Function at 0x140173ef0
Capabilities:
Get mac address on windows
Get memory capacity
Get session user name
Get system firmware table

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x4c8]
sub rsp, 0x5c8
mov r15, rdx
xor r13d, r13d
mov dword [rbp - 0x80], r13d
mov bl, bl
mov cl, cl
mov al, al
lea rcx, [rbp + 0x180]
call fcn.140171f38
nop
mov dword [rbp - 0x80], reloc.WS2_32.dll_recv
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov esi, 0x52534d42
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
mov ebx, eax
lea rcx, [rbp - 0x78]
test eax, eax
je 0x140175630
call fcn.140175be0
nop
mov edx, ebx
lea rcx, [rbp - 0x78]
call fcn.1401761d8
mov r9d, ebx
mov rdi, qword [rbp - 0x78]
mov r8, rdi
xor edx, edx
mov ecx, esi
call qword [sym.imp.KERNEL32.dll_GetSystemFirmwareTable]
lea rbx, [rdi + 8]
mov qword [rbp + 0x520], rbx
test rbx, rbx
je 0x14017564d
mov esi, dword [rdi + 4]
add rsi, qword [rbx]
cmp rbx, rsi
jae 0x1401741eb
mov rdx, rbx
mov rdi, rbx
mov r8, rbx
mov r14, rbx
mov r9, rbx
mov rcx, rbx
mov rax, qword [rbp + 0x520]
cmp byte [rax], 0x7f
jne 0x140173fd5
mov rbx, rdx
mov rdi, r8
mov r14, r9
cmp byte [rcx + 1], 4
je 0x1401741eb
lea rcx, [rbp + 0x520]
mov qword [rbp + 0x510], rcx
movzx ecx, byte [rax]
test ecx, ecx
je 0x140174110
sub ecx, 1
je 0x14017407d
cmp ecx, 1
jne 0x14017419a
mov r8b, byte [rbx + 4]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x510]
call fcn.140172008
mov rdx, rax
lea rcx, [rbp + 0x240]
call fcn.140156024
lea rcx, [rsp + 0x30]
call fcn.140155fc8
mov r8b, byte [rbx + 5]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x510]
call fcn.140172008
mov rdx, rax
lea rcx, [rbp + 0x260]
call fcn.140156024
lea rcx, [rsp + 0x30]
call fcn.140155fc8
mov r8b, byte [rbx + 7]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x510]
call fcn.140172008
lea rcx, [rbp + 0x280]
jmp 0x140174188
mov r8b, byte [rdi + 4]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x510]
call fcn.140172008
mov rdx, rax
lea rcx, [rbp + 0x1e0]
call fcn.140156024
lea rcx, [rsp + 0x30]
call fcn.140155fc8
mov r8b, byte [rdi + 5]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x510]
call fcn.140172008
mov rdx, rax
lea rcx, [rbp + 0x200]
call fcn.140156024
lea rcx, [rsp + 0x30]
call fcn.140155fc8
cmp byte [rdi + 1], 8
jbe 0x14017419a
lea r8, [rdi + 8]
lea rcx, [rbp - 0x60]
call fcn.14016f0d8
movaps xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x30], xmm0
lea r8, [rbp - 0x30]
lea rdx, [rsp + 0x30]
call fcn.140172074
lea rcx, [rbp + 0x220]
jmp 0x140174188
mov r8b, byte [r14 + 8]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x510]
call fcn.140172008
mov rdx, rax
lea rcx, [rbp + 0x1c0]
call fcn.140156024
lea rcx, [rsp + 0x30]
call fcn.140155fc8
mov r8b, byte [r14 + 4]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x510]
call fcn.140172008
mov rdx, rax
lea rcx, [rbp + 0x180]
call fcn.140156024
lea rcx, [rsp + 0x30]
call fcn.140155fc8
mov r8b, byte [r14 + 5]
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x510]
call fcn.140172008
lea rcx, [rbp + 0x1a0]
mov rdx, rax
call fcn.140156024
lea rcx, [rsp + 0x30]
call fcn.140155fc8
mov rcx, qword [rbp + 0x520]
movzx ebx, byte [rcx + 1]
add rbx, rcx
lea rcx, [rsi - 1]
cmp rbx, rcx
jae 0x1401741c5
mov al, byte [rbx]
lea rdx, [rbx + 1]
or al, byte [rdx]
je 0x1401741c5
mov rbx, rdx
mov al, byte [rdx]
cmp rdx, rcx
jb 0x1401741b3
add rbx, 2
mov rcx, rbx
mov qword [rbp + 0x520], rbx
mov rdx, rbx
mov rdi, rbx
mov r8, rbx
mov r14, rbx
mov r9, rbx
cmp rbx, rsi
jb 0x140173fb6
lea rcx, [rbp - 0x78]
call fcn.14015fb18
nop
lea rcx, [rbp + 0xa0]
call fcn.140172d00
nop
mov dword [rbp - 0x80], 0x20
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x50]
mov edx, 8
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14017566e
mov rcx, qword [rbp + 0x50]
cmp rcx, 0xffffffffffffffff
je 0x1401756c0
mov dword [rbp + 0x510], r13d
lea rax, [rbp + 0x510]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea r12d, [r9 + 1]
mov edx, r12d
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x140174270
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x1401756e1
mov ebx, dword [rbp + 0x510]
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, ebx
mov edx, 8
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov rbx, rax
mov rcx, qword [rbp + 0x50]
test rax, rax
je 0x14017573d
lea rax, [rbp + 0x510]
mov qword [rsp + 0x20], rax
mov r9d, dword [rbp + 0x510]
mov r8, rbx
mov edx, r12d
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x140175764
lea rdx, [rbp - 0x30]
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_ConvertSidToStringSidA]
test eax, eax
je 0x1401757d4
mov rdx, qword [rbp - 0x30]
lea rcx, [rbp + 0xc0]
call fcn.140164614
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [rbp + 0x528], 0x101
lea rdx, [rbp + 0x528]
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x140175844
lea rdx, [rbp + 0x2a0]
lea rcx, [rbp + 0xa0]
call fcn.140164614
nop
lea rcx, [rsp + 0x70]
call fcn.1401761b8
nop
lea rax, [rbp - 0x60]
mov qword [rbp + 0x510], rax
movdqa xmm0, xmmword [0x140f115d0]
movdqu xmmword [rbp - 0x30], xmm0
mov eax, 0x80000000
xor ecx, ecx
cpuid
mov r9d, eax
mov dword [rbp - 0x2c], ebx
mov dword [rbp - 0x28], ecx
mov dword [rbp - 0x24], edx
mov r8d, 0x80000000
cmp eax, r8d
jb 0x1401743d9
mov eax, r8d
xor ecx, ecx
cpuid
mov dword [rbp - 0x30], eax
mov dword [rbp - 0x2c], ebx
mov dword [rbp - 0x28], ecx
mov dword [rbp - 0x24], edx
cmp r8d, 0x80000002
jne 0x1401743ab
movups xmm0, xmmword [rbp - 0x30]
movdqu xmmword [rbp + 0x10], xmm0
jmp 0x1401743d1
cmp r8d, 0x80000003
jne 0x1401743bf
movups xmm0, xmmword [rbp - 0x30]
movdqu xmmword [rbp + 0x20], xmm0
jmp 0x1401743d1
cmp r8d, 0x80000004
jne 0x1401743d1
movups xmm0, xmmword [rbp - 0x30]
movdqu xmmword [rbp + 0x30], xmm0
add r8d, r12d
cmp r8d, r9d
jbe 0x140174384
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x30]
call fcn.1401560e0
nop
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x60]
call fcn.1401784f4
mov rbx, rax
lea rdx, [0x140f041f4]
lea rcx, [rsp + 0x70]
call fcn.1401784ac
mov rcx, rax
mov rdx, rbx
call fcn.140176180
nop
lea rcx, [rsp + 0x30]
call fcn.140155fc8
lea rax, [rbp - 0x60]
mov qword [rbp + 0x510], rax
lea rdx, [rbp + 0x180]
lea rcx, [rbp - 0x60]
call fcn.14017857c
mov rbx, rax
lea rdx, str.BiosVendor
lea rcx, [rsp + 0x70]
call fcn.1401784ac
mov rcx, rax
mov rdx, rbx
call fcn.140176180
lea rax, [rbp - 0x60]
mov qword [rbp + 0x510], rax
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp - 0x60]
call fcn.14017857c
mov rbx, rax
lea rdx, str.BiosVersion
lea rcx, [rsp + 0x70]
call fcn.1401784ac
mov rcx, rax
mov rdx, rbx
call fcn.140176180
lea rax, [rbp - 0x60]
mov qword [rbp + 0x510], rax
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp - 0x60]
call fcn.14017857c
mov rbx, rax
lea rdx, str.BiosReleaseData
lea rcx, [rsp + 0x70]
call fcn.1401784ac
mov rcx, rax
mov rdx, rbx
call fcn.140176180
lea rax, [rbp - 0x60]
mov qword [rbp + 0x510], rax
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp - 0x60]
call fcn.14017857c
mov rbx, rax
lea rdx, str.SystemVendor
lea rcx, [rsp + 0x70]
call fcn.1401784ac
mov rcx, rax
mov rdx, rbx
call fcn.140176180
lea rax, [rbp - 0x60]
mov qword [rbp + 0x510], rax
lea rdx, [rbp + 0x200]
lea rcx, [rbp - 0x60]
call fcn.14017857c
mov rbx, rax
lea rdx, str.SystemProduct
lea rcx, [rsp + 0x70]
call fcn.1401784ac
mov rcx, rax
mov rdx, rbx
call fcn.140176180
lea rax, [rbp - 0x60]
mov qword [rbp + 0x510], rax
lea rdx, [rbp + 0x240]
lea rcx, [rbp - 0x60]
call fcn.14017857c
mov rbx, rax
lea rdx, str.MotherBoardVendor
lea rcx, [rsp + 0x70]
call fcn.1401784ac
mov rcx, rax
mov rdx, rbx
call fcn.140176180
lea rax, [rbp - 0x60]
mov qword [rbp + 0x510], rax
lea rdx, [rbp + 0x260]
lea rcx, [rbp - 0x60]
call fcn.14017857c
mov rbx, rax
lea rdx, str.MotherBoardProduct
lea rcx, [rsp + 0x70]
call fcn.1401784ac
mov rcx, rax
mov rdx, rbx
call fcn.140176180
lea rax, [rbp - 0x60]
mov qword [rbp + 0x510], rax
lea rdx, [rbp + 0xa0]
lea rcx, [rbp - 0x60]
call fcn.14017857c
mov rbx, rax
lea rdx, str.ComputerName
lea rcx, [rsp + 0x70]
call fcn.1401784ac
mov rcx, rax
mov rdx, rbx
call fcn.140176180
lea rax, [rbp - 0x60]
mov qword [rbp + 0x520], rax
mov dword [rsp + 0x30], 0x40
lea rcx, [rsp + 0x30]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x38]
shr rax, 0xa
mov dword [rbp + 0x510], eax
lea rdx, [rbp + 0x510]
lea rcx, [rbp - 0x60]
call fcn.140178610
mov rbx, rax
lea rdx, str.RamSize
lea rcx, [rsp + 0x70]
call fcn.1401784ac
mov rcx, rax
mov rdx, rbx
call fcn.140176180
lea rcx, [rbp - 0x78]
call fcn.140175be0
nop
mov dword [rbp - 0x80], 0xc0
mov ecx, 0x2c0
mov dword [rbp + 0x520], ecx
call fcn.140cd46c0
mov rdi, rax
test rax, rax
je 0x14017490a
lea rdx, [rbp + 0x520]
mov rcx, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x1401746ad
mov rcx, rdi
call fcn.140cccd80
mov ecx, dword [rbp + 0x520]
call fcn.140cd46c0
mov rdi, rax
test rax, rax
je 0x14017490a
lea rdx, [rbp + 0x520]
mov rcx, rdi
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x140174901
mov rbx, rdi
test rdi, rdi
je 0x14017490a
mov byte [rbp + 0x510], gethostbyaddr
lea rcx, [rbp + 0xe0]
call fcn.140172b14
nop
lea rdx, [rbx + 0xc]
lea rcx, [rbp + 0xe0]
call fcn.140164614
lea rdx, [rbx + 0x110]
lea rcx, [rbp + 0x100]
call fcn.140164614
lea rdx, [rbx + 0x1c0]
lea rcx, [rbp + 0x160]
call fcn.140164614
lea rcx, [rbp - 0x10]
call fcn.140156174
nop
mov edx, dword [rbx + 0x1a4]
mov eax, edx
sub eax, 1
je 0x1401747ce
sub eax, 5
je 0x1401747c5
sub eax, 3
je 0x1401747bc
sub eax, 6
je 0x1401747b3
sub eax, 8
je 0x1401747aa
sub eax, 1
je 0x1401747a1
cmp eax, 4
je 0x140174798
lea rcx, [rbp - 0x60]
call fcn.14016f114
nop
mov r8, rax
lea rdx, str.Unknown_type
lea rcx, [rsp + 0x30]
call fcn.14015935c
mov rdx, rax
lea rcx, [rbp - 0x10]
call fcn.140156024
lea rcx, [rsp + 0x30]
call fcn.140155fc8
nop
lea rcx, [rbp - 0x60]
call fcn.140155fc8
jmp 0x1401747de
lea rdx, str.SLIP
jmp 0x1401747d5
lea rdx, str.Loopback
jmp 0x1401747d5
lea rdx, [0x140f03eb4]
jmp 0x1401747d5
lea rdx, str.FDDI
jmp 0x1401747d5
lea rdx, str.Token_Ring
jmp 0x1401747d5
lea rdx, str.Ethernet
jmp 0x1401747d5
lea rdx, str.Other
lea rcx, [rbp - 0x10]
call fcn.140164614
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x140]
call fcn.140155f5c
mov edx, r12d
lea rcx, [rbp + 0x2a0]
call fcn.14016a040
nop
lea rdx, [0x140165b24]
lea rcx, [rbp + 0x2b0]
call fcn.14016ac34
lea rdx, [0x14016f1fc]
mov rcx, rax
call fcn.14016ac34
lea rdx, [rbp + 0x510]
mov rcx, rax
call fcn.14016d7ec
mov esi, r13d
cmp dword [rbx + 0x194], r13d
jbe 0x140174898
lea r14, [rbx + 0x198]
mov edx, 2
lea rcx, [rbp + 0x10]
call fcn.140cbd54c
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.14016d7c4
movzx edx, byte [r14]
mov rcx, rax
call fcn.140176248
inc esi
lea rcx, [0x140f02908]
lea rdx, [0x140dfebef]
cmp esi, dword [rbx + 0x194]
cmovb rdx, rcx
mov rcx, rax
call fcn.1401780f8
add r14, r12
cmp esi, dword [rbx + 0x194]
jb 0x140174842
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x2a0]
call fcn.140169e84
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.140156024
lea rcx, [rsp + 0x30]
call fcn.140155fc8
lea rdx, [rbp + 0xe0]
lea rcx, [rbp - 0x78]
call fcn.140175c24
mov rbx, qword [rbx]
lea rcx, [rbp + 0x2a0]
call fcn.140165c80
nop
lea rcx, [rbp - 0x10]
call fcn.140155fc8
nop
lea rcx, [rbp + 0xe0]
call fcn.140172b78
test rbx, rbx
jne 0x1401746d8
mov rcx, rdi
call fcn.140cccd80
nop
mov esi, r13d
lea rcx, [rbp - 0x78]
call fcn.140175c00
test rax, rax
je 0x140174b00
mov rdi, r13
lea r14, str.InternetAdapters
lea rax, [rbp - 0x60]
mov qword [rbp + 0x510], rax
mov rdx, rdi
lea rcx, [rbp - 0x78]
call fcn.140175bf4
mov rdx, rax
lea rcx, [rbp - 0x60]
call fcn.14017857c
mov rbx, rax
mov rdx, r14
lea rcx, [rsp + 0x70]
call fcn.1401784ac
mov rdx, rdi
mov rcx, rax
call fcn.140175e28
lea rdx, str.Name
mov rcx, rax
call fcn.1401784ac
mov rcx, rax
mov rdx, rbx
call fcn.140176180
lea rax, [rbp - 0x30]
mov qword [rbp + 0x510], rax
mov rdx, rdi
lea rcx, [rbp - 0x78]
call fcn.140175bf4
lea rdx, [rax + 0x20]
lea rcx, [rbp - 0x30]
call fcn.14017857c
mov rbx, rax
mov rdx, r14
lea rcx, [rsp + 0x70]
call fcn.1401784ac
mov rdx, rdi
mov rcx, rax
call fcn.140175e28
lea rdx, str.Desc
mov rcx, rax
call fcn.1401784ac
mov rcx, rax
mov rdx, rbx
call fcn.140176180
lea rax, [rbp + 0x50]
mov qword [rbp + 0x510], rax
mov rdx, rdi
lea rcx, [rbp - 0x78]
call fcn.140175bf4
lea rdx, [rax + 0x40]
lea rcx, [rbp + 0x50]
call fcn.14017857c
mov rbx, rax
mov rdx, r14
lea rcx, [rsp + 0x70]
call fcn.1401784ac
mov rdx, rdi
mov rcx, rax
call fcn.140175e28
lea rdx, [0x140f0429c]
mov rcx, rax
call fcn.1401784ac
mov rcx, rax
mov rdx, rbx
call fcn.140176180
lea rax, [rbp - 0x10]
mov qword [rbp + 0x510], rax
mov rdx, rdi
lea rcx, [rbp - 0x78]
call fcn.140175bf4
lea rdx, [rax + 0x80]
lea rcx, [rbp - 0x10]
call fcn.14017857c
mov rbx, rax
mov rdx, r14
lea rcx, [rsp + 0x70]
call fcn.1401784ac
mov rdx, rdi
mov rcx, rax
call fcn.140175e28
lea rdx, str.AdapterIP
mov rcx, rax
call fcn.1401784ac
mov rcx, rax
mov rdx, rbx
call fcn.140176180
lea rax, [rbp + 0x10]
mov qword [rbp + 0x510], rax
mov rdx, rdi
lea rcx, [rbp - 0x78]
call fcn.140175bf4
lea rdx, [rax + 0x60]
lea rcx, [rbp + 0x10]
call fcn.14017857c
mov rbx, rax
mov rdx, r14
lea rcx, [rsp + 0x70]
call fcn.1401784ac
mov rdx, rdi
mov rcx, rax
call fcn.140175e28
lea rdx, str.AdapterType
mov rcx, rax
call fcn.1401784ac
mov rcx, rax
mov rdx, rbx
call fcn.140176180
add esi, r12d
movsxd rdi, esi
lea rcx, [rbp - 0x78]
call fcn.140175c00
cmp rdi, rax
jb 0x140174929
lea rdx, [rbp + 0x80]
call fcn.140171cbc
nop
mov esi, r13d
lea rcx, [rbp + 0x80]
call fcn.140175d14
test rax, rax
je 0x140174c02
mov rdi, r13
lea rax, [rbp + 0x10]
mov qword [rbp + 0x510], rax
mov rdx, rdi
lea rcx, [rbp + 0x80]
call fcn.140175d08
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.14017857c
mov rbx, rax
lea rdx, str.AccountGPU
lea rcx, [rsp + 0x70]
call fcn.1401784ac
mov rdx, rdi
mov rcx, rax
call fcn.140175e28
lea rdx, str.Name
mov rcx, rax
call fcn.1401784ac
mov rcx, rax
mov rdx, rbx
call fcn.140176180
lea rax, [rbp - 0x10]
mov qword [rbp + 0x510], rax
mov rdx, rdi
lea rcx, [rbp + 0x80]
call fcn.140175d08
lea rdx, [rax + 0x20]
lea rcx, [rbp - 0x10]
call fcn.140178650
mov rbx, rax
lea rdx, str.AccountGPU
lea rcx, [rsp + 0x70]
call fcn.1401784ac
mov rdx, rdi
mov rcx, rax
call fcn.140175e28
lea rdx, str.IsActive
mov rcx, rax
call fcn.1401784ac
mov rcx, rax
mov rdx, rbx
call fcn.140176180
add esi, r12d
movsxd rdi, esi
lea rcx, [rbp + 0x80]
call fcn.140175d14
cmp rdi, rax
jb 0x140174b28
lea rcx, [rbp + 0x50]
call fcn.140175be0
nop
mov dword [rbp - 0x80], 8
lea rdx, str.SOFTWAREValveSteam
lea rcx, [rbp + 0x10]
call fcn.1401560e0
nop
lea r8, [rbp + 0x10]
mov rdx, 0xffffffff80000001
lea rcx, [rbp - 0x60]
call fcn.14015e894
nop
lea rcx, [rbp + 0x10]
call fcn.140155fc8
lea rdx, str.SteamPath
lea rcx, [rbp + 0x10]
call fcn.1401560e0
nop
lea r8, [rbp + 0x10]
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x60]
call fcn.14015ed70
nop
lea rcx, [rbp + 0x10]
call fcn.140155fc8
lea rdx, str.configloginusers.vdf
lea rcx, [rsp + 0x30]
call fcn.14016ad34
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x10]
call fcn.140162d9c
nop
lea rcx, [rbp - 0x10]
call fcn.140167468
mov bl, al
lea rcx, [rbp - 0x10]
call fcn.140162944
test bl, bl
je 0x140174e53
mov dword [rsp + 0x20], r12d
mov r9d, 0x40
mov r8d, r12d
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x3b0]
call fcn.1401698e8
nop
lea rcx, [rbp + 0x510]
call fcn.14016f218
mov r8, rax
lea rdx, [rbp + 0x3b0]
lea rcx, [rbp + 0x2a0]
call fcn.140178410
nop
lea rdx, [rbp + 0x510]
lea rcx, [rbp + 0x300]
call fcn.1401758bc
mov rdx, qword [rbp + 0x308]
mov qword [rbp + 0x528], rdx
jmp 0x140174e1e
lea rcx, [rbp + 0x510]
call fcn.1401758a8
mov rdi, rax
lea rcx, [rbp + 0xe0]
call fcn.140172d28
nop
mov rbx, qword [rdi + 0x20]
lea rdx, str.AccountName
lea rcx, [rbp + 0x10]
call fcn.1401560e0
nop
lea rdx, [rbp + 0x10]
lea rcx, [rbx + 0x20]
call fcn.1401758cc
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.140155f5c
nop
lea rcx, [rbp + 0x10]
call fcn.140155fc8
mov rbx, qword [rdi + 0x20]
lea rdx, str.PersonaName
lea rcx, [rbp + 0x10]
call fcn.1401560e0
nop
lea rdx, [rbp + 0x10]
lea rcx, [rbx + 0x20]
call fcn.1401758cc
mov rdx, rax
lea rcx, [rbp + 0x120]
call fcn.140155f5c
nop
lea rcx, [rbp + 0x10]
call fcn.140155fc8
mov rdx, rdi
lea rcx, [rbp + 0xe0]
call fcn.140155f5c
mov rbx, qword [rdi + 0x20]
lea rdx, str.mostrecent
lea rcx, [rbp + 0x10]
call fcn.1401560e0
nop
lea rdx, [rbp + 0x10]
lea rcx, [rbx + 0x20]
call fcn.1401758cc
mov rcx, rax
lea rdx, [0x140dff028]
call fcn.140164d8c
mov byte [rbp + 0x140], al
lea rcx, [rbp + 0x10]
call fcn.140155fc8
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x50]
call fcn.140175b08
nop
lea rcx, [rbp + 0xe0]
call fcn.1401679ec
lea rcx, [rbp + 0x510]
call fcn.140175898
lea rdx, [rbp + 0x528]
lea rcx, [rbp + 0x510]
call fcn.1401758b0
test al, al
je 0x140174d14
lea rcx, [rbp + 0x2a0]
call fcn.140172d60
nop
lea rcx, [rbp + 0x3b0]
call fcn.140168a40
nop
lea rcx, [rsp + 0x30]
call fcn.140155fc8
nop
lea rcx, [rbp - 0x60]
call fcn.14015eb04
nop
mov dword [rbp + 0x510], r13d
mov rcx, qword [rbp + 0x58]
mov r12, qword [rbp + 0x50]
sub rcx, r12
movabs rax, 0x4ec4ec4ec4ec4ec5
imul rcx
mov r14, rdx
sar r14, 5
mov rax, r14
shr rax, 0x3f
add r14, rax
je 0x140175152
mov r15d, r13d
lea rax, [rbp + 0x10]
mov qword [rbp + 0x510], rax
imul rsi, r13, 0x68
add rsi, r12
lea rdx, [rsi + 0x40]
lea rcx, [rbp + 0x10]
call fcn.14017857c
mov rdi, rax
xor ebx, ebx
mov word [rsp + 0x3e], bx
mov qword [rsp + 0x40], reloc.WS2_32.dll_listen
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.SteamAccounts]
movsd qword [rsp + 0x30], xmm0
mov ecx, dword [0x140f042f8]
mov dword [rsp + 0x38], ecx
mov al, byte [reloc.WS2_32.dll_WSAStartup]
mov byte [rsp + 0x3c], al
mov byte [rsp + 0x3d], bl
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.1401793d8
mov rdx, r13
mov rcx, rax
call fcn.140175e28
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 4
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov dword [rsp + 0x30], 0x656d614e
mov byte [rsp + 0x34], bl
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.1401793d8
nop
mov dl, byte [rax]
mov cl, byte [rdi]
mov byte [rax], cl
mov byte [rdi], dl
lea rcx, [rdi + 8]
mov rdx, qword [rax + 8]
mov rbx, qword [rcx]
mov qword [rax + 8], rbx
mov qword [rcx], rdx
mov dl, byte [rdi]
call fcn.140177434
nop
lea rax, [rbp - 0x10]
mov qword [rbp + 0x510], rax
lea rdx, [rsi + 0x20]
lea rcx, [rbp - 0x10]
call fcn.14017857c
mov rdi, rax
xor ebx, ebx
mov word [rsp + 0x3e], bx
mov qword [rsp + 0x40], reloc.WS2_32.dll_listen
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
movsd xmm0, qword [str.SteamAccounts]
movsd qword [rsp + 0x30], xmm0
mov ecx, dword [0x140f042f8]
mov dword [rsp + 0x38], ecx
mov al, byte [reloc.WS2_32.dll_WSAStartup]
mov byte [rsp + 0x3c], al
mov byte [rsp + 0x3d], bl
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x70]
call fcn.1401793d8
mov rdx, r13
mov rcx, rax
call fcn.140175e28
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 5
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov ecx, dword [str.Login]
mov dword [rsp + 0x30], ecx
mov cl, byte [0x140f042e8]
mov byte [rsp + 0x34], cl
mov byte [rsp + 0x35], bl
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.1401793d8
nop
mov dl, byte [rax]
mov cl, byte [rdi]
mov byte [rax], cl
mov byte [rdi], dl
lea rcx, [rdi + 8]
mov rbx, qword [rax + 8]
mov r8, qword [rcx]
mov qword [rax + 8], r8
mov qword [rcx], rbx
mov dl, byte [rdi]
call fcn.140177434
nop
lea rax, [rbp - 0x60]
mov qword [rbp + 0x510], rax
mov rdx, rsi
lea rcx, [rbp - 0x60]
call fcn.14017857c
mov rbx, rax
lea rdx, str.SteamAccounts
lea rcx, [rsp + 0x70]
call fcn.1401784ac
mov rdx, r13
mov rcx, rax
call fcn.140175e28
lea rdx, str.SteamID
mov rcx, rax
call fcn.1401784ac
mov rcx, rax
mov rdx, rbx
call fcn.140176180
lea rax, [rbp - 0x30]
mov qword [rbp + 0x510], rax
mov rdx, r13
lea rcx, [rbp + 0x50]
call fcn.140175b00
lea rdx, [rax + 0x60]
lea rcx, [rbp - 0x30]
call fcn.140178650
mov rdi, rax
lea rdx, str.SteamAccounts
lea rcx, [rsp + 0x70]
call fcn.1401784ac
mov rdx, r13
mov rcx, rax
call fcn.140175e28
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], 8
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
movabs rcx, 0x746e656365527349
mov qword [rsp + 0x30], rcx
mov byte [rsp + 0x38], 0
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.1401793d8
nop
mov dl, byte [rax]
mov cl, byte [rdi]
mov byte [rax], cl
mov byte [rdi], dl
lea rcx, [rdi + 8]
mov rdx, qword [rax + 8]
mov rbx, qword [rcx]
mov qword [rax + 8], rbx
mov qword [rcx], rdx
mov dl, byte [rdi]
call fcn.140177434
nop
inc r15d
movsxd r13, r15d
cmp r13, r14
jb 0x140174ea1
mov r15, qword [rbp + 0x518]
xor r13d, r13d
lea rax, [rbp + 0x10]
mov qword [rbp + 0x510], rax
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x10]
call fcn.14017857c
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], 2
mov r14d, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x18], r14
mov esi, 0x7175
mov word [rbp - 0x30], si
mov byte [rbp - 0x2e], r13b
lea rdx, [rbp - 0x30]
lea rcx, [rsp + 0x70]
call fcn.1401793d8
mov qword [rsp + 0x38], r13
lea r12d, [r14 - 8]
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r14
mov rcx, qword [str.field_1]
mov dword [rsp + 0x30], ecx
movzx ecx, word [0x140f0430c]
mov word [rsp + 0x34], cx
mov cl, byte [0x140f0430e]
mov byte [rsp + 0x36], cl
mov byte [rsp + 0x37], r13b
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.1401793d8
nop
mov dl, byte [rax]
mov cl, byte [rdi]
mov byte [rax], cl
mov byte [rdi], dl
lea rcx, [rdi + 8]
mov rdx, qword [rax + 8]
mov rbx, qword [rcx]
mov qword [rax + 8], rbx
mov qword [rcx], rdx
mov dl, byte [rdi]
call fcn.140177434
nop
lea rax, [rbp - 0x10]
mov qword [rbp + 0x510], rax
lea rdx, [rbp + 0x220]
lea rcx, [rbp - 0x10]
call fcn.14017857c
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], 2
mov qword [rbp + 0x28], r14
mov word [rbp + 0x10], si
mov byte [rbp + 0x12], r13b
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x70]
call fcn.1401793d8
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r14
mov rcx, qword [str.field_2]
mov dword [rsp + 0x30], ecx
movzx ecx, word [0x140f0431c]
mov word [rsp + 0x34], cx
mov cl, byte [0x140f0431e]
mov byte [rsp + 0x36], cl
mov byte [rsp + 0x37], r13b
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.1401793d8
nop
mov dl, byte [rax]
mov cl, byte [rdi]
mov byte [rax], cl
mov byte [rdi], dl
lea rcx, [rdi + 8]
mov rdx, qword [rax + 8]
mov rbx, qword [rcx]
mov qword [rax + 8], rbx
mov qword [rcx], rdx
mov dl, byte [rdi]
call fcn.140177434
nop
lea rax, [rbp - 0x60]
mov qword [rbp + 0x510], rax
lea rdx, [rbp + 0x280]
lea rcx, [rbp - 0x60]
call fcn.14017857c
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], 2
mov qword [rbp + 0x28], r14
mov word [rbp + 0x10], si
mov byte [rbp + 0x12], r13b
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x70]
call fcn.1401793d8
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r14
mov rcx, qword [str.field_3]
mov dword [rsp + 0x30], ecx
movzx ecx, word [0x140f04314]
mov word [rsp + 0x34], cx
mov cl, byte [reloc.WS2_32.dll_gethostbyaddr]
mov byte [rsp + 0x36], cl
mov byte [rsp + 0x37], r13b
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.1401793d8
nop
mov dl, byte [rax]
mov cl, byte [rdi]
mov byte [rax], cl
mov byte [rdi], dl
lea rcx, [rdi + 8]
mov rdx, qword [rax + 8]
mov rbx, qword [rcx]
mov qword [rax + 8], rbx
mov qword [rcx], rdx
mov dl, byte [rdi]
call fcn.140177434
nop
lea rdx, [rbp + 0x68]
call fcn.140172584
nop
mov esi, r13d
mov rax, qword [rbp + 0x70]
mov rcx, qword [rbp + 0x68]
sub rax, rcx
sar rax, 5
test rax, rax
je 0x140175472
mov rbx, r13
mov r15d, 0x7175
lea rax, [rbp + 0x10]
mov qword [rbp + 0x510], rax
mov rdx, rbx
shl rdx, 5
add rdx, rcx
lea rcx, [rbp + 0x10]
call fcn.14017857c
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], 2
mov qword [rbp + 8], r14
mov word [rbp - 0x10], r15w
mov byte [rbp - 0xe], r13b
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x70]
call fcn.1401793d8
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r14
mov rcx, qword [str.field_4]
mov dword [rsp + 0x30], ecx
movzx ecx, word [0x140f0432c]
mov word [rsp + 0x34], cx
mov cl, byte [reloc.WS2_32.dll_gethostbyname]
mov byte [rsp + 0x36], cl
mov byte [rsp + 0x37], r13b
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.1401793d8
mov rdx, rbx
mov rcx, rax
call fcn.140175e28
nop
mov dl, byte [rax]
mov cl, byte [rdi]
mov byte [rax], cl
mov byte [rdi], dl
lea rcx, [rdi + 8]
mov rdx, qword [rax + 8]
mov rbx, qword [rcx]
mov qword [rax + 8], rbx
mov qword [rcx], rdx
mov dl, byte [rdi]
call fcn.140177434
nop
inc esi
movsxd rbx, esi
mov rax, qword [rbp + 0x70]
mov rcx, qword [rbp + 0x68]
sub rax, rcx
sar rax, 5
cmp rbx, rax
jb 0x140175393
mov r15, qword [rbp + 0x518]
lea rsi, [rbp - 0x30]
mov qword [rbp + 0x510], rsi
lea rdx, [rbp - 0x10]
call fcn.140172e40
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xor eax, eax
mov qword [rbp - 0x28], rax
mov dl, byte [rbp - 0x30]
lea rcx, [rbp - 0x28]
call fcn.140177434
mov byte [rbp - 0x30], 3
mov ecx, 0x20
call fcn.140cba3f8
xorps xmm0, xmm0
movups xmmword [rax], xmm0
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], r13
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rax + 0x10], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], r14
mov byte [rbx], r13b
lea rdi, [rsi + 8]
mov qword [rdi], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], 2
mov qword [rbp + 0x28], r14
mov eax, 0x7175
mov word [rbp + 0x10], ax
mov byte [rbp + 0x12], r13b
lea rdx, [rbp + 0x10]
lea rcx, [rsp + 0x70]
call fcn.1401793d8
mov qword [rsp + 0x38], r13
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], r14
mov rcx, qword [str.field_5]
mov dword [rsp + 0x30], ecx
movzx ecx, word [0x140f04324]
mov word [rsp + 0x34], cx
mov cl, byte [0x140f04326]
mov byte [rsp + 0x36], cl
mov byte [rsp + 0x37], r13b
lea rdx, [rsp + 0x30]
mov rcx, rax
call fcn.1401793d8
nop
mov r8b, byte [rax]
mov bl, byte [rsi]
mov byte [rax], bl
mov byte [rsi], r8b
mov rbx, qword [rax + 8]
mov r8, qword [rdi]
mov qword [rax + 8], r8
mov qword [rdi], rbx
mov dl, byte [rsi]
mov rcx, rdi
call fcn.140177434
nop
mov rdx, qword [rbp + 8]
cmp rdx, r14
jbe 0x1401755ac
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1401755a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14017562a
call fcn.140cba258
mov rdx, r15
lea rcx, [rsp + 0x70]
call fcn.140175f70
mov dl, dl
mov dl, dl
mov dl, dl
nop
lea rcx, [rbp + 0x68]
call fcn.140175dc0
nop
lea rcx, [rbp + 0x50]
call fcn.140175b38
nop
lea rcx, [rbp + 0x80]
call fcn.140175d38
nop
lea rcx, [rbp - 0x78]
call fcn.140175c58
nop
mov dl, byte [rsp + 0x70]
lea rcx, [rsp + 0x78]
call fcn.140177434
nop
lea rcx, [rbp + 0xa0]
call fcn.14015e3e0
nop
lea rcx, [rbp + 0x180]
call fcn.1401722b0
mov rax, r15
add rsp, 0x5c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140cd6fcc
nop
lea rdx, str.Failed_to_get_the_size_of_the_firmware.
call fcn.140151880
lea rdx, [0x140f44bc0]
lea rcx, [rbp - 0x78]
call fcn.140cc0808
nop
lea rdx, str.Failed_to_get_the_bios_header.
lea rcx, [rbp + 0x10]
call fcn.140151880
lea rdx, [0x140f44bc0]
lea rcx, [rbp + 0x10]
call fcn.140cc0808
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x520], eax
lea rax, str.Profile_Information:_Failed_to_open_process_token._Error_code:_
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 0x41
lea r8, [rbp + 0x520]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x30]
call fcn.14017834c
nop
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14015e834
lea rdx, [0x140f44bc0]
lea rcx, [rbp - 0x78]
call fcn.140cc0808
nop
lea rdx, str.Profile_Information:_Invalid_token
lea rcx, [rbp - 0x78]
call fcn.140151880
lea rdx, [0x140f44bc0]
lea rcx, [rbp - 0x78]
call fcn.140cc0808
int3
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x520], eax
lea rax, str.Profile_Information:_Failed_to_get_token_information_length._Error_code:_
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 0x4b
lea r8, [rbp + 0x520]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x30]
call fcn.14017834c
nop
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14015e834
lea rdx, [0x140f44bc0]
lea rcx, [rbp - 0x78]
call fcn.140cc0808
nop
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rdx, str.Profile_Information:_Failed_to_allocate_memory_for_token_user
lea rcx, [rbp - 0x78]
call fcn.140151880
lea rdx, [0x140f44bc0]
lea rcx, [rbp - 0x78]
call fcn.140cc0808
int3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x520], eax
lea rax, str.Profile_Information:_Failed_to_get_token_information._Error_code:_
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 0x44
lea r8, [rbp + 0x520]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x30]
call fcn.14017834c
nop
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14015e834
lea rdx, [0x140f44bc0]
lea rcx, [rbp - 0x78]
call fcn.140cc0808
nop
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov rcx, rax
mov r8, rbx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x520], eax
lea rax, str.Profile_Information:_Failed_to_convert_SID_to_string._Error_code:_
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 0x44
lea r8, [rbp + 0x520]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x30]
call fcn.14017834c
nop
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14015e834
lea rdx, [0x140f44bc0]
lea rcx, [rbp - 0x78]
call fcn.140cc0808
nop
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [rbp + 0x520], eax
lea rax, str.Profile_Information:_Failed_to_get_username._Error_code:_
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], 0x3b
lea r8, [rbp + 0x520]
lea rdx, [rbp - 0x60]
lea rcx, [rsp + 0x30]
call fcn.14017834c
nop
mov rdx, rax
lea rcx, [rbp - 0x78]
call fcn.14015e834
lea rdx, [0x140f44bc0]
lea rcx, [rbp - 0x78]
call fcn.140cc0808
int3