Function at 0x14003fd72
Capabilities:
Enumerate processes via ntquerysysteminformation
Get disk information
Get disk size
Get local ipv4 addresses
Get logon sessions
Get memory capacity
Get system information on windows
List groups for user account
List user accounts

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xab8
movaps xmmword [rsp + 0xaa0], xmm9
movaps xmmword [rsp + 0xa90], xmm8
movaps xmmword [rsp + 0xa80], xmm7
movaps xmmword [rsp + 0xa70], xmm6
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x320], rcx
movabs rbp, 0x8000000000000000
lea rsi, [rsp + 0x500]
push rsi
nop
pop rcx
call fcn.140042c08
nop
push rsi
pop rcx
call fcn.140042c42
push rax
pop rsi
nop
push rdx
nop
pop rdi
lea rbx, [rsp + 0x500]
mov edx, 0x158
mov r8d, 0x1f4
nop
push rbx
pop rcx
call fcn.14003f381
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movaps xmmword [rsp + 0xa60], xmm1
movaps xmmword [rsp + 0xa50], xmm0
lea rdx, [0x140995fd4]
lea rbx, [rsp + 0x500]
mov r8d, 9
mov rcx, rbx
call fcn.140039f5f
and qword [rbx + 0x18], 0
mov eax, 1
mov qword [rbx + 0x20], rax
xorps xmm0, xmm0
movups xmmword [rbx + 0x28], xmm0
mov qword [rbx + 0x38], rax
and qword [rbx + 0x40], 0
mov qword [rbx + 0x48], rbp
and qword [rbx + 0x60], 0
and dword [rbx + 0x68], 0
and qword [rbx + 0x70], 0
mov qword [rbx + 0x78], 8
and qword [rbx + 0x80], 0
mov byte [rbx + 0x88], 0
mov ecx, 8
mov edx, 0x120
call fcn.14000bf3f
or rax, rax
je 0x140042ba2
push rax
pop rbx
nop
lea r14, [rsp + 0x360]
mov rcx, r14
call fcn.140042c08
mov rcx, r14
call fcn.140042c42
mov r14, rax
mov r15, rdx
call fcn.140034c40
mov r8d, edx
lea r12, [rsp + 0x360]
mov rcx, r12
mov edx, eax
call fcn.140034c70
cmp qword [r12], 0
je 0x14003fed1
xor r13d, r13d
jmp 0x14003fef2
mov r13, qword [rsp + 0x368]
call sub.KERNEL32.dll_GetTickCount64
sub ecx, ecx
mov r8d, 0x3e8
xor edx, edx
div r8
sub r13, rax
cmovb r13, rcx
movaps xmm0, xmmword [rsp + 0xa50]
movaps xmm1, xmmword [rsp + 0xa60]
lea r12, [rsp + 0x360]
movups xmmword [r12 + 0xd8], xmm0
movups xmmword [r12 + 0xe8], xmm1
mov qword [r12 + 0xf8], rsi
mov qword [r12 + 0x100], rdi
xorps xmm8, xmm8
movups xmmword [r12 + 0x138], xmm8
movups xmmword [r12 + 0x148], xmm8
lea rdx, [rsp + 0x500]
mov r8d, 0x90
mov rcx, r12
call sub.msvcrt.dll_memcpy
and qword [r12 + 0x90], 0
mov eax, 8
mov qword [r12 + 0x98], rax
and qword [r12 + 0xa0], 0
mov qword [r12 + 0xa8], 2
mov qword [r12 + 0xb0], rbx
movups xmmword [r12 + 0xb8], xmm8
and qword [r12 + 0x158], 0
movdqu xmm6, xmmword [0x140995b30]
movdqu xmmword [r12 + 0x108], xmm6
movdqu xmm7, xmmword [0x140995b40]
movdqu xmmword [r12 + 0x118], xmm7
mov qword [r12 + 0x128], r14
mov qword [r12 + 0x130], r15
mov qword [r12 + 0x198], r13
mov qword [r12 + 0xc8], rax
and qword [r12 + 0xd0], 0
mov r15, qword [rsp + 0x68]
cmp byte [r15 + 4], 0
je 0x1400400c7
lea rsi, [rsp + 0x1f0]
movaps xmmword [rsi], xmm8
movaps xmmword [rsi + 0x30], xmm8
movaps xmmword [rsi + 0x20], xmm8
movaps xmmword [rsi + 0x10], xmm8
mov dword [rsi], 0x40
push rsi
nop
pop rcx
call sub.KERNEL32.dll_GlobalMemoryStatusEx
movups xmm0, xmmword [rsi + 8]
movups xmmword [rsp + 0x498], xmm0
lea rcx, [rsp + 0x500]
movaps xmmword [rcx + 0x50], xmm8
movaps xmmword [rcx + 0x40], xmm8
movaps xmmword [rcx + 0x30], xmm8
movaps xmmword [rcx + 0x20], xmm8
movaps xmmword [rcx + 0x10], xmm8
movaps xmmword [rcx], xmm8
and qword [rcx + 0x60], 0
mov edx, 0x68
call sub.PSAPI.DLL_GetPerformanceInfo
cmp eax, 1
jne 0x1400400c7
mov rdx, qword [rsp + 0x510]
mov r9, qword [rsp + 0x520]
xor r10d, r10d
sub rdx, r9
cmovb rdx, r10
mov rcx, qword [rsp + 0x550]
mov rax, rcx
mul rdx
mov r8, rax
mov r11, 0xffffffffffffffff
cmovo r8, r11
mov rdx, qword [rsp + 0x508]
sub rdx, r9
cmovb rdx, r10
mov rax, rcx
mul rdx
cmovo rax, r11
mov qword [rsp + 0x4a8], r8
mov qword [rsp + 0x4b0], rax
cmp byte [r15 + 0xb], 2
je 0x14004049d
lea r13, [rsp + 0x4b8]
mov r12b, byte [r15 + 0xc]
cmp qword [r13], 0
je 0x1400401fb
mov rcx, qword [rsp + 0x4e8]
call sub.pdh.dll_PdhCollectQueryData
cmp qword [rsp + 0x3a8], rbp
je 0x14004012d
lea rdx, [rsp + 0x3a8]
mov rcx, r13
call fcn.140044188
or eax, eax
je 0x140042bef
movss xmm1, dword [0x140048b00]
subss xmm1, xmm0
movss dword [rsp + 0x3c8], xmm1
mov edx, r12d
and dl, 1
lea rcx, [rsp + 0x360]
call fcn.140044166
nop
push rax
pop rdi
push rdx
pop rbx
nop
add rdi, 0x48
movss xmm8, dword [0x140048b00]
lea rax, [rdi - 0x48]
cmp rax, rbx
je 0x140040187
cmp qword [rdi], rbp
je 0x140040181
mov rcx, r13
nop
push rdi
pop rdx
call fcn.140044188
test eax, eax
je 0x140042b82
movaps xmm1, xmm8
subss xmm1, xmm0
movss dword [rdi + 0x20], xmm1
add rdi, 0x70
jmp 0x140040153
test r12b, 1
je 0x14004049d
cmp byte [rsp + 0x3e8], 0
jne 0x14004049d
mov rsi, qword [rsp + 0x3e0]
lea rdi, [rsp + 0x500]
nop
push rdi
pop rcx
nop
push rsi
pop rdx
call fcn.1400434c3
mov rbx, qword [rsp + 0x3d8]
mov rcx, qword [rdi]
mov rdx, qword [rdi + 8]
mov rax, qword [rdi + 0x10]
shl rax, 3
imul r8, rsi, 0x70
xor r9d, r9d
mov r10, rbx
test r8, r8
je 0x14004021e
cmp rax, r9
je 0x14004021e
mov r11, qword [rdx + r9]
mov qword [r10 + 0x60], r11
add r10, 0x70
add r9, 8
add r8, 0xffffffffffffff90
jmp 0x1400401db
lea r8, [rsp + 0x1f0]
and qword [r8], 0
sub ecx, ecx
sub edx, edx
call sub.pdh.dll_PdhOpenQueryA
or eax, eax
je 0x140040235
lea r14, [rsp + 0x110]
jmp 0x14004026a
call fcn.14003e4d4
or rsi, rsi
je 0x14004048b
mov rax, qword [rbx + 0x60]
jmp 0x14004048d
mov rsi, qword [rsp + 0x1f0]
lea r14, [rsp + 0x500]
mov rcx, r14
call fcn.140042c08
mov rcx, r14
call fcn.140042c42
push rax
nop
pop rbx
nop
push rdx
pop rdi
lea rax, [0x140995b20]
mov qword [rsp + 0x110], rax
and qword [r14], 0
cmp qword [rsp + 0x4b8], 0
je 0x140040289
mov rcx, r13
call fcn.140043d3a
mov rcx, r13
call fcn.14003ec3d
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x4b8], rax
and qword [rsp + 0x4d0], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x4c0], xmm0
mov qword [rsp + 0x4d8], rbx
mov qword [rsp + 0x4e0], rdi
mov qword [rsp + 0x4e8], rsi
mov rcx, qword [rsp + 0x500]
mov qword [rsp + 0x4f0], rcx
test rax, rax
je 0x14004049d
mov byte [rsp + 0x48], r12b
mov ebp, r12d
and bpl, 1
lea rdx, str.Processor__Total___Idle_Timetot_0Processor____Idle_Time
lea rsi, [rsp + 0x1f0]
mov r8d, 0x1e
push rsi
pop rcx
nop
call fcn.140039f5f
lea r14, [rsp + 0x3a8]
lea rdx, [0x1409964d6]
lea rdi, [rsp + 0x500]
mov r8d, 5
mov rcx, rdi
call fcn.140039f5f
push rsi
pop rcx
nop
mov rdx, r13
mov r8, r14
mov r9, rdi
call fcn.140043dbb
lea rcx, [rsp + 0x360]
mov edx, ebp
call fcn.140044166
mov r14, rax
mov qword [rsp + 0x40], rdx
sub ebp, ebp
mov ebx, 2
mov r12d, 1
cmp r14, qword [rsp + 0x40]
je 0x14004045e
mov qword [rsp + 0xd0], rbp
inc rbp
lea rax, [0x1409964f8]
mov qword [rsp + 0x500], rax
mov qword [rsp + 0x508], rbx
and qword [rsp + 0x520], 0
lea r15, [rsp + 0xd0]
mov qword [rsp + 0x80], r15
lea rdi, [fcn.140003b20]
mov qword [rsp + 0x88], rdi
lea r13, [rsp + 0x80]
mov qword [rsp + 0x510], r13
mov qword [rsp + 0x518], r12
lea rcx, [rsp + 0x110]
lea rsi, [rsp + 0x500]
nop
push rsi
pop rdx
call fcn.140039f1a
lea rax, [0x140996520]
mov qword [rsp + 0x500], rax
mov qword [rsp + 0x508], rbx
and qword [rsp + 0x520], 0
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x88], rdi
mov qword [rsp + 0x510], r13
mov qword [rsp + 0x518], r12
lea r15, [rsp + 0x1f0]
mov rcx, r15
push rsi
pop rdx
nop
call fcn.140039f1a
lea r8, [r14 + 0x48]
lea rcx, [rsp + 0x110]
lea rdx, [rsp + 0x4b8]
mov r9, r15
call fcn.140043dbb
add r14, 0x70
jmp 0x140040361
cmp qword [rsp + 0x4b8], 0
movabs rbp, 0x8000000000000000
mov r15, qword [rsp + 0x68]
mov r12b, byte [rsp + 0x48]
lea r13, [rsp + 0x4b8]
jne 0x1400400e9
jmp 0x14004049d
sub eax, eax
mov qword [rsp + 0x3c0], rax
mov byte [rsp + 0x3e8], 1
cmp byte [r15 + 6], 0
je 0x140040786
lea rsi, [rsp + 0x1f0]
push rsi
pop rcx
nop
call fcn.140043803
cmp dword [rsi], 2
je 0x1400406b0
mov rax, qword [rsp + 0x220]
lea rdx, [rsp + 0x500]
mov qword [rdx + 0x30], rax
movups xmm0, xmmword [rsp + 0x1f0]
movups xmm1, xmmword [rsp + 0x200]
movups xmm2, xmmword [rsp + 0x210]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0x110]
push rsi
pop rcx
nop
call fcn.14004382f
cmp qword [rsi], 2
je 0x1400406b0
mov rax, qword [rsp + 0x140]
lea rdx, [rsp + 0x500]
mov qword [rdx + 0x30], rax
movups xmm0, xmmword [rsp + 0x110]
movups xmm1, xmmword [rsp + 0x120]
movups xmm2, xmmword [rsp + 0x130]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0x80]
push rsi
nop
pop rcx
call fcn.1400438a9
cmp qword [rsi], 2
je 0x1400406b0
mov rax, qword [rsp + 0xb0]
lea rdx, [rsp + 0x500]
mov qword [rdx + 0x30], rax
movups xmm0, xmmword [rsp + 0x80]
movups xmm1, xmmword [rsp + 0x90]
movups xmm2, xmmword [rsp + 0xa0]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0xd0]
push rsi
pop rcx
nop
call fcn.14004393f
cmp qword [rsi], 2
je 0x1400406b0
mov rax, qword [rsp + 0x100]
lea rdx, [rsp + 0x500]
mov qword [rdx + 0x30], rax
movups xmm0, xmmword [rsp + 0xd0]
movups xmm1, xmmword [rsp + 0xe0]
movups xmm2, xmmword [rsp + 0xf0]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0x1a0]
mov rcx, rsi
call fcn.140043a09
cmp qword [rsi], 2
je 0x1400406b0
mov rax, qword [rsp + 0x1d0]
lea rdx, [rsp + 0x500]
mov qword [rdx + 0x30], rax
movups xmm0, xmmword [rsp + 0x1a0]
movups xmm1, xmmword [rsp + 0x1b0]
movups xmm2, xmmword [rsp + 0x1c0]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0x2c8]
nop
push rsi
pop rcx
call fcn.140043a86
mov rax, qword [rsi]
cmp rax, 2
je 0x1400406b0
movups xmm0, xmmword [rsp + 0x2d0]
movups xmm1, xmmword [rsp + 0x2e0]
movups xmm2, xmmword [rsp + 0x2f0]
lea rdx, [rsp + 0x328]
movups xmmword [rdx + 0x28], xmm2
movups xmmword [rdx + 0x18], xmm1
movups xmmword [rdx + 8], xmm0
mov qword [rdx], rax
lea rsi, [rsp + 0x110]
push rsi
pop rcx
nop
mov r8b, 1
call fcn.140043b65
mov edi, dword [rsi + 4]
cmp edi, 2
jne 0x140042aa1
lea rcx, [rsp + 0x328]
call fcn.14003eb5e
mov ebx, 8
sub esi, esi
mov rcx, qword [rsp + 0x3f8]
mov rdx, qword [rsp + 0x400]
call fcn.14003eb20
mov rcx, qword [rsp + 0x3f0]
mov rdx, qword [rsp + 0x3f8]
call fcn.14003ec23
mov qword [rsp + 0x3f0], rsi
mov qword [rsp + 0x3f8], rbx
mov qword [rsp + 0x400], rsi
mov r15, qword [rsp + 0x68]
cmp byte [r15 + 1], 0
je 0x140040a67
lea rcx, [rsp + 0x80]
and qword [rcx], 0
call sub.IPHLPAPI.DLL_GetIfTable2
test eax, eax
movabs r12, 0x8000000000000000
jne 0x1400419ac
lea r8, [rsp + 0x488]
mov rax, qword [r8 - 0x20]
mov rcx, qword [r8 - 0x18]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [r8 - 8]
lea rsi, [rsp + 0x500]
mov qword [rsi], rax
add rax, 0x10
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov word [rsi + 0x18], dx
mov qword [rsi + 0x20], r8
push rsi
nop
pop rcx
call fcn.14003ee00
or rax, rax
je 0x140040b9f
mov byte [rdx + 0x6e], 0
jmp 0x14004076f
cmp byte [r15 + 5], 0
je 0x1400406f9
mov rsi, qword [rsp + 0x3f8]
lea r14, [rsp + 0x1f8]
imul rbp, qword [rsp + 0x400], 0x60
lea rdi, [rsp + 0x110]
lea rbx, [rsp + 0x80]
lea r15, [rsp + 0x500]
lea r12, [rsp + 0xd0]
lea r13, [rsp + 0x1f0]
or rbp, rbp
je 0x1400406f9
mov rax, qword [rsi]
cmp rax, 2
jne 0x140040969
mov rcx, rdi
call fcn.140043803
cmp dword [rsp + 0x110], 2
je 0x140040908
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x530], rax
movups xmm0, xmmword [rsp + 0x110]
movups xmm1, xmmword [rsp + 0x120]
movups xmm2, xmmword [rsp + 0x130]
movaps xmmword [rsp + 0x520], xmm2
movaps xmmword [rsp + 0x510], xmm1
movaps xmmword [rsp + 0x500], xmm0
push rbx
pop rcx
nop
mov rdx, r15
call fcn.14004382f
cmp qword [rsp + 0x80], 2
je 0x140040908
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x530], rax
movups xmm0, xmmword [rsp + 0x80]
movups xmm1, xmmword [rsp + 0x90]
movups xmm2, xmmword [rsp + 0xa0]
movaps xmmword [rsp + 0x520], xmm2
movaps xmmword [rsp + 0x510], xmm1
movaps xmmword [rsp + 0x500], xmm0
mov rcx, r12
mov rdx, r15
call fcn.1400438a9
cmp qword [rsp + 0xd0], 2
je 0x140040908
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x530], rax
movups xmm0, xmmword [rsp + 0xd0]
movups xmm1, xmmword [rsp + 0xe0]
movups xmm2, xmmword [rsp + 0xf0]
movaps xmmword [rsp + 0x520], xmm2
movaps xmmword [rsp + 0x510], xmm1
movaps xmmword [rsp + 0x500], xmm0
mov rcx, rdi
mov rdx, r15
call fcn.14004393f
cmp qword [rsp + 0x110], 2
jne 0x140040a17
mov qword [rsp + 0x80], 2
push rsi
nop
pop rcx
call fcn.14003eb54
mov rax, qword [rsp + 0xb0]
mov qword [rsi + 0x30], rax
movups xmm0, xmmword [rsp + 0x80]
movups xmm1, xmmword [rsp + 0x90]
movups xmm2, xmmword [rsp + 0xa0]
movups xmmword [rsi + 0x20], xmm2
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, qword [rsi]
mov qword [rsi], 2
cmp rax, 2
jne 0x140040970
mov qword [rsp + 0x500], 2
jmp 0x14004099d
mov qword [rsi], 2
mov qword [rsp + 0x1f0], rax
movups xmm0, xmmword [rsi + 8]
movups xmm1, xmmword [rsi + 0x18]
movups xmm2, xmmword [rsi + 0x28]
movups xmmword [r14 + 0x20], xmm2
movups xmmword [r14 + 0x10], xmm1
movups xmmword [r14], xmm0
mov rcx, r15
mov rdx, r13
call fcn.140043a86
push rsi
pop rcx
nop
call fcn.14003eb54
mov rax, qword [rsp + 0x530]
mov qword [rsi + 0x30], rax
movups xmm0, xmmword [rsp + 0x500]
movups xmm1, xmmword [rsp + 0x510]
movups xmm2, xmmword [rsp + 0x520]
movups xmmword [rsi + 0x20], xmm2
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
cmp dword [rsi], 2
je 0x140040a0a
mov rcx, r15
mov rdx, rsi
sub r8d, r8d
call fcn.140043b65
cmp dword [rsp + 0x504], 2
je 0x140040a0a
movss xmm0, dword [rsp + 0x500]
movss dword [rsi + 0x58], xmm0
ucomiss xmm0, dword [rsi + 0x5c]
jbe 0x140040a0a
movss dword [rsi + 0x5c], xmm0
add rsi, 0x60
add rbp, 0xffffffffffffffa0
jmp 0x1400407d2
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x530], rax
movups xmm0, xmmword [rsp + 0x110]
movups xmm1, xmmword [rsp + 0x120]
movups xmm2, xmmword [rsp + 0x130]
movaps xmmword [rsp + 0x520], xmm2
movaps xmmword [rsp + 0x510], xmm1
movaps xmmword [rsp + 0x500], xmm0
mov rcx, rbx
mov rdx, r15
call fcn.140043a09
jmp 0x140040914
cmp byte [r15], 0
je 0x1400419ac
lea rsi, [rsp + 0x500]
mov r8d, 0x548
nop
push rsi
pop rcx
sub edx, edx
call sub.msvcrt.dll_memset
mov rax, qword [rsp + 0x468]
mov rcx, qword [rsp + 0x470]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [rsp + 0x480]
lea rdi, [rsp + 0x1f0]
mov qword [rdi], rax
add rax, 0x10
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rcx
mov word [rdi + 0x18], dx
mov qword [rdi + 0x20], r8
mov r14, 0xffffffffffffffff
nop
push rdi
pop rcx
call fcn.14003ee00
test rax, rax
je 0x1400419ac
push rdx
pop rbx
nop
mov rax, qword [rdx]
mov qword [rsp + 0x500], rax
and dword [rsp + 0x508], 0
nop
push rsi
pop rcx
call sub.IPHLPAPI.DLL_GetIfEntry2
test eax, eax
jne 0x140040ad7
mov rax, qword [rbx + 8]
mov rcx, qword [rbx + 0x18]
mov qword [rbx + 0x10], rax
mov rax, qword [rsp + 0xa00]
mov qword [rbx + 8], rax
mov qword [rbx + 0x20], rcx
mov rax, qword [rsp + 0x9b8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x28]
mov qword [rbx + 0x30], rax
mov rax, qword [rsp + 0x9c0]
add rax, qword [rsp + 0x9c8]
cmovb rax, r14
mov qword [rbx + 0x28], rax
mov rax, qword [rbx + 0x38]
mov qword [rbx + 0x40], rax
mov rax, qword [rsp + 0xa08]
add rax, qword [rsp + 0xa10]
cmovb rax, r14
mov qword [rbx + 0x38], rax
mov rax, qword [rbx + 0x48]
mov qword [rbx + 0x50], rax
mov rax, qword [rsp + 0x9d8]
mov qword [rbx + 0x48], rax
mov rax, qword [rbx + 0x58]
mov qword [rbx + 0x60], rax
mov rax, qword [rsp + 0xa20]
mov qword [rbx + 0x58], rax
jmp 0x140040ad7
lea rsi, [rsp + 0x500]
mov rcx, rsi
call fcn.140042c08
nop
push rsi
pop rcx
call fcn.140042c42
movdqa xmmword [rsi], xmm6
movdqa xmmword [rsi + 0x10], xmm7
lea rcx, [rsp + 0x520]
mov qword [rcx], rax
lea rax, [rsp + 0x110]
and qword [rax], 0
mov qword [rax + 8], 8
and qword [rax + 0x10], 0
mov qword [rcx + 8], rdx
mov rax, qword [rsp + 0x80]
lea rcx, [rax + 8]
mov qword [rsp + 0x1e8], rax
mov edx, dword [rax]
mov eax, 8
mov qword [rsp + 0xc0], rax
sub eax, eax
mov qword [rsp + 0x70], rax
pcmpeqd xmm6, xmm6
sub eax, eax
mov qword [rsp + 0x180], rax
sub r8d, r8d
mov qword [rsp + 0x188], rcx
mov qword [rsp + 0x58], rdx
cmp r8, rdx
je 0x140040f37
mov r15, r8
inc r8
imul rax, r15, 0x548
lea rsi, [rcx + rax]
cmp qword [rcx + rax + 0x4a8], 0
jne 0x140040c5f
cmp qword [rsi + 0x4b0], 0
je 0x140040c30
cmp dword [rsi + 0x48c], 2
je 0x140040c30
cmp dword [rsi + 0x420], 0
je 0x140040c30
mov qword [rsp + 0x48], r8
mov ecx, 0x14
mov edx, 2
call fcn.14000b03b
mov r13, rax
mov eax, dword [rsi + 0x10]
movzx ecx, byte [rsi + 0x14]
movzx edx, byte [rsi + 0x15]
movzx r8d, byte [rsi + 0x16]
movzx r9d, byte [rsi + 0x17]
movzx r10d, byte [rsi + 0x18]
movzx r11d, byte [rsi + 0x19]
movzx edi, byte [rsi + 0x1a]
movzx esi, byte [rsi + 0x1b]
mov dword [r13], eax
mov word [r13 + 4], cx
mov word [r13 + 6], dx
mov word [r13 + 8], r8w
mov word [r13 + 0xa], r9w
mov word [r13 + 0xc], r10w
mov word [r13 + 0xe], r11w
mov word [r13 + 0x10], di
mov word [r13 + 0x12], si
mov r8d, 0xa
lea rcx, [rsp + 0x1f0]
mov rdx, r13
call fcn.14003bf45
mov rcx, qword [rsp + 0x520]
mov rdx, qword [rsp + 0x528]
mov r14, qword [rsp + 0x1f8]
mov r12, qword [rsp + 0x200]
mov r8, r14
mov r9, r12
call fcn.14003e5ac
mov rdi, qword [rsp + 0x500]
mov rbp, qword [rsp + 0x508]
push rbp
nop
pop rsi
and rsi, rax
mov qword [rsp + 0x60], rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
sub eax, eax
mov qword [rsp + 0x40], rax
movdqu xmm8, xmmword [rdi + rsi]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0xd0], ax
lea rcx, [rsp + 0xd0]
call fcn.14003acb6
or rax, rax
je 0x140040daa
add rdx, rsi
and rdx, rbp
shl rdx, 5
push rdi
pop rbx
nop
sub rbx, rdx
mov rcx, qword [rbx - 0x18]
mov rdx, qword [rbx - 0x10]
mov r8, r14
mov r9, r12
call fcn.14003e647
test al, al
je 0x140040d6f
jmp 0x140040dcd
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
mov rax, qword [rsp + 0x40]
jne 0x140040e21
add rsi, rax
add rsi, 0x10
add rax, 0x10
and rsi, rbp
jmp 0x140040d4f
mov rcx, qword [rsp + 0x1f0]
movabs r12, 0x8000000000000000
cmp rcx, r12
je 0x140040dec
mov rdx, r14
call fcn.1400398ea
mov eax, dword [rbx - 8]
inc eax
mov dword [rbx - 8], eax
cmp eax, 1
jle 0x140040e93
mov ecx, 0xa
mov rdx, r13
call fcn.1400398ea
mov rcx, qword [rsp + 0x188]
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x48]
jmp 0x140040c30
cmp qword [rsp + 0x510], 0
je 0x140040f0d
mov rsi, qword [rsp + 0x1f0]
push rdi
pop rcx
nop
nop
push rbp
pop rdx
mov r8, qword [rsp + 0x60]
call fcn.14003ee20
mov rcx, qword [rsp + 0x500]
shl rax, 5
mov rbx, rcx
and dl, 1
movzx edx, dl
sub qword [rsp + 0x510], rdx
sub rbx, rax
neg rax
mov qword [rcx + rax - 0x20], rsi
mov qword [rbx - 0x18], r14
mov qword [rbx - 0x10], r12
and dword [rbx - 8], 0
inc qword [rsp + 0x518]
movabs r12, 0x8000000000000000
jmp 0x140040dec
mov rax, qword [rsp + 0x70]
cmp rax, qword [rsp + 0x110]
jne 0x140040ebf
lea rcx, [rsp + 0x110]
call fcn.14003e92a
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0xc0], rax
mov rcx, qword [rsp + 0x70]
nop
push rcx
pop rax
shl rax, 5
mov rdx, qword [rsp + 0xc0]
mov dword [rdx + rax], r15d
mov r8d, 0xa
mov qword [rdx + rax + 8], r8
mov qword [rdx + rax + 0x10], r13
mov qword [rdx + rax + 0x18], r8
inc rcx
push rcx
nop
pop rax
mov qword [rsp + 0x70], rcx
mov qword [rsp + 0x120], rcx
add qword [rsp + 0x180], 0x20
jmp 0x140040e0a
lea rcx, [rsp + 0x500]
lea rdx, [rsp + 0x520]
call fcn.14003eeda
mov rdi, qword [rsp + 0x500]
mov rbp, qword [rsp + 0x508]
jmp 0x140040e30
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x1e0], rax
mov rcx, qword [rsp + 0x118]
mov rax, qword [rsp + 0x70]
shl rax, 5
add rax, rcx
mov qword [rsp + 0x70], rax
add qword [rsp + 0x1e8], 0x24
lea rsi, [rsp + 0x1f0]
pcmpeqd xmm6, xmm6
mov qword [rsp + 0x1d8], rcx
nop
push rcx
pop rbx
nop
push rbx
pop rdi
cmp rbx, qword [rsp + 0x70]
je 0x14004149b
lea rbx, [rdi + 0x20]
mov r14, qword [rdi + 8]
cmp r14, r12
je 0x140041498
mov r13, qword [rdi + 0x10]
mov ecx, dword [rdi]
cmp qword [rsp + 0x518], 0
je 0x1400410cb
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x48], rbx
mov r14, qword [rdi + 0x18]
mov rcx, qword [rsp + 0x520]
mov rdx, qword [rsp + 0x528]
mov r8, r13
mov r9, r14
call fcn.14003e5ac
mov rbp, qword [rsp + 0x500]
mov rbx, qword [rsp + 0x508]
nop
push rbx
pop rdi
and rdi, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor eax, eax
mov qword [rsp + 0x40], rax
movdqu xmm8, xmmword [rbp + rdi]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0x1f0], ax
push rsi
pop rcx
nop
call fcn.14003acb6
mov r15, rax
test rax, rax
je 0x140041070
mov r12, rdx
add r12, rdi
and r12, rbx
mov rax, r12
shl rax, 5
push rbp
nop
pop rcx
sub rcx, rax
mov r8, qword [rcx - 0x18]
mov r9, qword [rcx - 0x10]
mov rcx, r13
mov rdx, r14
call fcn.14003e647
test al, al
je 0x140041031
jmp 0x140041096
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
mov rax, qword [rsp + 0x40]
jne 0x140041096
add rdi, rax
add rdi, 0x10
add rax, 0x10
and rdi, rbx
jmp 0x140041010
shl r12, 5
sub rbp, r12
test r15, r15
cmove rbp, r15
add rbp, 0xffffffffffffffe0
or r15, r15
cmove rbp, r15
add rbp, 0x18
or r15, r15
cmove rbp, r15
mov rbx, qword [rsp + 0x48]
mov r14, qword [rsp + 0x58]
mov rcx, qword [rsp + 0x60]
jmp 0x1400410cd
sub ebp, ebp
test rbp, rbp
lea rax, [0x140996130]
cmove rbp, rax
cmp dword [rbp], 1
movabs r12, 0x8000000000000000
jg 0x140041311
imul rax, rcx, 0x548
mov rcx, qword [rsp + 0x188]
lea rdi, [rcx + rax]
lea rdx, [rdi + 0x1c]
add rax, qword [rsp + 0x1e8]
mov ecx, 0x202
xor r8d, r8d
test rcx, rcx
je 0x14004112c
cmp word [rax + r8*2], 0
je 0x140041134
inc r8
add rcx, 0xfffffffffffffffe
jmp 0x140041116
mov r8d, 0x101
jmp 0x140041141
cmp r8, 0x102
jae 0x140042bb1
push rsi
pop rcx
nop
call fcn.1400036a0
mov rax, qword [rsp + 0x1f0]
cmp rax, r12
je 0x140041311
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], r14
mov qword [rsp + 0x48], rbx
mov rbp, qword [rsp + 0x1f8]
mov r14, qword [rsp + 0x200]
mov rcx, qword [rsp + 0x488]
mov rdx, qword [rsp + 0x490]
mov r8, rbp
mov r9, r14
call fcn.14003e516
mov r15, qword [rsp + 0x468]
mov r12, qword [rsp + 0x470]
mov rbx, r12
and rbx, rax
mov qword [rsp + 0x318], rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor eax, eax
mov qword [rsp + 0x40], rax
movdqu xmm8, xmmword [r15 + rbx]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0x1f0], ax
push rsi
pop rcx
nop
call fcn.14003acb6
or rax, rax
je 0x14004122a
add rdx, rbx
and rdx, r12
neg rdx
imul rdi, rdx, 0x88
mov rcx, qword [r15 + rdi - 0x80]
mov rdx, qword [r15 + rdi - 0x78]
mov r8, rbp
mov r9, r14
call fcn.14003e642
test al, al
je 0x1400411f2
jmp 0x140041251
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
or eax, eax
mov rax, qword [rsp + 0x40]
jne 0x140041321
add rbx, rax
add rbx, 0x10
add rax, 0x10
and rbx, r12
jmp 0x1400411d2
add r15, rdi
mov rax, qword [r15 - 0x68]
mov rcx, qword [r15 - 0x58]
mov qword [r15 - 0x60], rax
mov rdx, qword [rsp + 0x60]
mov rax, qword [rdx + 0x500]
mov qword [r15 - 0x68], rax
mov qword [r15 - 0x50], rcx
mov rax, qword [rdx + 0x4b8]
mov qword [r15 - 0x58], rax
mov rax, qword [r15 - 0x48]
mov qword [r15 - 0x40], rax
mov rax, qword [rdx + 0x4c0]
add rax, qword [rdx + 0x4c8]
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov qword [r15 - 0x48], rax
mov rax, qword [r15 - 0x38]
mov qword [r15 - 0x30], rax
mov rax, qword [rdx + 0x508]
add rax, qword [rdx + 0x510]
cmovb rax, rcx
mov qword [r15 - 0x38], rax
mov rax, qword [r15 - 0x28]
mov qword [r15 - 0x20], rax
mov rax, qword [rdx + 0x4d8]
mov qword [r15 - 0x28], rax
mov rax, qword [r15 - 0x18]
mov qword [r15 - 0x10], rax
mov rax, qword [rdx + 0x520]
mov qword [r15 - 0x18], rax
mov byte [r15 - 2], 1
mov rcx, qword [rsp + 0xc0]
mov rdx, rbp
call fcn.14000c2be
movabs r12, 0x8000000000000000
mov rbx, qword [rsp + 0x48]
mov r14, qword [rsp + 0x58]
mov rcx, r14
mov rdx, r13
call fcn.1400398ea
jmp 0x140040f80
cmp qword [rsp + 0x478], 0
je 0x14004146e
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rcx + 0x4c0]
add rdx, qword [rcx + 0x4c8]
mov rax, 0xffffffffffffffff
cmovb rdx, rax
mov qword [rsp + 0x40], rdx
mov rbx, qword [rcx + 0x508]
add rbx, qword [rcx + 0x510]
cmovb rbx, rax
mov rax, qword [rcx]
mov qword [rsp + 0x300], rax
mov rdi, qword [rcx + 0x500]
mov rax, qword [rcx + 0x4b8]
mov qword [rsp + 0x308], rax
mov rax, qword [rcx + 0x4d8]
mov qword [rsp + 0x310], rax
mov rax, qword [rcx + 0x520]
mov qword [rsp + 0x60], rax
mov rcx, r15
mov rdx, r12
mov r8, qword [rsp + 0x318]
call fcn.14003ee20
mov rcx, qword [rsp + 0x468]
neg rax
and dl, 1
movzx edx, dl
sub qword [rsp + 0x478], rdx
imul rax, rax, 0x88
mov rdx, qword [rsp + 0xc0]
mov qword [rcx + rax - 0x88], rdx
mov qword [rcx + rax - 0x80], rbp
mov qword [rcx + rax - 0x78], r14
mov rdx, qword [rsp + 0x300]
mov qword [rcx + rax - 0x70], rdx
mov qword [rcx + rax - 0x68], rdi
mov qword [rcx + rax - 0x60], rdi
mov rdx, qword [rsp + 0x308]
mov qword [rcx + rax - 0x58], rdx
mov qword [rcx + rax - 0x50], rdx
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax - 0x48], rdx
mov qword [rcx + rax - 0x40], rdx
mov qword [rcx + rax - 0x38], rbx
mov qword [rcx + rax - 0x30], rbx
mov rdx, qword [rsp + 0x310]
mov qword [rcx + rax - 0x28], rdx
mov qword [rcx + rax - 0x20], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rcx + rax - 0x18], rdx
mov qword [rcx + rax - 0x10], rdx
and dword [rcx + rax - 8], 0
and word [rcx + rax - 4], 0
mov byte [rcx + rax - 2], 1
inc qword [rsp + 0x480]
jmp 0x1400412fd
lea rcx, [rsp + 0x468]
lea rdx, [rsp + 0x488]
call fcn.14003f484
mov r15, qword [rsp + 0x468]
mov r12, qword [rsp + 0x470]
jmp 0x140041330
nop
push rbx
pop rdi
lea r14, [rsp + 0x468]
mov rax, qword [rsp + 0x180]
mov rbx, qword [rsp + 0x1e0]
mov r15, qword [rsp + 0x1d8]
mov rsi, r15
sub rsi, rdi
add rdi, 0x10
add rsi, rax
shr rsi, 5
sub rsi, 1
jb 0x1400414e4
mov rcx, qword [rdi - 8]
mov rdx, qword [rdi]
call fcn.1400398ea
add rdi, 0x20
jmp 0x1400414cc
test rbx, rbx
je 0x1400414fd
shl rbx, 5
mov edx, 8
mov rcx, r15
mov r8, rbx
call fcn.14000155c
mov rcx, qword [rsp + 0x80]
call sub.IPHLPAPI.DLL_FreeMibTable
mov r8, qword [rsp + 0x508]
test r8, r8
je 0x14004162a
mov rdx, qword [rsp + 0x500]
mov rax, qword [rsp + 0x518]
or rax, rax
je 0x1400415fb
lea rcx, [rdx + r8]
inc rcx
movdqa xmm0, xmmword [rdx]
pmovmskb r8d, xmm0
not r8d
lea rsi, [rsp + 0x208]
mov qword [rsi - 0x18], rdx
add rdx, 0x10
mov qword [rsi - 0x10], rdx
mov qword [rsi - 8], rcx
mov word [rsi], r8w
mov qword [rsi + 8], rax
mov edi, 1
test rdi, rdi
jne 0x1400415a5
jmp 0x1400415eb
mov rax, qword [rsp + 0x1f8]
movdqa xmm0, xmmword [rax]
pmovmskb ecx, xmm0
not ecx
mov word [rsp + 0x208], cx
add qword [rsp + 0x1f0], 0xfffffffffffffe00
add rax, 0x10
mov qword [rsp + 0x1f8], rax
mov rcx, rsi
call fcn.14003acb6
cmp rax, 1
jne 0x140041573
shl rdx, 5
mov rax, qword [rsp + 0x1f0]
mov rdi, qword [rsp + 0x210]
push rax
nop
pop rcx
sub rcx, rdx
dec rdi
mov qword [rsp + 0x210], rdi
mov rcx, qword [rcx - 0x20]
neg rdx
mov rdx, qword [rax + rdx - 0x18]
call fcn.1400398ea
jmp 0x14004156c
mov rdx, qword [rsp + 0x500]
mov r8, qword [rsp + 0x508]
mov qword [rsp + 0x20], 0x10
lea rsi, [rsp + 0x1f0]
mov r9d, 0x20
push rsi
nop
pop rcx
call fcn.14003ece8
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
mov r8, qword [rsi + 0x10]
call fcn.14000155c
mov rax, qword [rsp + 0x468]
mov rcx, qword [rsp + 0x470]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [rsp + 0x480]
lea rsi, [rsp + 0x500]
mov qword [rsi], rax
add rax, 0x10
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov word [rsi + 0x18], dx
mov qword [rsi + 0x20], r8
mov edi, 0x88
push rsi
pop rcx
nop
call fcn.14003e385
or rax, rax
je 0x1400416b9
push rax
pop rbx
nop
cmp byte [rax - 2], 0
jne 0x140041676
mov rax, qword [rsp + 0x468]
sub rax, rbx
cqo
idiv rdi
mov rcx, r14
nop
push rax
pop rdx
call fcn.14003fcfe
mov rcx, qword [rbx - 0x88]
mov rdx, qword [rbx - 0x80]
call fcn.14000c2be
jmp 0x140041676
lea rdi, [rsp + 0x1a0]
mov dword [rdi], 0x3c00
and dword [rsp + 0xd0], 0
mov ebp, 4
xor r14d, r14d
lea rsi, str.failed_to_allocate_memory_for_IP_ADAPTER_ADDRESSESGetAdaptersAddresses___failed_with_code
lea rbx, [rsp + 0x500]
dec ebp
je 0x1400417a4
mov edx, dword [rsp + 0x1a0]
mov rcx, r14
call sub.msvcrt.dll_realloc
mov r15, rax
mov r12, rax
or rax, rax
jne 0x14004174c
mov r8d, 0x32
nop
push rbx
pop rcx
push rsi
nop
pop rdx
call fcn.140039f5f
mov rcx, r14
call sub.msvcrt.dll_free
mov rcx, qword [rsp + 0x500]
mov r12, qword [rsp + 0x508]
mov r15, qword [rsp + 0x510]
movabs rax, 0x8000000000000000
cmp rcx, rax
jne 0x140042a7a
mov qword [rsp + 0x20], rdi
sub ecx, ecx
mov edx, 0xe
sub r8d, r8d
mov r9, r12
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
mov dword [rsp + 0xd0], eax
mov r14, r12
cmp eax, 0x6f
je 0x1400416e6
or eax, eax
jne 0x1400417a1
mov qword [rsp + 0x1f8], r12
mov qword [rsp + 0x200], r15
movabs rdi, 0x8000000000000000
mov qword [rsp + 0x1f0], rdi
push rdi
pop rcx
nop
jmp 0x140041818
mov r14, r12
movabs rdi, 0x8000000000000000
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x110], rax
lea rax, [0x1409966b0]
lea rdx, [rsp + 0x500]
mov qword [rdx], rax
mov eax, 1
mov qword [rdx + 8], rax
and qword [rdx + 0x20], 0
lea rcx, [0x140004b10]
mov qword [rsp + 0x118], rcx
lea rcx, [rsp + 0x110]
mov qword [rdx + 0x10], rcx
mov qword [rdx + 0x18], rax
lea rsi, [rsp + 0x1f0]
nop
push rsi
pop rcx
call fcn.140039f1a
mov rcx, r14
call sub.msvcrt.dll_free
mov rcx, qword [rsi]
mov r15, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x1f8]
cmp rcx, rdi
jne 0x140041993
mov rax, qword [rsp + 0x200]
lea rcx, [rsp + 0x110]
mov qword [rcx], rdx
mov qword [rcx + 8], rax
lea rbx, [rsp + 0xd0]
pcmpeqd xmm6, xmm6
lea rcx, [rsp + 0x500]
lea rdx, [rsp + 0x110]
call fcn.140043683
mov r14, qword [rsp + 0x500]
cmp r14, rdi
je 0x14004199a
mov r15, qword [rsp + 0x508]
cmp qword [rsp + 0x480], 0
je 0x140041979
mov r12, qword [rsp + 0x510]
mov rcx, qword [rsp + 0x488]
mov rdx, qword [rsp + 0x490]
mov r8, r15
mov r9, r12
call fcn.14003e516
mov rbp, qword [rsp + 0x468]
mov rsi, qword [rsp + 0x470]
nop
push rsi
pop rdi
and rdi, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor eax, eax
mov qword [rsp + 0x40], rax
movdqu xmm8, xmmword [rbp + rdi]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0xd0], ax
nop
push rbx
pop rcx
call fcn.14003acb6
or rax, rax
je 0x140041938
add rdx, rdi
and rdx, rsi
neg rdx
imul r13, rdx, 0x88
mov r8, qword [rbp + r13 - 0x80]
mov r9, qword [rbp + r13 - 0x78]
mov rcx, r15
mov rdx, r12
call fcn.14003e642
test al, al
je 0x140041900
jmp 0x140041960
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
or eax, eax
jne 0x140041979
mov rax, qword [rsp + 0x40]
add rdi, rax
add rdi, 0x10
add rax, 0x10
mov qword [rsp + 0x40], rax
and rdi, rsi
jmp 0x1400418e4
lea rcx, [rsp + 0x518]
movzx eax, word [rcx + 4]
mov word [rbp + r13 - 4], ax
mov eax, dword [rcx]
mov dword [rbp + r13 - 8], eax
mov rcx, r14
mov rdx, r15
call fcn.14000c2be
movabs rdi, 0x8000000000000000
jmp 0x140041851
call fcn.14000c2be
jmp 0x1400419ac
mov rcx, qword [rsp + 0x110]
call sub.msvcrt.dll_free
mov r15, qword [rsp + 0x68]
movzx ebp, word [r15 + 8]
cmp bpl, 2
je 0x1400420f1
movzx eax, byte [r15 + 0xa]
shl eax, 0x10
mov ecx, ebp
or ecx, eax
mov word [rsp + 0x54], cx
shr ecx, 0x10
mov byte [rsp + 0x56], cl
lea rbx, [rsp + 0x2c8]
mov edi, 0x80000
mov edx, 0x80000
push rbx
pop rcx
nop
call fcn.140042dd5
lea r14, [rsp + 0x500]
and dword [rsp + 0x500], 0
push rbx
pop rcx
nop
nop
push rdi
pop rdx
call fcn.14000af03
mov rsi, qword [rsp + 0x2d0]
mov ecx, 5
nop
push rsi
pop rdx
mov r8d, edi
mov r9, r14
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
jne 0x140041a42
mov eax, dword [rsp + 0x500]
add rdi, rdi
lea ecx, [rax + 0x2800]
or eax, eax
cmovne rdi, rcx
jmp 0x1400419f5
or eax, eax
jne 0x140041aee
mov qword [rsp + 0x2d8], rdi
mov ecx, 8
mov edx, 0xfa0
call fcn.14000bf3f
or rax, rax
je 0x140042bc8
lea rdi, [rsp + 0x1a0]
mov qword [rdi], 0x1f4
mov qword [rdi + 8], rax
and qword [rdi + 0x10], 0
sub ebx, ebx
xor r14d, r14d
cmp rbx, qword [rsp + 0x1a0]
jne 0x140041aa1
push rdi
nop
pop rcx
call fcn.14003e7ce
mov rax, qword [rsp + 0x1a8]
lea rcx, [rsi + r14]
mov qword [rax + rbx*8], rcx
inc rbx
mov qword [rsp + 0x1b0], rbx
mov ecx, dword [rcx]
add r14, rcx
or rcx, rcx
jne 0x140041a87
lea rax, [rsp + 0x438]
mov qword [rsp + 0x190], rax
test bpl, bpl
je 0x140041afe
lea rsi, [rsp + 0x360]
push rsi
pop rcx
nop
xor edx, edx
call fcn.140042e1b
mov rax, qword [rsi + 0x80]
jmp 0x140041b00
mov rcx, qword [rsp + 0x2c8]
mov rdx, rsi
jmp 0x1400420ec
xor eax, eax
movabs r13, 0x8000000000000000
mov qword [rsp + 0x78], rax
call fcn.140034c40
mov r8d, edx
lea rsi, [rsp + 0x500]
push rsi
nop
pop rcx
mov edx, eax
call fcn.140034c70
cmp qword [rsi], 0
jne 0x140041b39
mov rax, qword [rsp + 0x508]
jmp 0x140041b3b
sub eax, eax
lea rcx, [rsp + 0x328]
mov qword [rcx], rax
mov rdi, qword [rsp + 0x1b0]
mov qword [rsp + 0x510], rdi
and qword [rsp + 0xd0], 0
mov qword [rsp + 0xd8], 8
and qword [rsp + 0xe0], 0
movups xmm0, xmmword [rsp + 0x1a0]
movaps xmmword [rsp + 0x500], xmm0
lea rax, [rsp + 0x190]
mov qword [rsp + 0x518], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x520], rax
lea rax, [rsp + 0x78]
movups xmm0, xmmword [rsp + 0x1a0]
movaps xmmword [rsp + 0x110], xmm0
and qword [rsp + 0x120], 0
mov qword [rsp + 0x528], rax
mov qword [rsp + 0x530], rcx
cmp qword [rsp + 0x110], rdi
jb 0x140042bd7
lea rsi, [rsp + 0x518]
mov rbx, qword [rsp + 0x118]
push rdi
nop
pop rcx
call fcn.14003e465
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], 1
lea rsi, [rsp + 0x80]
mov rcx, rsi
push rdi
pop rdx
nop
sub r8d, r8d
mov r9, rax
call fcn.14003c2ff
cmp qword [rsp + 0x120], rdi
jne 0x140041c65
lea rax, [rsp + 0x110]
and qword [rax + 0x10], 0
lea rcx, [rsp + 0x1f0]
mov qword [rcx + 0x18], rdi
and qword [rcx + 0x20], 0
mov qword [rcx + 0x10], rax
mov eax, 8
mov qword [rcx], rax
mov qword [rcx + 8], rax
call fcn.14003e488
jmp 0x140041c73
test rdi, rdi
jne 0x140041c73
and qword [rsp + 0x120], 0
mov r8, qword [rsp + 0x110]
test r8, r8
je 0x140041c96
shl r8, 3
mov rcx, qword [rsp + 0x118]
mov edx, 8
call fcn.14000155c
mov rax, qword [rsp + 0x90]
sub edx, edx
sub rax, 1
jb 0x140041cb8
mov rsi, qword [rsi]
test rsi, rsi
je 0x140041cb8
add rdx, qword [rsi + 0x10]
add rsi, 0x18
jmp 0x140041ca0
lea rcx, [rsp + 0xd0]
call fcn.14003e66f
mov rax, qword [rsp + 0x90]
lea rsi, [rsp + 0x1f0]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x80]
movaps xmmword [rsi], xmm0
lea rbx, [rsp + 0x508]
lea rdi, [rsp + 0x500]
nop
push rsi
pop rcx
call fcn.14003b253
or rax, rax
je 0x140041db0
mov r14, qword [rax]
movups xmm0, xmmword [rax + 8]
movaps xmmword [rsp + 0x500], xmm0
mov edx, 8
mov rcx, rax
call fcn.1400038d0
movaps xmm0, xmmword [rsp + 0x500]
movaps xmmword [rsp + 0x110], xmm0
cmp r14, r13
je 0x140041db0
mov qword [rsp + 0x500], r14
movaps xmm0, xmmword [rsp + 0x110]
movups xmmword [rbx], xmm0
mov r14, qword [rsp + 0x508]
mov r15, qword [rsp + 0x510]
lea rcx, [rsp + 0xd0]
mov rdx, r15
call fcn.14003e66f
mov r12, qword [rsp + 0xe0]
imul rcx, r12, 0x150
add rcx, qword [rsp + 0xd8]
imul r8, r15, 0x150
mov rdx, r14
call sub.msvcrt.dll_memcpy
add r12, r15
mov qword [rsp + 0xe0], r12
and qword [rsp + 0x510], 0
push rdi
nop
pop rcx
call fcn.14003969a
jmp 0x140041cf4
lea rcx, [rsp + 0x1f0]
call fcn.14003c2c8
mov rax, qword [rsp + 0xd0]
mov qword [rsp + 0x40], rax
imul rbx, qword [rsp + 0xe0], 0x150
mov r13, qword [rsp + 0xd8]
lea rax, [rbx + r13]
mov qword [rsp + 0x58], rax
lea r15, [rsp + 0x500]
mov qword [rsp + 0x48], r13
or rbx, rbx
je 0x140042014
mov rbp, qword [r13]
cmp rbp, 2
je 0x14004200d
lea rsi, [r13 + 0xe0]
mov r12, qword [r13 + 0xd8]
lea rdx, [r13 + 8]
mov r8d, 0xd0
lea rcx, [rsp + 0x1f0]
call sub.msvcrt.dll_memcpy
mov ecx, 0xe
lea rdi, [rsp + 0x110]
rep movsq qword [rdi], qword [rsi]
mov qword [rsp + 0xd0], r12
mov rcx, qword [rsp + 0x458]
mov rdx, qword [rsp + 0x460]
mov r8, r12
call fcn.14003ac3b
push rax
nop
pop rsi
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x80], rax
cmp qword [rsp + 0x448], 0
je 0x140041ff3
lea rax, [rsp + 0x80]
mov qword [rsp + 0x500], rax
lea rax, [rsp + 0x438]
mov qword [rsp + 0x508], rax
mov rcx, qword [rsp + 0x438]
mov rdx, qword [rsp + 0x440]
lea rax, [0x14003fae7]
mov qword [rsp + 0x20], rax
mov r8, rsi
mov r9, r15
call fcn.14003f78f
mov rdi, qword [rsp + 0x438]
or rax, rax
je 0x140041f65
movzx eax, byte [rdi + rdx]
and eax, 1
sub qword [rsp + 0x448], rax
mov rax, qword [rsp + 0xd0]
shr rsi, 0x39
lea rcx, [rdx - 0x10]
and rcx, qword [rsp + 0x440]
mov byte [rdi + rdx], sil
mov byte [rdi + rcx + 0x10], sil
inc qword [rsp + 0x450]
neg rdx
imul r14, rdx, 0x158
lea rsi, [rdi + r14]
add rsi, 0xfffffffffffffeb8
mov qword [rsi - 0x10], rax
mov qword [rsi - 8], rbp
mov r8d, 0xd0
push rsi
nop
pop rcx
lea rdx, [rsp + 0x1f0]
call sub.msvcrt.dll_memcpy
mov qword [rsi + 0xd0], r12
add rdi, r14
add rdi, 0xffffffffffffff90
mov ecx, 0xe
lea rsi, [rsp + 0x110]
rep movsq qword [rdi], qword [rsi]
jmp 0x140041fe0
neg rdx
imul r14, rdx, 0x158
lea rsi, [rdi + r14]
add rsi, 0xfffffffffffffeb0
mov r8d, 0x150
mov rcx, r15
push rsi
nop
pop rdx
call sub.msvcrt.dll_memcpy
mov qword [rsi], rbp
lea rsi, [rdi + r14]
add rsi, 0xfffffffffffffeb8
mov r8d, 0xd0
mov rcx, rsi
lea rdx, [rsp + 0x1f0]
call sub.msvcrt.dll_memcpy
mov qword [rsi + 0xd0], r12
add rdi, r14
add rdi, 0xffffffffffffff90
mov ecx, 0xe
lea rsi, [rsp + 0x110]
rep movsq qword [rdi], qword [rsi]
cmp qword [rsp + 0x500], 2
je 0x140041fe0
mov rcx, r15
call fcn.14003970b
add r13, 0x150
add rbx, 0xfffffffffffffeb0
jmp 0x140041df4
lea rcx, [rsp + 0x438]
lea rdx, [rsp + 0x458]
call fcn.14003fb0d
jmp 0x140041e82
add r13, 0x150
mov rax, qword [rsp + 0x58]
sub rax, r13
mov ecx, 0x150
xor edx, edx
div rcx
mov rcx, r13
mov rdx, rax
call fcn.1400396e1
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
call fcn.1400396c4
mov rax, qword [rsp + 0x438]
mov rcx, qword [rsp + 0x440]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [rsp + 0x450]
lea rsi, [rsp + 0x500]
mov qword [rsi], rax
add rax, 0x10
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov word [rsi + 0x18], dx
mov qword [rsi + 0x20], r8
mov ebx, 0x158
mov r15, qword [rsp + 0x68]
push rsi
pop rcx
nop
call fcn.14003ed9f
test rax, rax
je 0x1400420dc
push rax
nop
pop rdi
cmp byte [rax - 4], 0
mov byte [rax - 4], 0
jne 0x140042091
mov rax, qword [rsp + 0x438]
sub rax, rdi
cqo
idiv rbx
lea rcx, [rsp + 0x438]
nop
push rax
pop rdx
call fcn.14003fcfe
add rdi, 0xfffffffffffffeb0
nop
push rdi
pop rcx
call fcn.14003970b
jmp 0x140042091
mov rcx, qword [rsp + 0x2c8]
mov rdx, qword [rsp + 0x2d0]
call fcn.14000c2be
cmp byte [r15 + 2], 0
je 0x1400422fb
lea rsi, [rsp + 0x408]
call sub.KERNEL32.dll_GetLogicalDrives
mov dword [rsp + 0x1a0], eax
or eax, eax
movabs rbp, 0x8000000000000000
je 0x14004237d
and qword [rsp + 0x80], 0
mov qword [rsp + 0x88], 8
and qword [rsp + 0x90], 0
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x500], rax
movabs rax, 0x2000000000
mov qword [rsp + 0x508], rax
mov ecx, 0x20
call fcn.14003e465
lea rcx, [rsp + 0x500]
mov qword [rsp + 0x38], rcx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x20
mov qword [rsp + 0x20], 1
sub ebx, ebx
lea rdi, [rsp + 0x110]
mov edx, 0x20
nop
push rdi
pop rcx
xor r8d, r8d
mov r9, rax
call fcn.14003b281
mov rax, qword [rdi + 0x10]
sub rax, 1
jb 0x1400421c8
mov rdi, qword [rdi]
or rdi, rdi
je 0x1400421c8
add rbx, qword [rdi + 0x10]
add rdi, 0x18
jmp 0x1400421b0
lea rdi, [rsp + 0x80]
mov rcx, rdi
mov rdx, rbx
call fcn.14003e6a7
mov rax, qword [rsp + 0x120]
lea rbx, [rsp + 0x1f0]
mov qword [rbx + 0x10], rax
movups xmm0, xmmword [rsp + 0x110]
movaps xmmword [rbx], xmm0
lea r13, [rsp + 0x508]
lea r14, [rsp + 0x500]
push rbx
pop rcx
nop
call fcn.14003b253
or rax, rax
je 0x1400422d1
mov r15, qword [rax]
movups xmm0, xmmword [rax + 8]
movaps xmmword [rsp + 0x500], xmm0
mov edx, 8
nop
push rax
pop rcx
call fcn.1400038d0
movaps xmm0, xmmword [rsp + 0x500]
movaps xmmword [rsp + 0xd0], xmm0
cmp r15, rbp
je 0x1400422d1
mov qword [rsp + 0x500], r15
movaps xmm0, xmmword [rsp + 0xd0]
movups xmmword [r13], xmm0
mov r15, qword [rsp + 0x508]
mov r12, qword [rsp + 0x510]
mov rcx, rdi
mov rdx, r12
call fcn.14003e6a7
mov rbp, qword [rsp + 0x90]
imul rcx, rbp, 0x90
add rcx, qword [rsp + 0x88]
imul r8, r12, 0x90
mov rdx, r15
call sub.msvcrt.dll_memcpy
add rbp, r12
mov qword [rsp + 0x90], rbp
movabs rbp, 0x8000000000000000
and qword [rsp + 0x510], 0
mov rcx, r14
call fcn.14003984a
jmp 0x14004220a
lea rcx, [rsp + 0x1f0]
call fcn.14003b21c
mov rbx, qword [rsp + 0x80]
mov rdi, qword [rsp + 0x88]
mov r14, qword [rsp + 0x90]
jmp 0x140042387
cmp byte [r15 + 3], 0
movabs rbp, 0x8000000000000000
je 0x1400423a7
imul rdi, qword [rsp + 0x418], 0x90
mov rbx, qword [rsp + 0x410]
xor r14d, r14d
lea rsi, [rsp + 0x500]
mov r15, rbx
cmp rdi, r14
je 0x1400423a7
cmp qword [r15 + 0x78], 0
je 0x14004236d
and qword [rsp + 0x500], 0
mov rcx, qword [rbx + r14 + 0x50]
sub edx, edx
xor r8d, r8d
mov r9, rsi
call sub.KERNEL32.dll_GetDiskFreeSpaceExW
or eax, eax
je 0x14004236d
mov rax, qword [rsp + 0x500]
mov qword [rbx + r14 + 0x80], rax
add r15, 0x90
add r14, 0x90
jmp 0x140042332
mov edi, 8
xor ebx, ebx
xor r14d, r14d
mov rcx, rsi
call fcn.14003984a
mov qword [rsp + 0x408], rbx
mov qword [rsp + 0x410], rdi
mov qword [rsp + 0x418], r14
mov rax, qword [rsp + 0x68]
cmp byte [rax + 7], 0
je 0x140042a29
lea rdi, [rsp + 0x1a0]
and qword [rdi], 0
mov qword [rdi + 8], 8
and qword [rdi + 0x10], 0
lea rax, [rsp + 0x198]
and dword [rax], 0
lea rbx, [rsp + 0x328]
lea rax, [rbp + 1]
mov qword [rsp + 0x48], rax
and qword [rsp + 0x78], 0
and dword [rsp + 0xcc], 0
and dword [rsp + 0x19c], 0
lea rax, [rsp + 0x198]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x19c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xcc]
mov qword [rsp + 0x28], rax
or dword [rsp + 0x20], 0xffffffff
xor ecx, ecx
xor edx, edx
mov r8d, 2
lea r9, [rsp + 0x78]
call sub.NETAPI32.dll_NetUserEnum
test eax, eax
je 0x140042450
cmp eax, 0xea
jne 0x140042782
mov dword [rsp + 0x40], eax
mov r15, qword [rsp + 0x78]
mov eax, dword [rsp + 0xcc]
lea r14, [r15 + rax*8]
cmp r15, r14
je 0x140042769
mov rsi, r15
add r15, 8
mov r12, qword [rsi]
test r12, r12
je 0x140042464
and qword [rsp + 0x328], 0
sub ecx, ecx
mov rdx, r12
mov r8d, 0x17
mov r9, rbx
call sub.NETAPI32.dll_NetUserGetInfo
or eax, eax
jne 0x14004274e
mov rax, qword [rsp + 0x328]
mov rdx, qword [rax + 0x20]
lea rcx, [rsp + 0xd0]
call fcn.14003a205
cmp qword [rsp + 0xd0], rbp
je 0x14004274e
mov rdx, qword [rsp + 0xd8]
lea rcx, [rsp + 0x500]
call fcn.140042c97
cmp qword [rsp + 0x500], rbp
jne 0x1400424f8
mov rdx, qword [rsi]
lea rcx, [rsp + 0x80]
call fcn.140039466
jmp 0x140042518
mov rax, qword [rsp + 0x510]
mov qword [rsp + 0x90], rax
movups xmm0, xmmword [rsp + 0x500]
movaps xmmword [rsp + 0x80], xmm0
and qword [rsp + 0x2c8], 0
and dword [rsp + 0x54], 0
and dword [rsp + 0x190], 0
lea rax, [rsp + 0x190]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x2c8]
mov qword [rsp + 0x20], rax
or dword [rsp + 0x28], 0xffffffff
lea rcx, [0x140996650]
mov rdx, r12
xor r8d, r8d
mov r9d, 1
call sub.NETAPI32.dll_NetUserGetLocalGroups
test eax, eax
je 0x140042590
and qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 8
xor r13d, r13d
jmp 0x1400426b9
mov r13d, dword [rsp + 0x54]
test r13, r13
je 0x1400425b9
imul rsi, r13, 0x18
mov ecx, 8
mov rdx, rsi
call fcn.14000bf3f
test rax, rax
je 0x140042b75
mov r12, rax
jmp 0x1400425c2
mov r12d, 8
xor r13d, r13d
mov qword [rsp + 0x110], r13
mov qword [rsp + 0x118], r12
and qword [rsp + 0x120], 0
mov rdi, qword [rsp + 0x2c8]
test rdi, rdi
je 0x140042620
mov esi, dword [rsp + 0x54]
cmp r13, rsi
jae 0x140042659
lea rcx, [rsp + 0x110]
xor edx, edx
mov r8, rsi
call fcn.14003aabe
cmp rax, qword [rsp + 0x48]
jne 0x140042b9a
mov r12, qword [rsp + 0x118]
mov r13, qword [rsp + 0x120]
jmp 0x14004265c
mov rax, qword [rsp + 0x120]
lea rbx, [rsp + 0x518]
mov qword [rbx + 0x28], rax
mov rax, qword [rsp + 0x110]
mov qword [rbx + 0x18], rax
mov rax, qword [rsp + 0x118]
mov qword [rbx + 0x20], rax
lea rdi, [rsp + 0x1a0]
jmp 0x1400426f7
xor r13d, r13d
test rsi, rsi
je 0x1400426a7
imul rax, r13, 0x18
add r12, rax
xor ebp, ebp
lea rbx, [rsp + 0x1f0]
mov rdx, qword [rdi + rbp*8]
push rbx
pop rcx
nop
call fcn.140039466
mov rax, qword [rsp + 0x200]
mov qword [r12 + 0x10], rax
movups xmm0, xmmword [rsp + 0x1f0]
movups xmmword [r12], xmm0
inc rbp
add r12, 0x18
cmp rsi, rbp
jne 0x140042672
add r13, rbp
movabs rbp, 0x8000000000000000
lea rdi, [rsp + 0x1a0]
mov qword [rsp + 0x120], r13
mov rcx, qword [rsp + 0x2c8]
lea rbx, [rsp + 0x518]
mov qword [rbx + 0x28], r13
mov rax, qword [rsp + 0x110]
mov qword [rbx + 0x18], rax
mov rax, qword [rsp + 0x118]
mov qword [rbx + 0x20], rax
or rcx, rcx
je 0x1400426f7
call sub.NETAPI32.dll_NetApiBufferFree
movups xmm0, xmmword [rsp + 0xd0]
movaps xmmword [rsp + 0x500], xmm0
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x510], rax
and dword [rsp + 0x548], 0
mov rax, qword [rsp + 0x90]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [rsp + 0x80]
movups xmmword [rbx], xmm0
push rdi
pop rcx
nop
lea rdx, [rsp + 0x500]
call fcn.140042d94
lea rbx, [rsp + 0x328]
mov rcx, qword [rsp + 0x328]
or rcx, rcx
je 0x140042464
call sub.NETAPI32.dll_NetApiBufferFree
jmp 0x140042464
mov rcx, qword [rsp + 0x78]
cmp dword [rsp + 0x40], 0xea
jne 0x140042787
call fcn.140042c83
jmp 0x1400423eb
mov rcx, qword [rsp + 0x78]
call fcn.140042c83
lea rcx, [rsp + 0x328]
and dword [rcx], 0
lea rsi, [rsp + 0x2c8]
and qword [rsi], 0
push rsi
pop rdx
nop
call sub.Secur32.dll_LsaEnumerateLogonSessions
mov rcx, qword [rsi]
or eax, eax
jne 0x1400429b6
mov eax, dword [rsp + 0x328]
lea r14, [rcx + rax*8]
lea rsi, [rsp + 0x110]
lea rbx, [rsp + 0x500]
cmp rcx, r14
je 0x1400429ae
lea rdi, [rcx + 8]
and qword [rsp + 0x110], 0
push rsi
nop
pop rdx
call sub.Secur32.dll_LsaGetLogonSessionData
mov rcx, qword [rsp + 0x110]
test eax, eax
je 0x140042805
call fcn.140042c8d
push rdi
pop rcx
nop
jmp 0x1400427d1
test rcx, rcx
je 0x1400428ae
cmp dword [rcx + 0x40], 3
je 0x1400427fb
movzx r12d, word [rcx + 0x10]
mov r13, qword [rcx + 0x18]
mov rdx, qword [rcx + 0x48]
nop
push rbx
pop rcx
call fcn.14003a205
mov r15, qword [rsp + 0x500]
cmp r15, rbp
je 0x1400429a1
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x40], r12
mov r12, qword [rsp + 0x508]
mov r13, qword [rsp + 0x510]
mov rdx, qword [rsp + 0x1a8]
imul rbx, qword [rsp + 0x1b0], 0x50
or rbx, rbx
je 0x1400428b5
lea rbp, [rdx + 0x50]
mov rcx, qword [rdx + 8]
mov rdx, qword [rdx + 0x10]
mov r8, r12
mov r9, r13
call fcn.14003e4f1
add rbx, 0xffffffffffffffb0
mov rdx, rbp
movabs rbp, 0x8000000000000000
test al, al
je 0x140042865
mov rcx, r15
mov rdx, r12
call fcn.14000c2be
lea rbx, [rsp + 0x500]
jmp 0x1400429a1
sub ecx, ecx
jmp 0x1400427fb
lea rcx, [rsp + 0x1f0]
mov rdx, r12
call fcn.140042c97
mov rax, qword [rsp + 0x1f0]
cmp rax, rbp
jne 0x140042923
mov r8, qword [rsp + 0x40]
shr r8d, 1
lea rbx, [rsp + 0x500]
push rbx
nop
pop rcx
mov rdx, qword [rsp + 0x48]
call fcn.1400036a0
mov rax, qword [rsp + 0x500]
cmp rax, rbp
mov r8d, 0
cmove rax, r8
mov rcx, qword [rsp + 0x508]
mov edx, 1
cmove rcx, rdx
mov rdx, qword [rsp + 0x510]
cmove rdx, r8
jmp 0x14004293b
mov rcx, qword [rsp + 0x1f8]
mov rdx, qword [rsp + 0x200]
lea rbx, [rsp + 0x500]
mov qword [rsp + 0x500], r15
mov qword [rsp + 0x508], r12
mov qword [rsp + 0x510], r13
and dword [rsp + 0x548], 0
mov qword [rsp + 0x518], rax
mov qword [rsp + 0x520], rcx
mov qword [rsp + 0x528], rdx
and qword [rsp + 0x530], 0
mov qword [rsp + 0x538], 8
and qword [rsp + 0x540], 0
lea rcx, [rsp + 0x1a0]
push rbx
pop rdx
nop
call fcn.140042d94
mov rcx, qword [rsp + 0x110]
jmp 0x1400427fb
mov rcx, qword [rsp + 0x2c8]
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x510], rax
movups xmm0, xmmword [rsp + 0x1a0]
movaps xmmword [rsp + 0x500], xmm0
or rcx, rcx
je 0x1400429e0
call fcn.140044654
mov rcx, qword [rsp + 0x428]
mov rdx, qword [rsp + 0x430]
call fcn.14003eadb
mov rcx, qword [rsp + 0x420]
mov rdx, qword [rsp + 0x428]
call fcn.14003ec09
mov rax, qword [rsp + 0x510]
lea rcx, [rsp + 0x420]
mov qword [rcx + 0x10], rax
movaps xmm0, xmmword [rsp + 0x500]
movups xmmword [rcx], xmm0
lea rdx, [rsp + 0x360]
mov r8d, 0x1a0
mov rcx, qword [rsp + 0x320]
call sub.msvcrt.dll_memcpy
movaps xmm6, xmmword [rsp + 0xa70]
movaps xmm7, xmmword [rsp + 0xa80]
movaps xmm8, xmmword [rsp + 0xa90]
movaps xmm9, xmmword [rsp + 0xaa0]
add rsp, 0xab8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x1f0], rcx
mov qword [rsp + 0x1f8], r12
mov qword [rsp + 0x200], r15
movabs rdi, 0x8000000000000000
jmp 0x140041818
movss xmm8, dword [rsp + 0x110]
movss xmm9, dword [rsp + 0x118]
lea rsi, [rsp + 0x538]
lea rdx, [0x140995e86]
mov ebx, 8
mov r8d, 8
mov rcx, rsi
call fcn.140039f5f
movss dword [rsi + 0x20], xmm8
movss dword [rsi + 0x24], xmm8
mov dword [rsi + 0x18], edi
movss dword [rsi + 0x1c], xmm9
movups xmm0, xmmword [rsp + 0x328]
movups xmm1, xmmword [rsp + 0x338]
movups xmm2, xmmword [rsp + 0x348]
movaps xmmword [rsi - 0x38], xmm0
movaps xmmword [rsi - 0x28], xmm1
movaps xmmword [rsi - 0x18], xmm2
mov rax, qword [rsp + 0x358]
mov qword [rsi - 8], rax
mov r14, qword [rsi - 0x38]
lea rsi, [rsp + 0x508]
lea rdi, [rsp + 0x1f0]
mov ecx, 0xb
rep movsq qword [rdi], qword [rsi]
cmp r14, 3
je 0x1400406b5
mov ecx, 0x60
mov edx, 8
call fcn.14000b03b
push rax
nop
pop rbx
mov qword [rax], r14
lea rdi, [rax + 8]
lea rsi, [rsp + 0x1f0]
mov ecx, 0xb
rep movsq qword [rdi], qword [rsi]
mov esi, 1
jmp 0x1400406b7
mov ecx, 8
nop
push rsi
pop rdx
call fcn.140002e60
lea rcx, str.key_used_disappeared
lea r8, [0x1409965f8]
mov edx, 0x14
call fcn.140005780
nop
push rax
pop rcx
call fcn.140002e60
mov ecx, 8
mov edx, 0x120
call fcn.140002e60
lea rax, str._home_omnipotent_.cargo_registry_src_index.crates.io_6f17d22bba15001f_sysinfo_0.29.11_src_windows_network.rs4a
mov edx, 0x101
mov rcx, r8
mov r8, rax
call fcn.140004380
mov ecx, 8
mov edx, 0xfa0
call fcn.140002e60
lea rcx, str.assertion_failed:_vec.capacity_____start___len_home_omnipotent_.cargo_registry_src_index.crates.io_6f17d22bba15001f_rayon_1.10.0_src_vec.rs
lea r8, [0x140995cf8]
mov edx, 0x2f
call fcn.1400046f0
lea rcx, str.global_key_idle_disappeared_home_omnipotent_.cargo_registry_src_index.crates.io_6f17d22bba15001f_sysinfo_0.29.11_src_windows_system.rs
lea r8, [0x1409965c8]
mov edx, 0x1b
call fcn.140005780
int3