsi, [rsp + 0x200]
mov r8d, 0x1e
mov rcx, rsi
call fcn.14003025f
lea r14, [rbx + 0x48]
lea rdx, [0x14004167c]
lea rdi, [rsp + 0x370]
mov r8d, 5
mov rcx, rdi
call fcn.14003025f
mov rcx, rsi
mov qword [rsp + 0x50], r15
mov rdx, r15
mov r8, r14
mov r9, rdi
call fcn.140036a88
mov rcx, rbx
mov edx, ebp
call fcn.14003134c
mov r14, rax
mov qword [rsp + 0x58], rdx
xor ebp, ebp
mov esi, 2
mov r12d, 1
cmp r14, qword [rsp + 0x58]
je 0x14002d902
mov qword [rsp + 0xe8], rbp
inc rbp
lea rax, [0x1400416a0]
mov qword [rsp + 0x370], rax
mov qword [rsp + 0x378], rsi
and qword [rsp + 0x390], 0
lea r15, [rsp + 0xe8]
mov qword [rsp + 0xb0], r15
lea rbx, [fcn.140004210]
mov qword [rsp + 0xb8], rbx
lea r13, [rsp + 0xb0]
mov qword [rsp + 0x380], r13
mov qword [rsp + 0x388], r12
lea rcx, [rsp + 0x120]
lea rdi, [rsp + 0x370]
mov rdx, rdi
call fcn.1400302c8
lea rax, [0x1400416c8]
mov qword [rsp + 0x370], rax
mov qword [rsp + 0x378], rsi
and qword [rsp + 0x390], 0
mov qword [rsp + 0xb0], r15
mov qword [rsp + 0xb8], rbx
mov qword [rsp + 0x380], r13
mov qword [rsp + 0x388], r12
lea r15, [rsp + 0x200]
mov rcx, r15
mov rdx, rdi
call fcn.1400302c8
lea r8, [r14 + 0x48]
lea rcx, [rsp + 0x120]
mov rdx, qword [rsp + 0x50]
mov r9, r15
call fcn.140036a88
add r14, 0x70
jmp 0x14002d808
mov r15, qword [rsp + 0x50]
cmp qword [r15], 0
mov rdi, qword [rsp + 0x48]
movabs rsi, 0x8000000000000000
mov bpl, byte [rsp + 0x60]
jne 0x14002d578
jmp 0x14002d939
xor eax, eax
mov rcx, qword [rsp + 0x48]
mov qword [rcx + 0x60], rax
mov byte [rcx + 0x88], 1
mov rbx, qword [rsp + 0x78]
cmp byte [rbx + 6], 0
je 0x14002dc2e
lea rsi, [rsp + 0x200]
mov rcx, rsi
call fcn.14003558d
cmp dword [rsi], 2
je 0x14002db50
mov rax, qword [rsp + 0x230]
lea rdx, [rsp + 0x370]
mov qword [rdx + 0x30], rax
movups xmm0, xmmword [rsp + 0x200]
movups xmm1, xmmword [rsp + 0x210]
movups xmm2, xmmword [rsp + 0x220]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0x120]
mov rcx, rsi
call fcn.1400355b9
cmp qword [rsi], 2
je 0x14002db50
mov rax, qword [rsp + 0x150]
lea rdx, [rsp + 0x370]
mov qword [rdx + 0x30], rax
movups xmm0, xmmword [rsp + 0x120]
movups xmm1, xmmword [rsp + 0x130]
movups xmm2, xmmword [rsp + 0x140]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0xb0]
mov rcx, rsi
call fcn.140035633
cmp qword [rsi], 2
je 0x14002db50
mov rax, qword [rsp + 0xe0]
lea rdx, [rsp + 0x370]
mov qword [rdx + 0x30], rax
movups xmm0, xmmword [rsp + 0xb0]
movups xmm1, xmmword [rsp + 0xc0]
movups xmm2, xmmword [rsp + 0xd0]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0xe8]
mov rcx, rsi
call fcn.1400356c9
cmp qword [rsi], 2
je 0x14002db50
mov rax, qword [rsp + 0x118]
lea rdx, [rsp + 0x370]
mov qword [rdx + 0x30], rax
movups xmm0, xmmword [rsp + 0xe8]
movups xmm1, xmmword [rsp + 0xf8]
movups xmm2, xmmword [rsp + 0x108]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0x1c8]
mov rcx, rsi
call fcn.140035793
cmp qword [rsi], 2
je 0x14002db50
mov rax, qword [rsp + 0x1f8]
lea rdx, [rsp + 0x370]
mov qword [rdx + 0x30], rax
movups xmm0, xmmword [rsp + 0x1c8]
movups xmm1, xmmword [rsp + 0x1d8]
movups xmm2, xmmword [rsp + 0x1e8]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0x2d0]
mov rcx, rsi
call fcn.14003581a
mov rax, qword [rsi]
cmp rax, 2
je 0x14002db50
movups xmm0, xmmword [rsp + 0x2d8]
movups xmm1, xmmword [rsp + 0x2e8]
movups xmm2, xmmword [rsp + 0x2f8]
lea rdx, [rsp + 0x338]
movups xmmword [rdx + 0x28], xmm2
movups xmmword [rdx + 0x18], xmm1
movups xmmword [rdx + 8], xmm0
mov qword [rdx], rax
lea rsi, [rsp + 0x200]
mov rcx, rsi
mov r8b, 1
call fcn.1400358f9
mov edi, dword [rsi + 4]
cmp edi, 2
jne 0x14003009c
lea rcx, [rsp + 0x338]
call fcn.140035ace
mov ebx, 8
xor esi, esi
mov rdi, qword [rsp + 0x48]
mov rcx, qword [rdi + 0x98]
mov rdx, qword [rdi + 0xa0]
call fcn.140031887
mov rcx, qword [rdi + 0x90]
mov rdx, qword [rdi + 0x98]
call fcn.1400321fa
mov qword [rdi + 0x90], rsi
mov qword [rdi + 0x98], rbx
mov qword [rdi + 0xa0], rsi
mov rax, qword [rsp + 0x78]
cmp byte [rax + 1], 0
je 0x14002df12
lea rcx, [rsp + 0xb0]
and qword [rcx], 0
call sub.iphlpapi.dll_GetIfTable2
test eax, eax
mov rbx, qword [rsp + 0x48]
jne 0x14002ee89
lea rax, [rbx + 0x108]
mov qword [rsp + 0x198], rax
mov rax, qword [rbx + 0x108]
mov rcx, qword [rbx + 0x110]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [rbx + 0x120]
lea rsi, [rsp + 0x370]
mov qword [rsi], rax
add rax, 0x10
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov word [rsi + 0x18], dx
mov qword [rsi + 0x20], r8
mov rcx, rsi
call fcn.14003539e
test rax, rax
je 0x14002e04b
mov byte [rdx + 0x6e], 0
jmp 0x14002dc17
cmp byte [rbx + 5], 0
je 0x14002db97
mov rax, qword [rsp + 0x48]
mov rsi, qword [rax + 0x98]
lea r13, [rsp + 0x208]
imul rbp, qword [rax + 0xa0], 0x60
lea rdi, [rsp + 0x120]
lea rbx, [rsp + 0xb0]
lea r14, [rsp + 0x370]
lea r15, [rsp + 0xe8]
lea r12, [rsp + 0x200]
test rbp, rbp
je 0x14002db97
mov rax, qword [rsi]
cmp rax, 2
jne 0x14002de13
mov rcx, rdi
call fcn.14003558d
cmp dword [rsp + 0x120], 2
je 0x14002ddb2
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x3a0], rax
movups xmm0, xmmword [rsp + 0x120]
movups xmm1, xmmword [rsp + 0x130]
movups xmm2, xmmword [rsp + 0x140]
movaps xmmword [rsp + 0x390], xmm2
movaps xmmword [rsp + 0x380], xmm1
movaps xmmword [rsp + 0x370], xmm0
mov rcx, rbx
mov rdx, r14
call fcn.1400355b9
cmp qword [rsp + 0xb0], 2
je 0x14002ddb2
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x3a0], rax
movups xmm0, xmmword [rsp + 0xb0]
movups xmm1, xmmword [rsp + 0xc0]
movups xmm2, xmmword [rsp + 0xd0]
movaps xmmword [rsp + 0x390], xmm2
movaps xmmword [rsp + 0x380], xmm1
movaps xmmword [rsp + 0x370], xmm0
mov rcx, r15
mov rdx, r14
call fcn.140035633
cmp qword [rsp + 0xe8], 2
je 0x14002ddb2
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x3a0], rax
movups xmm0, xmmword [rsp + 0xe8]
movups xmm1, xmmword [rsp + 0xf8]
movups xmm2, xmmword [rsp + 0x108]
movaps xmmword [rsp + 0x390], xmm2
movaps xmmword [rsp + 0x380], xmm1
movaps xmmword [rsp + 0x370], xmm0
mov rcx, rdi
mov rdx, r14
call fcn.1400356c9
cmp qword [rsp + 0x120], 2
jne 0x14002dec2
mov qword [rsp + 0xb0], 2
mov rcx, rsi
call fcn.140035810
mov rax, qword [rsp + 0xe0]
mov qword [rsi + 0x30], rax
movups xmm0, xmmword [rsp + 0xb0]
movups xmm1, xmmword [rsp + 0xc0]
movups xmm2, xmmword [rsp + 0xd0]
movups xmmword [rsi + 0x20], xmm2
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, qword [rsi]
mov qword [rsi], 2
cmp rax, 2
jne 0x14002de1a
mov qword [rsp + 0x370], 2
jmp 0x14002de48
mov qword [rsi], 2
mov qword [rsp + 0x200], rax
movups xmm0, xmmword [rsi + 8]
movups xmm1, xmmword [rsi + 0x18]
movups xmm2, xmmword [rsi + 0x28]
movups xmmword [r13 + 0x20], xmm2
movups xmmword [r13 + 0x10], xmm1
movups xmmword [r13], xmm0
mov rcx, r14
mov rdx, r12
call fcn.14003581a
mov rcx, rsi
call fcn.140035810
mov rax, qword [rsp + 0x3a0]
mov qword [rsi + 0x30], rax
movups xmm0, xmmword [rsp + 0x370]
movups xmm1, xmmword [rsp + 0x380]
movups xmm2, xmmword [rsp + 0x390]
movups xmmword [rsi + 0x20], xmm2
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
cmp dword [rsi], 2
je 0x14002deb5
mov rcx, r14
mov rdx, rsi
xor r8d, r8d
call fcn.1400358f9
cmp dword [rsp + 0x374], 2
je 0x14002deb5
movss xmm0, dword [rsp + 0x370]
movss dword [rsi + 0x58], xmm0
ucomiss xmm0, dword [rsi + 0x5c]
jbe 0x14002deb5
movss dword [rsi + 0x5c], xmm0
add rsi, 0x60
add rbp, 0xffffffffffffffa0
jmp 0x14002dc7c
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x3a0], rax
movups xmm0, xmmword [rsp + 0x120]
movups xmm1, xmmword [rsp + 0x130]
movups xmm2, xmmword [rsp + 0x140]
movaps xmmword [rsp + 0x390], xmm2
movaps xmmword [rsp + 0x380], xmm1
movaps xmmword [rsp + 0x370], xmm0
mov rcx, rbx
mov rdx, r14
call fcn.140035793
jmp 0x14002ddbe
cmp byte [rax], 0
mov rbx, qword [rsp + 0x48]
je 0x14002ee89
lea rsi, [rsp + 0x370]
mov r8d, 0x548
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rbx + 0x108]
mov rcx, qword [rbx + 0x110]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
lea rdi, [rsp + 0x200]
mov word [rdi + 0x18], dx
mov qword [rdi], rax
add rax, 0x10
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rcx
mov rax, qword [rbx + 0x120]
mov qword [rdi + 0x20], rax
mov r14, 0xffffffffffffffff
mov rcx, rdi
call fcn.14003539e
test rax, rax
je 0x14002ee89
mov rbx, rdx
mov rax, qword [rdx]
mov qword [rsp + 0x370], rax
and dword [rsp + 0x378], 0
mov rcx, rsi
call sub.iphlpapi.dll_GetIfEntry2
test eax, eax
jne 0x14002df83
mov rax, qword [rbx + 8]
mov rcx, qword [rbx + 0x18]
mov qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x870]
mov qword [rbx + 8], rax
mov qword [rbx + 0x20], rcx
mov rax, qword [rsp + 0x828]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x28]
mov qword [rbx + 0x30], rax
mov rax, qword [rsp + 0x830]
add rax, qword [rsp + 0x838]
cmovb rax, r14
mov qword [rbx + 0x28], rax
mov rax, qword [rbx + 0x38]
mov qword [rbx + 0x40], rax
mov rax, qword [rsp + 0x878]
add rax, qword [rsp + 0x880]
cmovb rax, r14
mov qword [rbx + 0x38], rax
mov rax, qword [rbx + 0x48]
mov qword [rbx + 0x50], rax
mov rax, qword [rsp + 0x848]
mov qword [rbx + 0x48], rax
mov rax, qword [rbx + 0x58]
mov qword [rbx + 0x60], rax
mov rax, qword [rsp + 0x890]
mov qword [rbx + 0x58], rax
jmp 0x14002df83
lea rsi, [rsp + 0x370]
mov rcx, rsi
call fcn.1400360a5
mov rcx, rsi
call fcn.14003610e
movups xmm0, xmmword [0x140041cd0]
movaps xmmword [rsi], xmm0
movdqu xmm0, xmmword [0x140041ce0]
movdqa xmmword [rsi + 0x10], xmm0
lea r8, [rsp + 0x390]
lea rcx, [rsp + 0x120]
and qword [rcx], 0
mov qword [rcx + 8], 8
and qword [rcx + 0x10], 0
mov qword [r8], rax
mov qword [r8 + 8], rdx
mov rax, qword [rsp + 0xb0]
lea rcx, [rax + 8]
mov qword [rsp + 0x1c0], rax
mov r14d, dword [rax]
mov eax, 8
mov qword [rsp + 0x88], rax
lea r12, [rsp + 0x200]
pcmpeqd xmm6, xmm6
xor eax, eax
mov qword [rsp + 0x60], rax
xor eax, eax
mov qword [rsp + 0x1b8], rax
xor r15d, r15d
mov qword [rsp + 0x90], rcx
mov qword [rsp + 0x80], r14
cmp r15, r14
je 0x14002e422
mov rsi, r15
inc r15
imul rax, rsi, 0x548
lea rdi, [rcx + rax]
cmp qword [rcx + rax + 0x4a8], 0
jne 0x14002e125
cmp qword [rdi + 0x4b0], 0
je 0x14002e0f6
cmp dword [rdi + 0x48c], 2
je 0x14002e0f6
cmp dword [rdi + 0x420], 0
je 0x14002e0f6
mov al, byte [0x14004a270]
mov edx, 0x14
xor ecx, ecx
call fcn.1400292c0
test rax, rax
je 0x1400301b3
mov rbx, rax
mov qword [rsp + 0x68], r15
mov eax, dword [rdi + 0x10]
movzx ecx, byte [rdi + 0x14]
movzx edx, byte [rdi + 0x15]
movzx r8d, byte [rdi + 0x16]
movzx r9d, byte [rdi + 0x17]
movzx r10d, byte [rdi + 0x18]
movzx r11d, byte [rdi + 0x19]
movzx ebp, byte [rdi + 0x1a]
movzx edi, byte [rdi + 0x1b]
mov dword [rbx], eax
mov word [rbx + 4], cx
mov word [rbx + 6], dx
mov word [rbx + 8], r8w
mov word [rbx + 0xa], r9w
mov word [rbx + 0xc], r10w
mov word [rbx + 0xe], r11w
mov word [rbx + 0x10], bp
mov word [rbx + 0x12], di
mov edx, 0xa
mov rcx, r12
xor r8d, r8d
call fcn.140031cb2
cmp qword [rsp + 0x200], 0
mov rax, qword [rsp + 0x208]
mov qword [rsp + 0x58], rax
jne 0x1400301a1
mov r13, qword [rsp + 0x210]
mov eax, dword [rbx + 0x10]
mov dword [r13 + 0x10], eax
movups xmm0, xmmword [rbx]
movups xmmword [r13], xmm0
mov rcx, qword [rsp + 0x390]
mov rdx, qword [rsp + 0x398]
mov r9d, 0xa
mov r8, r13
call fcn.140032b03
mov r14, qword [rsp + 0x370]
mov rdi, qword [rsp + 0x378]
mov r15, rdi
and r15, rax
mov qword [rsp + 0x1a0], rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor eax, eax
mov qword [rsp + 0x50], rax
movdqu xmm8, xmmword [r14 + r15]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0x200], ax
mov rcx, r12
call fcn.14003046f
test rax, rax
je 0x14002e297
add rdx, r15
and rdx, rdi
shl rdx, 5
mov rbp, r14
sub rbp, rdx
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x10]
mov r9d, 0xa
mov r8, r13
call fcn.140035d95
test al, al
je 0x14002e25e
jmp 0x14002e2ba
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
mov rax, qword [rsp + 0x50]
jne 0x14002e313
add r15, rax
add r15, 0x10
add rax, 0x10
and r15, rdi
jmp 0x14002e23e
movabs rax, 0x8000000000000000
mov rcx, qword [rsp + 0x58]
cmp rcx, rax
je 0x14002e2d6
mov rdx, r13
call fcn.1400321c4
mov r14, qword [rsp + 0x80]
mov r15, qword [rsp + 0x68]
mov eax, dword [rbp - 8]
inc eax
mov dword [rbp - 8], eax
cmp eax, 1
jle 0x14002e37f
mov ecx, 0xa
mov rdx, rbx
call fcn.1400321c4
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x90]
jmp 0x14002e0f6
cmp qword [rsp + 0x380], 0
je 0x14002e3f8
mov rcx, r14
mov rdx, rdi
mov r8, qword [rsp + 0x1a0]
call fcn.14003066d
mov rcx, qword [rsp + 0x370]
shl rax, 5
mov rbp, rcx
and dl, 1
movzx edx, dl
sub qword [rsp + 0x380], rdx
sub rbp, rax
neg rax
mov rdx, qword [rsp + 0x58]
mov qword [rcx + rax - 0x20], rdx
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], 0xa
and dword [rbp - 8], 0
inc qword [rsp + 0x388]
jmp 0x14002e2d6
mov rax, qword [rsp + 0x60]
cmp rax, qword [rsp + 0x120]
jne 0x14002e3ab
lea rcx, [rsp + 0x120]
call fcn.140031e8c
mov rax, qword [rsp + 0x128]
mov qword [rsp + 0x88], rax
mov rcx, qword [rsp + 0x60]
mov rax, rcx
shl rax, 5
mov rdx, qword [rsp + 0x88]
mov dword [rdx + rax], esi
mov r8d, 0xa
mov qword [rdx + rax + 8], r8
mov qword [rdx + rax + 0x10], rbx
mov qword [rdx + rax + 0x18], r8
inc rcx
mov rax, rcx
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x130], rcx
add qword [rsp + 0x1b8], 0x20
jmp 0x14002e301
lea rcx, [rsp + 0x370]
lea rdx, [rsp + 0x390]
call fcn.140039f2f
mov r14, qword [rsp + 0x370]
mov rdi, qword [rsp + 0x378]
jmp 0x14002e322
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x330], rax
mov rcx, qword [rsp + 0x128]
mov rax, qword [rsp + 0x60]
shl rax, 5
add rax, rcx
mov qword [rsp + 0x60], rax
lea rax, [rbx + 0x128]
mov qword [rsp + 0x328], rax
add qword [rsp + 0x1c0], 0x24
pcmpeqd xmm6, xmm6
mov qword [rsp + 0x88], rcx
mov r14, rcx
movabs rsi, 0x8000000000000000
mov rdi, r14
cmp r14, qword [rsp + 0x60]
je 0x14002e98e
lea r14, [rdi + 0x20]
mov r15, qword [rdi + 8]
cmp r15, rsi
je 0x14002e98b
mov r13, qword [rdi + 0x10]
mov edx, dword [rdi]
cmp qword [rsp + 0x388], 0
je 0x14002e575
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r14
mov rdi, qword [rdi + 0x18]
mov rcx, qword [rsp + 0x390]
mov rdx, qword [rsp + 0x398]
mov r8, r13
mov r9, rdi
call fcn.140032b03
mov r14, qword [rsp + 0x370]
mov r12, qword [rsp + 0x378]
mov rbp, r12
and rbp, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor ebx, ebx
movdqu xmm8, xmmword [r14 + rbp]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb ecx, xmm0
test cx, cx
je 0x14002e557
bsf eax, ecx
lea esi, [rcx - 1]
and esi, ecx
add rax, rbp
and rax, r12
shl rax, 5
mov r15, r14
sub r15, rax
mov r8, qword [r15 - 0x18]
mov r9, qword [r15 - 0x10]
mov rcx, r13
mov rdx, rdi
call fcn.140035d95
mov ecx, esi
test al, al
je 0x14002e51f
jmp 0x14002e57c
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x14002e579
add rbp, rbx
add rbp, 0x10
add rbx, 0x10
and rbp, r12
jmp 0x14002e50c
xor eax, eax
jmp 0x14002e5b0
xor r15d, r15d
lea rax, [r15 - 0x20]
test r15, r15
cmove rax, r15
add rax, 0x18
test r15, r15
cmove rax, r15
mov rbx, qword [rsp + 0x48]
movabs rsi, 0x8000000000000000
mov r14, qword [rsp + 0x50]
mov r15, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x68]
test rax, rax
lea rcx, [0x140041d10]
cmove rax, rcx
cmp dword [rax], 1
jg 0x14002e800
imul rax, rdx, 0x548
mov rcx, qword [rsp + 0x90]
lea rbp, [rcx + rax]
lea rdx, [rbp + 0x1c]
add rax, qword [rsp + 0x1c0]
mov ecx, 0x202
xor r8d, r8d
test rcx, rcx
je 0x14002e604
cmp word [rax + r8*2], 0
je 0x14002e60c
inc r8
add rcx, 0xfffffffffffffffe
jmp 0x14002e5ee
mov r8d, 0x101
jmp 0x14002e619
cmp r8, 0x102
jae 0x1400301c2
lea rcx, [rsp + 0x200]
call fcn.140004010
mov rax, qword [rsp + 0x200]
cmp rax, rsi
je 0x14002e800
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], r14
mov r14, qword [rsp + 0x208]
mov r15, qword [rsp + 0x210]
mov rcx, qword [rbx + 0x128]
mov rdx, qword [rbx + 0x130]
mov r8, r14
mov r9, r15
call fcn.1400327c3
mov r12, qword [rbx + 0x108]
mov rbx, qword [rbx + 0x110]
mov rdi, rbx
and rdi, rax
mov qword [rsp + 0x1a0], rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor eax, eax
mov qword [rsp + 0x68], rax
movdqu xmm8, xmmword [r12 + rdi]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0x200], ax
lea rcx, [rsp + 0x200]
call fcn.14003046f
test rax, rax
je 0x14002e703
add rdx, rdi
and rdx, rbx
neg rdx
imul rsi, rdx, 0x88
mov rcx, qword [r12 + rsi - 0x80]
mov rdx, qword [r12 + rsi - 0x78]
mov r8, r14
mov r9, r15
call fcn.140035d70
test al, al
je 0x14002e6c6
jmp 0x14002e72d
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
mov rax, qword [rsp + 0x68]
jne 0x14002e810
add rdi, rax
add rdi, 0x10
add rax, 0x10
and rdi, rbx
jmp 0x14002e6a6
add r12, rsi
mov rax, qword [r12 - 0x68]
mov rcx, qword [r12 - 0x58]
mov qword [r12 - 0x60], rax
mov rax, qword [rbp + 0x500]
mov qword [r12 - 0x68], rax
mov qword [r12 - 0x50], rcx
mov rax, qword [rbp + 0x4b8]
mov qword [r12 - 0x58], rax
mov rax, qword [r12 - 0x48]
mov qword [r12 - 0x40], rax
mov rax, qword [rbp + 0x4c0]
add rax, qword [rbp + 0x4c8]
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov qword [r12 - 0x48], rax
mov rax, qword [r12 - 0x38]
mov qword [r12 - 0x30], rax
mov rax, qword [rbp + 0x508]
add rax, qword [rbp + 0x510]
cmovb rax, rcx
mov qword [r12 - 0x38], rax
mov rax, qword [r12 - 0x28]
mov qword [r12 - 0x20], rax
mov rax, qword [rbp + 0x4d8]
mov qword [r12 - 0x28], rax
mov rax, qword [r12 - 0x18]
mov qword [r12 - 0x10], rax
mov rax, qword [rbp + 0x520]
mov qword [r12 - 0x18], rax
mov byte [r12 - 2], 1
mov rcx, qword [rsp + 0x80]
mov rdx, r14
call fcn.14000bd74
mov rbx, qword [rsp + 0x48]
movabs rsi, 0x8000000000000000
mov r14, qword [rsp + 0x50]
mov r15, qword [rsp + 0x58]
mov rcx, r15
mov rdx, r13
call fcn.1400321c4
jmp 0x14002e47c
mov rsi, qword [rsp + 0x48]
cmp qword [rsi + 0x118], 0
je 0x14002e963
mov rcx, qword [rbp + 0x4c0]
add rcx, qword [rbp + 0x4c8]
mov rax, 0xffffffffffffffff
cmovb rcx, rax
mov qword [rsp + 0x68], rcx
mov rdi, qword [rbp + 0x508]
add rdi, qword [rbp + 0x510]
cmovb rdi, rax
mov rax, qword [rbp]
mov qword [rsp + 0x310], rax
mov rax, qword [rbp + 0x500]
mov qword [rsp + 0x308], rax
mov rax, qword [rbp + 0x4b8]
mov qword [rsp + 0x318], rax
mov rax, qword [rbp + 0x4d8]
mov qword [rsp + 0x320], rax
mov rbp, qword [rbp + 0x520]
mov rcx, r12
mov rdx, rbx
mov r8, qword [rsp + 0x1a0]
call fcn.14003066d
mov rcx, qword [rsi + 0x108]
neg rax
and dl, 1
movzx edx, dl
sub qword [rsi + 0x118], rdx
imul rax, rax, 0x88
mov rdx, qword [rsp + 0x80]
mov qword [rcx + rax - 0x88], rdx
mov qword [rcx + rax - 0x80], r14
mov qword [rcx + rax - 0x78], r15
mov rdx, qword [rsp + 0x310]
mov qword [rcx + rax - 0x70], rdx
mov rdx, qword [rsp + 0x308]
mov qword [rcx + rax - 0x68], rdx
mov qword [rcx + rax - 0x60], rdx
mov rdx, qword [rsp + 0x318]
mov qword [rcx + rax - 0x58], rdx
mov qword [rcx + rax - 0x50], rdx
mov rdx, qword [rsp + 0x68]
mov qword [rcx + rax - 0x48], rdx
mov qword [rcx + rax - 0x40], rdx
mov qword [rcx + rax - 0x38], rdi
mov qword [rcx + rax - 0x30], rdi
mov rdx, qword [rsp + 0x320]
mov qword [rcx + rax - 0x28], rdx
mov qword [rcx + rax - 0x20], rdx
mov qword [rcx + rax - 0x18], rbp
mov qword [rcx + rax - 0x10], rbp
and dword [rcx + rax - 8], 0
and word [rcx + rax - 4], 0
mov byte [rcx + rax - 2], 1
inc qword [rsi + 0x120]
mov rbx, rsi
jmp 0x14002e7ec
mov rcx, qword [rsp + 0x198]
mov rdx, qword [rsp + 0x328]
call fcn.14003a495
mov r12, qword [rsi + 0x108]
mov rbx, qword [rsi + 0x110]
jmp 0x14002e823
mov rdi, r14
mov rsi, qword [rsp + 0x88]
sub rsi, rdi
add rdi, 0x10
add rsi, qword [rsp + 0x1b8]
shr rsi, 5
sub rsi, 1
jb 0x14002e9c1
mov rcx, qword [rdi - 8]
mov rdx, qword [rdi]
call fcn.1400321c4
add rdi, 0x20
jmp 0x14002e9a9
mov r8, qword [rsp + 0x330]
test r8, r8
je 0x14002e9e4
shl r8, 5
mov edx, 8
mov rcx, qword [rsp + 0x88]
call fcn.1400088dc
mov rcx, qword [rsp + 0xb0]
call sub.iphlpapi.dll_FreeMibTable
mov r8, qword [rsp + 0x378]
test r8, r8
je 0x14002eb11
mov rdx, qword [rsp + 0x370]
mov rax, qword [rsp + 0x388]
test rax, rax
je 0x14002eae2
lea rcx, [rdx + r8]
inc rcx
movdqa xmm0, xmmword [rdx]
pmovmskb r8d, xmm0
not r8d
lea rsi, [rsp + 0x218]
mov qword [rsi - 0x18], rdx
add rdx, 0x10
mov qword [rsi - 0x10], rdx
mov qword [rsi - 8], rcx
mov word [rsi], r8w
mov qword [rsi + 8], rax
mov edi, 1
test rdi, rdi
je 0x14002ead2
mov rcx, rsi
call fcn.14003046f
cmp rax, 1
je 0x14002ea9a
mov rax, qword [rsp + 0x208]
movdqa xmm0, xmmword [rax]
pmovmskb ecx, xmm0
not ecx
mov word [rsp + 0x218], cx
add qword [rsp + 0x200], 0xfffffffffffffe00
add rax, 0x10
mov qword [rsp + 0x208], rax
jmp 0x14002ea58
shl rdx, 5
mov rax, qword [rsp + 0x200]
mov rdi, qword [rsp + 0x220]
mov rcx, rax
sub rcx, rdx
dec rdi
mov qword [rsp + 0x220], rdi
mov rcx, qword [rcx - 0x20]
neg rdx
mov rdx, qword [rax + rdx - 0x18]
call fcn.1400321c4
jmp 0x14002ea53
mov rdx, qword [rsp + 0x370]
mov r8, qword [rsp + 0x378]
mov qword [rsp + 0x20], 0x10
lea rsi, [rsp + 0x200]
mov r9d, 0x20
mov rcx, rsi
call fcn.1400303b8
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
call fcn.1400088dc
mov rax, qword [rbx + 0x108]
mov rcx, qword [rbx + 0x110]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
lea rsi, [rsp + 0x370]
mov word [rsi + 0x18], dx
mov qword [rsi], rax
add rax, 0x10
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov rax, qword [rbx + 0x120]
mov qword [rsi + 0x20], rax
mov ebx, 0x88
mov rcx, rsi
call fcn.1400304ef
test rax, rax
je 0x14002eb9d
mov rdi, rax
cmp byte [rax - 2], 0
jne 0x14002eb5a
mov rcx, qword [rsp + 0x198]
mov rax, qword [rcx]
sub rax, rdi
cqo
idiv rbx
mov rdx, rax
call fcn.1400305f9
mov rcx, qword [rdi - 0x88]
mov rdx, qword [rdi - 0x80]
call fcn.14000bd74
jmp 0x14002eb5a
lea r12, [rsp + 0x1c8]
mov dword [r12], 0x3c00
and dword [rsp + 0xe8], 0
mov ebp, 4
xor edi, edi
lea rsi, str.failed_to_allocate_memory_for_IP_ADAPTER_ADDRESSESGetAdaptersAddresses___failed_with_code
lea rbx, [rsp + 0x370]
dec ebp
je 0x14002ec86
mov edx, dword [rsp + 0x1c8]
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
mov r14, rax
mov r15, rax
test rax, rax
jne 0x14002ec31
mov r8d, 0x32
mov rcx, rbx
mov rdx, rsi
call fcn.14003025f
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, qword [rsp + 0x370]
mov r15, qword [rsp + 0x378]
mov r14, qword [rsp + 0x380]
movabs rax, 0x8000000000000000
cmp rcx, rax
jne 0x14003007f
mov qword [rsp + 0x20], r12
xor ecx, ecx
mov edx, 0xe
xor r8d, r8d
mov r9, r15
call sub.iphlpapi.dll_GetAdaptersAddresses
mov dword [rsp + 0xe8], eax
mov rdi, r15
cmp eax, 0x6f
je 0x14002ebcb
test eax, eax
jne 0x14002ec83
mov qword [rsp + 0x208], r15
mov qword [rsp + 0x210], r14
movabs rcx, 0x8000000000000000
mov qword [rsp + 0x200], rcx
jmp 0x14002ecf0
mov rdi, r15
lea rax, [rsp + 0xe8]
mov qword [rsp + 0x120], rax
lea rax, [0x140042190]
lea rdx, [rsp + 0x370]
mov qword [rdx], rax
mov eax, 1
mov qword [rdx + 8], rax
and qword [rdx + 0x20], 0
lea rcx, [0x140004fe0]
mov qword [rsp + 0x128], rcx
lea rcx, [rsp + 0x120]
mov qword [rdx + 0x10], rcx
mov qword [rdx + 0x18], rax
lea rsi, [rsp + 0x200]
mov rcx, rsi
call fcn.140003c60
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, qword [rsi]
movabs rax, 0x8000000000000000
mov rdx, qword [rsp + 0x208]
cmp rcx, rax
jne 0x14002ee75
mov rax, qword [rsp + 0x210]
lea rcx, [rsp + 0x120]
mov qword [rcx], rdx
mov qword [rcx + 8], rax
lea rbx, [rsp + 0xe8]
pcmpeqd xmm6, xmm6
lea rcx, [rsp + 0x370]
lea rdx, [rsp + 0x120]
call fcn.140036908
mov r14, qword [rsp + 0x370]
movabs rax, 0x8000000000000000
cmp r14, rax
je 0x14002ee7c
mov r15, qword [rsp + 0x378]
mov rax, qword [rsp + 0x48]
cmp qword [rax + 0x120], 0
je 0x14002ee65
mov r12, qword [rsp + 0x380]
mov rsi, qword [rsp + 0x48]
mov rcx, qword [rsi + 0x128]
mov rdx, qword [rsi + 0x130]
mov r8, r15
mov r9, r12
call fcn.1400327c3
mov r13, qword [rsi + 0x108]
mov rsi, qword [rsi + 0x110]
mov rdi, rsi
and rdi, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor eax, eax
mov qword [rsp + 0x50], rax
movdqu xmm8, xmmword [r13 + rdi]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0xe8], ax
mov rcx, rbx
call fcn.14003046f
test rax, rax
je 0x14002ee24
add rdx, rdi
and rdx, rsi
neg rdx
imul rbp, rdx, 0x88
mov r8, qword [r13 + rbp - 0x80]
mov r9, qword [r13 + rbp - 0x78]
mov rcx, r15
mov rdx, r12
call fcn.140035d6b
test al, al
je 0x14002edec
jmp 0x14002ee4c
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x14002ee65
mov rax, qword [rsp + 0x50]
add rdi, rax
add rdi, 0x10
add rax, 0x10
mov qword [rsp + 0x50], rax
and rdi, rsi
jmp 0x14002edd0
lea rcx, [rsp + 0x388]
movzx eax, word [rcx + 4]
mov word [r13 + rbp - 4], ax
mov eax, dword [rcx]
mov dword [r13 + rbp - 8], eax
mov rcx, r14
mov rdx, r15
call fcn.14000bd74
jmp 0x14002ed2e
call fcn.14000bd74
jmp 0x14002ee89
mov rcx, qword [rsp + 0x120]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rax, qword [rsp + 0x78]
movzx ebp, word [rax + 8]
cmp bpl, 2
je 0x14002f71a
movzx eax, byte [rax + 0xa]
shl eax, 0x10
mov ecx, ebp
or ecx, eax
mov word [rsp + 0x74], cx
shr ecx, 0x10
mov byte [rsp + 0x76], cl
lea rsi, [rsp + 0x370]
mov edi, 0x80000
mov edx, 0x80000
mov rcx, rsi
xor r8d, r8d
call fcn.14000bc47
cmp qword [rsi], 0
mov rcx, qword [rsi + 8]
jne 0x1400301d9
lea rbx, [rsp + 0x370]
mov rax, qword [rbx + 0x10]
lea r14, [rsp + 0x2d0]
mov qword [r14], rcx
mov qword [r14 + 8], rax
and qword [r14 + 0x10], 0
mov r15, qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
and dword [rsp + 0x370], 0
mov rcx, r14
mov rdx, rdi
call fcn.140009563
mov rsi, qword [rsp + 0x2d8]
mov ecx, 5
mov rdx, rsi
mov r8d, edi
mov r9, rbx
call r15
cmp eax, 0xc0000004
jne 0x14002ef50
mov eax, dword [rsp + 0x370]
add rdi, rdi
lea ecx, [rax + 0x2800]
test eax, eax
cmovne rdi, rcx
jmp 0x14002ef05
test eax, eax
jne 0x14002effd
mov qword [rsp + 0x2e0], rdi
mov ecx, 8
mov edx, 0xfa0
call fcn.14000bcb5
test rax, rax
je 0x1400301e6
lea rdi, [rsp + 0x1c8]
mov qword [rdi], 0x1f4
mov qword [rdi + 8], rax
and qword [rdi + 0x10], 0
xor ebx, ebx
xor r14d, r14d
cmp rbx, qword [rsp + 0x1c8]
jne 0x14002efaf
mov rcx, rdi
call fcn.1400320ea
mov rax, qword [rsp + 0x1d0]
lea rcx, [rsi + r14]
mov qword [rax + rbx*8], rcx
inc rbx
mov qword [rsp + 0x1d8], rbx
mov ecx, dword [rcx]
add r14, rcx
test rcx, rcx
jne 0x14002ef95
mov rsi, qword [rsp + 0x48]
lea rax, [rsi + 0xd8]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x98], rax
test bpl, bpl
je 0x14002f00d
mov rcx, rsi
xor edx, edx
call fcn.140030d08
mov rax, qword [rsi + 0x80]
jmp 0x14002f00f
mov rcx, qword [rsp + 0x2d0]
mov rdx, rsi
jmp 0x14002f710
xor eax, eax
mov qword [rsp + 0x1a8], rax
call fcn.140029220
mov r8d, edx
lea rsi, [rsp + 0x370]
mov rcx, rsi
mov edx, eax
call fcn.140029250
cmp qword [rsi], 0
jne 0x14002f041
mov rax, qword [rsp + 0x378]
jmp 0x14002f043
xor eax, eax
lea rcx, [rsp + 0xa0]
mov qword [rcx], rax
mov rdi, qword [rsp + 0x1d8]
mov qword [rsp + 0x380], rdi
and qword [rsp + 0xe8], 0
mov qword [rsp + 0xf0], 8
and qword [rsp + 0xf8], 0
movups xmm0, xmmword [rsp + 0x1c8]
movaps xmmword [rsp + 0x370], xmm0
lea rax, [rsp + 0x98]
mov qword [rsp + 0x388], rax
lea rax, [rsp + 0x74]
mov qword [rsp + 0x390], rax
lea rax, [rsp + 0x1a8]
movups xmm0, xmmword [rsp + 0x1c8]
movaps xmmword [rsp + 0x120], xmm0
and qword [rsp + 0x130], 0
mov qword [rsp + 0x398], rax
mov qword [rsp + 0x3a0], rcx
cmp qword [rsp + 0x120], rdi
jb 0x1400301f5
lea rsi, [rsp + 0x388]
mov rbx, qword [rsp + 0x128]
mov rcx, rdi
call fcn.140032b99
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 1
lea rsi, [rsp + 0xb0]
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
mov r9, rax
call fcn.1400336fa
cmp qword [rsp + 0x130], rdi
jne 0x14002f170
lea rax, [rsp + 0x120]
and qword [rax + 0x10], 0
lea rcx, [rsp + 0x200]
mov qword [rcx + 0x18], rdi
and qword [rcx + 0x20], 0
mov qword [rcx + 0x10], rax
mov eax, 8
mov qword [rcx], rax
mov qword [rcx + 8], rax
call fcn.140035352
jmp 0x14002f17e
test rdi, rdi
jne 0x14002f17e
and qword [rsp + 0x130], 0
mov r8, qword [rsp + 0x120]
test r8, r8
je 0x14002f1a1
shl r8, 3
mov rcx, qword [rsp + 0x128]
mov edx, 8
call fcn.1400088dc
mov rax, qword [rsp + 0xc0]
xor edx, edx
sub rax, 1
jb 0x14002f1c3
mov rsi, qword [rsi]
test rsi, rsi
je 0x14002f1c3
add rdx, qword [rsi + 0x10]
add rsi, 0x18
jmp 0x14002f1ab
lea rcx, [rsp + 0xe8]
call fcn.14003167c
mov rax, qword [rsp + 0xc0]
lea rsi, [rsp + 0x370]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0xb0]
movaps xmmword [rsi], xmm0
movabs r12, 0x8000000000000000
mov rcx, rsi
call fcn.140035196
test rax, rax
je 0x14002f27e
mov rdi, qword [rax]
mov rbx, qword [rax + 8]
mov r14, qword [rax + 0x10]
mov edx, 8
mov rcx, rax
call fcn.1400086c0
cmp rdi, r12
je 0x14002f27e
lea rcx, [rsp + 0xe8]
mov rdx, r14
call fcn.14003167c
mov r15, qword [rsp + 0xf8]
imul rcx, r15, 0x150
add rcx, qword [rsp + 0xf0]
imul r8, r14, 0x150
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
add r15, r14
mov qword [rsp + 0xf8], r15
mov rcx, rbx
xor edx, edx
call fcn.140031757
mov rcx, rdi
mov rdx, rbx
call fcn.140032214
jmp 0x14002f1f9
lea rcx, [rsp + 0x370]
call fcn.140035263
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0x60], rax
imul rsi, qword [rsp + 0xf8], 0x150
mov rbp, qword [rsp + 0xf0]
lea rax, [rsi + rbp]
mov qword [rsp + 0x90], rax
mov r13, qword [rsp + 0x48]
lea rax, [r13 + 0xf8]
mov qword [rsp + 0x198], rax
lea r12, [rsp + 0x120]
mov qword [rsp + 0x68], rbp
test rsi, rsi
je 0x14002f5a5
mov r15, qword [rbp]
cmp r15, 2
je 0x14002f59e
mov qword [rsp + 0x50], rsi
lea rsi, [rbp + 0xe0]
mov rbx, qword [rbp + 0xd8]
lea rdx, [rbp + 8]
mov r8d, 0xd0
lea rcx, [rsp + 0x200]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, 0xe
mov rdi, r12
rep movsq qword [rdi], qword [rsi]
mov qword [rsp + 0x338], rbx
mov rcx, qword [r13 + 0xf8]
mov rdx, qword [r13 + 0x100]
mov r8, rbx
call fcn.140032a68
mov rsi, rax
lea rax, [rsp + 0x338]
mov qword [rsp + 0xe8], rax
cmp qword [r13 + 0xe8], 0
je 0x14002f587
lea rax, [rsp + 0xe8]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0xb8], rax
mov rcx, qword [r13 + 0xd8]
mov rdx, qword [r13 + 0xe0]
lea rax, [0x140035501]
mov qword [rsp + 0x20], rax
mov r8, rsi
lea r9, [rsp + 0xb0]
call fcn.1400353d4
mov rdi, qword [r13 + 0xd8]
test rax, rax
je 0x14002f446
movzx eax, byte [rdi + rdx]
and eax, 1
sub qword [r13 + 0xe8], rax
mov rax, qword [rsp + 0x338]
shr rsi, 0x39
lea rcx, [rdx - 0x10]
and rcx, qword [r13 + 0xe0]
mov byte [rdi + rdx], sil
mov byte [rdi + rcx + 0x10], sil
inc qword [r13 + 0xf0]
neg rdx
imul r14, rdx, 0x158
lea rsi, [rdi + r14]
add rsi, 0xfffffffffffffeb8
mov qword [rsi - 0x10], rax
mov qword [rsi - 8], r15
mov r8d, 0xd0
mov rcx, rsi
lea rdx, [rsp + 0x200]
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsi + 0xd0], rbx
add rdi, r14
add rdi, 0xffffffffffffff90
mov ecx, 0xe
mov rsi, r12
rep movsq qword [rdi], qword [rsi]
mov rsi, qword [rsp + 0x50]
jmp 0x14002f574
neg rdx
imul r14, rdx, 0x158
lea rsi, [rdi + r14]
add rsi, 0xfffffffffffffeb0
mov r8d, 0x150
lea rcx, [rsp + 0x370]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsi], r15
lea rsi, [rdi + r14]
add rsi, 0xfffffffffffffeb8
mov r8d, 0xd0
mov rcx, rsi
lea rdx, [rsp + 0x200]
call sub.VCRUNTIME140.dll_memcpy
mov qword [rsi + 0xd0], rbx
add rdi, r14
add rdi, 0xffffffffffffff90
mov ecx, 0xe
mov rsi, r12
rep movsq qword [rdi], qword [rsi]
cmp qword [rsp + 0x370], 2
mov rsi, qword [rsp + 0x50]
je 0x14002f574
mov rcx, qword [rsp + 0x380]
mov rdx, qword [rsp + 0x388]
call fcn.14000bd74
lea rcx, [rsp + 0x398]
call fcn.140030235
mov rcx, qword [rsp + 0x3b0]
mov rdx, qword [rsp + 0x3b8]
call fcn.14000bd74
mov rcx, qword [rsp + 0x428]
movabs rax, 0x8000000000000000
cmp rcx, rax
je 0x14002f51d
mov rdx, qword [rsp + 0x430]
call fcn.14000bd74
lea rcx, [rsp + 0x3d0]
call fcn.140030235
mov rcx, qword [rsp + 0x3e8]
mov rdx, qword [rsp + 0x3f0]
call fcn.14000bd74
mov rcx, qword [rsp + 0x408]
mov rdx, qword [rsp + 0x410]
call fcn.14000bd74
mov rax, qword [rsp + 0x460]
test rax, rax
je 0x14002f574
lock dec qword [rax]
jne 0x14002f574
lea rcx, [rsp + 0x460]
call fcn.14003522c
add rbp, 0x150
add rsi, 0xfffffffffffffeb0
jmp 0x14002f2d9
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x198]
call fcn.14003a0fd
jmp 0x14002f364
add rbp, 0x150
mov rax, qword [rsp + 0x90]
sub rax, rbp
mov ecx, 0x150
xor edx, edx
div rcx
mov rsi, rax
add rbp, 0xf0
movabs rbx, 0x8000000000000000
sub rsi, 1
jb 0x14002f665
mov rcx, qword [rbp - 0xe0]
mov rdx, qword [rbp - 0xd8]
call fcn.14000bd74
lea rcx, [rbp - 0xc8]
call fcn.140030235
mov rcx, qword [rbp - 0xb0]
mov rdx, qword [rbp - 0xa8]
call fcn.14000bd74
mov rcx, qword [rbp - 0x38]
cmp rcx, rbx
je 0x14002f61c
mov rdx, qword [rbp - 0x30]
call fcn.14000bd74
lea rcx, [rbp - 0x90]
call fcn.140030235
mov rcx, qword [rbp - 0x78]
mov rdx, qword [rbp - 0x70]
call fcn.14000bd74
mov rcx, qword [rbp - 0x58]
mov rdx, qword [rbp - 0x50]
call fcn.14000bd74
mov rax, qword [rbp]
test rax, rax
je 0x14002f659
lock dec qword [rax]
jne 0x14002f659
mov rcx, rbp
call fcn.14003522c
add rbp, 0x150
jmp 0x14002f5ce
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
call fcn.140032214
mov rax, qword [r13 + 0xd8]
mov rcx, qword [r13 + 0xe0]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
lea rsi, [rsp + 0x370]
mov word [rsi + 0x18], dx
mov qword [rsi], rax
add rax, 0x10
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov rax, qword [r13 + 0xf0]
mov qword [rsi + 0x20], rax
mov ebx, 0x158
mov rcx, rsi
call fcn.14003048e
test rax, rax
je 0x14002f700
mov rdi, rax
cmp byte [rax - 4], 0
mov byte [rax - 4], 0
jne 0x14002f6bd
mov rcx, qword [rsp + 0x58]
mov rax, qword [rcx]
sub rax, rdi
cqo
idiv rbx
mov rdx, rax
call fcn.1400305f9
add rdi, 0xfffffffffffffea8
mov rcx, rdi
call fcn.140030550
jmp 0x14002f6bd
mov rcx, qword [rsp + 0x2d0]
mov rdx, qword [rsp + 0x2d8]
call fcn.14000bd74
mov rax, qword [rsp + 0x78]
cmp byte [rax + 2], 0
je 0x14002f8b8
call sub.kernel32.dll_GetLogicalDrives
mov dword [rsp + 0xb0], eax
test eax, eax
je 0x14002f936
and qword [rsp + 0x120], 0
mov qword [rsp + 0x128], 8
and qword [rsp + 0x130], 0
lea rax, [rsp + 0xb0]
lea rsi, [rsp + 0x370]
mov qword [rsi], rax
movabs rax, 0x2000000000
mov qword [rsi + 8], rax
mov ecx, 0x20
call fcn.140032b99
mov qword [rsp + 0x38], rsi
and dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x20
mov qword [rsp + 0x20], 1
xor edi, edi
lea rsi, [rsp + 0x200]
mov edx, 0x20
mov rcx, rsi
xor r8d, r8d
mov r9, rax
call fcn.140032bff
mov rax, qword [rsi + 0x10]
sub rax, 1
jb 0x14002f7d5
mov rsi, qword [rsi]
test rsi, rsi
je 0x14002f7d5
add rdi, qword [rsi + 0x10]
add rsi, 0x18
jmp 0x14002f7bd
lea rsi, [rsp + 0x120]
mov rcx, rsi
mov rdx, rdi
call fcn.140031644
mov rax, qword [rsp + 0x210]
lea rdi, [rsp + 0x370]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0x200]
movaps xmmword [rdi], xmm0
movabs r12, 0x8000000000000000
mov rcx, rdi
call fcn.140035196
test rax, rax
je 0x14002f88e
mov rbx, qword [rax]
mov r14, qword [rax + 8]
mov r15, qword [rax + 0x10]
mov edx, 8
mov rcx, rax
call fcn.1400086c0
cmp rbx, r12
je 0x14002f88e
mov rcx, rsi
mov rdx, r15
call fcn.140031644
mov r13, qword [rsp + 0x130]
imul rcx, r13, 0x90
add rcx, qword [rsp + 0x128]
imul r8, r15, 0x90
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
add r13, r15
mov qword [rsp + 0x130], r13
mov rcx, r14
xor edx, edx
call fcn.1400316fe
mov rcx, rbx
mov rdx, r14
call fcn.14003224b
jmp 0x14002f811
lea rcx, [rsp + 0x370]
call fcn.1400352ab
mov rdi, qword [rsp + 0x120]
mov rsi, qword [rsp + 0x128]
mov rbx, qword [rsp + 0x130]
jmp 0x14002f93f
cmp byte [rax + 3], 0
je 0x14002f97f
mov rax, qword [rsp + 0x48]
imul rdi, qword [rax + 0xb8], 0x90
mov rbx, qword [rax + 0xb0]
xor r14d, r14d
lea rsi, [rsp + 0x370]
mov r15, rbx
cmp rdi, r14
je 0x14002f97f
cmp qword [r15 + 0x78], 0
je 0x14002f926
and qword [rsp + 0x370], 0
mov rcx, qword [rbx + r14 + 0x50]
xor edx, edx
xor r8d, r8d
mov r9, rsi
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x14002f926
mov rax, qword [rsp + 0x370]
mov qword [rbx + r14 + 0x80], rax
add r15, 0x90
add r14, 0x90
jmp 0x14002f8e7
mov esi, 8
xor edi, edi
xor ebx, ebx
mov r14, qword [rsp + 0x48]
mov rcx, qword [r14 + 0xb0]
mov rdx, qword [r14 + 0xb8]
call fcn.1400316fe
mov rcx, qword [r14 + 0xa8]
mov rdx, qword [r14 + 0xb0]
call fcn.14003224b
mov qword [r14 + 0xa8], rdi
mov qword [r14 + 0xb0], rsi
mov qword [r14 + 0xb8], rbx
mov rax, qword [rsp + 0x78]
cmp byte [rax + 7], 0
je 0x140030052
lea rbp, [rsp + 0x1c8]
and qword [rbp], 0
mov qword [rbp + 8], 8
and qword [rbp + 0x10], 0
lea rax, [rsp + 0x1b4]
and dword [rax], 0
lea r14, [rsp + 0x388]
lea rdi, [rsp + 0x338]
movabs r13, 0x8000000000000000
and qword [rsp + 0xa0], 0
and dword [rsp + 0xac], 0
and dword [rsp + 0x74], 0
lea rax, [rsp + 0x1b4]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x74]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xac]
mov qword [rsp + 0x28], rax
or dword [rsp + 0x20], 0xffffffff
xor ecx, ecx
xor edx, edx
mov r8d, 2
lea r9, [rsp + 0xa0]
call sub.netapi32.dll_NetUserEnum
test eax, eax
je 0x14002fa32
cmp eax, 0xea
jne 0x14002fd7c
mov dword [rsp + 0x78], eax
mov rbx, qword [rsp + 0xa0]
mov eax, dword [rsp + 0xac]
lea r15, [rbx + rax*8]
cmp rbx, r15
je 0x14002fd60
mov r12, rbx
add rbx, 8
mov rsi, qword [r12]
test rsi, rsi
je 0x14002fa49
and qword [rsp + 0x338], 0
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x17
mov r9, rdi
call sub.netapi32.dll_NetUserGetInfo
test eax, eax
jne 0x14002fd45
mov rax, qword [rsp + 0x338]
mov rdx, qword [rax + 0x20]
lea rcx, [rsp + 0xe8]
call fcn.140035b6e
mov rdi, qword [rsp + 0xe8]
cmp rdi, r13
je 0x14002fd3d
mov rdx, qword [rsp + 0xf0]
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x370]
mov qword [rsp + 0x50], rdx
call fcn.140035c6d
cmp qword [rsp + 0x370], r13
jne 0x14002faf4
mov rdx, qword [r12]
lea rcx, [rsp + 0xb0]
call fcn.140036f7a
jmp 0x14002fb14
mov rax, qword [rsp + 0x380]
mov qword [rsp + 0xc0], rax
movups xmm0, xmmword [rsp + 0x370]
movaps xmmword [rsp + 0xb0], xmm0
and qword [rsp + 0x2d0], 0
and dword [rsp + 0x98], 0
and dword [rsp + 0x1a8], 0
lea rax, [rsp + 0x1a8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x98]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x2d0]
mov qword [rsp + 0x20], rax
or dword [rsp + 0x28], 0xffffffff
lea rcx, [0x140042298]
mov rdx, rsi
xor r8d, r8d
mov r9d, 1
call sub.netapi32.dll_NetUserGetLocalGroups
test eax, eax
je 0x14002fbd7
and qword [rsp + 0x120], 0
mov qword [rsp + 0x128], 8
xor r14d, r14d
mov qword [rsp + 0x130], r14
mov rcx, qword [rsp + 0x2d0]
lea rax, [rsp + 0x388]
mov qword [rax + 0x28], r14
mov r14, rax
mov rax, qword [rsp + 0x120]
mov qword [r14 + 0x18], rax
mov rax, qword [rsp + 0x128]
mov qword [r14 + 0x20], rax
test rcx, rcx
je 0x14002fceb
call sub.netapi32.dll_NetApiBufferFree
jmp 0x14002fceb
mov edx, dword [rsp + 0x98]
lea rcx, [rsp + 0x200]
call fcn.140031c35
cmp qword [rsp + 0x200], 0
mov rcx, qword [rsp + 0x208]
jne 0x14003017c
mov rax, qword [rsp + 0x210]
mov qword [rsp + 0x120], rcx
mov qword [rsp + 0x128], rax
and qword [rsp + 0x130], 0
mov r12, qword [rsp + 0x2d0]
test r12, r12
je 0x14002fcc7
mov esi, dword [rsp + 0x98]
lea rcx, [rsp + 0x120]
mov rdx, rsi
call fcn.14003160c
mov r14, qword [rsp + 0x130]
test rsi, rsi
je 0x14002fb8d
mov qword [rsp + 0x60], rdi
imul rbp, r14, 0x18
add rbp, qword [rsp + 0x128]
xor r13d, r13d
lea rdi, [rsp + 0x200]
mov rdx, qword [r12 + r13*8]
mov rcx, rdi
call fcn.140036f7a
mov rax, qword [rsp + 0x210]
mov qword [rbp + 0x10], rax
movups xmm0, xmmword [rsp + 0x200]
movups xmmword [rbp], xmm0
inc r13
add rbp, 0x18
cmp rsi, r13
jne 0x14002fc78
add r14, r13
movabs r13, 0x8000000000000000
lea rbp, [rsp + 0x1c8]
mov rdi, qword [rsp + 0x60]
jmp 0x14002fb8d
mov rax, qword [rsp + 0x130]
mov qword [r14 + 0x28], rax
mov rax, qword [rsp + 0x120]
mov qword [r14 + 0x18], rax
mov rax, qword [rsp + 0x128]
mov qword [r14 + 0x20], rax
mov qword [rsp + 0x370], rdi
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x378], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x380], rax
and dword [rsp + 0x3b8], 0
mov rax, qword [rsp + 0xc0]
mov qword [r14 + 0x10], rax
movaps xmm0, xmmword [rsp + 0xb0]
movups xmmword [r14], xmm0
mov rcx, rbp
lea rdx, [rsp + 0x370]
call fcn.140036f39
lea rdi, [rsp + 0x338]
mov rcx, qword [rsp + 0x338]
test rcx, rcx
je 0x14002fa49
call sub.netapi32.dll_NetApiBufferFree
jmp 0x14002fa49
mov rcx, qword [rsp + 0xa0]
cmp dword [rsp + 0x78], 0xea
jne 0x14002fd84
call fcn.140036f25
jmp 0x14002f9cd
mov rcx, qword [rsp + 0xa0]
call fcn.140036f25
lea rcx, [rsp + 0x2d0]
and dword [rcx], 0
lea rsi, [rsp + 0xe8]
and qword [rsi], 0
mov rdx, rsi
call sub.secur32.dll_LsaEnumerateLogonSessions
mov rcx, qword [rsi]
test eax, eax
mov rbx, qword [rsp + 0x48]
jne 0x14002ffe4
mov eax, dword [rsp + 0x2d0]
lea rbp, [rcx + rax*8]
lea rsi, [rsp + 0x120]
lea r14, [rsp + 0x370]
cmp rcx, rbp
je 0x14002ffdc
lea rdi, [rcx + 8]
and qword [rsp + 0x120], 0
mov rdx, rsi
call sub.secur32.dll_LsaGetLogonSessionData
mov rcx, qword [rsp + 0x120]
test eax, eax
je 0x14002fe07
call fcn.140036f2f
mov rcx, rdi
jmp 0x14002fdd3
test rcx, rcx
je 0x14002feb9
cmp dword [rcx + 0x40], 3
je 0x14002fdfd
movzx r12d, word [rcx + 0x10]
mov rax, qword [rcx + 0x18]
mov qword [rsp + 0x50], rax
mov rdx, qword [rcx + 0x48]
mov rcx, r14
call fcn.140035b6e
mov r15, qword [rsp + 0x370]
cmp r15, r13
je 0x14002feac
mov qword [rsp + 0x58], r12
mov r12, qword [rsp + 0x378]
mov r13, qword [rsp + 0x380]
mov rdx, qword [rsp + 0x1d0]
imul rbx, qword [rsp + 0x1d8], 0x50
test rbx, rbx
je 0x14002fec0
lea r14, [rdx + 0x50]
mov rcx, qword [rdx + 8]
mov rdx, qword [rdx + 0x10]
mov r8, r12
mov r9, r13
call fcn.140035d70
add rbx, 0xffffffffffffffb0
mov rdx, r14
test al, al
je 0x14002fe63
mov rcx, r15
mov rdx, r12
call fcn.14000bd74
mov rbx, qword [rsp + 0x48]
movabs r13, 0x8000000000000000
lea r14, [rsp + 0x370]
mov rcx, qword [rsp + 0x120]
jmp 0x14002fdfd
xor ecx, ecx
jmp 0x14002fdfd
lea rcx, [rsp + 0x200]
mov rdx, r12
call fcn.140035c6d
mov rax, qword [rsp + 0x200]
movabs r14, 0x8000000000000000
cmp rax, r14
mov rbx, qword [rsp + 0x48]
jne 0x14002ff47
mov r8, qword [rsp + 0x58]
shr r8d, 1
lea r14, [rsp + 0x370]
mov rcx, r14
mov rdx, qword [rsp + 0x50]
call fcn.140004010
mov rax, qword [rsp + 0x370]
movabs rcx, 0x8000000000000000
cmp rax, rcx
mov r8d, 0
cmove rax, r8
mov rcx, qword [rsp + 0x378]
mov edx, 1
cmove rcx, rdx
mov rdx, qword [rsp + 0x380]
cmove rdx, r8
jmp 0x14002ff5f
mov rcx, qword [rsp + 0x208]
mov rdx, qword [rsp + 0x210]
lea r14, [rsp + 0x370]
mov qword [rsp + 0x370], r15
mov qword [rsp + 0x378], r12
mov qword [rsp + 0x380], r13
and dword [rsp + 0x3b8], 0
mov qword [rsp + 0x388], rax
mov qword [rsp + 0x390], rcx
mov qword [rsp + 0x398], rdx
and qword [rsp + 0x3a0], 0
mov qword [rsp + 0x3a8], 8
and qword [rsp + 0x3b0], 0
lea rcx, [rsp + 0x1c8]
mov rdx, r14
call fcn.140036f39
mov rcx, qword [rsp + 0x120]
movabs r13, 0x8000000000000000
jmp 0x14002fdfd
mov rcx, qword [rsp + 0xe8]
mov rax, qword [rsp + 0x1d8]
mov qword [rsp + 0x380], rax
movups xmm0, xmmword [rsp + 0x1c8]
movaps xmmword [rsp + 0x370], xmm0
test rcx, rcx
je 0x14003000e
call fcn.140037070
mov rcx, qword [rbx + 0xc8]
mov rdx, qword [rbx + 0xd0]
call fcn.140031842
mov rcx, qword [rbx + 0xc0]
mov rdx, qword [rbx + 0xc8]
call fcn.140032268
mov rax, qword [rsp + 0x380]
mov qword [rbx + 0xd0], rax
movaps xmm0, xmmword [rsp + 0x370]
movups xmmword [rbx + 0xc0], xmm0
movaps xmm6, xmmword [rsp + 0x910]
movaps xmm7, xmmword [rsp + 0x920]
movaps xmm8, xmmword [rsp + 0x930]
add rsp, 0x948
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x200], rcx
mov qword [rsp + 0x208], r15
mov qword [rsp + 0x210], r14
jmp 0x14002ecf0
movss xmm6, dword [rsp + 0x200]
movd xmm7, dword [rsp + 0x208]
lea rsi, [rsp + 0x3a8]
lea rdx, str.Computer
mov ebx, 8
mov r8d, 8
mov rcx, rsi
call fcn.14003025f
movss dword [rsi + 0x20], xmm6
movss dword [rsi + 0x24], xmm6
mov dword [rsi + 0x18], edi
movd dword [rsi + 0x1c], xmm7
movups xmm0, xmmword [rsp + 0x338]
movups xmm1, xmmword [rsp + 0x348]
movups xmm2, xmmword [rsp + 0x358]
movaps xmmword [rsi - 0x38], xmm0
movaps xmmword [rsi - 0x28], xmm1
movaps xmmword [rsi - 0x18], xmm2
mov rax, qword [rsp + 0x368]
mov qword [rsi - 8], rax
mov r14, qword [rsi - 0x38]
lea rsi, [rsp + 0x378]
lea rdi, [rsp + 0x8b8]
mov ecx, 0xb
rep movsq qword [rdi], qword [rsi]
cmp r14, 3
je 0x14002db55
mov ecx, 0x60
call fcn.14003554f
test rax, rax
je 0x140030225
mov rbx, rax
mov qword [rax], r14
mov rdi, rax
add rdi, 8
lea rsi, [rsp + 0x8b8]
mov ecx, 0xb
rep movsq qword [rdi], qword [rsi]
mov esi, 1
jmp 0x14002db57
call fcn.14003886a
jmp 0x14002d6d9
mov rdx, qword [rsp + 0x210]
call fcn.140037df0
lea rcx, str.key_used_disappeared
lea r8, [0x1400417a0]
mov edx, 0x14
call fcn.140038370
mov rdx, qword [rsp + 0x210]
mov rcx, qword [rsp + 0x58]
call fcn.140037df0
mov ecx, 2
mov edx, 0x14
call fcn.140037e10
lea rax, str.C:UsersTest.cargo_registry_srcindex.crates.io_6f17d22bba15001f_sysinfo_0.29.11_srcwindows_network.rs
mov edx, 0x101
mov rcx, r8
mov r8, rax
call fcn.140037ff0
mov rdx, qword [rsp + 0x380]
call fcn.140037df0
mov ecx, 8
mov edx, 0xfa0
call fcn.140037df0
lea rcx, str.assertion_failed:_vec.capacity_____start___lenC:UsersTest.cargo_registry_srcindex.crates.io_6f17d22bba15001f_rayon_1.10.0_src_vec.rs
lea r8, [0x140042250]
mov edx, 0x2f
call fcn.140038060
lea rcx, str.global_key_idle_disappearedC:UsersTest.cargo_registry_srcindex.crates.io_6f17d22bba15001f_sysinfo_0.29.11_srcwindows_system.rs
lea r8, [0x140041770]
mov edx, 0x1b
call fcn.140038370
mov ecx, 8
mov edx, 0x60
call fcn.140037e10
int3