Function at 0x14004ae70
Capabilities:
Connect to wmi namespace via wbemlocator
Get disk information
Get disk size
Get local ipv4 addresses
Get logon sessions
Get memory capacity
List groups for user account
List user accounts

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x9e8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x950], xmm8
movdqa xmmword [rbp + 0x940], xmm7
movaps xmmword [rbp + 0x930], xmm6
mov qword [rbp + 0x928], 0xfffffffffffffffe
mov qword [rbp + 0x8f8], rdx
mov qword [rbp + 0x518], rcx
mov eax, dword [0x140085284]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0x50], 0
jne 0x14004aedd
call fcn.140052940
mov eax, dword [0x140085284]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0x58]
inc qword [rax + 0x58]
movzx eax, byte [0x140085280]
mov rcx, qword [0x1400851f8]
test rcx, rcx
jne 0x14004af2a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x14004eb42
mov rcx, rax
mov qword [0x1400851f8], rax
mov r8d, 0x56410
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x14004eb42
mov rsi, rax
add rsi, 0x56000
mov r8d, 0x410
mov rcx, rsi
mov dl, 0xff
call sub.VCRUNTIME140.dll_memset
movzx eax, byte [0x140085280]
mov rcx, qword [0x1400851f8]
test rcx, rcx
jne 0x14004af87
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x14004eb4e
mov rcx, rax
mov qword [0x1400851f8], rax
mov r8d, 9
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x14004eb4e
mov rdi, rax
movabs rax, 0x5043206c61746f54
mov qword [rdi], rax
mov byte [rdi + 8], 0x55
xorps xmm0, xmm0
movaps xmmword [rbp + 0x890], xmm0
movaps xmmword [rbp + 0x6e0], xmm0
mov qword [rbp + 0x6f0], 0
movaps xmmword [rbp + 0x780], xmm0
mov byte [rbp + 0x790], 0
movzx eax, byte [0x140085280]
mov rcx, qword [0x1400851f8]
test rcx, rcx
jne 0x14004b008
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x14004eb5f
mov rcx, rax
mov qword [0x1400851f8], rax
mov r8d, 0x120
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x14004eb5f
mov rbx, rax
mov eax, dword [0x140085284]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0x50], 0
jne 0x14004b044
call fcn.140052940
mov eax, dword [0x140085284]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movdqu xmm8, xmmword [rax + 0x58]
inc qword [rax + 0x58]
pxor xmm7, xmm7
movdqa xmmword [rbp - 0x30], xmm7
mov qword [rbp - 0x20], 0
mov qword [rbp + 0x538], 0
mov rax, qword [0x140085040]
lea r14, [rbp + 0x538]
mov rcx, r14
call rax
mov rax, qword [rbp + 0x538]
movabs rcx, 0x19db1ded53e8000
cmp rax, rcx
jge 0x14004b0b0
xor eax, eax
jmp 0x14004b0f4
movabs rcx, 0xfe624e212ac18000
add rax, rcx
movabs rcx, 0xd6bf94d5e57a42bd
mul rcx
mov r15, rdx
shr r15, 0x17
call sub.KERNEL32.dll_GetTickCount64
shr rax, 3
movabs rcx, 0x20c49ba5e353f7cf
mul rcx
shr rdx, 4
xor eax, eax
sub r15, rdx
cmovae rax, r15
mov qword [rbp + 0x578], rsi
mov qword [rbp + 0x580], 0x3ff
mov qword [rbp + 0x588], 0x380
mov qword [rbp + 0x590], 0
movups xmmword [rbp + 0x598], xmm6
movdqu xmmword [rbp + 0x5d8], xmm7
movdqu xmmword [rbp + 0x5e8], xmm7
mov qword [rbp + 0x648], rdi
mov qword [rbp + 0x650], 9
mov qword [rbp + 0x658], 9
mov qword [rbp + 0x660], 1
movaps xmm0, xmmword [rbp + 0x890]
movups xmmword [rbp + 0x668], xmm0
mov qword [rbp + 0x678], 1
movaps xmm0, xmmword [rbp + 0x6e0]
movups xmmword [rbp + 0x680], xmm0
mov rcx, qword [rbp + 0x6f0]
mov qword [rbp + 0x690], rcx
movups xmm0, xmmword [rbp + 0x830]
movups xmmword [rbp + 0x698], xmm0
mov qword [rbp + 0x6a8], 0
mov dword [rbp + 0x6b0], 0
mov qword [rbp + 0x6b8], 8
movaps xmm0, xmmword [rbp + 0x780]
movups xmmword [rbp + 0x6c0], xmm0
movzx ecx, byte [rbp + 0x790]
mov byte [rbp + 0x6d0], cl
mov ecx, dword [rbp + 0x910]
mov edx, dword [rbp + 0x913]
mov dword [rbp + 0x6d1], ecx
mov dword [rbp + 0x6d4], edx
mov qword [rbp + 0x600], 8
movdqu xmmword [rbp + 0x608], xmm7
mov qword [rbp + 0x618], rbx
mov qword [rbp + 0x620], 2
mov qword [rbp + 0x628], 0
mov qword [rbp + 0x538], 0
lea rcx, [0x14007c3c0]
mov qword [rbp + 0x5a8], rcx
movaps xmm0, xmmword [rbp - 0x30]
movups xmmword [rbp + 0x5b0], xmm0
mov rcx, qword [rbp - 0x20]
mov qword [rbp + 0x5c0], rcx
movdqu xmmword [rbp + 0x5c8], xmm8
mov qword [rbp + 0x5f8], rax
mov qword [rbp + 0x630], 8
movdqu xmmword [rbp + 0x638], xmm7
mov rax, qword [rbp + 0x8f8]
cmp byte [rax + 4], 0
je 0x14004b34e
xorps xmm6, xmm6
movaps xmmword [rbp + 0x6e0], xmm6
movaps xmmword [rbp + 0x710], xmm6
movaps xmmword [rbp + 0x700], xmm6
movaps xmmword [rbp + 0x6f0], xmm6
mov dword [rbp + 0x6e0], 0x40
lea rcx, [rbp + 0x6e0]
call sub.KERNEL32.dll_GlobalMemoryStatusEx
movups xmm0, xmmword [rbp + 0x6e8]
movups xmmword [rbp + 0x5d8], xmm0
movaps xmmword [rbp + 0x20], xmm6
movaps xmmword [rbp + 0x10], xmm6
movaps xmmword [rbp], xmm6
movaps xmmword [rbp - 0x10], xmm6
movaps xmmword [rbp - 0x20], xmm6
movaps xmmword [rbp - 0x30], xmm6
mov qword [rbp + 0x30], 0
lea rcx, [rbp - 0x30]
mov edx, 0x68
call sub.PSAPI.DLL_GetPerformanceInfo
cmp eax, 1
jne 0x14004b347
mov rdx, qword [rbp - 0x20]
mov r9, qword [rbp - 0x10]
xor r10d, r10d
sub rdx, r9
cmovb rdx, r10
mov rcx, qword [rbp + 0x20]
mov rax, rcx
mul rdx
mov r8, rax
mov r11, 0xffffffffffffffff
cmovo r8, r11
mov rdx, qword [rbp - 0x28]
sub rdx, r9
cmovb rdx, r10
mov rax, rcx
mul rdx
cmovo rax, r11
mov qword [rbp + 0x5e8], r8
mov qword [rbp + 0x5f0], rax
mov rax, qword [rbp + 0x8f8]
movzx ebx, byte [rax + 0xb]
cmp bl, 2
je 0x14004b80f
lea r12, [rbp + 0x648]
movzx r15d, byte [rax + 0xc]
cmp qword [rbp + 0x538], 0
je 0x14004b4f1
mov rcx, qword [rbp + 0x568]
call sub.pdh.dll_PdhCollectQueryData
mov rdx, qword [rbp + 0x690]
test rdx, rdx
je 0x14004b3bc
mov r8, qword [rbp + 0x6a0]
lea rcx, [rbp + 0x538]
call fcn.140050050
test eax, eax
je 0x14004eb9a
movss xmm1, dword [0x14005f780]
subss xmm1, xmm0
movss dword [rbp + 0x6b0], xmm1
mov r8d, r15d
and r8b, 1
and bl, 1
mov rcx, r12
mov edx, ebx
call fcn.1400501b0
mov rax, qword [rbp + 0x6c8]
test rax, rax
je 0x14004b44c
mov rdi, qword [rbp + 0x6b8]
imul rbx, rax, 0x70
xor r14d, r14d
lea rsi, [rbp + 0x538]
movss xmm6, dword [0x14005f780]
jmp 0x14004b417
movaps xmm1, xmm6
subss xmm1, xmm0
movss dword [rdi + r14 + 0x68], xmm1
add r14, 0x70
cmp rbx, r14
je 0x14004b44c
mov rdx, qword [rdi + r14 + 0x48]
test rdx, rdx
je 0x14004b40e
mov r8, qword [rdi + r14 + 0x58]
mov rcx, rsi
call fcn.140050050
test eax, eax
jne 0x14004b400
lea rcx, str.key_used_disappeared
lea r8, [0x14007bea8]
mov edx, 0x14
call fcn.140057c80
ud2
test r15b, 1
mov rax, qword [rbp + 0x8f8]
je 0x14004b80f
cmp byte [rbp + 0x6d0], 0
jne 0x14004b80f
mov rsi, qword [rbp + 0x6c8]
lea rcx, [rbp - 0x30]
mov rdx, rsi
call fcn.140050ce0
mov rdi, qword [rbp + 0x6b8]
mov r8, qword [rbp - 0x30]
mov rax, qword [rbp - 0x28]
test rsi, rsi
je 0x14004b4cb
mov rcx, qword [rbp - 0x20]
shl rcx, 3
imul rdx, rsi, 0x70
xor r9d, r9d
xor r10d, r10d
nop word cs:[rax + rax]
cmp rcx, r10
je 0x14004b4cb
mov r11, qword [r8 + r10]
mov qword [rdi + r9 + 0x60], r11
add r10, 8
add r9, 0x70
cmp rdx, r9
jne 0x14004b4b0
test rax, rax
je 0x14004b4df
mov rcx, qword [0x1400851f8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rsi, rsi
je 0x14004e59b
mov rax, qword [rdi + 0x60]
jmp 0x14004e59d
mov qword [rbp - 0x30], 0
lea r8, [rbp - 0x30]
xor ecx, ecx
xor edx, edx
call sub.pdh.dll_PdhOpenQueryA
test eax, eax
je 0x14004b52b
mov qword [r14], 0
cmp qword [rbp + 0x538], 0
mov rax, qword [rbp + 0x8f8]
jne 0x14004b5c6
jmp 0x14004b80f
mov rsi, qword [rbp - 0x30]
mov eax, dword [0x140085284]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0x50], 0
jne 0x14004b551
call fcn.140052940
lea rax, [0x14007c3c0]
mov qword [rbp + 0x538], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x540], xmm0
mov qword [rbp + 0x550], 0
mov eax, dword [0x140085284]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm0, xmmword [rax + 0x58]
inc qword [rax + 0x58]
movups xmmword [rbp + 0x558], xmm0
mov qword [rbp + 0x568], rsi
lea r14, [rbp + 0x570]
mov qword [r14], 0
cmp qword [rbp + 0x538], 0
mov rax, qword [rbp + 0x8f8]
je 0x14004b80f
movzx eax, byte [0x140085280]
mov rcx, qword [0x1400851f8]
test rcx, rcx
jne 0x14004b5f2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x14004ebb4
mov rcx, rax
mov qword [0x1400851f8], rax
mov r8d, 0x1e
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x14004ebb4
movups xmm0, xmmword [0x14007bd7e]
movups xmmword [rax + 0xe], xmm0
movups xmm0, xmmword [str.Processor__Total___Idle_TimeProcessor____Idle_Time]
movups xmmword [rax], xmm0
mov qword [rbp + 0x6e0], rax
mov qword [rbp + 0x6e8], 0x1e
mov qword [rbp + 0x6f0], 0x1e
movzx eax, byte [0x140085280]
mov rcx, qword [0x1400851f8]
test rcx, rcx
jne 0x14004b667
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x14004ebc5
mov rcx, rax
mov qword [0x1400851f8], rax
mov r8d, 5
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x14004ebc5
lea r8, [rbp + 0x690]
mov byte [rbp + 0x908], r15b
mov r14d, r15d
and r14b, 1
mov byte [rbp + 0x900], bl
and bl, 1
mov byte [rax + 4], 0x30
mov dword [rax], 0x5f746f74
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 5
mov qword [rbp - 0x20], 5
lea rdi, [rbp + 0x6e0]
lea rdx, [rbp + 0x538]
lea r9, [rbp - 0x30]
mov rcx, rdi
call case.0x1400120f4.1632
mov rcx, r12
mov edx, ebx
mov r8d, r14d
call fcn.1400501b0
mov rax, qword [rbp + 0x6c8]
test rax, rax
je 0x14004b7e4
mov r14, qword [rbp + 0x6b8]
add r14, 0x48
imul rsi, rax, 0x70
xor ebx, ebx
nop word cs:[rax + rax]
mov qword [rbp + 0x830], rbx
inc rbx
lea r13, [rbp + 0x830]
mov qword [rbp + 0x6e0], r13
lea r15, [fcn.14000b1b0]
mov qword [rbp + 0x6e8], r15
lea rax, [0x14007bda8]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 2
mov qword [rbp - 0x10], 0
mov qword [rbp - 0x20], rdi
mov qword [rbp - 0x18], 1
lea rcx, [rbp + 0x780]
mov r12, rdi
lea rdi, [rbp - 0x30]
mov rdx, rdi
call fcn.14000a9c0
mov qword [rbp + 0x890], r13
mov qword [rbp + 0x898], r15
lea rax, str._rustc_13e6f24b9adda67852fb86538541adaa68aff6e8librarycore_srccellonce.rsreentrant_init
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 2
mov qword [rbp - 0x10], 0
lea rax, [rbp + 0x890]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 1
mov rcx, r12
mov rdx, rdi
mov rdi, r12
call fcn.14000a9c0
lea rcx, [rbp + 0x780]
lea rdx, [rbp + 0x538]
mov r8, r14
mov r9, r12
call case.0x1400120f4.1632
add r14, 0x70
add rsi, 0xffffffffffffff90
jne 0x14004b710
cmp qword [rbp + 0x538], 0
mov rax, qword [rbp + 0x8f8]
movzx r15d, byte [rbp + 0x908]
movzx ebx, byte [rbp + 0x900]
lea r12, [rbp + 0x648]
jne 0x14004b375
cmp byte [rax + 6], 0
je 0x14004e5bc
xor ecx, ecx
xor edx, edx
call sub.ole32.dll_CoInitializeEx
mov esi, eax
cmp eax, 2
setb bl
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov edx, 0xffffffff
xor r8d, r8d
xor r9d, r9d
call sub.ole32.dll_CoInitializeSecurity
test eax, eax
js 0x14004ba90
mov qword [rbp + 0x910], 0
lea rax, [rbp + 0x910]
mov qword [rsp + 0x20], rax
lea rcx, [0x14007c1e8]
lea r9, [0x14007c1f8]
xor edx, edx
mov r8d, 1
call sub.ole32.dll_CoCreateInstance
test eax, eax
js 0x14004ba90
mov rax, qword [rbp + 0x910]
mov qword [rbp + 0x6e0], 1
mov qword [rbp + 0x6e8], rax
mov qword [rbp + 0x6f0], 0
mov qword [rbp + 0x700], 0
mov byte [rbp + 0x710], bl
lea rcx, [rbp + 0x780]
lea rdx, [rbp + 0x6e0]
call fcn.1400524d0
mov r15, qword [rbp + 0x780]
cmp r15, 2
je 0x14004ba9a
mov rsi, qword [rbp + 0x788]
mov r12, qword [rbp + 0x790]
mov rdi, qword [rbp + 0x798]
mov r13, qword [rbp + 0x7a0]
mov rbx, qword [rbp + 0x7a8]
movzx r14d, byte [rbp + 0x7b0]
test r12, r12
je 0x14004e24f
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
mov rcx, rdi
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call sub.ole32.dll_CoSetProxyBlanket
test eax, eax
js 0x14004e24f
lea rax, [rbp + 0x7b1]
mov ecx, dword [rax]
mov eax, dword [rax + 3]
mov dword [rbp + 4], eax
mov dword [rbp + 1], ecx
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x28], rsi
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], r13
mov qword [rbp - 8], rbx
mov byte [rbp], r14b
lea rcx, [rbp + 0x890]
lea rdx, [rbp - 0x30]
call fcn.140052610
mov rax, qword [rbp + 0x890]
cmp rax, 2
je 0x14004ba9a
movups xmm0, xmmword [rbp + 0x898]
movups xmm1, xmmword [rbp + 0x8a8]
movdqu xmm2, xmmword [rbp + 0x8b8]
movdqu xmmword [rbp + 0x858], xmm2
movups xmmword [rbp + 0x848], xmm1
movups xmmword [rbp + 0x838], xmm0
mov qword [rbp + 0x830], rax
lea rcx, [rbp + 0x780]
lea rdx, [rbp + 0x830]
mov r8b, 1
call fcn.140052760
mov r12, qword [rbp + 0x830]
mov r13, qword [rbp + 0x838]
mov rax, qword [rbp + 0x840]
mov rbx, qword [rbp + 0x848]
mov r15, qword [rbp + 0x850]
mov r14, qword [rbp + 0x858]
movzx esi, byte [rbp + 0x860]
mov edi, dword [rbp + 0x784]
cmp edi, 2
jne 0x14004e996
test r15, r15
je 0x14004ba62
test r14, r14
je 0x14004ba62
mov rdi, rax
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x10]
mov rax, rdi
test rax, rax
je 0x14004ba75
test rbx, rbx
je 0x14004ba75
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
test r12, r12
je 0x14004ba89
test r13, r13
je 0x14004ba89
mov rax, qword [r13]
mov rcx, r13
call qword [rax + 0x10]
test sil, sil
jne 0x14004ba95
jmp 0x14004ba9a
cmp esi, 2
jae 0x14004ba9a
call sub.ole32.dll_CoUninitialize
mov esi, 8
xor r13d, r13d
mov rdi, qword [rbp + 0x610]
test rdi, rdi
je 0x14004bbaa
mov rbx, qword [rbp + 0x600]
mov r14, qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14004badd
add rbx, 0x60
dec rdi
je 0x14004bbaa
cmp qword [rbx + 0x48], 0
je 0x14004baf4
mov r8, qword [rbx + 0x40]
mov rcx, qword [0x1400851f8]
xor edx, edx
call r14
cmp dword [rbx], 2
je 0x14004bad0
mov rcx, qword [rbx + 0x28]
cmp qword [rbx + 0x20], 0
mov qword [rbx + 0x20], 0
je 0x14004bb17
test rcx, rcx
je 0x14004bb17
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx + 0x18]
cmp qword [rbx + 0x10], 0
mov qword [rbx + 0x10], 0
je 0x14004bb35
test rcx, rcx
je 0x14004bb35
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbx + 8]
cmp qword [rbx], 0
mov qword [rbx], 0
je 0x14004bb51
test rcx, rcx
je 0x14004bb51
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp byte [rbx + 0x30], 0
je 0x14004bb5c
call sub.ole32.dll_CoUninitialize
cmp qword [rbx], 0
je 0x14004bb71
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14004bb71
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp qword [rbx + 0x10], 0
je 0x14004bb87
mov rcx, qword [rbx + 0x18]
test rcx, rcx
je 0x14004bb87
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp qword [rbx + 0x20], 0
je 0x14004bad0
mov rcx, qword [rbx + 0x28]
test rcx, rcx
je 0x14004bad0
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x14004bad0
cmp qword [rbp + 0x608], 0
je 0x14004bbca
mov r8, qword [rbp + 0x600]
mov rcx, qword [0x1400851f8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbp + 0x600], rsi
mov qword [rbp + 0x608], r13
mov qword [rbp + 0x610], r13
mov rax, qword [rbp + 0x8f8]
cmp byte [rax + 1], 0
je 0x14004ce1d
mov qword [rbp + 0x890], 0
lea rcx, [rbp + 0x890]
call sub.IPHLPAPI.DLL_GetIfTable2
test eax, eax
je 0x14004cfe4
mov rax, qword [rbp + 0x8f8]
movzx edx, word [rax + 8]
cmp dl, 2
je 0x14004bc42
mov rax, qword [rbp + 0x8f8]
movzx eax, byte [rax + 0xa]
shl eax, 0x10
or edx, eax
lea rcx, [rbp + 0x538]
call fcn.14004ec60
mov rax, qword [rbp + 0x8f8]
cmp byte [rax + 2], 0
je 0x14004cf5f
call sub.KERNEL32.dll_GetLogicalDrives
mov dword [rbp + 0x8d0], eax
test eax, eax
je 0x14004c225
lea rax, [rbp + 0x8d0]
mov qword [rbp + 0x910], rax
movabs rax, 0x2000000001
mov qword [rbp + 0x918], rax
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
xor r8d, r8d
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 2
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 1
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 3
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 2
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 4
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 3
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 5
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 4
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 6
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 5
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 7
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 6
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 8
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 7
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 9
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 8
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 0xa
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 9
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 0xb
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 0xa
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 0xc
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 0xb
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 0xd
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 0xc
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 0xe
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 0xd
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 0xf
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 0xe
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 0x10
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 0xf
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 0x11
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 0x10
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 0x12
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 0x11
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 0x13
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 0x12
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 0x14
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 0x13
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 0x15
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 0x14
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 0x16
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 0x15
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 0x17
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 0x16
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 0x18
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 0x17
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 0x19
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 0x18
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 0x1a
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 0x19
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 0x1b
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 0x1a
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 0x1c
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 0x1b
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 0x1d
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 0x1c
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 0x1e
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 0x1d
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 0x1f
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 0x1e
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
mov dword [rbp + 0x918], 0x20
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x910]
mov r8d, 0x1f
call fcn.140051680
mov rdi, qword [rbp - 0x30]
cmp rdi, 3
jne 0x14004c246
xorps xmm0, xmm0
movaps xmmword [rbp - 0x30], xmm0
mov esi, 8
mov rdi, qword [rbp + 0x628]
test rdi, rdi
jne 0x14004c3e0
jmp 0x14004c469
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x780]
mov r8d, 0x88
call sub.VCRUNTIME140.dll_memcpy
movzx eax, byte [0x140085280]
mov rcx, qword [0x1400851f8]
test rcx, rcx
jne 0x14004c288
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x14004eb89
mov rcx, rax
mov qword [0x1400851f8], rax
mov r8d, 0x240
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x14004eb89
mov rsi, rax
mov qword [rax], rdi
mov rcx, rax
add rcx, 8
lea rdx, [rbp + 0x780]
mov r8d, 0x88
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x890], rsi
mov qword [rbp + 0x898], 4
mov qword [rbp + 0x8a0], 1
movups xmm0, xmmword [rbp + 0x910]
movaps xmmword [rbp + 0x830], xmm0
mov r8d, dword [rbp + 0x838]
mov ebx, dword [rbp + 0x83c]
cmp r8d, ebx
jae 0x14004c3bb
mov edi, 1
lea r14, [rbp - 0x30]
lea r15, [rbp + 0x830]
nop
lea r13d, [r8 + 1]
mov rcx, r14
mov rdx, r15
call fcn.140051680
mov r12, qword [rbp - 0x30]
cmp r12, 3
jne 0x14004c336
mov r8d, r13d
cmp ebx, r13d
jne 0x14004c310
jmp 0x14004c3bb
mov dword [rbp + 0x838], r13d
mov r8d, 0x88
lea rbx, [rbp + 0x6e0]
mov rcx, rbx
lea rdx, [rbp - 0x28]
call sub.VCRUNTIME140.dll_memcpy
cmp rdi, qword [rbp + 0x898]
je 0x14004c3a3
lea rax, [rdi + rdi*8]
shl rax, 4
mov qword [rsi + rax], r12
lea rcx, [rsi + rax]
add rcx, 8
mov r8d, 0x88
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
inc rdi
mov qword [rbp + 0x8a0], rdi
mov r8d, dword [rbp + 0x838]
mov ebx, dword [rbp + 0x83c]
cmp r8d, ebx
jb 0x14004c310
jmp 0x14004c3bb
lea rcx, [rbp + 0x890]
mov rdx, rdi
call fcn.14005a270
mov rsi, qword [rbp + 0x890]
jmp 0x14004c35f
mov rsi, qword [rbp + 0x890]
lea rax, [rbp + 0x898]
movups xmm0, xmmword [rax]
movaps xmmword [rbp - 0x30], xmm0
mov rdi, qword [rbp + 0x628]
test rdi, rdi
je 0x14004c469
mov rbx, qword [rbp + 0x618]
add rbx, 0x68
mov r14, qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14004c40c
add rbx, 0x90
dec rdi
je 0x14004c469
cmp qword [rbx - 0x50], 0
je 0x14004c423
mov r8, qword [rbx - 0x58]
mov rcx, qword [0x1400851f8]
xor edx, edx
call r14
cmp qword [rbx - 0x30], 0
je 0x14004c43a
mov r8, qword [rbx - 0x38]
mov rcx, qword [0x1400851f8]
xor edx, edx
call r14
cmp qword [rbx - 0x18], 0
je 0x14004c451
mov r8, qword [rbx - 0x20]
mov rcx, qword [0x1400851f8]
xor edx, edx
call r14
cmp qword [rbx], 0
je 0x14004c400
mov r8, qword [rbx - 8]
mov rcx, qword [0x1400851f8]
xor edx, edx
call r14
jmp 0x14004c400
cmp qword [rbp + 0x620], 0
je 0x14004c489
mov r8, qword [rbp + 0x618]
mov rcx, qword [0x1400851f8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rbp + 0x618], rsi
movaps xmm0, xmmword [rbp - 0x30]
movups xmmword [rbp + 0x620], xmm0
mov rax, qword [rbp + 0x8f8]
cmp byte [rax + 7], 0
je 0x14004d5fd
mov qword [rbp + 0x830], 8
xorps xmm6, xmm6
movups xmmword [rbp + 0x838], xmm6
mov dword [rbp + 0x77c], 0
lea r14, [rbp + 0x818]
mov r13, qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
mov qword [rbp + 0x808], 0
mov dword [rbp + 0x814], 0
mov dword [rbp + 0x778], 0
lea rax, [rbp + 0x77c]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x778]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x814]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xffffffff
xor ecx, ecx
xor edx, edx
mov r8d, 2
lea r9, [rbp + 0x808]
call sub.NETAPI32.dll_NetUserEnum
test eax, eax
je 0x14004c550
cmp eax, 0xea
jne 0x14004d475
mov dword [rbp + 0x828], eax
mov r12, qword [rbp + 0x808]
mov eax, dword [rbp + 0x814]
test rax, rax
je 0x14004cdf7
lea r15, [r12 + rax*8]
mov qword [rbp + 0x8f8], r15
jmp 0x14004c58d
add r12, 8
cmp r12, r15
je 0x14004cdf0
cmp qword [r12], 0
je 0x14004c580
mov qword [rbp + 0x818], 0
mov rdx, qword [r12]
xor ecx, ecx
mov r8d, 0x17
mov r9, r14
call sub.NETAPI32.dll_NetUserGetInfo
mov rcx, qword [rbp + 0x818]
test eax, eax
je 0x14004c5d0
test rcx, rcx
jne 0x14004cdc0
jmp 0x14004c580
mov rsi, qword [rcx + 0x20]
test rsi, rsi
je 0x14004cdb0
mov rcx, rsi
call sub.ADVAPI32.dll_IsValidSid
test eax, eax
je 0x14004cdb0
mov rcx, rsi
call sub.ADVAPI32.dll_GetLengthSid
mov ebx, eax
test eax, eax
je 0x14004c69b
mov r8d, ebx
mov rax, qword [0x1400851f8]
test rax, rax
mov qword [rbp + 0x880], r8
jne 0x14004c632
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x14004eaca
mov qword [0x1400851f8], rax
mov r8, qword [rbp + 0x880]
mov rcx, rax
mov edx, 8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x14004eaca
mov ecx, ebx
mov rdx, rax
mov rdi, rax
mov r8, rsi
call sub.ADVAPI32.dll_CopySid
test eax, eax
je 0x14004c6b7
cmp byte [rdi], 1
mov r8, rdi
jne 0x14004eadd
lea rcx, [rbp + 0x6e0]
mov qword [rbp + 0x888], r8
mov rdx, r8
call fcn.1400522e0
mov rax, qword [rbp + 0x6e0]
test rax, rax
je 0x14004c6d3
mov qword [rbp + 0x870], rax
lea rax, [rbp + 0x6e8]
jmp 0x14004c70e
mov edx, 1
mov ecx, ebx
mov r8, rsi
call sub.ADVAPI32.dll_CopySid
test eax, eax
je 0x14004cdb0
jmp 0x14004eb10
test ebx, ebx
je 0x14004cdb0
mov r8, rdi
mov rcx, qword [0x1400851f8]
xor edx, edx
call r13
jmp 0x14004cdb0
mov rdx, qword [r12]
mov r8, 0xffffffffffffffff
nop
cmp word [rdx + r8*2 + 2], 0
lea r8, [r8 + 1]
jne 0x14004c6e0
lea rcx, [rbp - 0x30]
call fcn.14000ad20
mov rax, qword [rbp - 0x30]
test rax, rax
je 0x14004c7f2
mov qword [rbp + 0x870], rax
lea rax, [rbp - 0x28]
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0x910], xmm0
mov rdx, qword [r12]
mov qword [rbp + 0x8d0], 0
mov dword [rbp + 0x87c], 0
mov dword [rbp + 0x774], 0
lea rax, [rbp + 0x774]
mov qword [rsp + 0x38], rax
lea rax, [rbp + 0x87c]
mov qword [rsp + 0x30], rax
lea rax, [rbp + 0x8d0]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0xffffffff
lea rcx, [0x14007c110]
xor r8d, r8d
mov r9d, 1
call sub.NETAPI32.dll_NetUserGetLocalGroups
test eax, eax
je 0x14004c79a
mov qword [rbp + 0x890], 8
lea rax, [rbp + 0x898]
movups xmmword [rax], xmm6
jmp 0x14004cc9d
mov edi, dword [rbp + 0x87c]
test rdi, rdi
je 0x14004c80a
lea rax, [rdi*8]
lea rsi, [rax + rax*2]
movzx eax, byte [0x140085280]
mov rax, qword [0x1400851f8]
test rax, rax
jne 0x14004c7da
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x14004eb33
mov qword [0x1400851f8], rax
mov rcx, rax
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
jne 0x14004c80f
jmp 0x14004eb33
movaps xmmword [rbp + 0x910], xmm6
mov eax, 1
mov qword [rbp + 0x870], rax
jmp 0x14004c718
mov eax, 8
mov qword [rbp + 0x890], rax
mov qword [rbp + 0x898], rdi
mov qword [rbp + 0x8a0], 0
mov rcx, qword [rbp + 0x8d0]
mov qword [rbp + 0x8e8], rcx
test rcx, rcx
je 0x14004ccd1
mov esi, dword [rbp + 0x87c]
cmp edi, esi
jb 0x14004cdca
mov ecx, 0
mov r8d, 0
test esi, esi
je 0x14004cc96
mov r8, rcx
xor r9d, r9d
mov qword [rbp + 0x8e0], r12
mov qword [rbp + 0x8d8], rax
mov qword [rbp + 0x820], rsi
jmp 0x14004c8ae
movaps xmm0, xmmword [rbp - 0x30]
movaps xmmword [rbp + 0x6e0], xmm0
lea rcx, [r8 + r8*2]
mov qword [rax + rcx*8], rdx
movaps xmm0, xmmword [rbp + 0x6e0]
movups xmmword [rax + rcx*8 + 8], xmm0
inc r8
inc r9
cmp r9, rsi
je 0x14004cc96
mov qword [rbp + 0x908], r8
mov rax, qword [rbp + 0x8e8]
mov qword [rbp + 0x900], r9
mov rbx, qword [rax + r9*8]
mov rsi, 0xffffffffffffffff
nop
cmp word [rbx + rsi*2 + 2], 0
lea rsi, [rsi + 1]
jne 0x14004c8d0
test rsi, rsi
je 0x14004c930
js 0x14004eac3
movzx eax, byte [0x140085280]
mov rax, qword [0x1400851f8]
test rax, rax
jne 0x14004c910
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x14004eab4
mov qword [0x1400851f8], rax
mov rcx, rax
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r15, rax
test rax, rax
jne 0x14004c936
jmp 0x14004eab4
mov r15d, 1
lea r13, [rbx + rsi*2]
mov qword [rbp + 0x780], r15
mov qword [rbp + 0x788], rsi
mov qword [rbp + 0x790], 0
xor r12d, r12d
cmp rbx, r13
jne 0x14004c977
jmp 0x14004cbd8
mov byte [r15 + r12], sil
inc r12
mov qword [rbp + 0x790], r12
cmp rbx, r13
je 0x14004cbd8
lea rdx, [rbx + 2]
movzx ecx, word [rbx]
movzx eax, cx
mov r8d, ecx
and r8d, 0xf800
cmp r8d, 0xd800
jne 0x14004ca30
cmp eax, 0xdbff
ja 0x14004cc30
cmp rdx, r13
je 0x14004cc30
movzx eax, word [rdx]
lea edx, [rax + 0x2000]
movzx edx, dx
cmp edx, 0xfc00
jb 0x14004cc30
add rbx, 4
and ecx, 0x3ff
and eax, 0x3ff
shl rcx, 0x1a
shl rax, 0x10
or rax, rcx
movabs rcx, 0x100000000
add rax, rcx
mov rsi, rax
shr rsi, 0x10
cmp esi, 0x80
jb 0x14004ca46
mov dword [rbp + 0x8f4], 0
cmp esi, 0x800
jae 0x14004ca80
shr eax, 0x16
or al, 0xc0
mov byte [rbp + 0x8f4], al
and sil, 0x3f
or sil, 0x80
mov byte [rbp + 0x8f5], sil
mov esi, 2
jmp 0x14004cafc
shl rax, 0x10
mov rbx, rdx
mov rsi, rax
shr rsi, 0x10
cmp esi, 0x80
jae 0x14004c9fa
cmp r12, qword [rbp + 0x788]
jne 0x14004c960
lea rcx, [rbp + 0x780]
mov rdx, r12
call fcn.14000a900
mov r15, qword [rbp + 0x780]
mov r12, qword [rbp + 0x790]
jmp 0x14004c960
mov rcx, rax
cmp esi, 0x10000
jae 0x14004cabb
shr rcx, 0x1c
or cl, 0xe0
mov byte [rbp + 0x8f4], cl
shr eax, 0x16
and al, 0x3f
or al, 0x80
mov byte [rbp + 0x8f5], al
and sil, 0x3f
or sil, 0x80
mov byte [rbp + 0x8f6], sil
mov esi, 3
jmp 0x14004cafc
shr rcx, 0x22
or cl, 0xf0
mov byte [rbp + 0x8f4], cl
mov rcx, rax
shr rcx, 0x1c
and cl, 0x3f
or cl, 0x80
mov byte [rbp + 0x8f5], cl
shr eax, 0x16
and al, 0x3f
or al, 0x80
mov byte [rbp + 0x8f6], al
and sil, 0x3f
or sil, 0x80
mov byte [rbp + 0x8f7], sil
mov esi, 4
mov rax, qword [rbp + 0x788]
mov rcx, rax
sub rcx, r12
cmp rcx, rsi
jae 0x14004cb50
mov r14, r12
add r14, rsi
jb 0x14004ea9f
lea rdi, [rax + rax]
cmp rdi, r14
cmovbe rdi, r14
cmp rdi, 9
mov ecx, 8
cmovb rdi, rcx
test rax, rax
je 0x14004cb56
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x20], rax
mov eax, 1
jmp 0x14004cb58
lea r14, [r12 + rsi]
jmp 0x14004cbb0
xor eax, eax
mov rdx, rdi
not rdx
shr rdx, 0x3f
mov qword [rbp - 0x28], rax
lea rcx, [rbp + 0x6e0]
mov r8, rdi
lea r9, [rbp - 0x30]
call fcn.14000a790
cmp qword [rbp + 0x6e0], 0
mov rcx, qword [rbp + 0x6e8]
je 0x14004cb9e
movabs rax, 0x8000000000000001
cmp rcx, rax
je 0x14004cbb0
jmp 0x14004ea9a
mov qword [rbp + 0x780], rcx
mov qword [rbp + 0x788], rdi
mov r15, rcx
nop
add r12, r15
mov rcx, r12
lea rdx, [rbp + 0x8f4]
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov qword [rbp + 0x790], r14
mov r12, r14
cmp rbx, r13
jne 0x14004c977
mov rdx, qword [rbp + 0x780]
lea rcx, [rbp + 0x788]
movups xmm0, xmmword [rcx]
movaps xmmword [rbp - 0x30], xmm0
test rdx, rdx
mov r13, qword [sym.imp.KERNEL32.dll_HeapFree]
lea r14, [rbp + 0x818]
mov r12, qword [rbp + 0x8e0]
mov r15, qword [rbp + 0x8f8]
mov rax, qword [rbp + 0x8d8]
mov rsi, qword [rbp + 0x820]
mov r8, qword [rbp + 0x908]
mov r9, qword [rbp + 0x900]
jne 0x14004c880
jmp 0x14004cc85
cmp qword [rbp + 0x788], 0
mov r13, qword [sym.imp.KERNEL32.dll_HeapFree]
je 0x14004cc54
mov r8, qword [rbp + 0x780]
mov rcx, qword [0x1400851f8]
xor edx, edx
call r13
lea r14, [rbp + 0x818]
mov r12, qword [rbp + 0x8e0]
mov r15, qword [rbp + 0x8f8]
mov rax, qword [rbp + 0x8d8]
mov rsi, qword [rbp + 0x820]
mov r8, qword [rbp + 0x908]
mov r9, qword [rbp + 0x900]
movaps xmmword [rbp + 0x6e0], xmm6
mov edx, 1
jmp 0x14004c88b
mov qword [rbp + 0x8a0], r8
mov rcx, qword [rbp + 0x8d0]
mov rax, qword [rbp + 0x890]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp + 0x898]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp + 0x8a0]
mov qword [rbp - 0x20], rax
test rcx, rcx
je 0x14004ccf2
call sub.NETAPI32.dll_NetApiBufferFree
jmp 0x14004ccf2
mov rax, qword [rbp + 0x8a0]
mov qword [rbp - 0x20], rax
mov rax, qword [rbp + 0x890]
mov qword [rbp - 0x30], rax
mov rax, qword [rbp + 0x898]
mov qword [rbp - 0x28], rax
mov rax, qword [rbp - 0x30]
mov qword [rbp + 0x6e0], rax
mov rax, qword [rbp - 0x28]
mov qword [rbp + 0x6e8], rax
mov rax, qword [rbp - 0x20]
mov qword [rbp + 0x6f0], rax
mov rdx, qword [rbp + 0x840]
cmp rdx, qword [rbp + 0x838]
jne 0x14004cd36
lea rcx, [rbp + 0x830]
call fcn.14004fd20
mov rdx, qword [rbp + 0x840]
mov r8, qword [rbp + 0x880]
mov rax, qword [rbp + 0x830]
lea rcx, [rdx + rdx*4]
shl rcx, 4
mov r9, qword [rbp + 0x888]
mov qword [rax + rcx], r9
mov qword [rax + rcx + 8], r8
mov qword [rax + rcx + 0x10], r8
mov r8, qword [rbp + 0x870]
mov qword [rax + rcx + 0x18], r8
movaps xmm0, xmmword [rbp + 0x910]
movups xmmword [rax + rcx + 0x20], xmm0
movaps xmm0, xmmword [rbp + 0x6e0]
movups xmmword [rax + rcx + 0x30], xmm0
mov r8, qword [rbp + 0x6f0]
mov qword [rax + rcx + 0x40], r8
mov dword [rax + rcx + 0x48], 0
inc rdx
mov qword [rbp + 0x840], rdx
nop word cs:[rax + rax]
mov rcx, qword [rbp + 0x818]
test rcx, rcx
je 0x14004c580
call sub.NETAPI32.dll_NetApiBufferFree
jmp 0x14004c580
lea rcx, [rbp + 0x890]
xor edx, edx
mov r8, rsi
call fcn.14005a340
mov rax, qword [rbp + 0x890]
mov rcx, qword [rbp + 0x8a0]
jmp 0x14004c860
mov r12, qword [rbp + 0x808]
cmp dword [rbp + 0x828], 0xea
jne 0x14004d47c
test r12, r12
je 0x14004c4e0
mov rcx, r12
call sub.NETAPI32.dll_NetApiBufferFree
jmp 0x14004c4e0
cmp byte [rax], 0
je 0x14004bc16
lea rsi, [rbp - 0x30]
mov r8d, 0x548
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rdi, qword [rbp + 0x5a8]
mov rbx, qword [rbp + 0x5c0]
movdqa xmm0, xmmword [rdi]
pmovmskb r12d, xmm0
not r12d
lea r14, [rdi + 0x10]
mov r15, 0xffffffffffffffff
nop
test rbx, rbx
je 0x14004bc0f
test r12w, r12w
jne 0x14004ce91
nop
movdqa xmm0, xmmword [r14]
pmovmskb r12d, xmm0
add rdi, 0xfffffffffffff780
add r14, 0x10
cmp r12d, 0xffff
je 0x14004ce70
not r12d
mov eax, r12d
lea r12d, [rax - 1]
and r12d, eax
tzcnt eax, eax
mov r13, rax
neg r13
shl rax, 3
shl r13, 7
sub r13, rax
dec rbx
mov rax, qword [rdi + r13 - 0x70]
mov qword [rbp - 0x30], rax
mov dword [rbp - 0x28], 0
mov rcx, rsi
call sub.IPHLPAPI.DLL_GetIfEntry2
test eax, eax
jne 0x14004ce60
add r13, rdi
mov rax, qword [r13 - 0x68]
mov rcx, qword [r13 - 0x58]
mov qword [r13 - 0x60], rax
mov rax, qword [rbp + 0x4d0]
mov qword [r13 - 0x68], rax
mov qword [r13 - 0x50], rcx
mov rax, qword [rbp + 0x488]
mov qword [r13 - 0x58], rax
mov rax, qword [r13 - 0x48]
mov qword [r13 - 0x40], rax
mov rax, qword [rbp + 0x490]
add rax, qword [rbp + 0x498]
cmovb rax, r15
mov qword [r13 - 0x48], rax
mov rax, qword [r13 - 0x38]
mov qword [r13 - 0x30], rax
mov rax, qword [rbp + 0x4d8]
add rax, qword [rbp + 0x4e0]
cmovb rax, r15
mov qword [r13 - 0x38], rax
mov rax, qword [r13 - 0x28]
mov qword [r13 - 0x20], rax
mov rax, qword [rbp + 0x4a8]
mov qword [r13 - 0x28], rax
mov rax, qword [r13 - 0x18]
mov qword [r13 - 0x10], rax
mov rax, qword [rbp + 0x4f0]
mov qword [r13 - 0x18], rax
jmp 0x14004ce60
cmp byte [rax + 3], 0
je 0x14004c49b
mov rax, qword [rbp + 0x628]
test rax, rax
je 0x14004c49b
mov rdi, qword [rbp + 0x618]
shl rax, 4
lea rbx, [rax + rax*8]
xor r14d, r14d
lea rsi, [rbp - 0x30]
jmp 0x14004cfb0
add r14, 0x90
cmp rbx, r14
je 0x14004c49b
cmp qword [rdi + r14 + 0x78], 0
je 0x14004cfa0
mov qword [rbp - 0x30], 0
mov rcx, qword [rdi + r14 + 0x48]
xor edx, edx
xor r8d, r8d
mov r9, rsi
call sub.KERNEL32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x14004cfa0
mov rax, qword [rbp - 0x30]
mov qword [rdi + r14 + 0x80], rax
jmp 0x14004cfa0
mov rax, qword [rbp + 0x5a8]
mov rcx, qword [rbp + 0x5c0]
movdqa xmm0, xmmword [rax]
pmovmskb r8d, xmm0
not r8d
lea rdx, [rax + 0x10]
jmp 0x14004d036
tzcnt r9d, r8d
mov r10, r9
neg r10
shl r9, 3
shl r10, 7
sub r10, r9
lea r9d, [r8 - 1]
and r9d, r8d
mov byte [rax + r10 - 2], 0
mov r8d, r9d
sub rcx, 1
jb 0x14004d071
test r8w, r8w
jne 0x14004d010
nop word cs:[rax + rax]
movdqa xmm0, xmmword [rdx]
pmovmskb r8d, xmm0
add rax, 0xfffffffffffff780
add rdx, 0x10
cmp r8d, 0xffff
je 0x14004d050
not r8d
jmp 0x14004d010
mov eax, dword [0x140085284]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0x50], 0
jne 0x14004d093
call fcn.140052940
lea rax, [0x14007c3c0]
mov qword [rbp - 0x30], rax
xorps xmm6, xmm6
movups xmmword [rbp - 0x28], xmm6
mov qword [rbp - 0x18], 0
mov eax, dword [0x140085284]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movdqu xmm0, xmmword [rax + 0x58]
inc qword [rax + 0x58]
movdqu xmmword [rbp - 0x10], xmm0
mov qword [rbp + 0x780], 8
movups xmmword [rbp + 0x788], xmm6
mov rax, qword [rbp + 0x890]
mov ebx, dword [rax]
test rbx, rbx
je 0x14004df94
mov qword [rbp + 0x888], rax
lea r14, [rax + 8]
xor r13d, r13d
mov rdi, qword [sym.imp.KERNEL32.dll_HeapAlloc]
pcmpeqd xmm7, xmm7
mov qword [rbp + 0x8d8], r14
jmp 0x14004d13c
mov rcx, qword [0x1400851f8]
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop dword [rax]
inc r13
cmp r13, rbx
je 0x14004d8a8
imul rsi, r13, 0x548
cmp qword [r14 + rsi + 0x4a8], 0
jne 0x14004d159
cmp qword [r14 + rsi + 0x4b0], 0
je 0x14004d130
cmp dword [r14 + rsi + 0x48c], 2
je 0x14004d130
cmp dword [r14 + rsi + 0x420], 0
je 0x14004d130
movzx eax, byte [0x140085280]
mov rax, qword [0x1400851f8]
test rax, rax
jne 0x14004d198
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x14004eb22
mov qword [0x1400851f8], rax
mov r8d, 0x14
mov rcx, rax
xor edx, edx
call rdi
test rax, rax
je 0x14004eb22
mov r15, rax
mov eax, dword [r14 + rsi + 0x10]
movq xmm0, qword [r14 + rsi + 0x14]
punpcklbw xmm0, xmm6
mov dword [r15], eax
movdqu xmmword [r15 + 4], xmm0
movzx eax, byte [0x140085280]
mov rax, qword [0x1400851f8]
test rax, rax
jne 0x14004d1f3
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x14004eb22
mov qword [0x1400851f8], rax
mov r8d, 0x14
mov rcx, rax
xor edx, edx
call rdi
test rax, rax
je 0x14004eb22
mov r12, rax
mov eax, dword [r15 + 0x10]
mov dword [r12 + 0x10], eax
movups xmm0, xmmword [r15]
movups xmmword [r12], xmm0
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 8]
mov r9d, 0xa
mov r8, r12
call fcn.140050fe0
mov rdi, rax
mov rax, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
mov rsi, rdi
shr rsi, 0x39
movd xmm0, esi
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
xor edx, edx
mov r8, rdi
and r8, rcx
movdqu xmm1, xmmword [rax + r8]
movdqa xmm2, xmm0
pcmpeqb xmm2, xmm1
pmovmskb r9d, xmm2
nop word cs:[rax + rax]
test r9w, r9w
je 0x14004d2f0
mov r10d, r9d
lea r9d, [r10 - 1]
and r9d, r10d
tzcnt r10d, r10d
add r10, r8
and r10, rcx
shl r10, 5
mov r14, rax
sub r14, r10
cmp qword [r14 - 0x10], 0xa
jne 0x14004d280
mov r10, qword [r14 - 0x20]
movdqu xmm2, xmmword [r10]
movdqu xmm3, xmmword [r12]
pcmpeqb xmm3, xmm2
movd xmm2, dword [r10 + 0x10]
movd xmm4, dword [r12 + 0x10]
pcmpeqb xmm4, xmm2
pand xmm4, xmm3
pmovmskb r10d, xmm4
cmp r10d, 0xffff
jne 0x14004d280
jmp 0x14004d320
pcmpeqb xmm1, xmm7
pmovmskb r9d, xmm1
test r9d, r9d
jne 0x14004d3ae
add r8, rdx
add r8, 0x10
add rdx, 0x10
jmp 0x14004d25d
mov rcx, qword [0x1400851f8]
xor edx, edx
mov r8, r12
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov eax, dword [r14 - 8]
inc eax
mov dword [r14 - 8], eax
cmp eax, 1
mov r14, qword [rbp + 0x8d8]
jg 0x14004d11a
mov rdx, qword [rbp + 0x790]
cmp rdx, qword [rbp + 0x788]
jne 0x14004d376
lea rcx, [rbp + 0x780]
call fcn.140017270
mov rdx, qword [rbp + 0x790]
mov rax, qword [rbp + 0x780]
mov rcx, rdx
shl rcx, 5
mov dword [rax + rcx], r13d
mov qword [rax + rcx + 8], r15
mov qword [rax + rcx + 0x10], 0xa
mov qword [rax + rcx + 0x18], 0xa
inc rdx
mov qword [rbp + 0x790], rdx
jmp 0x14004d130
cmp qword [rbp - 0x20], 0
je 0x14004d45b
and rdi, rcx
movdqu xmm0, xmmword [rax + rdi]
pmovmskb edx, xmm0
test edx, edx
jne 0x14004d3e7
mov r8d, 0x10
nop
add rdi, r8
and rdi, rcx
movdqu xmm0, xmmword [rax + rdi]
pmovmskb edx, xmm0
add r8, 0x10
test edx, edx
je 0x14004d3d0
tzcnt edx, edx
add rdx, rdi
and rdx, rcx
movzx r8d, byte [rax + rdx]
test r8b, r8b
js 0x14004d40c
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
tzcnt edx, edx
movzx r8d, byte [rax + rdx]
lea r9, [rdx - 0x10]
and r9, rcx
mov byte [rax + rdx], sil
mov byte [r9 + rax + 0x10], sil
shl rdx, 5
mov r14, rax
sub r14, rdx
and r8b, 1
movzx ecx, r8b
sub qword [rbp - 0x20], rcx
neg rdx
mov qword [rax + rdx - 0x20], r12
mov qword [r14 - 0x18], 0xa
mov qword [r14 - 0x10], 0xa
mov dword [r14 - 8], 0
inc qword [rbp - 0x18]
jmp 0x14004d332
lea rcx, [rbp - 0x30]
lea rdx, [rbp - 0x10]
call fcn.14005c0b0
mov rax, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
jmp 0x14004d3b9
mov r12, qword [rbp + 0x808]
test r12, r12
je 0x14004d489
mov rcx, r12
call sub.NETAPI32.dll_NetApiBufferFree
mov dword [rbp + 0x8d0], 0
mov qword [rbp + 0x910], 0
lea rcx, [rbp + 0x8d0]
lea rdx, [rbp + 0x910]
call sub.Secur32.dll_LsaEnumerateLogonSessions
test eax, eax
je 0x14004d640
mov rsi, qword [rbp + 0x910]
mov rax, qword [rbp + 0x840]
mov qword [rbp - 0x20], rax
movups xmm0, xmmword [rbp + 0x830]
movaps xmmword [rbp - 0x30], xmm0
test rsi, rsi
je 0x14004d4e3
mov rcx, rsi
call sub.Secur32.dll_LsaFreeReturnBuffer
mov rsi, qword [rbp + 0x640]
test rsi, rsi
je 0x14004d5c7
mov rdi, qword [rbp + 0x630]
xor ebx, ebx
jmp 0x14004d50c
inc rbx
cmp rbx, rsi
je 0x14004d5c7
lea r14, [rbx + rbx*4]
shl r14, 4
cmp qword [rdi + r14 + 8], 0
je 0x14004d52f
lea rax, [rdi + r14]
mov r8, qword [rax]
mov rcx, qword [0x1400851f8]
xor edx, edx
call r13
cmp qword [rdi + r14 + 0x20], 0
je 0x14004d54e
lea rax, [rdi + r14]
add rax, 0x18
mov r8, qword [rax]
mov rcx, qword [0x1400851f8]
xor edx, edx
call r13
mov r15, qword [rdi + r14 + 0x40]
test r15, r15
je 0x14004d5a0
mov r12, qword [rdi + r14 + 0x30]
add r12, 8
jmp 0x14004d579
add r12, 0x18
dec r15
je 0x14004d5a0
cmp qword [r12], 0
je 0x14004d570
mov r8, qword [r12 - 8]
mov rcx, qword [0x1400851f8]
xor edx, edx
call r13
jmp 0x14004d570
lea rax, [rdi + r14]
add rax, 0x30
cmp qword [rax + 8], 0
je 0x14004d500
mov r8, qword [rax]
mov rcx, qword [0x1400851f8]
xor edx, edx
call r13
jmp 0x14004d500
cmp qword [rbp + 0x638], 0
je 0x14004d5e7
mov r8, qword [rbp + 0x630]
mov rcx, qword [0x1400851f8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rbp - 0x20]
lea rcx, [rbp + 0x630]
mov qword [rcx + 0x10], rax
movaps xmm0, xmmword [rbp - 0x30]
movups xmmword [rcx], xmm0
lea rdx, [rbp + 0x538]
mov r8d, 0x1a0
mov rcx, qword [rbp + 0x518]
call sub.VCRUNTIME140.dll_memcpy
movaps xmm6, xmmword [rbp + 0x930]
movaps xmm7, xmmword [rbp + 0x940]
movaps xmm8, xmmword [rbp + 0x950]
add rsp, 0x9e8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov rsi, qword [rbp + 0x910]
mov eax, dword [rbp + 0x8d0]
test rax, rax
je 0x14004d4c0
lea rdi, [rsi + rax*8]
lea rbx, [rbp + 0x890]
xorps xmm6, xmm6
mov qword [rbp + 0x8e8], rdi
jmp 0x14004d697
mov rcx, qword [rbp + 0x890]
nop word cs:[rax + rax]
test rcx, rcx
je 0x14004d68a
call sub.Secur32.dll_LsaFreeReturnBuffer
add rsi, 8
cmp rsi, rdi
je 0x14004d4b9
mov qword [rbp + 0x890], 0
mov rcx, rsi
mov rdx, rbx
call sub.Secur32.dll_LsaGetLogonSessionData
mov rcx, qword [rbp + 0x890]
test eax, eax
jne 0x14004d680
test rcx, rcx
je 0x14004d680
cmp dword [rcx + 0x40], 3
je 0x14004d685
movzx r14d, word [rcx + 0x10]
mov r15, qword [rcx + 0x18]
mov rdx, qword [rcx + 0x48]
lea rcx, [rbp - 0x30]
call fcn.1400521a0
mov r12, qword [rbp - 0x30]
test r12, r12
je 0x14004d66d
mov qword [rbp + 0x8f8], r15
mov qword [rbp + 0x900], r14
mov rax, qword [rbp - 0x28]
mov qword [rbp + 0x908], rax
mov r15, qword [rbp - 0x20]
mov rbx, qword [rbp + 0x830]
mov r13, qword [rbp + 0x840]
mov rax, r13
shl rax, 4
lea r14, [rax + rax*4]
xor edi, edi
jmp 0x14004d724
add rdi, 0x50
cmp r14, rdi
je 0x14004d77a
cmp qword [rbx + rdi + 0x10], r15
jne 0x14004d720
mov rcx, qword [rbx + rdi]
mov rdx, r12
mov r8, r15
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14004d720
cmp qword [rbp + 0x908], 0
mov r13, qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rbp + 0x8e8]
lea rbx, [rbp + 0x890]
je 0x14004d66d
mov rcx, qword [0x1400851f8]
xor edx, edx
mov r8, r12
call r13
jmp 0x14004d66d
lea rcx, [rbp + 0x6e0]
mov rdx, r12
call fcn.1400522e0
mov r14, qword [rbp + 0x6e0]
test r14, r14
je 0x14004d7b8
lea rax, [rbp + 0x6e8]
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0x780], xmm0
mov rdi, qword [rbp + 0x8e8]
cmp r13, qword [rbp + 0x838]
je 0x14004d7fd
jmp 0x14004d81a
mov r8, qword [rbp + 0x900]
shr r8d, 1
lea rcx, [rbp - 0x30]
mov rdx, qword [rbp + 0x8f8]
call fcn.14000ad20
mov r14, qword [rbp - 0x30]
test r14, r14
mov rdi, qword [rbp + 0x8e8]
je 0x14004d889
lea rax, [rbp - 0x28]
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0x780], xmm0
cmp r13, qword [rbp + 0x838]
jne 0x14004d81a
lea rcx, [rbp + 0x830]
mov rdx, r13
call fcn.14004fd20
mov rbx, qword [rbp + 0x830]
mov r13, qword [rbp + 0x840]
lea rax, [r13*4]
add rax, r13
shl rax, 4
mov qword [rbx + rax], r12
mov rcx, qword [rbp + 0x908]
mov qword [rbx + rax + 8], rcx
mov qword [rbx + rax + 0x10], r15
mov qword [rbx + rax + 0x18], r14
movaps xmm0, xmmword [rbp + 0x780]
movups xmmword [rbx + rax + 0x20], xmm0
mov qword [rbx + rax + 0x30], 8
movups xmmword [rbx + rax + 0x38], xmm6
mov dword [rbx + rax + 0x48], 0
inc r13
mov qword [rbp + 0x840], r13
mov rcx, qword [rbp + 0x890]
mov r13, qword [sym.imp.KERNEL32.dll_HeapFree]
lea rbx, [rbp + 0x890]
jmp 0x14004d680
movaps xmmword [rbp + 0x780], xmm6
mov r14d, 1
cmp r13, qword [rbp + 0x838]
je 0x14004d7fd
jmp 0x14004d81a
mov rcx, qword [rbp + 0x780]
mov rax, qword [rbp + 0x788]
mov qword [rbp + 0x530], rax
mov rax, qword [rbp + 0x790]
mov rdi, rax
shl rdi, 5
add rdi, rcx
mov qword [rbp + 0x6d8], rcx
mov rbx, rcx
test rax, rax
je 0x14004df36
mov rsi, qword [rbp + 0x888]
add rsi, 0x2a
pcmpeqd xmm6, xmm6
mov rbx, qword [rbp + 0x6d8]
mov qword [rbp + 0x888], rsi
mov qword [rbp + 0x870], rdi
jmp 0x14004d939
mov rsi, qword [rbp + 0x888]
mov r14, qword [rbp + 0x8d8]
test r15, r15
je 0x14004d930
mov rcx, qword [0x1400851f8]
xor edx, edx
mov r8, qword [rbp + 0x908]
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp rbx, rdi
je 0x14004df74
mov rax, rbx
add rbx, 0x20
mov rcx, qword [rax + 8]
mov qword [rbp + 0x908], rcx
test rcx, rcx
je 0x14004df36
mov r15, qword [rax + 0x10]
mov ecx, dword [rax]
mov qword [rbp + 0x828], rcx
cmp qword [rbp - 0x18], 0
mov qword [rbp + 0x820], rbx
mov qword [rbp + 0x880], r15
je 0x14004dad0
mov rdi, qword [rax + 0x18]
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 8]
mov r8, qword [rbp + 0x908]
mov r9, rdi
call fcn.140050fe0
mov r14, rax
mov rcx, qword [rbp - 0x30]
mov rsi, qword [rbp - 0x28]
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
lea rbx, [rcx - 0x20]
lea rax, [rdi + rdi]
mov qword [rbp + 0x900], rax
xor eax, eax
mov qword [rbp + 0x8e8], rax
mov qword [rbp + 0x8e0], rcx
and r14, rsi
movdqu xmm8, xmmword [rcx + r14]
movdqa xmm0, xmm7
pcmpeqb xmm0, xmm8
pmovmskb r15d, xmm0
nop dword [rax]
mov r12d, r15d
test r15w, r15w
je 0x14004da40
lea r15d, [r12 - 1]
and r15d, r12d
tzcnt r13d, r12d
add r13, r14
and r13, rsi
mov rcx, r13
shl rcx, 5
mov rax, rbx
sub rax, rcx
cmp rdi, qword [rax + 0x10]
jne 0x14004d9f0
mov rdx, qword [rax]
mov rcx, qword [rbp + 0x908]
mov r8, qword [rbp + 0x900]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14004d9f0
jmp 0x14004da80
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x14004da80
mov rax, qword [rbp + 0x8e8]
add r14, rax
add r14, 0x10
add rax, 0x10
mov qword [rbp + 0x8e8], rax
mov rcx, qword [rbp + 0x8e0]
jmp 0x14004d9d5
shl r13, 5
mov rcx, qword [rbp + 0x8e0]
sub rcx, r13
test r12w, r12w
mov eax, 0
cmove rcx, rax
add rcx, 0xffffffffffffffe0
test r12w, r12w
cmove rcx, rax
mov rsi, qword [rbp + 0x888]
mov r14, qword [rbp + 0x8d8]
mov rdi, qword [rbp + 0x870]
mov rbx, qword [rbp + 0x820]
mov r15, qword [rbp + 0x880]
jmp 0x14004dad2
xor ecx, ecx
lea rax, [rcx + 0x18]
test rcx, rcx
lea rcx, [0x14007c3d0]
cmove rax, rcx
cmp dword [rax], 1
jg 0x14004d915
imul r12, qword [rbp + 0x828], 0x548
lea rcx, [r14 + r12]
lea rdx, [r14 + r12]
add rdx, 0x1c
lea rax, [rsi + r12]
xor r8d, r8d
mov qword [rbp + 0x828], rcx
cmp word [rax + r8*2 - 6], 0
je 0x14004db69
nop dword [rax + rax]
cmp r8, 0x100
je 0x14004db52
cmp word [rax + r8*2 - 4], 0
je 0x14004db5a
cmp word [rax + r8*2 - 2], 0
je 0x14004db5f
cmp word [rax + r8*2], 0
je 0x14004db65
add r8, 4
cmp word [rax + r8*2 - 6], 0
jne 0x14004db20
jmp 0x14004db69
mov r8d, 0x101
jmp 0x14004db76
inc r8
jmp 0x14004db69
add r8, 2
jmp 0x14004db69
add r8, 3
cmp r8, 0x102
jae 0x14004eb70
lea rcx, [rbp + 0x6e0]
call fcn.14000ad20
mov r13, qword [rbp + 0x6e0]
test r13, r13
je 0x14004d907
mov qword [rbp + 0x8e0], r12
mov rax, qword [rbp + 0x6e8]
mov qword [rbp + 0x8e8], rax
mov r14, qword [rbp + 0x6f0]
mov rcx, qword [rbp + 0x5c8]
mov rdx, qword [rbp + 0x5d0]
mov r8, r13
mov r9, r14
call fcn.140051370
mov rbx, rax
mov rsi, qword [rbp + 0x5a8]
mov r15, qword [rbp + 0x5b0]
shr rax, 0x39
mov qword [rbp + 0x520], rax
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor eax, eax
mov qword [rbp + 0x900], rax
mov qword [rbp + 0x528], rbx
and rbx, r15
movdqu xmm8, xmmword [rsi + rbx]
movdqa xmm0, xmm7
pcmpeqb xmm0, xmm8
pmovmskb r12d, xmm0
nop dword [rax]
test r12w, r12w
je 0x14004dc70
mov eax, r12d
lea r12d, [rax - 1]
and r12d, eax
tzcnt eax, eax
add rax, rbx
and rax, r15
mov rdi, rax
neg rdi
shl rax, 3
shl rdi, 7
sub rdi, rax
cmp qword [rsi + rdi - 0x78], r14
jne 0x14004dc20
add rdi, rsi
mov rcx, qword [rdi - 0x88]
mov rdx, r13
mov r8, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14004dc20
jmp 0x14004dca0
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x14004dd8d
mov rax, qword [rbp + 0x900]
add rbx, rax
add rbx, 0x10
add rax, 0x10
mov qword [rbp + 0x900], rax
jmp 0x14004dc05
mov rax, qword [rdi - 0x68]
mov rcx, qword [rdi - 0x58]
mov qword [rdi - 0x60], rax
mov r14, qword [rbp + 0x8d8]
mov rdx, qword [rbp + 0x8e0]
mov rax, qword [r14 + rdx + 0x500]
mov qword [rdi - 0x68], rax
mov qword [rdi - 0x50], rcx
mov rax, qword [r14 + rdx + 0x4b8]
mov qword [rdi - 0x58], rax
mov rax, qword [rdi - 0x48]
mov qword [rdi - 0x40], rax
mov rax, qword [r14 + rdx + 0x4c0]
add rax, qword [r14 + rdx + 0x4c8]
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov qword [rdi - 0x48], rax
mov rax, qword [rdi - 0x38]
mov qword [rdi - 0x30], rax
mov rax, qword [r14 + rdx + 0x508]
add rax, qword [r14 + rdx + 0x510]
cmovb rax, rcx
mov qword [rdi - 0x38], rax
mov rax, qword [rdi - 0x28]
mov qword [rdi - 0x20], rax
mov rax, qword [r14 + rdx + 0x4d8]
mov qword [rdi - 0x28], rax
mov rax, qword [rdi - 0x18]
mov qword [rdi - 0x10], rax
mov rax, qword [r14 + rdx + 0x520]
mov qword [rdi - 0x18], rax
mov byte [rdi - 2], 1
cmp qword [rbp + 0x8e8], 0
je 0x14004dd65
mov rcx, qword [0x1400851f8]
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rbp + 0x880], 0
mov rsi, qword [rbp + 0x888]
mov rdi, qword [rbp + 0x870]
mov rbx, qword [rbp + 0x820]
jne 0x14004d91a
jmp 0x14004d930
cmp qword [rbp + 0x5b8], 0
je 0x14004df10
mov r8, qword [rbp + 0x8d8]
mov rdi, qword [rbp + 0x8e0]
mov rax, qword [r8 + rdi + 0x4c0]
add rax, qword [r8 + rdi + 0x4c8]
mov rdx, qword [r8 + rdi + 0x4b8]
mov r9, 0xffffffffffffffff
cmovb rax, r9
mov rcx, qword [r8 + rdi + 0x508]
add rcx, qword [r8 + rdi + 0x510]
cmovb rcx, r9
mov r9, qword [rbp + 0x828]
mov r11, qword [r9]
mov r10, qword [r8 + rdi + 0x500]
mov r9, qword [r8 + rdi + 0x4d8]
mov r8, qword [r8 + rdi + 0x520]
mov r12, qword [rbp + 0x528]
and r12, r15
movdqu xmm0, xmmword [rsi + r12]
pmovmskb edi, xmm0
test edi, edi
jne 0x14004de38
mov ebx, 0x10
nop
add r12, rbx
and r12, r15
movdqu xmm0, xmmword [rsi + r12]
pmovmskb edi, xmm0
add rbx, 0x10
test edi, edi
je 0x14004de20
tzcnt edi, edi
add rdi, r12
and rdi, r15
movzx ebx, byte [rsi + rdi]
test bl, bl
js 0x14004de5a
movdqa xmm0, xmmword [rsi]
pmovmskb edi, xmm0
tzcnt edi, edi
movzx ebx, byte [rsi + rdi]
lea r12, [rdi - 0x10]
and r12, r15
mov r15, qword [rbp + 0x520]
mov byte [rsi + rdi], r15b
mov byte [r12 + rsi + 0x10], r15b
and bl, 1
movzx ebx, bl
sub qword [rbp + 0x5b8], rbx
mov rbx, rdi
neg rbx
shl rdi, 3
shl rbx, 7
sub rbx, rdi
mov qword [rsi + rbx - 0x88], r13
mov rdi, qword [rbp + 0x8e8]
mov qword [rsi + rbx - 0x80], rdi
mov qword [rsi + rbx - 0x78], r14
mov qword [rsi + rbx - 0x70], r11
mov qword [rsi + rbx - 0x68], r10
mov qword [rsi + rbx - 0x60], r10
mov qword [rsi + rbx - 0x58], rdx
mov qword [rsi + rbx - 0x50], rdx
mov qword [rsi + rbx - 0x48], rax
mov qword [rsi + rbx - 0x40], rax
mov qword [rsi + rbx - 0x38], rcx
mov qword [rsi + rbx - 0x30], rcx
mov qword [rsi + rbx - 0x28], r9
mov qword [rsi + rbx - 0x20], r9
mov qword [rsi + rbx - 0x18], r8
mov qword [rsi + rbx - 0x10], r8
mov dword [rsi + rbx - 8], 0
mov word [rsi + rbx - 4], 0
mov byte [rsi + rbx - 2], 1
inc qword [rbp + 0x5c0]
mov r14, qword [rbp + 0x8d8]
jmp 0x14004dd65
lea rcx, [rbp + 0x5a8]
lea rdx, [rbp + 0x5c8]
call fcn.14005ad80
mov rsi, qword [rbp + 0x5a8]
mov r15, qword [rbp + 0x5b0]
jmp 0x14004dd9b
sub rdi, rbx
je 0x14004df74
shr rdi, 5
add rbx, 0x10
jmp 0x14004df59
add rbx, 0x20
dec rdi
je 0x14004df74
cmp qword [rbx], 0
je 0x14004df50
mov r8, qword [rbx - 8]
mov rcx, qword [0x1400851f8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14004df50
cmp qword [rbp + 0x530], 0
je 0x14004df94
mov rcx, qword [0x1400851f8]
xor edx, edx
mov r8, qword [rbp + 0x6d8]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rbp + 0x890]
call sub.IPHLPAPI.DLL_FreeMibTable
mov rdi, qword [rbp - 0x28]
test rdi, rdi
je 0x14004e072
mov rsi, qword [rbp - 0x30]
mov rbx, qword [rbp - 0x18]
test rbx, rbx
je 0x14004e049
movdqa xmm0, xmmword [rsi]
pmovmskb r12d, xmm0
not r12d
lea r14, [rsi + 0x10]
mov r15, qword [sym.imp.KERNEL32.dll_HeapFree]
mov r13, rsi
jmp 0x14004dff3
dec rbx
lea eax, [r12 - 1]
and eax, r12d
mov r12d, eax
test rbx, rbx
je 0x14004e049
test r12w, r12w
jne 0x14004e021
nop dword [rax]
movdqa xmm0, xmmword [r14]
pmovmskb r12d, xmm0
add r13, 0xfffffffffffffe00
add r14, 0x10
cmp r12d, 0xffff
je 0x14004e000
not r12d
tzcnt ecx, r12d
shl rcx, 5
mov rax, r13
sub rax, rcx
cmp qword [rax - 0x18], 0
je 0x14004dfe0
mov r8, qword [rax - 0x20]
mov rcx, qword [0x1400851f8]
xor edx, edx
call r15
jmp 0x14004dfe0
mov rax, rdi
shl rax, 5
add rdi, rax
cmp rdi, 0xffffffffffffffcf
je 0x14004e072
sub rsi, rax
add rsi, 0xffffffffffffffe0
mov rcx, qword [0x1400851f8]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [rbp + 0x5a8]
mov rdi, qword [rbp + 0x5c0]
movdqa xmm0, xmmword [rsi]
pmovmskb r15d, xmm0
not r15d
lea rbx, [rsi + 0x10]
movabs r14, 0xf0f0f0f0f0f0f0f1
pcmpeqd xmm6, xmm6
nop
test rdi, rdi
je 0x14004e1ac
test r15w, r15w
jne 0x14004e0d0
nop
movdqa xmm0, xmmword [rbx]
pmovmskb r15d, xmm0
add rsi, 0xfffffffffffff780
add rbx, 0x10
cmp r15d, 0xffff
je 0x14004e0b0
not r15d
mov eax, r15d
lea r15d, [rax - 1]
and r15d, eax
tzcnt ecx, eax
mov rax, rcx
neg rax
shl rcx, 3
shl rax, 7
sub rax, rcx
dec rdi
cmp byte [rsi + rax - 2], 0
jne 0x14004e0a0
add rax, rsi
mov rcx, qword [rbp + 0x5a8]
mov rdx, rcx
sub rdx, rax
sar rdx, 3
imul rdx, r14
lea r8, [rdx - 0x10]
and r8, qword [rbp + 0x5b0]
movdqu xmm0, xmmword [rcx + r8]
pcmpeqb xmm0, xmm6
psllw xmm0, 7
pmovmskb r9d, xmm0
test r9d, r9d
je 0x14004e140
bsr r9w, r9w
xor r9d, 0xf
jmp 0x14004e145
mov r9w, 0x10
movdqu xmm0, xmmword [rcx + rdx]
pcmpeqb xmm0, xmm6
pmovmskb r10d, xmm0
or r10d, 0x10000
tzcnt r10d, r10d
add r9d, r10d
mov r10b, 0x80
cmp r9w, 0xf
ja 0x14004e176
inc qword [rbp + 0x5b8]
mov r10b, 0xff
mov byte [rcx + rdx], r10b
mov byte [r8 + rcx + 0x10], r10b
dec qword [rbp + 0x5c0]
cmp qword [rax - 0x80], 0
je 0x14004e0a0
mov r8, qword [rax - 0x88]
mov rcx, qword [0x1400851f8]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14004e0a0
mov dword [rbp + 0x910], 0x3c00
mov dword [rbp + 0x830], 0
mov ebx, 4
xor esi, esi
lea r14, [rbp + 0x910]
nop
dec ebx
je 0x14004e4fd
mov edx, dword [rbp + 0x910]
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
test rax, rax
je 0x14004e296
mov rdi, rax
mov qword [rsp + 0x20], r14
xor ecx, ecx
mov edx, 0xe
xor r8d, r8d
mov r9, rax
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
mov dword [rbp + 0x830], eax
mov rsi, rdi
cmp eax, 0x6f
je 0x14004e1d0
test eax, eax
jne 0x14004e4fa
mov qword [rbp + 0x6e8], rdi
mov qword [rbp + 0x6f0], rdi
mov qword [rbp + 0x6e0], 0
xor edi, edi
mov rax, qword [rbp + 0x8f8]
test rdi, rdi
jne 0x14004e576
jmp 0x14004e339
test r13, r13
je 0x14004e262
test rbx, rbx
je 0x14004e262
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
test r12, r12
je 0x14004e275
test rdi, rdi
je 0x14004e275
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
test r15, r15
je 0x14004e288
test rsi, rsi
je 0x14004e288
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x10]
test r14b, r14b
jne 0x14004ba95
jmp 0x14004ba9a
movzx eax, byte [0x140085280]
mov rcx, qword [0x1400851f8]
test rcx, rcx
jne 0x14004e2c2
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x14004ebd6
mov rcx, rax
mov qword [0x1400851f8], rax
mov r8d, 0x32
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x14004ebd6
mov rdi, rax
movups xmm0, xmmword [0x14007c0c0]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x14007c0b0]
movups xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [str.failed_to_allocate_memory_for_IP_ADAPTER_ADDRESSESGetAdaptersAddresses___failed_with_code]
movdqu xmmword [rax], xmm0
mov word [rax + 0x30], 0x5345
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rbp + 0x6e0], rdi
mov qword [rbp + 0x6e8], 0x32
mov qword [rbp + 0x6f0], 0x32
mov rax, qword [rbp + 0x8f8]
test rdi, rdi
jne 0x14004e576
movdqu xmm0, xmmword [rbp + 0x6e8]
movdqa xmmword [rbp + 0x780], xmm0
pcmpeqd xmm6, xmm6
nop dword [rax]
lea rcx, [rbp - 0x30]
lea rdx, [rbp + 0x780]
call fcn.140052050
mov rax, qword [rbp - 0x30]
mov qword [rbp + 0x908], rax
test rax, rax
je 0x14004e4e9
mov rax, qword [rbp - 0x28]
mov qword [rbp + 0x8e0], rax
cmp qword [rbp + 0x5c0], 0
je 0x14004e4c0
mov r14, qword [rbp - 0x20]
mov rcx, qword [rbp + 0x5c8]
mov rdx, qword [rbp + 0x5d0]
mov r8, qword [rbp + 0x908]
mov r9, r14
call fcn.140051370
mov r15, rax
mov rcx, qword [rbp + 0x5a8]
mov rdi, qword [rbp + 0x5b0]
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
lea r13, [rcx - 0x88]
xor eax, eax
mov qword [rbp + 0x900], rax
mov qword [rbp + 0x8e8], rcx
and r15, rdi
movdqu xmm8, xmmword [rcx + r15]
movdqa xmm0, xmm7
pcmpeqb xmm0, xmm8
pmovmskb esi, xmm0
nop word cs:[rax + rax]
test si, si
je 0x14004e460
mov eax, esi
lea esi, [rax - 1]
and esi, eax
tzcnt ecx, eax
add rcx, r15
and rcx, rdi
mov rbx, rcx
neg rbx
shl rcx, 3
mov r12, rbx
shl r12, 7
mov rax, r12
sub rax, rcx
cmp r14, qword [r13 + rax + 0x10]
jne 0x14004e410
add rax, r13
mov rdx, qword [rax]
mov rcx, qword [rbp + 0x908]
mov r8, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x14004e410
jmp 0x14004e4a0
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x14004e4c0
mov rax, qword [rbp + 0x900]
add r15, rax
add r15, 0x10
add rax, 0x10
mov qword [rbp + 0x900], rax
mov rcx, qword [rbp + 0x8e8]
jmp 0x14004e3ec
lea rax, [r12 + rbx*8]
lea rdx, [rbp - 0x18]
movzx ecx, word [rdx + 4]
mov r8, qword [rbp + 0x8e8]
mov word [r8 + rax - 4], cx
mov ecx, dword [rdx]
mov dword [r8 + rax - 8], ecx
cmp qword [rbp + 0x8e0], 0
je 0x14004e350
mov rcx, qword [0x1400851f8]
xor edx, edx
mov r8, qword [rbp + 0x908]
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14004e350
mov rcx, qword [rbp + 0x780]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
jmp 0x14004bc0f
mov rsi, rdi
lea rax, [rbp + 0x830]
mov qword [rbp + 0x780], rax
lea rax, [0x14000c660]
mov qword [rbp + 0x788], rax
lea rax, [0x14007c100]
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
mov qword [rbp - 0x10], 0
lea rax, [rbp + 0x780]
mov qword [rbp - 0x20], rax
mov qword [rbp - 0x18], 1
lea rcx, [rbp + 0x6e0]
lea rdx, [rbp - 0x30]
call fcn.14000a9c0
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rdi, qword [rbp + 0x6e0]
mov rax, qword [rbp + 0x8f8]
test rdi, rdi
je 0x14004e339
cmp qword [rbp + 0x6e8], 0
je 0x14004bc16
mov rcx, qword [0x1400851f8]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x14004bc0f
xor eax, eax
mov qword [rbp + 0x6a8], rax
mov byte [rbp + 0x6d0], 1
mov rax, qword [rbp + 0x8f8]
cmp byte [rax + 6], 0
jne 0x14004b819
cmp byte [rax + 5], 0
je 0x14004bbdf
mov rax, qword [rbp + 0x610]
test rax, rax
je 0x14004bbdf
mov rsi, qword [rbp + 0x600]
shl rax, 5
lea r13, [rax + rax*2]
lea r14, [rbp - 0x30]
jmp 0x14004e5fe
add rsi, 0x60
add r13, 0xffffffffffffffa0
je 0x14004bbdf
mov rbx, qword [rsi]
cmp rbx, 2
jne 0x14004e6e0
xor ecx, ecx
xor edx, edx
call sub.ole32.dll_CoInitializeEx
mov edi, eax
cmp eax, 2
setb bl
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov edx, 0xffffffff
xor r8d, r8d
xor r9d, r9d
call sub.ole32.dll_CoInitializeSecurity
test eax, eax
js 0x14004e720
mov qword [rbp - 0x30], 0
mov qword [rsp + 0x20], r14
lea rcx, [0x14007c1e8]
xor edx, edx
mov r8d, 1
lea r9, [0x14007c1f8]
call sub.ole32.dll_CoCreateInstance
test eax, eax
js 0x14004e720
mov rax, qword [rbp - 0x30]
mov qword [rbp - 0x30], 1
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x10], 0
mov byte [rbp], bl
lea rcx, [rbp + 0x780]
mov rdx, r14
call fcn.1400524d0
mov rbx, qword [rbp + 0x780]
cmp rbx, 2
jne 0x14004e866
mov ebx, 2
jmp 0x14004e72f
mov rcx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
mov r15, qword [rsi + 0x18]
mov r14, qword [rsi + 0x20]
mov rdi, qword [rsi + 0x28]
movzx r12d, byte [rsi + 0x30]
mov eax, dword [rsi + 0x31]
mov edx, dword [rsi + 0x34]
mov dword [rbp + 0x893], edx
mov dword [rbp + 0x890], eax
mov qword [rsi], 2
jmp 0x14004e790
mov ebx, 2
cmp edi, 1
ja 0x14004e72f
call sub.ole32.dll_CoUninitialize
mov qword [rsi], rbx
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], r8
mov qword [rsi + 0x18], r15
mov qword [rsi + 0x20], r14
mov qword [rsi + 0x28], rdi
mov byte [rsi + 0x30], r12b
mov eax, dword [rbp + 0x890]
mov edx, dword [rbp + 0x893]
mov dword [rsi + 0x31], eax
mov dword [rsi + 0x34], edx
mov eax, dword [rsi + 0x31]
mov edx, dword [rsi + 0x34]
mov dword [rbp + 0x893], edx
mov dword [rbp + 0x890], eax
cmp rbx, 2
jne 0x14004e790
mov qword [rbp + 0x780], 2
jmp 0x14004e7ec
mov qword [rbp + 0x6e0], rbx
mov qword [rbp + 0x6e8], rcx
mov qword [rbp + 0x6f0], r8
mov qword [rbp + 0x6f8], r15
mov qword [rbp + 0x700], r14
mov qword [rbp + 0x708], rdi
mov byte [rbp + 0x710], r12b
mov eax, dword [rbp + 0x890]
mov ecx, dword [rbp + 0x893]
lea rdx, [rbp + 0x711]
mov dword [rdx + 3], ecx
mov dword [rdx], eax
lea rcx, [rbp + 0x780]
lea rdx, [rbp + 0x6e0]
call fcn.140052610
mov rax, qword [rbp + 0x7b0]
mov qword [rsi + 0x30], rax
movups xmm0, xmmword [rbp + 0x780]
movups xmm1, xmmword [rbp + 0x790]
movdqu xmm2, xmmword [rbp + 0x7a0]
movdqu xmmword [rsi + 0x20], xmm2
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
cmp dword [rsi], 2
lea r14, [rbp - 0x30]
je 0x14004e5f0
lea rcx, [rbp + 0x780]
mov rdx, rsi
xor r8d, r8d
call fcn.140052760
cmp dword [rbp + 0x784], 2
je 0x14004e5f0
movss xmm0, dword [rbp + 0x780]
movss dword [rsi + 0x58], xmm0
ucomiss xmm0, dword [rsi + 0x5c]
jbe 0x14004e5f0
movss dword [rsi + 0x5c], xmm0
jmp 0x14004e5f0
mov rcx, qword [rbp + 0x788]
mov r8, qword [rbp + 0x790]
mov r15, qword [rbp + 0x798]
mov r14, qword [rbp + 0x7a0]
mov rdi, qword [rbp + 0x7a8]
movzx r12d, byte [rbp + 0x7b0]
test r8, r8
mov qword [rbp + 0x908], rcx
mov qword [rbp + 0x900], r8
je 0x14004e907
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
mov rcx, r15
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call sub.ole32.dll_CoSetProxyBlanket
mov r8, qword [rbp + 0x900]
mov rcx, qword [rbp + 0x908]
test eax, eax
js 0x14004e907
lea rdx, [rbp + 0x7b1]
mov eax, dword [rdx]
mov edx, dword [rdx + 3]
mov dword [rbp + 0x893], edx
mov dword [rbp + 0x890], eax
jmp 0x14004e72f
test r14, r14
je 0x14004e928
test rdi, rdi
je 0x14004e928
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov r8, qword [rbp + 0x900]
mov rcx, qword [rbp + 0x908]
test r8, r8
je 0x14004e949
test r15, r15
je 0x14004e949
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 0x10]
mov r8, qword [rbp + 0x900]
mov rcx, qword [rbp + 0x908]
test rbx, rbx
je 0x14004e967
test rcx, rcx
je 0x14004e967
mov rax, qword [rcx]
call qword [rax + 0x10]
mov r8, qword [rbp + 0x900]
mov rcx, qword [rbp + 0x908]
test r12b, r12b
je 0x14004e989
call sub.ole32.dll_CoUninitialize
mov r8, qword [rbp + 0x900]
mov rcx, qword [rbp + 0x908]
mov ebx, 2
jmp 0x14004e72f
xor r12d, r12d
mov ebx, 2
jmp 0x14004e72f
mov qword [rbp + 0x8e8], rax
mov qword [rbp + 0x900], r13
mov byte [rbp + 0x908], sil
movss xmm6, dword [rbp + 0x780]
movd xmm7, dword [rbp + 0x788]
mov eax, dword [rbp + 0x861]
mov ecx, dword [rbp + 0x864]
mov dword [rbp + 0x890], eax
mov dword [rbp + 0x893], ecx
xor r13d, r13d
mov esi, 8
mov ecx, 8
xor edx, edx
call fcn.14004fc80
movabs rcx, 0x72657475706d6f43
mov qword [rax], rcx
cmp r12, 3
je 0x14004baa2
mov qword [rbp + 0x8e0], rdx
mov r13, rax
movzx eax, byte [0x140085280]
mov ecx, 0x60
call fcn.14000a6b0
test rax, rax
je 0x14004ebe7
mov rsi, rax
mov qword [rax], r12
mov rax, qword [rbp + 0x900]
mov qword [rsi + 8], rax
mov rax, qword [rbp + 0x8e8]
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], rbx
mov qword [rsi + 0x20], r15
mov qword [rsi + 0x28], r14
movzx eax, byte [rbp + 0x908]
mov byte [rsi + 0x30], al
mov eax, dword [rbp + 0x890]
mov ecx, dword [rbp + 0x893]
mov dword [rsi + 0x31], eax
mov dword [rsi + 0x34], ecx
mov dword [rsi + 0x38], edi
movd dword [rsi + 0x3c], xmm7
mov qword [rsi + 0x40], r13
mov rax, qword [rbp + 0x8e0]
mov qword [rsi + 0x48], rax
mov qword [rsi + 0x50], 8
movss dword [rsi + 0x58], xmm6
movss dword [rsi + 0x5c], xmm6
mov r13d, 1
jmp 0x14004baa2
test rcx, rcx
jne 0x14004eaa6
call fcn.14000a710
jmp 0x14004eab2
mov rdx, qword [rbp + 0x6f0]
call fcn.140057590
ud2
mov ecx, 1
mov rdx, rsi
call fcn.140057590
ud2
call fcn.14000a710
ud2
mov ecx, 1
mov rdx, qword [rbp + 0x880]
call fcn.140057590
ud2
lea rax, str.Expected_SID_revision_to_be_1
mov qword [rbp - 0x30], rax
mov qword [rbp - 0x28], 1
lea rax, str._rustc_13e6f24b9adda67852fb86538541adaa68aff6e8librarycore_srccellonce.rsreentrant_init
mov qword [rbp - 0x20], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
lea rdx, [rbp - 0x30]
mov rcx, r8
call fcn.14005c890
ud2
lea r8, str.C:Userslakti.cargo_registry_srcindex.crates.io_6f17d22bba15001f_sysinfo_0.29.8_srcwindows_sid.rs
xor ecx, ecx
xor edx, edx
call fcn.1400577a0
ud2
mov ecx, 2
mov edx, 0x14
call fcn.140057590
ud2
mov ecx, 8
mov rdx, rsi
call fcn.140057590
ud2
mov ecx, 0x56410
call fcn.14001fd10
ud2
mov ecx, 1
mov edx, 9
call fcn.140057590
ud2
mov ecx, 8
mov edx, 0x120
call fcn.140057590
ud2
lea rax, str.C:Userslakti.cargo_registry_srcindex.crates.io_6f17d22bba15001f_sysinfo_0.29.8_srcwindows_network.rs
mov edx, 0x101
mov rcx, r8
mov r8, rax
call fcn.140057820
ud2
mov ecx, 8
mov edx, 0x240
call fcn.140057590
ud2
lea rcx, str.global_key_idle_disappearedC:Userslakti.cargo_registry_srcindex.crates.io_6f17d22bba15001f_sysinfo_0.29.8_srcwindows_system.rs
lea r8, [0x14007be78]
mov edx, 0x1b
call fcn.140057c80
ud2
mov ecx, 1
mov edx, 0x1e
call fcn.140057590
ud2
mov ecx, 1
mov edx, 5
call fcn.140057590
ud2
mov ecx, 1
mov edx, 0x32
call fcn.140057590
ud2
mov ecx, 8
mov edx, 0x60
call fcn.140057590
ud2