Function at 0x140064983
Capabilities:
Enumerate processes via ntquerysysteminformation
Get disk information
Get disk size
Get local ipv4 addresses
Get logon sessions
Get memory capacity
Get system information on windows
List groups for user account
List user accounts

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x8b8
movdqa xmmword [rsp + 0x8a0], xmm8
movdqa xmmword [rsp + 0x890], xmm7
movaps xmmword [rsp + 0x880], xmm6
mov r15, rcx
cmp byte [rdx + 4], 1
mov qword [rsp + 0x48], rdx
jne 0x140064a99
xorps xmm6, xmm6
lea rsi, [rsp + 0x1f0]
movaps xmmword [rsi], xmm6
movaps xmmword [rsi + 0x30], xmm6
movaps xmmword [rsi + 0x20], xmm6
movaps xmmword [rsi + 0x10], xmm6
mov dword [rsi], 0x40
mov rcx, rsi
call sub.KERNEL32.dll_GlobalMemoryStatusEx
mov rax, qword [rsi + 8]
mov qword [r15 + 0x138], rax
mov rax, qword [rsi + 0x10]
mov qword [r15 + 0x140], rax
lea rcx, [rsp + 0x330]
movaps xmmword [rcx + 0x50], xmm6
movaps xmmword [rcx + 0x40], xmm6
movaps xmmword [rcx + 0x30], xmm6
movaps xmmword [rcx + 0x20], xmm6
movaps xmmword [rcx + 0x10], xmm6
movaps xmmword [rcx], xmm6
mov qword [rcx + 0x60], 0
mov edx, 0x68
call sub.PSAPI.DLL_GetPerformanceInfo
cmp eax, 1
jne 0x140064a94
mov rdx, qword [rsp + 0x340]
mov r9, qword [rsp + 0x350]
xor r10d, r10d
sub rdx, r9
cmovb rdx, r10
mov rcx, qword [rsp + 0x380]
mov rax, rcx
mul rdx
mov r8, rax
mov r11, 0xffffffffffffffff
cmovo r8, r11
mov rdx, qword [rsp + 0x338]
sub rdx, r9
cmovb rdx, r10
mov rax, rcx
mul rdx
cmovo rax, r11
mov qword [r15 + 0x148], r8
mov qword [r15 + 0x150], rax
mov rdx, qword [rsp + 0x48]
cmp byte [rdx + 0xb], 2
mov qword [rsp + 0x40], r15
je 0x140064eec
mov bpl, byte [rdx + 0xc]
lea r12, [r15 + 0x158]
cmp qword [r15 + 0x158], 0
je 0x140064c17
mov rcx, qword [r15 + 0x188]
call sub.pdh.dll_PdhCollectQueryData
xor eax, eax
cmp rax, qword [r15 + 0x48]
jo 0x140064aff
mov rdx, qword [r15 + 0x50]
mov r8, qword [r15 + 0x58]
mov rcx, r12
call fcn.140069121
test al, 1
je 0x140067abb
movss xmm1, dword [0x14008a690]
subss xmm1, xmm0
movss dword [r15 + 0x68], xmm1
mov edx, ebp
and dl, 1
mov rcx, r15
call fcn.140067c3c
mov rax, qword [r15 + 0x80]
test rax, rax
je 0x140064b65
mov rsi, qword [r15 + 0x78]
imul rdi, rax, 0x70
xor ebx, ebx
movss xmm6, dword [0x14008a690]
xor r14d, r14d
cmp rbx, qword [rsi + r14 + 0x48]
jo 0x140064b5c
mov rdx, qword [rsi + r14 + 0x50]
mov r8, qword [rsi + r14 + 0x58]
mov rcx, r12
call fcn.140069121
test al, 1
je 0x140067a38
movaps xmm1, xmm6
subss xmm1, xmm0
movss dword [rsi + r14 + 0x68], xmm1
add r14, 0x70
cmp rdi, r14
jne 0x140064b2d
test bpl, 1
mov rdx, qword [rsp + 0x48]
je 0x140064eec
cmp byte [r15 + 0x88], 0
jne 0x140064eec
mov rsi, qword [r15 + 0x80]
lea rdi, [rsp + 0x330]
mov rcx, rdi
mov rdx, rsi
call fcn.14006847b
mov rbx, qword [r15 + 0x78]
mov rax, qword [rdi]
mov r8, qword [rdi + 8]
mov rcx, qword [rdi + 0x10]
test rsi, rsi
sete dl
test rcx, rcx
sete r9b
or r9b, dl
jne 0x140064bf1
lea rcx, [rcx*8 - 8]
imul rdx, rsi, 0x70
add rdx, 0xffffffffffffff90
xor r9d, r9d
xor r10d, r10d
mov r11, qword [r8 + r10]
mov qword [rbx + r9 + 0x60], r11
cmp rdx, r9
je 0x140064bf1
lea r11, [r10 + 8]
add r9, 0x70
cmp rcx, r10
mov r10, r11
jne 0x140064bd3
test rax, rax
je 0x140064c05
mov rcx, qword [0x1400cdc50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rsi, rsi
je 0x140064ed9
mov rax, qword [rbx + 0x60]
jmp 0x140064edb
lea r8, [rsp + 0x330]
mov qword [r8], 0
xor ecx, ecx
xor edx, edx
call sub.pdh.dll_PdhOpenQueryA
test eax, eax
je 0x140064c3d
lea rax, [rsp + 0x1f0]
jmp 0x140064c6e
mov rsi, qword [rsp + 0x330]
lea rcx, [0x14000242e]
call fcn.140025ba0
mov rbx, rax
mov rdi, rdx
lea rax, [0x1400b9030]
mov qword [rsp + 0x1f0], rax
lea rax, [rsp + 0xd0]
mov qword [rax], 0
cmp qword [r12], 0
je 0x140064c8c
mov rcx, r12
call fcn.140068c31
mov rcx, r12
call fcn.14006475d
mov rax, qword [rsp + 0x1f0]
mov qword [r15 + 0x158], rax
xorps xmm0, xmm0
movups xmmword [r15 + 0x160], xmm0
mov qword [r15 + 0x170], 0
mov qword [r15 + 0x178], rbx
mov qword [r15 + 0x180], rdi
mov qword [r15 + 0x188], rsi
mov rcx, qword [rsp + 0xd0]
mov qword [r15 + 0x190], rcx
test rax, rax
mov rdx, qword [rsp + 0x48]
je 0x140064eec
mov al, byte [0x1400cdcc0]
mov esi, 0x1e
mov edx, 0x1e
xor ecx, ecx
call fcn.14005b1d0
test rax, rax
je 0x140067ad3
movups xmm0, xmmword [0x1400b9a8e]
movups xmmword [rax + 0xe], xmm0
movups xmm0, xmmword [str.Processor__Total___Idle_TimeProcessor____Idle_Time]
movups xmmword [rax], xmm0
mov qword [rsp + 0x1f0], rsi
mov qword [rsp + 0x1f8], rax
mov qword [rsp + 0x200], rsi
mov al, byte [0x1400cdcc0]
mov esi, 5
mov edx, 5
xor ecx, ecx
call fcn.14005b1d0
test rax, rax
je 0x140067ae2
lea r8, [r15 + 0x48]
mov byte [rax + 4], 0x30
mov dword [rax], 0x5f746f74
lea r9, [rsp + 0x330]
mov qword [r9], rsi
mov qword [r9 + 8], rax
mov qword [r9 + 0x10], rsi
lea rdi, [rsp + 0x1f0]
mov rcx, rdi
mov rdx, r12
call fcn.140068ccc
mov byte [rsp + 0x58], bpl
mov edx, ebp
and dl, 1
mov rcx, r15
call fcn.140067c3c
mov rax, qword [r15 + 0x80]
test rax, rax
mov qword [rsp + 0x50], r12
je 0x140064eb8
mov rcx, qword [rsp + 0x40]
mov rbx, qword [rcx + 0x78]
add rbx, 0x48
imul r12, rax, 0x70
xor esi, esi
mov r15d, 1
mov qword [rsp + 0x190], rsi
inc rsi
lea rbp, [rsp + 0x190]
mov qword [rsp + 0x1f0], rbp
lea rax, [fcn.140020c20]
mov qword [rsp + 0x1f8], rax
lea rax, [0x1400b9ab8]
mov qword [rsp + 0x330], rax
mov eax, 2
mov qword [rsp + 0x338], rax
xor r13d, r13d
mov qword [rsp + 0x350], r13
mov qword [rsp + 0x340], rdi
mov qword [rsp + 0x348], r15
lea rcx, [rsp + 0xd0]
lea r14, [rsp + 0x330]
mov rdx, r14
call fcn.14001f780
mov qword [rsp + 0x70], rbp
lea rax, [fcn.140020c20]
mov qword [rsp + 0x78], rax
lea rax, [0x1400b9ae0]
mov qword [rsp + 0x330], rax
mov eax, 2
mov qword [rsp + 0x338], rax
mov qword [rsp + 0x350], r13
lea rax, [rsp + 0x70]
mov qword [rsp + 0x340], rax
mov qword [rsp + 0x348], r15
mov rcx, rdi
mov rdx, r14
call fcn.14001f780
lea rcx, [rsp + 0xd0]
mov rdx, qword [rsp + 0x50]
mov r8, rbx
mov r9, rdi
call fcn.140068ccc
add rbx, 0x70
add r12, 0xffffffffffffff90
jne 0x140064dc4
mov r12, qword [rsp + 0x50]
cmp qword [r12], 0
mov r15, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov bpl, byte [rsp + 0x58]
jne 0x140064ac1
jmp 0x140064eec
xor eax, eax
mov rdx, qword [rsp + 0x48]
mov qword [r15 + 0x60], rax
mov byte [r15 + 0x88], 1
cmp byte [rdx + 6], 0
je 0x14006512a
xor esi, esi
xor ecx, ecx
xor edx, edx
call sub.ole32.dll_CoInitializeEx
cmp eax, 2
lea rdx, [rsp + 0x330]
mov qword [rdx], rsi
mov qword [rdx + 0x10], rsi
mov qword [rdx + 0x20], rsi
setb byte [rdx + 0x30]
lea rsi, [rsp + 0x1f0]
mov rcx, rsi
call fcn.1400686e7
cmp dword [rsi], 2
je 0x1400650d6
mov rax, qword [rsp + 0x220]
lea rdx, [rsp + 0x330]
mov qword [rdx + 0x30], rax
movups xmm0, xmmword [rsp + 0x1f0]
movups xmm1, xmmword [rsp + 0x200]
movdqu xmm2, xmmword [rsp + 0x210]
movdqa xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0xd0]
mov rcx, rsi
call fcn.14006875f
cmp qword [rsi], 2
je 0x1400650d6
mov rax, qword [rsp + 0x100]
lea rdx, [rsp + 0x330]
mov qword [rdx + 0x30], rax
movups xmm0, xmmword [rsp + 0xd0]
movups xmm1, xmmword [rsp + 0xe0]
movdqu xmm2, xmmword [rsp + 0xf0]
movdqa xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0x70]
mov rcx, rsi
call fcn.140068801
cmp qword [rsi], 2
je 0x1400650d6
mov rax, qword [rsp + 0xa0]
lea rdx, [rsp + 0x330]
mov qword [rdx + 0x30], rax
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rsp + 0x80]
movdqu xmm2, xmmword [rsp + 0x90]
movdqa xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0x190]
mov rcx, rsi
call fcn.1400688dc
cmp qword [rsi], 2
je 0x1400650d6
mov rax, qword [rsp + 0x1c0]
lea rdx, [rsp + 0x330]
mov qword [rdx + 0x30], rax
movups xmm0, xmmword [rsp + 0x190]
movups xmm1, xmmword [rsp + 0x1a0]
movdqu xmm2, xmmword [rsp + 0x1b0]
movdqa xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0x148]
mov rcx, rsi
call fcn.14006895e
mov rax, qword [rsi]
cmp rax, 2
je 0x1400650d6
movups xmm0, xmmword [rsp + 0x150]
movups xmm1, xmmword [rsp + 0x160]
movdqu xmm2, xmmword [rsp + 0x170]
lea rdx, [rsp + 0x2f0]
movdqu xmmword [rdx + 0x28], xmm2
movups xmmword [rdx + 0x18], xmm1
movups xmmword [rdx + 8], xmm0
mov qword [rdx], rax
lea rsi, [rsp + 0x1f0]
mov rcx, rsi
mov r8b, 1
call fcn.140068a4b
mov ebx, dword [rsi + 4]
cmp ebx, 2
jne 0x14006791c
lea rcx, [rsp + 0x2f0]
call fcn.1400646d4
mov esi, 8
xor edi, edi
mov rcx, qword [r15 + 0x98]
mov rdx, qword [r15 + 0xa0]
call fcn.140064687
cmp qword [r15 + 0x90], 0
je 0x140065110
mov r8, qword [r15 + 0x98]
mov rcx, qword [0x1400cdc50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [r15 + 0x90], rdi
mov qword [r15 + 0x98], rsi
mov qword [r15 + 0xa0], rdi
jmp 0x14006544a
cmp byte [rdx + 5], 0
je 0x14006544a
mov rax, qword [rsp + 0x40]
mov rax, qword [rax + 0xa0]
test rax, rax
je 0x14006544a
mov rcx, qword [rsp + 0x40]
mov rsi, qword [rcx + 0x98]
lea r12, [rsp + 0x1f8]
shl rax, 5
lea r13, [rax + rax*2]
xor ebp, ebp
lea rdi, [rsp + 0xd0]
lea rbx, [rsp + 0x330]
lea r14, [rsp + 0x70]
lea r15, [rsp + 0x1f0]
mov rax, qword [rsi]
cmp rax, 2
jne 0x140065321
xor ecx, ecx
xor edx, edx
call sub.ole32.dll_CoInitializeEx
cmp eax, 2
mov qword [rsp + 0x330], rbp
mov qword [rsp + 0x340], rbp
mov qword [rsp + 0x350], rbp
setb byte [rsp + 0x360]
mov rcx, rdi
mov rdx, rbx
call fcn.1400686e7
cmp dword [rsp + 0xd0], 2
je 0x140065280
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x360], rax
movups xmm0, xmmword [rsp + 0xd0]
movups xmm1, xmmword [rsp + 0xe0]
movups xmm2, xmmword [rsp + 0xf0]
movaps xmmword [rsp + 0x350], xmm2
movaps xmmword [rsp + 0x340], xmm1
movaps xmmword [rsp + 0x330], xmm0
mov rcx, r14
mov rdx, rbx
call fcn.14006875f
cmp qword [rsp + 0x70], 2
je 0x140065280
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x360], rax
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rsp + 0x80]
movups xmm2, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0x350], xmm2
movaps xmmword [rsp + 0x340], xmm1
movaps xmmword [rsp + 0x330], xmm0
mov rcx, rdi
mov rdx, rbx
call fcn.140068801
cmp qword [rsp + 0xd0], 2
jne 0x1400653fa
mov qword [rsp + 0x70], 2
mov rax, qword [rsp + 0xa0]
mov qword [rsi + 0x30], rax
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rsp + 0x80]
movups xmm2, xmmword [rsp + 0x90]
movups xmmword [rsi + 0x20], xmm2
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, qword [rsi]
movups xmm0, xmmword [rsi + 8]
movups xmm1, xmmword [rsi + 0x18]
movdqu xmm2, xmmword [rsi + 0x28]
movdqa xmmword [rsp + 0xf0], xmm2
movaps xmmword [rsp + 0xe0], xmm1
movaps xmmword [rsp + 0xd0], xmm0
cmp rax, 2
jne 0x140065347
mov qword [rsp + 0x330], 2
mov rax, qword [rsp + 0x360]
mov qword [rsi + 0x30], rax
movups xmm0, xmmword [rsp + 0x340]
movups xmm1, xmmword [rsp + 0x350]
movups xmmword [rsi + 0x20], xmm1
movups xmmword [rsi + 0x10], xmm0
movups xmm0, xmmword [rsp + 0x330]
jmp 0x1400653b1
movups xmm0, xmmword [rsi + 8]
movups xmm1, xmmword [rsi + 0x18]
movdqu xmm2, xmmword [rsi + 0x28]
movdqa xmmword [rsp + 0xf0], xmm2
movaps xmmword [rsp + 0xe0], xmm1
movaps xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0x1f0], rax
movaps xmm0, xmmword [rsp + 0xd0]
movaps xmm1, xmmword [rsp + 0xe0]
movaps xmm2, xmmword [rsp + 0xf0]
movups xmmword [r12 + 0x20], xmm2
movups xmmword [r12 + 0x10], xmm1
movups xmmword [r12], xmm0
mov rcx, rbx
mov rdx, r15
call fcn.14006895e
mov rax, qword [rsp + 0x360]
mov qword [rsi + 0x30], rax
movups xmm0, xmmword [rsp + 0x330]
movups xmm1, xmmword [rsp + 0x340]
movdqu xmm2, xmmword [rsp + 0x350]
movdqu xmmword [rsi + 0x20], xmm2
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
cmp dword [rsi], 2
je 0x1400653ea
mov rcx, rbx
mov rdx, rsi
xor r8d, r8d
call fcn.140068a4b
cmp dword [rsp + 0x334], 2
je 0x1400653ea
movss xmm0, dword [rsp + 0x330]
movss dword [rsi + 0x58], xmm0
ucomiss xmm0, dword [rsi + 0x5c]
jbe 0x1400653ea
movss dword [rsi + 0x5c], xmm0
add rsi, 0x60
add r13, 0xffffffffffffffa0
jne 0x140065184
jmp 0x14006544a
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x360], rax
movups xmm0, xmmword [rsp + 0xd0]
movups xmm1, xmmword [rsp + 0xe0]
movups xmm2, xmmword [rsp + 0xf0]
movaps xmmword [rsp + 0x350], xmm2
movaps xmmword [rsp + 0x340], xmm1
movaps xmmword [rsp + 0x330], xmm0
mov rcx, r14
mov rdx, rbx
call fcn.1400688dc
jmp 0x140065289
mov rsi, qword [rsp + 0x48]
cmp byte [rsi + 1], 0
je 0x1400654d9
lea rcx, [rsp + 0x70]
mov qword [rcx], 0
call sub.IPHLPAPI.DLL_GetIfTable2
test eax, eax
mov r13, qword [rsp + 0x40]
jne 0x140066545
lea rbx, [r13 + 0x108]
mov rax, qword [r13 + 0x108]
mov rcx, qword [r13 + 0x110]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [r13 + 0x120]
lea rdi, [rsp + 0x330]
mov qword [rdi], rax
add rax, 0x10
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rcx
mov word [rdi + 0x18], dx
mov qword [rdi + 0x20], r8
mov rcx, rdi
call fcn.14006484c
test rax, rax
je 0x140065615
mov byte [rdx + 0x6e], 0
jmp 0x1400654c2
cmp byte [rsi], 0
mov r13, qword [rsp + 0x40]
je 0x140066545
lea rsi, [rsp + 0x330]
mov r8d, 0x548
mov rcx, rsi
xor edx, edx
call fcn.140082b20
mov rax, qword [r13 + 0x108]
mov rcx, qword [r13 + 0x110]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [r13 + 0x120]
lea rdi, [rsp + 0x1f0]
mov qword [rdi], rax
add rax, 0x10
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rcx
mov word [rdi + 0x18], dx
mov qword [rdi + 0x20], r8
mov r14, 0xffffffffffffffff
mov rcx, rdi
call fcn.14006484c
test rax, rax
je 0x140066540
mov rbx, rdx
mov rax, qword [rdx]
mov qword [rsp + 0x330], rax
mov dword [rsp + 0x338], 0
mov rcx, rsi
call sub.IPHLPAPI.DLL_GetIfEntry2
test eax, eax
jne 0x14006554a
mov rax, qword [rbx + 8]
mov rcx, qword [rbx + 0x18]
mov qword [rbx + 0x10], rax
mov rax, qword [rsp + 0x830]
mov qword [rbx + 8], rax
mov qword [rbx + 0x20], rcx
mov rax, qword [rsp + 0x7e8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x28]
mov qword [rbx + 0x30], rax
mov rax, qword [rsp + 0x7f0]
add rax, qword [rsp + 0x7f8]
cmovb rax, r14
mov qword [rbx + 0x28], rax
mov rax, qword [rbx + 0x38]
mov qword [rbx + 0x40], rax
mov rax, qword [rsp + 0x838]
add rax, qword [rsp + 0x840]
cmovb rax, r14
mov qword [rbx + 0x38], rax
mov rax, qword [rbx + 0x48]
mov qword [rbx + 0x50], rax
mov rax, qword [rsp + 0x808]
mov qword [rbx + 0x48], rax
mov rax, qword [rbx + 0x58]
mov qword [rbx + 0x60], rax
mov rax, qword [rsp + 0x850]
mov qword [rbx + 0x58], rax
jmp 0x14006554a
lea rcx, [0x14000242e]
call fcn.140025ba0
movups xmm0, xmmword [0x1400b9040]
movaps xmmword [rsp + 0x330], xmm0
movdqu xmm0, xmmword [0x1400b9050]
movdqa xmmword [rsp + 0x340], xmm0
mov qword [rsp + 0x350], rax
mov qword [rsp + 0x358], rdx
xor eax, eax
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0xd8], 8
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x70]
mov esi, dword [rax]
test rsi, rsi
je 0x140066040
mov qword [rsp + 0x2c8], rbx
mov qword [rsp + 0x1e0], rax
lea rbx, [rax + 8]
xor r15d, r15d
pcmpeqd xmm6, xmm6
imul rax, r15, 0x548
lea rdi, [rbx + rax]
cmp qword [rbx + rax + 0x4a8], 0
jne 0x1400656be
cmp qword [rdi + 0x4b0], 0
je 0x1400658fb
cmp dword [rdi + 0x48c], 2
je 0x1400658fb
cmp dword [rdi + 0x420], 0
je 0x1400658fb
mov al, byte [0x1400cdcc0]
mov edx, 0x14
xor ecx, ecx
call fcn.14005b1d0
test rax, rax
je 0x140067a5f
mov r12, rax
mov eax, dword [rdi + 0x10]
movzx ecx, byte [rdi + 0x14]
movzx edx, byte [rdi + 0x15]
movzx r8d, byte [rdi + 0x16]
movzx r9d, byte [rdi + 0x17]
movzx r10d, byte [rdi + 0x18]
movzx r11d, byte [rdi + 0x19]
movzx ebp, byte [rdi + 0x1a]
movzx edi, byte [rdi + 0x1b]
mov dword [r12], eax
mov word [r12 + 4], cx
mov word [r12 + 6], dx
mov word [r12 + 8], r8w
mov word [r12 + 0xa], r9w
mov word [r12 + 0xc], r10w
mov word [r12 + 0xe], r11w
mov word [r12 + 0x10], bp
mov word [r12 + 0x12], di
mov al, byte [0x1400cdcc0]
mov edx, 0x14
xor ecx, ecx
call fcn.14005b1d0
test rax, rax
je 0x140067a50
mov r13, rax
mov eax, dword [r12 + 0x10]
mov dword [r13 + 0x10], eax
movups xmm0, xmmword [r12]
movups xmmword [r13], xmm0
mov rcx, qword [rsp + 0x350]
mov rdx, qword [rsp + 0x358]
mov r9d, 0xa
mov r8, r13
call fcn.140063fc6
mov r14, rax
mov rdi, rax
shr rdi, 0x39
mov rax, qword [rsp + 0x330]
mov rcx, qword [rsp + 0x338]
mov rdx, rcx
and rdx, r14
movd xmm0, edi
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
xor r8d, r8d
mov r9, rdx
movdqu xmm1, xmmword [rax + r9]
movdqa xmm2, xmm1
pcmpeqb xmm2, xmm0
pmovmskb r10d, xmm2
test r10d, r10d
je 0x14006584d
bsf r11d, r10d
add r11, r9
and r11, rcx
shl r11, 5
mov rbp, rax
sub rbp, r11
cmp qword [rbp - 0x10], 0xa
jne 0x140065840
mov r11, qword [rbp - 0x18]
movdqu xmm2, xmmword [r11]
movdqu xmm3, xmmword [r13]
pcmpeqb xmm3, xmm2
movd xmm2, dword [r11 + 0x10]
movd xmm4, dword [r13 + 0x10]
pcmpeqb xmm4, xmm2
pand xmm4, xmm3
pmovmskb r11d, xmm4
cmp r11d, 0xffff
je 0x140065872
lea r11d, [r10 - 1]
and r11w, r10w
mov r10d, r11d
jne 0x1400657f0
pcmpeqb xmm1, xmm6
pmovmskb r10d, xmm1
test r10d, r10d
jne 0x14006590c
add r9, r8
add r9, 0x10
add r8, 0x10
and r9, rcx
jmp 0x1400657d8
mov rcx, qword [0x1400cdc50]
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov eax, dword [rbp - 8]
inc eax
mov dword [rbp - 8], eax
cmp eax, 1
mov r13, qword [rsp + 0x40]
jle 0x1400658aa
mov rcx, qword [0x1400cdc50]
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x1400658fb
mov rdi, qword [rsp + 0xe0]
cmp rdi, qword [rsp + 0xd0]
jne 0x1400658c9
lea rcx, [rsp + 0xd0]
call fcn.140064513
mov rax, qword [rsp + 0xd8]
mov rcx, rdi
shl rcx, 5
mov dword [rax + rcx], r15d
mov edx, 0xa
mov qword [rax + rcx + 8], rdx
mov qword [rax + rcx + 0x10], r12
mov qword [rax + rcx + 0x18], rdx
inc rdi
mov qword [rsp + 0xe0], rdi
inc r15
cmp r15, rsi
jne 0x14006569a
jmp 0x1400659ec
cmp qword [rsp + 0x340], 0
je 0x1400659bc
movdqu xmm0, xmmword [rax + rdx]
pmovmskb r8d, xmm0
test r8d, r8d
jne 0x140065949
mov r9d, 0x10
add rdx, r9
and rdx, rcx
movdqu xmm0, xmmword [rax + rdx]
pmovmskb r8d, xmm0
add r9, 0x10
test r8d, r8d
je 0x140065930
bsf r8d, r8d
add r8, rdx
and r8, rcx
mov dl, byte [rax + r8]
test dl, dl
js 0x14006596b
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
bsf r8d, edx
mov dl, byte [rax + r8]
lea r9, [r8 - 0x10]
and r9, rcx
mov byte [rax + r8], dil
mov byte [rax + r9 + 0x10], dil
shl r8, 5
mov rbp, rax
sub rbp, r8
and dl, 1
movzx ecx, dl
sub qword [rsp + 0x340], rcx
neg r8
mov ecx, 0xa
mov qword [rax + r8 - 0x20], rcx
mov qword [rbp - 0x18], r13
mov qword [rbp - 0x10], rcx
mov dword [rbp - 8], 0
inc qword [rsp + 0x348]
jmp 0x140065884
lea rcx, [rsp + 0x330]
lea rdx, [rsp + 0x350]
call fcn.1400874fa
mov rax, qword [rsp + 0x330]
mov rcx, qword [rsp + 0x338]
and r14, rcx
mov rdx, r14
jmp 0x14006591b
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x2d0], rax
mov rcx, qword [rsp + 0xd8]
mov rax, qword [rsp + 0xe0]
mov rsi, rax
shl rsi, 5
add rsi, rcx
mov qword [rsp + 0x1c8], rcx
mov rdi, rcx
test rax, rax
je 0x140065fef
mov qword [rsp + 0x2e8], rbx
lea rax, [r13 + 0x128]
mov qword [rsp + 0x2c0], rax
add qword [rsp + 0x1e0], 0x24
pcmpeqd xmm6, xmm6
mov rdi, qword [rsp + 0x1c8]
mov qword [rsp + 0x1e8], rsi
mov rax, rdi
add rdi, 0x20
mov rbx, qword [rax + 8]
mov rcx, rbx
neg rcx
jo 0x140065fef
mov r14, qword [rax + 0x10]
mov edx, dword [rax]
cmp qword [rsp + 0x348], 0
je 0x140065b6a
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], rdi
mov rbx, qword [rax + 0x18]
mov rcx, qword [rsp + 0x350]
mov rdx, qword [rsp + 0x358]
mov qword [rsp + 0x50], r14
mov r8, r14
mov r9, rbx
call fcn.140063fc6
mov r13, qword [rsp + 0x330]
mov rsi, qword [rsp + 0x338]
mov rbp, rsi
and rbp, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
lea r14, [rbx + rbx]
xor r12d, r12d
movdqu xmm8, xmmword [r13 + rbp]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb r15d, xmm0
test r15d, r15d
je 0x140065b4c
bsf eax, r15d
add rax, rbp
and rax, rsi
shl rax, 5
mov rdi, r13
sub rdi, rax
cmp rbx, qword [rdi - 0x10]
jne 0x140065b3f
mov rdx, qword [rdi - 0x18]
mov rcx, qword [rsp + 0x50]
mov r8, r14
call fcn.140082380
test eax, eax
je 0x140065b70
lea eax, [r15 - 1]
and ax, r15w
mov r15d, eax
jne 0x140065b10
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x140065b6e
add rbp, r12
add rbp, 0x10
add r12, 0x10
and rbp, rsi
jmp 0x140065af6
xor eax, eax
jmp 0x140065ba2
xor edi, edi
lea rax, [rdi - 0x20]
test rdi, rdi
cmove rax, rdi
mov r13, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x1e8]
mov rdi, qword [rsp + 0xb8]
mov r14, qword [rsp + 0x50]
mov rbx, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0x58]
lea rcx, [rax + 0x18]
test rax, rax
lea rax, [0x1400b9738]
cmove rcx, rax
cmp dword [rcx], 1
jg 0x140065c23
imul rax, rdx, 0x548
mov rcx, qword [rsp + 0x2e8]
lea r15, [rcx + rax]
lea rdx, [r15 + 0x1c]
add rax, qword [rsp + 0x1e0]
mov ecx, 0x202
xor r8d, r8d
cmp word [rax + r8*2], 0
je 0x140065bf9
inc r8
add rcx, 0xfffffffffffffffe
jne 0x140065be0
mov r8d, 0x101
jmp 0x140065c06
cmp r8, 0x102
jae 0x140067a7d
lea rcx, [rsp + 0x1f0]
call fcn.1400207b0
mov rcx, qword [rsp + 0x1f0]
mov rax, rcx
neg rax
jno 0x140065c48
test rbx, rbx
je 0x140065c3a
mov rcx, qword [0x1400cdc50]
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp rdi, rsi
jne 0x140065a5e
jmp 0x14006601e
mov qword [rsp + 0x1d0], r15
mov qword [rsp + 0x1d8], rcx
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0x50], r14
mov qword [rsp + 0xb8], rdi
mov r8, qword [rsp + 0x1f8]
mov rbp, qword [rsp + 0x200]
mov rcx, qword [r13 + 0x128]
mov rdx, qword [r13 + 0x130]
mov qword [rsp + 0x58], r8
mov r9, rbp
call fcn.140063e4f
mov rcx, rax
shr rcx, 0x39
mov r14, qword [r13 + 0x108]
mov rsi, qword [r13 + 0x110]
mov r12, rsi
mov qword [rsp + 0x2d8], rax
and r12, rax
mov qword [rsp + 0x2e0], rcx
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor r13d, r13d
mov rdi, r12
movdqu xmm8, xmmword [r14 + rdi]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb r15d, xmm0
test r15d, r15d
je 0x140065d3b
bsf eax, r15d
add rax, rdi
and rax, rsi
mov rbx, rax
neg rbx
shl rax, 3
shl rbx, 7
sub rbx, rax
cmp qword [r14 + rbx - 0x78], rbp
jne 0x140065d2e
add rbx, r14
mov rcx, qword [rbx - 0x80]
mov rdx, qword [rsp + 0x58]
mov r8, rbp
call fcn.140082380
test eax, eax
je 0x140065d60
lea eax, [r15 - 1]
and ax, r15w
mov r15d, eax
jne 0x140065cf4
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x140065e48
add rdi, r13
add rdi, 0x10
add r13, 0x10
and rdi, rsi
jmp 0x140065cdb
mov rax, qword [rbx - 0x68]
mov rcx, qword [rbx - 0x58]
mov qword [rbx - 0x60], rax
mov rdx, qword [rsp + 0x1d0]
mov rax, qword [rdx + 0x500]
mov qword [rbx - 0x68], rax
mov qword [rbx - 0x50], rcx
mov rax, qword [rdx + 0x4b8]
mov qword [rbx - 0x58], rax
mov rax, qword [rbx - 0x48]
mov qword [rbx - 0x40], rax
mov rax, qword [rdx + 0x4c0]
add rax, qword [rdx + 0x4c8]
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov qword [rbx - 0x48], rax
mov rax, qword [rbx - 0x38]
mov qword [rbx - 0x30], rax
mov rax, qword [rdx + 0x508]
add rax, qword [rdx + 0x510]
cmovb rax, rcx
mov qword [rbx - 0x38], rax
mov rax, qword [rbx - 0x28]
mov qword [rbx - 0x20], rax
mov rax, qword [rdx + 0x4d8]
mov qword [rbx - 0x28], rax
mov rax, qword [rbx - 0x18]
mov qword [rbx - 0x10], rax
mov rax, qword [rdx + 0x520]
mov qword [rbx - 0x18], rax
mov byte [rbx - 2], 1
cmp qword [rsp + 0x1d8], 0
je 0x140065e1a
mov rcx, qword [0x1400cdc50]
xor edx, edx
mov r8, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rsp + 0xb0], 0
mov rsi, qword [rsp + 0x1e8]
mov rdi, qword [rsp + 0xb8]
mov r14, qword [rsp + 0x50]
mov r13, qword [rsp + 0x40]
jne 0x140065c28
jmp 0x140065c3a
mov rax, qword [rsp + 0x40]
cmp qword [rax + 0x118], 0
mov rdi, qword [rsp + 0x1d0]
je 0x140065fb7
mov rax, qword [rdi + 0x4c0]
add rax, qword [rdi + 0x4c8]
mov rdx, 0xffffffffffffffff
cmovb rax, rdx
mov rcx, qword [rdi + 0x508]
add rcx, qword [rdi + 0x510]
cmovb rcx, rdx
mov r11, qword [rdi]
mov r10, qword [rdi + 0x500]
mov r9, qword [rdi + 0x4b8]
mov r8, qword [rdi + 0x4d8]
mov rdx, qword [rdi + 0x520]
movdqu xmm0, xmmword [r14 + r12]
pmovmskb edi, xmm0
test edi, edi
jne 0x140065ed8
mov ebx, 0x10
add r12, rbx
and r12, rsi
movdqu xmm0, xmmword [r14 + r12]
pmovmskb edi, xmm0
add rbx, 0x10
test edi, edi
je 0x140065ec0
bsf edi, edi
add rdi, r12
and rdi, rsi
mov bl, byte [r14 + rdi]
test bl, bl
js 0x140065ef9
movdqa xmm0, xmmword [r14]
pmovmskb edi, xmm0
bsf edi, edi
mov bl, byte [r14 + rdi]
lea r15, [rdi - 0x10]
and r15, rsi
mov rsi, qword [rsp + 0x2e0]
mov byte [r14 + rdi], sil
mov byte [r14 + r15 + 0x10], sil
and bl, 1
movzx esi, bl
mov rbx, qword [rsp + 0x40]
sub qword [rbx + 0x118], rsi
mov rsi, rdi
neg rsi
shl rdi, 3
shl rsi, 7
sub rsi, rdi
mov rdi, qword [rsp + 0x1d8]
mov qword [r14 + rsi - 0x88], rdi
mov rdi, qword [rsp + 0x58]
mov qword [r14 + rsi - 0x80], rdi
mov qword [r14 + rsi - 0x78], rbp
mov qword [r14 + rsi - 0x70], r11
mov qword [r14 + rsi - 0x68], r10
mov qword [r14 + rsi - 0x60], r10
mov qword [r14 + rsi - 0x58], r9
mov qword [r14 + rsi - 0x50], r9
mov qword [r14 + rsi - 0x48], rax
mov qword [r14 + rsi - 0x40], rax
mov qword [r14 + rsi - 0x38], rcx
mov qword [r14 + rsi - 0x30], rcx
mov qword [r14 + rsi - 0x28], r8
mov qword [r14 + rsi - 0x20], r8
mov qword [r14 + rsi - 0x18], rdx
mov qword [r14 + rsi - 0x10], rdx
mov dword [r14 + rsi - 8], 0
mov word [r14 + rsi - 4], 0
mov byte [r14 + rsi - 2], 1
inc qword [rbx + 0x120]
jmp 0x140065e1a
mov rcx, qword [rsp + 0x2c8]
mov rdx, qword [rsp + 0x2c0]
call fcn.140087214
mov rax, qword [rsp + 0x40]
mov r14, qword [rax + 0x108]
mov rsi, qword [rax + 0x110]
mov r12, qword [rsp + 0x2d8]
and r12, rsi
jmp 0x140065e63
sub rsi, rdi
je 0x14006601e
shr rsi, 5
add rdi, 0x10
cmp qword [rdi - 8], 0
je 0x140066015
mov r8, qword [rdi]
mov rcx, qword [0x1400cdc50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
add rdi, 0x20
dec rsi
jne 0x140065ffc
cmp qword [rsp + 0x2d0], 0
je 0x140066040
mov rcx, qword [0x1400cdc50]
xor edx, edx
mov r8, qword [rsp + 0x1c8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0x70]
call sub.IPHLPAPI.DLL_FreeMibTable
mov rsi, qword [rsp + 0x338]
test rsi, rsi
je 0x140066118
mov rdi, qword [rsp + 0x348]
test rdi, rdi
je 0x1400660e5
mov rbx, qword [rsp + 0x330]
movdqa xmm0, xmmword [rbx]
pmovmskb r12d, xmm0
not r12d
lea r14, [rbx + 0x10]
mov r15, qword [sym.imp.KERNEL32.dll_HeapFree]
test r12w, r12w
jne 0x1400660ae
movdqa xmm0, xmmword [r14]
pmovmskb r12d, xmm0
add rbx, 0xfffffffffffffe00
add r14, 0x10
cmp r12d, 0xffff
je 0x14006608d
not r12d
bsf ecx, r12d
shl ecx, 5
mov rax, rbx
sub rax, rcx
cmp qword [rax - 0x20], 0
je 0x1400660d2
mov r8, qword [rax - 0x18]
mov rcx, qword [0x1400cdc50]
xor edx, edx
call r15
dec rdi
lea eax, [r12 - 1]
and eax, r12d
mov r12d, eax
test rdi, rdi
jne 0x140066087
mov rax, rsi
shl rax, 5
lea rcx, [rsi + rax]
add rcx, 0x20
cmp rcx, 0xffffffffffffffef
je 0x140066118
add rax, 0x20
mov r8, qword [rsp + 0x330]
sub r8, rax
mov rcx, qword [0x1400cdc50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [r13 + 0x120]
test rsi, rsi
je 0x140066247
mov rdi, qword [r13 + 0x108]
lea rbx, [rdi + 0x10]
movdqa xmm0, xmmword [rdi]
pmovmskb eax, xmm0
not eax
movabs r14, 0xf0f0f0f0f0f0f0f1
pcmpeqd xmm6, xmm6
mov r15, qword [sym.imp.KERNEL32.dll_HeapFree]
test ax, ax
jne 0x140066173
movdqa xmm0, xmmword [rbx]
pmovmskb eax, xmm0
add rdi, 0xfffffffffffff780
add rbx, 0x10
cmp eax, 0xffff
je 0x140066157
not eax
mov r12d, eax
bsf ecx, r12d
mov rax, rcx
neg rax
shl ecx, 3
shl rax, 7
sub rax, rcx
cmp byte [rdi + rax - 2], 0
jne 0x140066236
add rax, rdi
mov rcx, qword [r13 + 0x108]
mov rdx, rcx
sub rdx, rax
sar rdx, 3
imul rdx, r14
lea r8, [rdx - 0x10]
and r8, qword [r13 + 0x110]
movdqu xmm0, xmmword [rcx + r8]
pcmpeqb xmm0, xmm6
pmovmskb r9d, xmm0
test r9d, r9d
je 0x1400661d7
bsr r9w, r9w
xor r9d, 0xf
jmp 0x1400661dc
mov r9w, 0x10
movdqu xmm0, xmmword [rcx + rdx]
pcmpeqb xmm0, xmm6
pmovmskb r10d, xmm0
or r10d, 0x10000
bsf r10d, r10d
add r9d, r10d
mov r10b, 0x80
cmp r9w, 0xf
ja 0x14006620c
inc qword [r13 + 0x118]
mov r10b, 0xff
mov byte [rcx + rdx], r10b
mov byte [rcx + r8 + 0x10], r10b
dec qword [r13 + 0x120]
cmp qword [rax - 0x88], 0
je 0x140066236
mov r8, qword [rax - 0x80]
mov rcx, qword [0x1400cdc50]
xor edx, edx
call r15
lea eax, [r12 - 1]
and eax, r12d
dec rsi
jne 0x140066152
lea rbx, [rsp + 0x148]
mov dword [rbx], 0x3c00
mov dword [rsp + 0x190], 0
mov ebp, 4
xor esi, esi
dec ebp
je 0x14006634b
mov edx, dword [rsp + 0x148]
mov rcx, rsi
call fcn.140078890
test rax, rax
je 0x1400662db
mov rdi, rax
mov qword [rsp + 0x20], rbx
xor ecx, ecx
mov edx, 0xe
xor r8d, r8d
mov r9, rax
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
mov dword [rsp + 0x190], eax
mov rsi, rdi
cmp eax, 0x6f
je 0x140066267
test eax, eax
jne 0x140066348
mov qword [rsp + 0x1f8], rdi
mov qword [rsp + 0x200], rdi
movabs rbx, 0x8000000000000000
mov qword [rsp + 0x1f0], rbx
jmp 0x1400663af
mov al, byte [0x1400cdcc0]
mov ebx, 0x32
mov edx, 0x32
xor ecx, ecx
call fcn.14005b1d0
test rax, rax
je 0x140067af1
mov rdi, rax
movups xmm0, xmmword [0x1400b9c32]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x1400b9c22]
movups xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [str.failed_to_allocate_memory_for_IP_ADAPTER_ADDRESSESGetAdaptersAddresses___failed_with_code]
movdqu xmmword [rax], xmm0
mov word [rax + 0x30], 0x5345
mov rcx, rsi
call fcn.1400788a0
mov qword [rsp + 0x1f0], rbx
mov qword [rsp + 0x1f8], rdi
mov qword [rsp + 0x200], rbx
jmp 0x1400663af
mov rsi, rdi
lea rax, [rsp + 0x190]
lea rcx, [rsp + 0xd0]
mov qword [rcx], rax
lea rax, [0x140021be0]
mov qword [rcx + 8], rax
lea rax, [0x1400b9c70]
lea rdx, [rsp + 0x330]
mov qword [rdx], rax
mov eax, 1
mov qword [rdx + 8], rax
mov qword [rdx + 0x20], 0
mov qword [rdx + 0x10], rcx
mov qword [rdx + 0x18], rax
lea rdi, [rsp + 0x1f0]
mov rcx, rdi
call fcn.14001f780
mov rcx, rsi
call fcn.1400788a0
mov rbx, qword [rdi]
mov rsi, qword [rsp + 0x48]
test rbx, rbx
je 0x140066545
neg rbx
jno 0x1400678e0
movdqu xmm0, xmmword [rsp + 0x1f8]
lea rax, [rsp + 0xd0]
movdqu xmmword [rax], xmm0
mov rax, qword [r13 + 0x120]
mov qword [rsp + 0x58], rax
mov rbp, qword [r13 + 0x108]
mov rsi, qword [r13 + 0x110]
pcmpeqd xmm6, xmm6
lea rcx, [rsp + 0x330]
lea rdx, [rsp + 0xd0]
call fcn.140068617
mov rcx, qword [rsp + 0x330]
mov rax, rcx
neg rax
jo 0x140066533
mov qword [rsp + 0x50], rcx
mov rbx, qword [rsp + 0x338]
cmp qword [rsp + 0x58], 0
je 0x14006650f
mov r14, qword [rsp + 0x340]
mov rax, qword [rsp + 0x40]
mov rcx, qword [rax + 0x128]
mov rdx, qword [rax + 0x130]
mov r8, rbx
mov r9, r14
call fcn.140063e4f
mov r15, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor r12d, r12d
and r15, rsi
movdqu xmm8, xmmword [rbp + r15]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb r13d, xmm0
test r13d, r13d
je 0x1400664df
bsf eax, r13d
add rax, r15
and rax, rsi
mov rdi, rax
neg rdi
shl rax, 3
shl rdi, 7
sub rdi, rax
cmp r14, qword [rbp + rdi - 0x78]
jne 0x1400664d2
add rdi, rbp
mov rdx, qword [rdi - 0x80]
mov rcx, rbx
mov r8, r14
call fcn.140082380
test eax, eax
je 0x1400664fa
lea eax, [r13 - 1]
and ax, r13w
mov r13d, eax
jne 0x14006649a
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x14006650f
add r15, r12
add r15, 0x10
add r12, 0x10
jmp 0x14006647d
lea rcx, [rsp + 0x348]
movzx eax, word [rcx + 4]
mov word [rdi - 4], ax
mov eax, dword [rcx]
mov dword [rdi - 8], eax
cmp qword [rsp + 0x50], 0
je 0x140066529
mov rcx, qword [0x1400cdc50]
xor edx, edx
mov r8, rbx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r13, qword [rsp + 0x40]
jmp 0x1400663f9
mov rcx, qword [rsp + 0xd0]
call fcn.1400788a0
mov rsi, qword [rsp + 0x48]
movzx ebp, word [rsi + 8]
cmp bpl, 2
je 0x140066e55
movzx eax, byte [rsi + 0xa]
shl eax, 0x10
or ebp, eax
mov word [rsp + 0x64], bp
mov eax, ebp
shr eax, 0x10
mov byte [rsp + 0x66], al
mov al, byte [0x1400cdcc0]
mov r12d, 0x80000
mov edx, 0x80000
xor ecx, ecx
call fcn.14005b1d0
test rax, rax
je 0x140067a6e
mov rdi, rax
lea rsi, [rsp + 0x148]
mov qword [rsi], 0x80000
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], 0
xor edx, edx
lea r14, [rsp + 0x330]
mov r15, qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, 0x80000
mov dword [rsp + 0x330], 0
sub r12, rdx
cmp r12, rbx
jb 0x140066612
mov ecx, 5
mov rdx, rdi
mov r8d, ebx
mov r9, r14
call r15
cmp eax, 0xc0000004
jne 0x140066636
mov eax, dword [rsp + 0x330]
add rbx, rbx
lea ecx, [rax + 0x2800]
test eax, eax
cmovne rbx, rcx
mov r12, qword [rsp + 0x148]
mov rdx, qword [rsp + 0x158]
jmp 0x1400665bf
mov qword [rsp + 0x20], 1
mov r9d, 1
mov rcx, rsi
mov r8, rbx
call fcn.140084696
mov rdi, qword [rsp + 0x150]
jmp 0x1400665d2
test eax, eax
jne 0x1400666f0
mov qword [rsp + 0x158], rbx
mov al, byte [0x1400cdcc0]
mov edx, 0xfa0
xor ecx, ecx
call fcn.14005b1d0
test rax, rax
je 0x140067a94
lea rdi, [rsp + 0x190]
mov qword [rdi], 0x1f4
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], 0
mov rbx, qword [rsp + 0x150]
xor esi, esi
xor r14d, r14d
cmp rsi, qword [rsp + 0x190]
jne 0x1400666a3
mov rcx, rdi
call fcn.140064459
mov rax, qword [rsp + 0x198]
lea rcx, [rbx + r14]
mov qword [rax + rsi*8], rcx
inc rsi
mov qword [rsp + 0x1a0], rsi
mov ecx, dword [rcx]
add r14, rcx
test rcx, rcx
jne 0x140066689
lea rax, [r13 + 0xd8]
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0x180], rax
test bpl, 1
je 0x140066720
mov rcx, r13
xor edx, edx
call fcn.140067c3c
mov rax, qword [r13 + 0x80]
jmp 0x140066722
cmp qword [rsp + 0x148], 0
mov rsi, qword [rsp + 0x48]
je 0x140066e55
mov r8, qword [rsp + 0x150]
mov rcx, qword [0x1400cdc50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140066e55
xor eax, eax
lea r15, [rsp + 0xc0]
mov qword [r15], rax
xor r12d, r12d
lea rbx, [rsp + 0x330]
mov qword [rbx], r12
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetSystemTimePreciseAsFileTime]
mov rcx, qword [rbx]
movabs r8, 0x19db1ded53e8000
mov rdx, rcx
sub rdx, r8
neg rdx
movabs rax, 0xfe624e212ac18000
add rax, rcx
cmp rcx, r8
cmovl rax, rdx
movabs rdx, 0xd6bf94d5e57a42bd
mul rdx
shr rdx, 0x17
cmp rcx, r8
cmovl rdx, r12
lea rax, [rsp + 0x68]
mov qword [rax], rdx
mov r14, qword [rsp + 0x190]
mov rdi, qword [rsp + 0x198]
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 8
mov qword [rsp + 0x80], r12
mov qword [rbx], r14
mov qword [rbx + 8], rdi
mov qword [rbx + 0x10], rsi
lea rcx, [rsp + 0x180]
mov qword [rbx + 0x18], rcx
lea rcx, [rsp + 0x64]
mov qword [rbx + 0x20], rcx
mov qword [rbx + 0x28], r15
mov qword [rbx + 0x30], rax
cmp r14, rsi
jb 0x140067aa3
lea rbx, [rsp + 0x348]
call fcn.140030f42
xor r9d, r9d
cmp rsi, 0xffffffffffffffff
sete r9b
cmp r9, rax
cmovbe r9, rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 1
lea rcx, [rsp + 0xd0]
mov rdx, rsi
xor r8d, r8d
call fcn.14006049b
test r14, r14
je 0x140066846
mov rcx, qword [0x1400cdc50]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0xd0]
mov rcx, qword [rsp + 0xe0]
test rcx, rcx
sete dl
test rax, rax
sete r8b
or r8b, dl
jne 0x140066896
xor r8d, r8d
add r8, qword [rax + 0x10]
dec rcx
je 0x14006687d
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x14006686b
mov rax, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x80]
sub rax, rdx
cmp rax, r8
jb 0x140067a0d
mov rax, qword [rsp + 0xe0]
lea r12, [rsp + 0x1f8]
mov qword [r12 + 8], rax
movdqu xmm0, xmmword [rsp + 0xd0]
movdqa xmmword [r12 - 8], xmm0
lea r13, [rsp + 0x338]
mov rbp, qword [sym.imp.KERNEL32.dll_HeapFree]
lea rsi, [rsp + 0x70]
lea rdi, [rsp + 0x330]
mov r8, qword [rsp + 0x1f0]
test r8, r8
je 0x1400669d7
mov rax, qword [r8 + 0x18]
mov qword [rsp + 0x1f0], rax
lea rcx, [rax + 0x20]
test rax, rax
cmove rcx, r12
mov qword [rcx], 0
dec qword [rsp + 0x200]
mov rbx, qword [r8]
movdqu xmm0, xmmword [r8 + 8]
movdqa xmmword [rsp + 0x2f0], xmm0
mov rcx, qword [0x1400cdc50]
xor edx, edx
call rbp
mov rax, rbx
neg rax
jo 0x1400669d7
mov qword [rsp + 0x330], rbx
movaps xmm0, xmmword [rsp + 0x2f0]
movups xmmword [r13], xmm0
mov r14, qword [rsp + 0x338]
mov rbx, qword [rsp + 0x340]
mov rax, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
sub rax, r15
cmp rax, rbx
jb 0x1400669b0
imul rcx, r15, 0x150
add rcx, qword [rsp + 0x78]
imul r8, rbx, 0x150
mov rdx, r14
call fcn.140082480
add r15, rbx
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x340], 0
mov rcx, rdi
call fcn.14005f418
jmp 0x1400668d7
mov qword [rsp + 0x20], 0x150
mov r9d, 8
mov rcx, rsi
mov rdx, r15
mov r8, rbx
call fcn.140084696
mov r15, qword [rsp + 0x80]
jmp 0x140066971
lea rcx, [rsp + 0x1f0]
call fcn.140061f8c
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x58], rax
mov r12, qword [rsp + 0x78]
mov rax, qword [rsp + 0x80]
imul rbx, rax, 0x150
add rbx, r12
mov qword [rsp + 0x50], r12
test rax, rax
je 0x140066c93
mov rax, qword [rsp + 0x40]
add rax, 0xf8
mov qword [rsp + 0xb0], rax
lea r13, [rsp + 0xd0]
pcmpeqd xmm6, xmm6
mov r12, qword [rsp + 0x50]
mov rdx, r12
add r12, 0x150
mov r15, qword [rdx]
cmp r15, 2
je 0x140066c93
lea rsi, [rdx + 0xe0]
mov r14, qword [rdx + 0xd8]
add rdx, 8
mov r8d, 0xd0
lea rcx, [rsp + 0x1f0]
call fcn.140082480
mov ecx, 0xe
mov rdi, r13
rep movsq qword [rdi], qword [rsi]
mov rbp, qword [rsp + 0x40]
mov rcx, qword [rbp + 0xf8]
mov rdx, qword [rbp + 0x100]
mov r8, r14
call fcn.14005f75b
mov rsi, rax
cmp qword [rbp + 0xe8], 0
je 0x140066c79
mov rdi, qword [rbp + 0xd8]
mov rax, qword [rbp + 0xe0]
mov rdx, rax
and rdx, rsi
shr rsi, 0x39
movd xmm0, esi
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
lea r8, [rdi - 0x158]
xor r9d, r9d
xor r10d, r10d
movdqu xmm1, xmmword [rdi + rdx]
movdqa xmm2, xmm1
pcmpeqb xmm2, xmm0
pmovmskb r11d, xmm2
test r11d, r11d
je 0x140066b1f
bsf ebp, r11d
add rbp, rdx
and rbp, rax
neg rbp
imul rbp, rbp, 0x158
cmp qword [r8 + rbp], r14
je 0x140066b66
lea ebp, [r11 - 1]
and bp, r11w
mov r11d, ebp
jne 0x140066af8
cmp r10, 1
mov r10d, 1
je 0x140066b41
pmovmskb ecx, xmm1
xor r10d, r10d
test ecx, ecx
setne r10b
bsf ecx, ecx
add rcx, rdx
and rcx, rax
pcmpeqb xmm1, xmm6
pmovmskb r11d, xmm1
test r11d, r11d
jne 0x140066bea
add rdx, r9
add rdx, 0x10
add r9, 0x10
and rdx, rax
jmp 0x140066ae1
lea rsi, [rdi + rbp]
add rsi, 0xfffffffffffffeb0
mov r8d, 0x150
lea rcx, [rsp + 0x330]
mov rdx, rsi
call fcn.140082480
mov qword [rsi], r15
lea rsi, [rdi + rbp]
add rsi, 0xfffffffffffffeb8
mov r8d, 0xd0
mov rcx, rsi
lea rdx, [rsp + 0x1f0]
call fcn.140082480
mov qword [rsi + 0xd0], r14
add rdi, rbp
add rdi, 0xffffffffffffff90
mov ecx, 0xe
mov rsi, r13
rep movsq qword [rdi], qword [rsi]
cmp qword [rsp + 0x330], 2
je 0x140066bdc
lea rcx, [rsp + 0x330]
call fcn.14005f475
cmp r12, rbx
jne 0x140066a37
jmp 0x140066cc6
mov dl, byte [rdi + rcx]
test dl, dl
js 0x140066bff
movdqa xmm0, xmmword [rdi]
pmovmskb ecx, xmm0
bsf ecx, ecx
mov dl, byte [rdi + rcx]
and dl, 1
movzx edx, dl
mov r8, qword [rsp + 0x40]
sub qword [r8 + 0xe8], rdx
lea rdx, [rcx - 0x10]
and rdx, rax
mov byte [rdi + rcx], sil
mov byte [rdi + rdx + 0x10], sil
inc qword [r8 + 0xf0]
neg rcx
imul rbp, rcx, 0x158
lea rsi, [rdi + rbp]
add rsi, 0xfffffffffffffeb8
mov qword [rsi - 0x10], r14
mov qword [rsi - 8], r15
mov r8d, 0xd0
mov rcx, rsi
lea rdx, [rsp + 0x1f0]
call fcn.140082480
mov qword [rsi + 0xd0], r14
add rdi, rbp
add rdi, 0xffffffffffffff90
mov ecx, 0xe
mov rsi, r13
rep movsq qword [rdi], qword [rsi]
jmp 0x140066bdc
mov rcx, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xb0]
call fcn.1400877ba
jmp 0x140066aaa
mov rax, rbx
sub rax, r12
shr rax, 4
movabs rcx, 0xc30c30c30c30c31
mul rcx
cmp rbx, r12
je 0x140066cc6
mov rsi, rdx
mov rcx, r12
call fcn.14005f475
add r12, 0x150
dec rsi
jne 0x140066cb2
cmp qword [rsp + 0x58], 0
je 0x140066ce2
mov rcx, qword [0x1400cdc50]
xor edx, edx
mov r8, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0x40]
mov rsi, qword [rax + 0xf0]
test rsi, rsi
je 0x140066e29
mov rax, qword [rsp + 0x40]
mov rdi, qword [rax + 0xd8]
mov rbx, qword [rax + 0xe0]
lea r14, [rdi + 0x10]
movdqa xmm0, xmmword [rdi]
pmovmskb r12d, xmm0
not r12d
mov r15, qword [rax + 0xe8]
pcmpeqd xmm6, xmm6
mov r13, rdi
mov rbp, rsi
test r12w, r12w
jne 0x140066d52
movdqa xmm0, xmmword [r14]
pmovmskb r12d, xmm0
add r13, 0xffffffffffffea80
add r14, 0x10
cmp r12d, 0xffff
je 0x140066d31
not r12d
bsf eax, r12d
neg rax
imul rcx, rax, 0x158
cmp byte [r13 + rcx - 4], 0
mov byte [r13 + rcx - 4], 0
jne 0x140066e15
add rcx, r13
mov rax, rdi
sub rax, rcx
sar rax, 3
movabs rdx, 0x82fa0be82fa0be83
imul rax, rdx
lea rdx, [rax - 0x10]
and rdx, rbx
movdqu xmm0, xmmword [rdi + rdx]
pcmpeqb xmm0, xmm6
pmovmskb r8d, xmm0
test r8d, r8d
je 0x140066db2
bsr r8w, r8w
xor r8d, 0xf
jmp 0x140066db7
mov r8w, 0x10
movdqu xmm0, xmmword [rdi + rax]
pcmpeqb xmm0, xmm6
pmovmskb r9d, xmm0
or r9d, 0x10000
bsf r9d, r9d
add r8d, r9d
mov r9b, 0x80
cmp r8w, 0xf
jbe 0x140066de4
mov r8, qword [rsp + 0x40]
jmp 0x140066df6
inc r15
mov r8, qword [rsp + 0x40]
mov qword [r8 + 0xe8], r15
mov r9b, 0xff
mov byte [rdi + rax], r9b
mov byte [rdi + rdx + 0x10], r9b
dec rsi
mov qword [r8 + 0xf0], rsi
add rcx, 0xfffffffffffffeb0
call fcn.14005f475
lea eax, [r12 - 1]
and eax, r12d
mov r12d, eax
dec rbp
jne 0x140066d2b
cmp qword [rsp + 0x148], 0
je 0x140066e4b
mov r8, qword [rsp + 0x150]
mov rcx, qword [0x1400cdc50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov r13, qword [rsp + 0x40]
mov rsi, qword [rsp + 0x48]
cmp byte [rsi + 2], 0
je 0x140067063
call sub.KERNEL32.dll_GetLogicalDrives
mov dword [rsp + 0x148], eax
test eax, eax
je 0x140067105
xor eax, eax
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], 8
mov qword [rsp + 0x80], rax
lea rax, [rsp + 0x148]
lea rsi, [rsp + 0x330]
mov qword [rsi], rax
movabs rax, 0x2000000000
mov qword [rsi + 8], rax
call fcn.140030f42
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], 0x20
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 1
lea rsi, [rsp + 0xd0]
mov edx, 0x20
mov rcx, rsi
xor r8d, r8d
mov r9, rax
call fcn.140062b94
mov rax, qword [rsi]
mov rcx, qword [rsi + 0x10]
test rcx, rcx
sete dl
test rax, rax
sete r8b
or r8b, dl
jne 0x140066f21
xor r8d, r8d
add r8, qword [rax + 0x10]
dec rcx
je 0x140066f18
mov rax, qword [rax + 0x18]
test rax, rax
jne 0x140066f06
test r8, r8
jne 0x1400678fc
mov rax, qword [rsp + 0xe0]
lea r12, [rsp + 0x1f8]
mov qword [r12 + 8], rax
movups xmm0, xmmword [rsp + 0xd0]
movaps xmmword [r12 - 8], xmm0
lea r13, [rsp + 0x338]
mov rbp, qword [sym.imp.KERNEL32.dll_HeapFree]
lea rsi, [rsp + 0x70]
lea rdi, [rsp + 0x330]
mov r8, qword [rsp + 0x1f0]
test r8, r8
je 0x1400670df
mov rax, qword [r8 + 0x18]
mov qword [rsp + 0x1f0], rax
lea rcx, [rax + 0x20]
test rax, rax
cmove rcx, r12
mov qword [rcx], 0
dec qword [rsp + 0x200]
mov rbx, qword [r8]
movups xmm0, xmmword [r8 + 8]
movaps xmmword [rsp + 0x190], xmm0
mov rcx, qword [0x1400cdc50]
xor edx, edx
call rbp
mov rax, rbx
neg rax
jo 0x1400670df
mov qword [rsp + 0x330], rbx
movaps xmm0, xmmword [rsp + 0x190]
movups xmmword [r13], xmm0
mov r14, qword [rsp + 0x338]
mov rbx, qword [rsp + 0x340]
mov rax, qword [rsp + 0x70]
mov r15, qword [rsp + 0x80]
sub rax, r15
cmp rax, rbx
jb 0x14006703c
lea rcx, [r15 + r15*8]
shl rcx, 4
add rcx, qword [rsp + 0x78]
mov rax, rbx
shl rax, 4
lea r8, [rax + rax*8]
mov rdx, r14
call fcn.140082480
add r15, rbx
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x340], 0
mov rcx, rdi
call fcn.14005f612
jmp 0x140066f60
mov qword [rsp + 0x20], 0x90
mov r9d, 8
mov rcx, rsi
mov rdx, r15
mov r8, rbx
call fcn.140084696
mov r15, qword [rsp + 0x80]
jmp 0x140066ff8
cmp byte [rsi + 3], 0
je 0x14006712f
mov rax, qword [r13 + 0xb8]
test rax, rax
je 0x14006712f
mov rdi, qword [r13 + 0xb0]
shl rax, 4
lea rbx, [rax + rax*8]
xor r14d, r14d
lea rsi, [rsp + 0x330]
cmp qword [rdi + r14 + 0x78], 0
je 0x1400670d1
mov qword [rsp + 0x330], 0
mov rcx, qword [rdi + r14 + 0x50]
xor edx, edx
xor r8d, r8d
mov r9, rsi
call sub.KERNEL32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x1400670d1
mov rax, qword [rsp + 0x330]
mov qword [rdi + r14 + 0x80], rax
add r14, 0x90
cmp rbx, r14
jne 0x140067097
jmp 0x14006712f
lea rcx, [rsp + 0x1f0]
call fcn.140063729
mov rbx, qword [rsp + 0x70]
mov rsi, qword [rsp + 0x78]
mov rdi, qword [rsp + 0x80]
mov r13, qword [rsp + 0x40]
jmp 0x14006710e
mov esi, 8
xor edi, edi
xor ebx, ebx
lea rcx, [r13 + 0xa8]
call fcn.14005f612
mov qword [r13 + 0xa8], rbx
mov qword [r13 + 0xb0], rsi
mov qword [r13 + 0xb8], rdi
mov rax, qword [rsp + 0x48]
cmp byte [rax + 7], 1
jne 0x1400678b3
xor r12d, r12d
lea rax, [rsp + 0x148]
mov qword [rax], r12
mov qword [rax + 8], 8
mov qword [rax + 0x10], r12
lea rax, [rsp + 0x188]
mov dword [rax], 0
mov eax, 8
mov qword [rsp + 0x50], rax
lea r15, [rsp + 0x68]
xor ebx, ebx
mov qword [rsp + 0xc0], 0
mov dword [rsp + 0xcc], r12d
mov dword [rsp + 0x18c], r12d
lea rax, [rsp + 0x188]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x18c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xcc]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xffffffff
xor ecx, ecx
xor edx, edx
mov r8d, 2
lea r9, [rsp + 0xc0]
call sub.NETAPI32.dll_NetUserEnum
test eax, eax
je 0x1400671e8
cmp eax, 0xea
jne 0x1400675a1
mov r14, qword [rsp + 0xc0]
mov ecx, dword [rsp + 0xcc]
test rcx, rcx
je 0x140067584
mov dword [rsp + 0x58], eax
lea rbp, [r14 + rcx*8]
mov rsi, qword [r14]
test rsi, rsi
je 0x140067533
mov qword [rsp + 0x68], 0
xor ecx, ecx
mov rdx, rsi
mov r8d, 0x17
mov r9, r15
call sub.NETAPI32.dll_NetUserGetInfo
mov rcx, qword [rsp + 0x68]
test eax, eax
jne 0x140067529
mov rdx, qword [rcx + 0x20]
lea rcx, [rsp + 0x190]
call fcn.14005feb9
cmp r12, qword [rsp + 0x190]
jo 0x140067524
mov rdx, qword [rsp + 0x198]
lea rcx, [rsp + 0x330]
call fcn.140067b1f
cmp r12, qword [rsp + 0x330]
jno 0x14006728a
mov rdx, qword [r14]
lea rcx, [rsp + 0x70]
call fcn.14005f340
jmp 0x1400672a7
mov rax, qword [rsp + 0x340]
mov qword [rsp + 0x80], rax
movups xmm0, xmmword [rsp + 0x330]
movaps xmmword [rsp + 0x70], xmm0
mov qword [rsp + 0x2f0], 0
mov dword [rsp + 0x64], r12d
mov dword [rsp + 0x180], r12d
lea rax, [rsp + 0x180]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x64]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x2f0]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0xffffffff
lea rcx, [0x1400b9c10]
mov rdx, rsi
xor r8d, r8d
mov r9d, 1
call sub.NETAPI32.dll_NetUserGetLocalGroups
test eax, eax
je 0x140067328
mov qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 8
xor r15d, r15d
jmp 0x1400673fb
mov r15d, dword [rsp + 0x64]
test r15, r15
je 0x140067358
lea rax, [r15*8]
lea rsi, [rax + rax*2]
mov al, byte [0x1400cdcc0]
xor ecx, ecx
mov rdx, rsi
call fcn.14005b1d0
test rax, rax
jne 0x140067360
jmp 0x140067a2b
mov eax, 8
xor r15d, r15d
mov qword [rsp + 0xd0], r15
mov qword [rsp + 0xd8], rax
mov qword [rsp + 0xe0], 0
mov rdi, qword [rsp + 0x2f0]
test rdi, rdi
je 0x140067437
mov esi, dword [rsp + 0x64]
cmp r15d, esi
mov qword [rsp + 0x48], rbx
jb 0x140067542
xor r15d, r15d
test esi, esi
je 0x1400673f3
lea rcx, [r15 + r15*2]
lea r12, [rax + rcx*8]
xor r13d, r13d
lea rbx, [rsp + 0x1f0]
mov rdx, qword [rdi + r13*8]
mov rcx, rbx
call fcn.14005f340
mov rax, qword [rsp + 0x200]
mov qword [r12 + 0x10], rax
movups xmm0, xmmword [rsp + 0x1f0]
movups xmmword [r12], xmm0
inc r13
add r12, 0x18
cmp rsi, r13
jne 0x1400673b9
add r15, r13
mov r13, qword [rsp + 0x40]
xor r12d, r12d
mov rbx, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x2f0]
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x1f0], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x1f8], rax
mov qword [rsp + 0x200], r15
test rcx, rcx
je 0x140067467
call sub.NETAPI32.dll_NetApiBufferFree
jmp 0x140067467
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x200], rax
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x1f0], rax
mov rax, qword [rsp + 0xd8]
mov qword [rsp + 0x1f8], rax
movups xmm0, xmmword [rsp + 0x190]
movaps xmmword [rsp + 0x330], xmm0
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x340], rax
mov rax, qword [rsp + 0x80]
lea rcx, [rsp + 0x348]
mov qword [rcx + 0x10], rax
movaps xmm0, xmmword [rsp + 0x70]
movups xmmword [rcx], xmm0
mov rax, qword [rsp + 0x200]
mov qword [rcx + 0x28], rax
mov rax, qword [rsp + 0x1f0]
mov qword [rcx + 0x18], rax
mov rax, qword [rsp + 0x1f8]
mov qword [rcx + 0x20], rax
cmp rbx, qword [rsp + 0x148]
lea r15, [rsp + 0x68]
jne 0x1400674f0
lea rcx, [rsp + 0x148]
call fcn.140064497
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x50], rax
lea rax, [rbx + rbx*4]
shl rax, 4
mov rdx, qword [rsp + 0x50]
lea rdi, [rdx + rax]
mov ecx, 9
lea rsi, [rsp + 0x330]
rep movsq qword [rdi], qword [rsi]
mov dword [rdx + rax + 0x48], 0
inc rbx
mov qword [rsp + 0x158], rbx
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x140067533
call sub.NETAPI32.dll_NetApiBufferFree
add r14, 8
cmp r14, rbp
jne 0x140067208
jmp 0x140067578
mov qword [rsp + 0x20], 0x18
mov r9d, 8
lea rcx, [rsp + 0xd0]
xor edx, edx
mov r8, rsi
call fcn.140084696
mov rax, qword [rsp + 0xd8]
mov r15, qword [rsp + 0xe0]
jmp 0x1400673a2
mov r14, qword [rsp + 0xc0]
mov eax, dword [rsp + 0x58]
cmp eax, 0xea
jne 0x1400675a9
test r14, r14
je 0x140067177
mov rcx, r14
call sub.NETAPI32.dll_NetApiBufferFree
jmp 0x140067177
mov r14, qword [rsp + 0xc0]
test r14, r14
je 0x1400675b6
mov rcx, r14
call sub.NETAPI32.dll_NetApiBufferFree
lea rcx, [rsp + 0x68]
mov dword [rcx], 0
lea rsi, [rsp + 0x2f0]
mov qword [rsi], 0
mov rdx, rsi
call sub.Secur32.dll_LsaEnumerateLogonSessions
mov rsi, qword [rsi]
test eax, eax
jne 0x140067835
mov eax, dword [rsp + 0x68]
test rax, rax
je 0x140067835
lea r14, [rsi + rax*8]
lea rdi, [rsp + 0xd0]
lea rbx, [rsp + 0x330]
mov qword [rsp + 0xd0], 0
mov rcx, rsi
mov rdx, rdi
call sub.Secur32.dll_LsaGetLogonSessionData
test eax, eax
je 0x14006762e
mov rcx, qword [rsp + 0xd0]
test rcx, rcx
jne 0x140067641
jmp 0x140067646
mov rcx, qword [rsp + 0xd0]
test rcx, rcx
je 0x140067646
cmp dword [rcx + 0x40], 3
jne 0x140067654
call sub.Secur32.dll_LsaFreeReturnBuffer
add rsi, 8
cmp rsi, r14
jne 0x140067604
jmp 0x14006782d
movzx r15d, word [rcx + 0x10]
mov r12, qword [rcx + 0x18]
mov rdx, qword [rcx + 0x48]
mov rcx, rbx
call fcn.14005feb9
mov rcx, qword [rsp + 0x330]
mov rax, rcx
neg rax
jo 0x14006761f
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x58], r15
mov qword [rsp + 0x50], rcx
mov r12, qword [rsp + 0x338]
mov r13, qword [rsp + 0x340]
mov rbp, qword [rsp + 0x150]
mov rbx, qword [rsp + 0x158]
test rbx, rbx
je 0x1400676e3
mov rax, rbx
shl rax, 4
lea rdi, [rax + rax*4]
xor r15d, r15d
cmp qword [rbp + r15 + 0x10], r13
jne 0x1400676da
mov rcx, qword [rbp + r15 + 8]
mov rdx, r12
mov r8, r13
call fcn.140082380
test eax, eax
je 0x1400677f5
add r15, 0x50
cmp rdi, r15
jne 0x1400676bb
lea rcx, [rsp + 0x1f0]
mov rdx, r12
call fcn.140067b1f
mov r15, qword [rsp + 0x1f0]
mov rax, r15
neg rax
jno 0x140067753
mov r8, qword [rsp + 0x58]
shr r8d, 1
lea rcx, [rsp + 0x330]
mov rdx, qword [rsp + 0x48]
call fcn.1400207b0
mov r15, qword [rsp + 0x330]
mov rax, r15
neg rax
mov eax, 0
cmovo r15, rax
mov rdx, qword [rsp + 0x338]
mov ecx, 1
cmovo rdx, rcx
mov rdi, qword [rsp + 0x340]
cmovo rdi, rax
jmp 0x140067763
mov rdx, qword [rsp + 0x1f8]
mov rdi, qword [rsp + 0x200]
cmp rbx, qword [rsp + 0x148]
jne 0x140067788
lea rcx, [rsp + 0x148]
mov rbp, rdx
call fcn.140064497
mov rdx, rbp
mov rbp, qword [rsp + 0x150]
lea rax, [rbx + rbx*4]
shl rax, 4
mov rcx, qword [rsp + 0x50]
mov qword [rbp + rax], rcx
mov qword [rbp + rax + 8], r12
mov qword [rbp + rax + 0x10], r13
mov qword [rbp + rax + 0x18], r15
mov qword [rbp + rax + 0x20], rdx
mov qword [rbp + rax + 0x28], rdi
xor ecx, ecx
mov qword [rbp + rax + 0x30], rcx
mov qword [rbp + rax + 0x38], 8
mov qword [rbp + rax + 0x40], rcx
mov dword [rbp + rax + 0x48], 0
inc rbx
mov qword [rsp + 0x158], rbx
mov r13, qword [rsp + 0x40]
lea rdi, [rsp + 0xd0]
lea rbx, [rsp + 0x330]
jmp 0x14006761f
cmp qword [rsp + 0x50], 0
mov r13, qword [rsp + 0x40]
lea rdi, [rsp + 0xd0]
lea rbx, [rsp + 0x330]
je 0x14006761f
mov rcx, qword [0x1400cdc50]
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14006761f
mov rsi, qword [rsp + 0x2f0]
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x340], rax
movups xmm0, xmmword [rsp + 0x148]
movaps xmmword [rsp + 0x330], xmm0
test rsi, rsi
je 0x140067862
mov rcx, rsi
call sub.Secur32.dll_LsaFreeReturnBuffer
lea rsi, [r13 + 0xc0]
mov rcx, qword [r13 + 0xc8]
mov rdx, qword [r13 + 0xd0]
call fcn.14006460b
cmp qword [r13 + 0xc0], 0
je 0x14006789c
mov r8, qword [r13 + 0xc8]
mov rcx, qword [0x1400cdc50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0x340]
mov qword [rsi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x330]
movups xmmword [rsi], xmm0
movaps xmm6, xmmword [rsp + 0x880]
movaps xmm7, xmmword [rsp + 0x890]
movaps xmm8, xmmword [rsp + 0x8a0]
add rsp, 0x8b8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r8, qword [rsp + 0x1f8]
mov rcx, qword [0x1400cdc50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x140066545
mov qword [rsp + 0x20], 0x90
lea rcx, [rsp + 0x70]
mov r9d, 8
xor edx, edx
call fcn.140084696
jmp 0x140066f21
movss xmm6, dword [rsp + 0x1f0]
movd xmm7, dword [rsp + 0x1f8]
mov al, byte [0x1400cdcc0]
mov esi, 8
mov edx, 8
xor ecx, ecx
call fcn.14005b1d0
test rax, rax
je 0x140067b00
mov rdi, rax
lea rax, [rsp + 0x2f8]
movabs rcx, 0x72657475706d6f43
mov qword [rdi], rcx
mov r14, qword [rax - 8]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movdqu xmm2, xmmword [rax + 0x20]
movaps xmmword [rsp + 0x330], xmm0
movaps xmmword [rsp + 0x340], xmm1
movdqa xmmword [rsp + 0x350], xmm2
cmp r14, 3
je 0x1400650db
mov al, byte [0x1400cdcc0]
mov edx, 0x60
xor ecx, ecx
call fcn.14005b1d0
test rax, rax
je 0x140067b0f
mov rsi, rax
mov qword [rax], r14
movaps xmm0, xmmword [rsp + 0x330]
movaps xmm1, xmmword [rsp + 0x340]
movdqa xmm2, xmmword [rsp + 0x350]
movups xmmword [rax + 8], xmm0
movups xmmword [rax + 0x18], xmm1
movdqu xmmword [rax + 0x28], xmm2
mov eax, 8
mov qword [rsi + 0x38], rax
mov qword [rsi + 0x40], rdi
mov qword [rsi + 0x48], rax
mov dword [rsi + 0x50], ebx
movd dword [rsi + 0x54], xmm7
movss dword [rsi + 0x58], xmm6
movss dword [rsi + 0x5c], xmm6
mov edi, 1
jmp 0x1400650dd
mov qword [rsp + 0x20], 0x150
lea rcx, [rsp + 0x70]
mov r9d, 8
call fcn.140084696
jmp 0x140066896
mov ecx, 8
mov rdx, rsi
call fcn.140083a40
lea rcx, str.key_used_disappeared
lea r8, [0x1400b9bb8]
mov edx, 0x14
call fcn.140084050
mov ecx, 2
mov edx, 0x14
call fcn.140083a40
mov ecx, 2
mov edx, 0x14
call fcn.140083a60
mov ecx, 1
mov edx, 0x80000
call fcn.140083a40
lea rax, str.C:UsersMain.cargo_registry_srcindex.crates.io_6f17d22bba15001f_sysinfo_0.29.11_srcwindows_network.rs
mov edx, 0x101
mov rcx, r8
mov r8, rax
call fcn.140083c30
mov ecx, 8
mov edx, 0xfa0
call fcn.140083a40
lea rcx, str.assertion_failed:_vec.capacity_____start___lenC:UsersMain.cargo_registry_srcindex.crates.io_6f17d22bba15001f_rayon_1.10.0_src_vec.rs
lea r8, [0x1400b9328]
mov edx, 0x2f
call fcn.140083ca0
lea rcx, str.global_key_idle_disappearedC:UsersMain.cargo_registry_srcindex.crates.io_6f17d22bba15001f_sysinfo_0.29.11_srcwindows_system.rs
lea r8, [0x1400b9b88]
mov edx, 0x1b
call fcn.140084050
mov ecx, 1
mov edx, 0x1e
call fcn.140083a40
mov ecx, 1
mov edx, 5
call fcn.140083a40
mov ecx, 1
mov edx, 0x32
call fcn.140083a40
mov ecx, 1
mov edx, 8
call fcn.140083a40
mov ecx, 8
mov edx, 0x60
call fcn.140083a60
int3