Function at 0x1400090bd
Capabilities:
Get disk information
Get local ipv4 addresses
Get logon sessions
Get memory capacity
List groups for user account
List user accounts

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x538
movaps xmmword [rsp + 0x520], xmm9
movaps xmmword [rsp + 0x510], xmm8
movaps xmmword [rsp + 0x500], xmm7
movaps xmmword [rsp + 0x4f0], xmm6
mov qword [rsp + 0x2b8], rcx
xor ecx, ecx
call fcn.140161ad8
test rax, rax
je 0x14000b194
movabs rdi, 0x8000000000000000
mov r12, qword [rax]
mov r13, qword [rax + 8]
lea rcx, [r12 + 1]
mov qword [rax], rcx
lea rsi, [rsp + 0x330]
mov edx, 0x158
mov r8d, 0x1f4
mov rcx, rsi
call fcn.14000bf1f
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x4e0], xmm1
movaps xmmword [rsp + 0x4d0], xmm0
lea rdx, [0x140311eab]
lea rsi, [rsp + 0xb0]
mov r8d, 9
mov rcx, rsi
call fcn.14001cc8e
and qword [rsi + 0x18], 0
mov eax, 1
mov qword [rsi + 0x20], rax
xorps xmm8, xmm8
movups xmmword [rsi + 0x28], xmm8
mov qword [rsi + 0x38], rax
and qword [rsi + 0x40], 0
mov qword [rsi + 0x48], rdi
and qword [rsi + 0x60], 0
and dword [rsi + 0x68], 0
and qword [rsi + 0x70], 0
mov qword [rsi + 0x78], 8
and qword [rsi + 0x80], 0
mov byte [rsi + 0x88], 0
mov ecx, 2
mov edx, 8
mov r8d, 0x90
call fcn.14015b4cd
mov rsi, rax
mov rdi, rdx
lea rcx, [0x14015fee1]
call fcn.14005e54a
mov rbx, rax
mov r14, rdx
call fcn.140157400
mov r8d, edx
lea r15, [rsp + 0x330]
mov rcx, r15
mov edx, eax
call fcn.140157430
test byte [r15], 1
je 0x14000920c
xor ebp, ebp
jmp 0x14000922d
mov rbp, qword [rsp + 0x338]
call sub.kernel32.dll_GetTickCount64
xor ecx, ecx
mov r8d, 0x3e8
xor edx, edx
div r8
sub rbp, rax
cmovb rbp, rcx
movaps xmm0, xmmword [rsp + 0x4d0]
movaps xmm1, xmmword [rsp + 0x4e0]
lea r15, [rsp + 0x330]
movups xmmword [r15 + 0xd8], xmm0
movups xmmword [r15 + 0xe8], xmm1
mov qword [r15 + 0xf8], r12
mov qword [r15 + 0x100], r13
movups xmmword [r15 + 0x138], xmm8
movups xmmword [r15 + 0x148], xmm8
lea r12, [rsp + 0xb0]
mov r8d, 0x90
mov rcx, r15
mov rdx, r12
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
and qword [r15 + 0x90], 0
mov eax, 8
mov qword [r15 + 0x98], rax
and qword [r15 + 0xa0], 0
mov qword [r15 + 0xa8], rsi
mov qword [r15 + 0xb0], rdi
movups xmmword [r15 + 0xb8], xmm8
and qword [r15 + 0x158], 0
movdqu xmm6, xmmword [0x1403128c0]
movdqu xmmword [r15 + 0x108], xmm6
movdqu xmm7, xmmword [0x1403128d0]
movdqu xmmword [r15 + 0x118], xmm7
mov qword [r15 + 0x128], rbx
mov qword [r15 + 0x130], r14
mov qword [r15 + 0x198], rbp
mov qword [r15 + 0xc8], rax
and qword [r15 + 0xd0], 0
lea rdi, [rsp + 0x1a0]
movaps xmmword [rdi], xmm8
movaps xmmword [rdi + 0x30], xmm8
movaps xmmword [rdi + 0x20], xmm8
movaps xmmword [rdi + 0x10], xmm8
mov dword [rdi], 0x40
mov rcx, rdi
call sub.kernel32.dll_GlobalMemoryStatusEx
movups xmm0, xmmword [rdi + 8]
movups xmmword [r15 + 0x138], xmm0
movaps xmmword [r12 + 0x50], xmm8
movaps xmmword [r12 + 0x40], xmm8
movaps xmmword [r12 + 0x30], xmm8
movaps xmmword [r12 + 0x20], xmm8
movaps xmmword [r12 + 0x10], xmm8
movaps xmmword [r12], xmm8
and qword [r12 + 0x60], 0
lea rcx, [rsp + 0xb0]
mov edx, 0x68
call sub.psapi.dll_GetPerformanceInfo
cmp eax, 1
jne 0x1400093e0
mov rdx, qword [rsp + 0xc0]
mov r9, qword [rsp + 0xd0]
xor r10d, r10d
sub rdx, r9
cmovb rdx, r10
mov rcx, qword [rsp + 0x100]
mov rax, rcx
mul rdx
mov r8, rax
mov r11, 0xffffffffffffffff
cmovo r8, r11
mov rdx, qword [rsp + 0xb8]
sub rdx, r9
cmovb rdx, r10
mov rax, rcx
mul rdx
cmovo rax, r11
mov qword [rsp + 0x478], r8
mov qword [rsp + 0x480], rax
lea r15, [rsp + 0x488]
cmp qword [r15], 0
movabs rbp, 0x8000000000000000
je 0x140009510
mov rcx, qword [rsp + 0x4b8]
call sub.pdh.dll_PdhCollectQueryData
cmp qword [rsp + 0x378], rbp
je 0x140009440
lea rdx, [rsp + 0x378]
mov rcx, r15
call fcn.140161971
test al, 1
je 0x14000b1c0
movss xmm1, dword [0x1402390e8]
subss xmm1, xmm0
movss dword [rsp + 0x398], xmm1
lea rcx, [rsp + 0x330]
mov dl, 1
call fcn.14016194f
mov rdi, rax
mov rbx, rdx
add rdi, 0x48
movss xmm8, dword [0x1402390e8]
lea rax, [rdi - 0x48]
cmp rax, rbx
je 0x140009496
cmp qword [rdi], rbp
je 0x140009490
mov rcx, r15
mov rdx, rdi
call fcn.140161971
test al, 1
je 0x14000b165
movaps xmm1, xmm8
subss xmm1, xmm0
movss dword [rdi + 0x20], xmm1
add rdi, 0x70
jmp 0x140009462
cmp byte [rsp + 0x3b8], 0
jne 0x140009782
mov rsi, qword [rsp + 0x3b0]
lea rdi, [rsp + 0xb0]
mov rcx, rdi
mov rdx, rsi
call fcn.140160dc0
mov rbx, qword [rsp + 0x3a8]
mov rcx, qword [rdi]
mov rdx, qword [rdi + 8]
mov rax, qword [rdi + 0x10]
shl rax, 3
imul r8, rsi, 0x70
xor r9d, r9d
mov r10, rbx
test r8, r8
je 0x140009500
cmp rax, r9
je 0x140009500
mov r11, qword [rdx + r9]
mov qword [r10 + 0x60], r11
add r10, 0x70
add r9, 8
add r8, 0xffffffffffffff90
jmp 0x1400094e0
call fcn.140162ea6
test rsi, rsi
je 0x14000952b
mov rax, qword [rbx + 0x60]
jmp 0x14000952d
lea r8, [rsp + 0xb0]
and qword [r8], 0
xor ecx, ecx
xor edx, edx
call sub.pdh.dll_PdhOpenQueryA
test eax, eax
je 0x140009542
jmp 0x140009570
xor eax, eax
mov qword [rsp + 0x390], rax
mov byte [rsp + 0x3b8], 1
jmp 0x140009782
mov rsi, qword [rsp + 0xb0]
lea rcx, [0x14015fee1]
call fcn.14005e54a
mov r14, rax
mov rbx, rdx
lea rax, [0x1403128b0]
mov qword [rsp + 0x1a0], rax
lea rdi, [rsp + 0x70]
and qword [rdi], 0
cmp qword [rsp + 0x488], 0
je 0x14000958f
mov rcx, r15
call fcn.14016157f
mov rcx, r15
call fcn.14015f486
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x488], rax
and qword [rsp + 0x4a0], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x490], xmm0
mov qword [rsp + 0x4a8], r14
mov qword [rsp + 0x4b0], rbx
mov qword [rsp + 0x4b8], rsi
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x4c0], rcx
test rax, rax
je 0x140009782
lea rdx, str.Processor__Total___Idle_Timetot_0Processor____Idle_Time
lea rdi, [rsp + 0x1a0]
mov r8d, 0x1e
mov rcx, rdi
call fcn.14001cc8e
lea r14, [rsp + 0x378]
lea rdx, [0x14031238e]
lea rsi, [rsp + 0xb0]
mov r8d, 5
mov rcx, rsi
call fcn.14001cc8e
mov rcx, rdi
mov rdx, r15
mov r8, r14
mov r9, rsi
call fcn.140161615
lea rcx, [rsp + 0x330]
mov dl, 1
call fcn.14016194f
mov r14, rax
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x40], 0
mov ebp, 2
mov r12d, 1
cmp r14, qword [rsp + 0x48]
je 0x140009761
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0x200], rax
inc rax
mov qword [rsp + 0x40], rax
lea rax, [0x1403123b0]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rbp
and qword [rsp + 0xd0], 0
lea rsi, [rsp + 0x200]
mov qword [rsp + 0x1a0], rsi
lea rbx, [fcn.14003f020]
mov qword [rsp + 0x1a8], rbx
lea r13, [rsp + 0x1a0]
mov qword [rsp + 0xc0], r13
mov qword [rsp + 0xc8], r12
lea rdi, [rsp + 0x70]
mov rcx, rdi
lea r15, [rsp + 0xb0]
mov rdx, r15
call fcn.14015b568
lea rax, [0x1403123d8]
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rbp
and qword [rsp + 0xd0], 0
mov qword [rsp + 0x160], rsi
mov qword [rsp + 0x168], rbx
lea rax, [rsp + 0x160]
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xc8], r12
mov rcx, r13
mov rdx, r15
call fcn.14015b568
lea r8, [r14 + 0x48]
mov rcx, rdi
lea rdx, [rsp + 0x488]
mov r9, r13
call fcn.140161615
add r14, 0x70
jmp 0x14000965f
cmp qword [rsp + 0x488], 0
movabs rbp, 0x8000000000000000
lea r15, [rsp + 0x488]
jne 0x1400093fc
lea rsi, [rsp + 0x1a0]
mov rcx, rsi
call fcn.14016104d
cmp dword [rsi], 2
je 0x140009981
mov rax, qword [rsp + 0x1d0]
lea rdx, [rsp + 0xb0]
mov qword [rdx + 0x30], rax
movups xmm0, xmmword [rsp + 0x1a0]
movups xmm1, xmmword [rsp + 0x1b0]
movups xmm2, xmmword [rsp + 0x1c0]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0x70]
mov rcx, rsi
call fcn.140161079
cmp qword [rsi], 2
je 0x140009981
mov rax, qword [rsp + 0xa0]
lea rdx, [rsp + 0xb0]
mov qword [rdx + 0x30], rax
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rsp + 0x80]
movups xmm2, xmmword [rsp + 0x90]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0x160]
mov rcx, rsi
call fcn.1401610f3
cmp qword [rsi], 2
je 0x140009981
mov rax, qword [rsp + 0x190]
lea rdx, [rsp + 0xb0]
mov qword [rdx + 0x30], rax
movups xmm0, xmmword [rsp + 0x160]
movups xmm1, xmmword [rsp + 0x170]
movups xmm2, xmmword [rsp + 0x180]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0x200]
mov rcx, rsi
call fcn.140161189
cmp qword [rsi], 2
je 0x140009981
mov rax, qword [rsp + 0x230]
lea rdx, [rsp + 0xb0]
mov qword [rdx + 0x30], rax
movups xmm0, xmmword [rsp + 0x200]
movups xmm1, xmmword [rsp + 0x210]
movups xmm2, xmmword [rsp + 0x220]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0x250]
mov rcx, rsi
call fcn.140161252
cmp qword [rsi], 2
je 0x140009981
mov rax, qword [rsp + 0x280]
lea rdx, [rsp + 0xb0]
mov qword [rdx + 0x30], rax
movups xmm0, xmmword [rsp + 0x250]
movups xmm1, xmmword [rsp + 0x260]
movups xmm2, xmmword [rsp + 0x270]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0x2f8]
mov rcx, rsi
call fcn.1401612ce
mov rax, qword [rsi]
cmp rax, 2
je 0x140009981
movups xmm0, xmmword [rsp + 0x300]
movups xmm1, xmmword [rsp + 0x310]
movups xmm2, xmmword [rsp + 0x320]
lea rdx, [rsp + 0x2c0]
movups xmmword [rdx + 0x28], xmm2
movups xmmword [rdx + 0x18], xmm1
movups xmmword [rdx + 8], xmm0
mov qword [rdx], rax
lea rsi, [rsp + 0x70]
mov rcx, rsi
mov r8b, 1
call fcn.1401613ac
mov edi, dword [rsi + 4]
cmp edi, 2
jne 0x14000b097
lea rcx, [rsp + 0x2c0]
call fcn.14015f3b9
mov ebx, 8
xor esi, esi
mov rcx, qword [rsp + 0x3c8]
mov rdx, qword [rsp + 0x3d0]
call fcn.14015f37b
mov rcx, qword [rsp + 0x3c0]
mov rdx, qword [rsp + 0x3c8]
call fcn.14015f464
mov qword [rsp + 0x3c0], rsi
mov qword [rsp + 0x3c8], rbx
mov qword [rsp + 0x3d0], rsi
lea rcx, [rsp + 0x160]
and qword [rcx], 0
call sub.iphlpapi.dll_GetIfTable2
test eax, eax
jne 0x14000a78b
lea r8, [rsp + 0x458]
mov rax, qword [r8 - 0x20]
mov rcx, qword [r8 - 0x18]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [r8 - 8]
lea rsi, [rsp + 0xb0]
mov qword [rsi], rax
add rax, 0x10
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov word [rsi + 0x18], dx
mov qword [rsi + 0x20], r8
mov rcx, rsi
call fcn.14015f599
test rax, rax
je 0x140009a39
mov byte [rdx + 0x6e], 0
jmp 0x140009a26
lea rcx, [0x14015fee1]
call fcn.14005e54a
lea rcx, [rsp + 0xd0]
movdqa xmmword [rcx - 0x20], xmm6
movdqa xmmword [rcx - 0x10], xmm7
mov qword [rcx], rax
mov qword [rcx + 8], rdx
lea rax, [rsp + 0x70]
and qword [rax], 0
mov qword [rax + 8], 8
and qword [rax + 0x10], 0
mov rax, qword [rsp + 0x160]
lea rcx, [rax + 8]
mov qword [rsp + 0x1f8], rax
mov edi, dword [rax]
xor ebx, ebx
pcmpeqd xmm6, xmm6
mov qword [rsp + 0x148], rcx
mov qword [rsp + 0x60], rdi
cmp rbx, rdi
je 0x140009dad
mov rdx, rbx
inc rbx
imul rax, rdx, 0x548
lea rsi, [rcx + rax]
cmp qword [rcx + rax + 0x4a8], 0
jne 0x140009acc
cmp qword [rsi + 0x4b0], 0
je 0x140009a9d
cmp dword [rsi + 0x48c], 2
je 0x140009a9d
cmp dword [rsi + 0x420], 0
je 0x140009a9d
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x40], rbx
mov ecx, 0x14
mov edx, 2
call fcn.14015b7bf
mov ebx, dword [rsi + 0x10]
movzx ecx, byte [rsi + 0x14]
movzx edx, byte [rsi + 0x15]
movzx r8d, byte [rsi + 0x16]
movzx r9d, byte [rsi + 0x17]
movzx r10d, byte [rsi + 0x18]
movzx r11d, byte [rsi + 0x19]
movzx edi, byte [rsi + 0x1a]
movzx esi, byte [rsi + 0x1b]
mov dword [rax], ebx
mov word [rax + 4], cx
mov word [rax + 6], dx
mov word [rax + 8], r8w
mov word [rax + 0xa], r9w
mov word [rax + 0xc], r10w
mov word [rax + 0xe], r11w
mov word [rax + 0x10], di
mov word [rax + 0x12], si
mov r8d, 0xa
lea rcx, [rsp + 0x1a0]
mov qword [rsp + 0x48], rax
mov rdx, rax
call fcn.14015b47a
mov rcx, qword [rsp + 0xd0]
mov rdx, qword [rsp + 0xd8]
mov rsi, qword [rsp + 0x1a8]
mov r15, qword [rsp + 0x1b0]
mov r8, rsi
mov r9, r15
call fcn.14015f0ae
mov rbp, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xb8]
mov rdi, rbx
and rdi, rax
mov qword [rsp + 0x140], rax
shr rax, 0x39
mov qword [rsp + 0x58], rax
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor r14d, r14d
movdqu xmm8, xmmword [rbp + rdi]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb r13d, xmm0
test r13w, r13w
je 0x140009c1a
bsf eax, r13d
add rax, rdi
and rax, rbx
shl rax, 5
mov r12, rbp
sub r12, rax
mov rcx, qword [r12 - 0x18]
mov rdx, qword [r12 - 0x10]
mov r8, rsi
mov r9, r15
call fcn.14015f144
test al, al
jne 0x140009c3c
lea eax, [r13 - 1]
and eax, r13d
mov r13d, eax
jmp 0x140009bdb
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x140009ce9
add rdi, r14
add rdi, 0x10
add r14, 0x10
and rdi, rbx
jmp 0x140009bc6
mov rcx, qword [rsp + 0x1a0]
mov rdx, rsi
call fcn.1400d9c17
movabs rbp, 0x8000000000000000
mov rbx, qword [rsp + 0x40]
mov rdi, qword [rsp + 0x60]
mov r15, qword [rsp + 0x48]
mov eax, dword [r12 - 8]
inc eax
mov dword [r12 - 8], eax
cmp eax, 1
jle 0x140009c90
mov ecx, 0xa
mov rdx, r15
call fcn.1400d9c17
mov rcx, qword [rsp + 0x148]
jmp 0x140009a9d
mov rsi, qword [rsp + 0x80]
cmp rsi, qword [rsp + 0x70]
jne 0x140009ca9
lea rcx, [rsp + 0x70]
call fcn.140090b45
mov rax, qword [rsp + 0x78]
mov rcx, rsi
shl rcx, 5
mov rdx, qword [rsp + 0x68]
mov dword [rax + rcx], edx
mov edx, 0xa
mov qword [rax + rcx + 8], rdx
mov qword [rax + rcx + 0x10], r15
mov qword [rax + rcx + 0x18], rdx
inc rsi
mov qword [rsp + 0x80], rsi
mov rcx, qword [rsp + 0x148]
jmp 0x140009a9d
cmp qword [rsp + 0xc0], 0
je 0x140009d93
mov rdi, qword [rsp + 0x1a0]
movabs rbp, 0x8000000000000000
cmp rdi, rbp
mov rbx, qword [rsp + 0x40]
jne 0x140009d1c
mov r12, rsi
jmp 0x140009c5b
mov r14, qword [rsp + 0xb0]
mov r12, qword [rsp + 0xb8]
mov rcx, r14
mov rdx, r12
mov r8, qword [rsp + 0x140]
call fcn.14000beb2
movzx ecx, byte [r14 + rax]
lea rdx, [rax - 0x10]
and rdx, r12
mov r8, qword [rsp + 0x58]
mov byte [r14 + rax], r8b
mov byte [r14 + rdx + 0x10], r8b
shl rax, 5
mov r12, r14
and ecx, 1
sub qword [rsp + 0xc0], rcx
sub r12, rax
neg rax
mov qword [r14 + rax - 0x20], rdi
mov qword [r12 - 0x18], rsi
mov qword [r12 - 0x10], r15
and dword [r12 - 8], 0
inc qword [rsp + 0xc8]
jmp 0x140009c5b
lea rcx, [rsp + 0xb0]
lea rdx, [rsp + 0xd0]
call fcn.14015f7f7
jmp 0x140009cf8
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x2a0], rax
mov rax, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
shl rdi, 5
add rdi, rax
add qword [rsp + 0x1f8], 0x24
pcmpeqd xmm6, xmm6
mov qword [rsp + 0x298], rax
mov r13, rax
mov qword [rsp + 0x60], rdi
mov rsi, r13
cmp r13, rdi
je 0x14000a2fb
lea r13, [rsi + 0x20]
mov r14, qword [rsi + 8]
cmp r14, rbp
je 0x14000a2f8
mov rbx, qword [rsi + 0x10]
mov edx, dword [rsi]
cmp qword [rsp + 0xc8], 0
je 0x140009f2c
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x48], r13
mov rsi, qword [rsi + 0x18]
mov rcx, qword [rsp + 0xd0]
mov rdx, qword [rsp + 0xd8]
mov r8, rbx
mov r9, rsi
call fcn.14015f0ae
mov r12, qword [rsp + 0xb0]
mov r15, qword [rsp + 0xb8]
mov rbp, r15
and rbp, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor r13d, r13d
movdqu xmm8, xmmword [r12 + rbp]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb r14d, xmm0
test r14w, r14w
je 0x140009ece
bsf edi, r14d
add rdi, rbp
and rdi, r15
mov rax, rdi
shl rax, 5
mov rcx, r12
sub rcx, rax
mov r8, qword [rcx - 0x18]
mov r9, qword [rcx - 0x10]
mov rcx, rbx
mov rdx, rsi
call fcn.14015f144
test al, al
jne 0x140009eec
lea eax, [r14 - 1]
and eax, r14d
mov r14d, eax
jmp 0x140009e8e
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x140009eec
add rbp, r13
add rbp, 0x10
add r13, 0x10
and rbp, r15
jmp 0x140009e7a
shl rdi, 5
sub r12, rdi
test r14w, r14w
mov eax, 0
cmove r12, rax
add r12, 0xffffffffffffffe0
test r14w, r14w
cmove r12, rax
movabs rbp, 0x8000000000000000
mov rdi, qword [rsp + 0x60]
mov r13, qword [rsp + 0x48]
mov r14, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x40]
jmp 0x140009f2f
xor r12d, r12d
lea rax, [r12 + 0x18]
test r12, r12
lea rcx, [0x140312000]
cmove rax, rcx
cmp dword [rax], 1
jg 0x14000a175
imul rax, rdx, 0x548
mov rcx, qword [rsp + 0x148]
lea rsi, [rcx + rax]
lea rdx, [rsi + 0x1c]
add rax, qword [rsp + 0x1f8]
mov ecx, 0x202
xor r8d, r8d
test rcx, rcx
je 0x140009f88
cmp word [rax + r8*2], 0
je 0x140009f90
inc r8
add rcx, 0xfffffffffffffffe
jmp 0x140009f72
mov r8d, 0x101
jmp 0x140009f9d
cmp r8, 0x102
jae 0x14000b17d
lea rcx, [rsp + 0x1a0]
call fcn.14003c8c0
mov rax, qword [rsp + 0x1a0]
cmp rax, rbp
je 0x14000a175
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x68], r14
mov qword [rsp + 0x48], r13
mov r8, qword [rsp + 0x1a8]
mov r9, qword [rsp + 0x1b0]
mov rcx, qword [rsp + 0x458]
mov rdx, qword [rsp + 0x460]
mov qword [rsp + 0x40], r8
mov r12, r9
call fcn.14015f018
mov r15, qword [rsp + 0x438]
mov r14, qword [rsp + 0x440]
mov rdi, r14
and rdi, rax
mov qword [rsp + 0x2a8], rax
shr rax, 0x39
mov qword [rsp + 0x2b0], rax
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor esi, esi
movdqu xmm8, xmmword [r15 + rdi]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb ebp, xmm0
test bp, bp
je 0x14000a08c
bsf eax, ebp
add rax, rdi
and rax, r14
neg rax
imul r13, rax, 0x88
mov rcx, qword [r15 + r13 - 0x80]
mov rdx, qword [r15 + r13 - 0x78]
mov r8, qword [rsp + 0x40]
mov r9, r12
call fcn.14003e713
test al, al
jne 0x14000a0ae
lea eax, [rbp - 1]
and eax, ebp
mov ebp, eax
jmp 0x14000a050
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x14000a185
add rdi, rsi
add rdi, 0x10
add rsi, 0x10
and rdi, r14
jmp 0x14000a03d
add r15, r13
mov rcx, qword [rsp + 0x140]
mov rdx, qword [rsp + 0x40]
call fcn.14005068f
mov rax, qword [r15 - 0x68]
mov rcx, qword [r15 - 0x58]
mov qword [r15 - 0x60], rax
mov rdx, qword [rsp + 0x58]
mov rax, qword [rdx + 0x500]
mov qword [r15 - 0x68], rax
mov qword [r15 - 0x50], rcx
mov rax, qword [rdx + 0x4b8]
mov qword [r15 - 0x58], rax
mov rax, qword [r15 - 0x48]
mov qword [r15 - 0x40], rax
mov rax, qword [rdx + 0x4c0]
add rax, qword [rdx + 0x4c8]
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov qword [r15 - 0x48], rax
mov rax, qword [r15 - 0x38]
mov qword [r15 - 0x30], rax
mov rax, qword [rdx + 0x508]
add rax, qword [rdx + 0x510]
cmovb rax, rcx
mov qword [r15 - 0x38], rax
mov rax, qword [r15 - 0x28]
mov qword [r15 - 0x20], rax
mov rax, qword [rdx + 0x4d8]
mov qword [r15 - 0x28], rax
mov rax, qword [r15 - 0x18]
mov qword [r15 - 0x10], rax
mov rax, qword [rdx + 0x520]
mov qword [r15 - 0x18], rax
mov byte [r15 - 2], 1
movabs rbp, 0x8000000000000000
mov rdi, qword [rsp + 0x60]
mov r13, qword [rsp + 0x48]
mov r14, qword [rsp + 0x68]
mov rcx, r14
mov rdx, rbx
call fcn.1400d9c17
jmp 0x140009deb
cmp qword [rsp + 0x448], 0
je 0x14000a2de
mov rcx, qword [rsp + 0x58]
mov rdi, qword [rcx + 0x4c0]
add rdi, qword [rcx + 0x4c8]
mov rax, 0xffffffffffffffff
cmovb rdi, rax
mov r14, qword [rcx + 0x508]
add r14, qword [rcx + 0x510]
cmovb r14, rax
mov rax, qword [rcx]
mov qword [rsp + 0x288], rax
mov r15, qword [rcx + 0x500]
mov rbp, qword [rcx + 0x4b8]
mov rax, qword [rcx + 0x4d8]
mov qword [rsp + 0x290], rax
mov rax, qword [rcx + 0x520]
mov qword [rsp + 0x58], rax
mov rsi, qword [rsp + 0x438]
mov r13, qword [rsp + 0x440]
mov rcx, rsi
mov rdx, r13
mov r8, qword [rsp + 0x2a8]
call fcn.14000beb2
lea rcx, [rax - 0x10]
and rcx, r13
movzx edx, byte [rsi + rax]
mov r8, qword [rsp + 0x2b0]
mov byte [rsi + rax], r8b
mov byte [rsi + rcx + 0x10], r8b
and edx, 1
sub qword [rsp + 0x448], rdx
neg rax
imul rax, rax, 0x88
mov rcx, qword [rsp + 0x140]
mov qword [rsi + rax - 0x88], rcx
mov rcx, qword [rsp + 0x40]
mov qword [rsi + rax - 0x80], rcx
mov qword [rsi + rax - 0x78], r12
mov rcx, qword [rsp + 0x288]
mov qword [rsi + rax - 0x70], rcx
mov qword [rsi + rax - 0x68], r15
mov qword [rsi + rax - 0x60], r15
mov qword [rsi + rax - 0x58], rbp
mov qword [rsi + rax - 0x50], rbp
mov qword [rsi + rax - 0x48], rdi
mov qword [rsi + rax - 0x40], rdi
mov qword [rsi + rax - 0x38], r14
mov qword [rsi + rax - 0x30], r14
mov rcx, qword [rsp + 0x290]
mov qword [rsi + rax - 0x28], rcx
mov qword [rsi + rax - 0x20], rcx
mov rcx, qword [rsp + 0x58]
mov qword [rsi + rax - 0x18], rcx
mov qword [rsi + rax - 0x10], rcx
and dword [rsi + rax - 8], 0
and word [rsi + rax - 4], 0
mov byte [rsi + rax - 2], 1
inc qword [rsp + 0x450]
jmp 0x14000a15c
lea rcx, [rsp + 0x438]
lea rdx, [rsp + 0x458]
call fcn.14015f5cd
jmp 0x14000a194
mov rsi, r13
sub rdi, rsi
shr rdi, 5
add rsi, 0x10
sub rdi, 1
jb 0x14000a31e
mov rcx, qword [rsi - 8]
mov rdx, qword [rsi]
call fcn.1400d9c17
add rsi, 0x20
jmp 0x14000a306
mov r8d, 8
mov r9d, 0x20
mov rcx, qword [rsp + 0x2a0]
mov rdx, qword [rsp + 0x298]
call fcn.140050545
mov rcx, qword [rsp + 0x160]
call sub.iphlpapi.dll_FreeMibTable
mov rdi, qword [rsp + 0xb8]
test rdi, rdi
je 0x14000a40b
mov rsi, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xc8]
test rbx, rbx
je 0x14000a3d7
movdqa xmm0, xmmword [rsi]
pmovmskb eax, xmm0
not eax
lea r14, [rsi + 0x10]
mov ecx, 1
test rcx, rcx
je 0x14000a3cf
test ax, ax
jne 0x14000a3a7
movdqa xmm0, xmmword [r14]
pmovmskb eax, xmm0
not eax
add rsi, 0xfffffffffffffe00
add r14, 0x10
jmp 0x14000a38a
dec rbx
lea ebp, [rax - 1]
and ebp, eax
bsf eax, eax
shl eax, 5
mov rdx, rsi
sub rdx, rax
mov rcx, qword [rdx - 0x20]
mov rdx, qword [rdx - 0x18]
call fcn.1400d9c17
mov eax, ebp
mov rcx, rbx
jmp 0x14000a385
mov rsi, qword [rsp + 0xb0]
inc rdi
lea rbx, [rsp + 0x1a0]
mov edx, 0x20
mov r8d, 0x10
mov rcx, rbx
mov r9, rdi
call fcn.14000bc8c
mov rdx, qword [rbx]
mov r8, qword [rbx + 8]
sub rsi, qword [rbx + 0x10]
mov rcx, rsi
call fcn.1400072fc
mov rax, qword [rsp + 0x438]
mov rcx, qword [rsp + 0x440]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r14, qword [rsp + 0x450]
lea rsi, [rsp + 0xb0]
mov qword [rsi], rax
add rax, 0x10
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov word [rsi + 0x18], dx
mov qword [rsi + 0x20], r14
mov ebx, 0x88
test r14, r14
je 0x14000a4b7
mov rcx, rsi
call fcn.14015efa4
mov r14, qword [rsp + 0xd0]
dec r14
mov qword [rsp + 0xd0], r14
test rax, rax
je 0x14000a4b7
mov rdi, rax
cmp byte [rax - 2], 0
jne 0x14000a457
mov rax, qword [rsp + 0x438]
sub rax, rdi
cqo
idiv rbx
lea rcx, [rsp + 0x438]
mov rdx, rax
call fcn.1400dec58
mov rcx, qword [rdi - 0x88]
mov rdx, qword [rdi - 0x80]
call fcn.14005068f
jmp 0x14000a457
lea r12, [rsp + 0x250]
mov dword [r12], 0x3c00
and dword [rsp + 0x200], 0
mov ebp, 4
xor edi, edi
lea rsi, str.failed_to_allocate_memory_for_IP_ADAPTER_ADDRESSESGetAdaptersAddresses___failed_with_code
lea rbx, [rsp + 0xb0]
dec ebp
je 0x14000a5a3
mov edx, dword [rsp + 0x250]
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
mov r14, rax
mov r15, rax
test rax, rax
jne 0x14000a54b
mov r8d, 0x32
mov rcx, rbx
mov rdx, rsi
call fcn.14001cc8e
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, qword [rsp + 0xb0]
mov r15, qword [rsp + 0xb8]
mov r14, qword [rsp + 0xc0]
movabs rax, 0x8000000000000000
cmp rcx, rax
jne 0x14000b070
mov qword [rsp + 0x20], r12
xor ecx, ecx
mov edx, 0xe
xor r8d, r8d
mov r9, r15
call sub.iphlpapi.dll_GetAdaptersAddresses
mov dword [rsp + 0x200], eax
mov rdi, r15
cmp eax, 0x6f
je 0x14000a4e5
test eax, eax
jne 0x14000a5a0
mov qword [rsp + 0x1a8], r15
mov qword [rsp + 0x1b0], r14
movabs rbp, 0x8000000000000000
mov qword [rsp + 0x1a0], rbp
mov rcx, rbp
jmp 0x14000a60e
mov rdi, r15
movabs rbp, 0x8000000000000000
lea rax, [rsp + 0x200]
mov qword [rsp + 0x70], rax
lea rax, [0x140312568]
lea rdx, [rsp + 0xb0]
mov qword [rdx], rax
mov eax, 1
mov qword [rdx + 8], rax
and qword [rdx + 0x20], 0
lea rcx, [0x140040280]
mov qword [rsp + 0x78], rcx
lea rcx, [rsp + 0x70]
mov qword [rdx + 0x10], rcx
mov qword [rdx + 0x18], rax
lea rsi, [rsp + 0x1a0]
mov rcx, rsi
call fcn.14015b568
mov rcx, rdi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rcx, qword [rsi]
mov rdx, qword [rsp + 0x1a8]
cmp rcx, rbp
jne 0x14000a77a
mov rax, qword [rsp + 0x1b0]
lea rcx, [rsp + 0x70]
mov qword [rcx], rdx
mov qword [rcx + 8], rax
pcmpeqd xmm6, xmm6
lea rcx, [rsp + 0xb0]
lea rdx, [rsp + 0x70]
call fcn.140160ecc
mov rbx, qword [rsp + 0xb0]
cmp rbx, rbp
je 0x14000a781
mov r14, qword [rsp + 0xb8]
cmp qword [rsp + 0x450], 0
je 0x14000a760
mov r15, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x458]
mov rdx, qword [rsp + 0x460]
mov r8, r14
mov r9, r15
call fcn.14015f018
mov r13, qword [rsp + 0x438]
mov rdi, qword [rsp + 0x440]
mov rbp, rdi
and rbp, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
mov qword [rsp + 0x40], 0
movdqu xmm8, xmmword [r13 + rbp]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb r12d, xmm0
test r12w, r12w
je 0x14000a71e
bsf eax, r12d
add rax, rbp
and rax, rdi
neg rax
imul rsi, rax, 0x88
mov r8, qword [r13 + rsi - 0x80]
mov r9, qword [r13 + rsi - 0x78]
mov rcx, r14
mov rdx, r15
call fcn.14003e713
test al, al
jne 0x14000a746
lea eax, [r12 - 1]
and eax, r12d
mov r12d, eax
jmp 0x14000a6de
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x14000a760
mov rax, qword [rsp + 0x40]
add rbp, rax
add rbp, 0x10
add rax, 0x10
mov qword [rsp + 0x40], rax
and rbp, rdi
jmp 0x14000a6c9
add r13, rsi
lea rcx, [rsp + 0xc8]
movzx eax, word [rcx + 4]
mov word [r13 - 4], ax
mov eax, dword [rcx]
mov dword [r13 - 8], eax
mov rcx, rbx
mov rdx, r14
call fcn.14005068f
movabs rbp, 0x8000000000000000
jmp 0x14000a637
call fcn.14005068f
jmp 0x14000a78b
mov rcx, qword [rsp + 0x70]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
lea r15, [rsp + 0x3d8]
lea rcx, [rsp + 0x330]
mov edx, 0x10101
call fcn.14015fee6
call sub.kernel32.dll_GetLogicalDrives
mov dword [rsp + 0x250], eax
test eax, eax
je 0x14000a966
and qword [rsp + 0x160], 0
mov qword [rsp + 0x168], 8
and qword [rsp + 0x170], 0
lea rax, [rsp + 0x250]
mov qword [rsp + 0xb0], rax
movabs rax, 0x2000000000
mov qword [rsp + 0xb8], rax
mov ecx, 0x20
call fcn.14015eff5
lea rcx, [rsp + 0xb0]
mov qword [rsp + 0x38], rcx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x20
mov qword [rsp + 0x20], 1
xor ebx, ebx
lea rdi, [rsp + 0x70]
mov edx, 0x20
mov rcx, rdi
xor r8d, r8d
mov r9, rax
call fcn.14015c3da
mov rax, qword [rdi + 0x10]
sub rax, 1
jb 0x14000a85c
mov rdi, qword [rdi]
test rdi, rdi
je 0x14000a85c
add rbx, qword [rdi + 0x10]
add rdi, 0x18
jmp 0x14000a844
lea rcx, [rsp + 0x160]
mov rdx, rbx
call fcn.14015f19d
movdqu xmm0, xmmword [rsp + 0x70]
lea r13, [rsp + 0x1a8]
movdqa xmmword [r13 - 8], xmm0
mov r12, qword [rsp + 0x80]
mov qword [r13 + 8], r12
lea rbp, [rsp + 0xb8]
mov rcx, qword [r13 - 8]
lea rbx, [rsp + 0xb0]
test rcx, rcx
je 0x14000a971
mov rsi, qword [rcx + 0x18]
lea rax, [rsi + 0x20]
test rsi, rsi
cmove rax, r13
and qword [rax], 0
mov r14, qword [rcx]
movups xmm0, xmmword [rcx + 8]
movaps xmmword [rsp + 0x200], xmm0
call fcn.14015ea7e
movabs rax, 0x8000000000000000
cmp r14, rax
je 0x14000a975
mov qword [rsp + 0xb0], r14
movdqa xmm0, xmmword [rsp + 0x200]
movdqu xmmword [rbp], xmm0
mov r14, qword [rsp + 0xb8]
mov r15, qword [rsp + 0xc0]
lea rcx, [rsp + 0x160]
mov rdx, r15
call fcn.14015f19d
mov rdi, qword [rsp + 0x170]
imul rcx, rdi, 0x90
add rcx, qword [rsp + 0x168]
imul r8, r15, 0x90
mov rdx, r14
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
add rdi, r15
mov qword [rsp + 0x170], rdi
and qword [rsp + 0xc0], 0
mov rcx, rbx
call fcn.14015acdb
dec r12
mov rcx, rsi
jmp 0x14000a8a0
mov esi, 8
xor ebx, ebx
xor edi, edi
jmp 0x14000a9b6
xor esi, esi
jmp 0x14000a978
dec r12
lea rcx, [rsp + 0x1a0]
mov qword [rcx], rsi
mov qword [rcx + 0x10], r12
call fcn.14015c35e
mov rbx, qword [rsp + 0x160]
mov rsi, qword [rsp + 0x168]
mov rdi, qword [rsp + 0x170]
movabs rbp, 0x8000000000000000
lea r15, [rsp + 0x3d8]
lea r14, [rsp + 0x3f0]
mov rcx, r15
call fcn.14015acdb
mov qword [r14 - 0x18], rbx
lea rax, [rsp + 0x238]
and qword [rax], 0
mov qword [rax + 8], 8
and qword [rax + 0x10], 0
lea rax, [rsp + 0x154]
and dword [rax], 0
mov qword [r14 - 0x10], rsi
mov qword [r14 - 8], rdi
lea rdi, [rsp + 0xc8]
lea rbx, [rsp + 0x2f8]
lea r13, [rsp + 0x200]
and qword [rsp + 0x2c0], 0
and dword [rsp + 0xac], 0
and dword [rsp + 0x158], 0
lea rax, [rsp + 0x154]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x158]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xac]
mov qword [rsp + 0x28], rax
or dword [rsp + 0x20], 0xffffffff
xor ecx, ecx
xor edx, edx
mov r8d, 2
lea r9, [rsp + 0x2c0]
call sub.netapi32.dll_NetUserEnum
test eax, eax
je 0x14000aa79
cmp eax, 0xea
jne 0x14000ada2
mov dword [rsp + 0x40], eax
mov r15, qword [rsp + 0x2c0]
mov eax, dword [rsp + 0xac]
lea r14, [r15 + rax*8]
cmp r15, r14
je 0x14000ad86
mov rsi, r15
add r15, 8
mov r12, qword [rsi]
test r12, r12
je 0x14000aa90
and qword [rsp + 0x2f8], 0
xor ecx, ecx
mov rdx, r12
mov r8d, 0x17
mov r9, rbx
call sub.netapi32.dll_NetUserGetInfo
test eax, eax
jne 0x14000ad24
mov rax, qword [rsp + 0x2f8]
mov rdx, qword [rax + 0x20]
mov rcx, r13
call fcn.14015b819
cmp qword [rsp + 0x200], rbp
je 0x14000ad24
mov rdx, qword [rsp + 0x208]
lea rcx, [rsp + 0xb0]
call fcn.140160618
cmp qword [rsp + 0xb0], rbp
jne 0x14000ab1f
mov rdx, qword [rsi]
lea rcx, [rsp + 0x160]
call fcn.14015abf2
jmp 0x14000ab41
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0x170], rax
movdqu xmm0, xmmword [rsp + 0xb0]
movdqa xmmword [rsp + 0x160], xmm0
and qword [rsp + 0x250], 0
and dword [rsp + 0x54], 0
and dword [rsp + 0x15c], 0
lea rax, [rsp + 0x15c]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x250]
mov qword [rsp + 0x20], rax
or dword [rsp + 0x28], 0xffffffff
lea rcx, [0x140312508]
mov rdx, r12
xor r8d, r8d
mov r9d, 1
call sub.netapi32.dll_NetUserGetLocalGroups
test eax, eax
je 0x14000abef
and qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 8
xor r13d, r13d
mov qword [rsp + 0x80], r13
mov rcx, qword [rsp + 0x250]
mov qword [rdi + 0x28], r13
mov rax, qword [rsp + 0x70]
mov qword [rdi + 0x18], rax
mov rax, qword [rsp + 0x78]
mov qword [rdi + 0x20], rax
test rcx, rcx
lea r13, [rsp + 0x200]
je 0x14000acce
call sub.netapi32.dll_NetApiBufferFree
jmp 0x14000acce
mov ecx, dword [rsp + 0x54]
mov edx, 8
mov r8d, 0x18
call fcn.14015b4cd
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rdx
and qword [rsp + 0x80], 0
mov rdi, qword [rsp + 0x250]
test rdi, rdi
je 0x14000aca8
mov r12d, dword [rsp + 0x54]
cmp rax, r12
jb 0x14000ad56
mov rsi, rdx
xor r13d, r13d
test r12, r12
je 0x14000ad3f
imul rax, r13, 0x18
add rsi, rax
xor ebp, ebp
lea rbx, [rsp + 0x1a0]
mov rdx, qword [rdi + rbp*8]
mov rcx, rbx
call fcn.14015abf2
mov rax, qword [rsp + 0x1b0]
mov qword [rsi + 0x10], rax
movdqu xmm0, xmmword [rsp + 0x1a0]
movdqu xmmword [rsi], xmm0
inc rbp
add rsi, 0x18
cmp r12, rbp
jne 0x14000ac55
add r13, rbp
movabs rbp, 0x8000000000000000
lea rdi, [rsp + 0xc8]
lea rbx, [rsp + 0x2f8]
jmp 0x14000abae
mov rax, qword [rsp + 0x80]
lea rdi, [rsp + 0xc8]
mov qword [rdi + 0x28], rax
mov rax, qword [rsp + 0x70]
mov qword [rdi + 0x18], rax
mov rax, qword [rsp + 0x78]
mov qword [rdi + 0x20], rax
movups xmm0, xmmword [rsp + 0x200]
movaps xmmword [rsp + 0xb0], xmm0
mov rax, qword [rsp + 0x210]
mov qword [rsp + 0xc0], rax
and dword [rsp + 0xf8], 0
mov rax, qword [rsp + 0x170]
mov qword [rdi + 0x10], rax
movdqa xmm0, xmmword [rsp + 0x160]
movdqu xmmword [rdi], xmm0
lea rcx, [rsp + 0x238]
lea rdx, [rsp + 0xb0]
call fcn.140160724
mov rcx, qword [rsp + 0x2f8]
test rcx, rcx
je 0x14000aa90
call sub.netapi32.dll_NetApiBufferFree
jmp 0x14000aa90
movabs rbp, 0x8000000000000000
lea rdi, [rsp + 0xc8]
jmp 0x14000abae
mov qword [rsp + 0x20], 0x18
mov r9d, 8
lea rcx, [rsp + 0x70]
xor edx, edx
mov r8, r12
call fcn.140019b93
mov rsi, qword [rsp + 0x78]
mov r13, qword [rsp + 0x80]
jmp 0x14000ac3b
mov rcx, qword [rsp + 0x2c0]
cmp dword [rsp + 0x40], 0xea
jne 0x14000adaa
call fcn.140160604
jmp 0x14000aa0e
mov rcx, qword [rsp + 0x2c0]
call fcn.140160604
lea rcx, [rsp + 0x2f8]
and dword [rcx], 0
lea rsi, [rsp + 0x250]
and qword [rsi], 0
mov rdx, rsi
call sub.secur32.dll_LsaEnumerateLogonSessions
mov rcx, qword [rsi]
test eax, eax
jne 0x14000afcd
mov eax, dword [rsp + 0x2f8]
lea r14, [rcx + rax*8]
lea rsi, [rsp + 0x70]
lea rbx, [rsp + 0xb0]
cmp rcx, r14
je 0x14000afc5
lea rdi, [rcx + 8]
and qword [rsp + 0x70], 0
mov rdx, rsi
call sub.secur32.dll_LsaGetLogonSessionData
mov rcx, qword [rsp + 0x70]
test eax, eax
je 0x14000ae1f
call fcn.14016060e
mov rcx, rdi
jmp 0x14000adf1
test rcx, rcx
je 0x14000aec8
cmp dword [rcx + 0x40], 3
je 0x14000ae15
movzx r12d, word [rcx + 0x10]
mov r13, qword [rcx + 0x18]
mov rdx, qword [rcx + 0x48]
mov rcx, rbx
call fcn.14015b819
mov r15, qword [rsp + 0xb0]
cmp r15, rbp
je 0x14000afbb
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r12
mov r12, qword [rsp + 0xb8]
mov r13, qword [rsp + 0xc0]
mov rdx, qword [rsp + 0x240]
imul rbx, qword [rsp + 0x248], 0x50
test rbx, rbx
je 0x14000aecf
lea rbp, [rdx + 0x50]
mov rcx, qword [rdx + 8]
mov rdx, qword [rdx + 0x10]
mov r8, r12
mov r9, r13
call fcn.14003e713
add rbx, 0xffffffffffffffb0
mov rdx, rbp
movabs rbp, 0x8000000000000000
test al, al
je 0x14000ae7f
mov rcx, r15
mov rdx, r12
call fcn.14005068f
lea rbx, [rsp + 0xb0]
jmp 0x14000afbb
xor ecx, ecx
jmp 0x14000ae15
lea rcx, [rsp + 0x1a0]
mov rdx, r12
call fcn.140160618
mov rax, qword [rsp + 0x1a0]
cmp rax, rbp
jne 0x14000af3d
mov r8, qword [rsp + 0x40]
shr r8d, 1
lea rbx, [rsp + 0xb0]
mov rcx, rbx
mov rdx, qword [rsp + 0x48]
call fcn.14003c8c0
mov rax, qword [rsp + 0xb0]
cmp rax, rbp
mov r8d, 0
cmove rax, r8
mov rcx, qword [rsp + 0xb8]
mov edx, 1
cmove rcx, rdx
mov rdx, qword [rsp + 0xc0]
cmove rdx, r8
jmp 0x14000af55
mov rcx, qword [rsp + 0x1a8]
mov rdx, qword [rsp + 0x1b0]
lea rbx, [rsp + 0xb0]
mov qword [rsp + 0xb0], r15
mov qword [rsp + 0xb8], r12
mov qword [rsp + 0xc0], r13
and dword [rsp + 0xf8], 0
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0xd0], rcx
mov qword [rsp + 0xd8], rdx
and qword [rsp + 0xe0], 0
mov qword [rsp + 0xe8], 8
and qword [rsp + 0xf0], 0
lea rcx, [rsp + 0x238]
mov rdx, rbx
call fcn.140160724
mov rcx, qword [rsp + 0x70]
jmp 0x14000ae15
mov rcx, qword [rsp + 0x250]
test rcx, rcx
je 0x14000afd7
call fcn.140173d2c
lea rsi, [rsp + 0x330]
mov rcx, qword [rsi + 0xc8]
mov rdx, qword [rsi + 0xd0]
call fcn.14015f2e0
mov rcx, qword [rsi + 0xc0]
mov rdx, qword [rsi + 0xc8]
call fcn.14015f453
mov rax, qword [rsp + 0x248]
lea rcx, [rsp + 0x3f0]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rsp + 0x238]
movups xmmword [rcx], xmm0
mov r8d, 0x1a0
mov rcx, qword [rsp + 0x2b8]
mov rdx, rsi
call sub.api_ms_win_crt_private_l1_1_0.dll_memcpy
movaps xmm6, xmmword [rsp + 0x4f0]
movaps xmm7, xmmword [rsp + 0x500]
movaps xmm8, xmmword [rsp + 0x510]
movaps xmm9, xmmword [rsp + 0x520]
add rsp, 0x538
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x1a0], rcx
mov qword [rsp + 0x1a8], r15
mov qword [rsp + 0x1b0], r14
movabs rbp, 0x8000000000000000
jmp 0x14000a60e
movss xmm8, dword [rsp + 0x70]
movss xmm9, dword [rsp + 0x78]
lea rsi, [rsp + 0xe8]
lea rdx, [0x140311d5e]
mov ebx, 8
mov r8d, 8
mov rcx, rsi
call fcn.14001cc8e
movss dword [rsi + 0x20], xmm8
movss dword [rsi + 0x24], xmm8
mov dword [rsi + 0x18], edi
movss dword [rsi + 0x1c], xmm9
movups xmm0, xmmword [rsp + 0x2c0]
movups xmm1, xmmword [rsp + 0x2d0]
movups xmm2, xmmword [rsp + 0x2e0]
movaps xmmword [rsi - 0x38], xmm0
movaps xmmword [rsi - 0x28], xmm1
movaps xmmword [rsi - 0x18], xmm2
mov rax, qword [rsp + 0x2f0]
mov qword [rsi - 8], rax
mov r14, qword [rsi - 0x38]
lea rsi, [rsp + 0xb8]
lea rdi, [rsp + 0x1a0]
mov ecx, 0xb
rep movsq qword [rdi], qword [rsi]
cmp r14, 3
je 0x140009986
mov ecx, 0x60
mov edx, 8
call fcn.14015b7bf
mov rbx, rax
mov qword [rax], r14
lea rdi, [rax + 8]
lea rsi, [rsp + 0x1a0]
mov ecx, 0xb
rep movsq qword [rdi], qword [rsi]
mov esi, 1
jmp 0x140009988
lea rcx, str.key_used_disappeared
lea r8, [0x1403124b0]
mov edx, 0x14
call fcn.140042e00
lea rax, str.C:Users_saelko.cargo_registry_srcindex.crates.io_6f17d22bba15001f_sysinfo_0.29.11_srcwindows_network.rs
mov edx, 0x101
mov rcx, r8
mov r8, rax
call fcn.14003f980
lea rax, [0x140312a50]
mov qword [rsp + 0x20], rax
lea rcx, str.cannot_access_a_Thread_Local_Storage_value_during_or_after_destruction_rustc_90b35a6239c3d8bdabc530a6a0816f7ff89a0aaflibrary_std_src_threadlocal.rs
lea r9, [0x140312b60]
lea r8, [rsp + 0x330]
mov edx, 0x46
call fcn.140041b70
lea rcx, str.global_key_idle_disappearedC:Users_saelko.cargo_registry_srcindex.crates.io_6f17d22bba15001f_sysinfo_0.29.11_srcwindows_system.rs
lea r8, [0x140312480]
mov edx, 0x1b
call fcn.140042e00
int3