Function at 0x1401428f2
Capabilities:
Get disk information
Get local ipv4 addresses
Get logon sessions
List groups for user account
List user accounts

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x518
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x480], xmm8
movdqa xmmword [rbp + 0x470], xmm7
movdqa xmmword [rbp + 0x460], xmm6
mov qword [rbp + 0x458], 0xfffffffffffffffe
mov qword [rbp + 0x2b8], rdx
mov qword [rbp + 0x1a0], rcx
lea rsi, [rbp - 0x40]
mov rcx, rsi
call fcn.14014c841
mov rcx, rsi
call fcn.1401454fa
mov rsi, rax
mov rdi, rdx
lea rbx, [rbp - 0x40]
mov edx, 0x158
mov r8d, 0x1f4
mov rcx, rbx
call fcn.14014260a
mov rax, qword [rbx]
test rax, rax
je 0x140142986
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
mov r8, qword [rbp - 0x28]
jmp 0x14014298e
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x30]
mov qword [rbp + 0x3a0], rax
mov qword [rbp + 0x3a8], rcx
mov qword [rbp + 0x3b0], rdx
mov qword [rbp + 0x3b8], r8
mov qword [rbp + 0x3c0], rsi
mov qword [rbp + 0x3c8], rdi
push 9
pop rcx
xor edx, edx
call fcn.14009dbaf
movabs rcx, 0x5043206c61746f54
mov qword [rax], rcx
mov byte [rax + 8], 0x55
pxor xmm0, xmm0
movdqu xmmword [rbp + 0x320], xmm0
movdqu xmmword [rbp + 0x338], xmm0
movdqu xmmword [rbp + 0x378], xmm0
mov qword [rbp + 0x300], rax
mov qword [rbp + 0x308], rdx
mov qword [rbp + 0x310], 9
push 1
pop r14
mov qword [rbp + 0x318], r14
mov qword [rbp + 0x330], r14
and qword [rbp + 0x348], 0
and qword [rbp + 0x360], 0
and dword [rbp + 0x368], 0
push 8
pop r15
mov qword [rbp + 0x370], r15
mov byte [rbp + 0x388], 0
mov qword [rbp + 0x200], r15
movdqu xmmword [rbp + 0x208], xmm0
mov edx, 0x120
mov rcx, r15
call fcn.14009161f
test rax, rax
je 0x140144630
mov qword [rbp + 0x260], rax
mov qword [rbp + 0x268], 2
and qword [rbp + 0x270], 0
and qword [rbp + 0x2c0], 0
lea rcx, [rbp - 0x40]
call fcn.14014c841
lea rcx, [rbp - 0x40]
call fcn.1401454fa
pxor xmm0, xmm0
movdqu xmmword [rbp + 0x3e8], xmm0
and qword [rbp + 0x3f8], 0
lea rbx, [0x1402d6850]
mov qword [rbp + 0x3e0], rbx
mov qword [rbp + 0x400], rax
mov qword [rbp + 0x408], rdx
call fcn.140134420
shl rdx, 0x20
mov eax, eax
or rax, rdx
lea rsi, [rbp - 0x40]
mov rcx, rsi
mov rdx, rax
call fcn.1401344b0
cmp qword [rsi], 0
je 0x140142af3
xor edi, edi
jmp 0x140142b10
mov rdi, qword [rbp - 0x38]
call sub.kernel32.dll_GetTickCount64
xor ecx, ecx
mov r8d, 0x3e8
xor edx, edx
div r8
sub rdi, rax
cmovb rdi, rcx
pxor xmm0, xmm0
lea rsi, [rbp + 0xd0]
movdqa xmmword [rsi - 0x10], xmm0
movups xmm1, xmmword [rbp + 0x3a0]
movups xmm2, xmmword [rbp + 0x3b0]
movups xmm3, xmmword [rbp + 0x3c0]
movaps xmmword [rsi - 0xd0], xmm1
movaps xmmword [rsi - 0xc0], xmm2
movaps xmmword [rsi - 0xb0], xmm3
movdqa xmmword [rsi - 0x70], xmm0
movdqa xmmword [rsi - 0x60], xmm0
lea rdx, [rbp + 0x300]
mov r8d, 0x90
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [rbp + 0x200]
movups xmmword [rsi - 0x48], xmm0
mov rax, qword [rbp + 0x210]
mov qword [rsi - 0x38], rax
movups xmm0, xmmword [rbp + 0x260]
movaps xmmword [rsi - 0x30], xmm0
mov rax, qword [rbp + 0x270]
mov qword [rsi - 0x20], rax
movups xmm0, xmmword [rbp + 0x2c0]
movups xmm1, xmmword [rbp + 0x2d0]
movups xmm2, xmmword [rbp + 0x2e0]
movups xmm3, xmmword [rbp + 0x2f0]
movaps xmmword [rsi - 0x110], xmm0
movaps xmmword [rsi - 0x100], xmm1
movaps xmmword [rsi - 0xf0], xmm2
movaps xmmword [rsi - 0xe0], xmm3
movdqu xmm0, xmmword [rbp + 0x3e0]
movups xmm1, xmmword [rbp + 0x3f0]
movups xmm2, xmmword [rbp + 0x400]
movaps xmmword [rsi - 0x80], xmm2
movaps xmmword [rsi - 0x90], xmm1
movdqa xmmword [rsi - 0xa0], xmm0
mov qword [rsi - 0x50], rdi
mov qword [rsi - 0x18], 8
mov rdi, qword [rbp + 0x2b8]
cmp byte [rdi + 4], 0
je 0x140142c18
lea rcx, [rbp - 0x40]
call fcn.140145791
cmp byte [rdi + 0xb], 2
je 0x140142c2d
mov dl, byte [rdi + 0xc]
and dl, 1
lea rcx, [rbp - 0x40]
call fcn.140145876
cmp byte [rdi + 6], 0
je 0x140142e80
lea rcx, [rbp + 0x2c0]
call fcn.140147d70
cmp dword [rbp + 0x2c0], 2
mov qword [rbp + 0x448], r15
je 0x140142f47
mov rax, qword [rbp + 0x2f0]
lea rdx, [rbp + 0x300]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rbp + 0x2c0]
movups xmm1, xmmword [rbp + 0x2d0]
movups xmm2, xmmword [rbp + 0x2e0]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rcx, [rbp + 0x3e0]
call fcn.140147d9c
cmp qword [rbp + 0x3e0], 2
je 0x140142f47
mov rax, qword [rbp + 0x410]
lea rdx, [rbp + 0x300]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rbp + 0x3e0]
movups xmm1, xmmword [rbp + 0x3f0]
movups xmm2, xmmword [rbp + 0x400]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rcx, [rbp + 0x3a0]
call fcn.140147e47
cmp qword [rbp + 0x3a0], 2
je 0x140142f47
mov rax, qword [rbp + 0x3d0]
lea rdx, [rbp + 0x300]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rbp + 0x3a0]
movups xmm1, xmmword [rbp + 0x3b0]
movups xmm2, xmmword [rbp + 0x3c0]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rcx, [rbp + 0x260]
call fcn.140147f3f
cmp qword [rbp + 0x260], 2
je 0x140142f47
mov rax, qword [rbp + 0x290]
lea rdx, [rbp + 0x300]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rbp + 0x260]
movups xmm1, xmmword [rbp + 0x270]
movups xmm2, xmmword [rbp + 0x280]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rcx, [rbp + 0x200]
call fcn.140148080
cmp qword [rbp + 0x200], 2
je 0x140142f47
mov rax, qword [rbp + 0x230]
lea rdx, [rbp + 0x300]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rbp + 0x200]
movups xmm1, xmmword [rbp + 0x210]
movups xmm2, xmmword [rbp + 0x220]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rcx, [rbp + 0x168]
call fcn.14014812b
mov rax, qword [rbp + 0x168]
cmp rax, 2
je 0x140142f47
movdqu xmm0, xmmword [rbp + 0x170]
movups xmm1, xmmword [rbp + 0x180]
movups xmm2, xmmword [rbp + 0x190]
lea rdx, [rbp + 0x1c8]
movups xmmword [rdx + 0x28], xmm2
movups xmmword [rdx + 0x18], xmm1
movdqu xmmword [rdx + 8], xmm0
mov qword [rdx], rax
mov byte [rbp + 0x456], 1
lea rcx, [rbp + 0x3a0]
mov r8b, 1
call fcn.140148289
mov rax, qword [rbp + 0x1f8]
mov qword [rbp + 0x2f0], rax
movdqu xmm0, xmmword [rbp + 0x1c8]
movups xmm1, xmmword [rbp + 0x1d8]
movups xmm2, xmmword [rbp + 0x1e8]
movaps xmmword [rbp + 0x2e0], xmm2
movaps xmmword [rbp + 0x2d0], xmm1
movdqa xmmword [rbp + 0x2c0], xmm0
mov esi, dword [rbp + 0x3a4]
cmp esi, 2
jne 0x140142ea2
mov byte [rbp + 0x456], 0
lea rcx, [rbp + 0x2c0]
call fcn.140141dd1
jmp 0x140142f47
cmp byte [rdi + 5], 0
je 0x140142f7f
mov rcx, qword [rbp + 0x88]
mov rdx, qword [rbp + 0x98]
call fcn.140145d21
jmp 0x140142f7f
movd xmm6, dword [rbp + 0x3a0]
movd xmm7, dword [rbp + 0x3a8]
mov rax, qword [rbp + 0x1f8]
mov qword [rbp + 0x330], rax
movdqu xmm0, xmmword [rbp + 0x1c8]
movups xmm1, xmmword [rbp + 0x1d8]
movups xmm2, xmmword [rbp + 0x1e8]
movaps xmmword [rbp + 0x320], xmm2
movaps xmmword [rbp + 0x310], xmm1
movdqa xmmword [rbp + 0x300], xmm0
mov rcx, r15
xor edx, edx
call fcn.14009dbaf
movabs rcx, 0x72657475706d6f43
mov qword [rax], rcx
mov rcx, qword [rbp + 0x300]
movups xmm0, xmmword [rbp + 0x308]
movaps xmmword [rbp + 0x3e0], xmm0
movups xmm0, xmmword [rbp + 0x318]
movaps xmmword [rbp + 0x3f0], xmm0
movdqu xmm0, xmmword [rbp + 0x328]
movdqa xmmword [rbp + 0x400], xmm0
cmp rcx, 3
jne 0x14014457d
mov qword [rbp + 0x448], r15
xor eax, eax
mov qword [rbp + 0x438], rax
lea rcx, [rbp + 0x88]
call fcn.14000fe0a
mov rax, qword [rbp + 0x448]
mov qword [rbp + 0x88], rax
mov rax, qword [rbp + 0x438]
mov qword [rbp + 0x90], rax
mov qword [rbp + 0x98], rax
cmp byte [rdi + 1], 0
je 0x140142fea
lea rcx, [rbp + 0x200]
and qword [rcx], 0
call sub.iphlpapi.dll_GetIfTable2
test eax, eax
jne 0x140143c62
mov rax, qword [rbp + 0x30]
mov rcx, qword [rbp + 0x38]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [rbp + 0x48]
lea rsi, [rbp + 0x300]
mov qword [rsi], rax
add rax, 0x10
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov word [rsi + 0x18], dx
mov qword [rsi + 0x20], r8
mov rcx, rsi
call fcn.1401424c5
test rax, rax
je 0x140143001
mov byte [rdx + 0x6e], 0
jmp 0x140142fd7
cmp byte [rdi], 0
je 0x140143c62
lea rcx, [rbp + 0x30]
call fcn.1401460c9
jmp 0x140143c62
lea rcx, [rbp + 0x300]
call fcn.14014c841
lea rcx, [rbp + 0x300]
call fcn.1401454fa
lea rcx, [rbp + 0x320]
mov qword [rcx - 0x20], rbx
pxor xmm0, xmm0
and qword [rcx - 8], 0
movdqu xmmword [rcx - 0x18], xmm0
mov qword [rcx], rax
mov qword [rcx + 8], rdx
lea rax, [rbp + 0x260]
mov qword [rax], 8
movdqu xmmword [rax + 8], xmm0
mov r15, qword [rbp + 0x200]
mov eax, dword [r15]
mov dword [rbp + 0x398], eax
add r15, 8
push 0xa
pop r13
lea rdi, [rbp + 0x2c0]
pcmpeqd xmm6, xmm6
xor ebx, ebx
mov qword [rbp + 0x430], r15
mov eax, ebx
cmp ebx, dword [rbp + 0x398]
mov qword [rbp + 0x438], rax
jae 0x140143367
lea ebx, [rax + 1]
mov eax, eax
imul rsi, rax, 0x548
cmp qword [r15 + rsi + 0x4a8], 0
jne 0x1401430af
cmp qword [r15 + rsi + 0x4b0], 0
je 0x140143078
cmp dword [r15 + rsi + 0x48c], 2
je 0x140143078
cmp dword [r15 + rsi + 0x420], 0
je 0x140143078
push 0x14
pop rcx
push 2
pop rdx
call fcn.1400916f6
mov dword [rbp + 0x418], ebx
mov r14d, dword [r15 + rsi + 0x10]
movzx ecx, byte [r15 + rsi + 0x14]
movzx edx, byte [r15 + rsi + 0x15]
movzx r8d, byte [r15 + rsi + 0x16]
movzx r9d, byte [r15 + rsi + 0x17]
movzx r10d, byte [r15 + rsi + 0x18]
movzx r11d, byte [r15 + rsi + 0x19]
movzx ebx, byte [r15 + rsi + 0x1a]
movzx esi, byte [r15 + rsi + 0x1b]
mov dword [rax], r14d
mov word [rax + 4], cx
mov word [rax + 6], dx
mov word [rax + 8], r8w
mov word [rax + 0xa], r9w
mov word [rax + 0xc], r10w
mov word [rax + 0xe], r11w
mov word [rax + 0x10], bx
mov word [rax + 0x12], si
mov byte [rbp + 0x446], 1
mov rcx, r13
xor edx, edx
mov qword [rbp + 0x428], rax
call fcn.14013f1e6
mov qword [rbp + 0x420], rdx
mov rdx, qword [rbp + 0x428]
mov ecx, dword [rdx + 0x10]
mov dword [rax + 0x10], ecx
movups xmm0, xmmword [rdx]
movups xmmword [rax], xmm0
mov rcx, qword [rbp + 0x320]
mov rdx, qword [rbp + 0x328]
mov qword [rbp + 0x448], rax
mov r8, rax
mov r9, r13
call fcn.1401417b0
mov r12, qword [rbp + 0x300]
mov rsi, qword [rbp + 0x308]
mov rbx, rsi
and rbx, rax
mov qword [rbp + 0x250], rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor r15d, r15d
movdqu xmm8, xmmword [r12 + rbx]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rbp + 0x2c0], ax
mov rcx, rdi
call fcn.14001a668
test rax, rax
je 0x14014320c
add rdx, rbx
and rdx, rsi
shl rdx, 5
mov r14, r12
sub r14, rdx
mov rcx, qword [r14 - 0x20]
mov rdx, qword [r14 - 0x10]
mov r8, qword [rbp + 0x448]
mov r9, r13
call fcn.140141875
test al, al
je 0x1401431d2
jmp 0x14014322e
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x1401432d2
add rbx, r15
add rbx, 0x10
add r15, 0x10
and rbx, rsi
jmp 0x1401431b8
mov rcx, qword [rbp + 0x448]
mov rdx, qword [rbp + 0x420]
call fcn.14016a4b8
mov r15, qword [rbp + 0x430]
mov eax, dword [r14 - 8]
inc eax
mov dword [r14 - 8], eax
cmp eax, 1
mov ebx, dword [rbp + 0x418]
jle 0x140143271
mov rcx, qword [rbp + 0x428]
mov rdx, r13
call fcn.14016a4b8
jmp 0x140143078
mov rdx, qword [rbp + 0x270]
cmp rdx, qword [rbp + 0x268]
jne 0x140143294
lea rcx, [rbp + 0x260]
call fcn.140113b56
mov rdx, qword [rbp + 0x270]
mov r9, qword [rbp + 0x428]
mov rax, qword [rbp + 0x260]
mov rcx, rdx
shl rcx, 5
mov r8, qword [rbp + 0x438]
mov dword [rax + rcx], r8d
mov qword [rax + rcx + 8], r9
mov qword [rax + rcx + 0x10], r13
mov qword [rax + rcx + 0x18], r13
inc rdx
mov qword [rbp + 0x270], rdx
jmp 0x140143078
cmp qword [rbp + 0x310], 0
mov r15, qword [rbp + 0x430]
jne 0x140143304
lea rcx, [rbp + 0x300]
lea rdx, [rbp + 0x320]
call fcn.1402860c1
mov r12, qword [rbp + 0x300]
mov rsi, qword [rbp + 0x308]
mov rcx, r12
mov rdx, rsi
mov r8, qword [rbp + 0x250]
call fcn.140142569
mov rcx, qword [rbp + 0x300]
shl rax, 5
mov r14, rcx
and dl, 1
movzx edx, dl
sub qword [rbp + 0x310], rdx
sub r14, rax
neg rax
mov rdx, qword [rbp + 0x448]
mov qword [rcx + rax - 0x20], rdx
mov rax, qword [rbp + 0x420]
mov qword [r14 - 0x18], rax
mov qword [r14 - 0x10], 0xa
and dword [r14 - 8], 0
inc qword [rbp + 0x318]
jmp 0x140143248
mov rsi, qword [rbp + 0x260]
mov rax, qword [rbp + 0x268]
mov rcx, qword [rbp + 0x270]
shl rcx, 5
add rcx, rsi
mov qword [rbp + 0x2c0], rsi
mov qword [rbp + 0x2c8], rax
mov qword [rbp + 0x2d0], rsi
mov qword [rbp + 0x250], rcx
mov qword [rbp + 0x2d8], rcx
pcmpeqd xmm6, xmm6
cmp rsi, qword [rbp + 0x250]
je 0x1401438f0
mov rax, rsi
add rsi, 0x20
mov qword [rbp + 0x2d0], rsi
mov rcx, qword [rax + 8]
mov qword [rbp + 0x448], rcx
test rcx, rcx
je 0x1401438f0
mov rcx, qword [rax + 0x10]
mov qword [rbp + 0x428], rcx
mov edx, dword [rax]
cmp qword [rbp + 0x318], 0
mov qword [rbp + 0x418], rsi
je 0x140143500
mov qword [rbp + 0x420], rdx
mov rsi, qword [rax + 0x18]
mov rcx, qword [rbp + 0x320]
mov rdx, qword [rbp + 0x328]
mov r8, qword [rbp + 0x448]
mov r9, rsi
call fcn.1401417b0
mov r13, qword [rbp + 0x300]
mov r12, qword [rbp + 0x308]
mov r14, r12
and r14, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor r15d, r15d
movdqu xmm8, xmmword [r13 + r14]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rbp + 0x3e0], ax
lea rcx, [rbp + 0x3e0]
call fcn.14001a668
mov rdi, rax
test rax, rax
je 0x1401434b2
mov rbx, rdx
add rbx, r14
and rbx, r12
mov rax, rbx
shl rax, 5
mov rcx, r13
sub rcx, rax
mov r8, qword [rcx - 0x20]
mov r9, qword [rcx - 0x10]
mov rcx, qword [rbp + 0x448]
mov rdx, rsi
call fcn.140141875
test al, al
je 0x14014346b
jmp 0x1401434d0
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x1401434d0
add r14, r15
add r14, 0x10
add r15, 0x10
and r14, r12
jmp 0x140143450
shl rbx, 5
sub r13, rbx
test rdi, rdi
cmove r13, rdi
add r13, 0xffffffffffffffe0
test rdi, rdi
cmove r13, rdi
mov r15, qword [rbp + 0x430]
mov rsi, qword [rbp + 0x418]
mov rdx, qword [rbp + 0x420]
jmp 0x140143503
xor r13d, r13d
lea rax, [r13 + 0x18]
test r13, r13
lea rcx, [0x1402d6018]
cmove rax, rcx
cmp dword [rax], 1
jg 0x140143745
imul r13, rdx, 0x548
lea rdi, [r15 + r13]
lea rcx, [r15 + r13]
add rcx, 0x1c
xor r8d, r8d
cmp r8, 0x101
je 0x14014354a
cmp word [rcx + r8*2], 0
je 0x140143550
inc r8
jmp 0x140143534
mov r8d, 0x101
mov edx, 0x101
lea r9, str.C:Users_admin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_sysinfo_0.29.8_srcwindows_network.rs
call fcn.14013f3a2
mov r8, rdx
lea rcx, [rbp + 0x3a0]
mov rdx, rax
call fcn.14005be50
cmp qword [rbp + 0x3a0], 0
je 0x140143737
mov qword [rbp + 0x258], rdi
mov rbx, qword [rbp + 0x3b0]
mov qword [rbp + 0x3f0], rbx
movups xmm0, xmmword [rbp + 0x3a0]
movaps xmmword [rbp + 0x3e0], xmm0
mov rcx, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x58]
mov rdi, qword [rbp + 0x3e0]
mov r8, rdi
mov r9, rbx
call fcn.14014171a
mov rsi, qword [rbp + 0x30]
mov r14, qword [rbp + 0x38]
mov r12, r14
and r12, rax
mov qword [rbp + 0x1a8], rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor eax, eax
mov qword [rbp + 0x420], rax
movdqu xmm8, xmmword [rsi + r12]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rbp + 0x3a0], ax
lea rcx, [rbp + 0x3a0]
call fcn.14001a668
test rax, rax
je 0x14014364b
add rdx, r12
and rdx, r14
neg rdx
imul r15, rdx, 0x88
mov rcx, qword [rsi + r15 - 0x88]
mov rdx, qword [rsi + r15 - 0x78]
mov r8, rdi
mov r9, rbx
call fcn.14008c355
test al, al
je 0x14014360c
jmp 0x14014367e
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x14014375d
mov rax, qword [rbp + 0x420]
add r12, rax
add r12, 0x10
add rax, 0x10
mov qword [rbp + 0x420], rax
and r12, r14
jmp 0x1401435f2
add rsi, r15
mov rdx, qword [rbp + 0x3e8]
mov rax, qword [rsi - 0x68]
mov rcx, qword [rsi - 0x58]
mov qword [rsi - 0x60], rax
mov r15, qword [rbp + 0x430]
mov rax, qword [r15 + r13 + 0x500]
mov qword [rsi - 0x68], rax
mov qword [rsi - 0x50], rcx
mov rax, qword [r15 + r13 + 0x4b8]
mov qword [rsi - 0x58], rax
mov rax, qword [rsi - 0x48]
mov qword [rsi - 0x40], rax
mov rax, qword [r15 + r13 + 0x4c0]
add rax, qword [r15 + r13 + 0x4c8]
push 0xffffffffffffffff
pop rcx
cmovb rax, rcx
mov qword [rsi - 0x48], rax
mov rax, qword [rsi - 0x38]
mov qword [rsi - 0x30], rax
mov rax, qword [r15 + r13 + 0x508]
add rax, qword [r15 + r13 + 0x510]
cmovb rax, rcx
mov qword [rsi - 0x38], rax
mov rax, qword [rsi - 0x28]
mov qword [rsi - 0x20], rax
mov rax, qword [r15 + r13 + 0x4d8]
mov qword [rsi - 0x28], rax
mov rax, qword [rsi - 0x18]
mov qword [rsi - 0x10], rax
mov rax, qword [r15 + r13 + 0x520]
mov qword [rsi - 0x18], rax
mov byte [rsi - 2], 1
mov rcx, rdi
call fcn.14006b51b
mov rsi, qword [rbp + 0x418]
jmp 0x140143745
mov rdx, qword [rbp + 0x3a8]
xor ecx, ecx
call fcn.140147d3c
mov rcx, qword [rbp + 0x448]
mov rdx, qword [rbp + 0x428]
call fcn.14016a4b8
jmp 0x1401433aa
cmp qword [rbp + 0x40], 0
jne 0x140143779
lea rcx, [rbp + 0x30]
lea rdx, [rbp + 0x50]
call fcn.140285db1
mov rsi, qword [rbp + 0x30]
mov r14, qword [rbp + 0x38]
mov rax, qword [rbp + 0x3e8]
mov qword [rbp + 0x420], rax
mov rax, qword [rbp + 0x430]
mov r15, qword [rax + r13 + 0x4c0]
mov rax, qword [rbp + 0x430]
add r15, qword [rax + r13 + 0x4c8]
mov rax, qword [rbp + 0x430]
mov rax, qword [rax + r13 + 0x4b8]
mov qword [rbp + 0x1b0], rax
push 0xffffffffffffffff
pop rcx
cmovb r15, rcx
mov rax, qword [rbp + 0x430]
mov r12, qword [rax + r13 + 0x508]
mov rax, qword [rbp + 0x430]
add r12, qword [rax + r13 + 0x510]
cmovb r12, rcx
mov rax, qword [rbp + 0x258]
mov rax, qword [rax]
mov qword [rbp + 0x1b8], rax
mov rax, qword [rbp + 0x430]
mov rax, qword [rax + r13 + 0x500]
mov qword [rbp + 0x1c0], rax
mov rax, qword [rbp + 0x430]
mov rax, qword [rax + r13 + 0x4d8]
mov qword [rbp + 0x258], rax
mov rax, qword [rbp + 0x430]
mov r13, qword [rax + r13 + 0x520]
mov rcx, rsi
mov rdx, r14
mov r8, qword [rbp + 0x1a8]
call fcn.140142569
mov rcx, qword [rbp + 0x30]
neg rax
and dl, 1
movzx edx, dl
sub qword [rbp + 0x40], rdx
imul rax, rax, 0x88
mov qword [rcx + rax - 0x88], rdi
mov rdx, qword [rbp + 0x420]
mov qword [rcx + rax - 0x80], rdx
mov qword [rcx + rax - 0x78], rbx
mov rdx, qword [rbp + 0x1b8]
mov qword [rcx + rax - 0x70], rdx
mov rdx, qword [rbp + 0x1c0]
mov qword [rcx + rax - 0x68], rdx
mov qword [rcx + rax - 0x60], rdx
mov rdx, qword [rbp + 0x1b0]
mov qword [rcx + rax - 0x58], rdx
mov qword [rcx + rax - 0x50], rdx
mov qword [rcx + rax - 0x48], r15
mov qword [rcx + rax - 0x40], r15
mov r15, qword [rbp + 0x430]
mov qword [rcx + rax - 0x38], r12
mov qword [rcx + rax - 0x30], r12
mov rdx, qword [rbp + 0x258]
mov qword [rcx + rax - 0x28], rdx
mov qword [rcx + rax - 0x20], rdx
mov qword [rcx + rax - 0x18], r13
mov qword [rcx + rax - 0x10], r13
and dword [rcx + rax - 8], 0
and word [rcx + rax - 4], 0
mov byte [rcx + rax - 2], 1
inc qword [rbp + 0x48]
jmp 0x14014372e
lea rcx, [rbp + 0x2c0]
call fcn.140142498
mov rcx, qword [rbp + 0x200]
call sub.iphlpapi.dll_FreeMibTable
lea rsi, [rbp + 0x300]
mov rcx, rsi
call fcn.14014216e
mov rax, qword [rbp + 0x30]
mov rcx, qword [rbp + 0x38]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [rbp + 0x48]
mov qword [rsi], rax
add rax, 0x10
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov word [rsi + 0x18], dx
mov qword [rsi + 0x20], r8
mov ebx, 0x88
mov rcx, rsi
call fcn.1401412aa
test rax, rax
je 0x14014398f
mov rdi, rax
cmp byte [rax - 2], 0
jne 0x14014394f
mov rax, qword [rbp + 0x30]
sub rax, rdi
cqo
idiv rbx
lea rcx, [rbp + 0x30]
mov rdx, rax
call fcn.14014287e
mov rcx, qword [rdi - 0x88]
mov rdx, qword [rdi - 0x80]
call fcn.14006b51b
jmp 0x14014394f
and dword [rbp + 0x3a0], 0
mov dword [rbp + 0x260], 0x3c00
xor r14d, r14d
push 0xe
pop rsi
xor ebx, ebx
cmp ebx, 2
ja 0x140143a5c
mov edx, dword [rbp + 0x260]
mov rcx, r14
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
test rax, rax
je 0x140143a0e
mov rdi, rax
mov qword [rbp + 0x248], rax
mov byte [rbp + 0x447], 1
lea rax, [rbp + 0x260]
mov qword [rsp + 0x20], rax
xor ecx, ecx
mov edx, esi
xor r8d, r8d
mov r9, rdi
call sub.iphlpapi.dll_GetAdaptersAddresses
inc ebx
mov dword [rbp + 0x3a0], eax
mov r14, rdi
cmp eax, 0x6f
je 0x1401439a8
test eax, eax
jne 0x140143a59
xor esi, esi
mov rbx, rdi
jmp 0x140143adb
mov qword [rbp + 0x448], r14
push 0x32
pop rdi
mov rcx, rdi
xor edx, edx
call fcn.14009dbaf
mov rsi, rax
mov rbx, rdx
movups xmm0, xmmword [0x1402d64e0]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x1402d64d0]
movups xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [str.failed_to_allocate_memory_for_IP_ADAPTER_ADDRESSESGetAdaptersAddresses___failed_with_code]
movdqu xmmword [rax], xmm0
mov word [rax + 0x30], 0x5345
mov rcx, qword [rbp + 0x448]
jmp 0x140143ad6
mov r14, rdi
lea rax, [rbp + 0x3a0]
mov qword [rbp + 0x3e0], rax
lea rax, [0x140063470]
mov qword [rbp + 0x3e8], rax
lea rax, [0x1402d6520]
lea rdx, [rbp + 0x300]
mov qword [rdx], rax
push 1
pop rax
mov qword [rdx + 8], rax
and qword [rdx + 0x20], 0
lea rcx, [rbp + 0x3e0]
mov qword [rdx + 0x10], rcx
mov qword [rdx + 0x18], rax
mov qword [rbp + 0x248], r14
mov byte [rbp + 0x447], 1
lea rcx, [rbp + 0x2c0]
call fcn.14013e7da
mov rsi, qword [rbp + 0x2c0]
mov rbx, qword [rbp + 0x2c8]
mov rdi, qword [rbp + 0x2d0]
mov rcx, r14
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
test rsi, rsi
je 0x140143af7
mov rcx, rsi
mov rdx, rbx
call fcn.14006b51b
mov rdi, qword [rbp + 0x2b8]
jmp 0x140143c62
lea rax, [rbp + 0x2c0]
mov qword [rax], rbx
mov qword [rax + 8], rdi
lea rbx, [rbp + 0x3e0]
pcmpeqd xmm6, xmm6
lea rcx, [rbp + 0x300]
lea rdx, [rbp + 0x2c0]
call fcn.140147bcd
mov rdi, qword [rbp + 0x2b8]
mov r14, qword [rbp + 0x300]
test r14, r14
je 0x140143c56
mov rax, qword [rbp + 0x308]
mov qword [rbp + 0x448], rax
cmp qword [rbp + 0x48], 0
je 0x140143c42
mov r12, qword [rbp + 0x310]
mov rcx, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x58]
mov r8, r14
mov r9, r12
call fcn.14014171a
mov rdi, qword [rbp + 0x30]
mov r13, qword [rbp + 0x38]
mov rsi, r13
and rsi, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor eax, eax
mov qword [rbp + 0x438], rax
movdqu xmm8, xmmword [rdi + rsi]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rbp + 0x3e0], ax
mov rcx, rbx
call fcn.14001a668
test rax, rax
je 0x140143bef
add rdx, rsi
and rdx, r13
neg rdx
imul r15, rdx, 0x88
mov r8, qword [rdi + r15 - 0x88]
mov r9, qword [rdi + r15 - 0x78]
mov rcx, r14
mov rdx, r12
call fcn.14008c355
test al, al
je 0x140143bb4
jmp 0x140143c1e
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x140143c42
mov rax, qword [rbp + 0x438]
add rsi, rax
add rsi, 0x10
add rax, 0x10
mov qword [rbp + 0x438], rax
and rsi, r13
jmp 0x140143b9a
lea rax, [rdi + r15]
add rax, 0xffffffffffffff78
lea rdx, [rbp + 0x318]
movzx ecx, word [rdx + 4]
mov word [rax + 0x84], cx
mov ecx, dword [rdx]
mov dword [rax + 0x80], ecx
mov rcx, r14
mov rdx, qword [rbp + 0x448]
call fcn.14006b51b
jmp 0x140143b10
mov rcx, qword [rbp + 0x2c0]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
movzx edx, word [rdi + 8]
cmp dl, 2
je 0x140143c7d
movzx eax, byte [rdi + 0xa]
shl eax, 0x10
or edx, eax
lea rcx, [rbp - 0x40]
call fcn.1401461fa
cmp byte [rdi + 2], 0
je 0x140143e4c
call sub.kernel32.dll_GetLogicalDrives
mov dword [rbp + 0x200], eax
test eax, eax
je 0x140143e67
mov qword [rbp + 0x3a0], 8
pxor xmm0, xmm0
movdqu xmmword [rbp + 0x3a8], xmm0
lea rax, [rbp + 0x200]
mov qword [rbp + 0x300], rax
movabs rax, 0x2000000000
mov qword [rbp + 0x308], rax
push 0x20
pop rcx
call fcn.140141380
lea rcx, [rbp + 0x300]
mov qword [rsp + 0x38], rcx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x20
mov qword [rsp + 0x20], 1
lea rsi, [rbp + 0x3e0]
push 0x20
pop rdx
mov rcx, rsi
xor r8d, r8d
mov r9, rax
call fcn.14013fced
mov rax, qword [rbp + 0x3f0]
xor edx, edx
sub rax, 1
jb 0x140143d33
mov rsi, qword [rsi]
test rsi, rsi
je 0x140143d33
add rdx, qword [rsi + 0x10]
add rsi, 0x18
jmp 0x140143d1b
mov byte [rbp + 0x445], 1
lea rcx, [rbp + 0x3a0]
call fcn.1401418d7
mov rax, qword [rbp + 0x3f0]
lea rsi, [rbp + 0x2c0]
mov qword [rsi + 0x10], rax
movdqu xmm0, xmmword [rbp + 0x3e0]
movdqa xmmword [rsi], xmm0
lea r13, [rbp + 0x308]
lea rdi, [rbp + 0x3a0]
lea rbx, [rbp + 0x300]
mov rcx, rsi
call fcn.14013a73a
test rax, rax
je 0x140143e0f
mov r14, qword [rax]
movups xmm0, xmmword [rax + 8]
movaps xmmword [rbp + 0x260], xmm0
mov rcx, rax
call fcn.14005cbb0
test r14, r14
je 0x140143e0f
mov qword [rbp + 0x300], r14
movdqa xmm0, xmmword [rbp + 0x260]
movdqu xmmword [r13], xmm0
mov r15, qword [rbp + 0x310]
mov rcx, rdi
mov rdx, r15
call fcn.1401418d7
mov r12, qword [rbp + 0x3b0]
imul rcx, r12, 0x90
add rcx, qword [rbp + 0x3a0]
imul r8, r15, 0x90
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
add r12, r15
mov qword [rbp + 0x3b0], r12
and qword [rbp + 0x310], 0
mov rcx, rbx
call fcn.14013a247
jmp 0x140143d79
mov byte [rbp + 0x445], 0
lea rcx, [rbp + 0x2c0]
call fcn.14013a6e3
lea rax, [rbp + 0x3a8]
mov rcx, qword [rbp + 0x3a0]
mov qword [rbp + 0x448], rcx
movdqu xmm0, xmmword [rax]
movdqa xmmword [rbp + 0x300], xmm0
mov rdi, qword [rbp + 0x2b8]
jmp 0x140143e7d
cmp byte [rdi + 3], 0
je 0x140143ea7
mov rcx, qword [rbp + 0xa0]
mov rdx, qword [rbp + 0xb0]
call fcn.140146b65
jmp 0x140143ea7
pxor xmm0, xmm0
movdqa xmmword [rbp + 0x300], xmm0
push 8
pop rax
mov qword [rbp + 0x448], rax
lea rcx, [rbp + 0xa0]
call fcn.14013a247
mov rax, qword [rbp + 0x448]
mov qword [rbp + 0xa0], rax
movdqa xmm0, xmmword [rbp + 0x300]
movdqu xmmword [rbp + 0xa8], xmm0
cmp byte [rdi + 7], 0
je 0x140144335
lea rax, [rbp + 0x168]
mov qword [rax], 8
pxor xmm6, xmm6
movdqu xmmword [rax + 8], xmm6
lea rax, [rbp + 0x244]
and dword [rax], 0
push 0x17
pop rsi
lea r15, [rbp + 0x2a8]
lea r12, [rbp + 0x300]
and qword [rbp + 0x2b0], 0
and dword [rbp + 0x2a4], 0
and dword [rbp + 0x240], 0
lea rax, [rbp + 0x244]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x240]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x2a4]
mov qword [rsp + 0x28], rax
or dword [rsp + 0x20], 0xffffffff
xor ecx, ecx
xor edx, edx
push 2
pop r8
lea r9, [rbp + 0x2b0]
call sub.netapi32.dll_NetUserEnum
mov dword [rbp + 0x428], eax
mov eax, dword [rbp + 0x428]
cmp eax, 0xea
je 0x140143f51
test eax, eax
jne 0x1401442a9
mov rbx, qword [rbp + 0x2b0]
mov eax, dword [rbp + 0x2a4]
lea r14, [rbx + rax*8]
cmp rbx, r14
je 0x140144285
mov rdi, rbx
add rbx, 8
cmp qword [rdi], 0
je 0x140143f62
and qword [rbp + 0x2a8], 0
mov rdx, qword [rdi]
xor ecx, ecx
mov r8d, esi
mov r9, r15
call sub.netapi32.dll_NetUserGetInfo
test eax, eax
jne 0x140144274
mov rax, qword [rbp + 0x2a8]
mov rdx, qword [rax + 0x20]
lea rcx, [rbp + 0x200]
call fcn.14013ea5d
mov rdx, qword [rbp + 0x200]
test rdx, rdx
je 0x140144274
mov rax, qword [rbp + 0x208]
mov qword [rbp + 0x398], rax
mov r15, qword [rbp + 0x210]
mov byte [rbp + 0x455], 1
mov rcx, r12
mov qword [rbp + 0x438], rdx
call fcn.140146bef
cmp qword [rbp + 0x300], 0
je 0x140144014
mov rax, qword [rbp + 0x310]
mov qword [rbp + 0x270], rax
movdqu xmm0, xmmword [rbp + 0x300]
movdqa xmmword [rbp + 0x260], xmm0
jmp 0x14014402a
mov rdx, qword [rdi]
mov byte [rbp + 0x455], 1
lea rcx, [rbp + 0x260]
call fcn.14013a16b
mov rax, qword [rbp + 0x270]
mov qword [rbp + 0x3b0], rax
movdqa xmm0, xmmword [rbp + 0x260]
movdqa xmmword [rbp + 0x3a0], xmm0
mov rdx, qword [rdi]
and qword [rbp + 0x1c8], 0
and dword [rbp + 0x3dc], 0
and dword [rbp + 0x23c], 0
mov byte [rbp + 0x454], 0
lea rax, [rbp + 0x23c]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x3dc]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x1c8]
mov qword [rsp + 0x20], rax
or dword [rsp + 0x28], 0xffffffff
lea rcx, [0x1402fee98]
xor r8d, r8d
push 1
pop r9
call sub.netapi32.dll_NetUserGetLocalGroups
test eax, eax
je 0x1401440c3
lea rax, [rbp + 0x3e8]
movdqu xmmword [rax], xmm6
mov qword [rbp + 0x3e0], 8
jmp 0x1401441b9
mov esi, dword [rbp + 0x3dc]
push 8
pop rcx
mov r13, rcx
test rsi, rsi
je 0x1401440ec
imul rdi, rsi, 0x18
mov rdx, rdi
call fcn.14009161f
mov r13, rax
test rax, rax
je 0x14014461c
mov qword [rbp + 0x3e0], r13
mov qword [rbp + 0x3e8], rsi
and qword [rbp + 0x3f0], 0
mov r12, qword [rbp + 0x1c8]
test r12, r12
je 0x1401441b9
mov edi, dword [rbp + 0x3dc]
cmp esi, edi
jae 0x14014414c
lea rcx, [rbp + 0x3e0]
xor edx, edx
mov r8, rdi
call fcn.14013f41b
mov byte [rbp + 0x454], 1
mov rcx, rax
call fcn.140011e6c
mov r13, qword [rbp + 0x3e0]
mov rax, qword [rbp + 0x3f0]
jmp 0x14014414e
xor eax, eax
test edi, edi
lea rsi, [rbp + 0x2c0]
je 0x1401441b2
mov qword [rbp + 0x418], rax
imul rax, rax, 0x18
add r13, rax
xor ecx, ecx
mov qword [rbp + 0x448], rcx
mov rdx, qword [r12 + rcx*8]
mov rcx, rsi
call fcn.14013a16b
mov rax, qword [rbp + 0x2d0]
mov qword [r13 + 0x10], rax
movdqu xmm0, xmmword [rbp + 0x2c0]
movdqu xmmword [r13], xmm0
mov rcx, qword [rbp + 0x448]
inc rcx
add r13, 0x18
cmp rdi, rcx
jne 0x140144169
mov rax, qword [rbp + 0x418]
add rax, rcx
mov qword [rbp + 0x3f0], rax
mov rax, qword [rbp + 0x3f0]
mov qword [rbp + 0x2d0], rax
mov rax, qword [rbp + 0x3e0]
mov qword [rbp + 0x2c0], rax
mov rax, qword [rbp + 0x3e8]
mov qword [rbp + 0x2c8], rax
mov rcx, qword [rbp + 0x1c8]
call fcn.140146bd6
mov rax, qword [rbp + 0x438]
mov qword [rbp + 0x300], rax
mov rax, qword [rbp + 0x398]
mov qword [rbp + 0x308], rax
mov qword [rbp + 0x310], r15
and dword [rbp + 0x348], 0
mov rax, qword [rbp + 0x3b0]
lea rcx, [rbp + 0x318]
mov qword [rcx + 0x10], rax
movaps xmm0, xmmword [rbp + 0x3a0]
movups xmmword [rcx], xmm0
mov rax, qword [rbp + 0x2d0]
mov qword [rcx + 0x28], rax
movdqa xmm0, xmmword [rbp + 0x2c0]
movdqu xmmword [rcx + 0x18], xmm0
mov byte [rbp + 0x455], 0
lea rcx, [rbp + 0x168]
lea r12, [rbp + 0x300]
mov rdx, r12
call fcn.140146d05
push 0x17
pop rsi
lea r15, [rbp + 0x2a8]
mov rcx, qword [rbp + 0x2a8]
call fcn.140146bd6
jmp 0x140143f62
cmp dword [rbp + 0x428], 0xea
jne 0x1401442a9
mov rcx, qword [rbp + 0x2b0]
mov byte [rbp + 0x457], 1
call fcn.140146bd6
jmp 0x140143ee3
mov rcx, qword [rbp + 0x2b0]
mov byte [rbp + 0x457], 1
call fcn.140146bd6
lea rcx, [rbp + 0x200]
and dword [rcx], 0
lea rdx, [rbp + 0x260]
and qword [rdx], 0
call sub.secur32.dll_LsaEnumerateLogonSessions
test eax, eax
je 0x140144375
mov rax, qword [rbp + 0x178]
mov qword [rbp + 0x310], rax
movups xmm0, xmmword [rbp + 0x168]
movaps xmmword [rbp + 0x300], xmm0
mov rcx, qword [rbp + 0x260]
mov byte [rbp + 0x457], 0
call fcn.140146be0
lea rcx, [rbp + 0xb8]
call fcn.14014572c
mov rax, qword [rbp + 0x310]
lea rcx, [rbp + 0xb8]
mov qword [rcx + 0x10], rax
movaps xmm0, xmmword [rbp + 0x300]
movups xmmword [rcx], xmm0
lea rdx, [rbp - 0x40]
mov r8d, 0x1a0
mov rcx, qword [rbp + 0x1a0]
call sub.VCRUNTIME140.dll_memcpy
movaps xmm6, xmmword [rbp + 0x460]
movaps xmm7, xmmword [rbp + 0x470]
movaps xmm8, xmmword [rbp + 0x480]
add rsp, 0x518
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rsi, qword [rbp + 0x260]
mov eax, dword [rbp + 0x200]
lea r15, [rsi + rax*8]
lea rdi, [rbp + 0x3a0]
lea rbx, [rbp + 0x300]
pxor xmm6, xmm6
cmp rsi, r15
je 0x1401442de
and qword [rbp + 0x3a0], 0
mov rcx, rsi
mov rdx, rdi
call sub.secur32.dll_LsaGetLogonSessionData
add rsi, 8
test eax, eax
je 0x1401443ca
mov rcx, qword [rbp + 0x3a0]
call fcn.140146be0
jmp 0x140144398
mov rcx, qword [rbp + 0x3a0]
test rcx, rcx
je 0x1401443bc
cmp dword [rcx + 0x40], 3
je 0x14014447e
movzx r13d, word [rcx + 0x10]
mov r14, qword [rcx + 0x18]
mov rdx, qword [rcx + 0x48]
mov rcx, rbx
call fcn.14013ea5d
mov rax, qword [rbp + 0x300]
mov qword [rbp + 0x448], rax
test rax, rax
je 0x140144477
mov rax, qword [rbp + 0x308]
mov qword [rbp + 0x438], rax
mov r12, qword [rbp + 0x310]
mov rdx, qword [rbp + 0x168]
imul rbx, qword [rbp + 0x178], 0x50
test rbx, rbx
je 0x140144488
lea rdi, [rdx + 0x50]
mov rcx, qword [rdx]
mov rdx, qword [rdx + 0x10]
mov r8, qword [rbp + 0x448]
mov r9, r12
call fcn.140116d88
add rbx, 0xffffffffffffffb0
mov rdx, rdi
test al, al
je 0x14014442c
mov rcx, qword [rbp + 0x448]
mov rdx, qword [rbp + 0x438]
call fcn.14006b51b
lea rdi, [rbp + 0x3a0]
lea rbx, [rbp + 0x300]
mov rcx, qword [rbp + 0x3a0]
call fcn.140146be0
jmp 0x140144398
mov byte [rbp + 0x444], 1
lea rcx, [rbp + 0x2c0]
mov rdx, qword [rbp + 0x448]
call fcn.140146bef
lea rbx, [rbp + 0x300]
mov rax, qword [rbp + 0x2c0]
test rax, rax
je 0x1401444be
lea rcx, [rbp + 0x2c8]
jmp 0x1401444ed
shr r13, 1
mov byte [rbp + 0x444], 1
mov rcx, rbx
mov rdx, r14
mov r8, r13
call fcn.14005be50
mov rax, qword [rbp + 0x300]
test rax, rax
je 0x14014456d
lea rcx, [rbp + 0x308]
movdqu xmm0, xmmword [rcx]
movdqa xmmword [rbp + 0x3e0], xmm0
mov rcx, qword [rbp + 0x448]
mov qword [rbp + 0x300], rcx
mov rcx, qword [rbp + 0x438]
mov qword [rbp + 0x308], rcx
mov qword [rbp + 0x310], r12
movdqa xmm0, xmmword [rbp + 0x3e0]
lea rcx, [rbp + 0x308]
movdqu xmmword [rcx + 0x18], xmm0
and dword [rcx + 0x40], 0
movdqu xmmword [rcx + 0x30], xmm6
mov qword [rbp + 0x318], rax
mov qword [rbp + 0x330], 8
mov byte [rbp + 0x444], 0
lea rcx, [rbp + 0x168]
mov rdx, rbx
call fcn.140146d05
lea rdi, [rbp + 0x3a0]
jmp 0x1401443bc
movdqa xmmword [rbp + 0x3e0], xmm6
push 1
pop rax
jmp 0x1401444f9
mov qword [rbp + 0x300], rcx
movdqa xmm0, xmmword [rbp + 0x3e0]
movaps xmm1, xmmword [rbp + 0x3f0]
movaps xmm2, xmmword [rbp + 0x400]
movdqu xmmword [rbp + 0x308], xmm0
movups xmmword [rbp + 0x318], xmm1
movups xmmword [rbp + 0x328], xmm2
mov dword [rbp + 0x338], esi
movd dword [rbp + 0x33c], xmm7
mov qword [rbp + 0x340], rax
mov qword [rbp + 0x348], rdx
mov qword [rbp + 0x350], 8
movd dword [rbp + 0x358], xmm6
movd dword [rbp + 0x35c], xmm6
push 0x60
pop rcx
push 8
pop rdx
call fcn.1400916f6
mov qword [rbp + 0x438], r14
push 0xc
pop rcx
lea rsi, [rbp + 0x300]
mov qword [rbp + 0x448], rax
mov rdi, rax
rep movsq qword [rdi], qword [rsi]
mov rdi, qword [rbp + 0x2b8]
jmp 0x140142f50
mov byte [rbp + 0x454], 0
push 8
pop rcx
mov rdx, rdi
call fcn.140281350
jmp 0x14014463d
push 8
pop rcx
mov edx, 0x120
call fcn.140281350
ud2