Function at 0x1400010ab
Capabilities:
Enumerate processes via ntquerysysteminformation
Get disk information
Get local ipv4 addresses
Get logon sessions
Get memory capacity
Get system information on windows
List groups for user account
List user accounts
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x7c8
movaps xmmword [rsp + 0x7b0], xmm15
movaps xmmword [rsp + 0x7a0], xmm14
movaps xmmword [rsp + 0x790], xmm13
movaps xmmword [rsp + 0x780], xmm12
movaps xmmword [rsp + 0x770], xmm11
movaps xmmword [rsp + 0x760], xmm10
movaps xmmword [rsp + 0x750], xmm9
movdqa xmmword [rsp + 0x740], xmm8
movdqa xmmword [rsp + 0x730], xmm7
movdqa xmmword [rsp + 0x720], xmm6
lea rsi, [rsp + 0x100]
mov qword [rsi], 1
pxor xmm0, xmm0
movdqu xmmword [rsi + 8], xmm0
mov eax, 1
xor edi, edi
lea rbx, [0x14002470f]
xor edx, edx
cmp rdi, 0x114
je 0x14000118c
mov bpl, byte [rdi + rbx]
cmp rdx, qword [rsp + 0x108]
jne 0x140001170
mov rcx, rsi
call fcn.140004cdd
mov rax, qword [rsp + 0x100]
mov rdx, qword [rsp + 0x110]
mov byte [rax + rdx], bpl
mov rdx, qword [rsp + 0x110]
inc rdx
mov qword [rsp + 0x110], rdx
inc rdi
jmp 0x140001141
mov qword [rsp + 0x118], 8
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x120], xmm0
call fcn.140011da7
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x80], rdx
lea rsi, [rsp + 0x1e0]
mov edx, 0x158
mov r8d, 0x1f4
mov rcx, rsi
call fcn.1400118a9
mov rsi, qword [rsi]
test rsi, rsi
je 0x140001201
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x78], rax
mov rdi, qword [rsp + 0x1f0]
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x98], rax
jmp 0x140001216
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x78], rax
mov rdi, qword [rsp + 0x1f0]
mov ecx, 9
call fcn.140004e11
mov r14, rax
mov r15, rdx
movabs rax, 0x5043206c61746f54
mov qword [r14], rax
mov byte [r14 + 8], 0x55
mov ecx, 8
mov edx, 0x120
call fcn.140004cd5
test rax, rax
je 0x140004432
mov rbx, rax
movabs rbp, 0x19db1ded53e8000
call fcn.140011da7
mov r12, rax
mov r13, rdx
call fcn.14000c3b5
shl rdx, 0x20
mov eax, eax
or rax, rdx
movabs rcx, 0xfe624e212ac18000
cmp rax, rbp
jge 0x140001289
xor ebp, ebp
jmp 0x1400012b4
add rax, rcx
mov ecx, 0x989680
xor edx, edx
div rcx
mov rbp, rax
call sub.KERNEL32.dll_GetTickCount64
mov ecx, 0x3e8
xor edx, edx
div rcx
sub rbp, rax
mov eax, 0
cmovb rbp, rax
mov rcx, qword [rsp + 0x98]
pxor xmm6, xmm6
movdqu xmmword [rsp + 0x2e0], xmm6
mov qword [rsp + 0x220], rsi
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x228], rax
mov qword [rsp + 0x230], rdi
mov qword [rsp + 0x238], rcx
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x240], rax
mov rax, qword [rsp + 0x80]
mov qword [rsp + 0x248], rax
movdqu xmmword [rsp + 0x280], xmm6
movdqu xmmword [rsp + 0x290], xmm6
mov qword [rsp + 0x2f0], r14
mov qword [rsp + 0x2f8], r15
mov qword [rsp + 0x300], 9
mov eax, 1
mov qword [rsp + 0x308], rax
movdqu xmmword [rsp + 0x310], xmm6
mov qword [rsp + 0x320], rax
and qword [rsp + 0x338], 0
movdqu xmmword [rsp + 0x328], xmm6
and qword [rsp + 0x350], 0
and dword [rsp + 0x358], 0
mov eax, 8
mov qword [rsp + 0x360], rax
movdqu xmmword [rsp + 0x368], xmm6
mov byte [rsp + 0x378], 0
mov qword [rsp + 0x2a8], rax
movdqu xmmword [rsp + 0x2b0], xmm6
mov qword [rsp + 0x2c0], rbx
mov qword [rsp + 0x2c8], 2
and qword [rsp + 0x2d0], 0
and qword [rsp + 0x1e0], 0
lea r14, [0x1400250c0]
mov qword [rsp + 0x250], r14
and qword [rsp + 0x268], 0
movdqu xmmword [rsp + 0x258], xmm6
mov qword [rsp + 0x270], r12
mov qword [rsp + 0x278], r13
mov qword [rsp + 0x2a0], rbp
mov qword [rsp + 0x2d8], rax
lea rsi, [rsp + 0x5a0]
movdqa xmmword [rsi], xmm6
movdqa xmmword [rsi + 0x30], xmm6
movdqa xmmword [rsi + 0x20], xmm6
movdqa xmmword [rsi + 0x10], xmm6
mov dword [rsi], 0x40
mov rcx, rsi
call sub.KERNEL32.dll_GlobalMemoryStatusEx
movdqu xmm0, xmmword [rsi + 8]
movdqu xmmword [rsp + 0x280], xmm0
lea rcx, [rsp + 0x410]
movdqa xmmword [rcx + 0x50], xmm6
movdqa xmmword [rcx + 0x40], xmm6
movdqa xmmword [rcx + 0x30], xmm6
movdqa xmmword [rcx + 0x20], xmm6
movdqa xmmword [rcx + 0x10], xmm6
movdqa xmmword [rcx], xmm6
and qword [rcx + 0x60], 0
mov edx, 0x68
call sub.PSAPI.DLL_GetPerformanceInfo
cmp eax, 1
jne 0x1400014df
mov rdx, qword [rsp + 0x420]
mov r9, qword [rsp + 0x430]
xor r10d, r10d
sub rdx, r9
cmovb rdx, r10
mov rcx, qword [rsp + 0x460]
mov rax, rcx
mul rdx
mov r8, rax
mov r11, 0xffffffffffffffff
cmovo r8, r11
mov rdx, qword [rsp + 0x418]
sub rdx, r9
cmovb rdx, r10
mov rax, rcx
mul rdx
cmovo rax, r11
mov qword [rsp + 0x290], r8
mov qword [rsp + 0x298], rax
lea rax, [rsp + 0x2f0]
cmp qword [rax - 0x110], 0
jne 0x140001758
lea r8, [rsp + 0x5a0]
and qword [r8], 0
xor esi, esi
xor ecx, ecx
xor edx, edx
call sub.pdh.dll_PdhOpenQueryA
mov edi, eax
test eax, eax
je 0x140001514
jmp 0x140001531
mov rbx, qword [rsp + 0x5a0]
call fcn.140011da7
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x410], xmm0
mov rsi, r14
and qword [rsp + 0x1e8], 0
and qword [rsp + 0x218], 0
mov qword [rsp + 0x1e0], rsi
movdqa xmm0, xmmword [rsp + 0x410]
movdqu xmmword [rsp + 0x1f0], xmm0
mov qword [rsp + 0x200], rax
mov qword [rsp + 0x208], rdx
mov qword [rsp + 0x210], rbx
test edi, edi
jne 0x14000174f
mov ecx, 0x23
call fcn.140004e11
movups xmm0, xmmword [0x1400252af]
movups xmmword [rax], xmm0
movdqu xmm0, xmmword [0x1400252bf]
movdqu xmmword [rax + 0x10], xmm0
mov dword [rax + 0x1f], 0x656d6954
mov qword [rsp + 0x5a0], rax
mov qword [rsp + 0x5a8], rdx
mov qword [rsp + 0x5b0], 0x23
lea r14, [rsp + 0x338]
mov ecx, 5
call fcn.140004e11
mov dword [rax], 0x5f746f74
mov byte [rax + 4], 0x30
lea r9, [rsp + 0x410]
mov qword [r9], rax
mov qword [r9 + 8], rdx
mov qword [r9 + 0x10], 5
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x5a0]
mov r8, r14
call fcn.140012d9b
lea rcx, [rsp + 0x2f0]
mov dl, 1
call fcn.1400130d0
mov r14, rax
mov qword [rsp + 0x80], rdx
xor eax, eax
mov qword [rsp + 0x70], rax
mov edi, 2
mov r12d, 1
cmp r14, qword [rsp + 0x80]
je 0x140001740
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x130], rax
inc rax
mov qword [rsp + 0x70], rax
lea rax, [0x1400252f0]
mov qword [rsp + 0x410], rax
mov qword [rsp + 0x418], rdi
and qword [rsp + 0x430], 0
lea rbx, [rsp + 0x130]
mov qword [rsp + 0x5a0], rbx
lea rsi, [0x140005afb]
mov qword [rsp + 0x5a8], rsi
lea rbp, [rsp + 0x5a0]
mov qword [rsp + 0x420], rbp
mov qword [rsp + 0x428], r12
lea r13, [rsp + 0x380]
mov rcx, r13
lea r15, [rsp + 0x410]
mov rdx, r15
call fcn.14000f272
lea rax, [0x140025318]
mov qword [rsp + 0x410], rax
mov qword [rsp + 0x418], rdi
and qword [rsp + 0x430], 0
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0xc8], rsi
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x420], rax
mov qword [rsp + 0x428], r12
mov rcx, rbp
mov rdx, r15
call fcn.14000f272
lea r8, [r14 + 0x48]
mov rcx, r13
lea rdx, [rsp + 0x1e0]
mov r9, rbp
call fcn.140012d9b
add r14, 0x70
jmp 0x140001638
mov rsi, qword [rsp + 0x1e0]
lea r14, [0x1400250c0]
test rsi, rsi
je 0x14000186c
mov rcx, qword [rsp + 0x210]
call sub.pdh.dll_PdhCollectQueryData
cmp qword [rsp + 0x338], 0
je 0x140001796
lea rdx, [rsp + 0x338]
lea rcx, [rsp + 0x1e0]
call fcn.1400130f2
test eax, eax
je 0x14000442e
movd dword [rsp + 0x358], xmm0
lea rcx, [rsp + 0x2f0]
mov dl, 1
call fcn.1400130d0
mov rsi, rax
mov rdi, rdx
add rsi, 0x48
lea rbx, [rsp + 0x1e0]
lea rax, [rsi - 0x48]
cmp rax, rdi
je 0x1400017e4
cmp qword [rsi], 0
je 0x1400017de
mov rcx, rbx
mov rdx, rsi
call fcn.1400130f2
test eax, eax
je 0x14000442e
movd dword [rsi + 0x20], xmm0
add rsi, 0x70
jmp 0x1400017b7
cmp byte [rsp + 0x378], 0
jne 0x14000186c
mov rsi, qword [rsp + 0x370]
lea rdi, [rsp + 0x410]
mov rcx, rdi
mov rdx, rsi
call fcn.140012605
mov rbx, qword [rsp + 0x360]
mov rcx, qword [rdi]
mov rdx, qword [rdi + 8]
mov rax, qword [rdi + 0x10]
shl rax, 3
imul r8, rsi, 0x70
xor r9d, r9d
mov r10, rbx
test r8, r8
je 0x14000184a
cmp rax, r9
je 0x14000184a
mov r11, qword [rcx + r9]
mov qword [r10 + 0x60], r11
add r10, 0x70
add r9, 8
add r8, 0xffffffffffffff90
jmp 0x14000182a
call fcn.140010fe7
test rsi, rsi
je 0x14000185a
mov rax, qword [rbx + 0x60]
jmp 0x14000185c
xor eax, eax
mov qword [rsp + 0x350], rax
mov byte [rsp + 0x378], 1
lea rsi, [rsp + 0x5a0]
mov rcx, rsi
call fcn.140012864
cmp dword [rsi], 2
je 0x140001ab6
mov rax, qword [rsp + 0x5d0]
lea rdx, [rsp + 0x410]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x5a0]
movups xmm1, xmmword [rsp + 0x5b0]
movups xmm2, xmmword [rsp + 0x5c0]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0x380]
mov rcx, rsi
call fcn.140012890
cmp qword [rsi], 2
je 0x140001ab6
mov rax, qword [rsp + 0x3b0]
lea rdx, [rsp + 0x410]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x380]
movups xmm1, xmmword [rsp + 0x390]
movups xmm2, xmmword [rsp + 0x3a0]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0xc0]
mov rcx, rsi
call fcn.14001290a
cmp qword [rsi], 2
je 0x140001ab6
mov rax, qword [rsp + 0xf0]
lea rdx, [rsp + 0x410]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0xc0]
movups xmm1, xmmword [rsp + 0xd0]
movups xmm2, xmmword [rsp + 0xe0]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0x130]
mov rcx, rsi
call fcn.1400129a0
cmp qword [rsi], 2
je 0x140001ab6
mov rax, qword [rsp + 0x160]
lea rdx, [rsp + 0x410]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x130]
movups xmm1, xmmword [rsp + 0x140]
movups xmm2, xmmword [rsp + 0x150]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0x1a0]
mov rcx, rsi
call fcn.140012a6a
cmp qword [rsi], 2
je 0x140001ab6
mov rax, qword [rsp + 0x1d0]
lea rdx, [rsp + 0x410]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x1a0]
movups xmm1, xmmword [rsp + 0x1b0]
movups xmm2, xmmword [rsp + 0x1c0]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0x568]
mov rcx, rsi
call fcn.140012ae7
mov rax, qword [rsi]
cmp rax, 2
je 0x140001ab6
movups xmm0, xmmword [rsp + 0x570]
movups xmm1, xmmword [rsp + 0x580]
movups xmm2, xmmword [rsp + 0x590]
lea rsi, [rsp + 0x6e8]
movups xmmword [rsi + 0x28], xmm2
movups xmmword [rsi + 0x18], xmm1
movups xmmword [rsi + 8], xmm0
mov qword [rsi], rax
lea rdi, [rsp + 0x380]
mov rcx, rdi
mov rdx, rsi
mov r8b, 1
call fcn.140012bc6
mov rax, qword [rsi + 0x30]
mov qword [rsp + 0x440], rax
movdqu xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmm2, xmmword [rsi + 0x20]
movaps xmmword [rsp + 0x430], xmm2
movaps xmmword [rsp + 0x420], xmm1
movdqa xmmword [rsp + 0x410], xmm0
mov ebp, dword [rdi + 4]
cmp ebp, 2
jne 0x140004339
lea rcx, [rsp + 0x410]
call fcn.1400115d7
mov esi, 8
xor edi, edi
mov rcx, qword [rsp + 0x2a8]
mov rdx, qword [rsp + 0x2b8]
call fcn.140011599
mov rcx, qword [rsp + 0x2a8]
mov rdx, qword [rsp + 0x2b0]
call fcn.1400116d5
mov qword [rsp + 0x2a8], rsi
mov qword [rsp + 0x2b0], rdi
mov qword [rsp + 0x2b8], rdi
lea rcx, [rsp + 0xc0]
and qword [rcx], 0
call sub.IPHLPAPI.DLL_GetIfTable2
test eax, eax
jne 0x140002910
lea r8, [rsp + 0x270]
mov rax, qword [r8 - 0x20]
mov rcx, qword [r8 - 0x18]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [r8 - 8]
lea rsi, [rsp + 0x410]
mov qword [rsi], rax
add rax, 0x10
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov word [rsi + 0x18], dx
mov qword [rsi + 0x20], r8
mov rcx, rsi
call fcn.1400117d0
test rax, rax
je 0x140001b6e
mov byte [rdx + 0x6e], 0
jmp 0x140001b5b
call fcn.140011da7
pxor xmm0, xmm0
lea rcx, [rsp + 0x430]
movdqu xmmword [rcx - 0x10], xmm0
mov qword [rcx - 0x20], r14
and qword [rcx - 0x18], 0
mov qword [rcx], rax
mov qword [rcx + 8], rdx
lea rax, [rsp + 0x380]
mov qword [rax], 8
movdqu xmmword [rax + 8], xmm0
mov r14, qword [rsp + 0xc0]
mov eax, dword [r14]
add r14, 8
lea rdi, [rsp + 0x5a0]
pcmpeqd xmm6, xmm6
xor ecx, ecx
mov qword [rsp + 0x98], r14
mov qword [rsp + 0x88], rax
cmp rcx, rax
je 0x140001ed8
mov rbx, rcx
inc rcx
imul rsi, rbx, 0x548
cmp qword [r14 + rsi + 0x4a8], 0
jne 0x140001c01
cmp qword [r14 + rsi + 0x4b0], 0
je 0x140001bd5
cmp dword [r14 + rsi + 0x48c], 2
je 0x140001bd5
cmp dword [r14 + rsi + 0x420], 0
je 0x140001bd5
mov qword [rsp + 0x80], rcx
mov ecx, 0x14
mov edx, 2
call fcn.14000bc7c
mov r12, rax
mov eax, dword [r14 + rsi + 0x10]
movzx ecx, byte [r14 + rsi + 0x14]
movzx edx, byte [r14 + rsi + 0x15]
movzx r8d, byte [r14 + rsi + 0x16]
movzx r9d, byte [r14 + rsi + 0x17]
movzx r10d, byte [r14 + rsi + 0x18]
movzx r11d, byte [r14 + rsi + 0x19]
movzx ebp, byte [r14 + rsi + 0x1a]
movzx esi, byte [r14 + rsi + 0x1b]
mov dword [r12], eax
mov word [r12 + 4], cx
mov word [r12 + 6], dx
mov word [r12 + 8], r8w
mov word [r12 + 0xa], r9w
mov word [r12 + 0xc], r10w
mov word [r12 + 0xe], r11w
mov word [r12 + 0x10], bp
mov word [r12 + 0x12], si
mov ecx, 0xa
xor edx, edx
call fcn.140009e6c
mov r14, rax
mov qword [rsp + 0x78], rdx
movups xmm0, xmmword [r12]
movups xmmword [rax], xmm0
mov eax, dword [r12 + 0x10]
mov dword [r14 + 0x10], eax
mov rcx, qword [rsp + 0x430]
mov rdx, qword [rsp + 0x438]
mov r9d, 0xa
mov r8, r14
call fcn.140010ffe
mov r13, qword [rsp + 0x410]
mov rsi, qword [rsp + 0x418]
mov r15, rsi
and r15, rax
mov qword [rsp + 0xa0], rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor eax, eax
mov qword [rsp + 0x70], rax
movdqu xmm8, xmmword [r13 + r15]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0x5a0], ax
mov rcx, rdi
call fcn.14000fd09
test rax, rax
je 0x140001d6d
add rdx, r15
and rdx, rsi
shl rdx, 5
mov rbp, r13
sub rbp, rdx
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x10]
mov r9d, 0xa
mov r8, r14
call fcn.14001112a
test al, al
je 0x140001d34
jmp 0x140001d9c
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x140001e43
mov rax, qword [rsp + 0x70]
add r15, rax
add r15, 0x10
add rax, 0x10
mov qword [rsp + 0x70], rax
and r15, rsi
jmp 0x140001d18
mov rcx, r14
mov rdx, qword [rsp + 0x78]
call fcn.14000a336
mov eax, dword [rbp - 8]
inc eax
mov dword [rbp - 8], eax
cmp eax, 1
jle 0x140001dcd
mov edx, 0xa
mov rcx, r12
call fcn.14000a336
mov r14, qword [rsp + 0x98]
jmp 0x140001e2e
mov rdx, qword [rsp + 0x390]
cmp rdx, qword [rsp + 0x388]
mov r14, qword [rsp + 0x98]
jne 0x140001dfc
lea rcx, [rsp + 0x380]
call fcn.14001131e
mov rdx, qword [rsp + 0x390]
mov rax, qword [rsp + 0x380]
mov rcx, rdx
shl rcx, 5
mov dword [rax + rcx], ebx
mov qword [rax + rcx + 8], r12
mov r8d, 0xa
mov qword [rax + rcx + 0x10], r8
mov qword [rax + rcx + 0x18], r8
inc rdx
mov qword [rsp + 0x390], rdx
mov rax, qword [rsp + 0x88]
mov rcx, qword [rsp + 0x80]
jmp 0x140001bd5
cmp qword [rsp + 0x420], 0
je 0x140001eae
mov rcx, r13
mov rdx, rsi
mov r8, qword [rsp + 0xa0]
call fcn.1400117f0
mov rcx, qword [rsp + 0x410]
shl rax, 5
mov rbp, rcx
and dl, 1
neg dl
movsx rdx, dl
add qword [rsp + 0x420], rdx
sub rbp, rax
neg rax
mov qword [rcx + rax - 0x20], r14
mov rax, qword [rsp + 0x78]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], 0xa
and dword [rbp - 8], 0
inc qword [rsp + 0x428]
jmp 0x140001da9
lea rcx, [rsp + 0x410]
lea rdx, [rsp + 0x430]
call fcn.1400227a5
mov r13, qword [rsp + 0x410]
mov rsi, qword [rsp + 0x418]
jmp 0x140001e4e
mov rax, qword [rsp + 0x380]
mov rcx, qword [rsp + 0x388]
mov qword [rsp + 0x188], rcx
mov rdi, qword [rsp + 0x390]
shl rdi, 5
add rdi, rax
lea rbp, [rsp + 0x5a0]
pcmpeqd xmm6, xmm6
mov qword [rsp + 0x180], rax
mov rbx, rax
mov qword [rsp + 0xf8], rdi
mov rsi, rbx
cmp rbx, rdi
je 0x140002470
lea rbx, [rsi + 0x20]
mov r15, qword [rsi + 8]
test r15, r15
je 0x14000246d
mov r12, qword [rsi + 0x10]
mov edx, dword [rsi]
cmp qword [rsp + 0x428], 0
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x80], r12
je 0x140002050
mov qword [rsp + 0x88], rdx
mov rsi, qword [rsi + 0x18]
mov rcx, qword [rsp + 0x430]
mov rdx, qword [rsp + 0x438]
mov r8, r15
mov r9, rsi
call fcn.140010ffe
mov r13, qword [rsp + 0x410]
mov rbx, qword [rsp + 0x418]
mov r12, rbx
and r12, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor eax, eax
mov qword [rsp + 0x78], rax
movdqu xmm8, xmmword [r13 + r12]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0x5a0], ax
mov rcx, rbp
call fcn.14000fd09
test rax, rax
je 0x140002009
add rdx, r12
and rdx, rbx
shl rdx, 5
mov r14, r13
sub r14, rdx
mov r8, qword [r14 - 0x20]
mov r9, qword [r14 - 0x10]
mov rcx, r15
mov rdx, rsi
call fcn.14001112a
test al, al
je 0x140001fd3
jmp 0x140002035
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x1400022ca
mov rax, qword [rsp + 0x78]
add r12, rax
add r12, 0x10
add rax, 0x10
mov qword [rsp + 0x78], rax
and r12, rbx
jmp 0x140001fb7
add r14, 0xffffffffffffffe0
mov rbx, qword [rsp + 0x70]
mov r12, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x88]
jmp 0x140002053
xor r14d, r14d
lea rax, [r14 + 0x18]
test r14, r14
lea rcx, [0x14002522c]
cmove rax, rcx
cmp dword [rax], 1
jg 0x1400022ba
imul r14, rdx, 0x548
mov rax, qword [rsp + 0x98]
lea r13, [rax + r14]
lea rdx, [rax + r14]
add rdx, 0x1c
xor r8d, r8d
cmp r8, 0x101
je 0x1400020a2
cmp word [rdx + r8*2], 0
je 0x1400020aa
inc r8
jmp 0x14000208c
mov r8d, 0x101
jmp 0x1400020b7
cmp r8, 0x102
jae 0x14000442e
mov rcx, rbp
call fcn.140004fc2
mov rsi, qword [rsp + 0x5a0]
test rsi, rsi
je 0x1400022ba
mov qword [rsp + 0xb0], r13
mov qword [rsp + 0x88], r14
mov rax, qword [rsp + 0x5a8]
mov qword [rsp + 0xa0], rax
mov r14, qword [rsp + 0x5b0]
mov rcx, qword [rsp + 0x270]
mov rdx, qword [rsp + 0x278]
mov r8, rsi
mov r9, r14
call fcn.140011094
mov r12, qword [rsp + 0x250]
mov r13, qword [rsp + 0x258]
mov rbx, r13
and rbx, rax
mov qword [rsp + 0x190], rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor eax, eax
mov qword [rsp + 0x78], rax
movdqu xmm8, xmmword [r12 + rbx]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0x5a0], ax
mov rcx, rbp
call fcn.14000fd09
test rax, rax
je 0x1400021a4
add rdx, rbx
and rdx, r13
neg rdx
imul rdi, rdx, 0x88
mov rcx, qword [r12 + rdi - 0x88]
mov rdx, qword [r12 + rdi - 0x78]
mov r8, rsi
mov r9, r14
call fcn.140005ca0
test al, al
je 0x140002169
jmp 0x1400021d3
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x1400022d2
mov rax, qword [rsp + 0x78]
add rbx, rax
add rbx, 0x10
add rax, 0x10
mov qword [rsp + 0x78], rax
and rbx, r13
jmp 0x14000214e
add r12, rdi
mov rax, qword [r12 - 0x68]
mov rcx, qword [r12 - 0x58]
mov qword [r12 - 0x60], rax
mov rdx, qword [rsp + 0x98]
mov r8, qword [rsp + 0x88]
mov rax, qword [rdx + r8 + 0x500]
mov qword [r12 - 0x68], rax
mov qword [r12 - 0x50], rcx
mov rax, qword [rdx + r8 + 0x4b8]
mov qword [r12 - 0x58], rax
mov rax, qword [r12 - 0x48]
mov qword [r12 - 0x40], rax
mov rax, qword [rdx + r8 + 0x4c0]
add rax, qword [rdx + r8 + 0x4c8]
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov qword [r12 - 0x48], rax
mov rax, qword [r12 - 0x38]
mov qword [r12 - 0x30], rax
mov rax, qword [rdx + r8 + 0x508]
add rax, qword [rdx + r8 + 0x510]
cmovb rax, rcx
mov qword [r12 - 0x38], rax
mov rax, qword [r12 - 0x28]
mov qword [r12 - 0x20], rax
mov rax, qword [rdx + r8 + 0x4d8]
mov qword [r12 - 0x28], rax
mov rax, qword [r12 - 0x18]
mov qword [r12 - 0x10], rax
mov rax, qword [rdx + r8 + 0x520]
mov qword [r12 - 0x18], rax
mov byte [r12 - 2], 1
mov rcx, rsi
mov rdx, qword [rsp + 0xa0]
call fcn.140004cf8
mov rdi, qword [rsp + 0xf8]
mov rbx, qword [rsp + 0x70]
mov r12, qword [rsp + 0x80]
mov rcx, r15
mov rdx, r12
call fcn.14000a336
jmp 0x140001f1e
xor r14d, r14d
jmp 0x140002039
cmp qword [rsp + 0x260], 0
je 0x140002443
mov rax, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x88]
mov r8, qword [rax + rdx + 0x4c0]
add r8, qword [rax + rdx + 0x4c8]
mov rcx, qword [rax + rdx + 0x4b8]
mov qword [rsp + 0x78], rcx
mov rcx, 0xffffffffffffffff
cmovb r8, rcx
mov qword [rsp + 0x178], r8
mov rbx, qword [rax + rdx + 0x508]
add rbx, qword [rax + rdx + 0x510]
cmovb rbx, rcx
mov rcx, qword [rsp + 0xb0]
mov rcx, qword [rcx]
mov qword [rsp + 0x170], rcx
mov rdi, qword [rax + rdx + 0x500]
mov rcx, qword [rax + rdx + 0x4d8]
mov qword [rsp + 0xb0], rcx
mov rax, qword [rax + rdx + 0x520]
mov qword [rsp + 0x88], rax
mov rcx, r12
mov rdx, r13
mov r8, qword [rsp + 0x190]
call fcn.1400117f0
mov rcx, qword [rsp + 0x250]
neg rax
and dl, 1
neg dl
movsx rdx, dl
add qword [rsp + 0x260], rdx
imul rax, rax, 0x88
mov qword [rcx + rax - 0x88], rsi
mov rdx, qword [rsp + 0xa0]
mov qword [rcx + rax - 0x80], rdx
mov qword [rcx + rax - 0x78], r14
mov rdx, qword [rsp + 0x170]
mov qword [rcx + rax - 0x70], rdx
mov qword [rcx + rax - 0x68], rdi
mov qword [rcx + rax - 0x60], rdi
mov rdx, qword [rsp + 0x78]
mov qword [rcx + rax - 0x58], rdx
mov qword [rcx + rax - 0x50], rdx
mov rdx, qword [rsp + 0x178]
mov qword [rcx + rax - 0x48], rdx
mov qword [rcx + rax - 0x40], rdx
mov qword [rcx + rax - 0x38], rbx
mov qword [rcx + rax - 0x30], rbx
mov rdx, qword [rsp + 0xb0]
mov qword [rcx + rax - 0x28], rdx
mov qword [rcx + rax - 0x20], rdx
mov rdx, qword [rsp + 0x88]
mov qword [rcx + rax - 0x18], rdx
mov qword [rcx + rax - 0x10], rdx
and dword [rcx + rax - 8], 0
and word [rcx + rax - 4], 0
mov byte [rcx + rax - 2], 1
inc qword [rsp + 0x268]
jmp 0x1400022a5
lea rcx, [rsp + 0x250]
lea rdx, [rsp + 0x270]
call fcn.1400224ae
mov r12, qword [rsp + 0x250]
mov r13, qword [rsp + 0x258]
jmp 0x1400022e1
mov rsi, rbx
sub rdi, rsi
shr rdi, 5
add rsi, 0x10
sub rdi, 1
jb 0x140002493
mov rcx, qword [rsi - 8]
mov rdx, qword [rsi]
call fcn.14000a336
add rsi, 0x20
jmp 0x14000247b
mov r8, qword [rsp + 0x188]
test r8, r8
je 0x1400024b6
shl r8, 5
mov edx, 8
mov rcx, qword [rsp + 0x180]
call fcn.140006e7b
mov rcx, qword [rsp + 0xc0]
call sub.IPHLPAPI.DLL_FreeMibTable
mov rdx, qword [rsp + 0x418]
test rdx, rdx
je 0x1400025be
mov rcx, qword [rsp + 0x410]
mov rax, qword [rsp + 0x428]
test rax, rax
je 0x1400025b3
add rdx, rcx
inc rdx
movdqa xmm0, xmmword [rcx]
pmovmskb r8d, xmm0
not r8d
lea rsi, [rsp + 0x5b8]
mov qword [rsi - 0x18], rcx
add rcx, 0x10
mov qword [rsi - 0x10], rcx
mov qword [rsi - 8], rdx
mov word [rsi], r8w
mov qword [rsi + 8], rax
mov edi, 1
test rdi, rdi
je 0x1400025a3
mov rcx, rsi
call fcn.14000fd09
cmp rax, 1
je 0x14000256b
mov rax, qword [rsp + 0x5a8]
movdqa xmm0, xmmword [rax]
pmovmskb ecx, xmm0
not ecx
mov word [rsp + 0x5b8], cx
add qword [rsp + 0x5a0], 0xfffffffffffffe00
add rax, 0x10
mov qword [rsp + 0x5a8], rax
jmp 0x140002529
shl rdx, 5
mov rax, qword [rsp + 0x5a0]
mov rdi, qword [rsp + 0x5c0]
mov rcx, rax
sub rcx, rdx
dec rdi
mov qword [rsp + 0x5c0], rdi
mov rcx, qword [rcx - 0x20]
neg rdx
mov rdx, qword [rax + rdx - 0x18]
call fcn.14000a336
jmp 0x140002524
mov rcx, qword [rsp + 0x410]
mov rdx, qword [rsp + 0x418]
mov r8d, 0x20
call fcn.1400116e9
mov rax, qword [rsp + 0x250]
mov rcx, qword [rsp + 0x258]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [rsp + 0x268]
lea rsi, [rsp + 0x410]
mov qword [rsi], rax
add rax, 0x10
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov word [rsi + 0x18], dx
mov qword [rsi + 0x20], r8
mov ebx, 0x88
mov rcx, rsi
call fcn.140010f63
test rax, rax
je 0x140002652
mov rdi, rax
cmp byte [rax - 2], 0
jne 0x14000260a
mov rax, qword [rsp + 0x250]
sub rax, rdi
cqo
idiv rbx
lea rcx, [rsp + 0x250]
mov rdx, rax
call fcn.140011d33
mov rcx, qword [rdi - 0x88]
mov rdx, qword [rdi - 0x80]
call fcn.140004cf8
jmp 0x14000260a
lea rdi, [rsp + 0x1a0]
mov dword [rdi], 0x3c00
and dword [rsp + 0x130], 0
mov ebx, 3
sub ebx, 1
jb 0x140002736
mov ecx, dword [rsp + 0x1a0]
call fcn.140016fe8
test rax, rax
je 0x1400026db
mov rsi, rax
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0xe
xor r8d, r8d
mov r9, rax
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
mov dword [rsp + 0x130], eax
cmp eax, 0x6f
jne 0x1400026b7
mov rcx, rsi
call fcn.140016ff0
jmp 0x14000266d
test eax, eax
jne 0x14000272e
mov qword [rsp + 0x5a8], rsi
mov qword [rsp + 0x5b0], rsi
and qword [rsp + 0x5a0], 0
xor ecx, ecx
jmp 0x140002798
mov ecx, 0x32
call fcn.140004e11
mov rcx, rax
movups xmm0, xmmword [str.failed_to_allocate_memory_for_IP_ADAPTER_ADDRESSES]
movups xmmword [rax], xmm0
movups xmm0, xmmword [0x1400253c8]
movups xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [0x1400253d8]
movdqu xmmword [rax + 0x20], xmm0
mov word [rax + 0x30], 0x5345
mov qword [rsp + 0x5a0], rax
mov qword [rsp + 0x5a8], rdx
mov qword [rsp + 0x5b0], 0x32
jmp 0x140002798
mov rcx, rsi
call fcn.140016ff0
lea rax, [rsp + 0x130]
mov qword [rsp + 0x380], rax
lea rax, str.GetAdaptersAddresses___failed_with_code
lea rdx, [rsp + 0x410]
mov qword [rdx], rax
mov eax, 1
mov qword [rdx + 8], rax
and qword [rdx + 0x20], 0
lea rcx, [0x1400057cd]
mov qword [rsp + 0x388], rcx
lea rcx, [rsp + 0x380]
mov qword [rdx + 0x10], rcx
mov qword [rdx + 0x18], rax
lea rsi, [rsp + 0x5a0]
mov rcx, rsi
call fcn.14000f272
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400027af
mov rdx, qword [rsp + 0x5a8]
call fcn.140004cf8
jmp 0x140002910
movdqu xmm0, xmmword [rsp + 0x5a8]
lea rax, [rsp + 0x380]
movdqu xmmword [rax], xmm0
lea rbx, [rsp + 0x130]
pcmpeqd xmm6, xmm6
lea rcx, [rsp + 0x410]
lea rdx, [rsp + 0x380]
call fcn.1400127a2
mov r14, qword [rsp + 0x410]
test r14, r14
je 0x140002903
mov rax, qword [rsp + 0x418]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x268], 0
je 0x1400028f1
mov r12, qword [rsp + 0x420]
mov rcx, qword [rsp + 0x270]
mov rdx, qword [rsp + 0x278]
mov r8, r14
mov r9, r12
call fcn.140011094
mov rbp, qword [rsp + 0x250]
mov rsi, qword [rsp + 0x258]
mov rdi, rsi
and rdi, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor r13d, r13d
movdqu xmm8, xmmword [rbp + rdi]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0x130], ax
mov rcx, rbx
call fcn.14000fd09
test rax, rax
je 0x1400028bb
add rdx, rdi
and rdx, rsi
neg rdx
imul r15, rdx, 0x88
mov r8, qword [rbp + r15 - 0x88]
mov r9, qword [rbp + r15 - 0x78]
mov rcx, r14
mov rdx, r12
call fcn.140005ca0
test al, al
je 0x140002880
jmp 0x1400028d9
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x1400028f1
add rdi, r13
add rdi, 0x10
add r13, 0x10
and rdi, rsi
jmp 0x140002864
add rbp, r15
lea rcx, [rsp + 0x428]
movzx eax, word [rcx + 4]
mov word [rbp - 4], ax
mov eax, dword [rcx]
mov dword [rbp - 8], eax
mov rcx, r14
mov rdx, qword [rsp + 0x70]
call fcn.140004cf8
jmp 0x1400027d0
mov rcx, qword [rsp + 0x380]
call fcn.140016ff0
mov byte [rsp + 0x92], 1
mov word [rsp + 0x90], 0x101
call fcn.14000c3b5
shl rdx, 0x20
mov eax, eax
or rax, rdx
movabs rcx, 0x19db1ded53e8000
cmp rax, rcx
jge 0x140002943
xor eax, eax
jmp 0x14000295a
movabs rcx, 0xfe624e212ac18000
add rax, rcx
mov ecx, 0x989680
xor edx, edx
div rcx
mov qword [rsp + 0xa8], rax
mov esi, 0x80000
lea rbx, [rsp + 0x94]
mov rdi, qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov rcx, rsi
xor edx, edx
call fcn.140004db4
mov r14, rax
mov rbp, rdx
and dword [rsp + 0x94], 0
mov ecx, 5
mov rdx, rax
mov r8d, esi
mov r9, rbx
call rdi
cmp eax, 0xc0000004
jne 0x1400029ca
mov eax, dword [rsp + 0x94]
test eax, eax
je 0x1400029ba
add eax, 0x2800
mov rsi, rax
jmp 0x1400029bd
add rsi, rsi
mov rcx, r14
mov rdx, rbp
call fcn.140004cf8
jmp 0x140002976
mov ecx, 8
mov edx, 0xfa0
call fcn.140004cd5
test rax, rax
je 0x14000443e
lea rsi, [rsp + 0x130]
mov qword [rsi], rax
mov qword [rsi + 8], 0x1f4
and qword [rsi + 0x10], 0
xor edx, edx
xor edi, edi
cmp rdx, qword [rsp + 0x138]
jne 0x140002a20
mov rcx, rsi
call fcn.1400111ae
mov rax, qword [rsp + 0x130]
mov rdx, qword [rsp + 0x140]
lea rcx, [r14 + rdi]
mov qword [rax + rdx*8], rcx
mov rdx, qword [rsp + 0x140]
inc rdx
mov qword [rsp + 0x140], rdx
mov ecx, dword [rcx]
add rdi, rcx
test rcx, rcx
jne 0x1400029fe
mov qword [rsp + 0x80], r14
lea rsi, [rsp + 0x6e8]
lea rax, [rsp + 0x220]
mov qword [rsi], rax
lea rcx, [rsp + 0x2f0]
xor edx, edx
call fcn.140011eeb
mov rax, qword [rsp + 0x370]
lea rcx, [rsp + 0x568]
mov qword [rcx], rax
mov rbx, qword [rsp + 0x140]
mov qword [rsp + 0x420], rbx
movdqu xmm0, xmmword [rsp + 0x130]
movdqa xmmword [rsp + 0x410], xmm0
mov qword [rsp + 0xc0], 8
pxor xmm0, xmm0
movdqu xmmword [rsp + 0xc8], xmm0
mov qword [rsp + 0x428], rsi
lea rax, [rsp + 0x90]
mov qword [rsp + 0x430], rax
mov qword [rsp + 0x438], rcx
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x440], rax
mov rdi, qword [rsp + 0x418]
cmp rdi, rbx
jb 0x14000442e
lea rsi, [rsp + 0x428]
mov r14, qword [rsi - 0x18]
mov rcx, rbx
call fcn.140010fc4
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 1
lea rsi, [rsp + 0x380]
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
mov r9, rax
call fcn.14000cd55
test rdi, rdi
je 0x140002b5c
shl rdi, 3
mov edx, 8
mov rcx, r14
mov r8, rdi
call fcn.140006e7b
mov rax, qword [rsp + 0x390]
xor edx, edx
sub rax, 1
jb 0x140002b7e
mov rsi, qword [rsi]
test rsi, rsi
je 0x140002b7e
add rdx, qword [rsi + 0x10]
add rsi, 0x18
jmp 0x140002b66
lea rcx, [rsp + 0xc0]
call fcn.140011180
mov rax, qword [rsp + 0x390]
lea rsi, [rsp + 0x5a0]
mov qword [rsi + 0x10], rax
movdqu xmm0, xmmword [rsp + 0x380]
movdqa xmmword [rsi], xmm0
lea r15, [rsp + 0x418]
lea rdi, [rsp + 0x410]
mov rcx, rsi
call fcn.14000ed24
test rax, rax
je 0x140002c60
mov rbx, qword [rax]
movdqu xmm0, xmmword [rax + 8]
movdqa xmmword [rsp + 0x1a0], xmm0
mov rcx, rax
call fcn.1400075df
test rbx, rbx
je 0x140002c60
mov qword [rsp + 0x410], rbx
movdqa xmm0, xmmword [rsp + 0x1a0]
movdqu xmmword [r15], xmm0
mov r14, qword [rsp + 0x420]
lea rcx, [rsp + 0xc0]
mov rdx, r14
call fcn.140011180
mov r12, qword [rsp + 0xd0]
imul rcx, r12, 0x150
add rcx, qword [rsp + 0xc0]
imul r8, r14, 0x150
mov rdx, rbx
call fcn.140013d60
add r12, r14
mov qword [rsp + 0xd0], r12
and qword [rsp + 0x420], 0
mov rcx, rdi
call fcn.14000c751
jmp 0x140002bbc
mov qword [rsp + 0x78], rbp
lea rcx, [rsp + 0x5a0]
call fcn.14000ecf2
mov rbp, qword [rsp + 0xc0]
imul rcx, qword [rsp + 0xd0], 0x150
mov rax, qword [rsp + 0xc8]
mov qword [rsp + 0x88], rax
lea rax, [rcx + rbp]
mov qword [rsp + 0xa0], rax
lea rdi, [rsp + 0x380]
lea r13, [rsp + 0x410]
mov qword [rsp + 0x98], rbp
test rcx, rcx
je 0x140002f03
mov rbx, qword [rbp]
cmp rbx, 2
je 0x140002efc
mov qword [rsp + 0x70], rcx
lea r12, [rbp + 0xc8]
mov rsi, qword [rbp + 0xc0]
lea rdx, [rbp + 8]
mov r8d, 0xb8
lea rcx, [rsp + 0x5a0]
call fcn.140013d60
mov r8d, 0x88
mov rcx, rdi
mov rdx, r12
call fcn.140013d60
mov qword [rsp + 0x1a0], rsi
mov rcx, qword [rsp + 0x240]
mov rdx, qword [rsp + 0x248]
mov r8, rsi
call fcn.14000fc8e
mov r12, rax
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0xc0], rax
cmp qword [rsp + 0x230], 0
je 0x140002ee2
lea rax, [rsp + 0xc0]
mov qword [rsp + 0x410], rax
lea rax, [rsp + 0x220]
mov qword [rsp + 0x418], rax
mov rcx, qword [rsp + 0x220]
mov rdx, qword [rsp + 0x228]
lea rax, [0x140011ce9]
mov qword [rsp + 0x20], rax
mov r8, r12
mov r9, r13
call fcn.140011b39
test rax, rax
je 0x140002e43
mov rax, qword [rsp + 0x1a0]
mov rcx, qword [rsp + 0x220]
movzx r8d, byte [rcx + rdx]
and r8d, 1
sub qword [rsp + 0x230], r8
shr r12, 0x39
lea r8, [rdx - 0x10]
and r8, qword [rsp + 0x228]
mov byte [rcx + rdx], r12b
mov byte [r8 + rcx + 0x10], r12b
inc qword [rsp + 0x238]
mov r15, qword [rsp + 0x220]
neg rdx
imul r14, rdx, 0x158
lea r12, [r15 + r14]
add r12, 0xfffffffffffffeb8
mov qword [r12 - 0x10], rax
mov qword [r12 - 8], rbx
mov r8d, 0xb8
mov rcx, r12
lea rdx, [rsp + 0x5a0]
call fcn.140013d60
mov qword [r12 + 0xb8], rsi
lea rcx, [r15 + r14]
add rcx, 0xffffffffffffff78
mov r8d, 0x88
mov rdx, rdi
call fcn.140013d60
jmp 0x140002eca
mov r14, qword [rsp + 0x220]
neg rdx
imul r15, rdx, 0x158
lea r12, [r14 + r15]
add r12, 0xfffffffffffffeb0
mov r8d, 0x150
mov rcx, r13
mov rdx, r12
call fcn.140013d60
mov qword [r12], rbx
lea r12, [r14 + r15]
add r12, 0xfffffffffffffeb8
mov r8d, 0xb8
mov rcx, r12
lea rdx, [rsp + 0x5a0]
call fcn.140013d60
mov qword [r12 + 0xb8], rsi
lea rcx, [r14 + r15]
add rcx, 0xffffffffffffff78
mov r8d, 0x88
mov rdx, rdi
call fcn.140013d60
cmp qword [rsp + 0x410], 2
je 0x140002eca
mov rcx, r13
call fcn.14000c7bc
add rbp, 0x150
mov rcx, qword [rsp + 0x70]
add rcx, 0xfffffffffffffeb0
jmp 0x140002cba
lea rcx, [rsp + 0x220]
lea rdx, [rsp + 0x240]
call fcn.140022d85
jmp 0x140002d4e
add rbp, 0x150
mov rax, qword [rsp + 0xa0]
sub rax, rbp
mov ecx, 0x150
xor edx, edx
div rcx
mov rcx, rbp
mov rdx, rax
call fcn.14000c792
mov rcx, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x88]
call fcn.14000c77b
mov rax, qword [rsp + 0x220]
mov rcx, qword [rsp + 0x228]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [rsp + 0x238]
lea rsi, [rsp + 0x410]
mov qword [rsi], rax
add rax, 0x10
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov word [rsi + 0x18], dx
mov qword [rsi + 0x20], r8
mov r14d, 0x158
lea rbp, [rsp + 0x94]
mov rcx, rsi
call fcn.14001176f
test rax, rax
je 0x140002fd8
mov rbx, rax
cmp byte [rax - 4], 0
mov byte [rax - 4], 0
jne 0x140002f8d
mov rax, qword [rsp + 0x220]
sub rax, rbx
cqo
idiv r14
lea rcx, [rsp + 0x220]
mov rdx, rax
call fcn.140011d33
add rbx, 0xfffffffffffffeb0
mov rcx, rbx
call fcn.14000c7bc
jmp 0x140002f8d
mov rcx, qword [rsp + 0x80]
mov rdx, qword [rsp + 0x78]
call fcn.140004cf8
call sub.KERNEL32.dll_GetLogicalDrives
mov dword [rsp + 0x1a0], eax
test eax, eax
je 0x1400031a9
lea r12, [rsp + 0xc8]
mov qword [r12 - 8], 8
pxor xmm0, xmm0
movdqu xmmword [r12], xmm0
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x410], rax
movabs rax, 0x2000000000
mov qword [rsp + 0x418], rax
mov ecx, 0x20
call fcn.140010fc4
and dword [rsp + 0x28], 0
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], 0x20
mov qword [rsp + 0x20], 1
xor ebx, ebx
mov edx, 0x20
mov rcx, rdi
xor r8d, r8d
mov r9, rax
call fcn.14000ff90
mov rax, qword [rsp + 0x390]
lea r13, [rsp + 0x568]
sub rax, 1
jb 0x14000309d
mov rdi, qword [rdi]
test rdi, rdi
je 0x14000309d
add rbx, qword [rdi + 0x10]
add rdi, 0x18
jmp 0x140003085
lea rsi, [rsp + 0xc0]
mov rcx, rsi
mov rdx, rbx
call fcn.140011152
mov rax, qword [rsp + 0x390]
lea rdi, [rsp + 0x5a0]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0x380]
movaps xmmword [rdi], xmm0
lea rbx, [rsp + 0x410]
mov rcx, rdi
call fcn.14000ed24
test rax, rax
je 0x140003183
mov r14, qword [rax]
movups xmm0, xmmword [rax + 8]
movaps xmmword [rsp + 0x130], xmm0
mov rcx, rax
call fcn.1400075df
test r14, r14
je 0x140003183
mov qword [rsp + 0x410], r14
movdqa xmm0, xmmword [rsp + 0x130]
lea rax, [rsp + 0x418]
movdqu xmmword [rax], xmm0
mov r15, qword [rsp + 0x420]
mov rcx, rsi
mov rdx, r15
call fcn.140011152
mov r13, qword [rsp + 0xd0]
imul rcx, r13, 0x90
add rcx, qword [rsp + 0xc0]
imul r8, r15, 0x90
mov rdx, r14
call fcn.140013d60
add r13, r15
mov qword [rsp + 0xd0], r13
lea r13, [rsp + 0x568]
and qword [rsp + 0x420], 0
mov rcx, rbx
call fcn.14000c8ed
jmp 0x1400030d7
lea rcx, [rsp + 0x5a0]
call fcn.1400109f8
mov rsi, qword [rsp + 0xc0]
movdqu xmm0, xmmword [r12]
movdqa xmmword [rsp + 0x410], xmm0
jmp 0x1400031c3
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x410], xmm0
mov esi, 8
lea r13, [rsp + 0x568]
lea rcx, [rsp + 0x2c0]
call fcn.14000c8ed
mov qword [rsp + 0x2c0], rsi
lea rax, [rsp + 0x440]
movdqa xmm0, xmmword [rax - 0x30]
movdqu xmmword [rsp + 0x2c8], xmm0
lea r15, [rsp + 0x1a0]
mov qword [r15], 8
pxor xmm6, xmm6
lea rax, [rsp + 0x198]
and dword [rax], 0
movdqu xmmword [r15 + 8], xmm6
lea rsi, [rsp + 0x6e8]
lea rdi, [rsp + 0x5a0]
and qword [rsp + 0xa8], 0
and dword [rsp + 0xbc], 0
and dword [rsp + 0x19c], 0
lea rax, [rsp + 0x198]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x19c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xbc]
mov qword [rsp + 0x28], rax
or dword [rsp + 0x20], 0xffffffff
xor ecx, ecx
xor edx, edx
mov r8d, 2
lea r9, [rsp + 0xa8]
call sub.NETAPI32.dll_NetUserEnum
test eax, eax
je 0x14000328d
cmp eax, 0xea
jne 0x1400035da
mov dword [rsp + 0x70], eax
mov rbx, qword [rsp + 0xa8]
mov eax, dword [rsp + 0xbc]
lea r14, [rbx + rax*8]
cmp rbx, r14
je 0x1400035be
mov r12, rbx
add rbx, 8
cmp qword [r12], 0
je 0x1400032a4
and qword [rsp + 0x6e8], 0
mov rdx, qword [r12]
xor ecx, ecx
mov r8d, 0x17
mov r9, rsi
call sub.NETAPI32.dll_NetUserGetInfo
test eax, eax
jne 0x1400035a3
mov rax, qword [rsp + 0x6e8]
mov rdx, qword [rax + 0x20]
lea rcx, [rsp + 0x130]
call fcn.14000f57c
mov rdx, qword [rsp + 0x130]
test rdx, rdx
je 0x1400035a3
lea rcx, [rsp + 0x410]
call fcn.140011ddc
cmp qword [rsp + 0x410], 0
je 0x140003346
mov rax, qword [rsp + 0x420]
mov qword [rsp + 0xd0], rax
movdqu xmm0, xmmword [rsp + 0x410]
movdqa xmmword [rsp + 0xc0], xmm0
jmp 0x140003357
mov rdx, qword [r12]
lea rcx, [rsp + 0xc0]
call fcn.14000c539
mov rdx, qword [r12]
and qword [rsp + 0x568], 0
and dword [rsp + 0x90], 0
and dword [rsp + 0x94], 0
mov qword [rsp + 0x38], rbp
lea rax, [rsp + 0x90]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x20], r13
or dword [rsp + 0x28], 0xffffffff
lea rcx, [0x140025378]
xor r8d, r8d
mov r9d, 1
call sub.NETAPI32.dll_NetUserGetLocalGroups
test eax, eax
je 0x1400033c6
lea rax, [rsp + 0x388]
movdqu xmmword [rax], xmm6
mov qword [rsp + 0x380], 8
jmp 0x14000350d
mov r15d, dword [rsp + 0x90]
test r15, r15
je 0x1400033ee
imul r12, r15, 0x18
mov ecx, 8
mov rdx, r12
call fcn.140004cd5
test rax, rax
jne 0x1400033f3
jmp 0x14000441f
mov eax, 8
mov qword [rsp + 0x380], rax
mov qword [rsp + 0x388], r15
and qword [rsp + 0x390], 0
mov rbp, qword [rsp + 0x568]
test rbp, rbp
je 0x140003452
mov r12d, dword [rsp + 0x90]
cmp r15d, r12d
jae 0x140003492
lea rcx, [rsp + 0x380]
xor edx, edx
mov r8, r12
call fcn.14000fb50
mov rcx, rax
call fcn.140004bda
mov rax, qword [rsp + 0x380]
mov r15, qword [rsp + 0x390]
jmp 0x1400034a2
mov rax, qword [rsp + 0x390]
lea rcx, [rsp + 0x440]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x380]
mov qword [rcx], rax
mov rax, qword [rsp + 0x388]
mov qword [rcx + 8], rax
lea r15, [rsp + 0x1a0]
lea rbp, [rsp + 0x94]
jmp 0x14000354a
mov r15d, 0
mov ecx, 0
test r12, r12
je 0x1400034ed
imul r13, r15, 0x18
add r13, rax
xor esi, esi
mov rdx, qword [rbp + rsi*8]
mov rcx, rdi
call fcn.14000c539
mov rax, qword [rsp + 0x5b0]
mov qword [r13 + 0x10], rax
movdqu xmm0, xmmword [rsp + 0x5a0]
movdqu xmmword [r13], xmm0
inc rsi
add r13, 0x18
cmp r12, rsi
jne 0x1400034ab
add r15, rsi
mov rcx, r15
lea rsi, [rsp + 0x6e8]
mov qword [rsp + 0x390], rcx
lea r15, [rsp + 0x1a0]
lea rbp, [rsp + 0x94]
lea r13, [rsp + 0x568]
mov rcx, qword [rsp + 0x568]
mov rax, qword [rsp + 0x390]
lea rdx, [rsp + 0x440]
mov qword [rdx + 0x10], rax
mov rax, qword [rsp + 0x380]
mov qword [rdx], rax
mov rax, qword [rsp + 0x388]
mov qword [rdx + 8], rax
test rcx, rcx
je 0x14000354a
call sub.NETAPI32.dll_NetApiBufferFree
movups xmm0, xmmword [rsp + 0x130]
movaps xmmword [rsp + 0x410], xmm0
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x420], rax
and dword [rsp + 0x458], 0
mov rax, qword [rsp + 0xd0]
lea rcx, [rsp + 0x428]
mov qword [rcx + 0x10], rax
movdqa xmm0, xmmword [rsp + 0xc0]
movdqu xmmword [rcx], xmm0
mov rcx, r15
lea rdx, [rsp + 0x410]
call fcn.140011eaa
mov rcx, qword [rsp + 0x6e8]
test rcx, rcx
je 0x1400032a4
call sub.NETAPI32.dll_NetApiBufferFree
jmp 0x1400032a4
mov rcx, qword [rsp + 0xa8]
cmp dword [rsp + 0x70], 0xea
jne 0x1400035e2
call fcn.140011dc8
jmp 0x140003222
mov rcx, qword [rsp + 0xa8]
call fcn.140011dc8
lea rcx, [rsp + 0x568]
and dword [rcx], 0
lea rsi, [rsp + 0x130]
and qword [rsi], 0
mov rdx, rsi
call sub.Secur32.dll_LsaEnumerateLogonSessions
mov rcx, qword [rsi]
test eax, eax
jne 0x14000381e
mov eax, dword [rsp + 0x568]
lea rdi, [rcx + rax*8]
lea rsi, [rsp + 0xc0]
lea r14, [rsp + 0x410]
pxor xmm6, xmm6
cmp rcx, rdi
je 0x140003816
lea rbx, [rcx + 8]
and qword [rsp + 0xc0], 0
mov rdx, rsi
call sub.Secur32.dll_LsaGetLogonSessionData
mov rcx, qword [rsp + 0xc0]
test eax, eax
je 0x140003664
call fcn.140011dd2
mov rcx, rbx
jmp 0x140003630
test rcx, rcx
je 0x140003712
cmp dword [rcx + 0x40], 3
je 0x14000365a
movzx r12d, word [rcx + 0x10]
mov r13, qword [rcx + 0x18]
mov rdx, qword [rcx + 0x48]
mov rcx, r14
call fcn.14000f57c
mov rbp, qword [rsp + 0x410]
test rbp, rbp
je 0x140003809
mov qword [rsp + 0x78], r13
mov qword [rsp + 0x80], r12
mov r14, r15
mov rax, qword [rsp + 0x418]
mov qword [rsp + 0x70], rax
mov r13, qword [rsp + 0x420]
mov rdx, qword [rsp + 0x1a0]
imul r15, qword [rsp + 0x1b0], 0x50
test r15, r15
je 0x140003719
lea r12, [rdx + 0x50]
mov rcx, qword [rdx]
mov rdx, qword [rdx + 0x10]
mov r8, rbp
mov r9, r13
call fcn.140005ca0
add r15, 0xffffffffffffffb0
mov rdx, r12
test al, al
je 0x1400036cf
mov rcx, rbp
mov rdx, qword [rsp + 0x70]
call fcn.140004cf8
mov r15, r14
lea r14, [rsp + 0x410]
jmp 0x140003809
xor ecx, ecx
jmp 0x14000365a
lea rcx, [rsp + 0x5a0]
mov rdx, rbp
call fcn.140011ddc
mov rax, qword [rsp + 0x5a0]
test rax, rax
mov r15, r14
je 0x140003758
lea rcx, [rsp + 0x5a8]
movdqu xmm0, xmmword [rcx]
movdqa xmmword [rsp + 0x380], xmm0
lea r14, [rsp + 0x410]
jmp 0x1400037aa
mov r8, qword [rsp + 0x80]
shr r8d, 1
lea r14, [rsp + 0x410]
mov rcx, r14
mov rdx, qword [rsp + 0x78]
call fcn.140004fc2
mov rax, qword [rsp + 0x410]
test rax, rax
je 0x14000379c
lea rcx, [rsp + 0x418]
movdqu xmm0, xmmword [rcx]
movdqa xmmword [rsp + 0x380], xmm0
jmp 0x1400037aa
movdqa xmmword [rsp + 0x380], xmm6
mov eax, 1
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x410], rbp
mov qword [rsp + 0x418], rcx
mov qword [rsp + 0x420], r13
movdqa xmm0, xmmword [rsp + 0x380]
lea rcx, [rsp + 0x430]
movdqu xmmword [rcx], xmm0
and dword [rcx + 0x28], 0
movdqu xmmword [rcx + 0x18], xmm6
mov qword [rsp + 0x428], rax
mov qword [rsp + 0x440], 8
lea rcx, [rsp + 0x1a0]
mov rdx, r14
call fcn.140011eaa
mov rcx, qword [rsp + 0xc0]
jmp 0x14000365a
mov rcx, qword [rsp + 0x130]
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x420], rax
movups xmm0, xmmword [rsp + 0x1a0]
movaps xmmword [rsp + 0x410], xmm0
test rcx, rcx
je 0x140003848
call fcn.140013288
mov rcx, qword [rsp + 0x2d8]
mov rdx, qword [rsp + 0x2e8]
call fcn.140011668
mov rcx, qword [rsp + 0x2d8]
mov rdx, qword [rsp + 0x2e0]
call fcn.1400116c1
mov rax, qword [rsp + 0x420]
lea rcx, [rsp + 0x2d8]
mov qword [rcx + 0x10], rax
movaps xmm0, xmmword [rsp + 0x410]
movups xmmword [rcx], xmm0
mov rax, qword [rsp + 0x1e0]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x210]
mov qword [rsp + 0x670], rax
mov rax, qword [rsp + 0x218]
mov qword [rsp + 0x668], rax
mov rsi, qword [rsp + 0x220]
mov rcx, qword [rsp + 0x228]
mov r14, qword [rsp + 0x238]
mov rax, qword [rsp + 0x250]
mov qword [rsp + 0x680], rax
mov rax, qword [rsp + 0x258]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x268]
mov qword [rsp + 0x678], rax
mov rax, qword [rsp + 0x2a8]
mov qword [rsp + 0x190], rax
mov rax, qword [rsp + 0x2b0]
mov qword [rsp + 0x188], rax
mov rax, qword [rsp + 0x2b8]
mov qword [rsp + 0x180], rax
movdqa xmm0, xmmword [rsi]
pmovmskb ebp, xmm0
not ebp
mov rax, qword [rsp + 0x2c0]
mov qword [rsp + 0x170], rax
mov rax, qword [rsp + 0x2c8]
mov qword [rsp + 0x178], rax
mov rax, qword [rsp + 0x2d0]
mov qword [rsp + 0x6e0], rax
mov rax, qword [rsp + 0x2d8]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x2e0]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x2e8]
mov qword [rsp + 0xf8], rax
mov rax, qword [rsp + 0x2f0]
mov qword [rsp + 0x690], rax
mov rax, qword [rsp + 0x2f8]
mov qword [rsp + 0x698], rax
mov rax, qword [rsp + 0x308]
mov qword [rsp + 0x6a8], rax
mov rax, qword [rsp + 0x310]
mov qword [rsp + 0x6b0], rax
mov rax, qword [rsp + 0x320]
mov qword [rsp + 0x6b8], rax
mov rax, qword [rsp + 0x328]
mov qword [rsp + 0x6c0], rax
mov rax, qword [rsp + 0x338]
mov qword [rsp + 0x6a0], rax
mov rax, qword [rsp + 0x340]
mov qword [rsp + 0x660], rax
mov rax, qword [rsp + 0x360]
mov qword [rsp + 0x6d0], rax
mov rax, qword [rsp + 0x368]
mov qword [rsp + 0x6d8], rax
mov rax, qword [rsp + 0x370]
mov qword [rsp + 0x6c8], rax
mov qword [rsp + 0x80], rcx
lea rdi, [rcx + rsi + 1]
lea rbx, [rsi + 0x10]
mov ecx, 0x38
mov edx, 8
call fcn.140001050
mov r13, rax
mov qword [rax], rsi
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rdi
mov word [rax + 0x18], bp
mov qword [rsp + 0x658], r14
mov qword [rax + 0x20], r14
lea rbp, str.dllhost.exe
mov qword [rax + 0x28], rbp
mov qword [rax + 0x30], 0xb
mov r14d, 0xb
mov rcx, r13
call fcn.14001176f
test rax, rax
je 0x140003b4e
mov r12, rax
add rax, 0xfffffffffffffeb0
je 0x140003b4e
mov rcx, qword [r12 - 0xd8]
mov rdx, qword [r12 - 0xc8]
mov r8, rbp
mov r9, r14
call fcn.140005ca5
test al, al
je 0x140003ac4
mov r14d, dword [r12 - 0x90]
mov rdx, qword [rsp + 0x128]
cmp rdx, qword [rsp + 0x120]
jne 0x140003b2a
lea rcx, [rsp + 0x118]
call fcn.140006bc7
mov rdx, qword [rsp + 0x128]
mov rax, qword [rsp + 0x118]
mov qword [rax + rdx*8], r14
inc rdx
mov qword [rsp + 0x128], rdx
mov rbp, qword [r13 + 0x28]
mov r14, qword [r13 + 0x30]
jmp 0x140003ac4
mov edx, 8
mov rcx, r13
call fcn.140004670
mov rbp, qword [rsp + 0x118]
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x688], rax
mov r12, qword [rsp + 0x128]
cmp qword [rsp + 0x80], 0
mov r13, qword [rsp + 0xb0]
je 0x140003bf4
mov rcx, qword [rsp + 0x658]
test rcx, rcx
je 0x140003bde
movdqa xmm0, xmmword [rsi]
pmovmskb eax, xmm0
not eax
lea r14, [rsp + 0x1e0]
mov word [r14 + 0x18], ax
mov qword [r14], rsi
mov qword [r14 + 8], rbx
mov qword [r14 + 0x10], rdi
mov qword [r14 + 0x20], rcx
mov rcx, r14
call fcn.14001176f
test rax, rax
je 0x140003bde
add rax, 0xfffffffffffffeb0
mov rcx, rax
call fcn.14000c7bc
jmp 0x140003bc1
mov r8d, 0x158
mov rcx, rsi
mov rdx, qword [rsp + 0x80]
call fcn.140001080
mov rcx, qword [rsp + 0x690]
mov rdx, qword [rsp + 0x698]
call fcn.140004cf8
mov rcx, qword [rsp + 0x6a0]
test rcx, rcx
je 0x140003c23
mov rdx, qword [rsp + 0x660]
call fcn.140004cf8
mov rcx, qword [rsp + 0x6a8]
mov rdx, qword [rsp + 0x6b0]
call fcn.140004cf8
mov rcx, qword [rsp + 0x6b8]
mov rdx, qword [rsp + 0x6c0]
call fcn.140004cf8
mov rsi, qword [rsp + 0x6d0]
mov rcx, rsi
mov rdx, qword [rsp + 0x6c8]
call fcn.140011543
mov rcx, rsi
mov rdx, qword [rsp + 0x6d8]
call fcn.1400116ad
mov rsi, qword [rsp + 0x190]
mov rcx, rsi
mov rdx, qword [rsp + 0x180]
call fcn.140011599
mov rcx, rsi
mov rdx, qword [rsp + 0x188]
call fcn.1400116d5
mov rsi, qword [rsp + 0x170]
mov rcx, rsi
mov rdx, qword [rsp + 0x6e0]
call fcn.14000c917
mov rcx, rsi
mov rdx, qword [rsp + 0x178]
call fcn.14000c970
test r13, r13
je 0x140003daf
mov rax, qword [rsp + 0x70]
lea rdi, [rax + r13]
inc rdi
movdqa xmm0, xmmword [r13]
pmovmskb eax, xmm0
not eax
lea rbx, [r13 + 0x10]
lea rsi, [rsp + 0x1e0]
mov qword [rsi], r13
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rdi
mov word [rsi + 0x18], ax
mov rax, qword [rsp + 0x78]
mov qword [rsi + 0x20], rax
mov rcx, rsi
call fcn.140011711
test rax, rax
je 0x140003d22
mov rcx, qword [rax - 8]
call sub.pdh.dll_PdhRemoveCounter
jmp 0x140003d0a
mov rcx, qword [rsp + 0x668]
test rcx, rcx
je 0x140003d35
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x670]
test rcx, rcx
je 0x140003d47
call sub.pdh.dll_PdhCloseQuery
cmp qword [rsp + 0x70], 0
je 0x140003daf
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x140003d9c
movdqa xmm0, xmmword [r13]
pmovmskb eax, xmm0
not eax
lea rsi, [rsp + 0x1e0]
mov qword [rsi], r13
mov qword [rsi + 8], rbx
mov qword [rsi + 0x10], rdi
mov word [rsi + 0x18], ax
mov qword [rsi + 0x20], rcx
mov rcx, rsi
call fcn.140011711
test rax, rax
je 0x140003d9c
mov rcx, qword [rax - 0x20]
mov rdx, qword [rax - 0x18]
call fcn.140004cf8
jmp 0x140003d80
mov r8d, 0x20
mov rcx, r13
mov rdx, qword [rsp + 0x70]
call fcn.1400116e9
mov rbx, qword [rsp + 0x98]
test rbx, rbx
je 0x140003e31
mov r8, qword [rsp + 0x678]
test r8, r8
mov rdi, qword [rsp + 0x680]
je 0x140003e20
lea rax, [rbx + rdi]
inc rax
movdqa xmm0, xmmword [rdi]
pmovmskb ecx, xmm0
not ecx
lea rdx, [rdi + 0x10]
lea rsi, [rsp + 0x1e0]
mov qword [rsi], rdi
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
mov qword [rsi + 0x20], r8
mov rcx, rsi
call fcn.140010f63
test rax, rax
je 0x140003e20
mov rcx, qword [rax - 0x88]
mov rdx, qword [rax - 0x80]
call fcn.140004cf8
jmp 0x140003e01
mov r8d, 0x88
mov rcx, rdi
mov rdx, rbx
call fcn.140001080
mov rsi, qword [rsp + 0xa0]
mov rcx, rsi
mov rdx, qword [rsp + 0xf8]
call fcn.140011668
mov rcx, rsi
mov rdx, qword [rsp + 0x88]
call fcn.1400116c1
test r12, r12
je 0x140004418
lea rdi, [r12*8]
add rdi, rbp
mov r14d, 0x114
movaps xmm14, xmmword [0x140024650]
movaps xmm15, xmmword [0x140024660]
movdqa xmm6, xmmword [0x140024670]
movdqa xmm7, xmmword [0x140024680]
movdqa xmm8, xmmword [0x140024690]
movaps xmm9, xmmword [0x1400246a0]
movaps xmm10, xmmword [0x1400246b0]
movaps xmm11, xmmword [0x1400246c0]
mov qword [rsp + 0x70], rbp
movaps xmm12, xmmword [0x1400246d0]
xorps xmm13, xmm13
cmp rbp, rdi
je 0x14000429e
mov ecx, 0x114
mov edx, 1
call fcn.140001050
mov r12, rax
movaps xmm0, xmmword [0x1400245d0]
movups xmmword [rax], xmm0
movaps xmm0, xmmword [0x1400245e0]
movups xmmword [rax + 0x10], xmm0
movaps xmm0, xmmword [0x1400245f0]
movups xmmword [rax + 0x20], xmm0
movaps xmm0, xmmword [0x140024600]
movups xmmword [rax + 0x30], xmm0
movaps xmm0, xmmword [0x140024610]
movups xmmword [rax + 0x40], xmm0
movaps xmm0, xmmword [0x140024620]
movups xmmword [rax + 0x50], xmm0
movaps xmm0, xmmword [0x140024630]
movups xmmword [rax + 0x60], xmm0
movdqa xmm0, xmmword [0x140024640]
movdqu xmmword [rax + 0x70], xmm0
movups xmmword [rax + 0x80], xmm14
movups xmmword [rax + 0x90], xmm15
movdqu xmmword [rax + 0xa0], xmm6
movdqu xmmword [rax + 0xb0], xmm7
movdqu xmmword [rax + 0xc0], xmm8
movups xmmword [rax + 0xd0], xmm9
movups xmmword [rax + 0xe0], xmm10
movups xmmword [rax + 0xf0], xmm11
movups xmmword [rax + 0x100], xmm12
mov dword [rax + 0x110], 0x9e5cbd2e
mov rsi, qword [rsp + 0x100]
mov r13, qword [rsp + 0x110]
cmp r13, r14
cmovae r13, r14
mov rcx, r13
xor edx, edx
call fcn.140004db4
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x1e8], rdx
and qword [rsp + 0x1f0], 0
lea rcx, [rsp + 0x1e0]
mov rdx, r13
call fcn.140004b08
mov rcx, qword [rsp + 0x1e0]
mov rax, qword [rsp + 0x1f0]
xor edx, edx
cmp r13, rdx
je 0x140004001
mov r8b, byte [r12 + rdx]
xor r8b, byte [rsi + rdx]
inc rdx
mov byte [rcx + rax], r8b
inc rax
jmp 0x140003fe8
movups xmm0, xmmword [rsp + 0x1e0]
movaps xmmword [rsp + 0x410], xmm0
mov qword [rsp + 0x420], rax
mov rdx, qword [rsp + 0x108]
mov rcx, rsi
call fcn.140004cf8
mov r8, qword [rsp + 0x420]
mov qword [rsp + 0x110], r8
movdqa xmm0, xmmword [rsp + 0x410]
movdqa xmmword [rsp + 0x100], xmm0
mov rdx, qword [rsp + 0x100]
lea rcx, [rsp + 0x410]
call fcn.140005058
mov rax, qword [rbp]
mov qword [rsp + 0x568], rax
movaps xmmword [rsp + 0x200], xmm13
movaps xmmword [rsp + 0x1f0], xmm13
movaps xmmword [rsp + 0x1e0], xmm13
mov qword [rsp + 0x5a0], rax
and qword [rsp + 0x5a8], 0
mov ecx, 0x4b82f718
call fcn.140009b6b
lea rcx, [rsp + 0x5a0]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x1e0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x7f
mov ecx, eax
mov r8d, 4
lea r9, [rsp + 0x568]
call section..text
test eax, eax
js 0x140004418
and qword [rsp + 0x1a0], 0
mov rsi, qword [rsp + 0x420]
mov qword [rsp + 0x130], rsi
mov ecx, 0xf783b8ec
call fcn.140009b6b
mov r9, qword [rsp + 0x568]
lea rcx, [rsp + 0x130]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x20], r15
mov dword [rsp + 0x40], 4
mov dword [rsp + 0x38], 0x3000
and dword [rsp + 0x28], 0
mov ecx, eax
mov r8d, 6
call section..text
test eax, eax
js 0x140004418
and dword [rsp + 0x118], 0
mov r13, qword [rsp + 0x410]
mov qword [rsp + 0xc0], rsi
mov ecx, 0xc3170192
call fcn.140009b6b
mov r9, qword [rsp + 0x568]
mov rcx, qword [rsp + 0x1a0]
lea r8, [rsp + 0x118]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], rcx
mov ecx, eax
mov r8d, 5
call section..text
test eax, eax
js 0x140004418
mov esi, eax
mov dword [rsp + 0x6e8], 4
mov ecx, 0x50e92888
call fcn.140009b6b
mov r9, qword [rsp + 0x568]
lea rcx, [rsp + 0x6e8]
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0xc0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r15
mov dword [rsp + 0x30], 0x40
mov ecx, eax
mov r8d, 5
call section..text
test eax, eax
js 0x140004418
and qword [rsp + 0x380], 0
mov rbx, qword [rsp + 0x568]
mov ecx, 0xaf18cfb0
call fcn.140009b6b
mov rcx, qword [rsp + 0x1a0]
movups xmmword [rsp + 0x60], xmm13
movups xmmword [rsp + 0x50], xmm13
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x48], 4
and qword [rsp + 0x40], 0
and qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1fffff
mov ecx, eax
mov r8d, 0xb
lea r9, [rsp + 0x380]
call section..text
test esi, esi
jne 0x140004418
add rbp, 8
mov rdx, qword [rsp + 0x418]
mov rcx, r13
call fcn.140004cf8
mov edx, 0x114
mov rcx, r12
call fcn.140004cf8
jmp 0x140003ec5
cmp qword [rsp + 0x688], 0
je 0x1400042b8
mov edx, 8
mov rcx, qword [rsp + 0x70]
call fcn.140004670
mov rcx, qword [rsp + 0x100]
mov rdx, qword [rsp + 0x108]
call fcn.140004cf8
movaps xmm6, xmmword [rsp + 0x720]
movaps xmm7, xmmword [rsp + 0x730]
movaps xmm8, xmmword [rsp + 0x740]
movaps xmm9, xmmword [rsp + 0x750]
movaps xmm10, xmmword [rsp + 0x760]
movaps xmm11, xmmword [rsp + 0x770]
movaps xmm12, xmmword [rsp + 0x780]
movaps xmm13, xmmword [rsp + 0x790]
movaps xmm14, xmmword [rsp + 0x7a0]
movaps xmm15, xmmword [rsp + 0x7b0]
add rsp, 0x7c8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r12, r14
lea r15, [rsp + 0x6f0]
movd xmm6, dword [rsp + 0x380]
movd xmm7, dword [rsp + 0x388]
mov esi, 8
mov ecx, 8
call fcn.140004e11
mov rdi, rax
movabs rax, 0x72657475706d6f43
mov qword [rdi], rax
mov r14, qword [r15 - 8]
movdqu xmm0, xmmword [r15]
movups xmm1, xmmword [r15 + 0x10]
movups xmm2, xmmword [r15 + 0x20]
movaps xmmword [rsp + 0x5c0], xmm2
movaps xmmword [rsp + 0x5b0], xmm1
movdqa xmmword [rsp + 0x5a0], xmm0
cmp r14, 3
jne 0x1400043ab
xor edi, edi
jmp 0x140004410
mov rbx, rdx
mov ecx, 0x60
mov edx, 8
call fcn.14000bc7c
mov rsi, rax
mov qword [rax], r14
movdqa xmm0, xmmword [rsp + 0x5a0]
movaps xmm1, xmmword [rsp + 0x5b0]
movaps xmm2, xmmword [rsp + 0x5c0]
movdqu xmmword [rax + 8], xmm0
movups xmmword [rax + 0x18], xmm1
movups xmmword [rax + 0x28], xmm2
mov dword [rax + 0x38], ebp
movd dword [rax + 0x3c], xmm7
mov qword [rax + 0x40], rdi
mov qword [rax + 0x48], rbx
mov qword [rax + 0x50], 8
movd dword [rax + 0x58], xmm6
movd dword [rax + 0x5c], xmm6
mov edi, 1
mov r14, r12
jmp 0x140001abd
call fcn.14000c397
ud2
mov ecx, 8
mov rdx, r12
call fcn.1400219d6
ud2
ud2
mov ecx, 8
mov edx, 0x120
jmp 0x140004427
mov ecx, 8
mov edx, 0xfa0
jmp 0x140004427