Function at 0x140035f80
Capabilities:
Connect to wmi namespace via wbemlocator
Get disk information
Get disk size
Get local ipv4 addresses
Get logon sessions
Get memory capacity
List groups for user account
List user accounts

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa58
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x9c0], xmm8
movdqa xmmword [rbp + 0x9b0], xmm7
movdqa xmmword [rbp + 0x9a0], xmm6
mov qword [rbp + 0x998], 0xfffffffffffffffe
mov qword [rbp + 0x960], rdx
mov qword [rbp + 0x520], rcx
mov eax, dword [0x14006a324]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x80], 0
jne 0x140035fed
call fcn.140035240
mov eax, dword [0x14006a324]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rdi, qword [rax + 0x88]
mov rbx, qword [rax + 0x90]
lea rcx, [rdi + 1]
mov qword [rax + 0x88], rcx
movzx eax, byte [0x14006a320]
mov edx, 0x56410
xor ecx, ecx
call fcn.140030bd0
test rax, rax
je 0x1400395de
mov rsi, rax
add rsi, 0x56000
mov r8d, 0x410
mov rcx, rsi
mov dl, 0xff
call sub.VCRUNTIME140.dll_memset
mov qword [rbp + 0x920], rsi
mov qword [rbp + 0x928], 0x3ff
mov qword [rbp + 0x930], 0x380
mov qword [rbp + 0x938], 0
mov qword [rbp + 0x940], rdi
mov qword [rbp + 0x948], rbx
movzx eax, byte [0x14006a320]
mov edx, 9
xor ecx, ecx
call fcn.140030bd0
test rax, rax
je 0x1400395e8
movabs rcx, 0x5043206c61746f54
mov qword [rax], rcx
mov byte [rax + 8], 0x55
mov qword [rbp - 0x30], 9
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], 9
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x10], 1
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], 1
mov qword [rbp + 0x10], 0
movabs rax, 0x8000000000000000
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x30], 0
mov dword [rbp + 0x38], 0
mov qword [rbp + 0x40], 0
mov qword [rbp + 0x48], 8
mov qword [rbp + 0x50], 0
mov byte [rbp + 0x58], 0
mov qword [rbp + 0x830], 0
mov qword [rbp + 0x838], 8
mov qword [rbp + 0x840], 0
movzx eax, byte [0x14006a320]
mov edx, 0x120
xor ecx, ecx
call fcn.140030bd0
test rax, rax
je 0x1400395fc
mov qword [rbp + 0x7c0], 2
mov qword [rbp + 0x7c8], rax
mov qword [rbp + 0x7d0], 0
mov qword [rbp + 0x870], 0
mov eax, dword [0x14006a324]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x80], 0
jne 0x1400361ac
call fcn.140035240
mov eax, dword [0x14006a324]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0x88]
mov rdx, qword [rax + 0x90]
lea r8, [rcx + 1]
mov qword [rax + 0x88], r8
movdqu xmm6, xmmword [0x14005a2c0]
movdqa xmmword [rbp + 0x8d0], xmm6
movdqu xmm7, xmmword [0x14005a2d0]
movdqa xmmword [rbp + 0x8e0], xmm7
mov qword [rbp + 0x8f0], rcx
mov qword [rbp + 0x8f8], rdx
mov qword [rbp + 0x540], 0
lea rcx, [rbp + 0x540]
call qword [sym.imp.KERNEL32.dll_GetSystemTimePreciseAsFileTime]
mov rcx, qword [rbp + 0x540]
movabs r8, 0x19db1ded53e8000
mov rdx, rcx
sub rdx, r8
neg rdx
movabs rax, 0xfe624e212ac18000
add rax, rcx
movabs r9, 0x19db1ded53e7fff
cmp rcx, r9
cmovle rax, rdx
movabs rdx, 0xd6bf94d5e57a42bd
mul rdx
cmp rcx, r8
jl 0x140036294
mov rsi, rdx
call sub.KERNEL32.dll_GetTickCount64
shr rsi, 0x17
shr rax, 3
movabs rcx, 0x20c49ba5e353f7cf
mul rcx
shr rdx, 4
xor edi, edi
sub rsi, rdx
cmovae rdi, rsi
jmp 0x140036296
xor edi, edi
movups xmm0, xmmword [rbp + 0x920]
movups xmm1, xmmword [rbp + 0x930]
movups xmm2, xmmword [rbp + 0x940]
movups xmmword [rbp + 0x638], xmm2
movups xmmword [rbp + 0x628], xmm1
movups xmmword [rbp + 0x618], xmm0
xorps xmm8, xmm8
movups xmmword [rbp + 0x678], xmm8
movups xmmword [rbp + 0x688], xmm8
lea rcx, [rbp + 0x540]
lea rdx, [rbp - 0x30]
mov r8d, 0x90
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [rbp + 0x830]
movups xmmword [rbp + 0x5d0], xmm0
mov rax, qword [rbp + 0x840]
mov qword [rbp + 0x5e0], rax
movups xmm0, xmmword [rbp + 0x7c0]
movups xmmword [rbp + 0x5e8], xmm0
mov rax, qword [rbp + 0x7d0]
mov qword [rbp + 0x5f8], rax
movups xmm0, xmmword [rbp + 0x870]
movups xmm1, xmmword [rbp + 0x880]
movups xmm2, xmmword [rbp + 0x890]
movdqu xmm3, xmmword [rbp + 0x8a0]
movups xmmword [rbp + 0x698], xmm0
movups xmmword [rbp + 0x6a8], xmm1
movups xmmword [rbp + 0x6b8], xmm2
movdqu xmmword [rbp + 0x6c8], xmm3
movaps xmm0, xmmword [rbp + 0x8d0]
movaps xmm1, xmmword [rbp + 0x8e0]
movdqa xmm2, xmmword [rbp + 0x8f0]
movdqu xmmword [rbp + 0x668], xmm2
movups xmmword [rbp + 0x658], xmm1
movups xmmword [rbp + 0x648], xmm0
mov qword [rbp + 0x6d8], rdi
mov qword [rbp + 0x600], 0
mov qword [rbp + 0x608], 8
mov qword [rbp + 0x610], 0
mov rax, qword [rbp + 0x960]
cmp byte [rax + 4], 0
je 0x140036488
movaps xmmword [rbp + 0x870], xmm8
movaps xmmword [rbp + 0x8a0], xmm8
movaps xmmword [rbp + 0x890], xmm8
movaps xmmword [rbp + 0x880], xmm8
mov dword [rbp + 0x870], 0x40
lea rcx, [rbp + 0x870]
call sub.KERNEL32.dll_GlobalMemoryStatusEx
movups xmm0, xmmword [rbp + 0x878]
movups xmmword [rbp + 0x678], xmm0
xorps xmm0, xmm0
movaps xmmword [rbp + 0x20], xmm0
movaps xmmword [rbp + 0x10], xmm0
movaps xmmword [rbp], xmm0
movaps xmmword [rbp - 0x10], xmm0
movaps xmmword [rbp - 0x20], xmm0
movaps xmmword [rbp - 0x30], xmm0
mov qword [rbp + 0x30], 0
lea rcx, [rbp - 0x30]
mov edx, 0x68
call sub.PSAPI.DLL_GetPerformanceInfo
cmp eax, 1
jne 0x140036488
mov rdx, qword [rbp - 0x20]
mov r9, qword [rbp - 0x10]
xor r10d, r10d
sub rdx, r9
cmovb rdx, r10
mov rcx, qword [rbp + 0x20]
mov rax, rcx
mul rdx
mov r8, rax
mov r11, 0xffffffffffffffff
cmovo r8, r11
mov rdx, qword [rbp - 0x28]
sub rdx, r9
cmovb rdx, r10
mov rax, rcx
mul rdx
cmovo rax, r11
mov qword [rbp + 0x688], r8
mov qword [rbp + 0x690], rax
mov rax, qword [rbp + 0x960]
cmp byte [rax + 0xb], 2
je 0x140036964
movzx eax, byte [rax + 0xc]
mov byte [rbp + 0x980], al
cmp qword [rbp + 0x698], 0
jne 0x1400367c8
mov qword [rbp - 0x30], 0
lea r8, [rbp - 0x30]
xor ecx, ecx
xor edx, edx
call sub.pdh.dll_PdhOpenQueryA
test eax, eax
je 0x1400364d3
lea rax, [rbp + 0x870]
jmp 0x14003654e
mov rax, qword [rbp - 0x30]
mov qword [rbp + 0x988], rax
mov eax, dword [0x14006a324]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x80], 0
jne 0x1400364ff
call fcn.140035240
mov eax, dword [0x14006a324]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rdx, qword [rax + 0x88]
mov rcx, qword [rax + 0x90]
mov qword [rbp + 0x968], rcx
mov qword [rbp + 0x910], rdx
lea rcx, [rdx + 1]
mov qword [rax + 0x88], rcx
lea rax, [0x14005a2b0]
mov qword [rbp + 0x870], rax
lea rax, [rbp + 0x8d0]
mov qword [rax], 0
lea rcx, [rbp + 0x698]
call fcn.140001f60
mov rax, qword [rbp + 0x870]
mov qword [rbp + 0x698], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x6a0], xmm0
mov qword [rbp + 0x6b0], 0
mov rcx, qword [rbp + 0x910]
mov qword [rbp + 0x6b8], rcx
mov rcx, qword [rbp + 0x968]
mov qword [rbp + 0x6c0], rcx
mov rcx, qword [rbp + 0x988]
mov qword [rbp + 0x6c8], rcx
mov rcx, qword [rbp + 0x8d0]
mov qword [rbp + 0x6d0], rcx
test rax, rax
je 0x1400367ba
movzx eax, byte [0x14006a320]
mov edx, 0x1e
xor ecx, ecx
call fcn.140030bd0
test rax, rax
je 0x14003963d
movups xmm0, xmmword [0x14005a946]
movups xmmword [rax + 0xe], xmm0
movups xmm0, xmmword [str.Processor__Total___Idle_TimeProcessor____Idle_Time]
movups xmmword [rax], xmm0
mov qword [rbp + 0x870], 0x1e
mov qword [rbp + 0x968], rax
mov qword [rbp + 0x878], rax
mov qword [rbp + 0x880], 0x1e
movzx eax, byte [0x14006a320]
mov edx, 5
xor ecx, ecx
call fcn.140030bd0
test rax, rax
mov qword [rbp + 0x988], rax
je 0x14003964e
mov byte [rax + 4], 0x30
mov dword [rax], 0x5f746f74
lea r8, [rbp + 0x588]
mov qword [rbp - 0x30], 5
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], 5
lea rcx, [rbp + 0x870]
lea r9, [rbp - 0x30]
lea rdx, [rbp + 0x698]
call fcn.140047c70
movzx edx, byte [rbp + 0x980]
and dl, 1
lea rcx, [rbp + 0x540]
call fcn.140041040
mov rax, qword [rbp + 0x5c0]
test rax, rax
je 0x1400367ba
mov r12, qword [rbp + 0x5b8]
imul rax, rax, 0x70
add rax, r12
mov qword [rbp + 0x988], rax
xor r15d, r15d
lea r13, [rbp + 0x7c0]
lea rdi, [fcn.140012860]
lea r14, [rbp + 0x920]
lea rbx, [rbp - 0x30]
mov qword [rbp + 0x7c0], r15
mov qword [rbp + 0x920], r13
mov qword [rbp + 0x928], rdi
lea rax, [0x14005a970]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 2
mov qword [rbp - 0x10], 0
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 1
lea rcx, [rbp + 0x8d0]
mov rdx, rbx
call fcn.140012050
mov qword [rbp + 0x920], r13
mov qword [rbp + 0x928], rdi
lea rax, str.C:UsersChara.cargo_registry_srcindex.crates.io_6f17d22bba15001fcrossbeam_epoch_0.9.14_srcinternal.rs
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 2
mov qword [rbp - 0x10], 0
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 1
mov byte [rbp + 0x978], 1
lea rdi, [rbp + 0x870]
mov rcx, rdi
mov rsi, rbx
mov rdx, rbx
call fcn.140012050
lea r8, [r12 + 0x48]
mov byte [rbp + 0x978], 0
lea rcx, [rbp + 0x8d0]
lea rdx, [rbp + 0x698]
mov r9, rdi
call fcn.140047c70
add r12, 0x70
inc r15
cmp r12, qword [rbp + 0x988]
lea r13, [rbp + 0x7c0]
lea rdi, [fcn.140012860]
lea r14, [rbp + 0x920]
mov rbx, rsi
jne 0x1400366d0
cmp qword [rbp + 0x698], 0
je 0x14003695d
mov rcx, qword [rbp + 0x6c8]
call sub.pdh.dll_PdhCollectQueryData
movabs rax, 0x8000000000000000
cmp qword [rbp + 0x588], rax
je 0x14003681d
mov rdx, qword [rbp + 0x590]
mov r8, qword [rbp + 0x598]
lea rcx, [rbp + 0x698]
call fcn.140048670
test eax, eax
je 0x140039623
movss xmm1, dword [0x1400506a0]
subss xmm1, xmm0
movss dword [rbp + 0x5a8], xmm1
movzx edx, byte [rbp + 0x980]
and dl, 1
lea rcx, [rbp + 0x540]
call fcn.140041040
mov rax, qword [rbp + 0x5c0]
test rax, rax
je 0x1400368a4
mov rsi, qword [rbp + 0x5b8]
imul rdi, rax, 0x70
add rdi, rsi
movss xmm8, dword [0x1400506a0]
jmp 0x140036869
add rsi, 0x70
cmp rsi, rdi
je 0x1400368a4
movabs rax, 0x8000000000000000
cmp qword [rsi + 0x48], rax
je 0x140036860
mov rdx, qword [rsi + 0x50]
mov r8, qword [rsi + 0x58]
lea rcx, [rbp + 0x698]
call fcn.140048670
test eax, eax
je 0x140039518
movaps xmm1, xmm8
subss xmm1, xmm0
movss dword [rsi + 0x68], xmm1
jmp 0x140036860
test byte [rbp + 0x980], 1
je 0x14003695d
cmp byte [rbp + 0x5c8], 0
jne 0x14003695d
mov rsi, qword [rbp + 0x5c0]
lea rcx, [rbp - 0x30]
mov rdx, rsi
call fcn.140047680
mov rdi, qword [rbp + 0x5b8]
mov rax, qword [rbp - 0x30]
mov r8, qword [rbp - 0x28]
test rsi, rsi
je 0x14003692e
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x14003692e
lea rcx, [rcx*8 - 8]
imul rdx, rsi, 0x70
add rdx, 0xffffffffffffff90
xor r9d, r9d
xor r10d, r10d
nop word cs:[rax + rax]
mov r11, qword [r8 + r10]
mov qword [rdi + r9 + 0x60], r11
cmp rdx, r9
je 0x14003692e
lea r11, [r10 + 8]
add r9, 0x70
cmp rcx, r10
mov r10, r11
jne 0x140036910
test rax, rax
je 0x140036942
mov rcx, qword [0x14006a2b8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rsi, rsi
je 0x14003694d
mov rax, qword [rdi + 0x60]
jmp 0x14003694f
xor eax, eax
mov qword [rbp + 0x5a0], rax
mov byte [rbp + 0x5c8], 1
mov rax, qword [rbp + 0x960]
cmp byte [rax + 6], 0
je 0x140036c4a
xor ecx, ecx
xor edx, edx
call sub.ole32.dll_CoInitializeEx
mov esi, eax
cmp eax, 2
mov qword [rbp + 0x770], 0
mov qword [rbp + 0x780], 0
mov qword [rbp + 0x790], 0
setb byte [rbp + 0x7a0]
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov edx, 0xffffffff
xor r8d, r8d
xor r9d, r9d
call sub.ole32.dll_CoInitializeSecurity
test eax, eax
js 0x140037128
lea rax, [rbp + 0x778]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movdqu xmm2, xmmword [rax + 0x20]
movdqu xmmword [rbp + 0x858], xmm2
movups xmmword [rbp + 0x848], xmm1
movups xmmword [rbp + 0x838], xmm0
mov qword [rbp + 0x830], 0
mov qword [rbp + 0x720], 0
lea rax, [rbp + 0x720]
mov qword [rsp + 0x20], rax
lea rcx, [0x14005a398]
lea r9, [0x14005a3a8]
xor edx, edx
mov r8d, 1
call sub.ole32.dll_CoCreateInstance
test eax, eax
js 0x14003713b
lea rax, [rbp + 0x838]
mov rcx, qword [rbp + 0x720]
mov qword [rbp + 0x838], rcx
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movdqu xmm2, xmmword [rax + 0x20]
movups xmmword [rbp + 0x7c8], xmm0
movups xmmword [rbp + 0x7d8], xmm1
movdqu xmmword [rbp + 0x7e8], xmm2
mov qword [rbp + 0x7c0], 1
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x7c0]
call fcn.140034d30
cmp dword [rbp - 0x30], 2
je 0x14003722e
movups xmm0, xmmword [rbp - 0x30]
movups xmm1, xmmword [rbp - 0x20]
movdqu xmm2, xmmword [rbp - 0x10]
movaps xmmword [rbp + 0x930], xmm1
mov rax, qword [rbp]
mov qword [rbp + 0x950], rax
movdqa xmmword [rbp + 0x940], xmm2
movaps xmmword [rbp + 0x920], xmm0
mov rsi, qword [rbp + 0x930]
test rsi, rsi
je 0x140037195
mov rcx, qword [rbp + 0x938]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call sub.ole32.dll_CoSetProxyBlanket
test eax, eax
js 0x140037195
mov rax, qword [rbp + 0x920]
cmp rax, 2
je 0x14003722e
mov qword [rbp + 0x8d0], rax
movups xmm0, xmmword [rbp + 0x928]
movups xmm1, xmmword [rbp + 0x938]
movdqu xmm2, xmmword [rbp + 0x948]
movups xmmword [rbp + 0x8d8], xmm0
movups xmmword [rbp + 0x8e8], xmm1
movdqu xmmword [rbp + 0x8f8], xmm2
lea rcx, [rbp + 0x870]
lea rdx, [rbp + 0x8d0]
call fcn.140034ea0
cmp dword [rbp + 0x870], 2
je 0x14003722e
mov rax, qword [rbp + 0x8a0]
mov qword [rbp + 0x710], rax
movups xmm0, xmmword [rbp + 0x870]
movups xmm1, xmmword [rbp + 0x880]
movdqu xmm2, xmmword [rbp + 0x890]
movdqa xmmword [rbp + 0x700], xmm2
movaps xmmword [rbp + 0x6f0], xmm1
movaps xmmword [rbp + 0x6e0], xmm0
mov byte [rbp + 0x97d], 1
lea rcx, [rbp + 0x818]
lea rdx, [rbp + 0x6e0]
mov r8b, 1
call fcn.140035030
mov rax, qword [rbp + 0x710]
mov qword [rbp + 0x750], rax
movaps xmm0, xmmword [rbp + 0x6e0]
movaps xmm1, xmmword [rbp + 0x6f0]
movdqa xmm2, xmmword [rbp + 0x700]
movdqa xmmword [rbp + 0x740], xmm2
movaps xmmword [rbp + 0x730], xmm1
movaps xmmword [rbp + 0x720], xmm0
cmp dword [rbp + 0x81c], 2
jne 0x1400393aa
mov byte [rbp + 0x97d], 0
lea rcx, [rbp + 0x720]
call fcn.140034c50
jmp 0x14003722e
cmp byte [rax + 5], 0
je 0x140037272
mov rax, qword [rbp + 0x5e0]
test rax, rax
je 0x140037272
mov rsi, qword [rbp + 0x5d8]
lea r13, [rax + rax*2]
shl r13, 5
add r13, rsi
lea r12, [rbp + 0x8d8]
lea rbx, [rbp + 0x7c8]
lea r14, [rbp + 0x830]
jmp 0x140036c9d
add rsi, 0x60
cmp rsi, r13
je 0x140037272
mov r15, qword [rsi]
cmp r15, 2
jne 0x140036e90
xor ecx, ecx
xor edx, edx
call sub.ole32.dll_CoInitializeEx
mov edi, eax
cmp eax, 2
mov qword [rbp + 0x920], 0
mov qword [rbp + 0x930], 0
mov qword [rbp + 0x940], 0
setb byte [rbp + 0x950]
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov edx, 0xffffffff
xor r8d, r8d
xor r9d, r9d
call sub.ole32.dll_CoInitializeSecurity
test eax, eax
js 0x140036ebd
lea rax, [rbp + 0x928]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movdqu xmm2, xmmword [rax + 0x20]
movdqu xmmword [r12 + 0x20], xmm2
movups xmmword [r12 + 0x10], xmm1
movups xmmword [r12], xmm0
mov qword [rbp + 0x8d0], 0
mov qword [rbp + 0x830], 0
mov qword [rsp + 0x20], r14
lea rcx, [0x14005a398]
xor edx, edx
mov r8d, 1
lea r9, [0x14005a3a8]
call sub.ole32.dll_CoCreateInstance
test eax, eax
js 0x140036ed6
mov rax, qword [rbp + 0x830]
mov qword [rbp + 0x8d8], rax
movups xmm0, xmmword [r12]
movups xmm1, xmmword [r12 + 0x10]
movdqu xmm2, xmmword [r12 + 0x20]
lea rax, [rbp + 0x878]
movdqu xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
mov qword [rbp + 0x870], 1
mov rcx, r14
lea rdx, [rbp + 0x870]
call fcn.140034d30
mov r15d, 2
cmp dword [rbp + 0x830], 2
je 0x140036fd0
movups xmm0, xmmword [rbp + 0x830]
movups xmm1, xmmword [rbp + 0x840]
movdqu xmm2, xmmword [rbp + 0x850]
movaps xmmword [rbp - 0x20], xmm1
mov rax, qword [rbp + 0x860]
mov qword [rbp], rax
movdqa xmmword [rbp - 0x10], xmm2
movaps xmmword [rbp - 0x30], xmm0
mov rdi, qword [rbp - 0x20]
test rdi, rdi
je 0x140036f36
mov rcx, qword [rbp - 0x18]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call sub.ole32.dll_CoSetProxyBlanket
test eax, eax
js 0x140036f36
mov r15, qword [rbp - 0x30]
lea rax, [rbp - 0x28]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movdqu xmm2, xmmword [rax + 0x20]
movaps xmmword [rbp + 0x770], xmm0
movaps xmmword [rbp + 0x780], xmm1
movdqa xmmword [rbp + 0x790], xmm2
jmp 0x140036fd0
movups xmm0, xmmword [rsi + 8]
movups xmm1, xmmword [rsi + 0x18]
movups xmm2, xmmword [rsi + 0x28]
movaps xmmword [rbp + 0x740], xmm2
movaps xmmword [rbp + 0x730], xmm1
movaps xmmword [rbp + 0x720], xmm0
mov qword [rsi], 2
jmp 0x140037080
mov r15d, 2
cmp edi, 1
ja 0x140036fd0
call sub.ole32.dll_CoUninitialize
jmp 0x140036fd0
cmp qword [rbp + 0x8f0], 0
je 0x140036ef2
mov rcx, qword [rbp + 0x8f8]
test rcx, rcx
je 0x140036ef2
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x8e8]
cmp qword [rbp + 0x8e0], 0
mov qword [rbp + 0x8e0], 0
je 0x140036f19
test rcx, rcx
je 0x140036f19
mov rax, qword [rcx]
call qword [rax + 0x10]
mov r15d, 2
cmp byte [rbp + 0x900], 0
je 0x140036fd0
call sub.ole32.dll_CoUninitialize
jmp 0x140036fd0
mov rcx, qword [rbp - 8]
cmp qword [rbp - 0x10], 0
mov qword [rbp - 0x10], 0
je 0x140036f5e
test rcx, rcx
je 0x140036f5e
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x800], rdi
call rax
mov rcx, qword [rbp - 0x18]
mov qword [rbp - 0x20], 0
test rdi, rdi
je 0x140036f88
test rcx, rcx
je 0x140036f88
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x800], 0
call rax
mov rcx, qword [rbp - 0x28]
cmp qword [rbp - 0x30], 0
mov qword [rbp - 0x30], 0
je 0x140036fb4
test rcx, rcx
je 0x140036fb4
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x800], 0
call rax
cmp byte [rbp], 0
je 0x140036fd0
mov qword [rbp + 0x800], 0
call sub.ole32.dll_CoUninitialize
nop word [rax + rax]
movaps xmm0, xmmword [rbp + 0x770]
movaps xmm1, xmmword [rbp + 0x780]
movaps xmm2, xmmword [rbp + 0x790]
movups xmmword [rsi + 0x28], xmm2
movups xmmword [rsi + 0x18], xmm1
movups xmmword [rsi + 8], xmm0
movups xmm0, xmmword [rsi + 8]
movups xmm1, xmmword [rsi + 0x18]
movups xmm2, xmmword [rsi + 0x28]
movaps xmmword [rbp + 0x740], xmm2
movaps xmmword [rbp + 0x730], xmm1
movaps xmmword [rbp + 0x720], xmm0
mov qword [rsi], 2
movups xmm0, xmmword [rbp + 0x770]
movups xmm1, xmmword [rbp + 0x780]
movups xmm2, xmmword [rbp + 0x790]
movups xmmword [rsi + 8], xmm0
movups xmmword [rsi + 0x18], xmm1
movups xmmword [rsi + 0x28], xmm2
cmp r15, 2
jne 0x140037080
mov qword [rbp + 0x830], 2
movups xmm0, xmmword [rbp + 0x770]
movups xmm1, xmmword [rbp + 0x780]
movups xmm2, xmmword [rbp + 0x790]
lea rax, [rbp + 0x838]
movups xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x10], xmm1
movups xmmword [rax], xmm0
jmp 0x1400370b6
mov qword [rbp + 0x7c0], r15
movaps xmm0, xmmword [rbp + 0x720]
movaps xmm1, xmmword [rbp + 0x730]
movaps xmm2, xmmword [rbp + 0x740]
movups xmmword [rbx + 0x20], xmm2
movups xmmword [rbx + 0x10], xmm1
movups xmmword [rbx], xmm0
mov rcx, r14
lea rdx, [rbp + 0x7c0]
call fcn.140034ea0
mov rax, qword [rbp + 0x860]
mov qword [rsi + 0x30], rax
movups xmm0, xmmword [rbp + 0x830]
movups xmm1, xmmword [rbp + 0x840]
movdqu xmm2, xmmword [rbp + 0x850]
movdqu xmmword [rsi + 0x20], xmm2
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
cmp dword [rsi], 2
je 0x140036c90
mov rcx, r14
mov rdx, rsi
xor r8d, r8d
call fcn.140035030
cmp dword [rbp + 0x834], 2
je 0x140036c90
movss xmm0, dword [rbp + 0x830]
movss dword [rsi + 0x58], xmm0
ucomiss xmm0, dword [rsi + 0x5c]
jbe 0x140036c90
movss dword [rsi + 0x5c], xmm0
jmp 0x140036c90
cmp esi, 1
ja 0x14003722e
call sub.ole32.dll_CoUninitialize
jmp 0x14003722e
cmp qword [rbp + 0x850], 0
je 0x140037157
mov rcx, qword [rbp + 0x858]
test rcx, rcx
je 0x140037157
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x848]
cmp qword [rbp + 0x840], 0
mov qword [rbp + 0x840], 0
je 0x14003717e
test rcx, rcx
je 0x14003717e
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp byte [rbp + 0x860], 0
je 0x14003722e
call sub.ole32.dll_CoUninitialize
jmp 0x14003722e
cmp qword [rbp + 0x940], 0
je 0x1400371bb
mov rcx, qword [rbp + 0x948]
test rcx, rcx
je 0x1400371bb
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x808], rsi
call rax
test rsi, rsi
je 0x1400371e0
mov rcx, qword [rbp + 0x938]
test rcx, rcx
je 0x1400371e0
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x808], 0
call rax
mov rcx, qword [rbp + 0x928]
cmp qword [rbp + 0x920], 0
mov qword [rbp + 0x920], 0
je 0x140037215
test rcx, rcx
je 0x140037215
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x808], 0
call rax
cmp byte [rbp + 0x950], 0
je 0x14003722e
mov qword [rbp + 0x808], 0
call sub.ole32.dll_CoUninitialize
mov eax, 8
mov qword [rbp + 0x988], rax
xor eax, eax
mov qword [rbp + 0x980], rax
lea rcx, [rbp + 0x5d0]
call fcn.14003acd0
mov rcx, qword [rbp + 0x980]
mov qword [rbp + 0x5d0], rcx
mov rax, qword [rbp + 0x988]
mov qword [rbp + 0x5d8], rax
mov qword [rbp + 0x5e0], rcx
mov rax, qword [rbp + 0x960]
cmp byte [rax + 1], 0
je 0x140037332
mov qword [rbp + 0x7c0], 0
lea rcx, [rbp + 0x7c0]
call sub.IPHLPAPI.DLL_GetIfTable2
test eax, eax
jne 0x14003857e
mov rax, qword [rbp + 0x660]
test rax, rax
je 0x140037482
mov rcx, qword [rbp + 0x648]
lea rdx, [rcx + 0x10]
movdqa xmm0, xmmword [rcx]
pmovmskb r8d, xmm0
not r8d
jmp 0x1400372ff
tzcnt r9d, r8d
mov r10, r9
neg r10
shl r9d, 3
shl r10, 7
sub r10, r9
lea r9d, [r8 - 1]
and r9d, r8d
mov byte [rcx + r10 - 2], 0
mov r8d, r9d
dec rax
je 0x140037482
test r8w, r8w
jne 0x1400372d0
nop word cs:[rax + rax]
movdqa xmm0, xmmword [rdx]
pmovmskb r8d, xmm0
add rcx, 0xfffffffffffff780
add rdx, 0x10
cmp r8d, 0xffff
je 0x140037310
not r8d
jmp 0x1400372d0
cmp byte [rax], 0
je 0x14003857e
lea rcx, [rbp - 0x30]
mov r8d, 0x548
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rdi, qword [rbp + 0x660]
test rdi, rdi
je 0x14003857e
mov rbx, qword [rbp + 0x648]
lea r14, [rbx + 0x10]
movdqa xmm0, xmmword [rbx]
pmovmskb r12d, xmm0
not r12d
lea rsi, [rbp - 0x30]
mov r15, 0xffffffffffffffff
jmp 0x140037394
lea eax, [r12 - 1]
and eax, r12d
mov r12d, eax
dec rdi
je 0x14003857e
test r12w, r12w
jne 0x1400373c1
nop word [rax + rax]
movdqa xmm0, xmmword [r14]
pmovmskb r12d, xmm0
add rbx, 0xfffffffffffff780
add r14, 0x10
cmp r12d, 0xffff
je 0x1400373a0
not r12d
tzcnt eax, r12d
mov r13, rax
neg r13
shl eax, 3
shl r13, 7
sub r13, rax
mov rax, qword [rbx + r13 - 0x70]
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x28], 0
mov rcx, rsi
call sub.IPHLPAPI.DLL_GetIfEntry2
test eax, eax
jne 0x140037380
add r13, rbx
mov rax, qword [r13 - 0x68]
mov rcx, qword [r13 - 0x58]
mov qword [r13 - 0x60], rax
mov rax, qword [rbp + 0x4d0]
mov qword [r13 - 0x68], rax
mov qword [r13 - 0x50], rcx
mov rax, qword [rbp + 0x488]
mov qword [r13 - 0x58], rax
mov rax, qword [r13 - 0x48]
mov qword [r13 - 0x40], rax
mov rax, qword [rbp + 0x490]
add rax, qword [rbp + 0x498]
cmovb rax, r15
mov qword [r13 - 0x48], rax
mov rax, qword [r13 - 0x38]
mov qword [r13 - 0x30], rax
mov rax, qword [rbp + 0x4d8]
add rax, qword [rbp + 0x4e0]
cmovb rax, r15
mov qword [r13 - 0x38], rax
mov rax, qword [r13 - 0x28]
mov qword [r13 - 0x20], rax
mov rax, qword [rbp + 0x4a8]
mov qword [r13 - 0x28], rax
mov rax, qword [r13 - 0x18]
mov qword [r13 - 0x10], rax
mov rax, qword [rbp + 0x4f0]
mov qword [r13 - 0x18], rax
jmp 0x140037380
mov eax, dword [0x14006a324]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x80], 0
jne 0x1400374a3
call fcn.140035240
mov eax, dword [0x14006a324]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0x88]
mov rdx, qword [rax + 0x90]
lea r8, [rcx + 1]
mov qword [rax + 0x88], r8
movdqa xmmword [rbp - 0x30], xmm6
movdqa xmmword [rbp - 0x20], xmm7
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rdx
mov qword [rbp + 0x920], 0
mov qword [rbp + 0x928], 8
mov qword [rbp + 0x930], 0
mov rax, qword [rbp + 0x7c0]
lea rcx, [rax + 8]
mov qword [rbp + 0x910], rcx
mov qword [rbp + 0x768], rax
mov edx, dword [rax]
test rdx, rdx
je 0x1400378a3
mov sil, 1
mov eax, 8
mov qword [rbp + 0x918], rax
xor r12d, r12d
pxor xmm6, xmm6
pcmpeqd xmm7, xmm7
mov rbx, qword [sym.imp.KERNEL32.dll_HeapFree]
xor edi, edi
mov qword [rbp + 0x968], rdx
jmp 0x1400375b7
mov rax, qword [rbp + 0x928]
mov qword [rbp + 0x918], rax
mov r12, qword [rbp + 0x930]
mov rax, r12
shl rax, 5
mov rcx, qword [rbp + 0x918]
mov dword [rcx + rax], edi
mov qword [rcx + rax + 8], 0xa
mov rdx, qword [rbp + 0x980]
mov qword [rcx + rax + 0x10], rdx
mov qword [rcx + rax + 0x18], 0xa
inc r12
mov qword [rbp + 0x930], r12
mov rdx, qword [rbp + 0x968]
inc rdi
cmp rdi, rdx
setb sil
je 0x140037893
imul rax, rdi, 0x548
mov rcx, qword [rbp + 0x910]
lea r14, [rcx + rax]
cmp qword [rcx + rax + 0x4a8], 0
jne 0x1400375de
cmp qword [r14 + 0x4b0], 0
je 0x1400375a7
cmp dword [r14 + 0x48c], 2
je 0x1400375a7
cmp dword [r14 + 0x420], 0
je 0x1400375a7
movzx eax, byte [0x14006a320]
mov edx, 0x14
xor ecx, ecx
call fcn.140030bd0
test rax, rax
je 0x14003956c
mov byte [rbp + 0x958], sil
mov rsi, r12
mov ecx, dword [r14 + 0x10]
movq xmm0, qword [r14 + 0x14]
punpcklbw xmm0, xmm6
mov dword [rax], ecx
movdqu xmmword [rax + 4], xmm0
movzx ecx, byte [0x14006a320]
mov edx, 0x14
mov r14, rax
xor ecx, ecx
call fcn.140030bd0
test rax, rax
mov qword [rbp + 0x980], r14
je 0x140039551
mov ecx, dword [r14 + 0x10]
mov dword [rax + 0x10], ecx
movups xmm0, xmmword [r14]
movups xmmword [rax], xmm0
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 8]
mov r9d, 0xa
mov qword [rbp + 0x988], rax
mov r8, rax
call fcn.1400352a0
mov r15, rax
mov r14, rax
shr r14, 0x39
mov rax, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
mov rdx, rcx
and rdx, r15
movd xmm0, r14d
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
xor r8d, r8d
mov r9, rdx
movdqu xmm1, xmmword [rax + r9]
movdqa xmm2, xmm1
pcmpeqb xmm2, xmm0
pmovmskb r10d, xmm2
test r10d, r10d
jne 0x140037700
pcmpeqb xmm1, xmm7
pmovmskb r10d, xmm1
test r10d, r10d
jne 0x14003779b
add r9, r8
add r9, 0x10
add r8, 0x10
and r9, rcx
jmp 0x1400376af
lea r11d, [r10 - 1]
and r11d, r10d
mov r10d, r11d
test r11w, r11w
je 0x1400376c7
tzcnt r11d, r10d
add r11, r9
and r11, rcx
shl r11, 5
mov r12, rax
sub r12, r11
cmp qword [r12 - 0x10], 0xa
jne 0x1400376f0
mov r11, qword [r12 - 0x18]
movdqu xmm2, xmmword [r11]
mov r13, qword [rbp + 0x988]
movdqu xmm3, xmmword [r13]
pcmpeqb xmm3, xmm2
movd xmm2, dword [r11 + 0x10]
movd xmm4, dword [r13 + 0x10]
pcmpeqb xmm4, xmm2
pand xmm4, xmm3
pmovmskb r11d, xmm4
cmp r11d, 0xffff
jne 0x1400376f0
mov rcx, qword [0x14006a2b8]
xor edx, edx
mov r8, qword [rbp + 0x988]
call rbx
mov eax, dword [r12 - 8]
inc eax
mov dword [r12 - 8], eax
cmp eax, 1
mov r12, rsi
jle 0x140037875
mov rcx, qword [0x14006a2b8]
xor edx, edx
mov r8, qword [rbp + 0x980]
call rbx
jmp 0x1400375a0
cmp qword [rbp - 0x20], 0
mov r12, rsi
jne 0x1400377c0
lea rcx, [rbp - 0x30]
lea rdx, [rbp - 0x10]
call fcn.14004cf10
mov rax, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
and r15, rcx
mov rdx, r15
movdqu xmm0, xmmword [rax + rdx]
pmovmskb r8d, xmm0
test r8d, r8d
jne 0x1400377f9
mov r9d, 0x10
nop word cs:[rax + rax]
add rdx, r9
and rdx, rcx
movdqu xmm0, xmmword [rax + rdx]
pmovmskb r8d, xmm0
add r9, 0x10
test r8d, r8d
je 0x1400377e0
tzcnt r8d, r8d
add r8, rdx
and r8, rcx
movzx edx, byte [rax + r8]
test dl, dl
js 0x14003781f
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
tzcnt r8d, edx
movzx edx, byte [rax + r8]
lea r9, [r8 - 0x10]
and r9, rcx
mov byte [rax + r8], r14b
mov byte [rax + r9 + 0x10], r14b
shl r8, 5
mov rcx, rax
sub rcx, r8
and dl, 1
movzx edx, dl
sub qword [rbp - 0x20], rdx
mov qword [rcx - 0x20], 0xa
mov rdx, qword [rbp + 0x988]
mov qword [rcx - 0x18], rdx
mov qword [rcx - 0x10], 0xa
neg r8
mov dword [rcx - 8], 0
inc qword [rbp - 0x18]
mov dword [rax + r8 - 8], 1
cmp r12, qword [rbp + 0x920]
jne 0x140037567
lea rcx, [rbp + 0x920]
call fcn.14001fbb0
jmp 0x140037552
mov rsi, qword [rbp + 0x920]
mov rax, qword [rbp + 0x928]
jmp 0x1400378ad
xor r12d, r12d
mov eax, 8
xor esi, esi
shl r12, 5
lea rcx, [rax + r12]
mov qword [rbp + 0x870], rax
mov qword [rbp + 0x880], rsi
mov qword [rbp + 0x758], rcx
mov qword [rbp + 0x888], rcx
add r12, 0xffffffffffffffe0
lea rdi, [rax + 0x30]
add qword [rbp + 0x768], 0x2a
pcmpeqd xmm6, xmm6
mov qword [rbp + 0x538], rax
mov rbx, rax
mov qword [rbp + 0x760], rsi
jmp 0x140037908
add r12, 0xffffffffffffffe0
add rdi, 0x20
cmp rbx, qword [rbp + 0x758]
je 0x140037fd4
mov rax, rbx
add rbx, 0x20
mov qword [rbp + 0x878], rbx
mov rdx, qword [rax + 8]
movabs rcx, 0x8000000000000000
mov qword [rbp + 0x968], rdx
cmp rdx, rcx
je 0x140037f9a
mov edx, dword [rax]
mov r9, qword [rax + 0x10]
cmp qword [rbp - 0x18], 0
mov qword [rbp + 0x988], r9
je 0x140037a90
mov qword [rbp + 0x810], rdx
mov qword [rbp + 0x828], rbx
mov qword [rbp + 0x918], rdi
mov qword [rbp + 0x958], r12
mov rsi, qword [rax + 0x18]
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 8]
mov r8, r9
mov r9, rsi
call fcn.1400352a0
mov rdi, rax
mov r14, qword [rbp - 0x30]
mov r13, qword [rbp - 0x28]
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
lea rax, [rsi + rsi]
mov qword [rbp + 0x980], rax
xor ebx, ebx
and rdi, r13
movdqu xmm8, xmmword [r14 + rdi]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb r15d, xmm0
test r15d, r15d
jne 0x140037a0f
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x140037d83
add rdi, rbx
add rdi, 0x10
add rbx, 0x10
jmp 0x1400379ba
lea eax, [r15 - 1]
and eax, r15d
mov r15d, eax
test ax, ax
je 0x1400379d6
tzcnt eax, r15d
add rax, rdi
and rax, r13
shl rax, 5
mov r12, r14
sub r12, rax
cmp qword [r12 - 0x10], rsi
jne 0x140037a00
mov rdx, qword [r12 - 0x18]
mov rcx, qword [rbp + 0x988]
mov r8, qword [rbp + 0x980]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140037a00
lea rax, [r12 - 0x20]
test r12, r12
cmove rax, r12
add rax, 0x18
test r12, r12
cmove rax, r12
mov r12, qword [rbp + 0x958]
mov rsi, qword [rbp + 0x760]
mov rdi, qword [rbp + 0x918]
mov r9, qword [rbp + 0x988]
mov rbx, qword [rbp + 0x828]
mov rdx, qword [rbp + 0x810]
jmp 0x140037a92
xor eax, eax
test rax, rax
lea rcx, [0x14005a610]
cmove rax, rcx
cmp dword [rax], 1
jg 0x140037b60
imul rax, rdx, 0x548
mov rcx, qword [rbp + 0x910]
lea r14, [rcx + rax]
lea rdx, [r14 + 0x1c]
add rax, qword [rbp + 0x768]
mov ecx, 0x200
xor r8d, r8d
cmp word [rax + r8*2 - 6], 0
je 0x140037b2a
nop word [rax + rax]
test rcx, rcx
je 0x140037b12
cmp word [rax + r8*2 - 4], 0
je 0x140037b1a
cmp word [rax + r8*2 - 2], 0
je 0x140037b20
cmp word [rax + r8*2], 0
je 0x140037b26
add r8, 4
add rcx, 0xfffffffffffffff8
cmp word [rax + r8*2 - 6], 0
jne 0x140037ae0
jmp 0x140037b2a
mov r8d, 0x101
jmp 0x140037b37
or r8, 1
jmp 0x140037b2a
or r8, 2
jmp 0x140037b2a
or r8, 3
cmp r8, 0x102
jae 0x140039535
lea rcx, [rbp + 0x8d0]
call fcn.140012690
mov rcx, qword [rbp + 0x8d0]
movabs rax, 0x8000000000000000
cmp rcx, rax
jne 0x140037b90
mov r9, qword [rbp + 0x988]
cmp qword [rbp + 0x968], 0
je 0x140037900
mov rcx, qword [0x14006a2b8]
xor edx, edx
mov r8, r9
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140037900
mov qword [rbp + 0x7b0], rcx
mov qword [rbp + 0x810], r14
mov qword [rbp + 0x828], rbx
mov qword [rbp + 0x918], rdi
mov qword [rbp + 0x958], r12
mov r8, qword [rbp + 0x8d8]
mov rsi, qword [rbp + 0x8e0]
mov rcx, qword [rbp + 0x668]
mov rdx, qword [rbp + 0x670]
mov qword [rbp + 0x980], r8
mov r9, rsi
call fcn.140035650
mov rcx, rax
shr rcx, 0x39
mov r14, qword [rbp + 0x648]
mov rbx, qword [rbp + 0x650]
mov r12, rbx
mov qword [rbp + 0x530], rax
and r12, rax
mov qword [rbp + 0x528], rcx
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor edi, edi
mov qword [rbp + 0x7b8], r12
movdqu xmm8, xmmword [r14 + r12]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb r13d, xmm0
test r13d, r13d
jne 0x140037c6f
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x140037d8b
add r12, rdi
add r12, 0x10
add rdi, 0x10
and r12, rbx
jmp 0x140037c22
lea eax, [r13 - 1]
and eax, r13d
mov r13d, eax
test ax, ax
je 0x140037c3b
tzcnt eax, r13d
add rax, r12
and rax, rbx
mov r15, rax
neg r15
shl rax, 3
shl r15, 7
sub r15, rax
cmp rsi, qword [r14 + r15 - 0x78]
jne 0x140037c60
add r15, r14
mov rcx, qword [r15 - 0x80]
mov rdx, qword [rbp + 0x980]
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140037c60
mov rax, qword [r15 - 0x68]
mov rcx, qword [r15 - 0x58]
mov qword [r15 - 0x60], rax
mov rdx, qword [rbp + 0x810]
mov rax, qword [rdx + 0x500]
mov qword [r15 - 0x68], rax
mov qword [r15 - 0x50], rcx
mov rax, qword [rdx + 0x4b8]
mov qword [r15 - 0x58], rax
mov rax, qword [r15 - 0x48]
mov qword [r15 - 0x40], rax
mov rax, qword [rdx + 0x4c0]
add rax, qword [rdx + 0x4c8]
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov qword [r15 - 0x48], rax
mov rax, qword [r15 - 0x38]
mov qword [r15 - 0x30], rax
mov rax, qword [rdx + 0x508]
add rax, qword [rdx + 0x510]
cmovb rax, rcx
mov qword [r15 - 0x38], rax
mov rax, qword [r15 - 0x28]
mov qword [r15 - 0x20], rax
mov rax, qword [rdx + 0x4d8]
mov qword [r15 - 0x28], rax
mov rax, qword [r15 - 0x18]
mov qword [r15 - 0x10], rax
mov rax, qword [rdx + 0x520]
mov qword [r15 - 0x18], rax
mov byte [r15 - 2], 1
mov rax, qword [rbp + 0x7b0]
shl rax, 1
test rax, rax
mov r12, qword [rbp + 0x958]
mov r13, qword [rbp + 0x988]
je 0x140037f60
mov rcx, qword [0x14006a2b8]
xor edx, edx
mov r8, qword [rbp + 0x980]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140037f60
xor r12d, r12d
jmp 0x140037a47
cmp qword [rbp + 0x658], 0
mov r12, qword [rbp + 0x958]
mov r15, qword [rbp + 0x810]
mov rdi, qword [rbp + 0x7b8]
jne 0x140037dd5
lea rcx, [rbp + 0x648]
lea rdx, [rbp + 0x668]
call fcn.14004c560
mov r14, qword [rbp + 0x648]
mov rbx, qword [rbp + 0x650]
mov rdi, qword [rbp + 0x530]
and rdi, rbx
mov r10, qword [r15 + 0x4c0]
add r10, qword [r15 + 0x4c8]
mov rdx, 0xffffffffffffffff
cmovb r10, rdx
mov rcx, qword [r15 + 0x508]
add rcx, qword [r15 + 0x510]
cmovb rcx, rdx
movdqu xmm0, xmmword [r14 + rdi]
pmovmskb edx, xmm0
test edx, edx
je 0x140037e17
mov r13, qword [rbp + 0x988]
jmp 0x140037e48
mov r8d, 0x10
mov r13, qword [rbp + 0x988]
nop word cs:[rax + rax]
add rdi, r8
and rdi, rbx
movdqu xmm0, xmmword [r14 + rdi]
pmovmskb edx, xmm0
add r8, 0x10
test edx, edx
je 0x140037e30
tzcnt edx, edx
add rdx, rdi
and rdx, rbx
movzx r8d, byte [r14 + rdx]
test r8b, r8b
js 0x140037e6e
movdqa xmm0, xmmword [r14]
pmovmskb edx, xmm0
tzcnt edx, edx
movzx r8d, byte [r14 + rdx]
mov rax, qword [r15]
mov qword [rbp + 0x7b8], rax
mov r9, r15
lea r15, [rdx - 0x10]
and r15, rbx
mov rbx, qword [r9 + 0x500]
mov rdi, qword [r9 + 0x4b8]
mov r11, qword [r9 + 0x4d8]
mov r9, qword [r9 + 0x520]
mov rax, qword [rbp + 0x528]
mov byte [r14 + rdx], al
mov byte [r14 + r15 + 0x10], al
and r8b, 1
movzx r8d, r8b
sub qword [rbp + 0x658], r8
mov r8, rdx
neg r8
shl rdx, 3
shl r8, 7
sub r8, rdx
mov rdx, qword [rbp + 0x7b0]
mov qword [r14 + r8 - 0x88], rdx
mov rdx, qword [rbp + 0x980]
mov qword [r14 + r8 - 0x80], rdx
mov qword [r14 + r8 - 0x78], rsi
mov rax, qword [rbp + 0x7b8]
mov qword [r14 + r8 - 0x70], rax
mov qword [r14 + r8 - 0x68], rbx
mov qword [r14 + r8 - 0x60], rbx
mov qword [r14 + r8 - 0x58], rdi
mov qword [r14 + r8 - 0x50], rdi
mov qword [r14 + r8 - 0x48], r10
mov qword [r14 + r8 - 0x40], r10
mov qword [r14 + r8 - 0x38], rcx
mov qword [r14 + r8 - 0x30], rcx
mov qword [r14 + r8 - 0x28], r11
mov qword [r14 + r8 - 0x20], r11
mov qword [r14 + r8 - 0x18], r9
mov qword [r14 + r8 - 0x10], r9
mov dword [r14 + r8 - 8], 0
mov word [r14 + r8 - 4], 0
mov byte [r14 + r8 - 2], 1
inc qword [rbp + 0x660]
nop word cs:[rax + rax]
cmp qword [rbp + 0x968], 0
mov rsi, qword [rbp + 0x760]
mov rdi, qword [rbp + 0x918]
mov rbx, qword [rbp + 0x828]
je 0x140037900
mov rcx, qword [0x14006a2b8]
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140037900
cmp qword [rbp + 0x758], rbx
je 0x140037fd4
shr r12, 5
jmp 0x140037fb9
add rdi, 0x20
dec r12
je 0x140037fd4
cmp qword [rdi - 8], 0
je 0x140037fb0
mov r8, qword [rdi]
mov rcx, qword [0x14006a2b8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140037fb0
test rsi, rsi
je 0x140037fef
mov rcx, qword [0x14006a2b8]
xor edx, edx
mov r8, qword [rbp + 0x538]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x7c0]
mov byte [rbp + 0x997], 0
call sub.IPHLPAPI.DLL_FreeMibTable
mov rdi, qword [rbp - 0x28]
test rdi, rdi
je 0x1400380d4
mov rsi, qword [rbp - 0x30]
mov rbx, qword [rbp - 0x18]
test rbx, rbx
je 0x1400380ab
movdqa xmm0, xmmword [rsi]
pmovmskb r12d, xmm0
not r12d
lea r14, [rsi + 0x10]
mov r15, rsi
jmp 0x140038050
lea eax, [r12 - 1]
and eax, r12d
mov r12d, eax
dec rbx
je 0x1400380ab
test r12w, r12w
jne 0x140038081
nop word cs:[rax + rax]
movdqa xmm0, xmmword [r14]
pmovmskb r12d, xmm0
add r15, 0xfffffffffffffe00
add r14, 0x10
cmp r12d, 0xffff
je 0x140038060
not r12d
tzcnt ecx, r12d
shl ecx, 5
mov rax, r15
sub rax, rcx
cmp qword [rax - 0x20], 0
je 0x140038040
mov r8, qword [rax - 0x18]
mov rcx, qword [0x14006a2b8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140038040
mov rax, rdi
shl rax, 5
add rdi, rax
cmp rdi, 0xffffffffffffffcf
je 0x1400380d4
sub rsi, rax
add rsi, 0xffffffffffffffe0
mov rcx, qword [0x14006a2b8]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [rbp + 0x660]
test rsi, rsi
je 0x140038236
mov rdi, qword [rbp + 0x648]
mov rax, qword [rbp + 0x650]
mov qword [rbp + 0x988], rax
lea r14, [rdi + 0x10]
movdqa xmm0, xmmword [rdi]
pmovmskb eax, xmm0
not eax
mov r15, qword [rbp + 0x658]
pcmpeqd xmm6, xmm6
mov r13, rdi
mov r12, rsi
jmp 0x14003812e
lea eax, [rbx - 1]
and eax, ebx
dec rsi
je 0x140038236
test ax, ax
jne 0x14003815d
nop word cs:[rax + rax]
movdqa xmm0, xmmword [r14]
pmovmskb eax, xmm0
add r13, 0xfffffffffffff780
add r14, 0x10
cmp eax, 0xffff
je 0x140038140
not eax
mov ebx, eax
tzcnt ecx, ebx
mov rax, rcx
neg rax
shl ecx, 3
shl rax, 7
sub rax, rcx
cmp byte [r13 + rax - 2], 0
jne 0x140038120
add rax, r13
mov rcx, rdi
sub rcx, rax
sar rcx, 3
movabs rdx, 0xf0f0f0f0f0f0f0f1
imul rcx, rdx
lea rdx, [rcx - 0x10]
and rdx, qword [rbp + 0x988]
movdqu xmm0, xmmword [rdi + rdx]
pcmpeqb xmm0, xmm6
psllw xmm0, 7
pmovmskb r8d, xmm0
test r8d, r8d
je 0x1400381c4
bsr r8w, r8w
xor r8d, 0xf
jmp 0x1400381c9
mov r8w, 0x10
movdqu xmm0, xmmword [rdi + rcx]
pcmpeqb xmm0, xmm6
pmovmskb r9d, xmm0
or r9d, 0x10000
tzcnt r9d, r9d
add r8d, r9d
mov r9b, 0x80
cmp r8w, 0xf
ja 0x1400381fd
inc r15
mov qword [rbp + 0x658], r15
mov r9b, 0xff
mov byte [rdi + rcx], r9b
mov byte [rdi + rdx + 0x10], r9b
dec r12
mov qword [rbp + 0x660], r12
cmp qword [rax - 0x88], 0
je 0x140038120
mov r8, qword [rax - 0x80]
mov rcx, qword [0x14006a2b8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140038120
mov dword [rbp + 0x830], 0x3c00
mov dword [rbp + 0x920], 0
xor r14d, r14d
lea rdi, [rbp + 0x830]
xor ebx, ebx
nop word cs:[rax + rax]
cmp ebx, 3
jae 0x140038341
mov edx, dword [rbp + 0x830]
mov rcx, r14
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
test rax, rax
je 0x1400382d7
mov rsi, rax
mov qword [rbp + 0x7a8], rax
mov byte [rbp + 0x97c], 1
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0xe
xor r8d, r8d
mov r9, rax
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
inc ebx
mov dword [rbp + 0x920], eax
mov r14, rsi
cmp eax, 0x6f
je 0x140038260
test eax, eax
jne 0x14003833e
mov rdi, rsi
movabs rbx, 0x8000000000000000
test rbx, rbx
jne 0x1400383cf
jmp 0x14003857e
movzx eax, byte [0x14006a320]
mov edx, 0x32
xor ecx, ecx
call fcn.140030bd0
test rax, rax
je 0x14003965f
mov rdi, rax
movups xmm0, xmmword [0x14005aaea]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x14005aada]
movups xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [str.failed_to_allocate_memory_for_IP_ADAPTER_ADDRESSESGetAdaptersAddresses___failed_with_code]
movdqu xmmword [rax], xmm0
mov word [rax + 0x30], 0x5345
mov rcx, r14
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov esi, 0x32
mov ebx, 0x32
test rbx, rbx
jne 0x1400383cf
jmp 0x14003857e
mov r14, rsi
lea rax, [rbp + 0x920]
mov qword [rbp + 0x8d0], rax
lea rax, [0x140013740]
mov qword [rbp + 0x8d8], rax
lea rax, [0x14005ab28]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x10], 0
lea rax, [rbp + 0x8d0]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 1
mov qword [rbp + 0x7a8], r14
mov byte [rbp + 0x97c], 1
lea rcx, [rbp + 0x870]
lea rdx, [rbp - 0x30]
call fcn.140012050
mov rbx, qword [rbp + 0x870]
mov rdi, qword [rbp + 0x878]
mov rsi, qword [rbp + 0x880]
mov rcx, r14
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
test rbx, rbx
je 0x14003857e
movabs rax, 0x8000000000000000
cmp rbx, rax
jne 0x14003856c
mov qword [rbp + 0x870], rdi
mov qword [rbp + 0x878], rsi
mov rax, qword [rbp + 0x660]
mov qword [rbp + 0x968], rax
mov rax, qword [rbp + 0x668]
mov qword [rbp + 0x910], rax
mov rax, qword [rbp + 0x670]
mov qword [rbp + 0x958], rax
mov r14, qword [rbp + 0x648]
mov rsi, qword [rbp + 0x650]
pcmpeqd xmm6, xmm6
nop dword [rax]
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x870]
call fcn.140035440
mov rcx, qword [rbp - 0x30]
movabs rax, 0x8000000000000000
cmp rcx, rax
je 0x140039386
mov qword [rbp + 0x980], rcx
mov r12, qword [rbp - 0x28]
cmp qword [rbp + 0x968], 0
je 0x140038547
mov r13, qword [rbp - 0x20]
mov rcx, qword [rbp + 0x910]
mov rdx, qword [rbp + 0x958]
mov r8, r12
mov r9, r13
call fcn.140035650
mov rdi, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor eax, eax
mov qword [rbp + 0x988], rax
and rdi, rsi
movdqu xmm8, xmmword [r14 + rdi]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb ebx, xmm0
test ebx, ebx
jne 0x1400384fc
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x140038547
mov rax, qword [rbp + 0x988]
add rdi, rax
add rdi, 0x10
add rax, 0x10
jmp 0x1400384a8
lea eax, [rbx - 1]
and eax, ebx
mov ebx, eax
test ax, ax
je 0x1400384c9
tzcnt eax, ebx
add rax, rdi
and rax, rsi
mov r15, rax
neg r15
shl rax, 3
shl r15, 7
sub r15, rax
cmp qword [r14 + r15 - 0x78], r13
jne 0x1400384f0
add r15, r14
mov rdx, qword [r15 - 0x80]
mov rcx, r12
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400384f0
lea rcx, [rbp - 0x18]
movzx eax, word [rcx + 4]
mov word [r15 - 4], ax
mov eax, dword [rcx]
mov dword [r15 - 8], eax
cmp qword [rbp + 0x980], 0
je 0x140038430
mov rcx, qword [0x14006a2b8]
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140038430
mov rcx, qword [0x14006a2b8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rbp + 0x960]
movzx eax, byte [rax + 8]
cmp al, 2
je 0x1400385ac
mov rcx, qword [rbp + 0x960]
movzx ecx, word [rcx + 9]
shl ecx, 8
movzx edx, al
or edx, ecx
lea rcx, [rbp + 0x540]
call fcn.14003af10
mov rax, qword [rbp + 0x960]
cmp byte [rax + 2], 0
je 0x140038634
call sub.KERNEL32.dll_GetLogicalDrives
mov dword [rbp + 0x830], eax
test eax, eax
je 0x1400386b1
mov qword [rbp + 0x920], 0
mov qword [rbp + 0x928], 8
mov qword [rbp + 0x930], 0
lea rax, [rbp + 0x830]
mov qword [rbp - 0x30], rax
movabs rax, 0x2000000000
mov qword [rbp - 0x28], rax
mov eax, dword [0x14006a324]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 0x30]
test rax, rax
je 0x1400386c0
add rax, 0x110
jmp 0x1400386c5
cmp byte [rax + 3], 0
je 0x1400388f9
mov rax, qword [rbp + 0x5f8]
test rax, rax
je 0x1400388f9
mov rdi, qword [rbp + 0x5f0]
lea rbx, [rax + rax*8]
shl rbx, 4
add rbx, rdi
lea rsi, [rbp - 0x30]
jmp 0x140038680
add rdi, 0x90
cmp rdi, rbx
je 0x1400388f9
cmp qword [rdi + 0x78], 0
je 0x140038670
mov qword [rbp - 0x30], 0
mov rcx, qword [rdi + 0x50]
xor edx, edx
xor r8d, r8d
mov r9, rsi
call sub.KERNEL32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x140038670
mov rax, qword [rbp - 0x30]
mov qword [rdi + 0x80], rax
jmp 0x140038670
mov edi, 8
xor ebx, ebx
xor r14d, r14d
jmp 0x1400388b2
call fcn.14001b340
mov rax, qword [rax]
mov r9, qword [rax + 0x1e8]
lea rax, [rbp - 0x30]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x20
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 1
lea rsi, [rbp + 0x8d0]
mov edx, 0x20
mov rcx, rsi
xor r8d, r8d
call fcn.14003c7a0
mov rax, qword [rbp + 0x8e0]
test rax, rax
je 0x14003874f
xor r8d, r8d
nop word [rax + rax]
mov rsi, qword [rsi]
test rsi, rsi
je 0x140038735
add r8, qword [rsi + 0x10]
add rsi, 0x18
dec rax
jne 0x140038720
test r8, r8
je 0x14003874f
mov byte [rbp + 0x977], 1
lea rcx, [rbp + 0x920]
xor edx, edx
call fcn.14004d7f0
movups xmm0, xmmword [rbp + 0x8d0]
movaps xmmword [rbp + 0x870], xmm0
mov rax, qword [rbp + 0x8e0]
mov qword [rbp + 0x880], rax
mov r8, qword [rbp + 0x870]
test r8, r8
je 0x14003889d
lea r15, [rbp + 0x878]
mov rdi, qword [rbp + 0x880]
dec rdi
mov r12, qword [sym.imp.KERNEL32.dll_HeapFree]
movabs rsi, 0x8000000000000000
jmp 0x1400387ba
mov rdi, qword [rbp + 0x980]
dec rdi
mov r8, qword [rbp + 0x988]
test r8, r8
je 0x14003889d
mov rbx, qword [r8 + 0x18]
lea rax, [rbx + 0x20]
test rbx, rbx
cmove rax, r15
mov qword [rax], 0
mov r13, qword [r8]
movups xmm0, xmmword [r8 + 8]
movaps xmmword [rbp + 0x7c0], xmm0
mov rcx, qword [0x14006a2b8]
xor edx, edx
call r12
cmp r13, rsi
je 0x140038894
mov qword [rbp + 0x980], rdi
mov qword [rbp + 0x988], rbx
mov qword [rbp - 0x30], r13
movaps xmm0, xmmword [rbp + 0x7c0]
lea rax, [rbp - 0x28]
movups xmmword [rax], xmm0
mov rdi, qword [rbp - 0x28]
mov rbx, qword [rbp - 0x20]
mov rax, qword [rbp + 0x920]
mov r14, qword [rbp + 0x930]
sub rax, r14
cmp rax, rbx
jae 0x14003884b
lea rcx, [rbp + 0x920]
mov rdx, r14
mov r8, rbx
call fcn.14004d7f0
mov r14, qword [rbp + 0x930]
lea rcx, [r14 + r14*8]
shl rcx, 4
add rcx, qword [rbp + 0x928]
mov rax, rbx
shl rax, 4
lea r8, [rax + rax*8]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
add r14, rbx
mov qword [rbp + 0x930], r14
test r13, r13
je 0x1400387a0
mov rcx, qword [0x14006a2b8]
xor edx, edx
mov r8, rdi
call r12
jmp 0x1400387a0
test rbx, rbx
jne 0x140038f5b
mov r14, qword [rbp + 0x920]
mov rdi, qword [rbp + 0x928]
mov rbx, qword [rbp + 0x930]
mov rsi, qword [rbp + 0x5f0]
mov rdx, qword [rbp + 0x5f8]
mov rcx, rsi
call fcn.14003c340
cmp qword [rbp + 0x5e8], 0
je 0x1400388e4
mov rcx, qword [0x14006a2b8]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbp + 0x5e8], r14
mov qword [rbp + 0x5f0], rdi
mov qword [rbp + 0x5f8], rbx
mov rax, qword [rbp + 0x960]
cmp byte [rax + 7], 0
je 0x140039343
mov qword [rbp + 0x920], 0
mov qword [rbp + 0x928], 8
mov qword [rbp + 0x930], 0
mov dword [rbp + 0x86c], 0
mov eax, 8
mov qword [rbp + 0x988], rax
lea rbx, [rbp + 0x86c]
lea r14, [rbp + 0x818]
xor eax, eax
mov qword [rbp + 0x968], rax
nop dword [rax + rax]
mov qword [rbp + 0x770], 0
mov dword [rbp + 0x824], 0
mov dword [rbp + 0x818], 0
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], r14
lea rax, [rbp + 0x824]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xffffffff
xor ecx, ecx
xor edx, edx
mov r8d, 2
lea r9, [rbp + 0x770]
call sub.NETAPI32.dll_NetUserEnum
mov r13d, eax
test eax, eax
je 0x1400389c7
cmp r13d, 0xea
jne 0x140038f98
mov r15, qword [rbp + 0x770]
mov eax, dword [rbp + 0x824]
lea rdi, [r15 + rax*8]
mov rax, r15
nop dword [rax + rax]
cmp rax, rdi
je 0x140038f10
lea r15, [rax + 8]
cmp qword [rax], 0
mov rax, r15
je 0x1400389e0
mov qword [rbp + 0x830], 0
mov rdx, qword [r15 - 8]
xor ecx, ecx
mov r8d, 0x17
lea r9, [rbp + 0x830]
call sub.NETAPI32.dll_NetUserGetInfo
test eax, eax
je 0x140038a2b
mov rcx, qword [rbp + 0x830]
test rcx, rcx
jne 0x140038a80
jmp 0x1400389d8
mov rcx, qword [rbp + 0x830]
mov rsi, qword [rcx + 0x20]
test rsi, rsi
je 0x140038a80
mov rcx, rsi
call sub.ADVAPI32.dll_IsValidSid
test eax, eax
je 0x140038a1d
mov rcx, rsi
call sub.ADVAPI32.dll_GetLengthSid
mov r12d, eax
mov edx, eax
test eax, eax
sete bl
mov qword [rbp + 0x910], rdx
je 0x140038a8a
mov ecx, 8
call fcn.140030bd0
test rax, rax
je 0x14003958b
mov rdx, rax
jmp 0x140038a8f
call sub.NETAPI32.dll_NetApiBufferFree
jmp 0x1400389d8
mov edx, 1
mov byte [rbp + 0x979], bl
mov ecx, r12d
mov qword [rbp + 0x960], rdx
mov r8, rsi
call sub.ADVAPI32.dll_CopySid
test eax, eax
lea rbx, [rbp + 0x86c]
je 0x140038b73
test r12d, r12d
je 0x1400394fc
mov rdx, qword [rbp + 0x960]
cmp byte [rdx], 1
jne 0x1400395a1
mov byte [rbp + 0x97f], 1
lea rcx, [rbp + 0x870]
call fcn.14003c4f0
mov rcx, qword [rbp + 0x870]
movabs rax, 0x8000000000000000
cmp rcx, rax
jne 0x140038b9a
mov rdx, qword [r15 - 8]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
cmp word [rdx + r8*2 + 2], 0
lea r8, [r8 + 1]
jne 0x140038b10
mov byte [rbp + 0x97f], 1
lea rcx, [rbp - 0x30]
call fcn.140012690
mov rdx, qword [rbp - 0x30]
movabs rax, 0x8000000000000000
cmp rdx, rax
mov rcx, qword [rbp - 0x20]
mov eax, 0
cmove rcx, rax
mov qword [rbp + 0x828], rcx
mov r8, qword [rbp - 0x28]
mov ecx, 1
cmove r8, rcx
mov qword [rbp + 0x918], r8
cmove rdx, rax
mov qword [rbp + 0x958], rdx
jmp 0x140038bbd
test r12d, r12d
je 0x140038b8e
mov rcx, qword [0x14006a2b8]
xor edx, edx
mov r8, qword [rbp + 0x960]
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea r14, [rbp + 0x818]
jmp 0x140038a1d
mov qword [rbp + 0x958], rcx
mov rax, qword [rbp + 0x878]
mov qword [rbp + 0x918], rax
mov rax, qword [rbp + 0x880]
mov qword [rbp + 0x828], rax
mov rdx, qword [r15 - 8]
mov qword [rbp + 0x7c0], 0
mov dword [rbp + 0x6e0], 0
mov dword [rbp + 0x720], 0
mov byte [rbp + 0x97e], 0
lea rax, [rbp + 0x720]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x6e0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x7c0]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0xffffffff
lea rcx, [0x14005aac8]
xor r8d, r8d
mov r9d, 1
call sub.NETAPI32.dll_NetUserGetLocalGroups
test eax, eax
je 0x140038c50
mov qword [rbp + 0x8d0], 0
mov qword [rbp + 0x8d8], 8
xor eax, eax
mov qword [rbp + 0x980], rax
jmp 0x140038dd2
mov ebx, dword [rbp + 0x6e0]
test rbx, rbx
je 0x140038c86
lea rax, [rbx*8]
lea r12, [rax + rax*2]
movzx eax, byte [0x14006a320]
xor ecx, ecx
mov rdx, r12
call fcn.140030bd0
test rax, rax
je 0x14003960d
mov rsi, rax
jmp 0x140038c8b
mov esi, 8
mov qword [rbp + 0x8d0], rbx
mov qword [rbp + 0x8d8], rsi
mov qword [rbp + 0x8e0], 0
mov rax, qword [rbp + 0x7c0]
test rax, rax
je 0x140038ce5
mov r14, rax
mov r12d, dword [rbp + 0x6e0]
cmp ebx, r12d
jae 0x140038d14
mov byte [rbp + 0x97e], 1
lea rcx, [rbp + 0x8d0]
mov rdx, r12
call fcn.14004c410
mov rsi, qword [rbp + 0x8d8]
mov rax, qword [rbp + 0x8e0]
jmp 0x140038d2e
mov rax, qword [rbp + 0x8e0]
mov qword [rbp + 0x880], rax
mov rax, qword [rbp + 0x8d0]
mov qword [rbp + 0x870], rax
mov rax, qword [rbp + 0x8d8]
mov qword [rbp + 0x878], rax
jmp 0x140038e0d
mov eax, 0
mov qword [rbp + 0x980], rax
mov eax, 0
test r12d, r12d
je 0x140038dd2
mov qword [rbp + 0x980], rax
xor ebx, ebx
nop word [rax + rax]
mov rdx, qword [r14 + rbx*8]
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
cmp word [rdx + r8*2 + 2], 0
lea r8, [r8 + 1]
jne 0x140038d50
lea rcx, [rbp + 0x870]
call fcn.140012690
mov rax, qword [rbp + 0x870]
movabs rcx, 0x8000000000000000
cmp rax, rcx
mov rcx, qword [rbp + 0x880]
mov r8d, 0
cmove rcx, r8
mov rdx, qword [rbp + 0x878]
mov r9d, 1
cmove rdx, r9
cmove rax, r8
mov r9, qword [rbp + 0x980]
lea r8, [r9 + r9*2]
mov qword [rsi + r8*8], rax
mov qword [rsi + r8*8 + 8], rdx
mov qword [rsi + r8*8 + 0x10], rcx
inc r9
mov qword [rbp + 0x980], r9
inc rbx
cmp rbx, r12
jne 0x140038d40
mov rcx, qword [rbp + 0x7c0]
mov rax, qword [rbp + 0x8d0]
mov qword [rbp + 0x870], rax
mov rax, qword [rbp + 0x8d8]
mov qword [rbp + 0x878], rax
mov rax, qword [rbp + 0x980]
mov qword [rbp + 0x880], rax
test rcx, rcx
je 0x140038e0d
call sub.NETAPI32.dll_NetApiBufferFree
mov r14, qword [rbp + 0x910]
mov qword [rbp - 0x30], r14
mov rax, qword [rbp + 0x960]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], r14
mov dword [rbp + 0x18], 0
mov rax, qword [rbp + 0x958]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp + 0x918]
mov qword [rbp - 0x10], rax
mov rax, qword [rbp + 0x828]
mov qword [rbp - 8], rax
mov rax, qword [rbp + 0x880]
lea rcx, [rbp]
mov qword [rcx + 0x10], rax
mov rax, qword [rbp + 0x870]
mov qword [rcx], rax
mov rax, qword [rbp + 0x878]
mov qword [rcx + 8], rax
mov rcx, qword [rbp + 0x968]
cmp rcx, qword [rbp + 0x920]
lea rbx, [rbp + 0x86c]
lea r14, [rbp + 0x818]
jne 0x140038eb2
lea rcx, [rbp + 0x920]
call fcn.14003c6e0
mov rax, qword [rbp + 0x928]
mov qword [rbp + 0x988], rax
mov rcx, qword [rbp + 0x930]
lea rax, [rcx + rcx*4]
shl rax, 4
movups xmm0, xmmword [rbp + 0x10]
mov rdx, qword [rbp + 0x988]
movups xmmword [rdx + rax + 0x40], xmm0
movups xmm0, xmmword [rbp - 0x30]
movups xmm1, xmmword [rbp - 0x20]
movdqu xmm2, xmmword [rbp - 0x10]
movdqu xmm3, xmmword [rbp]
movdqu xmmword [rdx + rax + 0x30], xmm3
movdqu xmmword [rdx + rax + 0x20], xmm2
movups xmmword [rdx + rax + 0x10], xmm1
movups xmmword [rdx + rax], xmm0
inc rcx
mov qword [rbp + 0x968], rcx
mov qword [rbp + 0x930], rcx
jmp 0x140038a1d
mov rcx, qword [rbp + 0x770]
cmp r13d, 0xea
jne 0x140038f9f
test rcx, rcx
je 0x140038960
mov byte [rbp + 0x996], 1
call sub.NETAPI32.dll_NetApiBufferFree
jmp 0x140038960
mov rcx, qword [0x14006a2b8]
xor edx, edx
mov r8, rbx
call r12
mov rbx, rdi
test rdi, rdi
je 0x14003889d
mov rdi, qword [rbx + 0x18]
lea rax, [rdi + 0x20]
test rdi, rdi
cmove rax, r15
mov qword [rax], 0
mov rsi, qword [rbx + 8]
mov rdx, qword [rbx + 0x10]
mov rcx, rsi
call fcn.14003c340
cmp qword [rbx], 0
je 0x140038f40
mov rcx, qword [0x14006a2b8]
xor edx, edx
mov r8, rsi
call r12
jmp 0x140038f40
mov rcx, qword [rbp + 0x770]
mov rdi, qword [rbp + 0x968]
test rcx, rcx
je 0x140038fb7
mov byte [rbp + 0x996], 1
call sub.NETAPI32.dll_NetApiBufferFree
mov dword [rbp + 0x830], 0
mov qword [rbp + 0x7c0], 0
lea rcx, [rbp + 0x830]
lea rdx, [rbp + 0x7c0]
call sub.Secur32.dll_LsaEnumerateLogonSessions
mov rsi, qword [rbp + 0x7c0]
test eax, eax
jne 0x1400392be
mov eax, dword [rbp + 0x830]
lea r12, [rsi + rax*8]
mov qword [rbp + 0x968], r12
nop
mov rax, rdi
shl rax, 4
lea rbx, [rax + rax*4]
cmp rsi, r12
je 0x1400392b7
mov r14, rdi
mov qword [rbp + 0x8d0], 0
mov rcx, rsi
lea rdx, [rbp + 0x8d0]
call sub.Secur32.dll_LsaGetLogonSessionData
add rsi, 8
mov rcx, qword [rbp + 0x8d0]
test eax, eax
jne 0x1400392aa
test rcx, rcx
mov rdi, r14
je 0x140039297
cmp dword [rcx + 0x40], 3
je 0x140039082
movzx r13d, word [rcx + 0x10]
mov r15, qword [rcx + 0x18]
mov rdx, qword [rcx + 0x48]
lea rcx, [rbp - 0x30]
call fcn.140035c60
mov rcx, qword [rbp - 0x30]
movabs rax, 0x8000000000000000
cmp rcx, rax
jne 0x1400390a0
mov rdi, r14
mov rcx, qword [rbp + 0x8d0]
test rcx, rcx
je 0x14003900b
call sub.Secur32.dll_LsaFreeReturnBuffer
jmp 0x14003900b
mov qword [rbp + 0x960], rcx
mov rax, qword [rbp - 0x28]
mov qword [rbp + 0x980], rax
mov r12, qword [rbp - 0x20]
test r14, r14
mov rcx, qword [rbp + 0x988]
je 0x140039140
xor edi, edi
jmp 0x1400390d9
add rdi, 0x50
cmp rbx, rdi
je 0x140039140
cmp r12, qword [rcx + rdi + 0x10]
jne 0x1400390d0
mov rax, qword [rbp + 0x988]
mov rcx, qword [rax + rdi + 8]
mov rdx, qword [rbp + 0x980]
mov r8, r12
call sub.VCRUNTIME140.dll_memcmp
mov rcx, qword [rbp + 0x988]
test eax, eax
jne 0x1400390d0
cmp qword [rbp + 0x960], 0
mov rdi, r14
mov r12, qword [rbp + 0x968]
je 0x140039082
mov rcx, qword [0x14006a2b8]
xor edx, edx
mov r8, qword [rbp + 0x980]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140039082
mov byte [rbp + 0x97a], 1
lea rcx, [rbp + 0x870]
mov rdx, qword [rbp + 0x980]
call fcn.14003c4f0
mov rax, qword [rbp + 0x870]
movabs rcx, 0x8000000000000000
cmp rax, rcx
jne 0x1400391c0
shr r13d, 1
mov byte [rbp + 0x97a], 1
lea rcx, [rbp - 0x30]
mov rdx, r15
mov r8, r13
call fcn.140012690
mov rax, qword [rbp - 0x30]
movabs rcx, 0x8000000000000000
cmp rax, rcx
mov r8d, 0
cmove rax, r8
mov rcx, qword [rbp - 0x28]
mov edx, 1
cmove rcx, rdx
mov rdx, qword [rbp - 0x20]
cmove rdx, r8
jmp 0x1400391ce
mov rcx, qword [rbp + 0x878]
mov rdx, qword [rbp + 0x880]
mov r8, qword [rbp + 0x960]
mov qword [rbp - 0x30], r8
mov r8, qword [rbp + 0x980]
mov qword [rbp - 0x28], r8
mov qword [rbp - 0x20], r12
mov dword [rbp + 0x18], 0
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], rcx
mov qword [rbp - 8], rdx
mov qword [rbp], 0
mov qword [rbp + 8], 8
mov qword [rbp + 0x10], 0
mov rdi, r14
cmp r14, qword [rbp + 0x920]
mov rcx, qword [rbp + 0x988]
mov r12, qword [rbp + 0x968]
jne 0x140039247
lea rcx, [rbp + 0x920]
call fcn.14003c6e0
mov rcx, qword [rbp + 0x928]
mov rdi, qword [rbp + 0x930]
lea rax, [rdi + rdi*4]
shl rax, 4
movups xmm0, xmmword [rbp + 0x10]
movups xmmword [rcx + rax + 0x40], xmm0
movups xmm0, xmmword [rbp - 0x30]
movups xmm1, xmmword [rbp - 0x20]
movdqu xmm2, xmmword [rbp - 0x10]
movdqu xmm3, xmmword [rbp]
movdqu xmmword [rcx + rax + 0x30], xmm3
movdqu xmmword [rcx + rax + 0x20], xmm2
movups xmmword [rcx + rax + 0x10], xmm1
mov qword [rbp + 0x988], rcx
movups xmmword [rcx + rax], xmm0
inc rdi
mov qword [rbp + 0x930], rdi
mov rcx, qword [rbp + 0x8d0]
test rcx, rcx
je 0x140039000
call sub.Secur32.dll_LsaFreeReturnBuffer
jmp 0x140039000
mov rdi, r14
test rcx, rcx
jne 0x1400392a0
jmp 0x140039000
mov rsi, qword [rbp + 0x7c0]
mov rax, qword [rbp + 0x930]
mov qword [rbp - 0x20], rax
movups xmm0, xmmword [rbp + 0x920]
movaps xmmword [rbp - 0x30], xmm0
test rsi, rsi
je 0x1400392e8
mov byte [rbp + 0x996], 0
mov rcx, rsi
call sub.Secur32.dll_LsaFreeReturnBuffer
mov rsi, qword [rbp + 0x608]
mov rbx, qword [rbp + 0x610]
test rbx, rbx
je 0x140039311
mov rdi, rsi
nop
mov rcx, rdi
call fcn.14003c430
add rdi, 0x50
dec rbx
jne 0x140039300
cmp qword [rbp + 0x600], 0
je 0x14003932d
mov rcx, qword [0x14006a2b8]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rbp - 0x20]
lea rcx, [rbp + 0x600]
mov qword [rcx + 0x10], rax
movaps xmm0, xmmword [rbp - 0x30]
movups xmmword [rcx], xmm0
lea rdx, [rbp + 0x540]
mov r8d, 0x1a0
mov rcx, qword [rbp + 0x520]
call sub.VCRUNTIME140.dll_memcpy
movaps xmm6, xmmword [rbp + 0x9a0]
movaps xmm7, xmmword [rbp + 0x9b0]
movaps xmm8, xmmword [rbp + 0x9c0]
add rsp, 0xa58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rcx, qword [rbp + 0x870]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rax, qword [rbp + 0x960]
movzx eax, byte [rax + 8]
cmp al, 2
jne 0x14003858d
jmp 0x1400385ac
mov rax, qword [rbp + 0x710]
mov qword [rbp + 0x8a0], rax
movaps xmm0, xmmword [rbp + 0x6e0]
movaps xmm1, xmmword [rbp + 0x6f0]
movdqa xmm2, xmmword [rbp + 0x700]
movdqa xmmword [rbp + 0x890], xmm2
movaps xmmword [rbp + 0x880], xmm1
movaps xmmword [rbp + 0x870], xmm0
mov byte [rbp + 0x97d], 0
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x870]
lea r8, [rbp + 0x818]
call fcn.140047b20
mov rax, qword [rbp - 0x30]
movups xmm0, xmmword [rbp - 0x28]
movaps xmmword [rbp + 0x870], xmm0
movups xmm0, xmmword [rbp - 0x18]
movaps xmmword [rbp + 0x880], xmm0
movups xmm0, xmmword [rbp - 8]
movaps xmmword [rbp + 0x890], xmm0
movups xmm0, xmmword [rbp + 8]
movaps xmmword [rbp + 0x8a0], xmm0
movups xmm0, xmmword [rbp + 0x18]
movaps xmmword [rbp + 0x8b0], xmm0
mov rcx, qword [rbp + 0x28]
mov qword [rbp + 0x8c0], rcx
cmp rax, 3
je 0x14003722e
mov qword [rbp - 0x30], rax
movaps xmm0, xmmword [rbp + 0x870]
movaps xmm1, xmmword [rbp + 0x880]
movdqa xmm2, xmmword [rbp + 0x890]
movdqa xmm3, xmmword [rbp + 0x8a0]
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm1
movdqu xmmword [rbp - 8], xmm2
movdqu xmmword [rbp + 8], xmm3
movaps xmm0, xmmword [rbp + 0x8b0]
movups xmmword [rbp + 0x18], xmm0
mov rax, qword [rbp + 0x8c0]
mov qword [rbp + 0x28], rax
movzx eax, byte [0x14006a320]
mov edx, 0x60
xor ecx, ecx
call fcn.140030bd0
test rax, rax
je 0x140039677
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [rax + 0x50], xmm0
movups xmm0, xmmword [rbp + 0x10]
movups xmmword [rax + 0x40], xmm0
movups xmm0, xmmword [rbp - 0x30]
movups xmm1, xmmword [rbp - 0x20]
movdqu xmm2, xmmword [rbp - 0x10]
movdqu xmm3, xmmword [rbp]
movdqu xmmword [rax + 0x30], xmm3
movdqu xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x10], xmm1
mov qword [rbp + 0x988], rax
movups xmmword [rax], xmm0
mov eax, 1
jmp 0x14003723c
mov byte [rbp + 0x979], 1
lea r8, str.C:UsersChara.cargo_registry_srcindex.crates.io_6f17d22bba15001f_sysinfo_0.29.7_srcwindows_sid.rs
xor ecx, ecx
xor edx, edx
call fcn.140049610
jmp 0x140039686
lea rcx, str.key_used_disappeared
lea r8, [0x14005aa70]
mov edx, 0x14
call fcn.140049950
jmp 0x140039686
lea rax, str.C:UsersChara.cargo_registry_srcindex.crates.io_6f17d22bba15001f_sysinfo_0.29.7_srcwindows_network.rs
mov edx, 0x101
mov rcx, r8
mov r8, rax
call fcn.140049680
jmp 0x140039686
mov byte [rbp + 0x97b], 1
mov ecx, 2
mov edx, 0x14
call fcn.1400494e0
jmp 0x140039686
and sil, 1
mov byte [rbp + 0x997], sil
mov ecx, 2
mov edx, 0x14
call fcn.140049500
jmp 0x140039686
mov ecx, 1
mov rdx, qword [rbp + 0x910]
call fcn.1400494e0
jmp 0x140039686
lea rax, str.Expected_SID_revision_to_be_1
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
lea rax, str.C:UsersChara.cargo_registry_srcindex.crates.io_6f17d22bba15001fcrossbeam_epoch_0.9.14_srcinternal.rs
mov qword [rbp - 0x20], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov byte [rbp + 0x979], 0
mov rcx, rdx
lea rdx, [rbp - 0x30]
call fcn.14004d710
jmp 0x140039686
mov ecx, 0x56410
call fcn.140016c30
mov ecx, 1
mov edx, 9
call fcn.1400494e0
jmp 0x140039686
mov ecx, 8
mov edx, 0x120
call fcn.1400494e0
jmp 0x140039686
mov byte [rbp + 0x97e], 0
mov ecx, 8
mov rdx, r12
call fcn.1400494e0
jmp 0x140039686
lea rcx, str.global_key_idle_disappearedC:UsersChara.cargo_registry_srcindex.crates.io_6f17d22bba15001f_sysinfo_0.29.7_srcwindows_system.rs
lea r8, [0x14005aa40]
mov edx, 0x1b
call fcn.140049950
jmp 0x140039686
mov ecx, 1
mov edx, 0x1e
call fcn.1400494e0
jmp 0x140039686
mov ecx, 1
mov edx, 5
call fcn.1400494e0
jmp 0x140039686
mov qword [rbp + 0x988], r14
mov ecx, 1
mov edx, 0x32
call fcn.1400494e0
jmp 0x140039686
mov ecx, 8
mov edx, 0x60
call fcn.140049500
ud2