Function at 0x140002083
Capabilities:
Get disk information
Get logon sessions
Get memory capacity
List groups for user account
List user accounts

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x528
movaps xmmword [rsp + 0x510], xmm9
movdqa xmmword [rsp + 0x500], xmm8
movdqa xmmword [rsp + 0x4f0], xmm7
movdqa xmmword [rsp + 0x4e0], xmm6
mov qword [rsp + 0x290], rcx
xor ecx, ecx
call fcn.14004e7fc
test rax, rax
je 0x140003ce4
mov rdi, qword [rax]
mov rbx, qword [rax + 8]
lea rcx, [rdi + 1]
mov qword [rax], rcx
lea rsi, [rsp + 0x2d0]
mov edx, 0x150
mov r8d, 0x1f4
mov rcx, rsi
call fcn.14004bc6c
movdqu xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0x480], xmm1
movdqa xmmword [rsp + 0x470], xmm0
mov qword [rsp + 0x490], rdi
mov qword [rsp + 0x498], rbx
lea rdx, [0x1403eba4d]
lea rcx, [rsp + 0x130]
mov r8d, 9
call fcn.140045925
movabs rbp, 0x8000000000000000
and qword [rsp + 0x148], 0
mov eax, 1
mov qword [rsp + 0x150], rax
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x158], xmm0
mov qword [rsp + 0x168], rax
and qword [rsp + 0x170], 0
mov qword [rsp + 0x178], rbp
and qword [rsp + 0x190], 0
and dword [rsp + 0x198], 0
and qword [rsp + 0x1a0], 0
mov eax, 8
mov qword [rsp + 0x1a8], rax
and qword [rsp + 0x1b0], 0
mov byte [rsp + 0x1b8], 0
and qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], rax
and qword [rsp + 0xc0], 0
mov ecx, 8
mov edx, 0x120
call fcn.140045162
test rax, rax
je 0x140003d10
mov qword [rsp + 0xf0], 2
mov qword [rsp + 0xf8], rax
and qword [rsp + 0x100], 0
and qword [rsp + 0x60], 0
call fcn.14000eeee
mov rdi, rax
mov rbx, rdx
call fcn.140041720
mov r8d, edx
lea rsi, [rsp + 0x2d0]
mov rcx, rsi
mov edx, eax
call fcn.140041750
cmp qword [rsi], 0
je 0x140002242
xor r12d, r12d
jmp 0x140002263
mov r12, qword [rsp + 0x2d8]
call sub.kernel32.dll_GetTickCount64
xor ecx, ecx
mov r8d, 0x3e8
xor edx, edx
div r8
sub r12, rax
cmovb r12, rcx
movaps xmm0, xmmword [rsp + 0x470]
movaps xmm1, xmmword [rsp + 0x480]
movaps xmm2, xmmword [rsp + 0x490]
lea r14, [rsp + 0x2d0]
movups xmmword [r14 + 0xd8], xmm0
movups xmmword [r14 + 0xe8], xmm1
movups xmmword [r14 + 0xf8], xmm2
pxor xmm8, xmm8
movdqu xmmword [r14 + 0x138], xmm8
movdqu xmmword [r14 + 0x148], xmm8
lea r15, [rsp + 0x130]
mov r8d, 0x90
mov rcx, r14
mov rdx, r15
call sub.msvcrt.dll_memcpy
movups xmm0, xmmword [rsp + 0xb0]
movups xmmword [r14 + 0x90], xmm0
mov rax, qword [rsp + 0xc0]
mov qword [r14 + 0xa0], rax
movups xmm0, xmmword [rsp + 0xf0]
movups xmmword [r14 + 0xa8], xmm0
mov rax, qword [rsp + 0x100]
mov qword [r14 + 0xb8], rax
lea rsi, [rsp + 0x60]
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmm2, xmmword [rsi + 0x20]
movups xmm3, xmmword [rsi + 0x30]
movups xmmword [r14 + 0x158], xmm0
movups xmmword [r14 + 0x168], xmm1
movups xmmword [r14 + 0x178], xmm2
movups xmmword [r14 + 0x188], xmm3
movdqu xmm6, xmmword [0x1403eb600]
movdqu xmmword [r14 + 0x118], xmm6
movdqu xmm7, xmmword [0x1403eb5f0]
movdqu xmmword [r14 + 0x108], xmm7
mov qword [r14 + 0x128], rdi
mov qword [r14 + 0x130], rbx
mov qword [r14 + 0x198], r12
and qword [r14 + 0xc0], 0
mov qword [r14 + 0xc8], 8
and qword [r14 + 0xd0], 0
movdqa xmmword [rsi], xmm8
movdqa xmmword [rsi + 0x30], xmm8
movdqa xmmword [rsi + 0x20], xmm8
movdqa xmmword [rsi + 0x10], xmm8
mov dword [rsi], 0x40
mov rcx, rsi
call sub.kernel32.dll_GlobalMemoryStatusEx
movdqu xmm0, xmmword [rsi + 8]
movdqu xmmword [r14 + 0x138], xmm0
movdqa xmmword [r15 + 0x50], xmm8
movdqa xmmword [r15 + 0x40], xmm8
movdqa xmmword [r15 + 0x30], xmm8
movdqa xmmword [r15 + 0x20], xmm8
movdqa xmmword [r15 + 0x10], xmm8
movdqa xmmword [r15], xmm8
and qword [r15 + 0x60], 0
lea rcx, [rsp + 0x130]
mov edx, 0x68
call sub.psapi.dll_GetPerformanceInfo
cmp eax, 1
jne 0x140002460
mov rdx, qword [rsp + 0x140]
mov r9, qword [rsp + 0x150]
xor r10d, r10d
sub rdx, r9
cmovb rdx, r10
mov rcx, qword [rsp + 0x180]
mov rax, rcx
mul rdx
mov r8, rax
mov r11, 0xffffffffffffffff
cmovo r8, r11
mov rdx, qword [rsp + 0x138]
sub rdx, r9
cmovb rdx, r10
mov rax, rcx
mul rdx
cmovo rax, r11
mov qword [rsp + 0x418], r8
mov qword [rsp + 0x420], rax
lea rax, [rsp + 0x3d8]
cmp qword [rax + 0x50], 0
je 0x140002579
mov rcx, qword [rsp + 0x458]
call sub.pdh.dll_PdhCollectQueryData
cmp qword [rsp + 0x318], rbp
je 0x1400024b0
lea rdx, [rsp + 0x318]
lea rcx, [rsp + 0x428]
call fcn.14004e5ff
test eax, eax
je 0x140003d21
movd dword [rsp + 0x338], xmm0
lea rcx, [rsp + 0x2d0]
mov dl, 1
call fcn.14004e5dd
mov rbx, rax
mov r14, rdx
add rbx, 0x48
lea rsi, [0x1403ebf48]
lea rdi, str.key_used_disappeared
lea rax, [rbx - 0x48]
cmp rax, r14
je 0x140002508
cmp qword [rbx], rbp
je 0x140002502
lea rcx, [rsp + 0x428]
mov rdx, rbx
call fcn.14004e5ff
test eax, eax
je 0x140003caf
movd dword [rbx + 0x20], xmm0
add rbx, 0x70
jmp 0x1400024d7
cmp byte [rsp + 0x358], 0
jne 0x1400027d8
mov rsi, qword [rsp + 0x350]
lea rcx, [rsp + 0x130]
mov rdx, rsi
call fcn.14004da40
mov rax, qword [rsp + 0x348]
mov rcx, qword [rsp + 0x130]
mov rdx, qword [rsp + 0x138]
mov r8, qword [rsp + 0x140]
shl r8, 3
imul r9, rsi, 0x70
xor r10d, r10d
test r9, r9
je 0x140002594
cmp r8, r10
je 0x140002594
mov r11, qword [rdx + r10]
mov qword [rax + 0x60], r11
add rax, 0x70
add r10, 8
add r9, 0xffffffffffffff90
jmp 0x140002559
lea r8, [rsp + 0x130]
and qword [r8], 0
xor ecx, ecx
xor edx, edx
call sub.pdh.dll_PdhOpenQueryA
test eax, eax
je 0x1400025a6
jmp 0x1400025cd
call fcn.140001d52
mov byte [rsp + 0x358], 1
jmp 0x1400027d8
mov r14, qword [rsp + 0x130]
call fcn.14000eeee
mov rbx, rax
mov rdi, rdx
lea rax, [0x1403eb5e0]
mov qword [rsp + 0x60], rax
lea rsi, [rsp + 0xf0]
and qword [rsi], 0
lea rcx, [rsp + 0x428]
call fcn.140001d2b
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x428], rax
and qword [rsp + 0x440], 0
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x430], xmm0
mov qword [rsp + 0x448], rbx
mov qword [rsp + 0x450], rdi
mov qword [rsp + 0x458], r14
mov rcx, qword [rsp + 0xf0]
mov qword [rsp + 0x460], rcx
test rax, rax
je 0x1400027d8
lea rdx, str.Processor__Total___Processor_Timetot_0Processor____Processor_Time
lea rcx, [rsp + 0x60]
mov r8d, 0x23
call fcn.140045925
lea rdx, [0x1403ebe2b]
lea rcx, [rsp + 0x130]
mov r8d, 5
call fcn.140045925
lea r8, [rsp + 0x318]
lea rcx, [rsp + 0x60]
lea r9, [rsp + 0x130]
lea rdx, [rsp + 0x428]
call fcn.14004e1ef
lea rcx, [rsp + 0x2d0]
mov dl, 1
call fcn.14004e5dd
mov rsi, rax
mov rdi, rdx
xor r12d, r12d
lea r13, [rsp + 0x1d0]
lea rbp, [fcn.140009cb0]
lea r15, [rsp + 0xb0]
lea rbx, [rsp + 0xf0]
lea r14, [rsp + 0x130]
cmp rsi, rdi
je 0x1400027bf
mov qword [rsp + 0x1d0], r12
lea rax, [0x1403ebe50]
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x138], 2
and qword [rsp + 0x150], 0
mov qword [rsp + 0xb0], r13
mov qword [rsp + 0xb8], rbp
mov qword [rsp + 0x140], r15
mov qword [rsp + 0x148], 1
mov rcx, rbx
mov rdx, r14
call fcn.140001e46
lea rax, [0x1403ebe78]
mov qword [rsp + 0x130], rax
mov qword [rsp + 0x138], 2
and qword [rsp + 0x150], 0
mov qword [rsp + 0xb0], r13
mov qword [rsp + 0xb8], rbp
mov qword [rsp + 0x140], r15
mov qword [rsp + 0x148], 1
lea rcx, [rsp + 0x60]
mov rdx, r14
call fcn.140001e46
add rsi, 0x48
movdqu xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x130], xmm0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x140], rax
mov rcx, rbx
lea rdx, [rsp + 0x428]
mov r8, rsi
mov r9, r14
call fcn.14004e1ef
inc r12
add rsi, 0x28
jmp 0x1400026c4
cmp qword [rsp + 0x428], 0
movabs rbp, 0x8000000000000000
jne 0x140002473
lea rsi, [rsp + 0x60]
mov rcx, rsi
call fcn.14004dc4a
cmp dword [rsi], 2
je 0x140002a34
mov rax, qword [rsp + 0x90]
lea rdx, [rsp + 0x130]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x60]
movups xmm1, xmmword [rsp + 0x70]
movups xmm2, xmmword [rsp + 0x80]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rcx, [rsp + 0xf0]
call fcn.14004dc76
cmp qword [rsp + 0xf0], 2
je 0x140002a34
mov rax, qword [rsp + 0x120]
lea rdx, [rsp + 0x130]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0xf0]
movups xmm1, xmmword [rsp + 0x100]
movups xmm2, xmmword [rsp + 0x110]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rcx, [rsp + 0xb0]
call fcn.14004dcf0
cmp qword [rsp + 0xb0], 2
je 0x140002a34
mov rax, qword [rsp + 0xe0]
lea rdx, [rsp + 0x130]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0xb0]
movups xmm1, xmmword [rsp + 0xc0]
movups xmm2, xmmword [rsp + 0xd0]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rcx, [rsp + 0x1d0]
call fcn.14004ddaa
cmp qword [rsp + 0x1d0], 2
je 0x140002a34
mov rax, qword [rsp + 0x200]
lea rdx, [rsp + 0x130]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x1d0]
movups xmm1, xmmword [rsp + 0x1e0]
movups xmm2, xmmword [rsp + 0x1f0]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rcx, [rsp + 0x298]
call fcn.14004de99
cmp qword [rsp + 0x298], 2
je 0x140002a34
mov rax, qword [rsp + 0x2c8]
lea rdx, [rsp + 0x130]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x298]
movups xmm1, xmmword [rsp + 0x2a8]
movups xmm2, xmmword [rsp + 0x2b8]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rcx, [rsp + 0x4a8]
call fcn.14004df16
mov rax, qword [rsp + 0x4a8]
cmp rax, 2
je 0x140002a34
movdqu xmm0, xmmword [rsp + 0x4b0]
movups xmm1, xmmword [rsp + 0x4c0]
movups xmm2, xmmword [rsp + 0x4d0]
lea rdx, [rsp + 0x228]
movups xmmword [rdx + 0x28], xmm2
movups xmmword [rdx + 0x18], xmm1
movdqu xmmword [rdx + 8], xmm0
mov qword [rdx], rax
lea rcx, [rsp + 0x1d0]
mov r8b, 1
call fcn.14004e01a
mov rax, qword [rsp + 0x258]
mov qword [rsp + 0x120], rax
movdqu xmm0, xmmword [rsp + 0x228]
movups xmm1, xmmword [rsp + 0x238]
movups xmm2, xmmword [rsp + 0x248]
movaps xmmword [rsp + 0x110], xmm2
movaps xmmword [rsp + 0x100], xmm1
movdqa xmmword [rsp + 0xf0], xmm0
mov ebx, dword [rsp + 0x1d4]
cmp ebx, 2
jne 0x140003b75
lea rcx, [rsp + 0xf0]
call fcn.14004b2f8
mov r14d, 8
xor esi, esi
lea rcx, [rsp + 0x360]
call fcn.14004c978
mov qword [rsp + 0x360], rsi
mov qword [rsp + 0x368], r14
mov qword [rsp + 0x370], rsi
lea rcx, [rsp + 0x1d0]
and qword [rcx], 0
call sub.iphlpapi.dll_GetIfTable2
test eax, eax
je 0x140002c69
lea rcx, [rsp + 0x2d0]
mov edx, 0x10101
call fcn.14004c9bb
call sub.kernel32.dll_GetLogicalDrives
mov dword [rsp + 0x298], eax
test eax, eax
je 0x14000301c
and qword [rsp + 0x1d0], 0
mov qword [rsp + 0x1d8], 8
and qword [rsp + 0x1e0], 0
lea rax, [rsp + 0x298]
mov qword [rsp + 0x130], rax
movabs rax, 0x2000000000
mov qword [rsp + 0x138], rax
mov ecx, 0x20
call fcn.14004ac0c
and dword [rsp + 0x28], 0
lea rcx, [rsp + 0x130]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 0x20
mov qword [rsp + 0x20], 1
lea rcx, [rsp + 0xb0]
mov edx, 0x20
xor r8d, r8d
mov r9, rax
call fcn.140049462
movdqu xmm0, xmmword [rsp + 0xb0]
mov rax, qword [rsp + 0xc0]
lea rcx, [rsp + 0x130]
movdqu xmmword [rcx], xmm0
mov qword [rcx + 0x10], rax
call fcn.14004ad84
test rax, rax
je 0x140002b62
lea rcx, [rsp + 0x1d0]
xor edx, edx
mov r8, rax
call fcn.14004ae3f
mov rax, qword [rsp + 0xc0]
lea rsi, [rsp + 0xf0]
mov qword [rsi + 0x10], rax
movdqu xmm0, xmmword [rsp + 0xb0]
movdqa xmmword [rsi], xmm0
lea rdi, [rsp + 0x60]
lea rbx, [rsp + 0x1d0]
lea r14, [rsp + 0x130]
mov rcx, rdi
mov rdx, rsi
call fcn.14004adf0
cmp qword [rsp + 0x60], rbp
je 0x140002c3f
movdqu xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x130], xmm0
mov r15, qword [rsp + 0x70]
mov qword [rsp + 0x140], r15
mov r12, qword [rsp + 0x138]
mov rax, qword [rsp + 0x1d0]
mov r13, qword [rsp + 0x1e0]
sub rax, r13
cmp rax, r15
jae 0x140002c00
mov rcx, rbx
mov rdx, r13
mov r8, r15
call fcn.14004ae3f
mov r13, qword [rsp + 0x1e0]
imul rcx, r13, 0x90
add rcx, qword [rsp + 0x1d8]
imul r8, r15, 0x90
mov rdx, r12
call sub.msvcrt.dll_memcpy
add r13, r15
mov qword [rsp + 0x1e0], r13
and qword [rsp + 0x140], 0
mov rcx, r14
call fcn.140001ce8
jmp 0x140002b98
lea rcx, [rsp + 0xf0]
call fcn.1400451ef
mov r14, qword [rsp + 0x1d0]
mov rdi, qword [rsp + 0x1d8]
mov rsi, qword [rsp + 0x1e0]
jmp 0x140003026
mov rax, qword [rsp + 0x3d8]
mov rcx, qword [rsp + 0x3e0]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [rsp + 0x3f0]
lea rsi, [rsp + 0x130]
mov qword [rsi], rax
add rax, 0x10
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov word [rsi + 0x18], dx
mov qword [rsi + 0x20], r8
mov rcx, rsi
call fcn.14004a900
test rax, rax
je 0x140002cc3
mov byte [rdx + 0x68], 0
jmp 0x140002cb0
call fcn.14000eeee
lea rcx, [rsp + 0x150]
movdqa xmmword [rcx - 0x10], xmm6
movdqa xmmword [rcx - 0x20], xmm7
mov qword [rcx], rax
mov qword [rcx + 8], rdx
lea rax, [rsp + 0xb0]
and qword [rax], 0
mov qword [rax + 8], 8
and qword [rax + 0x10], 0
mov rax, qword [rsp + 0x1d0]
lea rcx, [rax + 8]
mov qword [rsp + 0x220], rcx
mov qword [rsp + 0x218], rax
mov r14d, dword [rax]
xor edi, edi
pcmpeqd xmm6, xmm6
mov qword [rsp + 0x58], r14
cmp rdi, r14
je 0x1400033d9
mov rbx, rdi
inc rdi
imul rax, rbx, 0x548
mov rcx, qword [rsp + 0x220]
lea rsi, [rcx + rax]
cmp qword [rcx + rax + 0x4a8], 0
jne 0x140002d5b
cmp qword [rsi + 0x4b0], 0
je 0x140002d24
cmp dword [rsi + 0x48c], 2
je 0x140002d24
cmp dword [rsi + 0x420], 0
je 0x140002d24
mov ecx, 0x14
mov edx, 2
call fcn.14004875e
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rdi
mov ebp, dword [rsi + 0x10]
movzx ecx, byte [rsi + 0x14]
movzx edx, byte [rsi + 0x15]
movzx r8d, byte [rsi + 0x16]
movzx r9d, byte [rsi + 0x17]
movzx r10d, byte [rsi + 0x18]
movzx r11d, byte [rsi + 0x19]
movzx edi, byte [rsi + 0x1a]
movzx esi, byte [rsi + 0x1b]
mov dword [rax], ebp
mov word [rax + 4], cx
mov word [rax + 6], dx
mov word [rax + 8], r8w
mov word [rax + 0xa], r9w
mov word [rax + 0xc], r10w
mov word [rax + 0xe], r11w
mov word [rax + 0x10], di
mov word [rax + 0x12], si
mov r8d, 0xa
lea rcx, [rsp + 0x60]
mov qword [rsp + 0x40], rax
mov rdx, rax
call fcn.14004598b
mov rcx, qword [rsp + 0x150]
mov rdx, qword [rsp + 0x158]
mov r13, qword [rsp + 0x68]
mov rbp, qword [rsp + 0x70]
mov r8, r13
mov r9, rbp
call fcn.14004acee
mov r12, qword [rsp + 0x130]
mov rdi, qword [rsp + 0x138]
mov rsi, rdi
and rsi, rax
mov qword [rsp + 0x1c0], rax
shr rax, 0x39
mov qword [rsp + 0x208], rax
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor ebx, ebx
movdqu xmm8, xmmword [r12 + rsi]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb r14d, xmm0
test r14w, r14w
je 0x140002e9f
bsf eax, r14d
add rax, rsi
and rax, rdi
shl rax, 5
mov r15, r12
sub r15, rax
mov rcx, qword [r15 - 0x18]
mov rdx, qword [r15 - 0x10]
mov r8, r13
mov r9, rbp
call fcn.14004ada3
test al, al
jne 0x140002ec1
lea eax, [r14 - 1]
and eax, r14d
mov r14d, eax
jmp 0x140002e62
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x140002f69
add rsi, rbx
add rsi, 0x10
add rbx, 0x10
and rsi, rdi
jmp 0x140002e4e
mov rcx, qword [rsp + 0x60]
movabs rbp, 0x8000000000000000
cmp rcx, rbp
je 0x140002edd
mov rdx, r13
call fcn.140044ca9
mov r14, qword [rsp + 0x58]
mov rdi, qword [rsp + 0x48]
mov rbx, qword [rsp + 0x50]
mov eax, dword [r15 - 8]
inc eax
mov dword [r15 - 8], eax
cmp eax, 1
jle 0x140002f0f
mov ecx, 0xa
mov rdx, qword [rsp + 0x40]
call fcn.140044ca9
jmp 0x140002d24
mov rsi, qword [rsp + 0xc0]
cmp rsi, qword [rsp + 0xb0]
jne 0x140002f2e
lea rcx, [rsp + 0xb0]
call fcn.14004af04
mov rax, qword [rsp + 0xb8]
mov rcx, rsi
shl rcx, 5
mov dword [rax + rcx], ebx
mov edx, 0xa
mov qword [rax + rcx + 8], rdx
mov r8, qword [rsp + 0x40]
mov qword [rax + rcx + 0x10], r8
mov qword [rax + rcx + 0x18], rdx
inc rsi
mov qword [rsp + 0xc0], rsi
jmp 0x140002d24
mov rsi, qword [rsp + 0x140]
test rsi, rsi
jne 0x140002fa3
lea rcx, [rsp + 0x130]
lea rdx, [rsp + 0x150]
call fcn.14004c07d
mov r12, qword [rsp + 0x130]
mov rdi, qword [rsp + 0x138]
mov rsi, qword [rsp + 0x140]
mov r14, qword [rsp + 0x60]
mov rcx, r12
mov rdx, rdi
mov r8, qword [rsp + 0x1c0]
call fcn.14004b9da
movzx ecx, byte [r12 + rax]
lea rdx, [rax - 0x10]
and rdx, rdi
mov r8, qword [rsp + 0x208]
mov byte [r12 + rax], r8b
mov byte [r12 + rdx + 0x10], r8b
shl rax, 5
mov r15, r12
sub r15, rax
and ecx, 1
sub rsi, rcx
mov qword [rsp + 0x140], rsi
neg rax
mov qword [r12 + rax - 0x20], r14
mov qword [r15 - 0x18], r13
mov qword [r15 - 0x10], rbp
and dword [r15 - 8], 0
inc qword [rsp + 0x148]
movabs rbp, 0x8000000000000000
jmp 0x140002edd
mov edi, 8
xor r14d, r14d
xor esi, esi
lea rcx, [rsp + 0x378]
call fcn.140001ce8
mov qword [rsp + 0x378], r14
mov qword [rsp + 0x380], rdi
lea rax, [rsp + 0x1d0]
and qword [rax], 0
mov qword [rax + 8], 8
and qword [rax + 0x10], 0
lea rax, [rsp + 0x298]
and qword [rax], 0
lea rax, [rsp + 0x1cc]
and dword [rax], 0
lea rax, [rsp + 0x210]
and dword [rax], 0
lea rax, [rsp + 0x214]
and dword [rax], 0
mov qword [rsp + 0x388], rsi
lea rbx, [rsp + 0xf0]
lea r12, [rsp + 0x130]
lea r13, [rsp + 0x60]
lea rax, [rsp + 0x214]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x210]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x1cc]
mov qword [rsp + 0x28], rax
or dword [rsp + 0x20], 0xffffffff
xor ecx, ecx
xor edx, edx
mov r8d, 2
lea r9, [rsp + 0x298]
call sub.netapi32.dll_NetUserEnum
mov dword [rsp + 0x40], eax
cmp eax, 0xea
je 0x1400030ff
cmp dword [rsp + 0x40], 0
jne 0x1400032f4
mov rsi, qword [rsp + 0x298]
mov eax, dword [rsp + 0x1cc]
lea r14, [rsi + rax*8]
cmp rsi, r14
je 0x1400032f4
mov r15, qword [rsi]
add rsi, 8
test r15, r15
je 0x140003112
and qword [rsp + 0xf0], 0
and dword [rsp + 0x228], 0
and dword [rsp + 0x4a8], 0
lea rax, [rsp + 0x4a8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x228]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], rbx
or dword [rsp + 0x28], 0xffffffff
lea rcx, [0x1403ec1c0]
mov rdx, r15
xor r8d, r8d
mov r9d, 1
call sub.netapi32.dll_NetUserGetLocalGroups
test eax, eax
je 0x1400031b0
and qword [rsp + 0x60], 0
mov qword [rsp + 0x68], 8
and qword [rsp + 0x70], 0
mov rcx, qword [rsp + 0xf0]
test rcx, rcx
je 0x140003230
call sub.netapi32.dll_NetApiBufferFree
jmp 0x140003230
mov ebp, dword [rsp + 0x228]
test rbp, rbp
je 0x1400031d7
imul rdi, rbp, 0x18
mov ecx, 8
mov rdx, rdi
call fcn.140045162
test rax, rax
jne 0x1400031de
jmp 0x140003ca0
mov eax, 8
xor ebp, ebp
mov qword [rsp + 0x60], rbp
mov qword [rsp + 0x68], rax
and qword [rsp + 0x70], 0
cmp qword [rsp + 0xf0], 0
je 0x140003230
mov edi, dword [rsp + 0x228]
xor ebp, ebp
cmp rdi, rbp
je 0x140003195
mov rax, qword [rsp + 0xf0]
test rax, rax
je 0x140003230
mov rdx, qword [rax + rbp*8]
mov rcx, r12
call fcn.1400487bb
mov rcx, r13
mov rdx, r12
call fcn.140048c09
inc rbp
jmp 0x140003202
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0xc0], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0xb8], rax
mov rcx, rbx
mov rdx, r15
call fcn.1400487bb
mov r15, qword [rsp + 0xf8]
mov r8, qword [rsp + 0x100]
mov rcx, r13
mov rdx, r15
call fcn.140009b10
mov rcx, r13
call fcn.14004881f
movups xmm0, xmmword [rsp + 0xf0]
movaps xmmword [rsp + 0x130], xmm0
mov rcx, qword [rsp + 0x100]
mov qword [rsp + 0x140], rcx
mov rcx, qword [rsp + 0xc0]
lea r8, [rsp + 0x148]
mov qword [r8 + 0x10], rcx
movdqa xmm0, xmmword [rsp + 0xb0]
movdqu xmmword [r8], xmm0
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], rdx
and dword [rsp + 0x170], 0
lea rcx, [rsp + 0x1d0]
mov rdx, r12
call fcn.14004d161
jmp 0x140003112
mov rcx, qword [rsp + 0x298]
test rcx, rcx
je 0x14000330f
call sub.netapi32.dll_NetApiBufferFree
and qword [rsp + 0x298], 0
cmp dword [rsp + 0x40], 0xea
je 0x1400030a6
lea rcx, [rsp + 0x4a8]
and dword [rcx], 0
lea rdx, [rsp + 0xb0]
and qword [rdx], 0
call sub.secur32.dll_LsaEnumerateLogonSessions
test eax, eax
je 0x14000394a
mov rax, qword [rsp + 0x1e0]
mov qword [rsp + 0x140], rax
movups xmm0, xmmword [rsp + 0x1d0]
movaps xmmword [rsp + 0x130], xmm0
lea rsi, [rsp + 0x390]
mov rcx, rsi
call fcn.140001c1f
mov rax, qword [rsp + 0x140]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x130]
movups xmmword [rsi], xmm0
lea rdx, [rsp + 0x2d0]
mov r8d, 0x1a0
mov rcx, qword [rsp + 0x290]
call sub.msvcrt.dll_memcpy
movaps xmm6, xmmword [rsp + 0x4e0]
movaps xmm7, xmmword [rsp + 0x4f0]
movaps xmm8, xmmword [rsp + 0x500]
movaps xmm9, xmmword [rsp + 0x510]
add rsp, 0x528
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rax, qword [rsp + 0xb0]
mov r15, qword [rsp + 0xb8]
mov rbx, qword [rsp + 0xc0]
shl rbx, 5
add rbx, r15
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
add qword [rsp + 0x218], 0x24
pcmpeqd xmm6, xmm6
mov qword [rsp + 0x58], rbx
cmp r15, rbx
je 0x140003a9e
mov rax, r15
add r15, 0x20
mov rsi, qword [rax + 8]
cmp rsi, rbp
je 0x140003a9b
mov rdi, qword [rax + 0x10]
mov edx, dword [rax]
cmp qword [rsp + 0x148], 0
je 0x140003553
mov qword [rsp + 0x40], rdx
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], rsi
mov rbx, qword [rax + 0x18]
mov rcx, qword [rsp + 0x150]
mov rdx, qword [rsp + 0x158]
mov r8, rdi
mov r9, rbx
call fcn.14004acee
mov r12, qword [rsp + 0x130]
mov r13, qword [rsp + 0x138]
mov rbp, r13
and rbp, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor r15d, r15d
movdqu xmm8, xmmword [r12 + rbp]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb esi, xmm0
test si, si
je 0x1400034f7
bsf r14d, esi
add r14, rbp
and r14, r13
mov rax, r14
shl rax, 5
mov rcx, r12
sub rcx, rax
mov r8, qword [rcx - 0x18]
mov r9, qword [rcx - 0x10]
mov rcx, rdi
mov rdx, rbx
call fcn.14004ada3
test al, al
jne 0x140003515
lea eax, [rsi - 1]
and eax, esi
mov esi, eax
jmp 0x1400034bb
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x140003515
add rbp, r15
add rbp, 0x10
add r15, 0x10
and rbp, r13
jmp 0x1400034a8
shl r14, 5
sub r12, r14
test si, si
mov eax, 0
cmove r12, rax
add r12, 0xffffffffffffffe0
test si, si
cmove r12, rax
movabs rbp, 0x8000000000000000
mov rsi, qword [rsp + 0x48]
mov r15, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x40]
jmp 0x140003556
xor r12d, r12d
lea rax, [r12 + 0x18]
test r12, r12
lea rcx, [0x1403ebba0]
cmove rax, rcx
cmp dword [rax], 1
jg 0x1400037b1
imul rax, rdx, 0x548
mov rcx, qword [rsp + 0x220]
lea r12, [rcx + rax]
lea rdx, [r12 + 0x1c]
add rax, qword [rsp + 0x218]
mov ecx, 0x202
xor r8d, r8d
test rcx, rcx
je 0x1400035b0
cmp word [rax + r8*2], 0
je 0x1400035b8
inc r8
add rcx, 0xfffffffffffffffe
jmp 0x14000359a
mov r8d, 0x101
jmp 0x1400035c5
cmp r8, 0x102
jae 0x140003cc1
lea rcx, [rsp + 0xf0]
call fcn.1400099b0
mov rax, qword [rsp + 0xf0]
mov r8, qword [rsp + 0xf8]
cmp rax, rbp
jne 0x1400035f7
mov rcx, rbp
mov rdx, r8
call fcn.14004a8ec
jmp 0x1400037b1
mov qword [rsp + 0x1c0], rax
mov qword [rsp + 0x208], r12
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x48], rsi
mov rbx, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x3f8]
mov rdx, qword [rsp + 0x400]
mov qword [rsp + 0x40], r8
mov r9, rbx
call fcn.14004ac58
mov r13, qword [rsp + 0x3d8]
mov r15, qword [rsp + 0x3e0]
mov r12, r15
and r12, rax
mov qword [rsp + 0x280], rax
shr rax, 0x39
mov qword [rsp + 0x288], rax
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor r14d, r14d
movdqu xmm8, xmmword [r13 + r12]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb esi, xmm0
test si, si
je 0x1400036c5
bsf eax, esi
add rax, r12
and rax, r15
neg rax
imul rbp, rax, 0x88
mov rcx, qword [r13 + rbp - 0x80]
mov rdx, qword [r13 + rbp - 0x78]
mov r8, qword [rsp + 0x40]
mov r9, rbx
call fcn.14004adcb
test al, al
jne 0x1400036e7
lea eax, [rsi - 1]
and eax, esi
mov esi, eax
jmp 0x140003689
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x1400037c1
add r12, r14
add r12, 0x10
add r14, 0x10
and r12, r15
jmp 0x140003675
add r13, rbp
mov rax, qword [r13 - 0x68]
mov rcx, qword [r13 - 0x58]
mov qword [r13 - 0x60], rax
mov rdx, qword [rsp + 0x208]
mov rax, qword [rdx + 0x500]
mov qword [r13 - 0x68], rax
mov qword [r13 - 0x50], rcx
mov rax, qword [rdx + 0x4b8]
mov qword [r13 - 0x58], rax
mov rax, qword [r13 - 0x48]
mov qword [r13 - 0x40], rax
mov rax, qword [rdx + 0x4c0]
add rax, qword [rdx + 0x4c8]
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov qword [r13 - 0x48], rax
mov rax, qword [r13 - 0x38]
mov qword [r13 - 0x30], rax
mov rax, qword [rdx + 0x508]
add rax, qword [rdx + 0x510]
cmovb rax, rcx
mov qword [r13 - 0x38], rax
mov rax, qword [r13 - 0x28]
mov qword [r13 - 0x20], rax
mov rax, qword [rdx + 0x4d8]
mov qword [r13 - 0x28], rax
mov rax, qword [r13 - 0x18]
mov qword [r13 - 0x10], rax
mov rax, qword [rdx + 0x520]
mov qword [r13 - 0x18], rax
mov byte [r13 - 8], 1
mov rcx, qword [rsp + 0x1c0]
mov rdx, qword [rsp + 0x40]
call fcn.14004a8ec
movabs rbp, 0x8000000000000000
mov rsi, qword [rsp + 0x48]
mov r15, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov rcx, rsi
mov rdx, rdi
call fcn.140044ca9
jmp 0x140003419
mov r14, qword [rsp + 0x3e8]
test r14, r14
jne 0x1400037fb
lea rcx, [rsp + 0x3d8]
lea rdx, [rsp + 0x3f8]
call fcn.14004ba60
mov r13, qword [rsp + 0x3d8]
mov r15, qword [rsp + 0x3e0]
mov r14, qword [rsp + 0x3e8]
mov rcx, qword [rsp + 0x208]
mov r12, qword [rcx + 0x4c0]
add r12, qword [rcx + 0x4c8]
mov rax, 0xffffffffffffffff
cmovb r12, rax
mov rsi, qword [rcx + 0x508]
add rsi, qword [rcx + 0x510]
cmovb rsi, rax
mov rax, qword [rcx]
mov qword [rsp + 0x268], rax
mov rax, qword [rcx + 0x500]
mov qword [rsp + 0x260], rax
mov rax, qword [rcx + 0x4b8]
mov qword [rsp + 0x270], rax
mov rax, qword [rcx + 0x4d8]
mov qword [rsp + 0x278], rax
mov rbp, qword [rcx + 0x520]
mov rcx, r13
mov rdx, r15
mov r8, qword [rsp + 0x280]
call fcn.14004b9da
lea rcx, [rax - 0x10]
and rcx, r15
movzx edx, byte [r13 + rax]
mov r8, qword [rsp + 0x288]
mov byte [r13 + rax], r8b
mov byte [r13 + rcx + 0x10], r8b
and edx, 1
sub r14, rdx
mov qword [rsp + 0x3e8], r14
neg rax
imul rax, rax, 0x88
mov rcx, qword [rsp + 0x1c0]
mov qword [r13 + rax - 0x88], rcx
mov rcx, qword [rsp + 0x40]
mov qword [r13 + rax - 0x80], rcx
mov qword [r13 + rax - 0x78], rbx
mov rcx, qword [rsp + 0x268]
mov qword [r13 + rax - 0x70], rcx
mov rcx, qword [rsp + 0x260]
mov qword [r13 + rax - 0x68], rcx
mov qword [r13 + rax - 0x60], rcx
mov rcx, qword [rsp + 0x270]
mov qword [r13 + rax - 0x58], rcx
mov qword [r13 + rax - 0x50], rcx
mov qword [r13 + rax - 0x48], r12
mov qword [r13 + rax - 0x40], r12
mov qword [r13 + rax - 0x38], rsi
mov qword [r13 + rax - 0x30], rsi
mov rcx, qword [rsp + 0x278]
mov qword [r13 + rax - 0x28], rcx
mov qword [r13 + rax - 0x20], rcx
mov qword [r13 + rax - 0x18], rbp
mov qword [r13 + rax - 0x10], rbp
mov byte [r13 + rax - 8], 1
inc qword [rsp + 0x3f0]
jmp 0x140003798
mov r13d, dword [rsp + 0x4a8]
xor ecx, ecx
lea rsi, [rsp + 0xf0]
lea rbx, [rsp + 0x130]
cmp rcx, r13
je 0x140003341
lea rbp, [rcx + 1]
shl rcx, 3
add rcx, qword [rsp + 0xb0]
and qword [rsp + 0xf0], 0
mov rdx, rsi
call sub.secur32.dll_LsaGetLogonSessionData
test eax, eax
je 0x1400039a6
mov rcx, qword [rsp + 0xf0]
test rcx, rcx
je 0x140003a16
call sub.secur32.dll_LsaFreeReturnBuffer
jmp 0x140003a16
mov rax, qword [rsp + 0xf0]
test rax, rax
je 0x140003a16
cmp dword [rax + 0x40], 3
je 0x140003a16
mov rdx, qword [rax + 0x18]
lea rcx, [rsp + 0x60]
call fcn.1400487bb
mov rdx, qword [rsp + 0x1d8]
mov r15, qword [rsp + 0x68]
mov r12, qword [rsp + 0x70]
imul r14, qword [rsp + 0x1e0], 0x48
test r14, r14
je 0x140003a1e
lea rdi, [rdx + 0x48]
mov rcx, qword [rdx + 8]
mov rdx, qword [rdx + 0x10]
mov r8, r15
mov r9, r12
call fcn.14004adcb
add r14, 0xffffffffffffffb8
mov rdx, rdi
test al, al
je 0x1400039e2
mov rcx, qword [rsp + 0x60]
mov rdx, r15
call fcn.14001203c
mov rcx, rbp
jmp 0x140003964
mov rcx, rbx
mov rdx, r15
mov r8, r12
call fcn.140009b10
mov rcx, rbx
call fcn.14004881f
movdqu xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x130], xmm0
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x140], rcx
mov qword [rsp + 0x160], rax
mov qword [rsp + 0x168], rdx
and dword [rsp + 0x170], 0
and qword [rsp + 0x148], 0
mov qword [rsp + 0x150], 8
and qword [rsp + 0x158], 0
lea rcx, [rsp + 0x1d0]
mov rdx, rbx
call fcn.14004d161
jmp 0x140003992
mov rbx, r15
lea rcx, [rsp + 0x60]
mov qword [rcx + 8], rbx
call fcn.14004b964
mov rcx, qword [rsp + 0x1d0]
call sub.iphlpapi.dll_FreeMibTable
lea rsi, [rsp + 0x130]
mov rcx, rsi
call fcn.14004b667
mov rax, qword [rsp + 0x3d8]
mov rcx, qword [rsp + 0x3e0]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r14, qword [rsp + 0x3f0]
mov qword [rsi], rax
add rax, 0x10
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov word [rsi + 0x18], dx
mov qword [rsi + 0x20], r14
mov ebx, 0x88
test r14, r14
je 0x140002a7a
mov rcx, rsi
call fcn.14004a934
mov r14, qword [rsp + 0x150]
dec r14
mov qword [rsp + 0x150], r14
test rax, rax
je 0x140002a7a
mov rdi, rax
cmp byte [rax - 8], 0
jne 0x140003b0d
mov rax, qword [rsp + 0x3d8]
sub rax, rdi
cqo
idiv rbx
lea rcx, [rsp + 0x3d8]
mov rdx, rax
call fcn.14004c8c7
mov rcx, qword [rdi - 0x88]
mov rdx, qword [rdi - 0x80]
call fcn.14001203c
jmp 0x140003b0d
movd xmm8, dword [rsp + 0x1d0]
movss xmm9, dword [rsp + 0x1d8]
mov rax, qword [rsp + 0x258]
mov qword [rsp + 0x160], rax
movdqu xmm0, xmmword [rsp + 0x228]
movups xmm1, xmmword [rsp + 0x238]
movups xmm2, xmmword [rsp + 0x248]
movaps xmmword [rsp + 0x150], xmm2
movaps xmmword [rsp + 0x140], xmm1
movdqa xmmword [rsp + 0x130], xmm0
lea rdx, [0x1403eb906]
lea rcx, [rsp + 0xb0]
mov r14d, 8
mov r8d, 8
call fcn.140045925
lea rax, [rsp + 0x230]
mov rcx, qword [rax - 8]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmm2, xmmword [rax + 0x20]
movaps xmmword [rsp + 0x60], xmm0
movaps xmmword [rsp + 0x70], xmm1
movaps xmmword [rsp + 0x80], xmm2
mov rax, qword [rsp + 0xc0]
mov qword [rsp + 0xa0], rax
movdqu xmm0, xmmword [rsp + 0xb0]
movdqa xmmword [rsp + 0x90], xmm0
cmp rcx, 3
je 0x140002a3a
lea rax, [rsp + 0x138]
mov qword [rax - 8], rcx
lea rsi, [rsp + 0x60]
mov ecx, 9
mov rdi, rax
rep movsq qword [rdi], qword [rsi]
mov dword [rax + 0x48], ebx
movss dword [rax + 0x4c], xmm9
movd dword [rax + 0x50], xmm8
movd dword [rax + 0x54], xmm8
mov ecx, 0x60
mov edx, 8
call fcn.14004875e
mov r14, rax
lea rsi, [rsp + 0x130]
mov ecx, 0xc
mov rdi, rax
rep movsq qword [rdi], qword [rsi]
mov esi, 1
jmp 0x140002a3c
mov ecx, 8
mov rdx, rdi
call fcn.140008e20
jmp 0x140003d1f
mov edx, 0x14
mov rcx, rdi
mov r8, rsi
call fcn.14000b8b0
jmp 0x140003d1f
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x68], r15
lea rax, str._home_anon_.cargo_registry_src_index.crates.io_6f17d22bba15001f_sysinfo_0.26.9_src_windows_network.rs
mov edx, 0x101
mov rcx, r8
mov r8, rax
call fcn.14000a510
jmp 0x140003d1f
lea rax, [0x1403eb5c0]
mov qword [rsp + 0x20], rax
lea rcx, str.cannot_access_a_Thread_Local_Storage_value_during_or_after_destruction_rustc_eeb90cda1969383f56a2637cbd3037bdf598841clibrary_std_src_threadlocal.rs
lea r9, [0x1403eb630]
lea r8, [rsp + 0x2d0]
mov edx, 0x46
call fcn.14000b6f0
mov ecx, 8
mov edx, 0x120
call fcn.140008e20
ud2
lea rsi, [0x1403ebf18]
mov edx, 0x1b
lea rdi, str.global_key_idle_disappeared_home_anon_.cargo_registry_src_index.crates.io_6f17d22bba15001f_sysinfo_0.26.9_src_windows_system.rs
jmp 0x140003cb4