Function at 0x180129ea0
Capabilities:
Check os version
Connect to wmi namespace via wbemlocator
Enumerate processes via ntquerysysteminformation
Get disk information
Get disk size
Get local ipv4 addresses
Get logon sessions
Get memory capacity
Get number of processors
Get system information on windows
List groups for user account
List user accounts
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa08
movdqa xmmword [rsp + 0x9f0], xmm8
movaps xmmword [rsp + 0x9e0], xmm7
movaps xmmword [rsp + 0x9d0], xmm6
mov rsi, rdx
mov r14, rcx
mov eax, dword [0x180247064]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xb0], 0
jne 0x180129ef5
call fcn.18004cac0
mov qword [rsp + 0x60], rsi
mov eax, dword [0x180247064]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xb8]
inc qword [rax + 0xb8]
movzx eax, byte [0x180247060]
mov rcx, qword [0x180246f98]
test rcx, rcx
jne 0x180129f47
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x18012e572
mov rcx, rax
mov qword [0x180246f98], rax
mov r8d, 0x56410
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x18012e572
mov rsi, rax
add rsi, 0x56000
mov r8d, 0x410
mov rcx, rsi
mov dl, 0xff
call sub.VCRUNTIME140.dll_memset
movzx eax, byte [0x180247060]
mov rcx, qword [0x180246f98]
test rcx, rcx
jne 0x180129fa4
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x18012e57e
mov rcx, rax
mov qword [0x180246f98], rax
mov r8d, 9
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x18012e57e
mov rdi, rax
movabs rax, 0x5043206c61746f54
mov qword [rdi], rax
mov byte [rdi + 8], 0x55
movzx eax, byte [0x180247060]
mov rcx, qword [0x180246f98]
test rcx, rcx
jne 0x180129ffb
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x18012e58f
mov rcx, rax
mov qword [0x180246f98], rax
mov r8d, 0x120
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x18012e58f
mov rbx, rax
mov eax, dword [0x180247064]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xb0], 0
jne 0x18012a037
call fcn.18004cac0
mov eax, dword [0x180247064]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movdqu xmm7, xmmword [rax + 0xb8]
inc qword [rax + 0xb8]
mov qword [rsp + 0x480], 0
mov rax, qword [0x180246030]
lea rcx, [rsp + 0x480]
call rax
mov rax, qword [rsp + 0x480]
movabs rcx, 0x19db1ded53e8000
cmp rax, rcx
mov qword [rsp + 0x478], r14
jl 0x18012a0db
movabs rcx, 0xfe624e212ac18000
add rax, rcx
movabs rcx, 0xd6bf94d5e57a42bd
mul rcx
mov r14, rdx
shr r14, 0x17
call sub.KERNEL32.dll_GetTickCount64
shr rax, 3
movabs rcx, 0x20c49ba5e353f7cf
mul rcx
shr rdx, 4
xor eax, eax
sub r14, rdx
cmovae rax, r14
jmp 0x18012a0dd
xor eax, eax
mov qword [rsp + 0x2f8], rsi
mov qword [rsp + 0x300], 0x3ff
mov qword [rsp + 0x308], 0x380
mov qword [rsp + 0x310], 0
movups xmmword [rsp + 0x318], xmm6
xorps xmm6, xmm6
movups xmmword [rsp + 0x358], xmm6
movups xmmword [rsp + 0x368], xmm6
mov qword [rsp + 0x3c8], rdi
mov qword [rsp + 0x3d0], 9
mov qword [rsp + 0x3d8], 9
mov qword [rsp + 0x3e0], 1
movups xmmword [rsp + 0x3e8], xmm6
mov qword [rsp + 0x3f8], 1
movups xmmword [rsp + 0x400], xmm6
mov qword [rsp + 0x410], 0
mov qword [rsp + 0x428], 0
mov dword [rsp + 0x430], 0
mov qword [rsp + 0x438], 8
movups xmmword [rsp + 0x440], xmm6
mov byte [rsp + 0x450], 0
mov qword [rsp + 0x380], 8
movups xmmword [rsp + 0x388], xmm6
mov qword [rsp + 0x398], rbx
mov qword [rsp + 0x3a0], 2
mov qword [rsp + 0x3a8], 0
mov qword [rsp + 0x2b8], 0
lea rcx, [0x1802345c0]
mov qword [rsp + 0x328], rcx
movups xmmword [rsp + 0x330], xmm6
mov qword [rsp + 0x340], 0
movdqu xmmword [rsp + 0x348], xmm7
mov qword [rsp + 0x378], rax
mov qword [rsp + 0x3b0], 8
movups xmmword [rsp + 0x3b8], xmm6
mov rsi, qword [rsp + 0x60]
cmp byte [rsi + 4], 0
je 0x18012a343
movaps xmmword [rsp + 0x1e0], xmm6
movaps xmmword [rsp + 0x210], xmm6
movaps xmmword [rsp + 0x200], xmm6
movaps xmmword [rsp + 0x1f0], xmm6
mov dword [rsp + 0x1e0], 0x40
lea rcx, [rsp + 0x1e0]
call sub.KERNEL32.dll_GlobalMemoryStatusEx
movdqu xmm0, xmmword [rsp + 0x1e8]
movdqu xmmword [rsp + 0x358], xmm0
movaps xmmword [rsp + 0x4d0], xmm6
movaps xmmword [rsp + 0x4c0], xmm6
movaps xmmword [rsp + 0x4b0], xmm6
movaps xmmword [rsp + 0x4a0], xmm6
movaps xmmword [rsp + 0x490], xmm6
movaps xmmword [rsp + 0x480], xmm6
mov qword [rsp + 0x4e0], 0
lea rcx, [rsp + 0x480]
mov edx, 0x68
call sub.psapi.dll_GetPerformanceInfo
cmp eax, 1
jne 0x18012a343
mov r8, qword [rsp + 0x490]
mov r9, qword [rsp + 0x4a0]
xor r10d, r10d
sub r8, r9
cmovb r8, r10
mov rcx, qword [rsp + 0x4d0]
mov rax, rcx
mul r8
mov r8, rax
mov r11, 0xffffffffffffffff
cmovo r8, r11
mov rsi, qword [rsp + 0x488]
sub rsi, r9
cmovb rsi, r10
mov rax, rcx
mul rsi
mov rsi, qword [rsp + 0x60]
cmovo rax, r11
mov qword [rsp + 0x368], r8
mov qword [rsp + 0x370], rax
cmp byte [rsi + 0xb], 2
je 0x18012a4c1
movzx ebp, byte [rsi + 0xc]
cmp qword [rsp + 0x2b8], 0
jne 0x18012a3d9
mov qword [rsp + 0x1e0], 0
lea r8, [rsp + 0x1e0]
xor ecx, ecx
xor edx, edx
call sub.pdh.dll_PdhOpenQueryA
test eax, eax
mov byte [rsp + 0x50], bpl
je 0x18012a95b
mov qword [rsp + 0x2b8], 0
movdqu xmm0, xmmword [rsp + 0x480]
movdqu xmmword [rsp + 0x2c0], xmm0
mov rax, qword [rsp + 0x490]
mov qword [rsp + 0x2d0], rax
mov qword [rsp + 0x2f0], 0
cmp qword [rsp + 0x2b8], 0
mov rsi, qword [rsp + 0x60]
movzx ebp, byte [rsp + 0x50]
je 0x18012a4c1
mov rcx, qword [rsp + 0x2e8]
call sub.pdh.dll_PdhCollectQueryData
mov rdx, qword [rsp + 0x410]
test rdx, rdx
je 0x18012a425
mov r8, qword [rsp + 0x420]
lea rcx, [rsp + 0x2b8]
call fcn.1801363b0
test eax, eax
je 0x18012e64a
movss xmm1, dword [0x1801a92d4]
subss xmm1, xmm0
movss dword [rsp + 0x430], xmm1
mov edx, ebp
and dl, 1
lea rcx, [rsp + 0x3c8]
call fcn.180131370
mov rax, qword [rsp + 0x448]
test rax, rax
je 0x18012a4a8
mov rdi, qword [rsp + 0x438]
imul rbx, rax, 0x70
xor r14d, r14d
lea rsi, [rsp + 0x2b8]
movss xmm6, dword [0x1801a92d4]
jmp 0x18012a479
add r14, 0x70
cmp rbx, r14
je 0x18012a4a8
mov rdx, qword [rdi + r14 + 0x48]
test rdx, rdx
je 0x18012a470
mov r8, qword [rdi + r14 + 0x58]
mov rcx, rsi
call fcn.1801363b0
test eax, eax
je 0x18012e536
movaps xmm1, xmm6
subss xmm1, xmm0
movss dword [rdi + r14 + 0x68], xmm1
jmp 0x18012a470
test bpl, 1
mov rsi, qword [rsp + 0x60]
je 0x18012a4c1
cmp byte [rsp + 0x450], 0
je 0x18012a869
cmp byte [rsi + 6], 0
je 0x18012ab53
xor ecx, ecx
xor edx, edx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov esi, eax
cmp eax, 2
setb bl
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov edx, 0xffffffff
xor r8d, r8d
xor r9d, r9d
call sub.ole32.dll_CoInitializeSecurity
test eax, eax
js 0x18012a789
mov qword [rsp + 0x90], 0
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
lea rcx, [0x180233bc4]
lea r9, [0x180233ba8]
xor edx, edx
mov r8d, 1
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x18012a789
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x1e0], 1
mov qword [rsp + 0x1e8], rax
mov qword [rsp + 0x1f0], 0
mov qword [rsp + 0x200], 0
mov byte [rsp + 0x210], bl
lea rcx, [rsp + 0x140]
lea rdx, [rsp + 0x1e0]
call fcn.180129600
mov r14, qword [rsp + 0x140]
cmp r14, 2
je 0x18012a794
mov rsi, qword [rsp + 0x148]
mov r15, qword [rsp + 0x150]
mov rdi, qword [rsp + 0x158]
mov r12, qword [rsp + 0x160]
mov rbx, qword [rsp + 0x168]
movzx ebp, byte [rsp + 0x170]
test r15, r15
je 0x18012a914
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
mov rcx, rdi
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call sub.ole32.dll_CoSetProxyBlanket
test eax, eax
js 0x18012a914
lea rax, [rsp + 0x171]
mov ecx, dword [rax]
mov eax, dword [rax + 3]
mov dword [rsp + 0x4b4], eax
mov dword [rsp + 0x4b1], ecx
mov qword [rsp + 0x480], r14
mov qword [rsp + 0x488], rsi
mov qword [rsp + 0x490], r15
mov qword [rsp + 0x498], rdi
mov qword [rsp + 0x4a0], r12
mov qword [rsp + 0x4a8], rbx
mov byte [rsp + 0x4b0], bpl
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0x480]
call fcn.180129740
mov rax, qword [rsp + 0xa0]
cmp rax, 2
je 0x18012a794
movups xmm0, xmmword [rsp + 0xa8]
movups xmm1, xmmword [rsp + 0xb8]
movdqu xmm2, xmmword [rsp + 0xc8]
movdqu xmmword [rsp + 0x128], xmm2
movups xmmword [rsp + 0x118], xmm1
movups xmmword [rsp + 0x108], xmm0
mov qword [rsp + 0x100], rax
lea rcx, [rsp + 0x140]
lea rdx, [rsp + 0x100]
mov r8b, 1
call fcn.180129890
mov r12, qword [rsp + 0x100]
mov r15, qword [rsp + 0x108]
mov r13, qword [rsp + 0x110]
mov rbx, qword [rsp + 0x118]
mov rdi, qword [rsp + 0x120]
mov r14, qword [rsp + 0x128]
movzx esi, byte [rsp + 0x130]
mov ebp, dword [rsp + 0x144]
cmp ebp, 2
jne 0x18012b268
test rdi, rdi
je 0x18012a75c
test r14, r14
je 0x18012a75c
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x10]
test r13, r13
je 0x18012a76f
test rbx, rbx
je 0x18012a76f
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
test r12, r12
je 0x18012a782
test r15, r15
je 0x18012a782
mov rax, qword [r15]
mov rcx, r15
call qword [rax + 0x10]
test sil, sil
jne 0x18012a78e
jmp 0x18012a794
cmp esi, 2
jae 0x18012a794
call qword [sym.imp.ole32.dll_CoUninitialize]
mov esi, 8
xor ebx, ebx
mov rdi, qword [rsp + 0x380]
mov r14, qword [rsp + 0x390]
test r14, r14
je 0x18012b37b
mov r15, qword [sym.imp.ole32.dll_CoUninitialize]
mov r12, qword [sym.imp.KERNEL32.dll_HeapFree]
mov r13, rdi
jmp 0x18012a7dd
add r13, 0x60
dec r14
je 0x18012b37b
cmp qword [r13 + 0x48], 0
je 0x18012a7f4
mov r8, qword [r13 + 0x40]
mov rcx, qword [0x180246f98]
xor edx, edx
call r12
mov rbp, qword [r13]
cmp rbp, 2
je 0x18012a7d0
mov rcx, qword [r13 + 0x28]
cmp qword [r13 + 0x20], 0
mov qword [r13 + 0x20], 0
je 0x18012a81c
test rcx, rcx
je 0x18012a81c
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [r13 + 0x18]
cmp qword [r13 + 0x10], 0
mov qword [r13 + 0x10], 0
je 0x18012a83a
test rcx, rcx
je 0x18012a83a
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [r13 + 8]
mov qword [r13], 0
test rbp, rbp
je 0x18012a856
test rcx, rcx
je 0x18012a856
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp byte [r13 + 0x30], 0
je 0x18012a7d0
call r15
jmp 0x18012a7d0
mov rsi, qword [rsp + 0x448]
lea rcx, [rsp + 0x480]
mov rdx, rsi
call fcn.180135850
mov rdi, qword [rsp + 0x438]
mov r8, qword [rsp + 0x480]
mov rax, qword [rsp + 0x488]
test rsi, rsi
je 0x18012a8ee
mov rcx, qword [rsp + 0x490]
test rcx, rcx
je 0x18012a8ee
lea rcx, [rcx*8 - 8]
imul rdx, rsi, 0x70
add rdx, 0xffffffffffffff90
xor r9d, r9d
xor r10d, r10d
nop word cs:[rax + rax]
mov r11, qword [r8 + r10]
mov qword [rdi + r9 + 0x60], r11
cmp rdx, r9
je 0x18012a8ee
lea r11, [r10 + 8]
add r9, 0x70
cmp rcx, r10
mov r10, r11
jne 0x18012a8d0
test rax, rax
je 0x18012a902
mov rcx, qword [0x180246f98]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
test rsi, rsi
je 0x18012ab32
mov rax, qword [rdi + 0x60]
jmp 0x18012ab34
test r12, r12
je 0x18012a927
test rbx, rbx
je 0x18012a927
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + 0x10]
test r15, r15
je 0x18012a93a
test rdi, rdi
je 0x18012a93a
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
test r14, r14
je 0x18012a94d
test rsi, rsi
je 0x18012a94d
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x10]
test bpl, bpl
jne 0x18012a78e
jmp 0x18012a794
mov esi, eax
mov r13, qword [rsp + 0x1e0]
mov eax, dword [0x180247064]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xb0], 0
jne 0x18012a987
call fcn.18004cac0
mov eax, dword [0x180247064]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movups xmm6, xmmword [rax + 0xb8]
inc qword [rax + 0xb8]
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x480], xmm0
mov qword [rsp + 0x490], 0
mov rdi, qword [rsp + 0x2b8]
test rdi, rdi
je 0x18012afbc
mov rbx, qword [rsp + 0x2d0]
test rbx, rbx
je 0x18012aa59
lea r14, [rdi + 0x10]
movdqa xmm0, xmmword [rdi]
pmovmskb eax, xmm0
not eax
mov r15, rdi
mov r12, rbx
jmp 0x18012aa23
lea ebp, [rax - 1]
and ebp, eax
tzcnt eax, eax
shl rax, 5
mov rcx, r15
sub rcx, rax
mov rcx, qword [rcx - 8]
call sub.pdh.dll_PdhRemoveCounter
mov eax, ebp
dec r12
je 0x18012aa59
test ax, ax
jne 0x18012aa00
nop dword [rax + rax]
movdqa xmm0, xmmword [r14]
pmovmskb eax, xmm0
add r15, 0xfffffffffffffe00
add r14, 0x10
cmp ax, 0xffff
je 0x18012aa30
mov ecx, 0xfffffffe
sub ecx, eax
not eax
mov ebp, eax
and ebp, ecx
jmp 0x18012aa05
mov rcx, qword [rsp + 0x2f0]
test rcx, rcx
je 0x18012aa6c
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x2e8]
test rcx, rcx
je 0x18012aa7e
call sub.pdh.dll_PdhCloseQuery
mov r14, qword [rsp + 0x2c0]
test r14, r14
je 0x18012af65
mov qword [rsp + 0x58], r13
test rbx, rbx
je 0x18012af37
movdqa xmm0, xmmword [rdi]
pmovmskb eax, xmm0
not eax
lea r12, [rdi + 0x10]
mov r13, qword [sym.imp.KERNEL32.dll_HeapFree]
mov r15, rdi
jmp 0x18012aacb
mov eax, ebp
test rbx, rbx
je 0x18012af37
test ax, ax
je 0x18012aae0
lea ebp, [rax - 1]
and ebp, eax
jmp 0x18012ab08
movdqa xmm0, xmmword [r12]
pmovmskb eax, xmm0
add r15, 0xfffffffffffffe00
add r12, 0x10
cmp ax, 0xffff
je 0x18012aae0
mov ecx, 0xfffffffe
sub ecx, eax
not eax
mov ebp, eax
and ebp, ecx
tzcnt ecx, eax
shl rcx, 5
mov rax, r15
sub rax, rcx
dec rbx
cmp qword [rax - 0x18], 0
je 0x18012aac0
mov r8, qword [rax - 0x20]
mov rcx, qword [0x180246f98]
xor edx, edx
call r13
jmp 0x18012aac0
xor eax, eax
mov rsi, qword [rsp + 0x60]
mov qword [rsp + 0x428], rax
mov byte [rsp + 0x450], 1
cmp byte [rsi + 6], 0
jne 0x18012a4cb
cmp byte [rsi + 5], 0
je 0x18012b3b0
mov rax, qword [rsp + 0x390]
test rax, rax
je 0x18012b3b0
mov rsi, qword [rsp + 0x380]
shl rax, 5
lea r12, [rax + rax*2]
jmp 0x18012ab8e
add rsi, 0x60
add r12, 0xffffffffffffffa0
je 0x18012b3b0
mov r15, qword [rsi]
cmp r15, 2
jne 0x18012aca0
xor ecx, ecx
xor edx, edx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov edi, eax
cmp eax, 2
setb bl
mov qword [rsp + 0x40], 0
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 0
xor ecx, ecx
mov edx, 0xffffffff
xor r8d, r8d
xor r9d, r9d
call sub.ole32.dll_CoInitializeSecurity
test eax, eax
js 0x18012ace0
mov qword [rsp + 0x480], 0
lea r14, [rsp + 0x480]
mov qword [rsp + 0x20], r14
lea rcx, [0x180233bc4]
xor edx, edx
mov r8d, 1
lea r9, [0x180233ba8]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x18012ace0
mov rax, qword [rsp + 0x480]
mov qword [rsp + 0x480], 1
mov qword [rsp + 0x488], rax
mov qword [rsp + 0x490], 0
mov qword [rsp + 0x4a0], 0
mov byte [rsp + 0x4b0], bl
lea rcx, [rsp + 0x140]
mov rdx, r14
call fcn.180129600
mov r15, qword [rsp + 0x140]
cmp r15, 2
jne 0x18012ae34
mov r15d, 2
jmp 0x18012acf1
mov rcx, qword [rsi + 8]
mov rbp, qword [rsi + 0x10]
mov r14, qword [rsi + 0x18]
mov r13, qword [rsi + 0x20]
mov rdi, qword [rsi + 0x28]
movzx ebx, byte [rsi + 0x30]
mov eax, dword [rsi + 0x31]
mov edx, dword [rsi + 0x34]
mov dword [rsp + 0xa3], edx
mov dword [rsp + 0xa0], eax
mov qword [rsi], 2
jmp 0x18012ad50
mov r15d, 2
cmp edi, 1
ja 0x18012acf1
call qword [sym.imp.ole32.dll_CoUninitialize]
mov qword [rsi], r15
mov qword [rsi + 8], rcx
mov qword [rsi + 0x10], rbp
mov qword [rsi + 0x18], r14
mov qword [rsi + 0x20], r13
mov qword [rsi + 0x28], rdi
mov byte [rsi + 0x30], bl
mov eax, dword [rsp + 0xa0]
mov edx, dword [rsp + 0xa3]
mov dword [rsi + 0x31], eax
mov dword [rsi + 0x34], edx
mov eax, dword [rsi + 0x31]
mov edx, dword [rsi + 0x34]
mov dword [rsp + 0xa3], edx
mov dword [rsp + 0xa0], eax
cmp r15, 2
jne 0x18012ad50
mov qword [rsp + 0x140], 2
jmp 0x18012adb7
mov qword [rsp + 0x1e0], r15
mov qword [rsp + 0x1e8], rcx
mov qword [rsp + 0x1f0], rbp
mov qword [rsp + 0x1f8], r14
mov qword [rsp + 0x200], r13
mov qword [rsp + 0x208], rdi
mov byte [rsp + 0x210], bl
mov eax, dword [rsp + 0xa0]
mov ecx, dword [rsp + 0xa3]
lea rdx, [rsp + 0x211]
mov dword [rdx + 3], ecx
mov dword [rdx], eax
lea rcx, [rsp + 0x140]
lea rdx, [rsp + 0x1e0]
call fcn.180129740
mov rax, qword [rsp + 0x170]
mov qword [rsi + 0x30], rax
movups xmm0, xmmword [rsp + 0x140]
movups xmm1, xmmword [rsp + 0x150]
movdqu xmm2, xmmword [rsp + 0x160]
movdqu xmmword [rsi + 0x20], xmm2
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
cmp dword [rsi], 2
je 0x18012ab80
lea rcx, [rsp + 0x140]
mov rdx, rsi
xor r8d, r8d
call fcn.180129890
cmp dword [rsp + 0x144], 2
je 0x18012ab80
movss xmm0, dword [rsp + 0x140]
movss dword [rsi + 0x58], xmm0
ucomiss xmm0, dword [rsi + 0x5c]
jbe 0x18012ab80
movss dword [rsi + 0x5c], xmm0
jmp 0x18012ab80
mov rcx, qword [rsp + 0x148]
mov rbp, qword [rsp + 0x150]
mov r14, qword [rsp + 0x158]
mov r13, qword [rsp + 0x160]
mov rdi, qword [rsp + 0x168]
movzx ebx, byte [rsp + 0x170]
test rbp, rbp
mov qword [rsp + 0x50], rcx
je 0x18012aecb
mov dword [rsp + 0x38], 0
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x20], 3
mov rcx, r14
mov edx, 0xa
xor r8d, r8d
xor r9d, r9d
call sub.ole32.dll_CoSetProxyBlanket
mov rcx, qword [rsp + 0x50]
test eax, eax
js 0x18012aecb
lea rdx, [rsp + 0x171]
mov eax, dword [rdx]
mov edx, dword [rdx + 3]
mov dword [rsp + 0xa3], edx
mov dword [rsp + 0xa0], eax
jmp 0x18012acf1
test r13, r13
je 0x18012aee3
test rdi, rdi
je 0x18012aee3
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
test rbp, rbp
je 0x18012aefb
test r14, r14
je 0x18012aefb
mov rax, qword [r14]
mov rcx, r14
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
test r15, r15
je 0x18012af10
test rcx, rcx
je 0x18012af10
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x50]
test bl, bl
je 0x18012af2a
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [rsp + 0x50]
mov r15d, 2
jmp 0x18012acf1
xor ebx, ebx
mov r15d, 2
jmp 0x18012acf1
mov rax, r14
shl rax, 5
add r14, rax
cmp r14, 0xffffffffffffffcf
mov r13, qword [rsp + 0x58]
je 0x18012af65
sub rdi, rax
add rdi, 0xffffffffffffffe0
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
lea rax, [0x1802345c0]
mov qword [rsp + 0x2b8], rax
mov rax, qword [rsp + 0x490]
mov qword [rsp + 0x2d0], rax
movdqa xmm0, xmmword [rsp + 0x480]
movdqu xmmword [rsp + 0x2c0], xmm0
movups xmmword [rsp + 0x2d8], xmm6
mov qword [rsp + 0x2e8], r13
mov qword [rsp + 0x2f0], 0
test esi, esi
jne 0x18012a3c0
jmp 0x18012b009
lea rax, [0x1802345c0]
mov qword [rsp + 0x2b8], rax
movdqa xmm0, xmmword [rsp + 0x480]
movdqu xmmword [rsp + 0x2c0], xmm0
mov rax, qword [rsp + 0x490]
mov qword [rsp + 0x2d0], rax
movups xmmword [rsp + 0x2d8], xmm6
mov qword [rsp + 0x2e8], r13
mov qword [rsp + 0x2f0], 0
movzx eax, byte [0x180247060]
mov rcx, qword [0x180246f98]
test rcx, rcx
je 0x18012b023
movzx ebx, byte [rsp + 0x50]
jmp 0x18012b041
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
movzx ebx, byte [rsp + 0x50]
je 0x18012e69e
mov rcx, rax
mov qword [0x180246f98], rax
mov r8d, 0x1e
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x18012e69e
movups xmm0, xmmword [0x18020c566]
movups xmmword [rax + 0xe], xmm0
movdqu xmm0, xmmword [str.Processor__Total___Idle_TimeProcessor____Idle_Time]
movdqu xmmword [rax], xmm0
mov qword [rsp + 0x1e0], rax
mov qword [rsp + 0x1e8], 0x1e
mov qword [rsp + 0x1f0], 0x1e
movzx eax, byte [0x180247060]
mov rcx, qword [0x180246f98]
test rcx, rcx
jne 0x18012b0bb
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x18012e6af
mov rcx, rax
mov qword [0x180246f98], rax
mov r8d, 5
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x18012e6af
and bl, 1
lea r8, [rsp + 0x410]
mov byte [rax + 4], 0x30
mov dword [rax], 0x5f746f74
mov qword [rsp + 0x480], rax
mov qword [rsp + 0x488], 5
mov qword [rsp + 0x490], 5
lea rsi, [rsp + 0x1e0]
lea rdx, [rsp + 0x2b8]
lea r9, [rsp + 0x480]
mov rcx, rsi
call fcn.180135b40
lea rcx, [rsp + 0x3c8]
mov edx, ebx
call fcn.180131370
mov rax, qword [rsp + 0x448]
test rax, rax
je 0x18012a3c0
mov rdi, qword [rsp + 0x438]
add rdi, 0x48
imul r12, rax, 0x70
xor r13d, r13d
lea rbp, [rsp + 0x100]
lea r15, [fcn.1800245e0]
lea rbx, [rsp + 0x140]
lea r14, [rsp + 0x480]
nop dword [rax]
mov qword [rsp + 0x100], r13
inc r13
mov qword [rsp + 0x1e0], rbp
mov qword [rsp + 0x1e8], r15
lea rax, [0x18020c590]
mov qword [rsp + 0x480], rax
mov qword [rsp + 0x488], 2
mov qword [rsp + 0x4a0], 0
mov qword [rsp + 0x490], rsi
mov qword [rsp + 0x498], 1
mov rcx, rbx
mov rdx, r14
call fcn.18001efd0
mov qword [rsp + 0xa0], rbp
mov qword [rsp + 0xa8], r15
lea rax, [0x18020c5b8]
mov qword [rsp + 0x480], rax
mov qword [rsp + 0x488], 2
mov qword [rsp + 0x4a0], 0
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x490], rax
mov qword [rsp + 0x498], 1
mov rcx, rsi
mov rdx, r14
call fcn.18001efd0
mov rcx, rbx
lea rdx, [rsp + 0x2b8]
mov r8, rdi
mov r9, rsi
call fcn.180135b40
add rdi, 0x70
add r12, 0xffffffffffffff90
jne 0x18012b180
jmp 0x18012a3c0
mov qword [rsp + 0x58], r15
mov byte [rsp + 0x50], sil
movss xmm6, dword [rsp + 0x140]
movd xmm7, dword [rsp + 0x148]
movzx eax, byte [0x180247060]
mov esi, 8
mov ecx, 8
mov edx, 1
call fcn.18001e7b0
test rax, rax
je 0x18012e6c0
mov r15, rax
lea rax, [rsp + 0x131]
movabs rcx, 0x72657475706d6f43
mov qword [r15], rcx
mov ecx, dword [rax]
mov eax, dword [rax + 3]
mov dword [rsp + 0xa3], eax
mov dword [rsp + 0xa0], ecx
cmp r12, 3
je 0x18012a799
movzx eax, byte [0x180247060]
mov ecx, 0x60
mov edx, 8
call fcn.18001e7b0
test rax, rax
je 0x18012e6d1
mov rsi, rax
mov qword [rax], r12
mov rax, qword [rsp + 0x58]
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], r13
mov qword [rsi + 0x18], rbx
mov qword [rsi + 0x20], rdi
mov qword [rsi + 0x28], r14
movzx eax, byte [rsp + 0x50]
mov byte [rsi + 0x30], al
mov eax, dword [rsp + 0xa0]
mov ecx, dword [rsp + 0xa3]
mov dword [rsi + 0x31], eax
mov dword [rsi + 0x34], ecx
mov dword [rsi + 0x38], ebp
movd dword [rsi + 0x3c], xmm7
mov qword [rsi + 0x40], r15
mov qword [rsi + 0x48], 8
mov qword [rsi + 0x50], 8
movss dword [rsi + 0x58], xmm6
movss dword [rsi + 0x5c], xmm6
mov ebx, 1
mov rdi, qword [rsp + 0x380]
mov r14, qword [rsp + 0x390]
test r14, r14
jne 0x18012a7b4
cmp qword [rsp + 0x388], 0
je 0x18012b398
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x380], rsi
mov qword [rsp + 0x388], rbx
mov qword [rsp + 0x390], rbx
mov rsi, qword [rsp + 0x60]
cmp byte [rsi + 1], 0
je 0x18012b47f
mov qword [rsp + 0xa0], 0
lea rcx, [rsp + 0xa0]
call sub.iphlpapi.dll_GetIfTable2
test eax, eax
jne 0x18012c7b6
mov rax, qword [rsp + 0x340]
test rax, rax
je 0x18012b611
mov rcx, qword [rsp + 0x328]
lea rdx, [rcx + 0x10]
movdqa xmm0, xmmword [rcx]
pmovmskb r8d, xmm0
not r8d
jmp 0x18012b43f
lea r9d, [r8 - 1]
and r9d, r8d
tzcnt r8d, r8d
mov r10, r8
neg r10
shl r8, 3
shl r10, 7
sub r10, r8
mov byte [rcx + r10 - 2], 0
mov r8d, r9d
dec rax
je 0x18012b611
test r8w, r8w
jne 0x18012b410
nop word cs:[rax + rax]
movdqa xmm0, xmmword [rdx]
pmovmskb r8d, xmm0
add rcx, 0xfffffffffffff780
add rdx, 0x10
cmp r8w, 0xffff
je 0x18012b450
mov r10d, 0xfffffffe
sub r10d, r8d
not r8d
mov r9d, r8d
and r9d, r10d
jmp 0x18012b417
cmp byte [rsi], 0
je 0x18012c7b6
lea rcx, [rsp + 0x480]
mov r8d, 0x548
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rdi, qword [rsp + 0x340]
test rdi, rdi
je 0x18012d99d
mov rbx, qword [rsp + 0x328]
lea r14, [rbx + 0x10]
movdqa xmm0, xmmword [rbx]
pmovmskb eax, xmm0
not eax
lea rsi, [rsp + 0x480]
mov r15, 0xffffffffffffffff
jmp 0x18012b4eb
mov eax, ebp
test rdi, rdi
je 0x18012d99d
test ax, ax
je 0x18012b500
lea ebp, [rax - 1]
and ebp, eax
jmp 0x18012b527
movdqa xmm0, xmmword [r14]
pmovmskb eax, xmm0
add rbx, 0xfffffffffffff780
add r14, 0x10
cmp ax, 0xffff
je 0x18012b500
mov ecx, 0xfffffffe
sub ecx, eax
not eax
mov ebp, eax
and ebp, ecx
tzcnt eax, eax
mov r12, rax
neg r12
shl rax, 3
shl r12, 7
sub r12, rax
dec rdi
mov rax, qword [rbx + r12 - 0x70]
mov qword [rsp + 0x480], rax
mov dword [rsp + 0x488], 0
mov rcx, rsi
call sub.iphlpapi.dll_GetIfEntry2
test eax, eax
jne 0x18012b4e0
add r12, rbx
mov rax, qword [r12 - 0x68]
mov rcx, qword [r12 - 0x58]
mov qword [r12 - 0x60], rax
mov rax, qword [rsp + 0x980]
mov qword [r12 - 0x68], rax
mov qword [r12 - 0x50], rcx
mov rax, qword [rsp + 0x938]
mov qword [r12 - 0x58], rax
mov rax, qword [r12 - 0x48]
mov qword [r12 - 0x40], rax
mov rax, qword [rsp + 0x940]
add rax, qword [rsp + 0x948]
cmovb rax, r15
mov qword [r12 - 0x48], rax
mov rax, qword [r12 - 0x38]
mov qword [r12 - 0x30], rax
mov rax, qword [rsp + 0x988]
add rax, qword [rsp + 0x990]
cmovb rax, r15
mov qword [r12 - 0x38], rax
mov rax, qword [r12 - 0x28]
mov qword [r12 - 0x20], rax
mov rax, qword [rsp + 0x958]
mov qword [r12 - 0x28], rax
mov rax, qword [r12 - 0x18]
mov qword [r12 - 0x10], rax
mov rax, qword [rsp + 0x9a0]
mov qword [r12 - 0x18], rax
jmp 0x18012b4e0
mov eax, dword [0x180247064]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0xb0], 0
jne 0x18012b633
call fcn.18004cac0
lea rax, [0x1802345c0]
mov qword [rsp + 0x480], rax
xorps xmm6, xmm6
movups xmmword [rsp + 0x488], xmm6
mov qword [rsp + 0x498], 0
mov eax, dword [0x180247064]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
movdqu xmm0, xmmword [rax + 0xb8]
inc qword [rax + 0xb8]
movdqu xmmword [rsp + 0x4a0], xmm0
mov qword [rsp + 0x140], 8
movups xmmword [rsp + 0x148], xmm6
mov rax, qword [rsp + 0xa0]
mov r15d, dword [rax]
test r15, r15
je 0x18012c1c6
mov qword [rsp + 0xe8], rax
lea rbx, [rax + 8]
xor r12d, r12d
mov rdi, qword [sym.imp.KERNEL32.dll_HeapAlloc]
pcmpeqd xmm7, xmm7
mov qword [rsp + 0x70], rbx
jmp 0x18012b6ec
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, r13
call qword [sym.imp.KERNEL32.dll_HeapFree]
nop
inc r12
cmp r12, r15
je 0x18012ba4c
imul rsi, r12, 0x548
cmp qword [rbx + rsi + 0x4a8], 0
jne 0x18012b709
cmp qword [rbx + rsi + 0x4b0], 0
je 0x18012b6e0
cmp dword [rbx + rsi + 0x48c], 2
je 0x18012b6e0
cmp dword [rbx + rsi + 0x420], 0
je 0x18012b6e0
movzx eax, byte [0x180247060]
mov rax, qword [0x180246f98]
test rax, rax
jne 0x18012b746
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x18012e550
mov qword [0x180246f98], rax
mov r8d, 0x14
mov rcx, rax
xor edx, edx
call rdi
test rax, rax
je 0x18012e550
mov r13, rax
mov eax, dword [rbx + rsi + 0x10]
movq xmm0, qword [rbx + rsi + 0x14]
punpcklbw xmm0, xmm6
mov dword [r13], eax
movdqu xmmword [r13 + 4], xmm0
movzx eax, byte [0x180247060]
mov rax, qword [0x180246f98]
test rax, rax
jne 0x18012b7a0
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x18012e550
mov qword [0x180246f98], rax
mov r8d, 0x14
mov rcx, rax
xor edx, edx
call rdi
test rax, rax
je 0x18012e550
mov r14, rax
mov eax, dword [r13 + 0x10]
mov dword [r14 + 0x10], eax
movups xmm0, xmmword [r13]
movups xmmword [r14], xmm0
mov rcx, qword [rsp + 0x4a0]
mov rdx, qword [rsp + 0x4a8]
mov r9d, 0xa
mov r8, r14
call fcn.180129bc0
mov rdi, rax
mov rsi, qword [rsp + 0x480]
mov rax, qword [rsp + 0x488]
mov rbp, rdi
shr rbp, 0x39
movd xmm0, ebp
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
lea rcx, [rsi - 0x20]
xor edx, edx
mov r8, rdi
and r8, rax
movdqu xmm1, xmmword [rsi + r8]
movdqa xmm2, xmm0
pcmpeqb xmm2, xmm1
pmovmskb r9d, xmm2
test r9d, r9d
jne 0x18012b870
pcmpeqb xmm1, xmm7
pmovmskb r9d, xmm1
test r9d, r9d
jne 0x18012b95f
add r8, rdx
add r8, 0x10
add rdx, 0x10
jmp 0x18012b81d
lea r10d, [r9 - 1]
and r10d, r9d
mov r9d, r10d
test r10w, r10w
je 0x18012b838
tzcnt ebx, r9d
add rbx, r8
and rbx, rax
mov r10, rbx
shl r10, 5
mov r11, rcx
sub r11, r10
cmp qword [r11 + 0x10], 0xa
jne 0x18012b860
mov r10, qword [r11]
movdqu xmm2, xmmword [r10]
movdqu xmm3, xmmword [r14]
pcmpeqb xmm3, xmm2
movd xmm2, dword [r10 + 0x10]
movd xmm4, dword [r14 + 0x10]
pcmpeqb xmm4, xmm2
pand xmm4, xmm3
pmovmskb r10d, xmm4
cmp r10d, 0xffff
jne 0x18012b860
neg rbx
shl rbx, 5
add rsi, rbx
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, r14
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, rsi
mov rbx, qword [rsp + 0x70]
mov rdi, qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ecx, dword [rax - 8]
inc ecx
mov dword [rax - 8], ecx
cmp ecx, 1
jg 0x18012b6cd
mov rdx, qword [rsp + 0x150]
cmp rdx, qword [rsp + 0x148]
jne 0x18012b925
lea rcx, [rsp + 0x140]
call fcn.1801672c0
mov rdx, qword [rsp + 0x150]
mov rax, qword [rsp + 0x140]
mov rcx, rdx
shl rcx, 5
mov dword [rax + rcx], r12d
mov qword [rax + rcx + 8], r13
mov qword [rax + rcx + 0x10], 0xa
mov qword [rax + rcx + 0x18], 0xa
inc rdx
mov qword [rsp + 0x150], rdx
jmp 0x18012b6e0
cmp qword [rsp + 0x490], 0
je 0x18012ba22
and rdi, rax
movdqu xmm0, xmmword [rsi + rdi]
pmovmskb ecx, xmm0
test ecx, ecx
jne 0x18012b9a7
mov edx, 0x10
nop word cs:[rax + rax]
add rdi, rdx
and rdi, rax
movdqu xmm0, xmmword [rsi + rdi]
pmovmskb ecx, xmm0
add rdx, 0x10
test ecx, ecx
je 0x18012b990
mov rbx, qword [rsp + 0x70]
tzcnt ecx, ecx
add rcx, rdi
and rcx, rax
movzx edx, byte [rsi + rcx]
test dl, dl
js 0x18012b9ce
movdqa xmm0, xmmword [rsi]
pmovmskb ecx, xmm0
tzcnt ecx, ecx
movzx edx, byte [rsi + rcx]
lea r8, [rcx - 0x10]
and r8, rax
mov byte [rsi + rcx], bpl
mov byte [r8 + rsi + 0x10], bpl
shl rcx, 5
mov rax, rsi
sub rax, rcx
and dl, 1
movzx edx, dl
sub qword [rsp + 0x490], rdx
neg rcx
mov qword [rsi + rcx - 0x20], r14
mov qword [rax - 0x18], 0xa
mov qword [rax - 0x10], 0xa
mov dword [rax - 8], 0
inc qword [rsp + 0x498]
jmp 0x18012b8e6
lea rcx, [rsp + 0x480]
lea rdx, [rsp + 0x4a0]
call fcn.1801a31c0
mov rsi, qword [rsp + 0x480]
mov rax, qword [rsp + 0x488]
jmp 0x18012b96e
mov rcx, qword [rsp + 0x140]
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x458], rax
mov rax, qword [rsp + 0x150]
mov r13, rax
shl r13, 5
add r13, rcx
mov qword [rsp + 0x298], rcx
mov rsi, rcx
test rax, rax
je 0x18012c166
mov r12, qword [rsp + 0xe8]
add r12, 0x2a
pcmpeqd xmm6, xmm6
mov rsi, qword [rsp + 0x298]
mov qword [rsp + 0xe8], r12
mov qword [rsp + 0x1d0], r13
jmp 0x18012bae2
test rdi, rdi
je 0x18012bad9
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp rsi, r13
je 0x18012c1a4
mov rax, rsi
add rsi, 0x20
mov rcx, qword [rax + 8]
mov qword [rsp + 0x50], rcx
test rcx, rcx
je 0x18012c166
mov rdi, qword [rax + 0x10]
mov edx, dword [rax]
cmp qword [rsp + 0x498], 0
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0x2b0], rdi
je 0x18012bc60
mov qword [rsp + 0xf0], rdx
mov rdi, qword [rax + 0x18]
mov rcx, qword [rsp + 0x4a0]
mov rdx, qword [rsp + 0x4a8]
mov r8, qword [rsp + 0x50]
mov r9, rdi
call fcn.180129bc0
mov rbx, rax
mov rcx, qword [rsp + 0x480]
mov rsi, qword [rsp + 0x488]
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
lea r15, [rcx - 0x20]
lea r14, [rdi + rdi]
xor r12d, r12d
mov qword [rsp + 0x58], rcx
and rbx, rsi
movdqu xmm8, xmmword [rcx + rbx]
movdqa xmm0, xmm7
pcmpeqb xmm0, xmm8
pmovmskb r13d, xmm0
test r13d, r13d
jne 0x18012bbdf
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x18012bf61
add rbx, r12
add rbx, 0x10
add r12, 0x10
mov rcx, qword [rsp + 0x58]
jmp 0x18012bb82
lea eax, [r13 - 1]
and eax, r13d
mov r13d, eax
test ax, ax
je 0x18012bb9e
tzcnt ebp, r13d
add rbp, rbx
and rbp, rsi
mov rcx, rbp
shl rcx, 5
mov rax, r15
sub rax, rcx
cmp qword [rax + 0x10], rdi
jne 0x18012bbd0
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x50]
mov r8, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x18012bbd0
neg rbp
shl rbp, 5
mov rcx, qword [rsp + 0x58]
add rcx, rbp
lea rax, [rcx - 0x20]
test rcx, rcx
cmove rax, rcx
mov r12, qword [rsp + 0xe8]
mov rbx, qword [rsp + 0x70]
mov r13, qword [rsp + 0x1d0]
mov rsi, qword [rsp + 0xd8]
mov rdi, qword [rsp + 0x2b0]
mov rdx, qword [rsp + 0xf0]
jmp 0x18012bc62
xor eax, eax
lea rcx, [rax + 0x18]
test rax, rax
lea rax, [0x18020c300]
cmove rcx, rax
cmp dword [rcx], 1
jg 0x18012bac0
imul r14, rdx, 0x548
lea r15, [rbx + r14]
lea rdx, [rbx + r14]
add rdx, 0x1c
lea rax, [r12 + r14]
xor r8d, r8d
cmp word [rax + r8*2 - 6], 0
je 0x18012bce9
cmp r8, 0x100
je 0x18012bcd2
cmp word [rax + r8*2 - 4], 0
je 0x18012bcda
cmp word [rax + r8*2 - 2], 0
je 0x18012bcdf
cmp word [rax + r8*2], 0
je 0x18012bce5
add r8, 4
cmp word [rax + r8*2 - 6], 0
jne 0x18012bca0
jmp 0x18012bce9
mov r8d, 0x101
jmp 0x18012bcf6
inc r8
jmp 0x18012bce9
add r8, 2
jmp 0x18012bce9
add r8, 3
cmp r8, 0x102
jae 0x18012e60a
lea rcx, [rsp + 0x1e0]
call fcn.18001f3e0
mov rbp, qword [rsp + 0x1e0]
test rbp, rbp
je 0x18012bac0
mov qword [rsp + 0x470], r15
mov qword [rsp + 0x2a0], r14
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x2a8], rax
mov r14, qword [rsp + 0x1f0]
mov rcx, qword [rsp + 0x348]
mov rdx, qword [rsp + 0x350]
mov r8, rbp
mov r9, r14
call fcn.180009a00
mov rdi, rax
mov rax, qword [rsp + 0x328]
mov rsi, qword [rsp + 0x330]
mov rcx, rdi
shr rcx, 0x39
mov qword [rsp + 0x468], rcx
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
lea r15, [rax - 0x88]
xor ecx, ecx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x460], rdi
mov qword [rsp + 0xf0], rax
and rdi, rsi
movdqu xmm8, xmmword [rax + rdi]
movdqa xmm0, xmm7
pcmpeqb xmm0, xmm8
pmovmskb ebx, xmm0
test ebx, ebx
jne 0x18012be0c
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x18012bf68
mov rax, qword [rsp + 0x58]
add rdi, rax
add rdi, 0x10
add rax, 0x10
mov qword [rsp + 0x58], rax
mov rax, qword [rsp + 0xf0]
jmp 0x18012bda9
lea eax, [rbx - 1]
and eax, ebx
mov ebx, eax
test ax, ax
je 0x18012bdc3
tzcnt ecx, ebx
add rcx, rdi
and rcx, rsi
mov r12, rcx
neg r12
shl rcx, 3
mov r13, r12
shl r13, 7
mov rax, r13
sub rax, rcx
cmp r14, qword [r15 + rax + 0x10]
jne 0x18012be00
add rax, r15
mov rcx, qword [rax]
mov rdx, rbp
mov r8, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x18012be00
lea rax, [r12*8]
add rax, r13
mov r8, qword [rsp + 0xf0]
mov rcx, qword [r8 + rax - 0x68]
mov rdx, qword [r8 + rax - 0x58]
mov qword [r8 + rax - 0x60], rcx
mov rbx, qword [rsp + 0x70]
mov r9, qword [rsp + 0x2a0]
mov rcx, qword [rbx + r9 + 0x500]
mov qword [r8 + rax - 0x68], rcx
mov qword [r8 + rax - 0x50], rdx
mov rcx, qword [rbx + r9 + 0x4b8]
mov qword [r8 + rax - 0x58], rcx
mov rcx, qword [r8 + rax - 0x48]
mov qword [r8 + rax - 0x40], rcx
mov rcx, qword [rbx + r9 + 0x4c0]
add rcx, qword [rbx + r9 + 0x4c8]
mov rdx, 0xffffffffffffffff
cmovb rcx, rdx
mov qword [r8 + rax - 0x48], rcx
mov rcx, qword [r8 + rax - 0x38]
mov qword [r8 + rax - 0x30], rcx
mov rcx, qword [rbx + r9 + 0x508]
add rcx, qword [rbx + r9 + 0x510]
cmovb rcx, rdx
mov qword [r8 + rax - 0x38], rcx
mov rcx, qword [r8 + rax - 0x28]
mov qword [r8 + rax - 0x20], rcx
mov rcx, qword [rbx + r9 + 0x4d8]
mov qword [r8 + rax - 0x28], rcx
mov rcx, qword [r8 + rax - 0x18]
mov qword [r8 + rax - 0x10], rcx
mov rcx, qword [rbx + r9 + 0x520]
mov qword [r8 + rax - 0x18], rcx
mov byte [r8 + rax - 2], 1
cmp qword [rsp + 0x2a8], 0
mov r12, qword [rsp + 0xe8]
mov r13, qword [rsp + 0x1d0]
je 0x18012bf45
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, rbp
call qword [sym.imp.KERNEL32.dll_HeapFree]
cmp qword [rsp + 0x2b0], 0
mov rsi, qword [rsp + 0xd8]
jne 0x18012bac5
jmp 0x18012bad9
xor ecx, ecx
jmp 0x18012bc20
cmp qword [rsp + 0x338], 0
mov rdi, qword [rsp + 0x70]
mov r11, qword [rsp + 0xf0]
je 0x18012c13c
mov rbx, qword [rsp + 0x2a0]
mov rax, qword [rdi + rbx + 0x4c0]
add rax, qword [rdi + rbx + 0x4c8]
mov rdx, qword [rdi + rbx + 0x4b8]
mov r8, 0xffffffffffffffff
cmovb rax, r8
mov rcx, qword [rdi + rbx + 0x508]
add rcx, qword [rdi + rbx + 0x510]
cmovb rcx, r8
mov r8, qword [rsp + 0x470]
mov r8, qword [r8]
mov qword [rsp + 0x58], r8
mov r10, qword [rdi + rbx + 0x500]
mov r9, qword [rdi + rbx + 0x4d8]
mov r8, qword [rdi + rbx + 0x520]
mov r15, qword [rsp + 0x460]
and r15, rsi
movdqu xmm0, xmmword [r11 + r15]
pmovmskb edi, xmm0
test edi, edi
mov r13, qword [rsp + 0x1d0]
jne 0x18012c038
mov ebx, 0x10
nop word cs:[rax + rax]
add r15, rbx
and r15, rsi
movdqu xmm0, xmmword [r11 + r15]
pmovmskb edi, xmm0
add rbx, 0x10
test edi, edi
je 0x18012c020
mov r12, qword [rsp + 0xe8]
tzcnt edi, edi
add rdi, r15
and rdi, rsi
movzx ebx, byte [r11 + rdi]
test bl, bl
js 0x18012c065
movdqa xmm0, xmmword [r11]
pmovmskb edi, xmm0
tzcnt edi, edi
movzx ebx, byte [r11 + rdi]
lea r15, [rdi - 0x10]
and r15, rsi
mov rsi, qword [rsp + 0x468]
mov byte [r11 + rdi], sil
mov byte [r15 + r11 + 0x10], sil
and bl, 1
movzx esi, bl
sub qword [rsp + 0x338], rsi
mov rsi, rdi
neg rsi
shl rdi, 3
shl rsi, 7
sub rsi, rdi
mov qword [r11 + rsi - 0x88], rbp
mov rdi, qword [rsp + 0x2a8]
mov qword [r11 + rsi - 0x80], rdi
mov qword [r11 + rsi - 0x78], r14
mov rdi, qword [rsp + 0x58]
mov qword [r11 + rsi - 0x70], rdi
mov qword [r11 + rsi - 0x68], r10
mov qword [r11 + rsi - 0x60], r10
mov qword [r11 + rsi - 0x58], rdx
mov qword [r11 + rsi - 0x50], rdx
mov qword [r11 + rsi - 0x48], rax
mov qword [r11 + rsi - 0x40], rax
mov qword [r11 + rsi - 0x38], rcx
mov qword [r11 + rsi - 0x30], rcx
mov qword [r11 + rsi - 0x28], r9
mov qword [r11 + rsi - 0x20], r9
mov qword [r11 + rsi - 0x18], r8
mov qword [r11 + rsi - 0x10], r8
mov dword [r11 + rsi - 8], 0
mov word [r11 + rsi - 4], 0
mov byte [r11 + rsi - 2], 1
inc qword [rsp + 0x340]
mov rbx, qword [rsp + 0x70]
cmp qword [rsp + 0x2b0], 0
mov rsi, qword [rsp + 0xd8]
jne 0x18012bac5
jmp 0x18012bad9
lea rcx, [rsp + 0x328]
lea rdx, [rsp + 0x348]
call fcn.1801a2760
mov r11, qword [rsp + 0x328]
mov rsi, qword [rsp + 0x330]
jmp 0x18012bf84
sub r13, rsi
je 0x18012c1a4
shr r13, 5
add rsi, 0x10
jmp 0x18012c189
add rsi, 0x20
dec r13
je 0x18012c1a4
cmp qword [rsi], 0
je 0x18012c180
mov r8, qword [rsi - 8]
mov rcx, qword [0x180246f98]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18012c180
cmp qword [rsp + 0x458], 0
je 0x18012c1c6
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, qword [rsp + 0x298]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rcx, qword [rsp + 0xa0]
call sub.iphlpapi.dll_FreeMibTable
mov rdi, qword [rsp + 0x488]
test rdi, rdi
je 0x18012c2c2
mov rbx, qword [rsp + 0x498]
test rbx, rbx
je 0x18012c291
mov rsi, qword [rsp + 0x480]
movdqa xmm0, xmmword [rsi]
pmovmskb eax, xmm0
not eax
lea r14, [rsi + 0x10]
mov r15, qword [sym.imp.KERNEL32.dll_HeapFree]
mov r12, rsi
jmp 0x18012c227
mov eax, ebp
test rbx, rbx
je 0x18012c299
test ax, ax
je 0x18012c240
lea ebp, [rax - 1]
and ebp, eax
jmp 0x18012c267
movdqa xmm0, xmmword [r14]
pmovmskb eax, xmm0
add r12, 0xfffffffffffffe00
add r14, 0x10
cmp ax, 0xffff
je 0x18012c240
mov ecx, 0xfffffffe
sub ecx, eax
not eax
mov ebp, eax
and ebp, ecx
tzcnt ecx, eax
shl rcx, 5
mov rax, r12
sub rax, rcx
dec rbx
cmp qword [rax - 0x18], 0
je 0x18012c220
mov r8, qword [rax - 0x20]
mov rcx, qword [0x180246f98]
xor edx, edx
call r15
jmp 0x18012c220
mov rsi, qword [rsp + 0x480]
mov rax, rdi
shl rax, 5
add rdi, rax
cmp rdi, 0xffffffffffffffcf
je 0x18012c2c2
sub rsi, rax
add rsi, 0xffffffffffffffe0
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [rsp + 0x340]
test rsi, rsi
je 0x18012c438
mov r13, qword [rsp + 0x328]
mov rbx, qword [rsp + 0x330]
lea r14, [r13 + 0x10]
movdqa xmm0, xmmword [r13]
pmovmskb ebp, xmm0
not ebp
mov r15, qword [rsp + 0x338]
pcmpeqd xmm6, xmm6
mov rdi, r13
mov r12, rsi
jmp 0x18012c319
test rsi, rsi
je 0x18012c438
test bp, bp
je 0x18012c330
lea eax, [rbp - 1]
and eax, ebp
jmp 0x18012c357
movdqa xmm0, xmmword [r14]
pmovmskb ebp, xmm0
add rdi, 0xfffffffffffff780
add r14, 0x10
cmp bp, 0xffff
je 0x18012c330
mov ecx, 0xfffffffe
sub ecx, ebp
not ebp
mov eax, ebp
and eax, ecx
mov ecx, ebp
tzcnt ecx, ecx
mov ebp, eax
mov rax, rcx
neg rax
shl rcx, 3
shl rax, 7
sub rax, rcx
dec rsi
cmp byte [rdi + rax - 2], 0
jne 0x18012c310
add rax, rdi
mov rcx, r13
sub rcx, rax
sar rcx, 3
movabs rdx, 0xf0f0f0f0f0f0f0f1
imul rcx, rdx
lea rdx, [rcx - 0x10]
and rdx, rbx
movdqu xmm0, xmmword [r13 + rdx]
pcmpeqb xmm0, xmm6
psllw xmm0, 7
pmovmskb r8d, xmm0
test r8d, r8d
je 0x18012c3c1
bsr r8w, r8w
xor r8d, 0xf
jmp 0x18012c3c6
mov r8w, 0x10
movdqu xmm0, xmmword [r13 + rcx]
pcmpeqb xmm0, xmm6
pmovmskb r9d, xmm0
or r9d, 0x10000
tzcnt r9d, r9d
add r8d, r9d
mov r9b, 0x80
cmp r8w, 0xf
ja 0x18012c3fd
inc r15
mov qword [rsp + 0x338], r15
mov r9b, 0xff
mov byte [r13 + rcx], r9b
mov byte [rdx + r13 + 0x10], r9b
dec r12
mov qword [rsp + 0x340], r12
cmp qword [rax - 0x80], 0
je 0x18012c310
mov r8, qword [rax - 0x88]
mov rcx, qword [0x180246f98]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18012c310
mov dword [rsp + 0x90], 0x3c00
mov dword [rsp + 0x100], 0
mov ebx, 4
xor esi, esi
lea r14, [rsp + 0x90]
nop dword [rax]
dec ebx
je 0x18012c704
mov edx, dword [rsp + 0x90]
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_realloc
test rax, rax
je 0x18012c4d2
mov rdi, rax
mov qword [rsp + 0x20], r14
xor ecx, ecx
mov edx, 0xe
xor r8d, r8d
mov r9, rax
call sub.iphlpapi.dll_GetAdaptersAddresses
mov dword [rsp + 0x100], eax
mov rsi, rdi
cmp eax, 0x6f
je 0x18012c460
test eax, eax
jne 0x18012c701
mov qword [rsp + 0x1e8], rdi
mov qword [rsp + 0x1f0], rdi
xor edi, edi
mov rsi, qword [rsp + 0x60]
test rdi, rdi
jne 0x18012c799
jmp 0x18012c56e
movzx eax, byte [0x180247060]
mov rcx, qword [0x180246f98]
test rcx, rcx
jne 0x18012c4fe
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x18012e68d
mov rcx, rax
mov qword [0x180246f98], rax
mov r8d, 0x32
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x18012e68d
mov rdi, rax
movups xmm0, xmmword [0x18020c758]
movups xmmword [rax + 0x20], xmm0
movups xmm0, xmmword [0x18020c748]
movups xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [str.failed_to_allocate_memory_for_IP_ADAPTER_ADDRESSESGetAdaptersAddresses___failed_with_code]
movdqu xmmword [rax], xmm0
mov word [rax + 0x30], 0x5345
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov qword [rsp + 0x1e8], 0x32
mov qword [rsp + 0x1f0], 0x32
mov rsi, qword [rsp + 0x60]
test rdi, rdi
jne 0x18012c799
movdqu xmm0, xmmword [rsp + 0x1e8]
movdqa xmmword [rsp + 0x140], xmm0
cmp qword [rsp + 0x340], 0
je 0x18012d93b
mov rax, qword [rsp + 0x328]
mov r14, qword [rsp + 0x330]
mov qword [rsp + 0x50], rax
lea rbp, [rax - 0x88]
mov rax, qword [rsp + 0x348]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x350]
mov qword [rsp + 0xd8], rax
pcmpeqd xmm6, xmm6
nop dword [rax]
lea rcx, [rsp + 0x480]
lea rdx, [rsp + 0x140]
call fcn.180129a70
mov r15, qword [rsp + 0x480]
test r15, r15
je 0x18012d990
mov rax, qword [rsp + 0x488]
mov qword [rsp + 0x58], rax
mov r12, qword [rsp + 0x490]
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0xd8]
mov r8, r15
mov r9, r12
call fcn.180009a00
mov r13, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor edi, edi
and r13, r14
mov rax, qword [rsp + 0x50]
movdqu xmm8, xmmword [rax + r13]
movdqa xmm0, xmm7
pcmpeqb xmm0, xmm8
pmovmskb esi, xmm0
test esi, esi
jne 0x18012c68c
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x18012c6de
add r13, rdi
add r13, 0x10
add rdi, 0x10
jmp 0x18012c63e
lea eax, [rsi - 1]
and eax, esi
mov esi, eax
test ax, ax
je 0x18012c65d
tzcnt eax, esi
add rax, r13
and rax, r14
mov rbx, rax
neg rbx
shl rax, 3
shl rbx, 7
sub rbx, rax
cmp qword [rbp + rbx + 0x10], r12
jne 0x18012c680
add rbx, rbp
mov rdx, qword [rbx]
mov rcx, r15
mov r8, r12
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x18012c680
lea rcx, [rsp + 0x498]
movzx eax, word [rcx + 4]
mov word [rbx + 0x84], ax
mov eax, dword [rcx]
mov dword [rbx + 0x80], eax
cmp qword [rsp + 0x58], 0
je 0x18012c5d0
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, r15
call qword [sym.imp.KERNEL32.dll_HeapFree]
jmp 0x18012c5d0
mov rsi, rdi
lea rax, [rsp + 0x100]
mov qword [rsp + 0x140], rax
lea rax, [0x18002bd80]
mov qword [rsp + 0x148], rax
lea rax, [0x18020c798]
mov qword [rsp + 0x480], rax
mov qword [rsp + 0x488], 1
mov qword [rsp + 0x4a0], 0
lea rax, [rsp + 0x140]
mov qword [rsp + 0x490], rax
mov qword [rsp + 0x498], 1
lea rcx, [rsp + 0x1e0]
lea rdx, [rsp + 0x480]
call fcn.18001efd0
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rdi, qword [rsp + 0x1e0]
mov rsi, qword [rsp + 0x60]
test rdi, rdi
je 0x18012c56e
cmp qword [rsp + 0x1e8], 0
je 0x18012c7b6
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
movzx eax, word [rsi + 8]
cmp al, 2
jne 0x18012d9ae
cmp byte [rsi + 2], 0
je 0x18012e46a
call sub.KERNEL32.dll_GetLogicalDrives
mov dword [rsp + 0xa0], eax
test eax, eax
je 0x18012c83c
mov qword [rsp + 0x1e0], 8
xorps xmm0, xmm0
movups xmmword [rsp + 0x1e8], xmm0
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x140], rax
movabs rax, 0x2000000000
mov qword [rsp + 0x148], rax
mov eax, dword [0x180247064]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 0x50]
test rax, rax
je 0x18012c851
add rax, 0x110
jmp 0x18012c856
xorps xmm0, xmm0
movaps xmmword [rsp + 0x480], xmm0
mov edi, 8
jmp 0x18012c9e5
call fcn.180082200
lea r12, [rsp + 0x1e8]
mov rax, qword [rax]
mov r9, qword [rax + 0x1f0]
lea rax, [rsp + 0x140]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], 0x20
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 1
lea rcx, [rsp + 0x480]
mov edx, 0x20
xor r8d, r8d
call fcn.18012e6f0
mov rbx, qword [rsp + 0x480]
mov rax, qword [rsp + 0x490]
test rax, rax
je 0x18012c8eb
test rbx, rbx
je 0x18012c9d0
xor r8d, r8d
mov rcx, rbx
nop word [rax + rax]
add r8, qword [rcx + 0x10]
dec rax
je 0x18012c8e2
mov rcx, qword [rcx + 0x18]
test rcx, rcx
jne 0x18012c8d0
test r8, r8
jne 0x18012e4fc
test rbx, rbx
je 0x18012c9d0
mov r13, qword [sym.imp.KERNEL32.dll_HeapFree]
lea rdi, [rsp + 0x1e0]
jmp 0x18012c91c
mov rbx, rsi
test rsi, rsi
je 0x18012c9d0
mov rsi, qword [rbx + 0x18]
test rsi, rsi
je 0x18012c92d
mov qword [rsi + 0x20], 0
mov r14, qword [rbx]
mov rbp, qword [rbx + 8]
mov r15, qword [rbx + 0x10]
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, rbx
call r13
test r14, r14
je 0x18012c9c7
mov rax, qword [rsp + 0x1e8]
mov rbx, qword [rsp + 0x1f0]
sub rax, rbx
cmp rax, r15
jb 0x18012c9af
lea rcx, [rbx + rbx*8]
shl rcx, 4
add rcx, qword [rsp + 0x1e0]
mov rax, r15
shl rax, 4
lea r8, [rax + rax*8]
mov rdx, r14
call fcn.180199330
add rbx, r15
mov qword [rsp + 0x1f0], rbx
test rbp, rbp
je 0x18012c910
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, r14
call r13
jmp 0x18012c910
mov rcx, rdi
mov rdx, rbx
mov r8, r15
call fcn.1801a39e0
mov rbx, qword [rsp + 0x1f0]
jmp 0x18012c964
test rsi, rsi
jne 0x18012d2bb
mov rdi, qword [rsp + 0x1e0]
movups xmm0, xmmword [r12]
movaps xmmword [rsp + 0x480], xmm0
lea rbx, [rsp + 0x3a0]
mov rsi, qword [rsp + 0x398]
mov rdx, qword [rsp + 0x3a8]
mov rcx, rsi
call fcn.18012f620
cmp qword [rsp + 0x3a0], 0
je 0x18012ca22
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov qword [rsp + 0x398], rdi
movaps xmm0, xmmword [rsp + 0x480]
movups xmmword [rbx], xmm0
mov rax, qword [rsp + 0x60]
cmp byte [rax + 7], 0
je 0x18012d47f
mov qword [rsp + 0x140], 8
xorps xmm6, xmm6
movups xmmword [rsp + 0x148], xmm6
mov dword [rsp + 0x6c], 0
mov ebx, 8
xor eax, eax
mov qword [rsp + 0x50], rax
lea r12, [rsp + 0x6c]
lea rdi, [rsp + 0x68]
mov r13, qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, qword [sym.imp.KERNEL32.dll_HeapFree]
nop word [rax + rax]
mov qword [rsp + 0x78], 0
mov dword [rsp + 0xfc], 0
mov dword [rsp + 0x68], 0
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rdi
lea rax, [rsp + 0xfc]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xffffffff
xor ecx, ecx
xor edx, edx
mov r8d, 2
lea r9, [rsp + 0x78]
call sub.netapi32.dll_NetUserEnum
mov ebp, eax
cmp eax, 0xea
je 0x18012caf0
test ebp, ebp
jne 0x18012d2f3
mov rsi, qword [rsp + 0x78]
mov eax, dword [rsp + 0xfc]
lea r15, [rsi + rax*8]
mov rax, rsi
nop word cs:[rax + rax]
cmp rax, r15
je 0x18012d280
lea rsi, [rax + 8]
cmp qword [rax], 0
mov rax, rsi
je 0x18012cb10
mov qword [rsp + 0x88], 0
mov rdx, qword [rsi - 8]
xor ecx, ecx
mov r8d, 0x17
lea r9, [rsp + 0x88]
call sub.netapi32.dll_NetUserGetInfo
test eax, eax
je 0x18012cb63
mov rcx, qword [rsp + 0x88]
test rcx, rcx
je 0x18012cb00
call sub.netapi32.dll_NetApiBufferFree
jmp 0x18012cb00
mov rcx, qword [rsp + 0x88]
mov rdi, qword [rcx + 0x20]
test rdi, rdi
je 0x18012cd24
mov rcx, rdi
call sub.ADVAPI32.dll_IsValidSid
test eax, eax
je 0x18012cd33
mov rcx, rdi
call sub.ADVAPI32.dll_GetLengthSid
test eax, eax
je 0x18012cd3d
mov r12d, eax
mov r8d, eax
mov rax, qword [0x180246f98]
test rax, rax
mov qword [rsp + 0x60], r8
jne 0x18012cbca
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x18012e561
mov qword [0x180246f98], rax
mov r8, qword [rsp + 0x60]
mov rcx, rax
mov edx, 8
call r13
test rax, rax
je 0x18012e561
mov ecx, r12d
mov rdx, rax
mov r12, rax
mov r8, rdi
call sub.ADVAPI32.dll_CopySid
test eax, eax
je 0x18012cd63
cmp byte [r12], 1
jne 0x18012e5a0
mov dword [rsp + 0x90], 0
mov dword [rsp + 0x100], 0
mov dword [rsp + 0xa0], 8
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov qword [rsp + 0x50], r12
mov rdx, r12
xor r8d, r8d
lea r9, [rsp + 0x90]
call sub.ADVAPI32.dll_LookupAccountSidW
test eax, eax
jne 0x18012cc72
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x18012ce69
mov r12d, dword [rsp + 0x90]
test r12, r12
je 0x18012cd81
lea rbx, [r12 + r12]
mov rax, qword [0x180246f98]
test rax, rax
jne 0x18012cca9
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x18012e623
mov qword [0x180246f98], rax
mov rcx, rax
mov edx, 8
mov r8, rbx
call r13
test rax, rax
je 0x18012e623
mov rdi, rax
mov dword [rsp + 0x100], 0
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, qword [rsp + 0x50]
mov r8, rdi
lea r9, [rsp + 0x90]
call sub.ADVAPI32.dll_LookupAccountSidW
test eax, eax
jne 0x18012cdd6
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, rdi
call r14
jmp 0x18012ce69
lea rdi, [rsp + 0x68]
call sub.netapi32.dll_NetApiBufferFree
jmp 0x18012cb00
lea rdi, [rsp + 0x68]
jmp 0x18012cb4f
mov edx, 1
xor ecx, ecx
mov r8, rdi
call sub.ADVAPI32.dll_CopySid
test eax, eax
lea r12, [rsp + 0x6c]
lea rdi, [rsp + 0x68]
je 0x18012cb4f
jmp 0x18012e5e7
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, r12
call r14
lea r12, [rsp + 0x6c]
lea rdi, [rsp + 0x68]
jmp 0x18012cb4f
mov dword [rsp + 0x100], 0
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x100]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov edi, 2
mov r8d, 2
xor ecx, ecx
mov rdx, qword [rsp + 0x50]
lea r9, [rsp + 0x90]
call sub.ADVAPI32.dll_LookupAccountSidW
test eax, eax
je 0x18012ce69
mov r8, 0xffffffffffffffff
nop dword [rax]
cmp word [rdi + r8*2 + 2], 0
lea r8, [r8 + 1]
jne 0x18012cde0
lea rcx, [rsp + 0x480]
mov rdx, rdi
call fcn.18001f3e0
mov rax, qword [rsp + 0x480]
test rax, rax
je 0x18012cecb
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x488]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x1e0], xmm0
movaps xmm0, xmmword [rsp + 0x1e0]
movaps xmmword [rsp + 0x480], xmm0
test r12d, r12d
je 0x18012ce4a
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, rdi
call r14
movaps xmm0, xmmword [rsp + 0x480]
movaps xmmword [rsp + 0x90], xmm0
lea r12, [rsp + 0x6c]
lea rdi, [rsp + 0x68]
jmp 0x18012cf0d
mov rdx, qword [rsi - 8]
mov r8, 0xffffffffffffffff
nop word cs:[rax + rax]
cmp word [rdx + r8*2 + 2], 0
lea r8, [r8 + 1]
jne 0x18012ce80
lea rcx, [rsp + 0x480]
call fcn.18001f3e0
mov rax, qword [rsp + 0x480]
test rax, rax
lea r12, [rsp + 0x6c]
lea rdi, [rsp + 0x68]
je 0x18012cefb
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x488]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x90], xmm0
jmp 0x18012cf0d
movaps xmmword [rsp + 0x1e0], xmm6
mov eax, 1
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x1e0]
movaps xmmword [rsp + 0x480], xmm0
test r12d, r12d
jne 0x18012ce3b
jmp 0x18012ce4a
movaps xmmword [rsp + 0x90], xmm6
mov eax, 1
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0x100], xmm0
mov rdx, qword [rsi - 8]
mov qword [rsp + 0x80], 0
mov dword [rsp + 0xe4], 0
mov dword [rsp + 0x1dc], 0
lea rax, [rsp + 0x1dc]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xe4]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0xffffffff
lea rcx, [0x180233948]
xor r8d, r8d
mov r9d, 1
call sub.netapi32.dll_NetUserGetLocalGroups
test eax, eax
je 0x18012cfa7
mov qword [rsp + 0x1e0], 8
lea rax, [rsp + 0x1e8]
movups xmmword [rax], xmm6
jmp 0x18012d0f9
mov ebx, dword [rsp + 0xe4]
test rbx, rbx
je 0x18012d000
lea rax, [rbx*8]
lea r12, [rax + rax*2]
movzx eax, byte [0x180247060]
mov rax, qword [0x180246f98]
test rax, rax
jne 0x18012cfe8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x18012e67e
mov qword [0x180246f98], rax
mov rcx, rax
xor edx, edx
mov r8, r12
call r13
mov rdi, rax
test rax, rax
jne 0x18012d005
jmp 0x18012e67e
mov edi, 8
mov qword [rsp + 0x1e0], rdi
mov qword [rsp + 0x1e8], rbx
mov qword [rsp + 0x1f0], 0
mov r12, qword [rsp + 0x80]
test r12, r12
je 0x18012d13d
mov r13d, dword [rsp + 0xe4]
cmp ebx, r13d
jb 0x18012d254
mov eax, 0
mov ebx, 0
test r13d, r13d
je 0x18012d0e0
lea r13, [r12 + r13*8]
mov rbx, rax
jmp 0x18012d08a
movaps xmmword [rsp + 0xa0], xmm6
mov eax, 1
lea rcx, [rbx + rbx*2]
mov qword [rdi + rcx*8], rax
movaps xmm0, xmmword [rsp + 0xa0]
movups xmmword [rdi + rcx*8 + 8], xmm0
inc rbx
cmp r12, r13
je 0x18012d0e0
mov rdx, qword [r12]
mov r8, 0xffffffffffffffff
nop word cs:[rax + rax]
cmp word [rdx + r8*2 + 2], 0
lea r8, [r8 + 1]
jne 0x18012d0a0
add r12, 8
lea rcx, [rsp + 0x480]
call fcn.18001f3e0
mov rax, qword [rsp + 0x480]
test rax, rax
je 0x18012d060
lea rcx, [rsp + 0x488]
movups xmm0, xmmword [rcx]
movaps xmmword [rsp + 0xa0], xmm0
jmp 0x18012d06d
mov qword [rsp + 0x1f0], rbx
mov r13, qword [sym.imp.KERNEL32.dll_HeapAlloc]
lea r12, [rsp + 0x6c]
lea rdi, [rsp + 0x68]
mov rcx, qword [rsp + 0x80]
mov rax, qword [rsp + 0x1e0]
mov qword [rsp + 0x480], rax
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x488], rax
mov rax, qword [rsp + 0x1f0]
mov qword [rsp + 0x490], rax
test rcx, rcx
je 0x18012d177
call sub.netapi32.dll_NetApiBufferFree
jmp 0x18012d177
mov rax, qword [rsp + 0x1f0]
mov qword [rsp + 0x490], rax
mov rax, qword [rsp + 0x1e0]
mov qword [rsp + 0x480], rax
mov rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x488], rax
lea r12, [rsp + 0x6c]
lea rdi, [rsp + 0x68]
movaps xmm0, xmmword [rsp + 0x100]
movaps xmmword [rsp + 0xa0], xmm0
mov rax, qword [rsp + 0x480]
mov qword [rsp + 0x1e0], rax
mov rax, qword [rsp + 0x488]
mov qword [rsp + 0x1e8], rax
mov rax, qword [rsp + 0x490]
mov qword [rsp + 0x1f0], rax
mov rdx, qword [rsp + 0x150]
cmp rdx, qword [rsp + 0x148]
jne 0x18012d1de
lea rcx, [rsp + 0x140]
call fcn.1801654b0
mov rdx, qword [rsp + 0x150]
mov rcx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x50]
mov r9, qword [rsp + 0x58]
mov rbx, qword [rsp + 0x140]
lea rax, [rdx + rdx*4]
shl rax, 4
mov qword [rbx + rax], r8
mov qword [rbx + rax + 8], rcx
mov qword [rbx + rax + 0x10], rcx
mov qword [rbx + rax + 0x18], r9
movaps xmm0, xmmword [rsp + 0xa0]
movups xmmword [rbx + rax + 0x20], xmm0
movaps xmm0, xmmword [rsp + 0x1e0]
movups xmmword [rbx + rax + 0x30], xmm0
mov rcx, qword [rsp + 0x1f0]
mov qword [rbx + rax + 0x40], rcx
mov dword [rbx + rax + 0x48], 0
inc rdx
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x150], rdx
jmp 0x18012cb4f
lea rcx, [rsp + 0x1e0]
mov rdx, r13
call fcn.1801a2690
mov rdi, qword [rsp + 0x1e0]
mov rax, qword [rsp + 0x1f0]
jmp 0x18012d056
cmp ebp, 0xea
jne 0x18012d2f3
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x18012ca90
call sub.netapi32.dll_NetApiBufferFree
jmp 0x18012ca90
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, rsi
call r13
mov rsi, rbx
test rbx, rbx
je 0x18012c9d0
mov rbx, qword [rsi + 0x18]
test rbx, rbx
je 0x18012d2cc
mov qword [rbx + 0x20], 0
mov rdi, qword [rsi]
mov rdx, qword [rsi + 0x10]
mov rcx, rdi
call fcn.18012f620
cmp qword [rsi + 8], 0
je 0x18012d2a0
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, rdi
call r13
jmp 0x18012d2a0
mov rcx, qword [rsp + 0x78]
test rcx, rcx
je 0x18012d302
call sub.netapi32.dll_NetApiBufferFree
mov dword [rsp + 0x78], 0
mov qword [rsp + 0x100], 0
lea rcx, [rsp + 0x78]
lea rdx, [rsp + 0x100]
call sub.Secur32.dll_LsaEnumerateLogonSessions
test eax, eax
je 0x18012d4c7
mov rsi, qword [rsp + 0x100]
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x490], rax
movups xmm0, xmmword [rsp + 0x140]
movaps xmmword [rsp + 0x480], xmm0
test rsi, rsi
je 0x18012d365
mov rcx, rsi
call sub.Secur32.dll_LsaFreeReturnBuffer
mov rsi, qword [rsp + 0x3b0]
mov rbx, qword [rsp + 0x3c0]
test rbx, rbx
je 0x18012d443
xor r15d, r15d
jmp 0x18012d399
cmp r15, rbx
je 0x18012d443
lea r12, [r15 + r15*4]
shl r12, 4
cmp qword [rsi + r12 + 8], 0
je 0x18012d3bc
lea rax, [rsi + r12]
mov r8, qword [rax]
mov rcx, qword [0x180246f98]
xor edx, edx
call r14
cmp qword [rsi + r12 + 0x20], 0
je 0x18012d3d5
mov r8, qword [rsi + r12 + 0x18]
mov rcx, qword [0x180246f98]
xor edx, edx
call r14
mov rdi, qword [rsi + r12 + 0x30]
mov r13, qword [rsi + r12 + 0x40]
test r13, r13
je 0x18012d420
lea rbp, [rdi + 8]
jmp 0x18012d3f9
add rbp, 0x18
dec r13
je 0x18012d420
cmp qword [rbp], 0
je 0x18012d3f0
mov r8, qword [rbp - 8]
mov rcx, qword [0x180246f98]
xor edx, edx
call r14
jmp 0x18012d3f0
inc r15
cmp qword [rsi + r12 + 0x38], 0
je 0x18012d390
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, rdi
call r14
jmp 0x18012d390
cmp qword [rsp + 0x3b8], 0
je 0x18012d460
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, rsi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rax, qword [rsp + 0x490]
lea rcx, [rsp + 0x3b0]
mov qword [rcx + 0x10], rax
movaps xmm0, xmmword [rsp + 0x480]
movups xmmword [rcx], xmm0
lea rdx, [rsp + 0x2b8]
mov r8d, 0x1a0
mov rcx, qword [rsp + 0x478]
call fcn.180199330
movaps xmm6, xmmword [rsp + 0x9d0]
movaps xmm7, xmmword [rsp + 0x9e0]
movaps xmm8, xmmword [rsp + 0x9f0]
add rsp, 0xa08
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rsi, qword [rsp + 0x100]
mov eax, dword [rsp + 0x78]
test rax, rax
je 0x18012d338
lea r12, [rsi + rax*8]
lea r15, [rsp + 0xa0]
xorps xmm6, xmm6
mov qword [rsp + 0xd8], r12
jmp 0x18012d512
call sub.Secur32.dll_LsaFreeReturnBuffer
add rsi, 8
cmp rsi, r12
je 0x18012d330
mov qword [rsp + 0xa0], 0
mov rcx, rsi
mov rdx, r15
call sub.Secur32.dll_LsaGetLogonSessionData
mov rcx, qword [rsp + 0xa0]
test eax, eax
jne 0x18012d608
test rcx, rcx
je 0x18012d608
cmp dword [rcx + 0x40], 3
je 0x18012d600
movzx edi, word [rcx + 0x10]
mov r13, qword [rcx + 0x18]
mov rdx, qword [rcx + 0x48]
lea rcx, [rsp + 0x480]
call fcn.180129d60
mov rbp, qword [rsp + 0x480]
test rbp, rbp
je 0x18012d600
mov qword [rsp + 0x70], r13
mov qword [rsp + 0x58], rdi
mov rax, qword [rsp + 0x488]
mov qword [rsp + 0x60], rax
mov r13, qword [rsp + 0x490]
cmp qword [rsp + 0x50], 0
je 0x18012d616
mov rax, qword [rsp + 0x50]
shl rax, 4
lea rdi, [rax + rax*4]
xor r15d, r15d
jmp 0x18012d5b9
add r15, 0x50
cmp rdi, r15
je 0x18012d616
cmp r13, qword [rbx + r15 + 0x10]
jne 0x18012d5b0
mov rcx, qword [rbx + r15]
mov rdx, rbp
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x18012d5b0
cmp qword [rsp + 0x60], 0
lea r15, [rsp + 0xa0]
je 0x18012d600
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, rbp
call r14
nop word cs:[rax + rax]
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
jne 0x18012d500
jmp 0x18012d505
mov dword [rsp + 0x88], 0
mov dword [rsp + 0x80], 0
mov dword [rsp + 0x90], 8
lea rax, [rsp + 0x90]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, rbp
xor r8d, r8d
lea r9, [rsp + 0x88]
call sub.ADVAPI32.dll_LookupAccountSidW
test eax, eax
jne 0x18012d681
call sub.KERNEL32.dll_GetLastError
cmp eax, 0x7a
jne 0x18012d845
mov edi, dword [rsp + 0x88]
test rdi, rdi
je 0x18012d72f
lea r8, [rdi + rdi]
mov rax, qword [0x180246f98]
test rax, rax
jne 0x18012d6bd
mov r12, r8
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x18012e632
mov qword [0x180246f98], rax
mov r8, r12
mov rcx, rax
mov edx, 8
mov r12, r8
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x18012e632
mov r15, rax
mov dword [rsp + 0x80], 0
lea rax, [rsp + 0x90]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, rbp
mov r8, r15
lea r9, [rsp + 0x88]
call sub.ADVAPI32.dll_LookupAccountSidW
test eax, eax
je 0x18012d82e
mov r12, qword [rsp + 0xd8]
jmp 0x18012d783
mov dword [rsp + 0x80], 0
lea rax, [rsp + 0x90]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0
mov r15d, 2
mov r8d, 2
xor ecx, ecx
mov rdx, rbp
lea r9, [rsp + 0x88]
call sub.ADVAPI32.dll_LookupAccountSidW
test eax, eax
je 0x18012d845
mov qword [rsp + 0x58], rdi
mov r8, 0xffffffffffffffff
nop
cmp word [r15 + r8*2 + 2], 0
lea r8, [r8 + 1]
jne 0x18012d790
lea rcx, [rsp + 0x480]
mov rdx, r15
call fcn.18001f3e0
mov rdi, qword [rsp + 0x480]
test rdi, rdi
je 0x18012d808
lea rax, [rsp + 0x488]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x1e0], xmm0
movaps xmm0, xmmword [rsp + 0x1e0]
movaps xmmword [rsp + 0x480], xmm0
cmp dword [rsp + 0x58], 0
je 0x18012d7f3
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, r15
call r14
movaps xmm0, xmmword [rsp + 0x480]
movaps xmmword [rsp + 0x1e0], xmm0
jmp 0x18012d88e
movaps xmmword [rsp + 0x1e0], xmm6
mov edi, 1
movaps xmm0, xmmword [rsp + 0x1e0]
movaps xmmword [rsp + 0x480], xmm0
cmp dword [rsp + 0x58], 0
jne 0x18012d7e4
jmp 0x18012d7f3
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, r15
call r14
mov r12, qword [rsp + 0xd8]
mov r8, qword [rsp + 0x58]
shr r8, 1
lea rcx, [rsp + 0x480]
mov rdx, qword [rsp + 0x70]
call fcn.18001f3e0
mov rdi, qword [rsp + 0x480]
test rdi, rdi
je 0x18012d881
lea rax, [rsp + 0x488]
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x1e0], xmm0
jmp 0x18012d88e
movaps xmmword [rsp + 0x1e0], xmm6
mov edi, 1
lea r15, [rsp + 0xa0]
movaps xmm0, xmmword [rsp + 0x1e0]
movaps xmmword [rsp + 0x480], xmm0
mov rdx, qword [rsp + 0x50]
cmp rdx, qword [rsp + 0x148]
jne 0x18012d8d2
lea rcx, [rsp + 0x140]
call fcn.1801654b0
mov rbx, qword [rsp + 0x140]
mov rdx, qword [rsp + 0x150]
lea rax, [rdx + rdx*4]
shl rax, 4
mov qword [rbx + rax], rbp
mov rcx, qword [rsp + 0x60]
mov qword [rbx + rax + 8], rcx
mov qword [rbx + rax + 0x10], r13
mov qword [rbx + rax + 0x18], rdi
movaps xmm0, xmmword [rsp + 0x480]
movups xmmword [rbx + rax + 0x20], xmm0
mov qword [rbx + rax + 0x30], 8
inc rdx
movups xmmword [rbx + rax + 0x38], xmm6
mov dword [rbx + rax + 0x48], 0
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x150], rdx
mov rcx, qword [rsp + 0xa0]
test rcx, rcx
jne 0x18012d500
jmp 0x18012d505
lea rsi, [rsp + 0x480]
lea rdi, [rsp + 0x140]
mov rbx, qword [sym.imp.KERNEL32.dll_HeapFree]
nop word cs:[rax + rax]
mov rcx, rsi
mov rdx, rdi
call fcn.180129a70
mov r8, qword [rsp + 0x480]
test r8, r8
je 0x18012d990
cmp qword [rsp + 0x488], 0
je 0x18012d960
mov rcx, qword [0x180246f98]
xor edx, edx
call rbx
jmp 0x18012d960
mov rcx, qword [rsp + 0x140]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
mov rsi, qword [rsp + 0x60]
movzx eax, word [rsi + 8]
cmp al, 2
je 0x18012c7c2
movzx ecx, byte [rsi + 0xa]
shl ecx, 0x10
or eax, ecx
mov word [rsp + 0x78], ax
shr eax, 0x10
mov byte [rsp + 0x7a], al
movzx eax, byte [0x180247060]
mov rcx, qword [0x180246f98]
test rcx, rcx
jne 0x18012d9ef
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x18012e5f9
mov rcx, rax
mov qword [0x180246f98], rax
mov r13d, 0x80000
mov r8d, 0x80000
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x18012e5f9
mov rsi, rax
lea r15, [rsp + 0x2f8]
mov qword [rsp + 0x100], rax
mov qword [rsp + 0x108], 0x80000
mov qword [rsp + 0x110], 0
xor edx, edx
lea rdi, [rsp + 0x100]
lea r14, [rsp + 0x480]
mov r12, qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
mov ebx, 0x80000
mov dword [rsp + 0x480], 0
sub r13, rdx
cmp r13, rbx
jae 0x18012dac0
jmp 0x18012daa9
mov eax, dword [rsp + 0x480]
add rbx, rbx
lea ecx, [rax + 0x2800]
test eax, eax
cmovne rbx, rcx
mov r13, qword [rsp + 0x108]
mov rdx, qword [rsp + 0x110]
mov dword [rsp + 0x480], 0
sub r13, rdx
cmp r13, rbx
jae 0x18012dac0
mov rcx, rdi
mov r8, rbx
call fcn.18019b9e0
mov rsi, qword [rsp + 0x100]
nop dword [rax]
mov ecx, 5
mov rdx, rsi
mov r8d, ebx
mov r9, r14
call r12
cmp eax, 0xc0000004
je 0x18012da70
test eax, eax
jne 0x18012dba2
mov qword [rsp + 0x110], rbx
movzx eax, byte [0x180247060]
mov rcx, qword [0x180246f98]
test rcx, rcx
jne 0x18012db14
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
test rax, rax
je 0x18012e639
mov rcx, rax
mov qword [0x180246f98], rax
mov r8d, 0xfa0
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
test rax, rax
je 0x18012e639
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], 0x1f4
mov qword [rsp + 0xb0], 0
xor edx, edx
lea rdi, [rsp + 0xa0]
xor ebx, ebx
jmp 0x18012db7a
mov qword [rax + rdx*8], r14
inc rdx
mov qword [rsp + 0xb0], rdx
mov ecx, dword [r14]
add rbx, rcx
test rcx, rcx
je 0x18012dbc2
lea r14, [rsi + rbx]
cmp rdx, qword [rsp + 0xa8]
jne 0x18012db60
mov rcx, rdi
call fcn.1801122f0
mov rax, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0xb0]
jmp 0x18012db60
cmp qword [rsp + 0x108], 0
je 0x18012e45b
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, rsi
jmp 0x18012e455
mov qword [rsp + 0x88], r15
cmp byte [rsp + 0x78], 0
je 0x18012dbea
lea rcx, [rsp + 0x3c8]
xor edx, edx
call fcn.180131370
mov rax, qword [rsp + 0x448]
jmp 0x18012dbec
xor eax, eax
mov qword [rsp + 0x80], rax
mov qword [rsp + 0x480], 0
mov rax, qword [0x180246030]
lea rcx, [rsp + 0x480]
call rax
mov rax, qword [rsp + 0x480]
movabs rcx, 0x19db1ded53e8000
cmp rax, rcx
jl 0x18012dc48
movabs rcx, 0xfe624e212ac18000
add rax, rcx
movabs rcx, 0xd6bf94d5e57a42bd
mul rcx
shr rdx, 0x17
jmp 0x18012dc4a
xor edx, edx
mov qword [rsp + 0x90], rdx
mov rsi, qword [rsp + 0xb0]
mov qword [rsp + 0x490], rsi
movdqu xmm0, xmmword [rsp + 0xa0]
movdqa xmmword [rsp + 0x480], xmm0
mov qword [rsp + 0x140], 8
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x148], xmm0
lea rax, [rsp + 0x88]
mov qword [rsp + 0x498], rax
lea rax, [rsp + 0x78]
mov qword [rsp + 0x4a0], rax
lea rax, [rsp + 0x80]
mov qword [rsp + 0x4a8], rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x4b0], rax
mov rbx, qword [rsp + 0x488]
cmp rbx, rsi
jb 0x18012e664
lea r14, [rsp + 0x498]
mov rdi, qword [rsp + 0x480]
mov eax, dword [0x180247064]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rax, qword [rax + 0x50]
test rax, rax
je 0x18012dd12
add rax, 0x110
jmp 0x18012dd17
call fcn.180082200
mov rax, qword [rax]
mov r9, qword [rax + 0x1f0]
xor eax, eax
cmp rsi, 0xffffffffffffffff
sete al
cmp rax, r9
cmova r9, rax
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], 1
lea rcx, [rsp + 0x1e0]
mov rdx, rsi
xor r8d, r8d
call fcn.180131e90
test rbx, rbx
je 0x18012dd73
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, rdi
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rdi, qword [rsp + 0x1e0]
mov rax, qword [rsp + 0x1f0]
test rax, rax
je 0x18012ddbb
test rdi, rdi
je 0x18012de97
xor r8d, r8d
mov rcx, rdi
nop word [rax + rax]
add r8, qword [rcx + 0x10]
dec rax
je 0x18012ddb2
mov rcx, qword [rcx + 0x18]
test rcx, rcx
jne 0x18012dda0
test r8, r8
jne 0x18012e519
test rdi, rdi
je 0x18012de97
mov r12, qword [sym.imp.KERNEL32.dll_HeapFree]
lea rbx, [rsp + 0x140]
jmp 0x18012ddec
mov rdi, rsi
test rsi, rsi
je 0x18012de97
mov rsi, qword [rdi + 0x18]
test rsi, rsi
je 0x18012ddfd
mov qword [rsi + 0x20], 0
mov r14, qword [rdi]
mov r13, qword [rdi + 8]
mov r15, qword [rdi + 0x10]
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, rdi
call r12
test r14, r14
je 0x18012de92
mov rax, qword [rsp + 0x148]
mov rdi, qword [rsp + 0x150]
sub rax, rdi
cmp rax, r15
jb 0x18012de7a
imul rcx, rdi, 0x150
add rcx, qword [rsp + 0x140]
imul r8, r15, 0x150
mov rdx, r14
call fcn.180199330
add rdi, r15
mov qword [rsp + 0x150], rdi
test r13, r13
je 0x18012dde0
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, r14
call r12
jmp 0x18012dde0
mov rcx, rbx
mov rdx, rdi
mov r8, r15
call fcn.1801a4040
mov rdi, qword [rsp + 0x150]
jmp 0x18012de34
test rsi, rsi
jne 0x18012df07
mov rbx, qword [rsp + 0x140]
mov rax, qword [rsp + 0x148]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0x150]
imul rcx, rax, 0x150
add rcx, rbx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rbx
test rax, rax
je 0x18012e27d
lea r15, [rsp + 0x1e0]
lea r14, [rsp + 0x140]
pcmpeqd xmm6, xmm6
mov rbx, qword [rsp + 0x58]
jmp 0x18012dffb
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, rsi
call r12
mov rsi, r14
test r14, r14
je 0x18012de97
mov r14, qword [rsi + 0x18]
test r14, r14
je 0x18012df18
mov qword [r14 + 0x20], 0
mov rdi, qword [rsi]
mov r15, qword [rsi + 0x10]
test r15, r15
je 0x18012df44
mov rbx, rdi
nop word [rax + rax]
mov rcx, rbx
call fcn.180133ea0
add rbx, 0x150
dec r15
jne 0x18012df30
cmp qword [rsi + 8], 0
je 0x18012def0
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, rdi
call r12
jmp 0x18012def0
movzx edx, r12b
sub qword [rsp + 0x308], rdx
lea rdx, [rcx - 0x10]
and rdx, rax
mov byte [rdi + rcx], r14b
mov byte [rdx + rdi + 0x10], r14b
inc qword [rsp + 0x310]
mov rdi, qword [rsp + 0x2f8]
neg rcx
imul r14, rcx, 0x158
mov qword [rdi + r14 - 0x158], r13
mov qword [rdi + r14 - 0x150], rbp
lea rcx, [rdi + r14]
add rcx, 0xfffffffffffffeb8
mov r8d, 0xb8
mov r15, rsi
mov rdx, rsi
call fcn.180199330
mov qword [rdi + r14 - 0x90], r13
lea rcx, [rdi + r14]
add rcx, 0xffffffffffffff78
mov r8d, 0x88
lea r14, [rsp + 0x140]
mov rdx, r14
call fcn.180199330
nop word [rax + rax]
cmp rbx, qword [rsp + 0x50]
je 0x18012e2c4
mov rdx, rbx
add rbx, 0x150
mov rbp, qword [rdx]
cmp rbp, 2
je 0x18012e27d
lea rdi, [rdx + 0xc8]
mov r13, qword [rdx + 0xc0]
add rdx, 8
mov r8d, 0xb8
mov rsi, r15
mov rcx, r15
call fcn.180199330
mov r8d, 0x88
mov rcx, r14
mov rdx, rdi
call fcn.180199330
mov rcx, qword [rsp + 0x318]
mov rdx, qword [rsp + 0x320]
mov r8, r13
call fcn.180134030
mov r15, rax
mov rdi, qword [rsp + 0x2f8]
mov rax, qword [rsp + 0x300]
mov r14, r15
shr r14, 0x39
movd xmm0, r14d
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
lea rcx, [rdi - 0x158]
xor edx, edx
mov r8, r15
and r8, rax
movdqu xmm1, xmmword [rdi + r8]
movdqa xmm2, xmm0
pcmpeqb xmm2, xmm1
pmovmskb r9d, xmm2
nop dword [rax]
test r9w, r9w
je 0x18012e0e0
lea r10d, [r9 - 1]
and r10d, r9d
tzcnt r9d, r9d
add r9, r8
and r9, rax
neg r9
imul r12, r9, 0x158
mov r9d, r10d
cmp qword [rcx + r12], r13
jne 0x18012e0b0
jmp 0x18012e100
pcmpeqb xmm1, xmm6
pmovmskb r9d, xmm1
test r9d, r9d
jne 0x18012e18c
add r8, rdx
add r8, 0x10
add rdx, 0x10
jmp 0x18012e097
lea rdx, [rdi + r12]
add rdx, 0xfffffffffffffeb0
mov r8d, 0x150
lea rcx, [rsp + 0x480]
call fcn.180199330
mov qword [rdi + r12 - 0x150], rbp
lea rcx, [rdi + r12]
add rcx, 0xfffffffffffffeb8
mov r8d, 0xb8
mov r15, rsi
mov rdx, rsi
call fcn.180199330
mov qword [rdi + r12 - 0x90], r13
lea rcx, [rdi + r12]
add rcx, 0xffffffffffffff78
mov r8d, 0x88
lea r14, [rsp + 0x140]
mov rdx, r14
call fcn.180199330
cmp qword [rsp + 0x480], 2
je 0x18012dff0
lea rcx, [rsp + 0x480]
call fcn.180133ea0
jmp 0x18012dff0
mov rdx, rax
and rdx, r15
movdqu xmm0, xmmword [rdi + rdx]
pmovmskb ecx, xmm0
test ecx, ecx
jne 0x18012e1c7
mov r8d, 0x10
nop word cs:[rax + rax]
add rdx, r8
and rdx, rax
movdqu xmm0, xmmword [rdi + rdx]
pmovmskb ecx, xmm0
add r8, 0x10
test ecx, ecx
je 0x18012e1b0
tzcnt ecx, ecx
add rcx, rdx
and rcx, rax
movzx r12d, byte [rdi + rcx]
test r12b, r12b
js 0x18012e1ec
movdqa xmm0, xmmword [rdi]
pmovmskb ecx, xmm0
tzcnt ecx, ecx
movzx r12d, byte [rdi + rcx]
and r12b, 1
je 0x18012df5c
cmp qword [rsp + 0x308], 0
jne 0x18012df5c
lea rcx, [rsp + 0x2f8]
lea rdx, [rsp + 0x318]
call fcn.1801a4110
mov rdi, qword [rsp + 0x2f8]
mov rax, qword [rsp + 0x300]
and r15, rax
movdqu xmm0, xmmword [rdi + r15]
pmovmskb ecx, xmm0
test ecx, ecx
jne 0x18012e258
mov edx, 0x10
add r15, rdx
and r15, rax
movdqu xmm0, xmmword [rdi + r15]
pmovmskb ecx, xmm0
add rdx, 0x10
test ecx, ecx
je 0x18012e240
tzcnt ecx, ecx
add rcx, r15
and rcx, rax
cmp byte [rdi + rcx], 0
js 0x18012df5c
movdqa xmm0, xmmword [rdi]
pmovmskb ecx, xmm0
tzcnt ecx, ecx
jmp 0x18012df5c
mov r8, qword [rsp + 0x50]
mov rax, r8
sub rax, rbx
shr rax, 4
movabs rcx, 0xc30c30c30c30c31
mul rcx
cmp r8, rbx
je 0x18012e2c4
mov rdi, rdx
nop word cs:[rax + rax]
mov rcx, rbx
call fcn.180133ea0
add rbx, 0x150
dec rdi
jne 0x18012e2b0
cmp qword [rsp + 0x70], 0
je 0x18012e2e0
mov rcx, qword [0x180246f98]
xor edx, edx
mov r8, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [rsp + 0x310]
test rsi, rsi
je 0x18012e439
mov rdi, qword [rsp + 0x2f8]
mov rbx, qword [rsp + 0x300]
lea r14, [rdi + 0x10]
movdqa xmm0, xmmword [rdi]
pmovmskb eax, xmm0
not eax
mov r15, qword [rsp + 0x308]
pcmpeqd xmm6, xmm6
mov r13, rsi
mov rbp, rdi
jmp 0x18012e360
lea rcx, [rax + rbp]
add rcx, 0xfffffffffffffeb0
mov byte [rdi + rdx], r9b
mov byte [r8 + rdi + 0x10], r9b
dec rsi
mov qword [rsp + 0x310], rsi
call fcn.180133ea0
mov eax, r12d
test r13, r13
je 0x18012e439
test ax, ax
je 0x18012e370
lea r12d, [rax - 1]
and r12d, eax
jmp 0x18012e399
movdqa xmm0, xmmword [r14]
pmovmskb eax, xmm0
add rbp, 0xffffffffffffea80
add r14, 0x10
cmp ax, 0xffff
je 0x18012e370
mov ecx, 0xfffffffe
sub ecx, eax
not eax
mov r12d, eax
and r12d, ecx
tzcnt eax, eax
neg rax
imul rax, rax, 0x158
dec r13
cmp byte [rbp + rax - 4], 0
mov byte [rbp + rax - 4], 0
jne 0x18012e354
mov rdx, rdi
sub rdx, rbp
sub rdx, rax
sar rdx, 3
movabs rcx, 0x82fa0be82fa0be83
imul rdx, rcx
lea r8, [rdx - 0x10]
and r8, rbx
movdqu xmm0, xmmword [rdi + r8]
pcmpeqb xmm0, xmm6
psllw xmm0, 7
pmovmskb ecx, xmm0
test ecx, ecx
je 0x18012e3f8
bsr cx, cx
xor ecx, 0xf
jmp 0x18012e3fc
mov cx, 0x10
movdqu xmm0, xmmword [rdi + rdx]
pcmpeqb xmm0, xmm6
pmovmskb r9d, xmm0
or r9d, 0x10000
tzcnt r9d, r9d
add ecx, r9d
mov r9b, 0x80
cmp cx, 0xf
ja 0x18012e330
inc r15
mov qword [rsp + 0x308], r15
mov r9b, 0xff
jmp 0x18012e330
cmp qword [rsp + 0x108], 0
je 0x18012e45b
mov r8, qword [rsp + 0x100]
mov rcx, qword [0x180246f98]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapFree]
mov rsi, qword [rsp + 0x60]
cmp byte [rsi + 2], 0
jne 0x18012c7cc
cmp byte [rsi + 3], 0
je 0x18012ca35
mov rax, qword [rsp + 0x3a8]
test rax, rax
je 0x18012ca35
mov rdi, qword [rsp + 0x398]
shl rax, 4
lea rbx, [rax + rax*8]
xor r14d, r14d
lea rsi, [rsp + 0x480]
jmp 0x18012e4c0
add r14, 0x90
cmp rbx, r14
je 0x18012ca35
cmp qword [rdi + r14 + 0x78], 0
je 0x18012e4b0
mov qword [rsp + 0x480], 0
mov rcx, qword [rdi + r14 + 0x48]
xor edx, edx
xor r8d, r8d
mov r9, rsi
call sub.KERNEL32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x18012e4b0
mov rax, qword [rsp + 0x480]
mov qword [rdi + r14 + 0x80], rax
jmp 0x18012e4b0
lea rcx, [rsp + 0x1e0]
xor edx, edx
call fcn.1801a39e0
test rbx, rbx
jne 0x18012c8f4
jmp 0x18012c9d0
lea rcx, [rsp + 0x140]
xor edx, edx
call fcn.1801a4040
test rdi, rdi
jne 0x18012ddc4
jmp 0x18012de97
lea rcx, str.key_used_disappeared
lea r8, [0x18020c690]
mov edx, 0x14
call fcn.18019b120
ud2
mov ecx, 2
mov edx, 0x14
call fcn.18019a870
ud2
mov ecx, 1
mov rdx, qword [rsp + 0x60]
call fcn.18019a870
ud2
mov ecx, 0x56410
call fcn.180054480
ud2
mov ecx, 1
mov edx, 9
call fcn.18019a870
ud2
mov ecx, 8
mov edx, 0x120
call fcn.18019a870
ud2
lea rax, str.Expected_SID_revision_to_be_1
mov qword [rsp + 0x480], rax
mov qword [rsp + 0x488], 1
lea rax, [0x180234e18]
mov qword [rsp + 0x490], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x498], xmm0
lea rdx, [rsp + 0x480]
mov rcx, r12
call fcn.1801a3970
ud2
lea r8, str.C:UsersDadoodze.cargo_registry_srcindex.crates.io_6f17d22bba15001f_sysinfo_0.29.11_srcwindows_sid.rs
xor ecx, ecx
xor edx, edx
call fcn.18019ac00
ud2
mov ecx, 1
mov edx, 0x80000
call fcn.18019a870
ud2
lea rax, str.C:UsersDadoodze.cargo_registry_srcindex.crates.io_6f17d22bba15001f_sysinfo_0.29.11_srcwindows_network.rs
mov edx, 0x101
mov rcx, r8
mov r8, rax
call fcn.18019ad00
ud2
mov ecx, 2
mov rdx, rbx
call fcn.18019a870
ud2
mov ecx, 2
jmp 0x18012e683
mov ecx, 8
mov edx, 0xfa0
call fcn.18019a870
ud2
lea rcx, str.global_key_idle_disappearedC:UsersDadoodze.cargo_registry_srcindex.crates.io_6f17d22bba15001f_sysinfo_0.29.11_srcwindows_system.rs
lea r8, [0x18020c660]
mov edx, 0x1b
call fcn.18019b120
ud2
lea rcx, str.assertion_failed:_vec.capacity_____start___lenC:UsersDadoodze.cargo_registry_srcindex.crates.io_6f17d22bba15001f_rayon_1.7.0_src_vec.rs
lea r8, [0x18020bee0]
mov edx, 0x2f
call fcn.18019ad80
ud2
mov ecx, 8
mov rdx, r12
call fcn.18019a870
ud2
mov ecx, 1
mov edx, 0x32
call fcn.18019a870
ud2
mov ecx, 1
mov edx, 0x1e
call fcn.18019a870
ud2
mov ecx, 1
mov edx, 5
call fcn.18019a870
ud2
mov ecx, 1
mov edx, 8
call fcn.18019a870
ud2
mov ecx, 8
mov edx, 0x60
call fcn.18019a870
ud2