Function at 0x1400023a3
Capabilities:
Get disk information
Get local ipv4 addresses
Get logon sessions
List groups for user account
List user accounts

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x4f8
movaps xmmword [rsp + 0x4e0], xmm9
movdqa xmmword [rsp + 0x4d0], xmm8
movdqa xmmword [rsp + 0x4c0], xmm7
movdqa xmmword [rsp + 0x4b0], xmm6
mov r14, rcx
call fcn.1400c8d4e
test rax, rax
je 0x14000411d
mov rdi, qword [rax]
mov rbx, qword [rax + 8]
lea rcx, [rdi + 1]
mov qword [rax], rcx
lea rsi, [rsp + 0x2d8]
mov edx, 0x158
mov r8d, 0x1f4
mov rcx, rsi
call fcn.1400c953f
movdqu xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movaps xmmword [rsp + 0xc0], xmm1
movdqa xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xd0], rdi
mov qword [rsp + 0xd8], rbx
lea rdx, [0x14010ae43]
lea rcx, [rsp + 0xf0]
mov r8d, 9
call fcn.1400ca7d1
movabs rcx, 0x8000000000000000
and qword [rsp + 0x108], 0
mov eax, 1
mov qword [rsp + 0x110], rax
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x118], xmm0
mov qword [rsp + 0x128], rax
and qword [rsp + 0x130], 0
mov qword [rsp + 0x138], rcx
and qword [rsp + 0x150], 0
and dword [rsp + 0x158], 0
and qword [rsp + 0x160], 0
mov eax, 8
mov qword [rsp + 0x168], rax
and qword [rsp + 0x170], 0
mov byte [rsp + 0x178], 0
and qword [rsp + 0x1f0], 0
mov qword [rsp + 0x1f8], rax
and qword [rsp + 0x200], 0
mov ecx, 2
mov edx, 8
mov r8d, 0x90
call fcn.1400c7a13
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rdx
and qword [rsp + 0x80], 0
and qword [rsp + 0x1a0], 0
lea rcx, [0x1400ca656]
call fcn.14006e335
mov rsi, rax
mov rdi, rdx
call fcn.1400c3760
mov r8d, edx
lea rbx, [rsp + 0x2d8]
mov rcx, rbx
mov edx, eax
call fcn.1400c3790
test byte [rbx], 1
mov qword [rsp + 0x2d0], r14
je 0x14000255f
xor r14d, r14d
jmp 0x140002580
mov r14, qword [rsp + 0x2e0]
call sub.KERNEL32.dll_GetTickCount64
xor ecx, ecx
mov r8d, 0x3e8
xor edx, edx
div r8
sub r14, rax
cmovb r14, rcx
movaps xmm0, xmmword [rsp + 0xb0]
movaps xmm1, xmmword [rsp + 0xc0]
movaps xmm2, xmmword [rsp + 0xd0]
lea rbx, [rsp + 0x2d8]
movups xmmword [rbx + 0xd8], xmm0
movups xmmword [rbx + 0xe8], xmm1
movups xmmword [rbx + 0xf8], xmm2
xorps xmm0, xmm0
movups xmmword [rbx + 0x138], xmm0
movups xmmword [rbx + 0x148], xmm0
lea rdx, [rsp + 0xf0]
mov r8d, 0x90
mov rcx, rbx
call sub.msvcrt.dll_memcpy
lea rcx, [rsp + 0x368]
movups xmm0, xmmword [rsp + 0x1f0]
movups xmmword [rcx], xmm0
mov rax, qword [rsp + 0x200]
mov qword [rcx + 0x10], rax
lea rcx, [rsp + 0x380]
movups xmm0, xmmword [rsp + 0x70]
movups xmmword [rcx], xmm0
mov rax, qword [rsp + 0x80]
mov qword [rcx + 0x10], rax
movdqu xmm0, xmmword [rsp + 0x1a0]
movups xmm1, xmmword [rsp + 0x1b0]
movups xmm2, xmmword [rsp + 0x1c0]
movups xmm3, xmmword [rsp + 0x1d0]
movdqu xmmword [rcx + 0xb0], xmm0
movups xmmword [rcx + 0xc0], xmm1
movups xmmword [rcx + 0xd0], xmm2
movups xmmword [rcx + 0xe0], xmm3
lea rax, [rsp + 0x3e0]
movdqu xmm6, xmmword [0x14010b090]
movdqu xmmword [rax + 0x10], xmm6
movdqu xmm7, xmmword [0x14010b080]
movdqu xmmword [rax], xmm7
mov qword [rax + 0x20], rsi
mov qword [rax + 0x28], rdi
mov qword [rax + 0x90], r14
lea r12, [rsp + 0x398]
and qword [r12], 0
mov qword [r12 + 8], 8
and qword [r12 + 0x10], 0
mov rcx, rbx
call fcn.1400c7adb
mov rcx, rbx
mov dl, 1
call fcn.1400c7bc0
lea rsi, [rsp + 0x1a0]
mov rcx, rsi
call fcn.1400d0d0e
cmp dword [rsi], 2
je 0x14000290f
mov rax, qword [rsp + 0x1d0]
lea rdx, [rsp + 0xf0]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x1a0]
movups xmm1, xmmword [rsp + 0x1b0]
movups xmm2, xmmword [rsp + 0x1c0]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rcx, [rsp + 0xb0]
call fcn.1400d0d3a
cmp qword [rsp + 0xb0], 2
je 0x14000290f
mov rax, qword [rsp + 0xe0]
lea rdx, [rsp + 0xf0]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0xb0]
movups xmm1, xmmword [rsp + 0xc0]
movups xmm2, xmmword [rsp + 0xd0]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rcx, [rsp + 0x70]
call fcn.1400d0db4
cmp qword [rsp + 0x70], 2
je 0x14000290f
mov rax, qword [rsp + 0xa0]
lea rdx, [rsp + 0xf0]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rsp + 0x80]
movups xmm2, xmmword [rsp + 0x90]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rcx, [rsp + 0x1f0]
call fcn.1400d0e6e
cmp qword [rsp + 0x1f0], 2
je 0x14000290f
mov rax, qword [rsp + 0x220]
lea rdx, [rsp + 0xf0]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x1f0]
movups xmm1, xmmword [rsp + 0x200]
movups xmm2, xmmword [rsp + 0x210]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rcx, [rsp + 0x240]
call fcn.1400d0f5c
cmp qword [rsp + 0x240], 2
je 0x14000290f
mov rax, qword [rsp + 0x270]
lea rdx, [rsp + 0xf0]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x240]
movups xmm1, xmmword [rsp + 0x250]
movups xmm2, xmmword [rsp + 0x260]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rcx, [rsp + 0x478]
call fcn.1400d0fe2
mov rax, qword [rsp + 0x478]
cmp rax, 2
je 0x14000290f
movdqu xmm0, xmmword [rsp + 0x480]
movups xmm1, xmmword [rsp + 0x490]
movups xmm2, xmmword [rsp + 0x4a0]
lea rdx, [rsp + 0x278]
movups xmmword [rdx + 0x28], xmm2
movups xmmword [rdx + 0x18], xmm1
movdqu xmmword [rdx + 8], xmm0
mov qword [rdx], rax
lea rcx, [rsp + 0x1f0]
mov r8b, 1
call fcn.1400d10e5
mov rax, qword [rsp + 0x2a8]
mov qword [rsp + 0xe0], rax
movdqu xmm0, xmmword [rsp + 0x278]
movups xmm1, xmmword [rsp + 0x288]
movups xmm2, xmmword [rsp + 0x298]
movaps xmmword [rsp + 0xd0], xmm2
movaps xmmword [rsp + 0xc0], xmm1
movdqa xmmword [rsp + 0xb0], xmm0
mov ebp, dword [rsp + 0x1f4]
cmp ebp, 2
jne 0x140003fab
lea rcx, [rsp + 0xb0]
call fcn.1400d12b8
mov ebx, 8
xor esi, esi
lea rcx, [rsp + 0x368]
call fcn.1400c7a55
mov qword [rsp + 0x368], rsi
mov qword [rsp + 0x370], rbx
mov qword [rsp + 0x378], rsi
lea rcx, [rsp + 0x1f0]
and qword [rcx], 0
call sub.IPHLPAPI.DLL_GetIfTable2
test eax, eax
jne 0x14000366a
mov rax, qword [rsp + 0x3e0]
mov rcx, qword [rsp + 0x3e8]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [rsp + 0x3f8]
lea rsi, [rsp + 0xf0]
mov qword [rsi], rax
add rax, 0x10
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov word [rsi + 0x18], dx
mov qword [rsi + 0x20], r8
movabs rbx, 0x8000000000000000
mov rcx, rsi
call fcn.1400d18a3
test rax, rax
je 0x1400029b8
mov byte [rdx + 0x6e], 0
jmp 0x1400029a5
lea rcx, [0x1400ca656]
call fcn.14006e335
lea rcx, [rsp + 0x110]
movdqa xmmword [rcx - 0x10], xmm6
movdqa xmmword [rcx - 0x20], xmm7
mov qword [rcx], rax
lea rax, [rsp + 0x70]
and qword [rax], 0
mov qword [rax + 8], 8
and qword [rax + 0x10], 0
mov qword [rcx + 8], rdx
mov rax, qword [rsp + 0x1f0]
lea rcx, [rax + 8]
mov qword [rsp + 0xe8], rcx
mov qword [rsp + 0x1e8], rax
mov r15d, dword [rax]
xor r12d, r12d
pcmpeqd xmm6, xmm6
mov qword [rsp + 0x58], r15
cmp r12, r15
je 0x140002d18
mov rbp, r12
inc r12
imul rax, rbp, 0x548
mov rcx, qword [rsp + 0xe8]
lea rsi, [rcx + rax]
cmp qword [rcx + rax + 0x4a8], 0
jne 0x140002a55
cmp qword [rsi + 0x4b0], 0
je 0x140002a1e
cmp dword [rsi + 0x48c], 2
je 0x140002a1e
cmp dword [rsi + 0x420], 0
je 0x140002a1e
mov al, byte [0x140124138]
mov edx, 0x14
xor ecx, ecx
call fcn.1400c3830
test rax, rax
je 0x1400040dc
mov rbx, rax
mov qword [rsp + 0x50], r12
mov eax, dword [rsi + 0x10]
movzx ecx, byte [rsi + 0x14]
movzx edx, byte [rsi + 0x15]
movzx r8d, byte [rsi + 0x16]
movzx r9d, byte [rsi + 0x17]
movzx r10d, byte [rsi + 0x18]
movzx r11d, byte [rsi + 0x19]
movzx edi, byte [rsi + 0x1a]
movzx esi, byte [rsi + 0x1b]
mov dword [rbx], eax
mov word [rbx + 4], cx
mov word [rbx + 6], dx
mov word [rbx + 8], r8w
mov word [rbx + 0xa], r9w
mov word [rbx + 0xc], r10w
mov word [rbx + 0xe], r11w
mov word [rbx + 0x10], di
mov word [rbx + 0x12], si
mov ecx, 0xa
mov edx, 2
mov r8d, 2
mov qword [rsp + 0x48], rbx
call fcn.1400c7a13
mov qword [rsp + 0x60], rax
mov r15, rdx
mov eax, dword [rbx + 0x10]
mov dword [rdx + 0x10], eax
movups xmm0, xmmword [rbx]
movups xmmword [rdx], xmm0
mov rcx, qword [rsp + 0x110]
mov rdx, qword [rsp + 0x118]
mov r9d, 0xa
mov r8, r15
call fcn.1400cb4a1
mov rbx, qword [rsp + 0xf0]
mov r12, qword [rsp + 0xf8]
mov rsi, r12
and rsi, rax
mov qword [rsp + 0x228], rax
shr rax, 0x39
mov qword [rsp + 0x188], rax
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor r14d, r14d
movdqu xmm8, xmmword [rbx + rsi]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb r13d, xmm0
test r13w, r13w
je 0x140002bb6
bsf eax, r13d
add rax, rsi
and rax, r12
shl rax, 5
mov rdi, rbx
sub rdi, rax
mov rcx, qword [rdi - 0x18]
mov rdx, qword [rdi - 0x10]
mov r9d, 0xa
mov r8, r15
call fcn.1400d0bd9
test al, al
jne 0x140002bd8
lea eax, [r13 - 1]
and eax, r13d
mov r13d, eax
jmp 0x140002b76
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x140002c70
add rsi, r14
add rsi, 0x10
add r14, 0x10
and rsi, r12
jmp 0x140002b62
movabs rbx, 0x8000000000000000
mov rcx, qword [rsp + 0x60]
cmp rcx, rbx
je 0x140002bf4
mov rdx, r15
call fcn.1400d16f6
mov r15, qword [rsp + 0x58]
mov r12, qword [rsp + 0x50]
mov eax, dword [rdi - 8]
inc eax
mov dword [rdi - 8], eax
cmp eax, 1
jle 0x140002c1f
mov ecx, 0xa
mov rdx, qword [rsp + 0x48]
call fcn.1400d16f6
jmp 0x140002a1e
mov rsi, qword [rsp + 0x80]
cmp rsi, qword [rsp + 0x70]
jne 0x140002c38
lea rcx, [rsp + 0x70]
call fcn.140096a9f
mov rax, qword [rsp + 0x78]
mov rcx, rsi
shl rcx, 5
mov dword [rax + rcx], ebp
mov edx, 0xa
mov qword [rax + rcx + 8], rdx
mov r8, qword [rsp + 0x48]
mov qword [rax + rcx + 0x10], r8
mov qword [rax + rcx + 0x18], rdx
inc rsi
mov qword [rsp + 0x80], rsi
jmp 0x140002a1e
cmp qword [rsp + 0x100], 0
mov rsi, qword [rsp + 0x60]
jne 0x140002c95
lea rcx, [rsp + 0xf0]
lea rdx, [rsp + 0x110]
call fcn.1400c9da9
mov rbx, qword [rsp + 0xf0]
mov rdi, qword [rsp + 0xf8]
mov rcx, rbx
mov rdx, rdi
mov r8, qword [rsp + 0x228]
call fcn.1400c92e3
movzx ecx, byte [rbx + rax]
lea rdx, [rax - 0x10]
and rdx, rdi
mov r8, qword [rsp + 0x188]
mov byte [rbx + rax], r8b
mov byte [rbx + rdx + 0x10], r8b
shl rax, 5
mov rdi, rbx
and ecx, 1
sub qword [rsp + 0x100], rcx
sub rdi, rax
neg rax
mov qword [rbx + rax - 0x20], rsi
mov qword [rdi - 0x18], r15
mov qword [rdi - 0x10], 0xa
and dword [rdi - 8], 0
inc qword [rsp + 0x108]
movabs rbx, 0x8000000000000000
jmp 0x140002bf4
mov rdx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x80]
shl rcx, 5
add rcx, rax
mov qword [rsp + 0x1a0], rax
mov qword [rsp + 0x1a8], rax
mov qword [rsp + 0x1b0], rdx
mov qword [rsp + 0x1b8], rcx
add qword [rsp + 0x1e8], 0x24
pcmpeqd xmm6, xmm6
cmp rax, rcx
je 0x140003275
lea rcx, [rax + 0x20]
mov qword [rsp + 0x1a8], rcx
mov rsi, qword [rax + 8]
cmp rsi, rbx
je 0x140003275
mov r13, qword [rax + 0x10]
mov edx, dword [rax]
cmp qword [rsp + 0x108], 0
je 0x140002e83
mov qword [rsp + 0x48], rdx
mov qword [rsp + 0x50], rsi
mov rsi, qword [rax + 0x18]
mov rcx, qword [rsp + 0x110]
mov rdx, qword [rsp + 0x118]
mov r8, r13
mov r9, rsi
call fcn.1400cb4a1
mov rbx, qword [rsp + 0xf0]
mov r14, qword [rsp + 0xf8]
mov r15, r14
and r15, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor ebp, ebp
movdqu xmm8, xmmword [rbx + r15]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb edi, xmm0
test di, di
je 0x140002e3b
bsf r12d, edi
add r12, r15
and r12, r14
mov rax, r12
shl rax, 5
mov rcx, rbx
sub rcx, rax
mov r8, qword [rcx - 0x18]
mov r9, qword [rcx - 0x10]
mov rcx, r13
mov rdx, rsi
call fcn.1400d0bd9
test al, al
jne 0x140002e59
lea eax, [rdi - 1]
and eax, edi
mov edi, eax
jmp 0x140002dff
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x140002e59
add r15, rbp
add r15, 0x10
add rbp, 0x10
and r15, r14
jmp 0x140002dec
shl r12, 5
sub rbx, r12
test di, di
mov eax, 0
cmove rbx, rax
add rbx, 0xffffffffffffffe0
test di, di
cmove rbx, rax
mov rsi, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x48]
jmp 0x140002e85
xor ebx, ebx
lea rax, [rbx + 0x18]
test rbx, rbx
lea rcx, [0x14010b0a0]
cmove rax, rcx
cmp dword [rax], 1
movabs rbx, 0x8000000000000000
jg 0x1400030c7
imul rax, rdx, 0x548
mov rcx, qword [rsp + 0xe8]
lea rdi, [rcx + rax]
lea rdx, [rdi + 0x1c]
add rax, qword [rsp + 0x1e8]
mov ecx, 0x202
xor r8d, r8d
test rcx, rcx
je 0x140002ee7
cmp word [rax + r8*2], 0
je 0x140002eef
inc r8
add rcx, 0xfffffffffffffffe
jmp 0x140002ed1
mov r8d, 0x101
jmp 0x140002efc
cmp r8, 0x102
jae 0x1400040ed
lea rcx, [rsp + 0xb0]
call fcn.14002a510
mov rax, qword [rsp + 0xb0]
cmp rax, rbx
je 0x1400030c7
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x50], rsi
mov r8, qword [rsp + 0xb8]
mov rbp, qword [rsp + 0xc0]
mov rcx, qword [rsp + 0x400]
mov rdx, qword [rsp + 0x408]
mov qword [rsp + 0x48], r8
mov r9, rbp
call fcn.1400cb537
mov r15, qword [rsp + 0x3e0]
mov rbx, qword [rsp + 0x3e8]
mov rdi, rbx
and rdi, rax
mov qword [rsp + 0x228], rax
shr rax, 0x39
mov qword [rsp + 0x188], rax
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor r14d, r14d
movdqu xmm8, xmmword [r15 + rdi]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb r12d, xmm0
test r12w, r12w
je 0x140002feb
bsf eax, r12d
add rax, rdi
and rax, rbx
neg rax
imul rsi, rax, 0x88
mov rcx, qword [r15 + rsi - 0x80]
mov rdx, qword [r15 + rsi - 0x78]
mov r8, qword [rsp + 0x48]
mov r9, rbp
call fcn.1400393aa
test al, al
jne 0x14000300d
lea eax, [r12 - 1]
and eax, r12d
mov r12d, eax
jmp 0x140002fa9
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x1400030e7
add rdi, r14
add rdi, 0x10
add r14, 0x10
and rdi, rbx
jmp 0x140002f95
add r15, rsi
mov rax, qword [r15 - 0x68]
mov rcx, qword [r15 - 0x58]
mov qword [r15 - 0x60], rax
mov rdx, qword [rsp + 0x60]
mov rax, qword [rdx + 0x500]
mov qword [r15 - 0x68], rax
mov qword [r15 - 0x50], rcx
mov rax, qword [rdx + 0x4b8]
mov qword [r15 - 0x58], rax
mov rax, qword [r15 - 0x48]
mov qword [r15 - 0x40], rax
mov rax, qword [rdx + 0x4c0]
add rax, qword [rdx + 0x4c8]
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov qword [r15 - 0x48], rax
mov rax, qword [r15 - 0x38]
mov qword [r15 - 0x30], rax
mov rax, qword [rdx + 0x508]
add rax, qword [rdx + 0x510]
cmovb rax, rcx
mov qword [r15 - 0x38], rax
mov rax, qword [r15 - 0x28]
mov qword [r15 - 0x20], rax
mov rax, qword [rdx + 0x4d8]
mov qword [r15 - 0x28], rax
mov rax, qword [r15 - 0x18]
mov qword [r15 - 0x10], rax
mov rax, qword [rdx + 0x520]
mov qword [r15 - 0x18], rax
mov byte [r15 - 2], 1
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x48]
call fcn.1400969d8
movabs rbx, 0x8000000000000000
mov rsi, qword [rsp + 0x50]
mov rcx, rsi
mov rdx, r13
call fcn.1400d16f6
mov rax, qword [rsp + 0x1a8]
mov rcx, qword [rsp + 0x1b8]
jmp 0x140002d5e
mov r14, qword [rsp + 0x3f0]
test r14, r14
jne 0x140003121
lea rcx, [rsp + 0x3e0]
lea rdx, [rsp + 0x400]
call fcn.1400c98ff
mov r15, qword [rsp + 0x3e0]
mov rbx, qword [rsp + 0x3e8]
mov r14, qword [rsp + 0x3f0]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rcx + 0x4c0]
add rdx, qword [rcx + 0x4c8]
mov rax, 0xffffffffffffffff
cmovb rdx, rax
mov qword [rsp + 0x2c8], rdx
mov rdi, qword [rcx + 0x508]
add rdi, qword [rcx + 0x510]
cmovb rdi, rax
mov rax, qword [rcx]
mov qword [rsp + 0x2b0], rax
mov r12, qword [rcx + 0x500]
mov rax, qword [rcx + 0x4b8]
mov qword [rsp + 0x2b8], rax
mov rax, qword [rcx + 0x4d8]
mov qword [rsp + 0x2c0], rax
mov rsi, qword [rcx + 0x520]
mov rcx, r15
mov rdx, rbx
mov r8, qword [rsp + 0x228]
call fcn.1400c92e3
lea rcx, [rax - 0x10]
and rcx, rbx
movzx edx, byte [r15 + rax]
mov r8, qword [rsp + 0x188]
mov byte [r15 + rax], r8b
mov byte [r15 + rcx + 0x10], r8b
and edx, 1
sub r14, rdx
mov qword [rsp + 0x3f0], r14
neg rax
imul rax, rax, 0x88
mov rcx, qword [rsp + 0x58]
mov qword [r15 + rax - 0x88], rcx
mov rcx, qword [rsp + 0x48]
mov qword [r15 + rax - 0x80], rcx
mov qword [r15 + rax - 0x78], rbp
mov rcx, qword [rsp + 0x2b0]
mov qword [r15 + rax - 0x70], rcx
mov qword [r15 + rax - 0x68], r12
mov qword [r15 + rax - 0x60], r12
mov rcx, qword [rsp + 0x2b8]
mov qword [r15 + rax - 0x58], rcx
mov qword [r15 + rax - 0x50], rcx
mov rcx, qword [rsp + 0x2c8]
mov qword [r15 + rax - 0x48], rcx
mov qword [r15 + rax - 0x40], rcx
mov qword [r15 + rax - 0x38], rdi
mov qword [r15 + rax - 0x30], rdi
mov rcx, qword [rsp + 0x2c0]
mov qword [r15 + rax - 0x28], rcx
mov qword [r15 + rax - 0x20], rcx
mov qword [r15 + rax - 0x18], rsi
mov qword [r15 + rax - 0x10], rsi
and dword [r15 + rax - 8], 0
and word [r15 + rax - 4], 0
mov byte [r15 + rax - 2], 1
inc qword [rsp + 0x3f8]
jmp 0x1400030b8
lea rcx, [rsp + 0x1a0]
call fcn.1400d16b2
mov rcx, qword [rsp + 0x1f0]
call sub.IPHLPAPI.DLL_FreeMibTable
lea rsi, [rsp + 0xf0]
mov rcx, rsi
call fcn.1400c9082
mov rax, qword [rsp + 0x3e0]
mov rcx, qword [rsp + 0x3e8]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov word [rsi + 0x18], dx
mov qword [rsi], rax
add rax, 0x10
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov r14, qword [rsp + 0x3f8]
mov qword [rsi + 0x20], r14
mov ebx, 0x88
test r14, r14
je 0x140003343
mov rcx, rsi
call fcn.1400c8e20
mov r14, qword [rsp + 0x110]
dec r14
mov qword [rsp + 0x110], r14
test rax, rax
je 0x140003343
mov rdi, rax
cmp byte [rax - 2], 0
jne 0x1400032e3
mov rax, qword [rsp + 0x3e0]
sub rax, rdi
cqo
idiv rbx
lea rcx, [rsp + 0x3e0]
mov rdx, rax
call fcn.1400c9274
mov rcx, qword [rdi - 0x88]
mov rdx, qword [rdi - 0x80]
call fcn.1400969d8
jmp 0x1400032e3
lea r12, [rsp + 0x240]
and dword [rsp + 0x70], 0
mov dword [r12], 0x3c00
mov ebp, 4
lea rsi, [rsp + 0xf0]
xor r14d, r14d
dec ebp
je 0x14000344a
mov edx, dword [rsp + 0x240]
mov rcx, r14
call sub.msvcrt.dll_realloc
mov rdi, rax
mov rbx, rax
test rax, rax
jne 0x140003413
mov qword [rsp + 0x20], 1
mov edx, 0x32
mov r9d, 1
mov rcx, rsi
xor r8d, r8d
call fcn.1400402fc
mov r15, qword [rsp + 0xf8]
cmp dword [rsp + 0xf0], 1
je 0x14000410b
mov rbx, qword [rsp + 0x100]
movups xmm0, xmmword [0x14010b6d0]
movups xmmword [rbx + 0x20], xmm0
movups xmm0, xmmword [0x14010b6c0]
movups xmmword [rbx + 0x10], xmm0
movdqu xmm0, xmmword [str.failed_to_allocate_memory_for_IP_ADAPTER_ADDRESSESGetAdaptersAddresses___failed_with_code]
movdqu xmmword [rbx], xmm0
mov word [rbx + 0x30], 0x5345
mov rcx, r14
call sub.msvcrt.dll_free
mov edi, 0x32
movabs rax, 0x8000000000000000
cmp r15, rax
jne 0x1400034c9
mov qword [rsp + 0x20], r12
xor ecx, ecx
mov edx, 0xe
xor r8d, r8d
mov r9, rbx
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
mov dword [rsp + 0x70], eax
mov r14, rbx
cmp eax, 0x6f
je 0x140003368
movabs r15, 0x8000000000000000
test eax, eax
jne 0x14000344d
jmp 0x1400034c9
mov rbx, r14
lea rax, [rsp + 0x70]
mov qword [rsp + 0xb0], rax
lea rax, [0x14010b710]
lea rdx, [rsp + 0xf0]
mov qword [rdx], rax
mov eax, 1
mov qword [rdx + 8], rax
and qword [rdx + 0x20], 0
lea rcx, [0x14002bde0]
mov qword [rsp + 0xb8], rcx
lea rcx, [rsp + 0xb0]
mov qword [rdx + 0x10], rcx
mov qword [rdx + 0x18], rax
lea rcx, [rsp + 0x1a0]
call fcn.1400296b0
mov r15, qword [rsp + 0x1a0]
mov rsi, qword [rsp + 0x1a8]
mov rdi, qword [rsp + 0x1b0]
mov rcx, rbx
call sub.msvcrt.dll_free
mov rbx, rsi
lea r12, [rsp + 0x398]
movabs rax, 0x8000000000000000
cmp r15, rax
jne 0x140003650
lea rax, [rsp + 0x1a0]
mov qword [rax], rbx
mov qword [rax + 8], rdi
pcmpeqd xmm6, xmm6
lea rcx, [rsp + 0xf0]
lea rdx, [rsp + 0x1a0]
call fcn.1400d1cda
mov rbx, qword [rsp + 0xf0]
movabs rax, 0x8000000000000000
cmp rbx, rax
je 0x14000365d
mov r14, qword [rsp + 0xf8]
cmp qword [rsp + 0x3f8], 0
je 0x140003640
mov r15, qword [rsp + 0x100]
mov rcx, qword [rsp + 0x400]
mov rdx, qword [rsp + 0x408]
mov r8, r14
mov r9, r15
call fcn.1400cb537
mov r13, qword [rsp + 0x3e0]
mov rdi, qword [rsp + 0x3e8]
mov rbp, rdi
and rbp, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
mov qword [rsp + 0x48], 0
movdqu xmm8, xmmword [r13 + rbp]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb r12d, xmm0
test r12w, r12w
je 0x1400035eb
bsf eax, r12d
add rax, rbp
and rax, rdi
neg rax
imul rsi, rax, 0x88
mov r8, qword [r13 + rsi - 0x80]
mov r9, qword [r13 + rsi - 0x78]
mov rcx, r14
mov rdx, r15
call fcn.1400d1a53
test al, al
jne 0x14000361e
lea eax, [r12 - 1]
and eax, r12d
mov r12d, eax
jmp 0x1400035ab
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
lea r12, [rsp + 0x398]
jne 0x140003640
mov rax, qword [rsp + 0x48]
add rbp, rax
add rbp, 0x10
add rax, 0x10
mov qword [rsp + 0x48], rax
and rbp, rdi
jmp 0x140003596
add r13, rsi
lea rcx, [rsp + 0x108]
movzx eax, word [rcx + 4]
mov word [r13 - 4], ax
mov eax, dword [rcx]
mov dword [r13 - 8], eax
lea r12, [rsp + 0x398]
mov rcx, rbx
mov rdx, r14
call fcn.1400969d8
jmp 0x1400034f7
mov rcx, r15
mov rdx, rbx
call fcn.1400969d8
jmp 0x14000366a
mov rcx, qword [rsp + 0x1a0]
call sub.msvcrt.dll_free
movabs rbx, 0x8000000000000000
lea rcx, [rsp + 0x2d8]
mov edx, 0x10101
call fcn.1400c8282
call sub.KERNEL32.dll_GetLogicalDrives
mov dword [rsp + 0x240], eax
test eax, eax
je 0x140003845
and qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 8
and qword [rsp + 0x80], 0
lea rax, [rsp + 0x240]
mov qword [rsp + 0xf0], rax
movabs rax, 0x2000000000
mov qword [rsp + 0xf8], rax
mov ecx, 0x20
call fcn.1400cbcd4
and dword [rsp + 0x28], 0
lea rcx, [rsp + 0xf0]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 0x20
mov qword [rsp + 0x20], 1
lea rsi, [rsp + 0xb0]
mov edx, 0x20
mov rcx, rsi
xor r8d, r8d
mov r9, rax
call fcn.1400ce1a6
mov rax, qword [rsp + 0xc0]
xor edx, edx
sub rax, 1
jb 0x14000373e
mov rsi, qword [rsi]
test rsi, rsi
je 0x14000373e
add rdx, qword [rsi + 0x10]
add rsi, 0x18
jmp 0x140003726
lea rcx, [rsp + 0x70]
call fcn.1400ca0fd
movdqu xmm0, xmmword [rsp + 0xb0]
lea r13, [rsp + 0x1a8]
movdqa xmmword [r13 - 8], xmm0
mov r15, qword [rsp + 0xc0]
mov qword [r13 + 8], r15
mov rcx, qword [r13 - 8]
lea rsi, [rsp + 0x70]
lea rdi, [rsp + 0xf0]
test rcx, rcx
je 0x140003851
mov r12, qword [rcx + 0x18]
lea rax, [r12 + 0x20]
test r12, r12
cmove rax, r13
and qword [rax], 0
mov r14, rbx
mov rbx, qword [rcx]
movups xmm0, xmmword [rcx + 8]
movaps xmmword [rsp + 0x1f0], xmm0
call fcn.1400626a4
dec r15
cmp rbx, r14
je 0x140003854
mov qword [rsp + 0xf0], rbx
movdqa xmm0, xmmword [rsp + 0x1f0]
lea rax, [rsp + 0xf8]
movdqu xmmword [rax], xmm0
mov r14, qword [rsp + 0xf8]
mov rbx, qword [rsp + 0x100]
mov rcx, rsi
mov rdx, rbx
call fcn.1400ca0fd
mov rbp, qword [rsp + 0x80]
imul rcx, rbp, 0x90
add rcx, qword [rsp + 0x78]
imul r8, rbx, 0x90
mov rdx, r14
call sub.msvcrt.dll_memcpy
add rbp, rbx
mov qword [rsp + 0x80], rbp
and qword [rsp + 0x100], 0
mov rcx, rdi
call fcn.140001ac6
mov rcx, r12
movabs rbx, 0x8000000000000000
jmp 0x14000377c
mov esi, 8
xor r14d, r14d
xor ebx, ebx
jmp 0x140003882
xor r12d, r12d
lea rcx, [rsp + 0x1a0]
mov qword [rcx], r12
mov qword [rcx + 0x10], r15
lea r12, [rsp + 0x398]
call fcn.1400d037e
mov r14, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rbx, qword [rsp + 0x80]
lea rcx, [rsp + 0x380]
call fcn.140001ac6
mov qword [rsp + 0x380], r14
lea rax, [rsp + 0x240]
and qword [rax], 0
mov qword [rax + 8], 8
and qword [rax + 0x10], 0
lea rax, [rsp + 0x234]
and dword [rax], 0
mov qword [rsp + 0x388], rsi
mov qword [rsp + 0x390], rbx
lea r15, [rsp + 0x278]
lea r13, [rsp + 0x1f0]
movabs rsi, 0x8000000000000000
and qword [rsp + 0x190], 0
and dword [rsp + 0x19c], 0
and dword [rsp + 0x238], 0
lea rax, [rsp + 0x234]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x238]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x19c]
mov qword [rsp + 0x28], rax
or dword [rsp + 0x20], 0xffffffff
xor ecx, ecx
xor edx, edx
mov r8d, 2
lea r9, [rsp + 0x190]
call sub.NETAPI32.dll_NetUserEnum
test eax, eax
je 0x140003950
cmp eax, 0xea
jne 0x140003cb1
mov dword [rsp + 0x188], eax
mov r12, qword [rsp + 0x190]
mov eax, dword [rsp + 0x19c]
lea r14, [r12 + rax*8]
lea rbx, [rsp + 0x240]
cmp r12, r14
je 0x140003c92
mov rdi, r12
add r12, 8
mov rbp, qword [rdi]
test rbp, rbp
je 0x140003972
and qword [rsp + 0x278], 0
xor ecx, ecx
mov rdx, rbp
mov r8d, 0x17
mov r9, r15
call sub.NETAPI32.dll_NetUserGetInfo
test eax, eax
jne 0x140003b94
mov rax, qword [rsp + 0x278]
mov rdx, qword [rax + 0x20]
mov rcx, r13
call fcn.1400d13a4
mov rax, qword [rsp + 0x1f0]
cmp rax, rsi
je 0x140003b94
mov qword [rsp + 0x48], rax
mov r13, qword [rsp + 0x1f8]
mov rax, qword [rsp + 0x200]
mov qword [rsp + 0x1e8], rax
lea rcx, [rsp + 0xf0]
mov rdx, r13
call fcn.1400d14cc
cmp qword [rsp + 0xf0], rsi
jne 0x140003a19
mov rdx, qword [rdi]
lea rcx, [rsp + 0x70]
call fcn.1400cf5a8
jmp 0x140003a38
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x80], rax
movdqu xmm0, xmmword [rsp + 0xf0]
movdqa xmmword [rsp + 0x70], xmm0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x50], rax
and qword [rsp + 0x478], 0
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x60], rax
and dword [rsp + 0x6c], 0
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x58], rax
and dword [rsp + 0x23c], 0
lea rax, [rsp + 0x23c]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x6c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x478]
mov qword [rsp + 0x20], rax
or dword [rsp + 0x28], 0xffffffff
lea rcx, [0x14010b150]
mov rdx, rbp
xor r8d, r8d
mov r9d, 1
call sub.NETAPI32.dll_NetUserGetLocalGroups
test eax, eax
mov qword [rsp + 0xe8], r13
je 0x140003ba6
and qword [rsp + 0xb0], 0
mov qword [rsp + 0xb8], 8
xor r15d, r15d
mov qword [rsp + 0xc0], r15
lea r15, [rsp + 0x278]
mov rax, qword [rsp + 0xc0]
lea rcx, [rsp + 0x120]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0xb0]
mov qword [rcx], rax
mov rax, qword [rsp + 0xb8]
mov qword [rcx + 8], rax
mov rcx, qword [rsp + 0x478]
call fcn.1400cf51d
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0xf0], rax
mov rax, qword [rsp + 0xe8]
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x100], rax
and dword [rsp + 0x138], 0
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x108], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x110], rax
mov rax, qword [rsp + 0x58]
mov qword [rsp + 0x118], rax
mov rcx, rbx
lea rdx, [rsp + 0xf0]
call fcn.1400cf531
lea r13, [rsp + 0x1f0]
mov rcx, qword [rsp + 0x278]
call fcn.1400cf51d
jmp 0x140003972
mov ecx, dword [rsp + 0x6c]
mov edx, 0x18
call fcn.1400cf10f
mov rdi, rdx
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rdx
and qword [rsp + 0xc0], 0
mov r13, qword [rsp + 0x478]
test r13, r13
je 0x140003ae8
mov ebp, dword [rsp + 0x6c]
cmp rax, rbp
jae 0x140003c1d
mov qword [rsp + 0x20], 0x18
mov r9d, 8
lea rcx, [rsp + 0xb0]
xor edx, edx
mov r8, rbp
call fcn.1400403a8
mov rdi, qword [rsp + 0xb8]
mov r15, qword [rsp + 0xc0]
jmp 0x140003c20
xor r15d, r15d
test rbp, rbp
je 0x140003c83
imul rax, r15, 0x18
add rdi, rax
xor ebx, ebx
lea rsi, [r15 + rbx]
mov rdx, qword [r13 + rbx*8]
lea rcx, [rsp + 0x1a0]
call fcn.1400cf5a8
mov rax, qword [rsp + 0x1b0]
mov qword [rdi + 0x10], rax
movdqu xmm0, xmmword [rsp + 0x1a0]
movdqu xmmword [rdi], xmm0
inc rbx
add rdi, 0x18
cmp rbp, rbx
jne 0x140003c2e
add r15, rbx
movabs rsi, 0x8000000000000000
lea rbx, [rsp + 0x240]
jmp 0x140003ad8
movabs rsi, 0x8000000000000000
jmp 0x140003ad8
mov rcx, qword [rsp + 0x190]
cmp dword [rsp + 0x188], 0xea
jne 0x140003cb9
call fcn.1400cf51d
jmp 0x1400038e5
mov rcx, qword [rsp + 0x190]
call fcn.1400cf51d
lea rcx, [rsp + 0x1f0]
and dword [rcx], 0
lea rsi, [rsp + 0x70]
and qword [rsi], 0
mov rdx, rsi
call sub.Secur32.dll_LsaEnumerateLogonSessions
mov rcx, qword [rsi]
test eax, eax
lea r12, [rsp + 0x398]
jne 0x140003f13
mov eax, dword [rsp + 0x1f0]
lea r14, [rcx + rax*8]
lea rsi, [rsp + 0xb0]
lea r15, [rsp + 0xf0]
cmp rcx, r14
je 0x140003f0e
lea rdi, [rcx + 8]
and qword [rsp + 0xb0], 0
mov rdx, rsi
call sub.Secur32.dll_LsaGetLogonSessionData
mov rcx, qword [rsp + 0xb0]
test eax, eax
je 0x140003d3c
call fcn.1400cf527
mov rcx, rdi
jmp 0x140003d08
test rcx, rcx
je 0x140003df2
cmp dword [rcx + 0x40], 3
je 0x140003d32
movzx ebp, word [rcx + 0x10]
mov rbx, qword [rcx + 0x18]
mov rdx, qword [rcx + 0x48]
mov rcx, r15
call fcn.1400d13a4
mov rcx, qword [rsp + 0xf0]
movabs rax, 0x8000000000000000
cmp rcx, rax
je 0x140003de5
mov qword [rsp + 0x48], rcx
mov r12, qword [rsp + 0xf8]
mov r13, qword [rsp + 0x100]
mov rsi, qword [rsp + 0x248]
imul r15, qword [rsp + 0x250], 0x50
test r15, r15
je 0x140003df9
mov rcx, qword [rsi + 8]
mov rdx, qword [rsi + 0x10]
mov r8, r12
mov r9, r13
call fcn.1400393aa
add rsi, 0x50
add r15, 0xffffffffffffffb0
test al, al
je 0x140003d9c
mov rcx, qword [rsp + 0x48]
mov rdx, r12
call fcn.1400969d8
lea r12, [rsp + 0x398]
lea rsi, [rsp + 0xb0]
lea r15, [rsp + 0xf0]
mov rcx, qword [rsp + 0xb0]
jmp 0x140003d32
xor ecx, ecx
jmp 0x140003d32
lea rcx, [rsp + 0x1a0]
mov rdx, r12
call fcn.1400d14cc
lea r15, [rsp + 0xf0]
mov rax, qword [rsp + 0x1a0]
movabs rcx, 0x8000000000000000
cmp rax, rcx
jne 0x140003e76
shr ebp, 1
mov rcx, r15
mov rdx, rbx
mov r8, rbp
call fcn.14002a510
mov rax, qword [rsp + 0xf0]
movabs rcx, 0x8000000000000000
cmp rax, rcx
mov r8d, 0
cmove rax, r8
mov rcx, qword [rsp + 0xf8]
mov edx, 1
cmove rcx, rdx
mov rdx, qword [rsp + 0x100]
cmove rdx, r8
jmp 0x140003e86
mov rcx, qword [rsp + 0x1a8]
mov rdx, qword [rsp + 0x1b0]
mov r8, qword [rsp + 0x48]
mov qword [rsp + 0xf0], r8
mov qword [rsp + 0xf8], r12
mov qword [rsp + 0x100], r13
and dword [rsp + 0x138], 0
mov qword [rsp + 0x108], rax
mov qword [rsp + 0x110], rcx
mov qword [rsp + 0x118], rdx
and qword [rsp + 0x120], 0
mov qword [rsp + 0x128], 8
and qword [rsp + 0x130], 0
lea rcx, [rsp + 0x240]
mov rdx, r15
call fcn.1400cf531
mov rcx, qword [rsp + 0xb0]
lea r12, [rsp + 0x398]
lea rsi, [rsp + 0xb0]
jmp 0x140003d32
mov rcx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x250]
mov qword [rsp + 0x100], rax
movups xmm0, xmmword [rsp + 0x240]
movaps xmmword [rsp + 0xf0], xmm0
call fcn.1400cf527
mov rcx, r12
call fcn.1400c7a98
mov rax, qword [rsp + 0x100]
mov qword [r12 + 0x10], rax
movaps xmm0, xmmword [rsp + 0xf0]
movups xmmword [r12], xmm0
lea rdx, [rsp + 0x2d8]
mov r8d, 0x1a0
mov rcx, qword [rsp + 0x2d0]
call sub.msvcrt.dll_memcpy
movaps xmm6, xmmword [rsp + 0x4b0]
movaps xmm7, xmmword [rsp + 0x4c0]
movaps xmm8, xmmword [rsp + 0x4d0]
movaps xmm9, xmmword [rsp + 0x4e0]
add rsp, 0x4f8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
movd xmm8, dword [rsp + 0x1f0]
movss xmm9, dword [rsp + 0x1f8]
mov rax, qword [rsp + 0x2a8]
mov qword [rsp + 0x120], rax
movdqu xmm0, xmmword [rsp + 0x278]
movups xmm1, xmmword [rsp + 0x288]
movups xmm2, xmmword [rsp + 0x298]
movaps xmmword [rsp + 0x110], xmm2
movaps xmmword [rsp + 0x100], xmm1
movdqa xmmword [rsp + 0xf0], xmm0
lea rdx, str.Computer
lea rcx, [rsp + 0x70]
mov ebx, 8
mov r8d, 8
call fcn.1400d0c96
lea rax, [rsp + 0x280]
mov rcx, qword [rax - 8]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmm2, xmmword [rax + 0x20]
movaps xmmword [rsp + 0x1a0], xmm0
movaps xmmword [rsp + 0x1b0], xmm1
movaps xmmword [rsp + 0x1c0], xmm2
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x1e0], rax
movdqu xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x1d0], xmm0
cmp rcx, 3
je 0x140002914
lea rax, [rsp + 0xf8]
mov qword [rax - 8], rcx
lea rsi, [rsp + 0x1a0]
mov ecx, 9
mov rdi, rax
rep movsq qword [rdi], qword [rsi]
mov dword [rax + 0x48], ebp
movss dword [rax + 0x4c], xmm9
movd dword [rax + 0x50], xmm8
movd dword [rax + 0x54], xmm8
mov ecx, 0x60
call fcn.1400d0c60
test rax, rax
je 0x140004149
mov rbx, rax
lea rsi, [rsp + 0xf0]
mov ecx, 0xc
mov rdi, rax
rep movsq qword [rdi], qword [rsi]
mov esi, 1
jmp 0x140002916
mov ecx, 2
mov edx, 0x14
call fcn.140029260
jmp 0x140004158
mov qword [rsp + 0x50], rsi
lea rax, str._home_ghost_.cargo_registry_src_index.crates.io_6f17d22bba15001f_sysinfo_0.29.11_src_windows_network.rs
mov edx, 0x101
mov rcx, r8
mov r8, rax
call fcn.14002b4e0
jmp 0x140004158
mov rdx, qword [rsp + 0x100]
mov rcx, r15
call fcn.140029200
jmp 0x140004158
lea rax, [0x14010b030]
mov qword [rsp + 0x20], rax
lea rcx, str.cannot_access_a_Thread_Local_Storage_value_during_or_after_destruction_rustc_f6e511eec7342f59a25f7c0534f1dbea00d01b14library_std_src_threadlocal.rs
lea r9, [0x14010b048]
lea r8, [rsp + 0x2d8]
mov edx, 0x46
call fcn.14002ca50
mov ecx, 8
mov edx, 0x60
call fcn.140029260
ud2