Function at 0x140007880
Capabilities:
Get session user name

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x778
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x6f0], 0xfffffffffffffffe
mov ecx, 2
xor edx, edx
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
test rax, rax
je 0x140008a48
mov rdi, rax
xor r12d, r12d
lea rcx, [rbp - 0x58]
mov r8d, 0x238
xor edx, edx
call fcn.14004da00
mov dword [rbp - 0x58], 0x238
mov qword [rbp + 0x498], 0
mov qword [rbp + 0x4a0], 8
lea r13, [rbp + 0x1f8]
mov esi, 8
lea rbx, [0x14005147c]
lea r15, [rbp + 0x4b0]
jmp 0x14000793a
mov rsi, qword [rbp + 0x4a0]
lea rax, [r12 + r12*2]
mov rcx, qword [rbp + 0x6c8]
mov qword [rsi + rax*8], rcx
mov rcx, qword [rbp + 0x6e0]
mov qword [rsi + rax*8 + 8], rcx
mov qword [rsi + rax*8 + 0x10], r14
inc r12
mov qword [rbp + 0x4a8], r12
mov rcx, rdi
lea rdx, [rbp - 0x58]
call sub.KERNEL32.dll_Process32NextW
cmp eax, 1
jne 0x140007ba5
lea rax, [rbp - 0x2c]
mov qword [rbp + 0x1e0], rax
lea rax, [rbp + 0x1dc]
mov qword [rbp + 0x1e8], rax
mov word [rbp + 0x1f0], 0
lea rcx, [rbp + 0x420]
lea rdx, [rbp + 0x1e0]
call fcn.140006ab0
mov r8d, 0x11
lea rcx, [rbp + 0x460]
lea rdx, [0x140051444]
call fcn.14000c640
mov r8d, 0x1b
lea rcx, [rbp + 0x5f0]
lea rdx, [0x140051455]
call fcn.14000c640
mov r8d, 0xc
lea rcx, [rbp + 0x670]
lea rdx, [0x140051470]
call fcn.14000c640
mov r8d, 8
mov rcx, r15
mov rdx, rbx
call fcn.14000c640
mov rax, qword [rbp + 0x470]
mov qword [rbp + 0x1f0], rax
movups xmm0, xmmword [rbp + 0x460]
movaps xmmword [rbp + 0x1e0], xmm0
mov rax, qword [rbp + 0x600]
mov qword [r13 + 0x10], rax
movups xmm0, xmmword [rbp + 0x5f0]
movups xmmword [r13], xmm0
mov rax, qword [rbp + 0x680]
mov qword [r13 + 0x28], rax
movups xmm0, xmmword [rbp + 0x670]
movups xmmword [r13 + 0x18], xmm0
mov rax, qword [rbp + 0x4c0]
mov qword [r13 + 0x40], rax
movups xmm0, xmmword [rbp + 0x4b0]
movups xmmword [r13 + 0x30], xmm0
mov rax, qword [rbp + 0x428]
mov qword [rbp + 0x6e0], rax
mov r14, qword [rbp + 0x430]
cmp qword [rbp + 0x1f0], r14
jne 0x140007a84
mov rcx, qword [rbp + 0x1e8]
mov rdx, qword [rbp + 0x6e0]
mov r8, r14
call fcn.14004d260
test eax, eax
je 0x140008a1f
cmp qword [rbp + 0x208], r14
jne 0x140007aab
mov rcx, qword [rbp + 0x200]
mov rdx, qword [rbp + 0x6e0]
mov r8, r14
call fcn.14004d260
test eax, eax
je 0x140008a1f
cmp qword [rbp + 0x220], r14
jne 0x140007ad2
mov rcx, qword [rbp + 0x218]
mov rdx, qword [rbp + 0x6e0]
mov r8, r14
call fcn.14004d260
test eax, eax
je 0x140008a1f
cmp qword [rbp + 0x238], r14
jne 0x140007af9
mov rcx, qword [rbp + 0x230]
mov rdx, qword [rbp + 0x6e0]
mov r8, r14
call fcn.14004d260
test eax, eax
je 0x140008a1f
cmp qword [rbp + 0x1e0], 0
je 0x140007b19
mov r8, qword [rbp + 0x1e8]
mov rcx, qword [0x14006c4c8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x1f8], 0
je 0x140007b39
mov r8, qword [rbp + 0x200]
mov rcx, qword [0x14006c4c8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x210], 0
je 0x140007b59
mov r8, qword [rbp + 0x218]
mov rcx, qword [0x14006c4c8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x228], 0
je 0x140007b79
mov r8, qword [rbp + 0x230]
mov rcx, qword [0x14006c4c8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rbp + 0x420]
mov qword [rbp + 0x6c8], rax
cmp r12, qword [rbp + 0x498]
jne 0x140007917
lea rcx, [rbp + 0x498]
call fcn.140006690
jmp 0x140007910
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, 0x202
lea rdi, [rbp + 0x1e0]
mov rcx, rdi
xor edx, edx
call fcn.14004da00
mov dword [rbp + 0x4b0], 0x101
lea rdx, [rbp + 0x4b0]
mov rcx, rdi
call sub.ADVAPI32.dll_GetUserNameW
lea rax, [rbp + 0x3e2]
mov qword [rbp + 0x4b0], rdi
mov qword [rbp + 0x4b8], rax
mov word [rbp + 0x4c0], 0
lea rcx, [rbp + 0x448]
lea rdx, [rbp + 0x4b0]
call fcn.140006ab0
lea rdx, [0x140051484]
lea rcx, [rbp + 0x4b0]
mov r8d, 6
call fcn.14000c640
mov r8, qword [rbp + 0x458]
mov rdi, qword [rbp + 0x4b8]
cmp r8, qword [rbp + 0x4c0]
jne 0x140007c56
mov rcx, qword [rbp + 0x450]
mov rdx, rdi
call fcn.14004d260
test eax, eax
je 0x140008ac4
cmp qword [rbp + 0x4b0], 0
je 0x140007c72
mov rcx, qword [0x14006c4c8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rdx, [0x14005148a]
lea rcx, [rbp + 0x670]
mov r8d, 8
call fcn.14000c640
mov r14, qword [rbp + 0x678]
mov rdi, qword [rbp + 0x680]
test rdi, rdi
je 0x140007cc1
js 0x140008a9a
movzx eax, byte [0x14006c420]
mov rcx, rdi
call fcn.14002a260
test rax, rax
je 0x140008aab
mov rbx, rax
jmp 0x140007cc6
mov ebx, 1
mov rcx, rbx
mov rdx, r14
mov r8, rdi
call fcn.14004d360
mov qword [rbp + 0x4b0], rdi
mov qword [rbp + 0x4b8], rbx
mov qword [rbp + 0x4c0], rdi
mov byte [rbp + 0x4c8], 0
mov qword [rbp + 0x4d0], 0
mov qword [rbp + 0x4d8], 8
mov qword [rbp + 0x4e0], 0
movabs r15, 0x8000000000000000
mov qword [rbp + 0x4e8], r15
mov dword [rbp + 0x508], 6
mov dword [rbp + 0x518], 6
mov dword [rbp + 0x528], 6
xorps xmm0, xmm0
movups xmmword [rbp + 0x538], xmm0
movups xmmword [rbp + 0x542], xmm0
movups xmmword [rbp + 0x558], xmm0
movups xmmword [rbp + 0x566], xmm0
cmp qword [rbp + 0x670], 0
je 0x140007d7b
mov rcx, qword [0x14006c4c8]
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rdx, [0x140051492]
lea rcx, [rbp + 0x578]
mov r8d, 9
call fcn.14000c640
lea rdx, [0x14005149b]
lea rcx, [rbp + 0x5a8]
mov r8d, 3
call fcn.14000c640
lea rdx, [0x14005149e]
lea rcx, [rbp + 0x670]
mov r8d, 4
call fcn.14000c640
mov rax, qword [rbp + 0x588]
mov qword [rbp + 0x600], rax
movups xmm0, xmmword [rbp + 0x578]
movaps xmmword [rbp + 0x5f0], xmm0
mov rax, qword [rbp + 0x5b8]
mov qword [rbp + 0x618], rax
movups xmm1, xmmword [rbp + 0x5a8]
movups xmmword [rbp + 0x608], xmm1
movups xmm1, xmmword [rbp + 0x670]
movaps xmmword [rbp + 0x620], xmm1
mov rax, qword [rbp + 0x680]
mov qword [rbp + 0x630], rax
mov qword [rbp + 0x678], 3
movups xmmword [rbp + 0x680], xmm0
mov rcx, qword [rbp + 0x600]
mov qword [rbp + 0x690], rcx
mov rcx, qword [rbp + 0x608]
mov qword [rbp + 0x698], rcx
mov rcx, qword [rbp + 0x610]
mov qword [rbp + 0x6a0], rcx
mov rcx, qword [rbp + 0x618]
mov qword [rbp + 0x6a8], rcx
movups xmmword [rbp + 0x6b0], xmm1
mov qword [rbp + 0x6c0], rax
mov r14, qword [rbp + 0x680]
mov ebx, 1
mov edi, 1
cmp r14, r15
je 0x140007ee6
mov rdi, qword [rbp + 0x688]
mov r8, qword [rbp + 0x690]
mov qword [rbp + 0x650], 1
mov qword [rbp + 0x648], r14
mov qword [rbp + 0x640], rdi
lea rcx, [rbp + 0x4b0]
mov rdx, rdi
call fcn.14002dd40
test r14, r14
je 0x140007ed5
mov rcx, qword [0x14006c4c8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r14, qword [rbp + 0x698]
mov edi, 2
cmp r14, r15
jne 0x140007f32
mov qword [rbp + 0x670], rdi
lea rax, [rdi + rdi*2]
lea r14, [rax*8 + 0x688]
add r14, rbp
jmp 0x140007f17
mov rax, rbx
xor rax, rdi
inc rbx
add r14, 0x18
cmp rax, 3
je 0x140007fd8
cmp qword [r14 - 8], 0
je 0x140007f00
mov r8, qword [r14]
mov rcx, qword [0x14006c4c8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140007f00
mov rdi, qword [rbp + 0x6a0]
mov r8, qword [rbp + 0x6a8]
mov qword [rbp + 0x650], 2
mov qword [rbp + 0x648], r14
mov qword [rbp + 0x640], rdi
lea rcx, [rbp + 0x4b0]
mov rdx, rdi
call fcn.14002dd40
test r14, r14
je 0x140007f7f
mov rcx, qword [0x14006c4c8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rbx, qword [rbp + 0x6b0]
cmp rbx, r15
je 0x140007fd8
mov rdi, qword [rbp + 0x6b8]
mov r8, qword [rbp + 0x6c0]
mov qword [rbp + 0x650], 3
mov qword [rbp + 0x648], rbx
mov qword [rbp + 0x640], rdi
lea rcx, [rbp + 0x4b0]
mov rdx, rdi
call fcn.14002dd40
test rbx, rbx
je 0x140007fd8
mov rcx, qword [0x14006c4c8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [rbp + 0x5f0], 3
lea rcx, [rbp + 0x670]
lea rdx, [rbp + 0x4b0]
lea r8, [rbp + 0x5f0]
call fcn.14001d8c0
mov rbx, qword [rbp + 0x670]
mov rax, qword [rbp + 0x680]
cmp rax, 2
mov qword [rbp + 0x6e0], rbx
je 0x140008a59
mov rdi, qword [rbp + 0x678]
movups xmm0, xmmword [rbp + 0x688]
movups xmmword [rbp + 0x580], xmm0
movups xmm0, xmmword [rbp + 0x698]
movups xmmword [rbp + 0x590], xmm0
mov rcx, qword [rbp + 0x6a8]
mov qword [rbp + 0x5a0], rcx
mov rcx, qword [rbp + 0x580]
mov qword [rbp + 0x578], 0
test rax, rax
je 0x140008069
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp + 0x658], 0
mov qword [rbp + 0x660], 1
mov qword [rbp + 0x668], 0
mov qword [rbp + 0x5d8], 0
mov qword [rbp + 0x5e0], 1
mov qword [rbp + 0x5e8], 0
mov rdx, qword [rbp + 0x590]
cmp qword [rbp + 0x588], 0
mov rax, qword [rbp + 0x598]
mov qword [rbp + 0x588], 0
mov rcx, qword [rbp + 0x5a0]
mov qword [rbp + 0x598], 0
mov qword [rbp + 0x6c8], rdi
je 0x14000813b
test rax, rax
je 0x1400081a1
mov qword [rbp + 0x6d8], rcx
mov byte [rbp + 0x6ef], 1
lea rcx, [rbp + 0x670]
lea r8, [rbp + 0x658]
call fcn.140029a90
mov rax, qword [rbp + 0x670]
mov rdi, qword [rbp + 0x678]
cmp rax, 3
jne 0x1400081e4
mov rcx, qword [rbp + 0x6d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1400084c2
test rax, rax
je 0x1400084d2
mov qword [rbp + 0x6d8], rcx
mov qword [rbp + 0x5f0], rcx
lea rcx, [rbp + 0x5f0]
lea rdx, [rbp + 0x5d8]
call fcn.14001d2d0
test rax, rax
je 0x1400081cb
mov qword [rbp + 0x670], rdx
lea rax, [0x140054950]
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, fcn.140013e40
lea r8, [rbp + 0x670]
mov edx, 0x2b
call fcn.14004e340
jmp 0x140008b73
mov qword [rbp + 0x6d8], rdx
mov qword [rbp + 0x5f0], rdx
lea rcx, [rbp + 0x5f0]
lea rdx, [rbp + 0x658]
call fcn.14001d2d0
test rax, rax
jne 0x140008b41
mov rcx, qword [rbp + 0x6d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rbx, qword [rbp + 0x6e0]
jmp 0x1400084d2
movups xmm0, xmmword [rbp + 0x680]
movups xmm1, xmmword [rbp + 0x690]
movups xmmword [rbp + 0x5c8], xmm1
movups xmmword [rbp + 0x5b8], xmm0
mov qword [rbp + 0x5a8], rax
mov qword [rbp + 0x5b0], rdi
lea rcx, [rbp + 0x670]
lea r8, [rbp + 0x5d8]
mov rdx, qword [rbp + 0x6d8]
call fcn.140029a90
mov rax, qword [rbp + 0x670]
mov rdi, qword [rbp + 0x678]
cmp rax, 3
je 0x1400084af
movups xmm0, xmmword [rbp + 0x680]
movups xmm1, xmmword [rbp + 0x690]
movups xmmword [rbp + 0x610], xmm1
movups xmmword [rbp + 0x600], xmm0
mov qword [rbp + 0x5f0], rax
mov qword [rbp + 0x5f8], rdi
mov rax, qword [rbp + 0x5d0]
mov rcx, qword [rbp + 0x618]
mov qword [rbp + 0x438], rax
mov qword [rbp + 0x440], rcx
lea rdi, [rbp + 0x438]
mov r14, qword [sym.imp.KERNEL32.dll_WaitForMultipleObjects]
lea rbx, [rbp + 0x670]
lea r13, [rbp + 0x5a8]
nop word cs:[rax + rax]
mov ecx, 2
mov rdx, rdi
xor r8d, r8d
mov r9d, 0xffffffff
call r14
cmp eax, 1
je 0x140008330
test eax, eax
jne 0x140008429
mov rax, qword [rbp + 0x5a8]
test rax, rax
je 0x1400083ee
cmp eax, 1
jne 0x1400083cc
mov rdx, qword [rbp + 0x5b8]
mov rcx, qword [rbp + 0x5c8]
mov dword [rbp + 0x6d4], 0
lea r8, [rbp + 0x6d4]
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x1400089bd
mov eax, dword [rbp + 0x6d4]
jmp 0x1400083d3
mov rax, qword [rbp + 0x5f0]
test rax, rax
je 0x1400083a2
cmp eax, 2
jne 0x14000834a
mov rax, qword [rbp + 0x5f8]
jmp 0x140008383
mov rdx, qword [rbp + 0x600]
mov rcx, qword [rbp + 0x610]
mov dword [rbp + 0x6d4], 0
lea r8, [rbp + 0x6d4]
mov r9d, 1
call qword [sym.imp.KERNEL32.dll_GetOverlappedResult]
test eax, eax
je 0x14000843b
mov eax, dword [rbp + 0x6d4]
mov qword [rbp + 0x5f0], 0
mov rcx, qword [rbp + 0x608]
add qword [rcx + 0x10], rax
test rax, rax
je 0x140008494
mov rcx, rbx
lea rdx, [rbp + 0x5f0]
call fcn.140029e00
cmp byte [rbp + 0x670], 0
jne 0x140008420
cmp byte [rbp + 0x671], 0
jne 0x1400082b0
jmp 0x140008494
mov rax, qword [rbp + 0x5b0]
mov qword [rbp + 0x5a8], 0
mov rcx, qword [rbp + 0x5c0]
add qword [rcx + 0x10], rax
test rax, rax
je 0x14000840f
mov rcx, rbx
mov rdx, r13
call fcn.140029e00
cmp byte [rbp + 0x670], 0
jne 0x140008420
cmp byte [rbp + 0x671], 0
jne 0x1400082b0
lea rcx, [rbp + 0x5f0]
call fcn.140029f90
jmp 0x1400084a0
mov rdi, qword [rbp + 0x678]
jmp 0x1400084a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
shl rdi, 0x20
or rdi, 2
jmp 0x1400084a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov qword [rbp + 0x670], rdi
movabs rax, 0xffffffff00000000
and rax, rdi
movabs rcx, 0x6d00000000
cmp rax, rcx
je 0x14000847d
movabs rcx, 0x2600000000
cmp rax, rcx
jne 0x1400084a3
lea rcx, [rbp + 0x670]
call fcn.140013e40
mov qword [rbp + 0x5f0], 0
lea rcx, [rbp + 0x5a8]
call fcn.140029f90
mov rdi, rax
lea rcx, [rbp + 0x5f0]
call fcn.140029ba0
mov byte [rbp + 0x6ef], 0
lea rcx, [rbp + 0x5a8]
call fcn.140029ba0
test rdi, rdi
mov rbx, qword [rbp + 0x6e0]
jne 0x140008b0d
mov rcx, rbx
mov edx, 0xffffffff
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x14000853a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov r13d, eax
cmp qword [rbp + 0x5d8], 0
je 0x14000850d
mov r8, qword [rbp + 0x5e0]
mov rcx, qword [0x14006c4c8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
shl r13, 0x20
cmp qword [rbp + 0x658], 0
je 0x140008531
mov r8, qword [rbp + 0x660]
mov rcx, qword [0x14006c4c8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
or r13, 2
mov rbx, r15
jmp 0x140008595
mov dword [rbp + 0x670], 0
lea rdx, [rbp + 0x670]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
test eax, eax
je 0x1400084e4
mov eax, dword [rbp + 0x670]
mov dword [rbp + 0x6d8], eax
mov rbx, qword [rbp + 0x658]
mov r13, qword [rbp + 0x660]
mov r14, qword [rbp + 0x668]
movups xmm0, xmmword [rbp + 0x5d8]
movups xmmword [rbp + 0x3e8], xmm0
mov rax, qword [rbp + 0x5e8]
mov qword [rbp + 0x3f8], rax
mov rdi, r15
mov r15, qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x6e0]
call r15
mov rcx, qword [rbp + 0x6c8]
call r15
cmp rbx, rdi
je 0x140008a52
mov rdi, rbx
movups xmm0, xmmword [rbp + 0x3e4]
movups xmm1, xmmword [rbp + 0x3f0]
movups xmmword [rbp + 0x40c], xmm1
movaps xmmword [rbp + 0x400], xmm0
movups xmm0, xmmword [rbp + 0x404]
movups xmmword [rbp + 0x478], xmm0
mov rax, qword [rbp + 0x414]
mov qword [rbp + 0x488], rax
mov qword [rbp + 0x460], rbx
mov rbx, r13
mov qword [rbp + 0x468], r13
mov qword [rbp + 0x470], r14
mov eax, dword [rbp + 0x6d8]
mov dword [rbp + 0x490], eax
mov r13, qword [rbp + 0x478]
mov rax, qword [rbp + 0x480]
mov qword [rbp + 0x6e0], rax
lea rcx, [rbp + 0x4b0]
call fcn.140005ac0
mov qword [rbp + 0x4b0], 0
mov qword [rbp + 0x4b8], r14
lea r15, [rbp + 0x4c0]
mov qword [rbp + 0x4c0], rbx
mov qword [rbp + 0x4c8], r14
mov qword [rbp + 0x4d0], 0
mov qword [rbp + 0x4d8], r14
movabs rax, 0xa0000000a
mov qword [rbp + 0x4e0], rax
mov byte [rbp + 0x4e8], 1
mov word [rbp + 0x4f0], 1
lea rcx, [rbp + 0x670]
mov rdx, r15
call fcn.140006750
cmp qword [rbp + 0x670], 0
je 0x140008a3e
mov rax, qword [rbp + 0x680]
mov qword [rbp + 0x4b0], rax
cmp byte [rbp + 0x4f1], 0
jne 0x140008a3e
mov r14, qword [rbp + 0x4c0]
lea rcx, [rbp + 0x670]
mov rdx, r15
call fcn.140006750
cmp qword [rbp + 0x670], 0
je 0x14000871a
mov rax, qword [rbp + 0x678]
mov rcx, qword [rbp + 0x680]
mov rdx, qword [rbp + 0x4b0]
sub rax, rdx
add r14, rdx
mov qword [rbp + 0x4b0], rcx
test rax, rax
jne 0x140008761
jmp 0x14000888d
cmp byte [rbp + 0x4f1], 0
jne 0x140008a3e
mov byte [rbp + 0x4f1], 1
cmp byte [rbp + 0x4f0], 0
mov r14, qword [rbp + 0x4b0]
mov rax, qword [rbp + 0x4b8]
jne 0x14000874e
cmp rax, r14
je 0x140008a3e
sub rax, r14
add r14, qword [rbp + 0x4c0]
test rax, rax
je 0x14000888d
add rax, r14
lea rcx, [0x140053370]
jmp 0x140008799
movzx edx, dl
movzx edx, byte [rdx + rcx]
shr dl, 1
and dl, 1
test dl, dl
je 0x1400089b5
nop word cs:[rax + rax]
cmp rax, r14
je 0x14000888d
mov r15, rax
movzx edx, byte [rax - 1]
test dl, dl
js 0x1400087b0
lea rax, [r15 - 1]
movzx edx, dl
jmp 0x140008812
movzx r8d, byte [r15 - 2]
cmp r8b, 0xc0
jge 0x1400087e0
movzx r9d, byte [r15 - 3]
cmp r9b, 0xbf
jg 0x1400087ea
lea rax, [r15 - 4]
movzx r10d, byte [r15 - 4]
and r10d, 7
shl r10d, 6
and r9d, 0x3f
or r9d, r10d
jmp 0x1400087f2
lea rax, [r15 - 2]
and r8d, 0x1f
jmp 0x1400087fd
lea rax, [r15 - 3]
and r9d, 0xf
shl r9d, 6
and r8d, 0x3f
or r8d, r9d
shl r8d, 6
and dl, 0x3f
movzx edx, dl
or edx, r8d
cmp edx, 0x110000
je 0x14000888d
lea r8d, [rdx - 9]
cmp r8d, 5
jb 0x140008790
cmp edx, 0x20
je 0x140008790
cmp edx, 0x80
jb 0x1400089b5
mov r8d, edx
shr r8d, 8
cmp r8d, 0x1f
jg 0x14000885f
test r8d, r8d
je 0x140008881
cmp r8d, 0x16
jne 0x1400089b5
cmp edx, 0x1680
sete dl
jmp 0x140008779
cmp r8d, 0x20
je 0x14000876d
cmp r8d, 0x30
jne 0x1400089b5
cmp edx, 0x3000
sete dl
jmp 0x140008779
movzx edx, dl
movzx edx, byte [rdx + rcx]
jmp 0x140008776
xor r15d, r15d
lea rdx, [0x1400514a2]
lea rcx, [rbp + 0x4b0]
mov r8d, 0x24
call fcn.14000c640
mov qword [rbp + 0x6c8], rbx
mov rbx, r13
mov r13, qword [rbp + 0x4b8]
cmp r15, qword [rbp + 0x4c0]
jne 0x1400088d9
mov rcx, r14
mov rdx, r13
mov r8, r15
call fcn.14004d260
test eax, eax
je 0x140008aea
cmp qword [rbp + 0x4b0], 0
je 0x1400088f5
mov rcx, qword [0x14006c4c8]
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rdi, rdi
je 0x140008910
mov rcx, qword [0x14006c4c8]
xor edx, edx
mov r8, qword [rbp + 0x6c8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rbx, rbx
je 0x14000892b
mov rcx, qword [0x14006c4c8]
xor edx, edx
mov r8, qword [rbp + 0x6e0]
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x448], 0
je 0x14000894b
mov r8, qword [rbp + 0x450]
mov rcx, qword [0x14006c4c8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test r12, r12
je 0x140008984
lea rdi, [rsi + 8]
jmp 0x140008969
add rdi, 0x18
dec r12
je 0x140008984
cmp qword [rdi - 8], 0
je 0x140008960
mov r8, qword [rdi]
mov rcx, qword [0x14006c4c8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140008960
cmp qword [rbp + 0x498], 0
je 0x1400089a0
mov rcx, qword [0x14006c4c8]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
add rsp, 0x778
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
sub r15, r14
jmp 0x140008890
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
shl rdi, 0x20
or rdi, 2
mov qword [rbp + 0x670], rdi
movabs rax, 0xffffffff00000000
and rax, rdi
movabs rcx, 0x6d00000000
cmp rax, rcx
je 0x140008a03
movabs rcx, 0x2600000000
cmp rax, rcx
jne 0x1400084a3
lea rcx, [rbp + 0x670]
call fcn.140013e40
mov qword [rbp + 0x5a8], 0
jmp 0x14000840f
lea rcx, [rbp + 0x1e0]
call fcn.1400060a0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.14002a1c0
jmp 0x140008b73
call fcn.14002a1c0
jmp 0x140008b73
call fcn.14002a1c0
jmp 0x140008b73
mov qword [rbp + 0x6e0], r13
mov rax, qword [rbp + 0x6e0]
mov qword [rbp + 0x468], rax
movabs rax, 0x8000000000000000
mov qword [rbp + 0x460], rax
lea rcx, [rbp + 0x460]
call fcn.140006170
lea rcx, [rbp + 0x4b0]
call fcn.140005ac0
call fcn.14002a1c0
jmp 0x140008b73
mov qword [rbp + 0x6e0], r14
call fcn.140008f80
jmp 0x140008b73
mov qword [rbp + 0x6e0], r14
mov ecx, 1
mov rdx, rdi
call fcn.14004dee0
jmp 0x140008b73
cmp qword [rbp + 0x4b0], 0
je 0x140008ae0
mov rcx, qword [0x14006c4c8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
call fcn.14002a1c0
jmp 0x140008b73
cmp qword [rbp + 0x4b0], 0
je 0x140008b06
mov rcx, qword [0x14006c4c8]
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
call fcn.14002a1c0
jmp 0x140008b73
mov qword [rbp + 0x670], rdi
lea rax, [0x140054980]
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, fcn.140013e40
lea r8, [rbp + 0x670]
mov edx, 0x2b
call fcn.14004e340
jmp 0x140008b73
mov qword [rbp + 0x670], rdx
lea rax, [0x140054968]
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, fcn.140013e40
lea r8, [rbp + 0x670]
mov edx, 0x2b
call fcn.14004e340
ud2