Function at 0x1400b6701
Capabilities:
Check os version
Get disk information
Get disk size
Get local ipv4 addresses
Get logon sessions
Get memory capacity
List groups for user account
List user accounts

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x978
movaps xmmword [rsp + 0x960], xmm9
movdqa xmmword [rsp + 0x950], xmm8
movaps xmmword [rsp + 0x940], xmm7
movaps xmmword [rsp + 0x930], xmm6
mov r12, rdx
mov qword [rsp + 0x368], rcx
mov eax, dword [0x14014d2d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x130], 0
jne 0x1400b6763
call fcn.14005fa16
mov eax, dword [0x14014d2d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rdi, qword [rax + 0x138]
mov r13, qword [rax + 0x140]
lea rcx, [rdi + 1]
mov qword [rax + 0x138], rcx
mov al, byte [0x14014d2a0]
mov edx, 0x54410
xor ecx, ecx
call fcn.1400abc70
test rax, rax
je 0x1400b937e
mov rsi, rax
add rsi, 0x54000
mov r8d, 0x410
mov rcx, rsi
mov dl, 0xff
call sub.VCRUNTIME140.dll_memset
mov ecx, 9
call fcn.140085c2f
mov r14, rax
mov r15, rdx
movabs rax, 0x5043206c61746f54
mov qword [rdx], rax
mov byte [rdx + 8], 0x55
mov al, byte [0x14014d2a0]
mov edx, 0x120
xor ecx, ecx
call fcn.1400abc70
test rax, rax
je 0x1400b9388
mov rbx, rax
mov qword [rsp + 0x40], r14
mov r14, r12
mov eax, dword [0x14014d2d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x130], 0
jne 0x1400b682c
call fcn.14005fa16
mov eax, dword [0x14014d2d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rbp, qword [rax + 0x138]
mov rcx, qword [rax + 0x140]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 1]
mov qword [rax + 0x138], rcx
lea r12, [rsp + 0x3e0]
mov qword [r12], 0
mov rax, qword [0x14014b050]
mov rcx, r12
call rax
mov rax, qword [r12]
movabs rcx, 0x19db1ded53e8000
cmp rax, rcx
mov qword [rsp + 0xe8], r14
jl 0x1400b68e2
movabs rcx, 0xfe624e212ac18000
add rax, rcx
movabs rcx, 0xd6bf94d5e57a42bd
mul rcx
mov r12, rdx
shr r12, 0x17
call sub.kernel32.dll_GetTickCount64
shr rax, 3
movabs rcx, 0x20c49ba5e353f7cf
mul rcx
shr rdx, 4
xor eax, eax
sub r12, rdx
cmovae rax, r12
mov r12, qword [rsp + 0xe8]
jmp 0x1400b68e7
mov r12, r14
xor eax, eax
mov qword [rsp + 0x270], rsi
mov qword [rsp + 0x278], 0x3ff
mov qword [rsp + 0x280], 0x380
xor ecx, ecx
mov qword [rsp + 0x288], rcx
mov qword [rsp + 0x290], rdi
mov qword [rsp + 0x298], r13
pxor xmm8, xmm8
movdqu xmmword [rsp + 0x2d0], xmm8
movdqu xmmword [rsp + 0x2e0], xmm8
mov rdx, qword [rsp + 0x40]
mov qword [rsp + 0x198], rdx
mov qword [rsp + 0x1a0], r15
mov qword [rsp + 0x1a8], 9
mov qword [rsp + 0x1b0], rcx
mov edx, 1
mov qword [rsp + 0x1b8], rdx
movdqu xmmword [rsp + 0x1c0], xmm8
mov qword [rsp + 0x1d0], rdx
mov qword [rsp + 0x1d8], rcx
movabs rdx, 0x8000000000000000
mov qword [rsp + 0x1e0], rdx
mov qword [rsp + 0x1f8], rcx
mov dword [rsp + 0x200], 0
mov qword [rsp + 0x208], rcx
mov edx, 8
mov qword [rsp + 0x210], rdx
mov qword [rsp + 0x218], rcx
mov byte [rsp + 0x220], 0
mov qword [rsp + 0x228], rcx
mov qword [rsp + 0x230], rdx
mov qword [rsp + 0x238], rcx
mov qword [rsp + 0x240], 2
mov qword [rsp + 0x248], rbx
mov qword [rsp + 0x250], rcx
mov qword [rsp + 0x2f0], rcx
movdqu xmm6, xmmword [0x1401377a0]
movdqu xmmword [rsp + 0x2b0], xmm6
movdqu xmm7, xmmword [0x140137790]
movdqu xmmword [rsp + 0x2a0], xmm7
mov qword [rsp + 0x2c0], rbp
mov r8, qword [rsp + 0x48]
mov qword [rsp + 0x2c8], r8
mov qword [rsp + 0x330], rax
mov qword [rsp + 0x258], rcx
mov qword [rsp + 0x260], rdx
mov qword [rsp + 0x268], rcx
cmp byte [r12 + 4], 0
je 0x1400b6b4f
lea rsi, [rsp + 0xa0]
movdqa xmmword [rsi], xmm8
movdqa xmmword [rsi + 0x30], xmm8
movdqa xmmword [rsi + 0x20], xmm8
movdqa xmmword [rsi + 0x10], xmm8
mov dword [rsi], 0x40
mov rcx, rsi
call sub.kernel32.dll_GlobalMemoryStatusEx
movdqu xmm0, xmmword [rsi + 8]
movdqu xmmword [rsp + 0x2d0], xmm0
lea rcx, [rsp + 0x3e0]
movdqa xmmword [rcx + 0x50], xmm8
movdqa xmmword [rcx + 0x40], xmm8
movdqa xmmword [rcx + 0x30], xmm8
movdqa xmmword [rcx + 0x20], xmm8
movdqa xmmword [rcx + 0x10], xmm8
movdqa xmmword [rcx], xmm8
mov qword [rcx + 0x60], 0
mov edx, 0x68
call sub.psapi.dll_GetPerformanceInfo
cmp eax, 1
jne 0x1400b6b4f
mov rdx, qword [rsp + 0x3f0]
mov r9, qword [rsp + 0x400]
xor r10d, r10d
sub rdx, r9
cmovb rdx, r10
mov rcx, qword [rsp + 0x430]
mov rax, rcx
mul rdx
mov r8, rax
mov r11, 0xffffffffffffffff
cmovo r8, r11
mov rdx, qword [rsp + 0x3e8]
sub rdx, r9
cmovb rdx, r10
mov rax, rcx
mul rdx
cmovo rax, r11
mov qword [rsp + 0x2e0], r8
mov qword [rsp + 0x2e8], rax
cmp byte [r12 + 0xb], 2
je 0x1400b7117
lea r15, [rsp + 0x2f0]
mov r14b, byte [r12 + 0xc]
cmp qword [r15], 0
jne 0x1400b6fbf
lea r8, [rsp + 0x3e0]
mov qword [r8], 0
xor ecx, ecx
xor edx, edx
call sub.pdh.dll_PdhOpenQueryA
mov ebp, eax
test eax, eax
mov byte [rsp + 0x40], r14b
je 0x1400b6b9c
xor ecx, ecx
jmp 0x1400b6d93
mov rbx, qword [rsp + 0x3e0]
mov eax, dword [0x14014d2d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x130], 0
jne 0x1400b6bc5
call fcn.14005fa16
mov eax, dword [0x14014d2d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov r13, qword [rax + 0x138]
mov rdx, qword [rax + 0x140]
lea rcx, [r13 + 1]
mov qword [rax + 0x138], rcx
mov rax, qword [rsp + 0x2f0]
lea rcx, [0x140137780]
test rax, rax
je 0x1400b6d93
mov qword [rsp + 0x98], rdx
mov rcx, qword [rsp + 0x2f8]
mov r12, qword [rsp + 0x308]
mov qword [rsp + 0x48], rcx
lea rdx, [rax + rcx]
inc rdx
movdqa xmm0, xmmword [rax]
pmovmskb r8d, xmm0
not r8d
lea rcx, [rsp + 0x3e0]
mov qword [rcx], rax
add rax, 0x10
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rdx
mov word [rcx + 0x18], r8w
mov qword [rcx + 0x20], r12
call fcn.1400b44fa
test rax, rax
je 0x1400b6c80
lea rsi, [rsp + 0x3e0]
mov rcx, qword [rdx]
call sub.pdh.dll_PdhRemoveCounter
mov rcx, rsi
call fcn.1400b44fa
test rax, rax
jne 0x1400b6c6b
mov rcx, qword [rsp + 0x328]
test rcx, rcx
je 0x1400b6c93
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [rsp + 0x320]
test rcx, rcx
je 0x1400b6ca5
call sub.pdh.dll_PdhCloseQuery
mov rax, qword [rsp + 0x48]
test rax, rax
je 0x1400b6d84
mov qword [rsp + 0xe0], r13
mov qword [rsp + 0x90], rbx
lea rdi, [rax + 1]
test r12, r12
je 0x1400b6d48
mov rsi, qword [rsp + 0x2f0]
movdqa xmm0, xmmword [rsi]
pmovmskb r13d, xmm0
not r13d
lea rbx, [rsi + 0x10]
mov r15, qword [sym.imp.kernel32.dll_HeapFree]
test r13w, r13w
jne 0x1400b6d11
movdqa xmm0, xmmword [rbx]
pmovmskb r13d, xmm0
add rsi, 0xfffffffffffffe00
add rbx, 0x10
cmp r13d, 0xffff
je 0x1400b6cf1
not r13d
bsf ecx, r13d
shl rcx, 5
mov rax, rsi
sub rax, rcx
cmp qword [rax - 0x20], 0
je 0x1400b6d36
mov r8, qword [rax - 0x18]
mov rcx, qword [0x14014d1f0]
xor edx, edx
call r15
dec r12
lea eax, [r13 - 1]
and eax, r13d
mov r13d, eax
test r12, r12
jne 0x1400b6ceb
shl rdi, 5
mov rax, qword [rsp + 0x48]
add rax, rdi
cmp rax, 0xffffffffffffffef
je 0x1400b6d74
mov r8, qword [rsp + 0x2f0]
sub r8, rdi
mov rcx, qword [0x14014d1f0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rbx, qword [rsp + 0x90]
mov r13, qword [rsp + 0xe0]
mov rdx, qword [rsp + 0x98]
lea rcx, [0x140137780]
xor eax, eax
mov qword [rsp + 0x2f0], rcx
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x2f8], xmm0
mov qword [rsp + 0x308], rax
mov qword [rsp + 0x310], r13
mov qword [rsp + 0x318], rdx
mov qword [rsp + 0x320], rbx
mov qword [rsp + 0x328], rax
test ebp, ebp
jne 0x1400b6f9b
lea rsi, [rsp + 0x1e0]
mov bl, byte [rsp + 0x40]
and bl, 1
mov ecx, 0x23
call fcn.140085c2f
movups xmm0, xmmword [str.Processor__Total___Processor_TimeProcessor____Processor_Time36]
movups xmmword [rdx], xmm0
movdqu xmm0, xmmword [0x140133620]
movdqu xmmword [rdx + 0x10], xmm0
mov dword [rdx + 0x1f], 0x656d6954
lea r15, [rsp + 0xa0]
mov qword [r15], rax
mov qword [r15 + 8], rdx
mov qword [r15 + 0x10], 0x23
mov ecx, 5
call fcn.140085c2f
mov dword [rdx], 0x5f746f74
mov byte [rdx + 4], 0x30
lea r9, [rsp + 0x3e0]
mov qword [r9], rax
mov qword [r9 + 8], rdx
mov qword [r9 + 0x10], 5
mov rcx, r15
lea rdx, [rsp + 0x2f0]
mov r8, rsi
call fcn.1400b5f0e
lea rcx, [rsp + 0x198]
mov edx, ebx
call fcn.1400b4e3b
mov rax, qword [rsi + 0x38]
test rax, rax
je 0x1400b6f9b
mov rsi, qword [rsp + 0x210]
add rsi, 0x48
imul r13, rax, 0x70
xor ebp, ebp
mov r15d, 1
mov qword [rsp + 0x148], rbp
inc rbp
lea r14, [rsp + 0x148]
mov qword [rsp + 0xf0], r14
lea rax, [fcn.1400489e0]
mov qword [rsp + 0xf8], rax
lea rax, [0x140133650]
mov qword [rsp + 0x3e0], rax
mov eax, 2
mov qword [rsp + 0x3e8], rax
xor edi, edi
mov qword [rsp + 0x400], rdi
lea r12, [rsp + 0xf0]
mov qword [rsp + 0x3f0], r12
mov qword [rsp + 0x3f8], r15
lea rcx, [rsp + 0x50]
lea rbx, [rsp + 0x3e0]
mov rdx, rbx
call fcn.140041ae0
mov qword [rsp + 0xf0], r14
lea rax, [fcn.1400489e0]
mov qword [rsp + 0xf8], rax
lea rax, str.NoneSomeP
mov qword [rsp + 0x3e0], rax
mov eax, 2
mov qword [rsp + 0x3e8], rax
mov qword [rsp + 0x400], rdi
mov qword [rsp + 0x3f0], r12
mov qword [rsp + 0x3f8], r15
lea rdi, [rsp + 0xa0]
mov rcx, rdi
mov rdx, rbx
call fcn.140041ae0
lea rcx, [rsp + 0x50]
lea rdx, [rsp + 0x2f0]
mov r8, rsi
mov r9, rdi
call fcn.1400b5f0e
add rsi, 0x70
add r13, 0xffffffffffffff90
jne 0x1400b6e9a
cmp qword [rsp + 0x2f0], 0
mov r12, qword [rsp + 0xe8]
mov r14b, byte [rsp + 0x40]
lea r15, [rsp + 0x2f0]
je 0x1400b7117
mov rcx, qword [rsp + 0x320]
call sub.pdh.dll_PdhCollectQueryData
movabs rax, 0x8000000000000000
cmp qword [rsp + 0x1e0], rax
je 0x1400b7009
mov rdx, qword [rsp + 0x1e8]
mov r8, qword [rsp + 0x1f0]
mov rcx, r15
call fcn.1400b65c7
test eax, eax
je 0x1400b93ae
movd dword [rsp + 0x200], xmm0
mov edx, r14d
and dl, 1
lea rsi, [rsp + 0x198]
mov rcx, rsi
call fcn.1400b4e3b
mov rax, qword [rsi + 0x80]
test rax, rax
je 0x1400b7073
mov rsi, qword [rsp + 0x210]
imul rdi, rax, 0x70
xor ebx, ebx
movabs rax, 0x8000000000000000
cmp qword [rsi + rbx + 0x48], rax
je 0x1400b706a
mov rdx, qword [rsi + rbx + 0x50]
mov r8, qword [rsi + rbx + 0x58]
mov rcx, r15
call fcn.1400b65c7
test eax, eax
je 0x1400b9357
movd dword [rsi + rbx + 0x68], xmm0
add rbx, 0x70
cmp rdi, rbx
jne 0x1400b7039
test r14b, 1
je 0x1400b7117
cmp byte [rsp + 0x220], 0
jne 0x1400b7117
mov rsi, qword [rsp + 0x218]
lea rbx, [rsp + 0x3e0]
mov rcx, rbx
mov rdx, rsi
call fcn.1400b56cb
mov rax, qword [rbx]
mov r8, qword [rbx + 8]
test rsi, rsi
je 0x1400b70fb
mov rdx, qword [rsp + 0x3f0]
test rdx, rdx
je 0x1400b70fb
mov rcx, qword [rsp + 0x210]
lea rdx, [rdx*8 - 8]
imul r9, rsi, 0x70
add r9, 0xffffffffffffff90
xor r10d, r10d
xor r11d, r11d
mov rsi, qword [r8 + r11]
mov qword [rcx + r10 + 0x60], rsi
cmp r9, r10
je 0x1400b70fb
lea rsi, [r11 + 8]
add r10, 0x70
cmp rdx, r11
mov r11, rsi
jne 0x1400b70dd
test rax, rax
je 0x1400b710f
mov rcx, qword [0x14014d1f0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov byte [rsp + 0x220], 1
cmp byte [r12 + 6], 0
je 0x1400b7885
xor esi, esi
xor ecx, ecx
xor edx, edx
call sub.ole32.dll_CoInitializeEx
cmp eax, 2
lea rdx, [rsp + 0x3e0]
mov qword [rdx], rsi
mov qword [rdx + 0x10], rsi
mov qword [rdx + 0x20], rsi
setb byte [rdx + 0x30]
lea rsi, [rsp + 0xa0]
mov rcx, rsi
call fcn.1400b59c0
cmp dword [rsi], 2
je 0x1400b7347
mov rax, qword [rsp + 0xd0]
lea rdx, [rsp + 0x3e0]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0xa0]
movdqu xmm1, xmmword [rsp + 0xb0]
movdqu xmm2, xmmword [rsp + 0xc0]
movdqa xmmword [rdx + 0x20], xmm2
movdqa xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0x50]
mov rcx, rsi
call fcn.1400b5a38
cmp qword [rsi], 2
je 0x1400b7347
mov rax, qword [rsp + 0x80]
lea rdx, [rsp + 0x3e0]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x50]
movdqu xmm1, xmmword [rsp + 0x60]
movdqu xmm2, xmmword [rsp + 0x70]
movdqa xmmword [rdx + 0x20], xmm2
movdqa xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0xf0]
mov rcx, rsi
call fcn.1400b5ada
cmp qword [rsi], 2
je 0x1400b7347
mov rax, qword [rsp + 0x120]
lea rdx, [rsp + 0x3e0]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0xf0]
movdqu xmm1, xmmword [rsp + 0x100]
movdqu xmm2, xmmword [rsp + 0x110]
movdqa xmmword [rdx + 0x20], xmm2
movdqa xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0x148]
mov rcx, rsi
call fcn.1400b5bb6
cmp qword [rsi], 2
je 0x1400b7347
mov rax, qword [rsp + 0x178]
lea rdx, [rsp + 0x3e0]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x148]
movdqu xmm1, xmmword [rsp + 0x158]
movdqu xmm2, xmmword [rsp + 0x168]
movdqa xmmword [rdx + 0x20], xmm2
movdqa xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0x370]
mov rcx, rsi
call fcn.1400b5c39
mov rax, qword [rsi]
cmp rax, 2
je 0x1400b7347
movups xmm0, xmmword [rsp + 0x378]
movups xmm1, xmmword [rsp + 0x388]
movups xmm2, xmmword [rsp + 0x398]
lea rsi, [rsp + 0x3a8]
movups xmmword [rsi + 0x28], xmm2
movups xmmword [rsi + 0x18], xmm1
movups xmmword [rsi + 8], xmm0
mov qword [rsi], rax
lea rbx, [rsp + 0xf0]
mov rcx, rbx
mov rdx, rsi
mov r8b, 1
call fcn.1400b5d27
mov rax, qword [rsi + 0x30]
mov qword [rsp + 0x410], rax
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rsi + 0x10]
movdqu xmm2, xmmword [rsi + 0x20]
movdqa xmmword [rsp + 0x400], xmm2
movdqa xmmword [rsp + 0x3f0], xmm1
movdqa xmmword [rsp + 0x3e0], xmm0
mov edi, dword [rbx + 4]
cmp edi, 2
jne 0x1400b923d
lea rcx, [rsp + 0x3e0]
call fcn.1400b4483
mov esi, 8
xor edi, edi
mov r14, qword [rsp + 0x238]
test r14, r14
je 0x1400b7397
mov rbx, qword [rsp + 0x230]
mov r15, qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rbx + 0x38], 0
je 0x1400b7381
mov r8, qword [rbx + 0x40]
mov rcx, qword [0x14014d1f0]
xor edx, edx
call r15
cmp dword [rbx], 2
je 0x1400b738e
mov rcx, rbx
call fcn.1400b4483
add rbx, 0x60
dec r14
jne 0x1400b736a
cmp qword [rsp + 0x228], 0
je 0x1400b73b9
mov r8, qword [rsp + 0x230]
mov rcx, qword [0x14014d1f0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov qword [rsp + 0x228], rdi
mov qword [rsp + 0x230], rsi
mov qword [rsp + 0x238], rdi
mov r15, qword [rsp + 0xe8]
cmp byte [r15 + 1], 0
je 0x1400b7b4a
lea rcx, [rsp + 0xf0]
mov qword [rcx], 0
call sub.iphlpapi.dll_GetIfTable2
test eax, eax
jne 0x1400b8882
mov rax, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x2a8]
lea rdx, [rcx + rax]
inc rdx
movdqa xmm0, xmmword [rax]
pmovmskb r8d, xmm0
not r8d
mov r9, qword [rsp + 0x2b8]
lea rcx, [rsp + 0x3e0]
mov qword [rcx], rax
add rax, 0x10
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rdx
mov word [rcx + 0x18], r8w
mov qword [rcx + 0x20], r9
call fcn.1400b3a2a
test rax, rax
je 0x1400b746e
lea rsi, [rsp + 0x3e0]
mov byte [rdx + 0x6e], 0
mov rcx, rsi
call fcn.1400b3a2a
test rax, rax
jne 0x1400b745d
mov eax, dword [0x14014d2d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp byte [rax + 0x130], 0
jne 0x1400b748f
call fcn.14005fa16
mov eax, dword [0x14014d2d0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0x138]
mov rdx, qword [rax + 0x140]
lea r8, [rcx + 1]
mov qword [rax + 0x138], r8
movdqa xmmword [rsp + 0x3e0], xmm7
movdqa xmmword [rsp + 0x3f0], xmm6
mov qword [rsp + 0x400], rcx
mov qword [rsp + 0x408], rdx
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], 8
mov qword [rsp + 0x60], rax
mov r14, qword [rsp + 0xf0]
mov ebx, dword [r14]
test rbx, rbx
je 0x1400b8313
add r14, 8
xor r12d, r12d
pcmpeqd xmm6, xmm6
mov qword [rsp + 0x90], r14
mov qword [rsp + 0x40], rbx
imul rsi, r12, 0x548
cmp qword [r14 + rsi + 0x4a8], 0
jne 0x1400b753f
cmp qword [r14 + rsi + 0x4b0], 0
je 0x1400b7783
cmp dword [r14 + rsi + 0x48c], 2
je 0x1400b7783
cmp dword [r14 + rsi + 0x420], 0
je 0x1400b7783
mov al, byte [0x14014d2a0]
mov edx, 0x14
xor ecx, ecx
call fcn.1400abc70
test rax, rax
je 0x1400b936f
mov r13, rax
mov eax, dword [r14 + rsi + 0x10]
movzx ecx, byte [r14 + rsi + 0x14]
movzx edx, byte [r14 + rsi + 0x15]
movzx r8d, byte [r14 + rsi + 0x16]
movzx r9d, byte [r14 + rsi + 0x17]
movzx r10d, byte [r14 + rsi + 0x18]
movzx r11d, byte [r14 + rsi + 0x19]
movzx edi, byte [r14 + rsi + 0x1a]
movzx esi, byte [r14 + rsi + 0x1b]
mov dword [r13], eax
mov word [r13 + 4], cx
mov word [r13 + 6], dx
mov word [r13 + 8], r8w
mov word [r13 + 0xa], r9w
mov word [r13 + 0xc], r10w
mov word [r13 + 0xe], r11w
mov word [r13 + 0x10], di
mov word [r13 + 0x12], si
mov ecx, 0xa
call fcn.1400b0bae
mov rbp, rax
mov rsi, rdx
movups xmm0, xmmword [r13]
movups xmmword [rdx], xmm0
mov eax, dword [r13 + 0x10]
mov dword [rdx + 0x10], eax
mov rcx, qword [rsp + 0x400]
mov r14, qword [rsp + 0x408]
mov r9d, 0xa
mov qword [rsp + 0x48], rcx
mov rdx, r14
mov r8, rsi
call fcn.1400b40f4
mov r15, rax
mov rbx, rax
shr rbx, 0x39
mov rax, qword [rsp + 0x3e0]
mov rcx, qword [rsp + 0x3e8]
mov rdx, rcx
and rdx, r15
movd xmm0, ebx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
xor r8d, r8d
mov r9, rdx
movdqu xmm1, xmmword [rax + r9]
movdqa xmm2, xmm1
pcmpeqb xmm2, xmm0
pmovmskb r10d, xmm2
test r10d, r10d
je 0x1400b76ce
bsf r11d, r10d
add r11, r9
and r11, rcx
shl r11, 5
mov rdi, rax
sub rdi, r11
cmp qword [rdi - 0x10], 0xa
jne 0x1400b76be
mov r11, qword [rdi - 0x18]
movdqu xmm2, xmmword [r11]
movdqu xmm3, xmmword [rsi]
pcmpeqb xmm3, xmm2
movd xmm2, dword [r11 + 0x10]
movd xmm4, dword [rsi + 0x10]
pcmpeqb xmm4, xmm2
pand xmm4, xmm3
pmovmskb r11d, xmm4
cmp r11d, 0xffff
je 0x1400b76f3
lea r11d, [r10 - 1]
and r11d, r10d
mov r10d, r11d
test r11w, r11w
jne 0x1400b7671
pcmpeqb xmm1, xmm6
pmovmskb r10d, xmm1
test r10d, r10d
jne 0x1400b7794
add r9, r8
add r9, 0x10
add r8, 0x10
and r9, rcx
jmp 0x1400b7659
shl rbp, 1
test rbp, rbp
je 0x1400b770d
mov rcx, qword [0x14014d1f0]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
mov r14, qword [rsp + 0x90]
mov rbx, qword [rsp + 0x40]
mov eax, dword [rdi - 8]
inc eax
mov dword [rdi - 8], eax
cmp eax, 1
jle 0x1400b773b
mov rcx, qword [0x14014d1f0]
xor edx, edx
mov r8, r13
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1400b7783
mov rdx, qword [rsp + 0x60]
cmp rdx, qword [rsp + 0x50]
jne 0x1400b7756
lea rcx, [rsp + 0x50]
call fcn.140083c45
mov rdx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x58]
mov rcx, rdx
shl rcx, 5
mov dword [rax + rcx], r12d
mov r8d, 0xa
mov qword [rax + rcx + 8], r8
mov qword [rax + rcx + 0x10], r13
mov qword [rax + rcx + 0x18], r8
inc rdx
mov qword [rsp + 0x60], rdx
inc r12
cmp r12, rbx
jne 0x1400b751e
jmp 0x1400b7cab
cmp qword [rsp + 0x3f0], 0
je 0x1400b7855
movdqu xmm0, xmmword [rax + rdx]
pmovmskb r8d, xmm0
test r8d, r8d
je 0x1400b77bc
mov r14, qword [rsp + 0x90]
jmp 0x1400b77e3
mov r9d, 0x10
mov r14, qword [rsp + 0x90]
add rdx, r9
and rdx, rcx
movdqu xmm0, xmmword [rax + rdx]
pmovmskb r8d, xmm0
add r9, 0x10
test r8d, r8d
je 0x1400b77ca
bsf r8d, r8d
add r8, rdx
and r8, rcx
mov dl, byte [rax + r8]
test dl, dl
js 0x1400b7805
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
bsf r8d, edx
mov dl, byte [rax + r8]
lea r9, [r8 - 0x10]
and r9, rcx
mov byte [rax + r8], bl
mov byte [r9 + rax + 0x10], bl
shl r8, 5
mov rdi, rax
sub rdi, r8
and dl, 1
movzx ecx, dl
sub qword [rsp + 0x3f0], rcx
neg r8
mov qword [rax + r8 - 0x20], rbp
mov qword [rdi - 0x18], rsi
mov qword [rdi - 0x10], 0xa
mov dword [rdi - 8], 0
inc qword [rsp + 0x3f8]
jmp 0x1400b7715
lea rcx, [rsp + 0x3e0]
mov rdx, qword [rsp + 0x48]
mov r8, r14
call fcn.1401079d1
mov rax, qword [rsp + 0x3e0]
mov rcx, qword [rsp + 0x3e8]
and r15, rcx
mov rdx, r15
jmp 0x1400b77a3
cmp byte [r12 + 5], 0
je 0x1400b73d1
mov rax, qword [rsp + 0x238]
test rax, rax
je 0x1400b73d1
mov rsi, qword [rsp + 0x230]
lea rdi, [rsp + 0xa8]
shl rax, 5
lea rbx, [rax + rax*2]
xor ebp, ebp
lea r14, [rsp + 0x50]
lea r15, [rsp + 0x3e0]
lea r12, [rsp + 0xf0]
lea r13, [rsp + 0xa0]
mov rax, qword [rsi]
cmp rax, 2
jne 0x1400b7a3d
xor ecx, ecx
xor edx, edx
call sub.ole32.dll_CoInitializeEx
cmp eax, 2
mov qword [rsp + 0x3e0], rbp
mov qword [rsp + 0x3f0], rbp
mov qword [rsp + 0x400], rbp
setb byte [rsp + 0x410]
mov rcx, r14
mov rdx, r15
call fcn.1400b59c0
cmp dword [rsp + 0x50], 2
je 0x1400b79d0
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x410], rax
movdqu xmm0, xmmword [rsp + 0x50]
movups xmm1, xmmword [rsp + 0x60]
movups xmm2, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0x400], xmm2
movaps xmmword [rsp + 0x3f0], xmm1
movdqa xmmword [rsp + 0x3e0], xmm0
mov rcx, r12
mov rdx, r15
call fcn.1400b5a38
cmp qword [rsp + 0xf0], 2
je 0x1400b79d0
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x410], rax
movdqu xmm0, xmmword [rsp + 0xf0]
movups xmm1, xmmword [rsp + 0x100]
movups xmm2, xmmword [rsp + 0x110]
movaps xmmword [rsp + 0x400], xmm2
movaps xmmword [rsp + 0x3f0], xmm1
movdqa xmmword [rsp + 0x3e0], xmm0
mov rcx, r14
mov rdx, r15
call fcn.1400b5ada
cmp qword [rsp + 0x50], 2
jne 0x1400b7b01
mov qword [rsp + 0xf0], 2
mov rax, qword [rsp + 0x120]
mov qword [rsi + 0x30], rax
movups xmm0, xmmword [rsp + 0xf0]
movups xmm1, xmmword [rsp + 0x100]
movups xmm2, xmmword [rsp + 0x110]
movups xmmword [rsi + 0x20], xmm2
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, qword [rsi]
movups xmm0, xmmword [rsi + 8]
movups xmm1, xmmword [rsi + 0x18]
movups xmm2, xmmword [rsi + 0x28]
movaps xmmword [rsp + 0x70], xmm2
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x50], xmm0
cmp rax, 2
jne 0x1400b7a58
mov qword [rsp + 0x3e0], 2
jmp 0x1400b7a85
movups xmm0, xmmword [rsi + 8]
movups xmm1, xmmword [rsi + 0x18]
movups xmm2, xmmword [rsi + 0x28]
movaps xmmword [rsp + 0x70], xmm2
movaps xmmword [rsp + 0x60], xmm1
movaps xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0xa0], rax
movaps xmm0, xmmword [rsp + 0x50]
movaps xmm1, xmmword [rsp + 0x60]
movaps xmm2, xmmword [rsp + 0x70]
movups xmmword [rdi + 0x20], xmm2
movups xmmword [rdi + 0x10], xmm1
movups xmmword [rdi], xmm0
mov rcx, r15
mov rdx, r13
call fcn.1400b5c39
mov rax, qword [rsp + 0x410]
mov qword [rsi + 0x30], rax
movups xmm0, xmmword [rsp + 0x3e0]
movdqu xmm1, xmmword [rsp + 0x3f0]
movdqu xmm2, xmmword [rsp + 0x400]
movdqu xmmword [rsi + 0x20], xmm2
movdqu xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
cmp dword [rsi], 2
je 0x1400b7aee
mov rcx, r15
mov rdx, rsi
xor r8d, r8d
call fcn.1400b5d27
cmp dword [rsp + 0x3e4], 2
je 0x1400b7aee
movss xmm0, dword [rsp + 0x3e0]
movss dword [rsi + 0x58], xmm0
ucomiss xmm0, dword [rsi + 0x5c]
jbe 0x1400b7aee
movss dword [rsi + 0x5c], xmm0
add rsi, 0x60
add rbx, 0xffffffffffffffa0
jne 0x1400b78d9
jmp 0x1400b73d1
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x410], rax
movdqu xmm0, xmmword [rsp + 0x50]
movups xmm1, xmmword [rsp + 0x60]
movups xmm2, xmmword [rsp + 0x70]
movaps xmmword [rsp + 0x400], xmm2
movaps xmmword [rsp + 0x3f0], xmm1
movdqa xmmword [rsp + 0x3e0], xmm0
mov rcx, r12
mov rdx, r15
call fcn.1400b5bb6
jmp 0x1400b79dc
cmp byte [r15], 0
je 0x1400b8882
lea rcx, [rsp + 0x3e0]
mov r8d, 0x548
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x2a0]
mov rcx, qword [rsp + 0x2a8]
lea rdx, [rcx + rax]
inc rdx
movdqa xmm0, xmmword [rax]
pmovmskb r8d, xmm0
not r8d
mov r9, qword [rsp + 0x2b8]
lea rcx, [rsp + 0xa0]
mov qword [rcx], rax
add rax, 0x10
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rdx
mov word [rcx + 0x18], r8w
mov qword [rcx + 0x20], r9
call fcn.1400b3a2a
test rax, rax
je 0x1400b8882
mov rbx, rdx
lea rsi, [rsp + 0x3e0]
mov rdi, 0xffffffffffffffff
lea r14, [rsp + 0xa0]
mov rax, qword [rbx]
mov qword [rsp + 0x3e0], rax
mov dword [rsp + 0x3e8], 0
mov rcx, rsi
call sub.iphlpapi.dll_GetIfEntry2
test eax, eax
jne 0x1400b7c92
mov rax, qword [rbx + 8]
mov rcx, qword [rbx + 0x18]
mov qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x8e0]
mov qword [rbx + 8], rax
mov qword [rbx + 0x20], rcx
mov rax, qword [rsp + 0x898]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x28]
mov qword [rbx + 0x30], rax
mov rax, qword [rsp + 0x8a0]
add rax, qword [rsp + 0x8a8]
cmovb rax, rdi
mov qword [rbx + 0x28], rax
mov rax, qword [rbx + 0x38]
mov qword [rbx + 0x40], rax
mov rax, qword [rsp + 0x8e8]
add rax, qword [rsp + 0x8f0]
cmovb rax, rdi
mov qword [rbx + 0x38], rax
mov rax, qword [rbx + 0x48]
mov qword [rbx + 0x50], rax
mov rax, qword [rsp + 0x8b8]
mov qword [rbx + 0x48], rax
mov rax, qword [rbx + 0x58]
mov qword [rbx + 0x60], rax
mov rax, qword [rsp + 0x900]
mov qword [rbx + 0x58], rax
mov rcx, r14
call fcn.1400b3a2a
mov rbx, rdx
test rax, rax
jne 0x1400b7bdc
jmp 0x1400b8882
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x130], rax
mov rcx, qword [rsp + 0x58]
mov rax, qword [rsp + 0x60]
mov r12, rax
shl r12, 5
add r12, rcx
mov qword [rsp + 0x138], rcx
mov r15, rcx
test rax, rax
je 0x1400b82da
pcmpeqd xmm6, xmm6
mov r15, qword [rsp + 0x138]
mov qword [rsp + 0x190], r12
mov rax, r15
add r15, 0x20
mov rsi, qword [rax + 8]
movabs rcx, 0x8000000000000000
cmp rsi, rcx
je 0x1400b82da
mov edx, dword [rax]
mov rbx, qword [rax + 0x10]
cmp qword [rsp + 0x3f8], 0
je 0x1400b7e15
mov qword [rsp + 0xe0], rdx
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0x48], r15
mov rsi, qword [rax + 0x18]
mov rcx, qword [rsp + 0x400]
mov rdx, qword [rsp + 0x408]
mov rdi, rbx
mov r8, rbx
mov r9, rsi
call fcn.1400b40f4
mov r13, qword [rsp + 0x3e0]
mov r15, qword [rsp + 0x3e8]
mov rbp, r15
and rbp, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
lea rbx, [rsi + rsi]
xor eax, eax
mov qword [rsp + 0x40], rax
movdqu xmm8, xmmword [r13 + rbp]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb r14d, xmm0
test r14d, r14d
je 0x1400b7ded
bsf eax, r14d
add rax, rbp
and rax, r15
shl rax, 5
mov r12, r13
sub r12, rax
cmp rsi, qword [r12 - 0x10]
jne 0x1400b7dde
mov rdx, qword [r12 - 0x18]
mov rcx, rdi
mov r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400b7e1c
lea eax, [r14 - 1]
and eax, r14d
mov r14d, eax
test ax, ax
jne 0x1400b7daf
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x1400b7e19
mov rax, qword [rsp + 0x40]
add rbp, rax
add rbp, 0x10
add rax, 0x10
mov qword [rsp + 0x40], rax
and rbp, r15
jmp 0x1400b7d95
xor eax, eax
jmp 0x1400b7e50
xor r12d, r12d
lea rax, [r12 - 0x20]
test r12, r12
cmove rax, r12
mov r14, qword [rsp + 0x90]
mov r12, qword [rsp + 0x190]
mov r15, qword [rsp + 0x48]
mov rbx, rdi
mov rsi, qword [rsp + 0x98]
mov rdx, qword [rsp + 0xe0]
lea rcx, [rax + 0x18]
test rax, rax
lea rax, [0x1401333c8]
cmove rcx, rax
cmp dword [rcx], 1
jg 0x1400b7eca
imul rdi, rdx, 0x548
lea r13, [r14 + rdi]
lea rdx, [r14 + rdi]
add rdx, 0x1c
xor r8d, r8d
cmp word [rdx + r8*2], 0
je 0x1400b7e99
inc r8
cmp r8, 0x101
jne 0x1400b7e7d
mov r8d, 0x101
jmp 0x1400b7ea6
cmp r8, 0x102
jae 0x1400b9397
lea rcx, [rsp + 0xa0]
call fcn.140041e70
mov rcx, qword [rsp + 0xa0]
movabs rax, 0x8000000000000000
cmp rcx, rax
jne 0x1400b7eef
test rsi, rsi
je 0x1400b7ee1
mov rcx, qword [0x14014d1f0]
xor edx, edx
mov r8, rbx
call qword [sym.imp.kernel32.dll_HeapFree]
cmp r15, r12
jne 0x1400b7cf4
jmp 0x1400b8324
mov qword [rsp + 0x358], r13
mov qword [rsp + 0x180], rdi
mov qword [rsp + 0x188], rcx
mov qword [rsp + 0x98], rsi
mov qword [rsp + 0xe0], rbx
mov qword [rsp + 0x48], r15
mov r8, qword [rsp + 0xa8]
mov rsi, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x2c0]
mov rdx, qword [rsp + 0x2c8]
mov qword [rsp + 0x348], rcx
mov qword [rsp + 0x340], rdx
mov r13, r8
mov r9, rsi
call fcn.1400b3f7d
mov rcx, rax
shr rcx, 0x39
mov rbx, qword [rsp + 0x2a0]
mov r12, qword [rsp + 0x2a8]
mov r15, r12
mov qword [rsp + 0x338], rax
and r15, rax
mov qword [rsp + 0x360], rcx
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor eax, eax
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x350], r15
movdqu xmm8, xmmword [rbx + r15]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb edi, xmm0
test edi, edi
je 0x1400b7fff
bsf eax, edi
add rax, r15
and rax, r12
mov rbp, rax
neg rbp
shl rax, 3
shl rbp, 7
sub rbp, rax
cmp qword [rbx + rbp - 0x78], rsi
jne 0x1400b7ff3
add rbp, rbx
mov rcx, qword [rbp - 0x80]
mov rdx, r13
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400b802e
lea eax, [rdi - 1]
and eax, edi
mov edi, eax
test ax, ax
jne 0x1400b7fbc
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x1400b8117
mov rax, qword [rsp + 0x40]
add r15, rax
add r15, 0x10
add rax, 0x10
mov qword [rsp + 0x40], rax
and r15, r12
jmp 0x1400b7fa5
mov rax, qword [rbp - 0x68]
mov rcx, qword [rbp - 0x58]
mov qword [rbp - 0x60], rax
mov rdx, qword [rsp + 0x180]
mov rax, qword [r14 + rdx + 0x500]
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x50], rcx
mov rax, qword [r14 + rdx + 0x4b8]
mov qword [rbp - 0x58], rax
mov rax, qword [rbp - 0x48]
mov qword [rbp - 0x40], rax
mov rax, qword [r14 + rdx + 0x4c0]
add rax, qword [r14 + rdx + 0x4c8]
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov qword [rbp - 0x48], rax
mov rax, qword [rbp - 0x38]
mov qword [rbp - 0x30], rax
mov rax, qword [r14 + rdx + 0x508]
add rax, qword [r14 + rdx + 0x510]
cmovb rax, rcx
mov qword [rbp - 0x38], rax
mov rax, qword [rbp - 0x28]
mov qword [rbp - 0x20], rax
mov rax, qword [r14 + rdx + 0x4d8]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x18]
mov qword [rbp - 0x10], rax
mov rax, qword [r14 + rdx + 0x520]
mov qword [rbp - 0x18], rax
mov byte [rbp - 2], 1
cmp qword [rsp + 0x188], 0
je 0x1400b80ee
mov rcx, qword [0x14014d1f0]
xor edx, edx
mov r8, r13
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x98], 0
mov r15, qword [rsp + 0x48]
mov rbx, qword [rsp + 0xe0]
mov r12, qword [rsp + 0x190]
jne 0x1400b7ecf
jmp 0x1400b7ee1
cmp qword [rsp + 0x2b0], 0
mov rdi, qword [rsp + 0x180]
mov r15, qword [rsp + 0x350]
je 0x1400b829d
mov rax, qword [r14 + rdi + 0x4c0]
add rax, qword [r14 + rdi + 0x4c8]
mov rdx, 0xffffffffffffffff
cmovb rax, rdx
mov rcx, qword [r14 + rdi + 0x508]
add rcx, qword [r14 + rdi + 0x510]
cmovb rcx, rdx
mov r9, qword [r14 + rdi + 0x4b8]
mov rdx, qword [rsp + 0x358]
mov r11, qword [rdx]
mov r10, qword [r14 + rdi + 0x500]
mov r8, qword [r14 + rdi + 0x4d8]
mov rdx, qword [r14 + rdi + 0x520]
movdqu xmm0, xmmword [rbx + r15]
pmovmskb edi, xmm0
test edi, edi
jne 0x1400b81bc
mov r14d, 0x10
add r15, r14
and r15, r12
movdqu xmm0, xmmword [rbx + r15]
pmovmskb edi, xmm0
add r14, 0x10
test edi, edi
je 0x1400b81a4
bsf edi, edi
add rdi, r15
and rdi, r12
mov bpl, byte [rbx + rdi]
test bpl, bpl
js 0x1400b81dd
movdqa xmm0, xmmword [rbx]
pmovmskb edi, xmm0
bsf edi, edi
mov bpl, byte [rbx + rdi]
lea r14, [rdi - 0x10]
and r14, r12
mov r15, qword [rsp + 0x360]
mov byte [rbx + rdi], r15b
mov byte [r14 + rbx + 0x10], r15b
and bpl, 1
movzx r14d, bpl
sub qword [rsp + 0x2b0], r14
mov r14, rdi
neg r14
shl rdi, 3
shl r14, 7
sub r14, rdi
mov rdi, qword [rsp + 0x188]
mov qword [rbx + r14 - 0x88], rdi
mov qword [rbx + r14 - 0x80], r13
mov qword [rbx + r14 - 0x78], rsi
mov qword [rbx + r14 - 0x70], r11
mov qword [rbx + r14 - 0x68], r10
mov qword [rbx + r14 - 0x60], r10
mov qword [rbx + r14 - 0x58], r9
mov qword [rbx + r14 - 0x50], r9
mov qword [rbx + r14 - 0x48], rax
mov qword [rbx + r14 - 0x40], rax
mov qword [rbx + r14 - 0x38], rcx
mov qword [rbx + r14 - 0x30], rcx
mov qword [rbx + r14 - 0x28], r8
mov qword [rbx + r14 - 0x20], r8
mov qword [rbx + r14 - 0x18], rdx
mov qword [rbx + r14 - 0x10], rdx
mov dword [rbx + r14 - 8], 0
mov word [rbx + r14 - 4], 0
mov byte [rbx + r14 - 2], 1
inc qword [rsp + 0x2b8]
mov r14, qword [rsp + 0x90]
jmp 0x1400b80ee
lea rcx, [rsp + 0x2a0]
mov rdx, qword [rsp + 0x348]
mov r8, qword [rsp + 0x340]
call fcn.140107eb5
mov rbx, qword [rsp + 0x2a0]
mov r12, qword [rsp + 0x2a8]
mov r15, qword [rsp + 0x338]
and r15, r12
jmp 0x1400b8136
sub r12, r15
je 0x1400b8324
shr r12, 5
add r15, 0x10
mov rsi, qword [rsp + 0x130]
cmp qword [r15 - 8], 0
je 0x1400b8308
mov r8, qword [r15]
mov rcx, qword [0x14014d1f0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
add r15, 0x20
dec r12
jne 0x1400b82ef
jmp 0x1400b832c
mov eax, 8
mov qword [rsp + 0x138], rax
xor esi, esi
jmp 0x1400b832c
mov rsi, qword [rsp + 0x130]
test rsi, rsi
je 0x1400b8348
mov rcx, qword [0x14014d1f0]
xor edx, edx
mov r8, qword [rsp + 0x138]
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [rsp + 0xf0]
call sub.iphlpapi.dll_FreeMibTable
mov rsi, qword [rsp + 0x3e8]
test rsi, rsi
je 0x1400b8421
mov rdi, qword [rsp + 0x3f8]
test rdi, rdi
je 0x1400b83ee
mov rbx, qword [rsp + 0x3e0]
movdqa xmm0, xmmword [rbx]
pmovmskb r12d, xmm0
not r12d
lea r14, [rbx + 0x10]
mov r15, qword [sym.imp.kernel32.dll_HeapFree]
test r12w, r12w
jne 0x1400b83b9
movdqa xmm0, xmmword [r14]
pmovmskb r12d, xmm0
add rbx, 0xfffffffffffffe00
add r14, 0x10
cmp r12d, 0xffff
je 0x1400b8398
not r12d
bsf ecx, r12d
shl rcx, 5
mov rax, rbx
sub rax, rcx
cmp qword [rax - 0x20], 0
je 0x1400b83de
mov r8, qword [rax - 0x18]
mov rcx, qword [0x14014d1f0]
xor edx, edx
call r15
lea eax, [r12 - 1]
and eax, r12d
mov r12d, eax
dec rdi
jne 0x1400b8392
mov rax, rsi
shl rax, 5
lea rcx, [rsi + rax]
add rcx, 0x20
cmp rcx, 0xffffffffffffffef
je 0x1400b8421
add rax, 0x20
mov r8, qword [rsp + 0x3e0]
sub r8, rax
mov rcx, qword [0x14014d1f0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rsi, qword [rsp + 0x2b8]
test rsi, rsi
je 0x1400b855c
mov rdi, qword [rsp + 0x2a0]
lea rbx, [rdi + 0x10]
movdqa xmm0, xmmword [rdi]
pmovmskb eax, xmm0
not eax
movabs r14, 0xf0f0f0f0f0f0f0f1
pcmpeqd xmm6, xmm6
mov r15, qword [sym.imp.kernel32.dll_HeapFree]
test ax, ax
jne 0x1400b847e
movdqa xmm0, xmmword [rbx]
pmovmskb eax, xmm0
add rdi, 0xfffffffffffff780
add rbx, 0x10
cmp eax, 0xffff
je 0x1400b8462
not eax
mov r12d, eax
bsf ecx, r12d
mov rax, rcx
neg rax
shl rcx, 3
shl rax, 7
sub rax, rcx
cmp byte [rdi + rax - 2], 0
jne 0x1400b854b
add rax, rdi
mov rcx, qword [rsp + 0x2a0]
mov rdx, rcx
sub rdx, rax
sar rdx, 3
imul rdx, r14
lea r8, [rdx - 0x10]
and r8, qword [rsp + 0x2a8]
movdqu xmm0, xmmword [rcx + r8]
pcmpeqb xmm0, xmm6
psllw xmm0, 7
pmovmskb r9d, xmm0
test r9d, r9d
je 0x1400b84ea
bsr r9w, r9w
xor r9d, 0xf
jmp 0x1400b84ef
mov r9w, 0x10
movdqu xmm0, xmmword [rcx + rdx]
pcmpeqb xmm0, xmm6
pmovmskb r10d, xmm0
or r10d, 0x10000
bsf r10d, r10d
add r9d, r10d
mov r10b, 0x80
cmp r9w, 0xf
ja 0x1400b8520
inc qword [rsp + 0x2b0]
mov r10b, 0xff
mov byte [rcx + rdx], r10b
mov byte [r8 + rcx + 0x10], r10b
dec qword [rsp + 0x2b8]
cmp qword [rax - 0x88], 0
je 0x1400b854b
mov r8, qword [rax - 0x80]
mov rcx, qword [0x14014d1f0]
xor edx, edx
call r15
lea eax, [r12 - 1]
and eax, r12d
dec rsi
jne 0x1400b845d
lea rdi, [rsp + 0x370]
mov dword [rdi], 0x3c00
mov ebx, 3
mov r15, qword [rsp + 0xe8]
mov ecx, dword [rsp + 0x370]
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
je 0x1400b85ea
mov rsi, rax
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0xe
xor r8d, r8d
mov r9, rax
call sub.iphlpapi.dll_GetAdaptersAddresses
mov dword [rsp + 0x148], eax
cmp eax, 0x6f
jne 0x1400b85bf
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
dec ebx
jne 0x1400b8577
jmp 0x1400b8645
test eax, eax
jne 0x1400b863d
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xb0], rsi
movabs rsi, 0x8000000000000000
mov qword [rsp + 0xa0], rsi
jmp 0x1400b869e
mov ecx, 0x32
call fcn.140085c2f
mov rsi, rax
movups xmm0, xmmword [str.failed_to_allocate_memory_for_IP_ADAPTER_ADDRESSES]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [0x140133800]
movups xmmword [rdx + 0x10], xmm0
movdqu xmm0, xmmword [0x140133810]
movdqu xmmword [rdx + 0x20], xmm0
mov word [rdx + 0x30], 0x5345
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0xb0], 0x32
jmp 0x1400b869e
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
lea rax, [rsp + 0x148]
lea rcx, [rsp + 0x50]
mov qword [rcx], rax
lea rax, [0x14004bdf0]
mov qword [rcx + 8], rax
lea rax, str.GetAdaptersAddresses___failed_with_code
lea rdx, [rsp + 0x3e0]
mov qword [rdx], rax
mov eax, 1
mov qword [rdx + 8], rax
mov qword [rdx + 0x20], 0
mov qword [rdx + 0x10], rcx
mov qword [rdx + 0x18], rax
lea rsi, [rsp + 0xa0]
mov rcx, rsi
call fcn.140041ae0
mov rsi, qword [rsi]
movabs rax, 0x8000000000000000
cmp rsi, rax
jne 0x1400b8866
movdqu xmm0, xmmword [rsp + 0xa8]
lea rdx, [rsp + 0x50]
movdqu xmmword [rdx], xmm0
lea rsi, [rsp + 0x3e0]
mov rcx, rsi
call fcn.1400b5837
mov rcx, qword [rsi]
movabs rax, 0x8000000000000000
cmp rcx, rax
jne 0x1400b86f4
mov rcx, qword [rsp + 0x50]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp 0x1400b8882
pcmpeqd xmm6, xmm6
mov qword [rsp + 0x40], rcx
mov r15, qword [rsp + 0x3e8]
cmp qword [rsp + 0x2b8], 0
je 0x1400b87f6
mov rcx, qword [rsp + 0x2c0]
mov rdx, qword [rsp + 0x2c8]
mov rbx, qword [rsp + 0x3f0]
mov r8, r15
mov r9, rbx
call fcn.1400b3f7d
mov rbp, qword [rsp + 0x2a0]
mov rsi, qword [rsp + 0x2a8]
mov r12, rsi
and r12, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor r14d, r14d
movdqu xmm8, xmmword [rbp + r12]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb edi, xmm0
test edi, edi
je 0x1400b87c1
bsf eax, edi
add rax, r12
and rax, rsi
mov r13, rax
neg r13
shl rax, 3
shl r13, 7
sub r13, rax
cmp rbx, qword [rbp + r13 - 0x78]
jne 0x1400b87b5
add r13, rbp
mov rdx, qword [r13 - 0x80]
mov rcx, r15
mov r8, rbx
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400b87df
lea eax, [rdi - 1]
and eax, edi
mov edi, eax
test ax, ax
jne 0x1400b877e
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x1400b87f6
add r12, r14
add r12, 0x10
add r14, 0x10
and r12, rsi
jmp 0x1400b8766
lea rcx, [rsp + 0x3f8]
movzx eax, word [rcx + 4]
mov word [r13 - 4], ax
mov eax, dword [rcx]
mov dword [r13 - 8], eax
cmp qword [rsp + 0x40], 0
je 0x1400b8810
mov rcx, qword [0x14014d1f0]
xor edx, edx
mov r8, r15
call qword [sym.imp.kernel32.dll_HeapFree]
lea rcx, [rsp + 0x3e0]
lea rdx, [rsp + 0x50]
call fcn.1400b5837
mov rcx, qword [rsp + 0x3e0]
movabs rax, 0x8000000000000000
cmp rcx, rax
jne 0x1400b86f8
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x50]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
movabs rax, 0x8000000000000000
cmp rsi, rax
mov r15, qword [rsp + 0xe8]
je 0x1400b8882
test rsi, rsi
je 0x1400b8882
mov r8, qword [rsp + 0xa8]
mov rcx, qword [0x14014d1f0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
movzx edx, word [r15 + 8]
cmp dl, 2
je 0x1400b88a3
movzx eax, byte [r15 + 0xa]
shl eax, 0x10
or edx, eax
lea rcx, [rsp + 0x198]
call fcn.1400b456a
cmp byte [r15 + 2], 0
je 0x1400b89fc
lea r14, [rsp + 0x240]
call sub.kernel32.dll_GetLogicalDrives
mov dword [rsp + 0x370], eax
test eax, eax
je 0x1400b8a7b
xor eax, eax
mov qword [rsp + 0x148], rax
mov qword [rsp + 0x150], 8
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x370]
mov qword [rsp + 0x3e0], rax
movabs rax, 0x2000000000
mov qword [rsp + 0x3e8], rax
call fcn.14008745f
lea rcx, [rsp + 0x3e0]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 0x20
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 1
lea rsi, [rsp + 0xf0]
mov edx, 0x20
mov rcx, rsi
xor r8d, r8d
mov r9, rax
call fcn.1400afa59
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x1400b8984
mov rcx, qword [rsp + 0xf0]
test rcx, rcx
je 0x1400b8984
xor r8d, r8d
add r8, qword [rcx + 0x10]
dec rax
je 0x1400b897b
mov rcx, qword [rcx + 0x18]
test rcx, rcx
jne 0x1400b8969
test r8, r8
jne 0x1400b9229
mov rax, qword [rsp + 0x100]
lea rdx, [rsp + 0x50]
mov qword [rdx + 0x10], rax
movdqu xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0xa0]
mov rcx, rsi
call fcn.1400b4276
movabs rax, 0x8000000000000000
cmp qword [rsi], rax
jne 0x1400b9146
mov rdi, qword [rsp + 0x150]
mov rbx, qword [rsp + 0x158]
lea rcx, [rsp + 0x50]
call fcn.1400b0599
mov rsi, qword [rsp + 0x148]
mov r15, qword [rsp + 0xe8]
lea r14, [rsp + 0x240]
jmp 0x1400b8a84
cmp byte [r15 + 3], 0
je 0x1400b8aa4
mov rax, qword [rsp + 0x250]
test rax, rax
je 0x1400b8aa4
mov rdi, qword [rsp + 0x248]
shl rax, 4
lea rbx, [rax + rax*8]
xor r14d, r14d
lea rsi, [rsp + 0x3e0]
cmp qword [rdi + r14 + 0x78], 0
je 0x1400b8a6d
mov qword [rsp + 0x3e0], 0
mov rcx, qword [rdi + r14 + 0x50]
xor edx, edx
xor r8d, r8d
mov r9, rsi
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x1400b8a6d
mov rax, qword [rsp + 0x3e0]
mov qword [rdi + r14 + 0x80], rax
add r14, 0x90
cmp rbx, r14
jne 0x1400b8a33
jmp 0x1400b8aa4
mov edi, 8
xor ebx, ebx
xor esi, esi
mov rcx, r14
call fcn.1400af383
mov qword [rsp + 0x240], rsi
mov qword [rsp + 0x248], rdi
mov qword [rsp + 0x250], rbx
cmp byte [r15 + 7], 0
je 0x1400b8f3f
xor r14d, r14d
lea rax, [rsp + 0xf0]
mov qword [rax], r14
mov qword [rax + 8], 8
mov qword [rax + 0x10], r14
lea rax, [rsp + 0x370]
mov qword [rax], r14
lea rax, [rsp + 0x12c]
mov dword [rax], r14d
lea rax, [rsp + 0x140]
mov dword [rax], r14d
lea rax, [rsp + 0x144]
mov dword [rax], r14d
lea r15, [rsp + 0x50]
lea r13, [rsp + 0xa0]
lea rax, [rsp + 0x144]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x140]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x12c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xffffffff
xor ecx, ecx
xor edx, edx
mov r8d, 2
lea r9, [rsp + 0x370]
call sub.netapi32.dll_NetUserEnum
mov dword [rsp + 0x40], eax
cmp eax, 0xea
je 0x1400b8b5e
cmp dword [rsp + 0x40], 0
jne 0x1400b8e26
mov rsi, qword [rsp + 0x370]
mov eax, dword [rsp + 0x12c]
test rax, rax
je 0x1400b8e2e
lea r12, [rsi + rax*8]
mov rbx, qword [rsi]
test rbx, rbx
je 0x1400b8e19
mov qword [rsp + 0x50], 0
mov dword [rsp + 0x3a8], r14d
mov dword [rsp + 0x148], r14d
lea rax, [rsp + 0x148]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x3a8]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], r15
mov dword [rsp + 0x28], 0xffffffff
lea rcx, [0x1401337b0]
mov rdx, rbx
xor r8d, r8d
mov r9d, 1
call sub.netapi32.dll_NetUserGetLocalGroups
test eax, eax
je 0x1400b8c16
mov qword [rsp + 0xa0], r14
mov qword [rsp + 0xa8], 8
mov qword [rsp + 0xb0], r14
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400b8d1b
call sub.netapi32.dll_NetApiBufferFree
jmp 0x1400b8d1b
mov r14d, dword [rsp + 0x3a8]
test r14, r14
je 0x1400b8c4c
lea rax, [r14*8]
lea rbp, [rax + rax*2]
mov al, byte [0x14014d2a0]
xor ecx, ecx
mov rdx, rbp
call fcn.1400abc70
mov rdi, rax
test rax, rax
jne 0x1400b8c51
jmp 0x1400b934a
mov edi, 8
mov qword [rsp + 0xa0], r14
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], 0
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400b8d1b
mov r14d, dword [rsp + 0x3a8]
test r14, r14
je 0x1400b8c0c
xor ebp, ebp
xor r15d, r15d
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x1400b8d1b
mov rdx, qword [rax + r15*8]
lea rcx, [rsp + 0x3e0]
call fcn.1400b0f6b
cmp rbp, qword [rsp + 0xa0]
jne 0x1400b8cd1
mov rcx, r13
mov rdx, rbp
call fcn.1400b1312
mov rdi, qword [rsp + 0xa8]
mov rbp, qword [rsp + 0xb0]
inc r15
lea rax, [rbp*2]
add rax, rbp
mov rcx, qword [rsp + 0x3f0]
mov qword [rdi + rax*8 + 0x10], rcx
movdqu xmm0, xmmword [rsp + 0x3e0]
movdqu xmmword [rdi + rax*8], xmm0
mov rbp, qword [rsp + 0xb0]
inc rbp
mov qword [rsp + 0xb0], rbp
cmp r14, r15
jne 0x1400b8c8d
jmp 0x1400b8bfe
mov rax, qword [rsp + 0xb0]
lea rcx, [rsp + 0x3f8]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0xa0]
mov qword [rcx], rax
mov rax, qword [rsp + 0xa8]
mov qword [rcx + 8], rax
lea r15, [rsp + 0x50]
mov rcx, r15
mov rdx, rbx
call fcn.1400b0f6b
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov rcx, r13
call fcn.140042000
mov rcx, r13
call fcn.14004688e
mov rdi, qword [rsp + 0xa8]
mov rbx, qword [rsp + 0xb0]
movups xmm0, xmmword [rsp + 0x50]
movaps xmmword [rsp + 0x3e0], xmm0
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x3f0], rax
mov rdx, qword [rsp + 0x100]
cmp rdx, qword [rsp + 0xf0]
jne 0x1400b8dc1
lea rcx, [rsp + 0xf0]
call fcn.140051dec
mov rdx, qword [rsp + 0x100]
xor r14d, r14d
mov rax, qword [rsp + 0xf8]
lea rcx, [rdx + rdx*8]
movdqa xmm0, xmmword [rsp + 0x3e0]
movdqa xmm1, xmmword [rsp + 0x3f0]
movdqa xmm2, xmmword [rsp + 0x400]
movdqu xmmword [rax + rcx*8 + 0x20], xmm2
movdqu xmmword [rax + rcx*8 + 0x10], xmm1
movdqu xmmword [rax + rcx*8], xmm0
mov qword [rax + rcx*8 + 0x30], rdi
mov qword [rax + rcx*8 + 0x38], rbx
mov dword [rax + rcx*8 + 0x40], 0
inc rdx
mov qword [rsp + 0x100], rdx
add rsi, 8
cmp rsi, r12
jne 0x1400b8b7a
mov rsi, qword [rsp + 0x370]
test rsi, rsi
je 0x1400b8e47
mov rcx, rsi
call sub.netapi32.dll_NetApiBufferFree
mov qword [rsp + 0x370], 0
cmp dword [rsp + 0x40], 0xea
je 0x1400b8b02
lea rcx, [rsp + 0x3a8]
mov dword [rcx], 0
lea rdx, [rsp + 0x148]
mov qword [rdx], 0
call sub.secur32.dll_LsaEnumerateLogonSessions
test eax, eax
je 0x1400b8f90
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x3f0], rax
movups xmm0, xmmword [rsp + 0xf0]
movaps xmmword [rsp + 0x3e0], xmm0
mov rsi, qword [rsp + 0x268]
test rsi, rsi
je 0x1400b8efc
mov rdi, qword [rsp + 0x260]
add rdi, 0x38
mov rbx, qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rdi], 0
je 0x1400b8ed4
mov r8, qword [rdi - 8]
mov rcx, qword [0x14014d1f0]
xor edx, edx
call rbx
cmp qword [rdi - 0x38], 0
je 0x1400b8eea
mov r8, qword [rdi - 0x30]
mov rcx, qword [0x14014d1f0]
xor edx, edx
call rbx
lea rcx, [rdi - 0x20]
call fcn.1400af578
add rdi, 0x48
dec rsi
jne 0x1400b8ebf
cmp qword [rsp + 0x258], 0
je 0x1400b8f1e
mov r8, qword [rsp + 0x260]
mov rcx, qword [0x14014d1f0]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rax, qword [rsp + 0x3f0]
lea rcx, [rsp + 0x258]
mov qword [rcx + 0x10], rax
movdqa xmm0, xmmword [rsp + 0x3e0]
movdqu xmmword [rcx], xmm0
lea rdx, [rsp + 0x198]
mov r8d, 0x1a0
mov rcx, qword [rsp + 0x368]
call sub.VCRUNTIME140.dll_memcpy
movaps xmm6, xmmword [rsp + 0x930]
movaps xmm7, xmmword [rsp + 0x940]
movaps xmm8, xmmword [rsp + 0x950]
movaps xmm9, xmmword [rsp + 0x960]
add rsp, 0x978
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ebp, dword [rsp + 0x3a8]
test rbp, rbp
je 0x1400b8e7f
lea rsi, [rsp + 0x50]
xor edi, edi
lea rcx, [rdi*8]
add rcx, qword [rsp + 0x148]
mov qword [rsp + 0x50], 0
mov rdx, rsi
call sub.secur32.dll_LsaGetLogonSessionData
test eax, eax
je 0x1400b8fdd
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400b8fed
call sub.secur32.dll_LsaFreeReturnBuffer
jmp 0x1400b8fed
mov rax, qword [rsp + 0x50]
test rax, rax
je 0x1400b8fed
cmp dword [rax + 0x40], 3
jne 0x1400b8ffa
inc rdi
cmp rdi, rbp
jne 0x1400b8fa7
jmp 0x1400b8e7f
mov rdx, qword [rax + 0x18]
lea rcx, [rsp + 0xa0]
call fcn.1400b0f6b
mov r14, qword [rsp + 0xf8]
mov r15, qword [rsp + 0x100]
mov r12, qword [rsp + 0xa8]
mov r13, qword [rsp + 0xb0]
test r15, r15
je 0x1400b9066
lea rax, [r15*8]
lea rbx, [rax + rax*8]
xor esi, esi
cmp qword [r14 + rsi + 0x10], r13
jne 0x1400b905d
mov rcx, qword [r14 + rsi + 8]
mov rdx, r12
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400b911b
add rsi, 0x48
cmp rbx, rsi
jne 0x1400b903e
lea rsi, [rsp + 0x3e0]
mov rcx, rsi
mov rdx, r12
mov r8, r13
call fcn.140042000
mov rcx, rsi
call fcn.14004688e
mov r12, qword [rsp + 0x3e8]
mov r13, qword [rsp + 0x3f0]
cmp r15, qword [rsp + 0xf0]
jne 0x1400b90be
lea rcx, [rsp + 0xf0]
mov rdx, r15
call fcn.140051dec
mov r14, qword [rsp + 0xf8]
mov r15, qword [rsp + 0x100]
lea rsi, [rsp + 0x50]
lea rax, [r15 + r15*8]
mov rcx, qword [rsp + 0xb0]
mov qword [r14 + rax*8 + 0x10], rcx
movdqu xmm0, xmmword [rsp + 0xa0]
movdqu xmmword [r14 + rax*8], xmm0
xor ecx, ecx
mov qword [r14 + rax*8 + 0x18], rcx
mov qword [r14 + rax*8 + 0x20], 8
mov qword [r14 + rax*8 + 0x28], rcx
mov qword [r14 + rax*8 + 0x30], r12
mov qword [r14 + rax*8 + 0x38], r13
mov dword [r14 + rax*8 + 0x40], 0
inc r15
mov qword [rsp + 0x100], r15
jmp 0x1400b8fcc
cmp qword [rsp + 0xa0], 0
lea rsi, [rsp + 0x50]
je 0x1400b8fed
mov rcx, qword [0x14014d1f0]
xor edx, edx
mov r8, r12
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1400b8fed
lea r14, [rsp + 0x148]
mov rbx, qword [r14 + 0x10]
lea r15, [rsp + 0x3e0]
lea r12, [rsp + 0xa0]
lea r13, [rsp + 0x50]
movdqu xmm0, xmmword [rsp + 0xa0]
movdqa xmmword [rsp + 0x3e0], xmm0
mov rbp, qword [rsp + 0xb0]
mov qword [rsp + 0x3f0], rbp
mov rsi, qword [rsp + 0x3e8]
mov rax, qword [rsp + 0x148]
sub rax, rbx
cmp rax, rbp
jb 0x1400b920e
mov rdi, qword [rsp + 0x150]
lea rcx, [rbx + rbx*8]
shl rcx, 4
add rcx, rdi
mov rax, rbp
shl rax, 4
lea r8, [rax + rax*8]
mov rdx, rsi
call sub.VCRUNTIME140.dll_memcpy
add rbx, rbp
mov qword [rsp + 0x158], rbx
mov qword [rsp + 0x3f0], 0
mov rcx, r15
call fcn.1400af383
mov rcx, r12
mov rdx, r13
call fcn.1400b4276
movabs rax, 0x8000000000000000
cmp qword [rsp + 0xa0], rax
jne 0x1400b9167
jmp 0x1400b89d5
mov rcx, r14
mov rdx, rbx
mov r8, rbp
call fcn.140107971
mov rbx, qword [rsp + 0x158]
jmp 0x1400b91a1
lea rcx, [rsp + 0x148]
xor edx, edx
call fcn.140107971
jmp 0x1400b8984
lea rax, [rsp + 0x3b0]
movd xmm8, dword [rsp + 0xf0]
movss xmm9, dword [rsp + 0xf8]
mov r15, qword [rax - 8]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmm2, xmmword [rax + 0x20]
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0xb0], xmm1
movaps xmmword [rsp + 0xc0], xmm2
mov esi, 8
mov ecx, 8
call fcn.140085c2f
mov rbx, rax
movabs rax, 0x72657475706d6f43
mov qword [rdx], rax
movdqa xmm0, xmmword [rsp + 0xa0]
movdqa xmm1, xmmword [rsp + 0xb0]
movdqa xmm2, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmmword [rsp + 0x70], xmm2
cmp r15, 3
je 0x1400b734c
mov r14, rdx
mov al, byte [0x14014d2a0]
mov edx, 0x60
xor ecx, ecx
call fcn.1400abc70
test rax, rax
je 0x1400b93c6
mov rsi, rax
mov qword [rax], r15
movdqa xmm0, xmmword [rsp + 0x50]
movdqa xmm1, xmmword [rsp + 0x60]
movdqa xmm2, xmmword [rsp + 0x70]
movdqu xmmword [rax + 8], xmm0
movdqu xmmword [rax + 0x18], xmm1
movdqu xmmword [rax + 0x28], xmm2
mov qword [rax + 0x38], rbx
mov qword [rax + 0x40], r14
mov qword [rax + 0x48], 8
mov dword [rax + 0x50], edi
movss dword [rax + 0x54], xmm9
movd dword [rax + 0x58], xmm8
movd dword [rax + 0x5c], xmm8
mov edi, 1
jmp 0x1400b734e
mov ecx, 8
mov rdx, rbp
call fcn.140100fe0
lea rcx, str.key_used_disappeared
lea r8, [0x140133758]
mov edx, 0x14
call fcn.140101990
mov ecx, 2
mov edx, 0x14
call fcn.140100fe0
mov ecx, 0x54410
call fcn.14005f770
mov ecx, 8
mov edx, 0x120
call fcn.140100fe0
lea rax, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_sysinfo_0.27.8_srcwindows_network.rs
mov edx, 0x101
mov rcx, r8
mov r8, rax
call fcn.140101500
lea rcx, str.global_key_idle_disappearedC:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_sysinfo_0.27.8_srcwindows_system.rs
lea r8, [0x140133728]
mov edx, 0x1b
call fcn.140101990
mov ecx, 8
mov edx, 0x60
call fcn.140100fe0
int3