Function at 0x1400e1fa0
Capabilities:
Connect to wmi namespace via wbemlocator
Get disk information
Get disk size
Get local ipv4 addresses
Get logon sessions
Get memory capacity
List groups for user account
List user accounts

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa58
lea rbp, [rsp + 0x80]
movdqa xmmword [rbp + 0x9c0], xmm8
movdqa xmmword [rbp + 0x9b0], xmm7
movaps xmmword [rbp + 0x9a0], xmm6
mov qword [rbp + 0x998], 0xfffffffffffffffe
mov r15, rdx
mov qword [rbp + 0x560], rcx
mov eax, dword [0x1402448c0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0x60], 0
jne 0x1400e200a
call fcn.1400e17f0
mov eax, dword [0x1402448c0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0x68]
inc qword [rax + 0x68]
movzx eax, byte [0x1402448a8]
mov rcx, qword [0x1402443c8]
test rcx, rcx
jne 0x1400e2057
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1400e5288
mov rcx, rax
mov qword [0x1402443c8], rax
mov r8d, 0x56410
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x1400e5288
mov rsi, rax
add rsi, 0x56000
mov r8d, 0x410
mov rcx, rsi
mov dl, 0xff
call sub.VCRUNTIME140.dll_memset
mov qword [rbp + 0x890], rsi
mov qword [rbp + 0x898], 0x3ff
mov qword [rbp + 0x8a0], 0x380
mov qword [rbp + 0x8a8], 0
movups xmmword [rbp + 0x8b0], xmm6
movzx eax, byte [0x1402448a8]
mov rcx, qword [0x1402443c8]
test rcx, rcx
jne 0x1400e20e3
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1400e5294
mov rcx, rax
mov qword [0x1402443c8], rax
mov r8d, 9
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x1400e5294
movabs rcx, 0x5043206c61746f54
mov qword [rax], rcx
mov byte [rax + 8], 0x55
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 9
mov qword [rbp - 0x20], 9
mov qword [rbp - 0x18], 1
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], 1
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], 0
mov qword [rbp + 0x30], 0
mov dword [rbp + 0x38], 0
mov qword [rbp + 0x40], 8
movups xmmword [rbp + 0x48], xmm0
mov byte [rbp + 0x58], 0
mov qword [rbp + 0x848], 8
movups xmmword [rbp + 0x850], xmm0
movzx eax, byte [0x1402448a8]
mov rcx, qword [0x1402443c8]
test rcx, rcx
jne 0x1400e219f
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1400e52a8
mov rcx, rax
mov qword [0x1402443c8], rax
mov r8d, 0x120
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x1400e52a8
mov qword [rbp + 0x800], rax
mov qword [rbp + 0x808], 2
mov qword [rbp + 0x810], 0
mov qword [rbp + 0x8d0], 0
mov eax, dword [0x1402448c0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0x60], 0
jne 0x1400e2200
call fcn.1400e17f0
lea rax, [0x1401db090]
mov qword [rbp + 0x910], rax
xorps xmm6, xmm6
movups xmmword [rbp + 0x918], xmm6
mov qword [rbp + 0x928], 0
mov eax, dword [0x1402448c0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm0, xmmword [rax + 0x68]
inc qword [rax + 0x68]
movups xmmword [rbp + 0x930], xmm0
mov qword [rbp + 0x590], 0
mov rax, qword [0x1402440b8]
lea rcx, [rbp + 0x590]
call rax
mov rcx, qword [rbp + 0x590]
movabs r8, 0x19db1ded53e8000
mov rdx, rcx
sub rdx, r8
neg rdx
movabs rax, 0xfe624e212ac18000
add rax, rcx
movabs r9, 0x19db1ded53e7fff
cmp rcx, r9
cmovle rax, rdx
movabs rdx, 0xd6bf94d5e57a42bd
mul rdx
cmp rcx, r8
jl 0x1400e22dc
mov rsi, rdx
call sub.kernel32.dll_GetTickCount64
shr rsi, 0x17
shr rax, 3
movabs rcx, 0x20c49ba5e353f7cf
mul rcx
shr rdx, 4
xor edi, edi
sub rsi, rdx
cmovae rdi, rsi
jmp 0x1400e22de
xor edi, edi
movups xmm0, xmmword [rbp + 0x890]
movups xmm1, xmmword [rbp + 0x8a0]
movups xmm2, xmmword [rbp + 0x8b0]
movaps xmmword [rbp + 0x5f0], xmm2
movaps xmmword [rbp + 0x5e0], xmm1
movaps xmmword [rbp + 0x5d0], xmm0
lea rcx, [rbp + 0x6a0]
movaps xmmword [rbp + 0x630], xmm6
movaps xmmword [rbp + 0x640], xmm6
lea rdx, [rbp - 0x30]
mov r8d, 0x90
call sub.VCRUNTIME140.dll_memcpy
movups xmm0, xmmword [rbp + 0x848]
movups xmmword [rbp + 0x658], xmm0
mov rax, qword [rbp + 0x858]
mov qword [rbp + 0x668], rax
movups xmm0, xmmword [rbp + 0x800]
movaps xmmword [rbp + 0x670], xmm0
mov rax, qword [rbp + 0x810]
mov qword [rbp + 0x680], rax
movups xmm0, xmmword [rbp + 0x8d0]
movups xmm1, xmmword [rbp + 0x8e0]
movups xmm2, xmmword [rbp + 0x8f0]
movdqu xmm3, xmmword [rbp + 0x900]
movaps xmmword [rbp + 0x590], xmm0
movaps xmmword [rbp + 0x5a0], xmm1
movaps xmmword [rbp + 0x5b0], xmm2
movdqa xmmword [rbp + 0x5c0], xmm3
movups xmm0, xmmword [rbp + 0x910]
movups xmm1, xmmword [rbp + 0x920]
movdqu xmm2, xmmword [rbp + 0x930]
movdqa xmmword [rbp + 0x620], xmm2
movaps xmmword [rbp + 0x610], xmm1
movaps xmmword [rbp + 0x600], xmm0
mov qword [rbp + 0x650], rdi
mov qword [rbp + 0x688], 8
movaps xmmword [rbp + 0x690], xmm6
cmp byte [r15 + 4], 0
mov qword [rbp + 0x968], r15
je 0x1400e24bc
movaps xmmword [rbp + 0x8d0], xmm6
movaps xmmword [rbp + 0x900], xmm6
movaps xmmword [rbp + 0x8f0], xmm6
movaps xmmword [rbp + 0x8e0], xmm6
mov dword [rbp + 0x8d0], 0x40
lea rcx, [rbp + 0x8d0]
call sub.kernel32.dll_GlobalMemoryStatusEx
movups xmm0, xmmword [rbp + 0x8d8]
movaps xmmword [rbp + 0x630], xmm0
movaps xmmword [rbp + 0x20], xmm6
movaps xmmword [rbp + 0x10], xmm6
movaps xmmword [rbp], xmm6
movaps xmmword [rbp - 0x10], xmm6
movaps xmmword [rbp - 0x20], xmm6
movaps xmmword [rbp - 0x30], xmm6
mov qword [rbp + 0x30], 0
lea rcx, [rbp - 0x30]
mov edx, 0x68
call sub.psapi.dll_GetPerformanceInfo
cmp eax, 1
jne 0x1400e24b5
mov rdx, qword [rbp - 0x20]
mov r9, qword [rbp - 0x10]
xor r10d, r10d
sub rdx, r9
cmovb rdx, r10
mov rcx, qword [rbp + 0x20]
mov rax, rcx
mul rdx
mov r8, rax
mov r11, 0xffffffffffffffff
cmovo r8, r11
mov rdx, qword [rbp - 0x28]
sub rdx, r9
cmovb rdx, r10
mov rax, rcx
mul rdx
cmovo rax, r11
mov qword [rbp + 0x640], r8
mov qword [rbp + 0x648], rax
mov r15, qword [rbp + 0x968]
cmp byte [r15 + 0xb], 2
je 0x1400e2965
movzx eax, byte [r15 + 0xc]
mov byte [rbp + 0x978], al
cmp qword [rbp + 0x590], 0
jne 0x1400e2881
mov qword [rbp + 0x8d0], 0
lea r8, [rbp + 0x8d0]
xor ecx, ecx
xor edx, edx
call sub.pdh.dll_PdhOpenQueryA
test eax, eax
je 0x1400e250b
lea rax, [rbp + 0x910]
jmp 0x1400e2599
mov rax, qword [rbp + 0x8d0]
mov qword [rbp + 0x988], rax
mov eax, dword [0x1402448c0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0x60], 0
jne 0x1400e253b
call fcn.1400e17f0
mov eax, dword [0x1402448c0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rdx, qword [rax + 0x68]
mov rcx, qword [rax + 0x70]
mov qword [rbp + 0x960], rcx
mov qword [rbp + 0x950], rdx
lea rcx, [rdx + 1]
mov qword [rax + 0x68], rcx
lea rax, [0x1401db090]
mov qword [rbp + 0x910], rax
xorps xmm0, xmm0
movaps xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], 0
lea rax, [rbp + 0x890]
mov qword [rax], 0
lea rcx, [rbp + 0x590]
call fcn.14000fa40
mov rax, qword [rbp + 0x910]
mov qword [rbp + 0x590], rax
movaps xmm0, xmmword [rbp - 0x30]
movups xmmword [rbp + 0x598], xmm0
mov rcx, qword [rbp - 0x20]
mov qword [rbp + 0x5a8], rcx
mov rcx, qword [rbp + 0x950]
mov qword [rbp + 0x5b0], rcx
mov rcx, qword [rbp + 0x960]
mov qword [rbp + 0x5b8], rcx
mov rcx, qword [rbp + 0x988]
mov qword [rbp + 0x5c0], rcx
mov rcx, qword [rbp + 0x890]
mov qword [rbp + 0x5c8], rcx
test rax, rax
je 0x1400e286c
movzx eax, byte [0x1402448a8]
mov rcx, qword [0x1402443c8]
test rcx, rcx
jne 0x1400e263d
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1400e5336
mov rcx, rax
mov qword [0x1402443c8], rax
mov r8d, 0x1e
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x1400e5336
movups xmm0, xmmword [0x1401b3a2e]
movups xmmword [rax + 0xe], xmm0
movups xmm0, xmmword [str.Processor__Total___Idle_TimeProcessor____Idle_Time]
movups xmmword [rax], xmm0
mov qword [rbp + 0x988], rax
mov qword [rbp + 0x8d0], rax
mov qword [rbp + 0x8d8], 0x1e
mov qword [rbp + 0x8e0], 0x1e
movzx eax, byte [0x1402448a8]
mov rcx, qword [0x1402443c8]
test rcx, rcx
jne 0x1400e26b9
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1400e5347
mov rcx, rax
mov qword [0x1402443c8], rax
mov r8d, 5
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x1400e5347
lea r8, [rbp + 0x6e8]
mov byte [rax + 4], 0x30
mov dword [rax], 0x5f746f74
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 5
mov qword [rbp - 0x20], 5
mov byte [rbp + 0x95f], 0
lea rcx, [rbp + 0x8d0]
lea rdx, [rbp + 0x590]
lea r9, [rbp - 0x30]
call fcn.1400ed9b0
movzx edx, byte [rbp + 0x978]
and dl, 1
lea rcx, [rbp + 0x6a0]
call fcn.1400e9030
lea rbx, [rbp + 0x8d0]
mov rax, qword [rbp + 0x720]
test rax, rax
je 0x1400e286c
mov rsi, qword [rbp + 0x710]
imul rax, rax, 0x70
add rax, rsi
mov qword [rbp + 0x988], rax
xor r15d, r15d
lea r12, [rbp + 0x800]
lea rdi, [fcn.14002dc30]
nop word cs:[rax + rax]
mov qword [rbp + 0x800], r15
mov qword [rbp + 0x8d0], r12
mov qword [rbp + 0x8d8], rdi
lea rax, str._:e_
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 2
mov qword [rbp - 0x10], 0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], 1
lea rcx, [rbp + 0x910]
lea r13, [rbp - 0x30]
mov rdx, r13
call fcn.14001ffe0
mov qword [rbp + 0x890], r12
mov r14, rdi
mov qword [rbp + 0x898], rdi
lea rax, str.called__Result::unwrap____on_an__Err__value
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 2
mov qword [rbp - 0x10], 0
lea rax, [rbp + 0x890]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 1
mov byte [rbp + 0x95e], 1
mov rcx, rbx
mov rdx, r13
call fcn.14001ffe0
lea r8, [rsi + 0x48]
movups xmm0, xmmword [rbp + 0x8d0]
movaps xmmword [rbp - 0x30], xmm0
mov rax, qword [rbp + 0x8e0]
mov qword [rbp - 0x20], rax
mov byte [rbp + 0x95e], 0
lea rcx, [rbp + 0x910]
lea rdx, [rbp + 0x590]
mov r9, r13
call fcn.1400ed9b0
add rsi, 0x70
inc r15
cmp rsi, qword [rbp + 0x988]
lea rbx, [rbp + 0x8d0]
lea r12, [rbp + 0x800]
mov rdi, r14
jne 0x1400e2770
cmp qword [rbp + 0x590], 0
mov r15, qword [rbp + 0x968]
je 0x1400e2965
mov rcx, qword [rbp + 0x5c0]
call sub.pdh.dll_PdhCollectQueryData
mov rdx, qword [rbp + 0x6e8]
test rdx, rdx
je 0x1400e28c8
mov r8, qword [rbp + 0x6f8]
lea rcx, [rbp + 0x590]
call fcn.1400ee3a0
test eax, eax
je 0x1400e530b
movss xmm1, dword [0x14016e7f4]
subss xmm1, xmm0
movss dword [rbp + 0x708], xmm1
movzx edx, byte [rbp + 0x978]
and dl, 1
lea rcx, [rbp + 0x6a0]
call fcn.1400e9030
mov rbx, qword [rbp + 0x710]
mov rsi, qword [rbp + 0x720]
imul r14, rsi, 0x70
test rsi, rsi
je 0x1400e2948
lea r15, [rbx + r14]
lea rdi, [rbp + 0x590]
movss xmm6, dword [0x14016e7f4]
mov r12, rbx
jmp 0x1400e2919
add r12, 0x70
cmp r12, r15
je 0x1400e2948
mov rdx, qword [r12 + 0x48]
test rdx, rdx
je 0x1400e2910
mov r8, qword [r12 + 0x58]
mov rcx, rdi
call fcn.1400ee3a0
test eax, eax
je 0x1400e51ff
movaps xmm1, xmm6
subss xmm1, xmm0
movss dword [r12 + 0x68], xmm1
jmp 0x1400e2910
test byte [rbp + 0x978], 1
mov r15, qword [rbp + 0x968]
je 0x1400e2965
cmp byte [rbp + 0x728], 0
je 0x1400e3e93
cmp byte [r15 + 6], 0
je 0x1400e4d11
xor ecx, ecx
xor edx, edx
call sub.ole32.dll_CoInitializeEx
cmp eax, 2
mov qword [rbp + 0x848], 0
mov qword [rbp + 0x858], 0
mov qword [rbp + 0x868], 0
setb byte [rbp + 0x878]
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov edx, 0xffffffff
xor r8d, r8d
xor r9d, r9d
call sub.ole32.dll_CoInitializeSecurity
test eax, eax
js 0x1400e2c4c
lea rax, [rbp + 0x850]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movdqu xmm2, xmmword [rax + 0x20]
movdqu xmmword [rbp + 0x828], xmm2
movups xmmword [rbp + 0x818], xmm1
movups xmmword [rbp + 0x808], xmm0
mov qword [rbp + 0x800], 0
mov qword [rbp + 0x520], 0
lea rax, [rbp + 0x520]
mov qword [rsp + 0x20], rax
lea rcx, [0x1401b3568]
lea r9, [0x1401b3578]
xor edx, edx
mov r8d, 1
call sub.ole32.dll_CoCreateInstance
test eax, eax
js 0x1400e2c55
lea rax, [rbp + 0x808]
mov rcx, qword [rbp + 0x520]
mov qword [rbp + 0x808], rcx
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movdqu xmm2, xmmword [rax + 0x20]
movups xmmword [rbp + 0x898], xmm0
movups xmmword [rbp + 0x8a8], xmm1
movdqu xmmword [rbp + 0x8b8], xmm2
mov qword [rbp + 0x890], 1
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x890]
call fcn.1400e12b0
cmp qword [rbp - 0x30], 2
je 0x1400e2c64
movups xmm0, xmmword [rbp - 0x30]
movups xmm1, xmmword [rbp - 0x20]
movdqu xmm2, xmmword [rbp - 0x10]
movaps xmmword [rbp + 0x920], xmm1
mov rax, qword [rbp]
mov qword [rbp + 0x940], rax
movdqa xmmword [rbp + 0x930], xmm2
movaps xmmword [rbp + 0x910], xmm0
lea rsi, [rbp + 0x910]
cmp qword [rbp + 0x920], 0
je 0x1400e2c5c
mov rcx, qword [rbp + 0x928]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call sub.ole32.dll_CoSetProxyBlanket
test eax, eax
js 0x1400e2c5c
mov rax, qword [rbp + 0x910]
cmp rax, 2
je 0x1400e2c64
mov qword [rbp + 0x8d0], rax
movups xmm0, xmmword [rbp + 0x918]
movups xmm1, xmmword [rbp + 0x928]
movdqu xmm2, xmmword [rbp + 0x938]
movups xmmword [rbp + 0x8d8], xmm0
movups xmmword [rbp + 0x8e8], xmm1
movdqu xmmword [rbp + 0x8f8], xmm2
lea rcx, [rbp + 0x7c0]
lea rdx, [rbp + 0x8d0]
call fcn.1400e1420
mov rax, qword [rbp + 0x7c0]
cmp rax, 2
je 0x1400e2c64
movups xmm0, xmmword [rbp + 0x7c8]
movups xmm1, xmmword [rbp + 0x7d8]
movdqu xmm2, xmmword [rbp + 0x7e8]
movdqu xmmword [rbp + 0x790], xmm2
movups xmmword [rbp + 0x780], xmm1
movups xmmword [rbp + 0x770], xmm0
mov qword [rbp + 0x768], rax
mov byte [rbp + 0x987], 1
lea rcx, [rbp + 0x83c]
lea rdx, [rbp + 0x768]
mov r8b, 1
call fcn.1400e15b0
mov rax, qword [rbp + 0x798]
mov qword [rbp + 0x7f0], rax
movups xmm0, xmmword [rbp + 0x768]
movups xmm1, xmmword [rbp + 0x778]
movdqu xmm2, xmmword [rbp + 0x788]
movdqa xmmword [rbp + 0x7e0], xmm2
movaps xmmword [rbp + 0x7d0], xmm1
movaps xmmword [rbp + 0x7c0], xmm0
mov esi, dword [rbp + 0x840]
cmp esi, 2
jne 0x1400e5096
mov byte [rbp + 0x987], 0
lea rcx, [rbp + 0x7c0]
call fcn.1400e11d0
jmp 0x1400e2c64
lea rsi, [rbp + 0x848]
jmp 0x1400e2c5c
lea rsi, [rbp + 0x800]
mov rcx, rsi
call fcn.1400e11d0
mov eax, 8
mov qword [rbp + 0x988], rax
xor eax, eax
mov qword [rbp + 0x978], rax
lea rcx, [rbp + 0x658]
call fcn.1400e6790
mov rax, qword [rbp + 0x988]
mov qword [rbp + 0x658], rax
mov rax, qword [rbp + 0x978]
mov qword [rbp + 0x660], rax
mov qword [rbp + 0x668], rax
mov r15, qword [rbp + 0x968]
cmp byte [r15 + 1], 0
je 0x1400e2d7c
mov qword [rbp + 0x800], 0
lea rcx, [rbp + 0x800]
call sub.iphlpapi.dll_GetIfTable2
test eax, eax
je 0x1400e2f58
mov r15, qword [rbp + 0x968]
movzx edx, word [r15 + 8]
cmp dl, 2
je 0x1400e2d06
mov rax, qword [rbp + 0x968]
movzx eax, byte [rax + 0xa]
shl eax, 0x10
or edx, eax
lea rcx, [rbp + 0x590]
call fcn.1400e6970
mov r12, qword [rbp + 0x968]
cmp byte [r12 + 2], 0
je 0x1400e2ed3
call sub.kernel32.dll_GetLogicalDrives
mov dword [rbp + 0x800], eax
test eax, eax
je 0x1400e2d61
movabs rax, 0x2000000000
mov qword [rbp + 0x898], rax
lea rax, [rbp + 0x800]
mov qword [rbp + 0x890], rax
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x890]
call fcn.1400e7f30
cmp dword [rbp - 0x30], 3
jne 0x1400e3414
xorps xmm0, xmm0
movaps xmmword [rbp + 0x910], xmm0
mov esi, 8
mov r12, qword [rbp + 0x968]
jmp 0x1400e4020
cmp byte [r15], 0
je 0x1400e2ce0
lea rcx, [rbp - 0x30]
mov r8d, 0x548
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rdi, qword [rbp + 0x618]
test rdi, rdi
je 0x1400e2cd9
mov rbx, qword [rbp + 0x600]
lea r14, [rbx + 0x10]
movdqa xmm0, xmmword [rbx]
pmovmskb r12d, xmm0
not r12d
lea rsi, [rbp - 0x30]
mov r15, 0xffffffffffffffff
jmp 0x1400e2de4
lea eax, [r12 - 1]
and eax, r12d
mov r12d, eax
dec rdi
je 0x1400e2cd9
test r12w, r12w
jne 0x1400e2e11
nop word [rax + rax]
movdqa xmm0, xmmword [r14]
pmovmskb r12d, xmm0
add rbx, 0xfffffffffffff780
add r14, 0x10
cmp r12d, 0xffff
je 0x1400e2df0
not r12d
tzcnt eax, r12d
mov r13, rax
neg r13
shl rax, 3
shl r13, 7
sub r13, rax
mov rax, qword [rbx + r13 - 0x70]
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x28], 0
mov rcx, rsi
call sub.iphlpapi.dll_GetIfEntry2
test eax, eax
jne 0x1400e2dd0
add r13, rbx
mov rax, qword [r13 - 0x68]
mov rcx, qword [r13 - 0x58]
mov qword [r13 - 0x60], rax
mov rax, qword [rbp + 0x4d0]
mov qword [r13 - 0x68], rax
mov qword [r13 - 0x50], rcx
mov rax, qword [rbp + 0x488]
mov qword [r13 - 0x58], rax
mov rax, qword [r13 - 0x48]
mov qword [r13 - 0x40], rax
mov rax, qword [rbp + 0x490]
add rax, qword [rbp + 0x498]
cmovb rax, r15
mov qword [r13 - 0x48], rax
mov rax, qword [r13 - 0x38]
mov qword [r13 - 0x30], rax
mov rax, qword [rbp + 0x4d8]
add rax, qword [rbp + 0x4e0]
cmovb rax, r15
mov qword [r13 - 0x38], rax
mov rax, qword [r13 - 0x28]
mov qword [r13 - 0x20], rax
mov rax, qword [rbp + 0x4a8]
mov qword [r13 - 0x28], rax
mov rax, qword [r13 - 0x18]
mov qword [r13 - 0x10], rax
mov rax, qword [rbp + 0x4f0]
mov qword [r13 - 0x18], rax
jmp 0x1400e2dd0
cmp byte [r12 + 3], 0
je 0x1400e4041
mov rax, qword [rbp + 0x680]
test rax, rax
je 0x1400e4041
mov rdi, qword [rbp + 0x670]
lea rbx, [rax + rax*8]
shl rbx, 4
add rbx, rdi
lea rsi, [rbp - 0x30]
jmp 0x1400e2f27
mov r12, qword [rbp + 0x968]
add rdi, 0x90
cmp rdi, rbx
je 0x1400e4041
cmp qword [rdi + 0x78], 0
je 0x1400e2f17
mov qword [rbp - 0x30], 0
mov rcx, qword [rdi + 0x48]
xor edx, edx
xor r8d, r8d
mov r9, rsi
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x1400e2f10
mov rax, qword [rbp - 0x30]
mov qword [rdi + 0x80], rax
jmp 0x1400e2f10
mov rax, qword [rbp + 0x618]
test rax, rax
je 0x1400e2ff2
mov rcx, qword [rbp + 0x600]
lea rdx, [rcx + 0x10]
movdqa xmm0, xmmword [rcx]
pmovmskb r8d, xmm0
not r8d
jmp 0x1400e2fbb
tzcnt r9d, r8d
mov r10, r9
neg r10
shl r9, 3
shl r10, 7
sub r10, r9
lea r9d, [r8 - 1]
and r9d, r8d
mov byte [rcx + r10 - 2], 0
mov r8d, r9d
dec rax
je 0x1400e2ff2
test r8w, r8w
jne 0x1400e2f90
nop word cs:[rax + rax]
movdqa xmm0, xmmword [rdx]
pmovmskb r8d, xmm0
add rcx, 0xfffffffffffff780
add rdx, 0x10
cmp r8d, 0xffff
je 0x1400e2fd0
not r8d
jmp 0x1400e2f90
mov eax, dword [0x1402448c0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0x60], 0
jne 0x1400e3014
call fcn.1400e17f0
lea r12, [0x1401db090]
mov qword [rbp - 0x30], r12
xorps xmm6, xmm6
movups xmmword [rbp - 0x28], xmm6
mov qword [rbp - 0x18], 0
mov eax, dword [0x1402448c0]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movdqu xmm0, xmmword [rax + 0x68]
inc qword [rax + 0x68]
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp + 0x890], 8
movups xmmword [rbp + 0x898], xmm6
mov rax, qword [rbp + 0x800]
lea rdi, [rax + 8]
mov qword [rbp + 0x760], rax
mov r14d, dword [rax]
test r14, r14
mov qword [rbp + 0x888], rdi
je 0x1400e346d
mov r13b, 1
lea rbx, [0x1401db090]
xor r12d, r12d
mov rsi, qword [sym.imp.kernel32.dll_HeapAlloc]
pcmpeqd xmm7, xmm7
jmp 0x1400e3100
mov rdx, qword [rbp + 0x8a0]
mov rax, qword [rbp + 0x890]
mov rcx, rdx
shl rcx, 5
mov dword [rax + rcx], r12d
mov r8, qword [rbp + 0x978]
mov qword [rax + rcx + 8], r8
mov qword [rax + rcx + 0x10], 0xa
mov qword [rax + rcx + 0x18], 0xa
inc rdx
mov qword [rbp + 0x8a0], rdx
nop word [rax + rax]
inc r12
cmp r12, r14
setb r13b
je 0x1400e3437
imul r15, r12, 0x548
cmp qword [rdi + r15 + 0x4a8], 0
jne 0x1400e311d
cmp qword [rdi + r15 + 0x4b0], 0
je 0x1400e30f0
cmp dword [rdi + r15 + 0x48c], 2
je 0x1400e30f0
cmp dword [rdi + r15 + 0x420], 0
je 0x1400e30f0
movzx eax, byte [0x1402448a8]
mov rax, qword [0x1402443c8]
test rax, rax
jne 0x1400e315c
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1400e521c
mov qword [0x1402443c8], rax
mov r8d, 0x14
mov rcx, rax
xor edx, edx
call rsi
test rax, rax
je 0x1400e521c
mov ecx, dword [rdi + r15 + 0x10]
movq xmm0, qword [rdi + r15 + 0x14]
punpcklbw xmm0, xmm6
mov dword [rax], ecx
mov qword [rbp + 0x978], rax
movdqu xmmword [rax + 4], xmm0
movzx eax, byte [0x1402448a8]
mov rax, qword [0x1402443c8]
test rax, rax
mov byte [rbp + 0x960], r13b
jne 0x1400e31c0
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1400e523b
mov qword [0x1402443c8], rax
mov r8d, 0x14
mov rcx, rax
xor edx, edx
call rsi
test rax, rax
je 0x1400e523b
mov rcx, qword [rbp + 0x978]
mov edx, dword [rcx + 0x10]
mov dword [rax + 0x10], edx
movups xmm0, xmmword [rcx]
movups xmmword [rax], xmm0
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 8]
mov r9d, 0xa
mov qword [rbp + 0x988], rax
mov r8, rax
call fcn.1400e1860
mov r15, rax
mov rax, qword [rbp - 0x28]
mov r13, r15
shr r13, 0x39
movd xmm0, r13d
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
xor ecx, ecx
mov rdx, r15
and rdx, rax
movdqu xmm1, xmmword [rbx + rdx]
movdqa xmm2, xmm0
pcmpeqb xmm2, xmm1
pmovmskb r8d, xmm2
test r8d, r8d
jne 0x1400e3280
pcmpeqb xmm1, xmm7
pmovmskb r8d, xmm1
test r8d, r8d
jne 0x1400e3321
add rdx, rcx
add rdx, 0x10
add rcx, 0x10
jmp 0x1400e322c
lea r9d, [r8 - 1]
and r9d, r8d
mov r8d, r9d
test r9w, r9w
je 0x1400e3246
tzcnt r9d, r8d
add r9, rdx
and r9, rax
shl r9, 5
mov rdi, rbx
sub rdi, r9
cmp qword [rdi - 0x10], 0xa
jne 0x1400e3270
mov r9, qword [rdi - 0x20]
movdqu xmm2, xmmword [r9]
mov r10, qword [rbp + 0x988]
movdqu xmm3, xmmword [r10]
pcmpeqb xmm3, xmm2
movd xmm2, dword [r9 + 0x10]
movd xmm4, dword [r10 + 0x10]
pcmpeqb xmm4, xmm2
pand xmm4, xmm3
pmovmskb r9d, xmm4
cmp r9d, 0xffff
jne 0x1400e3270
mov rcx, qword [0x1402443c8]
xor edx, edx
mov r8, qword [rbp + 0x988]
mov r15, qword [sym.imp.kernel32.dll_HeapFree]
call r15
mov eax, dword [rdi - 8]
inc eax
mov dword [rdi - 8], eax
cmp eax, 1
jle 0x1400e33e8
mov rcx, qword [0x1402443c8]
xor edx, edx
mov r8, qword [rbp + 0x978]
call r15
mov rdi, qword [rbp + 0x888]
jmp 0x1400e30f0
cmp qword [rbp - 0x20], 0
jne 0x1400e3339
lea rcx, [rbp - 0x30]
lea rdx, [rbp - 0x10]
call fcn.140169300
mov rax, qword [rbp - 0x28]
mov rbx, qword [rbp - 0x30]
and r15, rax
movdqu xmm0, xmmword [rbx + r15]
pmovmskb ecx, xmm0
test ecx, ecx
jne 0x1400e3378
mov edx, 0x10
nop word cs:[rax + rax]
add r15, rdx
and r15, rax
movdqu xmm0, xmmword [rbx + r15]
pmovmskb ecx, xmm0
add rdx, 0x10
test ecx, ecx
je 0x1400e3360
tzcnt ecx, ecx
add rcx, r15
and rcx, rax
movzx edx, byte [rbx + rcx]
test dl, dl
js 0x1400e339a
movdqa xmm0, xmmword [rbx]
pmovmskb ecx, xmm0
tzcnt ecx, ecx
movzx edx, byte [rbx + rcx]
lea r8, [rcx - 0x10]
and r8, rax
mov byte [rbx + rcx], r13b
mov byte [r8 + rbx + 0x10], r13b
shl rcx, 5
mov rax, rbx
sub rax, rcx
and dl, 1
movzx edx, dl
sub qword [rbp - 0x20], rdx
mov rdx, qword [rbp + 0x988]
mov qword [rax - 0x20], rdx
mov qword [rax - 0x18], 0xa
mov qword [rax - 0x10], 0xa
neg rcx
inc qword [rbp - 0x18]
mov dword [rbx + rcx - 8], 1
mov rdi, qword [rbp + 0x888]
mov rdx, qword [rbp + 0x8a0]
cmp rdx, qword [rbp + 0x898]
jne 0x1400e30ad
lea rcx, [rbp + 0x890]
call fcn.1400e1c20
jmp 0x1400e30a6
movzx eax, byte [0x1402448a8]
mov rcx, qword [0x1402443c8]
test rcx, rcx
je 0x1400e3f14
mov r12, qword [rbp + 0x968]
jmp 0x1400e3f34
mov rax, qword [rbp + 0x890]
mov rcx, qword [rbp + 0x898]
mov rsi, qword [rbp + 0x8a0]
mov rdx, qword [rbp - 0x18]
mov qword [rbp + 0x758], rdx
movdqu xmm0, xmmword [rbp - 0x10]
mov r12, qword [rbp - 0x30]
mov rdx, qword [rbp - 0x28]
mov qword [rbp + 0x978], rdx
jmp 0x1400e3488
xor eax, eax
mov qword [rbp + 0x978], rax
mov eax, 8
xor ecx, ecx
mov qword [rbp + 0x758], rcx
xor esi, esi
xor ecx, ecx
shl rsi, 5
lea rdx, [rax + rsi]
mov qword [rbp + 0x8d0], rax
mov qword [rbp + 0x580], rcx
mov qword [rbp + 0x8d8], rcx
mov qword [rbp + 0x750], rdx
mov qword [rbp + 0x8e8], rdx
movq qword [rbp + 0x550], xmm0
pshufd xmm0, xmm0, 0xee
movq qword [rbp + 0x558], xmm0
add rsi, 0xffffffffffffffe0
lea rdi, [rax + 0x30]
add qword [rbp + 0x760], 0x2a
pcmpeqd xmm6, xmm6
mov qword [rbp + 0x588], rax
mov rbx, rax
mov r13, r12
jmp 0x1400e351b
cmp qword [rbp + 0x8c8], 0
mov r12, r13
je 0x1400e3513
mov rcx, qword [0x1402443c8]
xor edx, edx
mov r8, qword [rbp + 0x988]
call qword [sym.imp.kernel32.dll_HeapFree]
add rsi, 0xffffffffffffffe0
add rdi, 0x20
cmp rbx, qword [rbp + 0x750]
je 0x1400e3b84
mov rax, rbx
add rbx, 0x20
mov qword [rbp + 0x8e0], rbx
mov rcx, qword [rax + 8]
mov qword [rbp + 0x988], rcx
test rcx, rcx
je 0x1400e3b4c
mov edx, dword [rax]
mov rcx, qword [rax + 0x10]
mov qword [rbp + 0x8c8], rcx
cmp qword [rbp + 0x758], 0
mov qword [rbp + 0x738], rsi
mov qword [rbp + 0x740], rdi
mov qword [rbp + 0x748], rbx
je 0x1400e3690
mov qword [rbp + 0x960], rdx
mov rsi, qword [rax + 0x18]
mov rcx, qword [rbp + 0x550]
mov rdx, qword [rbp + 0x558]
mov r8, qword [rbp + 0x988]
mov r9, rsi
call fcn.1400e1860
mov rdi, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
lea r15, [rsi + rsi]
xor r14d, r14d
mov rcx, qword [rbp + 0x978]
and rdi, rcx
movdqu xmm8, xmmword [r12 + rdi]
movdqa xmm0, xmm7
pcmpeqb xmm0, xmm8
pmovmskb r12d, xmm0
test r12d, r12d
jne 0x1400e3620
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x1400e3974
add rdi, r14
add rdi, 0x10
add r14, 0x10
mov r12, r13
jmp 0x1400e35c9
lea eax, [r12 - 1]
and eax, r12d
mov r12d, eax
test ax, ax
je 0x1400e35e5
tzcnt eax, r12d
add rax, rdi
and rax, rcx
shl rax, 5
mov rbx, r13
sub rbx, rax
cmp qword [rbx - 0x10], rsi
jne 0x1400e3610
mov rdx, qword [rbx - 0x20]
mov rcx, qword [rbp + 0x988]
mov r8, r15
call sub.VCRUNTIME140.dll_memcmp
mov rcx, qword [rbp + 0x978]
test eax, eax
jne 0x1400e3610
lea rax, [rbx - 0x20]
test rbx, rbx
cmove rax, rbx
mov rsi, qword [rbp + 0x738]
mov rdi, qword [rbp + 0x740]
mov rbx, qword [rbp + 0x748]
mov rdx, qword [rbp + 0x960]
jmp 0x1400e3692
xor eax, eax
lea rcx, [rax + 0x18]
test rax, rax
lea rax, [0x1401b37e0]
cmove rcx, rax
cmp dword [rcx], 1
jg 0x1400e34f0
imul r14, rdx, 0x548
mov rax, qword [rbp + 0x888]
lea r15, [rax + r14]
lea rdx, [rax + r14]
add rdx, 0x1c
mov rax, qword [rbp + 0x760]
add rax, r14
xor r8d, r8d
cmp word [rax + r8*2 - 6], 0
je 0x1400e3729
nop dword [rax]
cmp r8, 0x100
je 0x1400e3712
cmp word [rax + r8*2 - 4], 0
je 0x1400e371a
cmp word [rax + r8*2 - 2], 0
je 0x1400e371f
cmp word [rax + r8*2], 0
je 0x1400e3725
add r8, 4
cmp word [rax + r8*2 - 6], 0
jne 0x1400e36e0
jmp 0x1400e3729
mov r8d, 0x101
jmp 0x1400e3736
inc r8
jmp 0x1400e3729
add r8, 2
jmp 0x1400e3729
add r8, 3
cmp r8, 0x102
jae 0x1400e526c
lea rcx, [rbp + 0x910]
call fcn.140020340
mov r8, qword [rbp + 0x910]
test r8, r8
je 0x1400e34f0
mov qword [rbp + 0x570], r15
mov qword [rbp + 0x7b0], r14
mov rax, qword [rbp + 0x918]
mov qword [rbp + 0x7b8], rax
mov rsi, qword [rbp + 0x920]
mov rcx, qword [rbp + 0x620]
mov rdx, qword [rbp + 0x628]
mov qword [rbp + 0x960], r8
mov r9, rsi
call fcn.140029e30
mov r15, rax
mov rbx, qword [rbp + 0x600]
mov r14, qword [rbp + 0x608]
shr rax, 0x39
mov qword [rbp + 0x578], rax
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor eax, eax
mov qword [rbp + 0x950], rax
mov qword [rbp + 0x568], r15
and r15, r14
movdqu xmm8, xmmword [rbx + r15]
movdqa xmm0, xmm7
pcmpeqb xmm0, xmm8
pmovmskb edi, xmm0
test edi, edi
jne 0x1400e382c
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x1400e397b
mov rax, qword [rbp + 0x950]
add r15, rax
add r15, 0x10
add rax, 0x10
mov qword [rbp + 0x950], rax
jmp 0x1400e37d0
lea eax, [rdi - 1]
and eax, edi
mov edi, eax
test ax, ax
je 0x1400e37ea
tzcnt eax, edi
add rax, r15
and rax, r14
mov r12, rax
neg r12
shl rax, 3
shl r12, 7
sub r12, rax
cmp rsi, qword [rbx + r12 - 0x78]
jne 0x1400e3820
add r12, rbx
mov rcx, qword [r12 - 0x88]
mov rdx, qword [rbp + 0x960]
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400e3820
mov rax, qword [r12 - 0x68]
mov rcx, qword [r12 - 0x58]
mov qword [r12 - 0x60], rax
mov rdx, qword [rbp + 0x888]
mov r8, qword [rbp + 0x7b0]
mov rax, qword [rdx + r8 + 0x500]
mov qword [r12 - 0x68], rax
mov qword [r12 - 0x50], rcx
mov rax, qword [rdx + r8 + 0x4b8]
mov qword [r12 - 0x58], rax
mov rax, qword [r12 - 0x48]
mov qword [r12 - 0x40], rax
mov rax, qword [rdx + r8 + 0x4c0]
add rax, qword [rdx + r8 + 0x4c8]
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov qword [r12 - 0x48], rax
mov rax, qword [r12 - 0x38]
mov qword [r12 - 0x30], rax
mov rax, qword [rdx + r8 + 0x508]
add rax, qword [rdx + r8 + 0x510]
cmovb rax, rcx
mov qword [r12 - 0x38], rax
mov rax, qword [r12 - 0x28]
mov qword [r12 - 0x20], rax
mov rax, qword [rdx + r8 + 0x4d8]
mov qword [r12 - 0x28], rax
mov rax, qword [r12 - 0x18]
mov qword [r12 - 0x10], rax
mov rax, qword [rdx + r8 + 0x520]
mov qword [r12 - 0x18], rax
mov byte [r12 - 2], 1
cmp qword [rbp + 0x7b8], 0
mov r12, r13
je 0x1400e394c
mov rcx, qword [0x1402443c8]
xor edx, edx
mov r8, qword [rbp + 0x960]
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rbp + 0x8c8], 0
mov rsi, qword [rbp + 0x738]
mov rdi, qword [rbp + 0x740]
mov rbx, qword [rbp + 0x748]
jne 0x1400e34fd
jmp 0x1400e3513
xor ebx, ebx
jmp 0x1400e3659
cmp qword [rbp + 0x610], 0
mov r12, r13
mov rdi, qword [rbp + 0x568]
jne 0x1400e39b0
lea rcx, [rbp + 0x600]
lea rdx, [rbp + 0x620]
call fcn.1401688c0
mov rbx, qword [rbp + 0x600]
mov r14, qword [rbp + 0x608]
mov rdx, qword [rbp + 0x888]
mov r9, qword [rbp + 0x7b0]
mov r11, qword [rdx + r9 + 0x4c0]
add r11, qword [rdx + r9 + 0x4c8]
mov r8, 0xffffffffffffffff
cmovb r11, r8
mov rcx, qword [rdx + r9 + 0x508]
add rcx, qword [rdx + r9 + 0x510]
cmovb rcx, r8
and rdi, r14
movdqu xmm0, xmmword [rbx + rdi]
pmovmskb edx, xmm0
test edx, edx
jne 0x1400e3a27
mov r8d, 0x10
nop word cs:[rax + rax]
add rdi, r8
and rdi, r14
movdqu xmm0, xmmword [rbx + rdi]
pmovmskb edx, xmm0
add r8, 0x10
test edx, edx
je 0x1400e3a10
tzcnt edx, edx
add rdx, rdi
and rdx, r14
movzx r8d, byte [rbx + rdx]
test r8b, r8b
js 0x1400e3a4c
movdqa xmm0, xmmword [rbx]
pmovmskb edx, xmm0
tzcnt edx, edx
movzx r8d, byte [rbx + rdx]
lea r9, [rdx - 0x10]
and r9, r14
mov r15, qword [rbp + 0x888]
mov rax, qword [rbp + 0x7b0]
mov r10, qword [r15 + rax + 0x4b8]
mov rdi, qword [rbp + 0x570]
mov rdi, qword [rdi]
mov qword [rbp + 0x950], rdi
mov rdi, qword [r15 + rax + 0x500]
mov r14, qword [r15 + rax + 0x4d8]
mov r15, qword [r15 + rax + 0x520]
mov rax, qword [rbp + 0x578]
mov byte [rbx + rdx], al
mov byte [r9 + rbx + 0x10], al
and r8b, 1
movzx r8d, r8b
sub qword [rbp + 0x610], r8
mov r8, rdx
neg r8
shl rdx, 3
shl r8, 7
sub r8, rdx
mov rax, qword [rbp + 0x960]
mov qword [rbx + r8 - 0x88], rax
mov rax, qword [rbp + 0x7b8]
mov qword [rbx + r8 - 0x80], rax
mov qword [rbx + r8 - 0x78], rsi
mov rax, qword [rbp + 0x950]
mov qword [rbx + r8 - 0x70], rax
mov qword [rbx + r8 - 0x68], rdi
mov qword [rbx + r8 - 0x60], rdi
mov qword [rbx + r8 - 0x58], r10
mov qword [rbx + r8 - 0x50], r10
mov qword [rbx + r8 - 0x48], r11
mov qword [rbx + r8 - 0x40], r11
mov qword [rbx + r8 - 0x38], rcx
mov qword [rbx + r8 - 0x30], rcx
mov qword [rbx + r8 - 0x28], r14
mov qword [rbx + r8 - 0x20], r14
mov qword [rbx + r8 - 0x18], r15
mov qword [rbx + r8 - 0x10], r15
mov dword [rbx + r8 - 8], 0
mov word [rbx + r8 - 4], 0
mov byte [rbx + r8 - 2], 1
inc qword [rbp + 0x618]
jmp 0x1400e394c
cmp qword [rbp + 0x750], rbx
je 0x1400e3b84
shr rsi, 5
jmp 0x1400e3b69
add rdi, 0x20
dec rsi
je 0x1400e3b84
cmp qword [rdi], 0
je 0x1400e3b60
mov r8, qword [rdi - 8]
mov rcx, qword [0x1402443c8]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1400e3b60
cmp qword [rbp + 0x580], 0
je 0x1400e3ba4
mov rcx, qword [0x1402443c8]
xor edx, edx
mov r8, qword [rbp + 0x588]
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [rbp + 0x800]
mov byte [rbp + 0x997], 0
call sub.iphlpapi.dll_FreeMibTable
mov rdi, qword [rbp - 0x28]
test rdi, rdi
je 0x1400e3c85
mov rsi, qword [rbp - 0x30]
mov rbx, qword [rbp - 0x18]
test rbx, rbx
je 0x1400e3c5c
movdqa xmm0, xmmword [rsi]
pmovmskb r12d, xmm0
not r12d
lea r14, [rsi + 0x10]
mov r15, rsi
jmp 0x1400e3c00
lea eax, [r12 - 1]
and eax, r12d
mov r12d, eax
dec rbx
je 0x1400e3c5c
test r12w, r12w
jne 0x1400e3c31
nop word cs:[rax + rax]
movdqa xmm0, xmmword [r14]
pmovmskb r12d, xmm0
add r15, 0xfffffffffffffe00
add r14, 0x10
cmp r12d, 0xffff
je 0x1400e3c10
not r12d
tzcnt ecx, r12d
shl rcx, 5
mov rax, r15
sub rax, rcx
cmp qword [rax - 0x18], 0
je 0x1400e3bf0
mov r8, qword [rax - 0x20]
mov rcx, qword [0x1402443c8]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1400e3bf0
mov rax, rdi
shl rax, 5
add rdi, rax
cmp rdi, 0xffffffffffffffcf
je 0x1400e3c85
sub rsi, rax
add rsi, 0xffffffffffffffe0
mov rcx, qword [0x1402443c8]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
mov r14, qword [rbp + 0x608]
mov rsi, qword [rbp + 0x618]
test rsi, rsi
je 0x1400e3df2
mov rdi, qword [rbp + 0x600]
lea rbx, [rdi + 0x10]
movdqa xmm0, xmmword [rdi]
pmovmskb eax, xmm0
not eax
mov rcx, qword [rbp + 0x610]
mov qword [rbp + 0x988], rcx
pcmpeqd xmm6, xmm6
mov r13, rdi
mov r12, rsi
jmp 0x1400e3ce0
lea eax, [r15 - 1]
and eax, r15d
dec rsi
je 0x1400e3df2
test ax, ax
jne 0x1400e3d0c
nop word cs:[rax + rax]
movdqa xmm0, xmmword [rbx]
pmovmskb eax, xmm0
add r13, 0xfffffffffffff780
add rbx, 0x10
cmp eax, 0xffff
je 0x1400e3cf0
not eax
mov r15d, eax
tzcnt ecx, r15d
mov rax, rcx
neg rax
shl rcx, 3
shl rax, 7
sub rax, rcx
cmp byte [r13 + rax - 2], 0
jne 0x1400e3cd0
add rax, r13
mov rcx, rdi
sub rcx, rax
sar rcx, 3
movabs rdx, 0xf0f0f0f0f0f0f0f1
imul rcx, rdx
lea rdx, [rcx - 0x10]
and rdx, r14
movdqu xmm0, xmmword [rdi + rdx]
pcmpeqb xmm0, xmm6
psllw xmm0, 7
pmovmskb r8d, xmm0
test r8d, r8d
je 0x1400e3d72
bsr r8w, r8w
xor r8d, 0xf
jmp 0x1400e3d77
mov r8w, 0x10
movdqu xmm0, xmmword [rdi + rcx]
pcmpeqb xmm0, xmm6
pmovmskb r9d, xmm0
or r9d, 0x10000
tzcnt r9d, r9d
add r8d, r9d
mov r9b, 0x80
cmp r8w, 0xf
ja 0x1400e3db9
mov r8, qword [rbp + 0x988]
inc r8
mov qword [rbp + 0x988], r8
mov qword [rbp + 0x610], r8
mov r9b, 0xff
mov byte [rdi + rcx], r9b
mov byte [rdx + rdi + 0x10], r9b
dec r12
mov qword [rbp + 0x618], r12
cmp qword [rax - 0x80], 0
je 0x1400e3cd0
mov r8, qword [rax - 0x88]
mov rcx, qword [0x1402443c8]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1400e3cd0
mov dword [rbp + 0x848], 0x3c00
mov dword [rbp + 0x890], 0
xor r12d, r12d
lea rdi, [rbp + 0x848]
xor ebx, ebx
mov r15, qword [rbp + 0x968]
nop dword [rax]
cmp ebx, 3
jae 0x1400e4c41
mov edx, dword [rbp + 0x848]
mov rcx, r12
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
test rax, rax
je 0x1400e4a16
mov rsi, rax
mov qword [rbp + 0x7a8], rax
mov byte [rbp + 0x977], 1
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0xe
xor r8d, r8d
mov r9, rax
call sub.iphlpapi.dll_GetAdaptersAddresses
inc ebx
mov dword [rbp + 0x890], eax
mov r12, rsi
cmp eax, 0x6f
je 0x1400e3e20
test eax, eax
jne 0x1400e4c3e
xor edi, edi
mov rbx, rsi
test rdi, rdi
jne 0x1400e4ccf
jmp 0x1400e4a9f
lea rcx, [rbp - 0x30]
mov rdx, rsi
call fcn.1400ed470
mov r8, qword [rbp - 0x30]
mov rax, qword [rbp - 0x28]
test rsi, rsi
je 0x1400e3eee
mov rcx, qword [rbp - 0x20]
test rcx, rcx
je 0x1400e3eee
lea rcx, [rcx*8 - 8]
add r14, 0xffffffffffffff90
xor edx, edx
xor r9d, r9d
nop word cs:[rax + rax]
mov r10, qword [r8 + r9]
mov qword [rbx + rdx + 0x60], r10
cmp r14, rdx
je 0x1400e3eee
lea r10, [r9 + 8]
add rdx, 0x70
cmp rcx, r9
mov r9, r10
jne 0x1400e3ed0
test rax, rax
je 0x1400e3f02
mov rcx, qword [0x1402443c8]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
test rsi, rsi
je 0x1400e4cef
mov rax, qword [rbx + 0x60]
jmp 0x1400e4cf1
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
mov r12, qword [rbp + 0x968]
je 0x1400e5325
mov rcx, rax
mov qword [0x1402443c8], rax
mov r8d, 0x240
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x1400e5325
mov rsi, rax
lea rdx, [rbp - 0x30]
mov r8d, 0x90
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x8d0], rsi
mov qword [rbp + 0x8d8], 4
mov qword [rbp + 0x8e0], 1
movups xmm0, xmmword [rbp + 0x890]
movaps xmmword [rbp + 0x910], xmm0
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
call fcn.1400e7f30
cmp dword [rbp - 0x30], 3
je 0x1400e400f
mov edi, 1
lea rbx, [rbp + 0x8d0]
lea r14, [rbp - 0x30]
lea r15, [rbp + 0x910]
nop dword [rax + rax]
cmp rdi, qword [rbp + 0x8d8]
jne 0x1400e3fdb
mov rcx, rbx
mov rdx, rdi
call fcn.140169b30
mov rsi, qword [rbp + 0x8d0]
lea rcx, [rdi + rdi*8]
shl rcx, 4
add rcx, rsi
mov r8d, 0x90
mov rdx, r14
call sub.VCRUNTIME140.dll_memcpy
inc rdi
mov qword [rbp + 0x8e0], rdi
mov rcx, r14
mov rdx, r15
call fcn.1400e7f30
cmp dword [rbp - 0x30], 3
jne 0x1400e3fc0
lea rax, [rbp + 0x8d8]
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0x910], xmm0
lea rcx, [rbp + 0x670]
call fcn.14000f920
mov qword [rbp + 0x670], rsi
movaps xmm0, xmmword [rbp + 0x910]
movups xmmword [rbp + 0x678], xmm0
cmp byte [r12 + 7], 0
je 0x1400e49d3
mov qword [rbp + 0x890], 8
xorps xmm6, xmm6
movups xmmword [rbp + 0x898], xmm6
mov dword [rbp + 0x7a4], 0
mov r14d, 8
xor edi, edi
nop word cs:[rax + rax]
mov qword [rbp + 0x768], 0
mov dword [rbp + 0x884], 0
mov dword [rbp + 0x7a0], 0
lea rax, [rbp + 0x7a4]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x7a0]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x884]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xffffffff
xor ecx, ecx
xor edx, edx
mov r8d, 2
lea r9, [rbp + 0x768]
call sub.netapi32.dll_NetUserEnum
mov r12d, eax
test eax, eax
je 0x1400e40f5
cmp r12d, 0xea
jne 0x1400e466a
mov rbx, qword [rbp + 0x768]
mov eax, dword [rbp + 0x884]
lea r15, [rbx + rax*8]
mov rax, rbx
nop dword [rax]
cmp rax, r15
je 0x1400e4640
lea rbx, [rax + 8]
cmp qword [rax], 0
mov rax, rbx
je 0x1400e4110
mov qword [rbp + 0x7c0], 0
mov rdx, qword [rbx - 8]
xor ecx, ecx
mov r8d, 0x17
lea r9, [rbp + 0x7c0]
call sub.netapi32.dll_NetUserGetInfo
test eax, eax
je 0x1400e415f
mov rcx, qword [rbp + 0x7c0]
test rcx, rcx
jne 0x1400e41e0
jmp 0x1400e4106
mov rcx, qword [rbp + 0x7c0]
mov rsi, qword [rcx + 0x20]
test rsi, rsi
je 0x1400e41e0
mov rcx, rsi
call sub.advapi32.dll_IsValidSid
test eax, eax
je 0x1400e414d
mov rcx, rsi
call sub.advapi32.dll_GetLengthSid
mov r13d, eax
mov eax, eax
mov qword [rbp + 0x960], rax
test r13d, r13d
je 0x1400e41ea
mov rax, qword [0x1402443c8]
test rax, rax
jne 0x1400e41b6
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1400e5256
mov qword [0x1402443c8], rax
mov rcx, rax
mov edx, 8
mov r8, qword [rbp + 0x960]
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
jne 0x1400e41ef
jmp 0x1400e5256
call sub.netapi32.dll_NetApiBufferFree
jmp 0x1400e4106
mov eax, 1
mov ecx, r13d
mov qword [rbp + 0x978], rax
mov rdx, rax
mov r8, rsi
call sub.advapi32.dll_CopySid
test eax, eax
je 0x1400e4265
test r13d, r13d
je 0x1400e51ea
mov r8, qword [rbp + 0x978]
cmp byte [r8], 1
jne 0x1400e52bc
mov byte [rbp + 0x986], 1
lea rcx, [rbp + 0x8d0]
mov rdx, r8
call fcn.1400e7c70
mov rax, qword [rbp + 0x8d0]
test rax, rax
je 0x1400e4289
mov qword [rbp + 0x968], rax
mov rax, qword [rbp + 0x8d8]
mov qword [rbp + 0x950], rax
mov rsi, qword [rbp + 0x8e0]
jmp 0x1400e42eb
test r13d, r13d
je 0x1400e414d
mov rcx, qword [0x1402443c8]
xor edx, edx
mov r8, qword [rbp + 0x978]
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1400e414d
mov rdx, qword [rbx - 8]
mov r8, 0xffffffffffffffff
nop word cs:[rax + rax]
cmp word [rdx + r8*2 + 2], 0
lea r8, [r8 + 1]
jne 0x1400e42a0
mov byte [rbp + 0x986], 1
lea rcx, [rbp - 0x30]
call fcn.140020340
mov rcx, qword [rbp - 0x30]
test rcx, rcx
mov rsi, qword [rbp - 0x20]
cmove rsi, rcx
mov rax, qword [rbp - 0x28]
cmove rax, rcx
mov qword [rbp + 0x950], rax
mov eax, 1
cmove rcx, rax
mov qword [rbp + 0x968], rcx
mov rdx, qword [rbx - 8]
mov qword [rbp + 0x848], 0
mov dword [rbp + 0x83c], 0
mov dword [rbp + 0x520], 0
mov byte [rbp + 0x985], 0
lea rax, [rbp + 0x520]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x83c]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x848]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0xffffffff
lea rcx, [0x1401b3bb0]
xor r8d, r8d
mov r9d, 1
call sub.netapi32.dll_NetUserGetLocalGroups
test eax, eax
je 0x1400e4374
mov qword [rbp + 0x910], 8
lea rax, [rbp + 0x918]
movups xmmword [rax], xmm6
jmp 0x1400e4526
mov r14d, dword [rbp + 0x83c]
test r14, r14
mov qword [rbp + 0x8c8], rsi
je 0x1400e43d7
lea rax, [r14*8]
lea rsi, [rax + rax*2]
movzx eax, byte [0x1402448a8]
mov rax, qword [0x1402443c8]
test rax, rax
jne 0x1400e43bc
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1400e52f2
mov qword [0x1402443c8], rax
mov rcx, rax
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapAlloc]
mov rdi, rax
test rax, rax
jne 0x1400e43dc
jmp 0x1400e52f2
mov edi, 8
mov qword [rbp + 0x910], rdi
mov qword [rbp + 0x918], r14
mov qword [rbp + 0x920], 0
mov r13, qword [rbp + 0x848]
test r13, r13
je 0x1400e4432
mov esi, dword [rbp + 0x83c]
cmp r14d, esi
jae 0x1400e4468
mov byte [rbp + 0x985], 1
lea rcx, [rbp + 0x910]
mov rdx, rsi
call fcn.1401687f0
mov rdi, qword [rbp + 0x910]
mov rax, qword [rbp + 0x920]
jmp 0x1400e447a
mov rax, qword [rbp + 0x920]
mov qword [rbp + 0x8e0], rax
mov rax, qword [rbp + 0x910]
mov qword [rbp + 0x8d0], rax
mov rax, qword [rbp + 0x918]
mov qword [rbp + 0x8d8], rax
mov rsi, qword [rbp + 0x8c8]
jmp 0x1400e4561
mov eax, 0
mov edx, 0
test esi, esi
je 0x1400e4518
mov rdx, rax
xor r14d, r14d
jmp 0x1400e44c2
movaps xmmword [rbp + 0x800], xmm6
mov eax, 1
mov rdx, qword [rbp + 0x988]
lea rcx, [rdx + rdx*2]
mov qword [rdi + rcx*8], rax
movaps xmm0, xmmword [rbp + 0x800]
movups xmmword [rdi + rcx*8 + 8], xmm0
inc rdx
inc r14
cmp r14, rsi
je 0x1400e4518
mov qword [rbp + 0x988], rdx
mov rdx, qword [r13 + r14*8]
mov r8, 0xffffffffffffffff
nop word cs:[rax + rax]
cmp word [rdx + r8*2 + 2], 0
lea r8, [r8 + 1]
jne 0x1400e44e0
lea rcx, [rbp + 0x8d0]
call fcn.140020340
mov rax, qword [rbp + 0x8d0]
test rax, rax
je 0x1400e4490
lea rcx, [rbp + 0x8d8]
movups xmm0, xmmword [rcx]
movaps xmmword [rbp + 0x800], xmm0
jmp 0x1400e449c
mov qword [rbp + 0x920], rdx
mov rsi, qword [rbp + 0x8c8]
mov rcx, qword [rbp + 0x848]
mov rax, qword [rbp + 0x910]
mov qword [rbp + 0x8d0], rax
mov rax, qword [rbp + 0x918]
mov qword [rbp + 0x8d8], rax
mov rax, qword [rbp + 0x920]
mov qword [rbp + 0x8e0], rax
test rcx, rcx
je 0x1400e4561
call sub.netapi32.dll_NetApiBufferFree
mov rax, qword [rbp + 0x978]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp + 0x960]
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov dword [rbp + 0x18], 0
mov rax, qword [rbp + 0x968]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp + 0x950]
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], rsi
mov rax, qword [rbp + 0x8e0]
lea rcx, [rbp]
mov qword [rcx + 0x10], rax
mov rax, qword [rbp + 0x8d0]
mov qword [rcx], rax
mov rax, qword [rbp + 0x8d8]
mov qword [rcx + 8], rax
mov rdi, qword [rbp + 0x8a0]
cmp rdi, qword [rbp + 0x898]
jne 0x1400e45e6
lea rcx, [rbp + 0x890]
mov rdx, rdi
call fcn.1400e7e60
mov rdi, qword [rbp + 0x8a0]
mov r14, qword [rbp + 0x890]
lea rax, [rdi + rdi*4]
shl rax, 4
movups xmm0, xmmword [rbp + 0x10]
movups xmmword [r14 + rax + 0x40], xmm0
movups xmm0, xmmword [rbp - 0x30]
movups xmm1, xmmword [rbp - 0x20]
movdqu xmm2, xmmword [rbp - 0x10]
movdqu xmm3, xmmword [rbp]
movdqu xmmword [r14 + rax + 0x30], xmm3
movdqu xmmword [r14 + rax + 0x20], xmm2
movups xmmword [r14 + rax + 0x10], xmm1
movups xmmword [r14 + rax], xmm0
inc rdi
mov qword [rbp + 0x8a0], rdi
jmp 0x1400e414d
mov rcx, qword [rbp + 0x768]
cmp r12d, 0xea
jne 0x1400e4671
test rcx, rcx
je 0x1400e4080
mov byte [rbp + 0x996], 1
call sub.netapi32.dll_NetApiBufferFree
jmp 0x1400e4080
mov rcx, qword [rbp + 0x768]
test rcx, rcx
je 0x1400e4682
mov byte [rbp + 0x996], 1
call sub.netapi32.dll_NetApiBufferFree
mov dword [rbp + 0x7c0], 0
mov qword [rbp + 0x848], 0
lea rcx, [rbp + 0x7c0]
lea rdx, [rbp + 0x848]
call sub.secur32.dll_LsaEnumerateLogonSessions
mov rsi, qword [rbp + 0x848]
test eax, eax
jne 0x1400e4950
mov eax, dword [rbp + 0x7c0]
lea r13, [rsi + rax*8]
xorps xmm6, xmm6
mov qword [rbp + 0x968], r13
nop dword [rax]
mov rax, rdi
shl rax, 4
lea rbx, [rax + rax*4]
mov qword [rbp + 0x960], rdi
cmp rsi, r13
je 0x1400e4949
mov qword [rbp + 0x800], 0
mov rcx, rsi
lea rdx, [rbp + 0x800]
call sub.secur32.dll_LsaGetLogonSessionData
add rsi, 8
mov rcx, qword [rbp + 0x800]
test eax, eax
jne 0x1400e4925
test rcx, rcx
je 0x1400e4925
cmp dword [rcx + 0x40], 3
je 0x1400e47d0
movzx r12d, word [rcx + 0x10]
mov r15, qword [rcx + 0x18]
mov rdx, qword [rcx + 0x48]
lea rcx, [rbp - 0x30]
call fcn.1400e1e30
mov rax, qword [rbp - 0x30]
mov qword [rbp + 0x988], rax
test rax, rax
je 0x1400e47d0
mov rax, qword [rbp - 0x28]
mov qword [rbp + 0x978], rax
mov r13, qword [rbp - 0x20]
test rdi, rdi
je 0x1400e47f0
xor edi, edi
jmp 0x1400e4779
add rdi, 0x50
cmp rbx, rdi
je 0x1400e47f0
cmp r13, qword [r14 + rdi + 0x10]
jne 0x1400e4770
mov rcx, qword [r14 + rdi]
mov rdx, qword [rbp + 0x988]
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400e4770
cmp qword [rbp + 0x978], 0
mov rdi, qword [rbp + 0x960]
mov r13, qword [rbp + 0x968]
je 0x1400e47d0
mov rcx, qword [0x1402443c8]
xor edx, edx
mov r8, qword [rbp + 0x988]
call qword [sym.imp.kernel32.dll_HeapFree]
nop word cs:[rax + rax]
mov rcx, qword [rbp + 0x800]
test rcx, rcx
je 0x1400e46e2
call sub.secur32.dll_LsaFreeReturnBuffer
jmp 0x1400e46e2
mov byte [rbp + 0x975], 1
lea rcx, [rbp + 0x8d0]
mov rdx, qword [rbp + 0x988]
call fcn.1400e7c70
mov rax, qword [rbp + 0x8d0]
test rax, rax
je 0x1400e4820
lea rcx, [rbp + 0x8d8]
jmp 0x1400e484a
shr r12d, 1
mov byte [rbp + 0x975], 1
lea rcx, [rbp - 0x30]
mov rdx, r15
mov r8, r12
call fcn.140020340
mov rax, qword [rbp - 0x30]
test rax, rax
je 0x1400e4938
lea rcx, [rbp - 0x28]
movups xmm0, xmmword [rcx]
movaps xmmword [rbp + 0x910], xmm0
mov rdi, qword [rbp + 0x960]
movaps xmm0, xmmword [rbp + 0x910]
lea rcx, [rbp - 0x28]
movups xmmword [rcx + 0x18], xmm0
mov rdx, qword [rbp + 0x988]
mov qword [rbp - 0x30], rdx
mov rdx, qword [rbp + 0x978]
mov qword [rbp - 0x28], rdx
mov qword [rbp - 0x20], r13
mov dword [rbp + 0x18], 0
mov qword [rbp - 0x18], rax
mov qword [rbp], 8
movups xmmword [rcx + 0x30], xmm6
cmp rdi, qword [rbp + 0x898]
jne 0x1400e48d0
lea rcx, [rbp + 0x890]
mov rdx, rdi
call fcn.1400e7e60
mov r13, qword [rbp + 0x968]
mov r14, qword [rbp + 0x890]
mov rdi, qword [rbp + 0x8a0]
jmp 0x1400e48d7
mov r13, qword [rbp + 0x968]
lea rax, [rdi + rdi*4]
shl rax, 4
movups xmm0, xmmword [rbp + 0x10]
movups xmmword [r14 + rax + 0x40], xmm0
movups xmm0, xmmword [rbp - 0x30]
movups xmm1, xmmword [rbp - 0x20]
movdqu xmm2, xmmword [rbp - 0x10]
movdqu xmm3, xmmword [rbp]
movdqu xmmword [r14 + rax + 0x30], xmm3
movdqu xmmword [r14 + rax + 0x20], xmm2
movups xmmword [r14 + rax + 0x10], xmm1
movups xmmword [r14 + rax], xmm0
inc rdi
mov qword [rbp + 0x8a0], rdi
mov rcx, qword [rbp + 0x800]
test rcx, rcx
je 0x1400e46d0
call sub.secur32.dll_LsaFreeReturnBuffer
jmp 0x1400e46d0
movaps xmmword [rbp + 0x910], xmm6
mov eax, 1
jmp 0x1400e4854
mov rsi, qword [rbp + 0x848]
mov rax, qword [rbp + 0x8a0]
mov qword [rbp - 0x20], rax
movups xmm0, xmmword [rbp + 0x890]
movaps xmmword [rbp - 0x30], xmm0
test rsi, rsi
je 0x1400e497a
mov byte [rbp + 0x996], 0
mov rcx, rsi
call sub.secur32.dll_LsaFreeReturnBuffer
mov rsi, qword [rbp + 0x688]
mov rbx, qword [rbp + 0x698]
test rbx, rbx
je 0x1400e49a1
mov rdi, rsi
mov rcx, rdi
call fcn.1400e7b90
add rdi, 0x50
dec rbx
jne 0x1400e4990
cmp qword [rbp + 0x690], 0
je 0x1400e49bd
mov rcx, qword [0x1402443c8]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
mov rax, qword [rbp - 0x20]
lea rcx, [rbp + 0x688]
mov qword [rcx + 0x10], rax
movaps xmm0, xmmword [rbp - 0x30]
movups xmmword [rcx], xmm0
lea rdx, [rbp + 0x590]
mov r8d, 0x1a0
mov rcx, qword [rbp + 0x560]
call sub.VCRUNTIME140.dll_memcpy
movaps xmm6, xmmword [rbp + 0x9a0]
movaps xmm7, xmmword [rbp + 0x9b0]
movaps xmm8, xmmword [rbp + 0x9c0]
add rsp, 0xa58
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
movzx eax, byte [0x1402448a8]
mov rcx, qword [0x1402443c8]
test rcx, rcx
jne 0x1400e4a42
call qword [sym.imp.kernel32.dll_GetProcessHeap]
test rax, rax
je 0x1400e535f
mov rcx, rax
mov qword [0x1402443c8], rax
mov esi, 0x32
mov r8d, 0x32
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapAlloc]
test rax, rax
je 0x1400e535f
mov rdi, rax
movups xmm0, xmmword [0x1401b3bd2]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x1401b3bc2]
movups xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [str.failed_to_allocate_memory_for_IP_ADAPTER_ADDRESSESGetAdaptersAddresses___failed_with_code]
movdqu xmmword [rax], xmm0
mov word [rax + 0x30], 0x5345
mov rcx, r12
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov ebx, 0x32
test rdi, rdi
jne 0x1400e4ccf
mov qword [rbp + 0x8d0], rbx
mov qword [rbp + 0x8d8], rsi
mov r15, qword [rbp + 0x600]
mov rax, qword [rbp + 0x618]
mov qword [rbp + 0x960], rax
mov rax, qword [rbp + 0x620]
mov qword [rbp + 0x950], rax
mov rax, qword [rbp + 0x628]
mov qword [rbp + 0x8c8], rax
pcmpeqd xmm6, xmm6
nop word cs:[rax + rax]
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x8d0]
call fcn.1400e1a10
mov r12, qword [rbp - 0x30]
test r12, r12
je 0x1400e4c2d
mov rax, qword [rbp - 0x28]
mov qword [rbp + 0x978], rax
cmp qword [rbp + 0x960], 0
je 0x1400e4c08
mov r13, qword [rbp - 0x20]
mov rcx, qword [rbp + 0x950]
mov rdx, qword [rbp + 0x8c8]
mov r8, r12
mov r9, r13
call fcn.140029e30
mov rdi, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor eax, eax
mov qword [rbp + 0x988], rax
and rdi, r14
movdqu xmm8, xmmword [r15 + rdi]
movdqa xmm0, xmm7
pcmpeqb xmm0, xmm8
pmovmskb ebx, xmm0
test ebx, ebx
jne 0x1400e4bbc
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x1400e4c08
mov rax, qword [rbp + 0x988]
add rdi, rax
add rdi, 0x10
add rax, 0x10
jmp 0x1400e4b5e
lea eax, [rbx - 1]
and eax, ebx
mov ebx, eax
test ax, ax
je 0x1400e4b7f
tzcnt eax, ebx
add rax, rdi
and rax, r14
mov rsi, rax
neg rsi
shl rax, 3
shl rsi, 7
sub rsi, rax
cmp qword [r15 + rsi - 0x78], r13
jne 0x1400e4bb0
add rsi, r15
mov rdx, qword [rsi - 0x88]
mov rcx, r12
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400e4bb0
lea rcx, [rbp - 0x18]
movzx eax, word [rcx + 4]
mov word [rsi - 4], ax
mov eax, dword [rcx]
mov dword [rsi - 8], eax
cmp qword [rbp + 0x978], 0
je 0x1400e4af0
mov rcx, qword [0x1402443c8]
xor edx, edx
mov r8, r12
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1400e4af0
mov rcx, qword [rbp + 0x8d0]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp 0x1400e2cd9
mov r12, rsi
lea rax, [rbp + 0x890]
mov qword [rbp + 0x910], rax
lea rax, [0x1400331d0]
mov qword [rbp + 0x918], rax
lea rax, [0x1401b3c10]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x10], 0
lea rax, [rbp + 0x910]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 1
mov qword [rbp + 0x7a8], r12
mov byte [rbp + 0x977], 1
lea rcx, [rbp + 0x8d0]
lea rdx, [rbp - 0x30]
call fcn.14001ffe0
mov rdi, qword [rbp + 0x8d0]
mov rbx, qword [rbp + 0x8d8]
mov rsi, qword [rbp + 0x8e0]
mov rcx, r12
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
test rdi, rdi
je 0x1400e4a9f
test rbx, rbx
je 0x1400e2ce0
mov rcx, qword [0x1402443c8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1400e2ce0
xor eax, eax
mov r15, qword [rbp + 0x968]
mov qword [rbp + 0x700], rax
mov byte [rbp + 0x728], 1
cmp byte [r15 + 6], 0
jne 0x1400e2970
cmp byte [r15 + 5], 0
je 0x1400e2ca8
mov rax, qword [rbp + 0x668]
test rax, rax
je 0x1400e2ca8
mov rsi, qword [rbp + 0x658]
lea rdi, [rax + rax*2]
shl rdi, 5
add rdi, rsi
lea rbx, [rbp + 0x898]
lea r14, [rbp + 0x918]
lea r12, [rbp + 0x8d8]
lea r13, [rbp + 0x808]
lea r15, [rbp + 0x848]
jmp 0x1400e4d7d
add rsi, 0x60
cmp rsi, rdi
je 0x1400e2ca8
mov rax, qword [rsi]
cmp rax, 2
jne 0x1400e4f90
xor ecx, ecx
xor edx, edx
call sub.ole32.dll_CoInitializeEx
cmp eax, 2
mov qword [rbp + 0x890], 0
mov qword [rbp + 0x8a0], 0
mov qword [rbp + 0x8b0], 0
setb byte [rbp + 0x8c0]
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov edx, 0xffffffff
xor r8d, r8d
xor r9d, r9d
call sub.ole32.dll_CoInitializeSecurity
lea rcx, [rbp + 0x890]
test eax, eax
js 0x1400e4fff
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movdqu xmm2, xmmword [rbx + 0x20]
movdqu xmmword [r14 + 0x20], xmm2
movups xmmword [r14 + 0x10], xmm1
movups xmmword [r14], xmm0
mov qword [rbp + 0x910], 0
mov qword [rbp + 0x7c0], 0
lea rax, [rbp + 0x7c0]
mov qword [rsp + 0x20], rax
lea rcx, [0x1401b3568]
xor edx, edx
mov r8d, 1
lea r9, [0x1401b3578]
call sub.ole32.dll_CoCreateInstance
test eax, eax
js 0x1400e4ff8
mov rax, qword [rbp + 0x7c0]
mov qword [rbp + 0x918], rax
movups xmm0, xmmword [r14]
movups xmm1, xmmword [r14 + 0x10]
movdqu xmm2, xmmword [r14 + 0x20]
movdqu xmmword [r12 + 0x20], xmm2
movups xmmword [r12 + 0x10], xmm1
movups xmmword [r12], xmm0
mov qword [rbp + 0x8d0], 1
mov rcx, r15
lea rdx, [rbp + 0x8d0]
call fcn.1400e12b0
cmp qword [rbp + 0x848], 2
je 0x1400e5004
movups xmm0, xmmword [rbp + 0x848]
movups xmm1, xmmword [rbp + 0x858]
movdqu xmm2, xmmword [rbp + 0x868]
movaps xmmword [rbp - 0x20], xmm1
mov rax, qword [rbp + 0x878]
mov qword [rbp], rax
movdqa xmmword [rbp - 0x10], xmm2
movaps xmmword [rbp - 0x30], xmm0
cmp qword [rbp - 0x20], 0
je 0x1400e5088
mov rcx, qword [rbp - 0x18]
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call sub.ole32.dll_CoSetProxyBlanket
test eax, eax
js 0x1400e5088
mov rax, qword [rbp - 0x30]
lea rcx, [rbp - 0x28]
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movups xmm2, xmmword [rcx + 0x20]
movups xmmword [rsi + 0x28], xmm2
movups xmmword [rsi + 0x18], xmm1
movups xmmword [rsi + 8], xmm0
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movdqu xmm2, xmmword [rcx + 0x20]
movdqa xmmword [rbp + 0x7e0], xmm2
movaps xmmword [rbp + 0x7d0], xmm1
movaps xmmword [rbp + 0x7c0], xmm0
mov qword [rsi], 2
cmp rax, 2
jne 0x1400e4fba
jmp 0x1400e500b
movups xmm0, xmmword [rsi + 8]
movups xmm1, xmmword [rsi + 0x18]
movdqu xmm2, xmmword [rsi + 0x28]
movdqa xmmword [rbp + 0x7e0], xmm2
movaps xmmword [rbp + 0x7d0], xmm1
movaps xmmword [rbp + 0x7c0], xmm0
mov qword [rsi], 2
mov qword [rbp + 0x800], rax
movaps xmm0, xmmword [rbp + 0x7c0]
movaps xmm1, xmmword [rbp + 0x7d0]
movdqa xmm2, xmmword [rbp + 0x7e0]
movdqu xmmword [r13 + 0x20], xmm2
movups xmmword [r13 + 0x10], xmm1
movups xmmword [r13], xmm0
mov rcx, r15
lea rdx, [rbp + 0x800]
call fcn.1400e1420
jmp 0x1400e5016
lea rcx, [rbp + 0x910]
call fcn.1400e11d0
mov qword [rsi], 2
mov qword [rbp + 0x848], 2
mov rax, qword [rbp + 0x878]
mov qword [rsi + 0x30], rax
movups xmm0, xmmword [rbp + 0x848]
movups xmm1, xmmword [rbp + 0x858]
movdqu xmm2, xmmword [rbp + 0x868]
movdqu xmmword [rsi + 0x20], xmm2
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
cmp dword [rsi], 2
je 0x1400e4d70
mov rcx, r15
mov rdx, rsi
xor r8d, r8d
call fcn.1400e15b0
cmp dword [rbp + 0x84c], 2
je 0x1400e4d70
movss xmm0, dword [rbp + 0x848]
movss dword [rsi + 0x58], xmm0
ucomiss xmm0, dword [rsi + 0x5c]
jbe 0x1400e4d70
movss dword [rsi + 0x5c], xmm0
jmp 0x1400e4d70
lea rcx, [rbp - 0x30]
call fcn.1400e11d0
jmp 0x1400e5004
movss xmm6, dword [rbp + 0x83c]
movd xmm7, dword [rbp + 0x844]
mov rax, qword [rbp + 0x798]
mov qword [rbp], rax
movups xmm0, xmmword [rbp + 0x768]
movups xmm1, xmmword [rbp + 0x778]
movdqu xmm2, xmmword [rbp + 0x788]
movdqa xmmword [rbp - 0x10], xmm2
movaps xmmword [rbp - 0x20], xmm1
movaps xmmword [rbp - 0x30], xmm0
movzx eax, byte [0x1402448a8]
mov ecx, 8
mov edx, 1
call fcn.14006ffe0
test rax, rax
je 0x1400e5377
lea rdx, [rbp + 0x770]
movabs rcx, 0x72657475706d6f43
mov qword [rax], rcx
mov rcx, qword [rbp + 0x768]
movups xmm0, xmmword [rdx]
movups xmm1, xmmword [rdx + 0x10]
movdqu xmm2, xmmword [rdx + 0x20]
movaps xmmword [rbp + 0x520], xmm0
movaps xmmword [rbp + 0x530], xmm1
movdqa xmmword [rbp + 0x540], xmm2
cmp rcx, 3
je 0x1400e2c64
mov qword [rbp - 0x30], rcx
movaps xmm0, xmmword [rbp + 0x520]
movaps xmm1, xmmword [rbp + 0x530]
movdqa xmm2, xmmword [rbp + 0x540]
movups xmmword [rbp - 0x28], xmm0
movups xmmword [rbp - 0x18], xmm1
movdqu xmmword [rbp - 8], xmm2
mov dword [rbp + 8], esi
movd dword [rbp + 0xc], xmm7
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], 8
mov qword [rbp + 0x20], 8
movss dword [rbp + 0x28], xmm6
movss dword [rbp + 0x2c], xmm6
movzx eax, byte [0x1402448a8]
mov ecx, 0x60
mov edx, 8
call fcn.14006ffe0
test rax, rax
je 0x1400e5388
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [rax + 0x50], xmm0
movups xmm0, xmmword [rbp + 0x10]
movups xmmword [rax + 0x40], xmm0
movups xmm0, xmmword [rbp - 0x30]
movups xmm1, xmmword [rbp - 0x20]
movdqu xmm2, xmmword [rbp - 0x10]
movdqu xmm3, xmmword [rbp]
movdqu xmmword [rax + 0x30], xmm3
movdqu xmmword [rax + 0x20], xmm2
movups xmmword [rax + 0x10], xmm1
mov qword [rbp + 0x988], rax
movups xmmword [rax], xmm0
mov eax, 1
jmp 0x1400e2c72
lea r8, str.C:Users_andrea.cargo_registry_srcindex.crates.io_6f17d22bba15001f_sysinfo_0.29.10_srcwindows_sid.rs
xor ecx, ecx
xor edx, edx
call fcn.140164430
jmp 0x1400e5397
lea rcx, str.key_used_disappeared
lea r8, [0x1401b3b58]
mov edx, 0x14
call fcn.140164960
jmp 0x1400e5397
and r13b, 1
mov byte [rbp + 0x997], r13b
mov ecx, 2
mov edx, 0x14
call fcn.140162bd0
jmp 0x1400e5397
mov byte [rbp + 0x976], 1
mov ecx, 2
mov edx, 0x14
call fcn.140162bd0
jmp 0x1400e5397
mov ecx, 1
mov rdx, qword [rbp + 0x960]
call fcn.140162bd0
jmp 0x1400e5397
lea rax, str.C:Users_andrea.cargo_registry_srcindex.crates.io_6f17d22bba15001f_sysinfo_0.29.10_srcwindows_network.rs
mov edx, 0x101
mov rcx, r8
mov r8, rax
call fcn.1401644b0
jmp 0x1400e5397
mov ecx, 0x56410
call fcn.140052e20
ud2
mov ecx, 1
mov edx, 9
call fcn.140162bd0
jmp 0x1400e5397
mov ecx, 8
mov edx, 0x120
call fcn.140162bd0
jmp 0x1400e5397
lea rax, str.Expected_SID_revision_to_be_1
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
lea rax, str.called__Result::unwrap____on_an__Err__value
mov qword [rbp - 0x20], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
lea rdx, [rbp - 0x30]
mov rcx, r8
call fcn.140169ae0
jmp 0x1400e5397
mov byte [rbp + 0x985], 0
mov ecx, 8
mov rdx, rsi
call fcn.140162bd0
jmp 0x1400e5397
lea rcx, str.global_key_idle_disappearedC:Users_andrea.cargo_registry_srcindex.crates.io_6f17d22bba15001f_sysinfo_0.29.10_srcwindows_system.rs
lea r8, [0x1401b3b28]
mov edx, 0x1b
call fcn.140164960
jmp 0x1400e5397
mov ecx, 8
mov edx, 0x240
call fcn.140162bd0
jmp 0x1400e5397
mov ecx, 1
mov edx, 0x1e
call fcn.140162bd0
jmp 0x1400e5397
mov byte [rbp + 0x95f], 1
mov ecx, 1
mov edx, 5
call fcn.140162bd0
jmp 0x1400e5397
mov qword [rbp + 0x988], r12
mov ecx, 1
mov edx, 0x32
call fcn.140162bd0
jmp 0x1400e5397
mov ecx, 1
mov edx, 8
call fcn.140162bd0
jmp 0x1400e5397
mov ecx, 8
mov edx, 0x60
call fcn.140162bd0
ud2