Function at 0x1400bdf29
Capabilities:
Check os version
Get disk information
Get disk size
Get local ipv4 addresses
Get logon sessions
Get memory capacity
List groups for user account
List user accounts

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x968
movdqa xmmword [rsp + 0x950], xmm8
movdqa xmmword [rsp + 0x940], xmm7
movdqa xmmword [rsp + 0x930], xmm6
mov rdi, rdx
mov qword [rsp + 0x368], rcx
mov eax, dword [0x140152a74]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0x130], 0
jne 0x1400bdf85
call fcn.140051877
mov eax, dword [0x140152a74]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rbx, qword [rax + 0x138]
mov r12, qword [rax + 0x140]
lea rcx, [rbx + 1]
mov qword [rax + 0x138], rcx
mov al, byte [0x140152a70]
mov ecx, 0x54410
mov edx, 0x10
call fcn.140041bf0
test rax, rax
je 0x1400c0b6c
mov r14, rax
add r14, 0x54000
mov r8d, 0x410
mov rcx, r14
mov dl, 0xff
call sub.VCRUNTIME140.dll_memset
mov ecx, 9
call fcn.14008bd36
mov r15, rax
mov r13, rdx
movabs rax, 0x5043206c61746f54
mov qword [r15], rax
mov byte [r15 + 8], 0x55
mov al, byte [0x140152a70]
mov ecx, 0x120
mov edx, 8
call fcn.140041bf0
test rax, rax
je 0x1400c0b78
mov rsi, rax
mov qword [rsp + 0x58], rdi
mov eax, dword [0x140152a74]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0x130], 0
jne 0x1400be053
call fcn.140051877
mov eax, dword [0x140152a74]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rbp, qword [rax + 0x138]
mov rcx, qword [rax + 0x140]
mov qword [rsp + 0x48], rcx
lea rcx, [rbp + 1]
mov qword [rax + 0x138], rcx
lea rdi, [rsp + 0x3e0]
mov qword [rdi], 0
mov rax, qword [0x140150050]
mov rcx, rdi
call rax
mov rax, qword [rdi]
movabs rcx, 0x19db1ded53e8000
cmp rax, rcx
jl 0x1400be0f7
movabs rcx, 0xfe624e212ac18000
add rax, rcx
movabs rcx, 0xd6bf94d5e57a42bd
mul rcx
mov rdi, rdx
shr rdi, 0x17
call sub.kernel32.dll_GetTickCount64
shr rax, 3
movabs rcx, 0x20c49ba5e353f7cf
mul rcx
shr rdx, 4
xor eax, eax
sub rdi, rdx
cmovae rax, rdi
jmp 0x1400be0f9
xor eax, eax
pxor xmm6, xmm6
movdqu xmmword [rsp + 0x2a8], xmm6
mov qword [rsp + 0x1e8], r14
mov qword [rsp + 0x1f0], 0x3ff
mov qword [rsp + 0x1f8], 0x380
xor ecx, ecx
mov qword [rsp + 0x200], rcx
mov qword [rsp + 0x208], rbx
mov qword [rsp + 0x210], r12
movdqu xmmword [rsp + 0x248], xmm6
movdqu xmmword [rsp + 0x258], xmm6
mov qword [rsp + 0x2b8], r15
mov qword [rsp + 0x2c0], r13
mov qword [rsp + 0x2c8], 9
mov edx, 1
mov qword [rsp + 0x2d0], rdx
movdqu xmmword [rsp + 0x2d8], xmm6
mov qword [rsp + 0x2e8], rdx
movdqu xmmword [rsp + 0x2f0], xmm6
mov qword [rsp + 0x300], rcx
mov qword [rsp + 0x318], rcx
mov dword [rsp + 0x320], 0
mov edx, 8
mov qword [rsp + 0x328], rdx
movdqu xmmword [rsp + 0x330], xmm6
mov byte [rsp + 0x340], 0
mov qword [rsp + 0x270], rdx
movdqu xmmword [rsp + 0x278], xmm6
mov qword [rsp + 0x288], rsi
mov qword [rsp + 0x290], 2
mov qword [rsp + 0x298], rcx
mov qword [rsp + 0x1a8], rcx
lea rdi, [0x14013f8f0]
mov qword [rsp + 0x218], rdi
movdqu xmmword [rsp + 0x220], xmm6
mov qword [rsp + 0x230], rcx
mov qword [rsp + 0x238], rbp
mov rcx, qword [rsp + 0x48]
mov qword [rsp + 0x240], rcx
mov qword [rsp + 0x268], rax
mov qword [rsp + 0x2a0], rdx
mov r15, qword [rsp + 0x58]
cmp byte [r15 + 4], 0
je 0x1400be32a
lea rsi, [rsp + 0xa0]
movdqa xmmword [rsi], xmm6
movdqa xmmword [rsi + 0x30], xmm6
movdqa xmmword [rsi + 0x20], xmm6
movdqa xmmword [rsi + 0x10], xmm6
mov dword [rsi], 0x40
mov rcx, rsi
call sub.kernel32.dll_GlobalMemoryStatusEx
movdqu xmm0, xmmword [rsi + 8]
movdqu xmmword [rsp + 0x248], xmm0
lea rcx, [rsp + 0x3e0]
movdqa xmmword [rcx + 0x50], xmm6
movdqa xmmword [rcx + 0x40], xmm6
movdqa xmmword [rcx + 0x30], xmm6
movdqa xmmword [rcx + 0x20], xmm6
movdqa xmmword [rcx + 0x10], xmm6
movdqa xmmword [rcx], xmm6
mov qword [rcx + 0x60], 0
mov edx, 0x68
call sub.psapi.dll_GetPerformanceInfo
cmp eax, 1
jne 0x1400be32a
mov r8, qword [rsp + 0x3f0]
mov r9, qword [rsp + 0x400]
xor r10d, r10d
sub r8, r9
cmovb r8, r10
mov rcx, qword [rsp + 0x430]
mov rax, rcx
mul r8
mov r8, rax
mov r11, 0xffffffffffffffff
cmovo r8, r11
mov rsi, qword [rsp + 0x3e8]
sub rsi, r9
cmovb rsi, r10
mov rax, rcx
mul rsi
cmovo rax, r11
mov qword [rsp + 0x258], r8
mov qword [rsp + 0x260], rax
cmp byte [r15 + 0xb], 2
je 0x1400be8ba
lea rsi, [rsp + 0x2b8]
mov r13b, byte [r15 + 0xc]
cmp qword [rsi - 0x110], 0
jne 0x1400be777
lea r8, [rsp + 0x3e0]
mov qword [r8], 0
xor ecx, ecx
xor edx, edx
call sub.pdh.dll_PdhOpenQueryA
mov ebp, eax
test eax, eax
mov byte [rsp + 0x48], r13b
je 0x1400be379
xor edi, edi
jmp 0x1400be53a
mov r14, qword [rsp + 0x3e0]
mov eax, dword [0x140152a74]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0x130], 0
jne 0x1400be3a3
call fcn.140051877
mov eax, dword [0x140152a74]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rbx, qword [rax + 0x138]
mov rdx, qword [rax + 0x140]
lea rcx, [rbx + 1]
mov qword [rax + 0x138], rcx
pxor xmm0, xmm0
movdqa xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], 0
mov rax, qword [rsp + 0x1a8]
test rax, rax
je 0x1400be53a
mov qword [rsp + 0x50], rdx
mov r12, qword [rsp + 0x1b0]
mov r15, qword [rsp + 0x1c0]
lea rdx, [r12 + rax]
inc rdx
movdqa xmm0, xmmword [rax]
pmovmskb r8d, xmm0
not r8d
lea rcx, [rsp + 0x3e0]
mov qword [rcx], rax
add rax, 0x10
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rdx
mov word [rcx + 0x18], r8w
mov qword [rcx + 0x20], r15
call fcn.1400bbaee
test rax, rax
je 0x1400be468
lea rsi, [rsp + 0x3e0]
mov rcx, qword [rdx]
call sub.pdh.dll_PdhRemoveCounter
mov rcx, rsi
call fcn.1400bbaee
test rax, rax
jne 0x1400be453
mov rcx, qword [rsp + 0x1e0]
test rcx, rcx
je 0x1400be47b
call qword [sym.imp.kernel32.dll_CloseHandle]
mov rcx, qword [rsp + 0x1d8]
test rcx, rcx
je 0x1400be48d
call sub.pdh.dll_PdhCloseQuery
test r12, r12
je 0x1400be535
mov qword [rsp + 0x98], rbx
test r15, r15
je 0x1400be518
mov rsi, qword [rsp + 0x1a8]
movdqa xmm0, xmmword [rsi]
pmovmskb eax, xmm0
not eax
lea r13, [rsi + 0x10]
mov r12, qword [sym.imp.kernel32.dll_HeapFree]
test ax, ax
jne 0x1400be4e2
movdqa xmm0, xmmword [r13]
pmovmskb eax, xmm0
add rsi, 0xfffffffffffffe00
add r13, 0x10
cmp ax, 0xffff
je 0x1400be4c5
not eax
bsf edx, eax
shl rdx, 5
mov rcx, rsi
sub rcx, rdx
dec r15
lea ebx, [rax - 1]
and ebx, eax
cmp qword [rcx - 0x18], 0
je 0x1400be511
add rcx, 0xffffffffffffffe0
mov r8, qword [rcx]
mov rcx, qword [0x1401529c8]
xor edx, edx
call r12
mov eax, ebx
test r15, r15
jne 0x1400be4c0
mov rcx, qword [rsp + 0x1a8]
mov rdx, qword [rsp + 0x1b0]
call fcn.1400bbac3
mov rbx, qword [rsp + 0x98]
mov rdx, qword [rsp + 0x50]
mov qword [rsp + 0x1a8], rdi
movdqa xmm0, xmmword [rsp + 0xa0]
movdqu xmmword [rsp + 0x1b0], xmm0
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x1c0], rax
mov qword [rsp + 0x1c8], rbx
mov qword [rsp + 0x1d0], rdx
mov qword [rsp + 0x1d8], r14
mov qword [rsp + 0x1e0], 0
test ebp, ebp
jne 0x1400be756
mov bpl, byte [rsp + 0x48]
and bpl, 1
mov ecx, 0x23
call fcn.14008bd36
movups xmm0, xmmword [str.Processor__Total___Processor_TimeProcessor____Processor_Time_v]
movups xmmword [rax], xmm0
movdqu xmm0, xmmword [0x14013b6f8]
movdqu xmmword [rax + 0x10], xmm0
mov dword [rax + 0x1f], 0x656d6954
lea rsi, [rsp + 0xa0]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], 0x23
lea rdi, [rsp + 0x300]
mov ecx, 5
call fcn.14008bd36
mov dword [rax], 0x5f746f74
mov byte [rax + 4], 0x30
lea r9, [rsp + 0x3e0]
mov qword [r9], rax
mov qword [r9 + 8], rdx
mov qword [r9 + 0x10], 5
lea rdx, [rsp + 0x1a8]
mov rcx, rsi
mov r8, rdi
call fcn.1400bd885
lea rcx, [rsp + 0x2b8]
mov edx, ebp
call fcn.1400bc7e0
mov rax, qword [rdi + 0x38]
test rax, rax
je 0x1400be756
lea rcx, [rsp + 0x1a8]
mov r12, qword [rcx + 0x180]
add r12, 0x48
imul rdi, rax, 0x70
xor r15d, r15d
mov ebp, 2
mov ebx, 1
mov qword [rsp + 0x140], r15
inc r15
lea rax, [rsp + 0x140]
mov qword [rsp + 0xa0], rax
lea rax, [fcn.1400499d0]
mov qword [rsp + 0xa8], rax
lea rax, [0x14013b728]
mov qword [rsp + 0x3e0], rax
mov qword [rsp + 0x3e8], rbp
xor r14d, r14d
mov qword [rsp + 0x400], r14
mov qword [rsp + 0x3f0], rsi
mov qword [rsp + 0x3f8], rbx
lea rcx, [rsp + 0x60]
lea r13, [rsp + 0x3e0]
mov rdx, r13
call fcn.1400424d0
lea rax, [rsp + 0x140]
mov qword [rsp + 0xf0], rax
lea rax, [fcn.1400499d0]
mov qword [rsp + 0xf8], rax
lea rax, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001fwidestring_0.4.3_srcucstr.rs
mov qword [rsp + 0x3e0], rax
mov qword [rsp + 0x3e8], rbp
mov qword [rsp + 0x400], r14
lea rax, [rsp + 0xf0]
mov qword [rsp + 0x3f0], rax
mov qword [rsp + 0x3f8], rbx
mov rcx, rsi
mov rdx, r13
call fcn.1400424d0
lea rcx, [rsp + 0x60]
lea rdx, [rsp + 0x1a8]
mov r8, r12
mov r9, rsi
call fcn.1400bd885
add r12, 0x70
add rdi, 0xffffffffffffff90
jne 0x1400be65e
cmp qword [rsp + 0x1a8], 0
mov r15, qword [rsp + 0x58]
mov r13b, byte [rsp + 0x48]
lea rsi, [rsp + 0x2b8]
je 0x1400be8ba
mov rcx, qword [rsp + 0x1d8]
call sub.pdh.dll_PdhCollectQueryData
mov rdx, qword [rsp + 0x300]
test rdx, rdx
je 0x1400be7b6
lea rcx, [rsp + 0x1a8]
mov r8, qword [rcx + 0x168]
call fcn.1400bddd7
test eax, eax
je 0x1400c0b9d
movd dword [rsp + 0x320], xmm0
mov edx, r13d
and dl, 1
mov rcx, rsi
call fcn.1400bc7e0
mov rax, qword [rsp + 0x338]
test rax, rax
je 0x1400be816
lea rsi, [rsp + 0x1a8]
mov rdi, qword [rsi + 0x180]
imul rbx, rax, 0x70
xor r14d, r14d
mov rdx, qword [rdi + r14 + 0x48]
test rdx, rdx
je 0x1400be80d
mov r8, qword [rdi + r14 + 0x58]
mov rcx, rsi
call fcn.1400bddd7
test eax, eax
je 0x1400c0b46
movd dword [rdi + r14 + 0x68], xmm0
add r14, 0x70
cmp rbx, r14
jne 0x1400be7e7
test r13b, 1
je 0x1400be8ba
cmp byte [rsp + 0x340], 0
jne 0x1400be8ba
mov rsi, qword [rsp + 0x338]
lea rdi, [rsp + 0x3e0]
mov rcx, rdi
mov rdx, rsi
call fcn.1400bd063
mov r8, qword [rdi]
mov rax, qword [rdi + 8]
test rsi, rsi
je 0x1400be89e
mov rdx, qword [rsp + 0x3f0]
test rdx, rdx
je 0x1400be89e
mov rcx, qword [rsp + 0x328]
lea rdx, [rdx*8 - 8]
imul r9, rsi, 0x70
add r9, 0xffffffffffffff90
xor r10d, r10d
xor r11d, r11d
mov rsi, qword [r8 + r11]
mov qword [rcx + r10 + 0x60], rsi
cmp r9, r10
je 0x1400be89e
lea rsi, [r11 + 8]
add r10, 0x70
cmp rdx, r11
mov r11, rsi
jne 0x1400be880
test rax, rax
je 0x1400be8b2
mov rcx, qword [0x1401529c8]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov byte [rsp + 0x340], 1
cmp byte [r15 + 6], 0
je 0x1400bf04b
xor esi, esi
xor ecx, ecx
xor edx, edx
call sub.ole32.dll_CoInitializeEx
cmp eax, 2
lea rdx, [rsp + 0x3e0]
mov qword [rdx], rsi
mov qword [rdx + 0x10], rsi
mov qword [rdx + 0x20], rsi
setb byte [rdx + 0x30]
lea rsi, [rsp + 0xa0]
mov rcx, rsi
call fcn.1400bd337
cmp dword [rsi], 2
je 0x1400beaec
mov rax, qword [rsp + 0xd0]
lea rdx, [rsp + 0x3e0]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0xa0]
movdqu xmm1, xmmword [rsp + 0xb0]
movdqu xmm2, xmmword [rsp + 0xc0]
movdqa xmmword [rdx + 0x20], xmm2
movdqa xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0x60]
mov rcx, rsi
call fcn.1400bd3af
cmp qword [rsi], 2
je 0x1400beaec
mov rax, qword [rsp + 0x90]
lea rdx, [rsp + 0x3e0]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x60]
movdqu xmm1, xmmword [rsp + 0x70]
movdqu xmm2, xmmword [rsp + 0x80]
movdqa xmmword [rdx + 0x20], xmm2
movdqa xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0xf0]
mov rcx, rsi
call fcn.1400bd451
cmp qword [rsi], 2
je 0x1400beaec
mov rax, qword [rsp + 0x120]
lea rdx, [rsp + 0x3e0]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0xf0]
movdqu xmm1, xmmword [rsp + 0x100]
movdqu xmm2, xmmword [rsp + 0x110]
movdqa xmmword [rdx + 0x20], xmm2
movdqa xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0x140]
mov rcx, rsi
call fcn.1400bd52d
cmp qword [rsi], 2
je 0x1400beaec
mov rax, qword [rsp + 0x170]
lea rdx, [rsp + 0x3e0]
mov qword [rdx + 0x30], rax
movdqu xmm0, xmmword [rsp + 0x140]
movdqu xmm1, xmmword [rsp + 0x150]
movdqu xmm2, xmmword [rsp + 0x160]
movdqa xmmword [rdx + 0x20], xmm2
movdqa xmmword [rdx + 0x10], xmm1
movdqa xmmword [rdx], xmm0
lea rsi, [rsp + 0x370]
mov rcx, rsi
call fcn.1400bd5b0
mov rax, qword [rsi]
cmp rax, 2
je 0x1400beaec
movups xmm0, xmmword [rsp + 0x378]
movups xmm1, xmmword [rsp + 0x388]
movups xmm2, xmmword [rsp + 0x398]
lea rsi, [rsp + 0x3a8]
movups xmmword [rsi + 0x28], xmm2
movups xmmword [rsi + 0x18], xmm1
movups xmmword [rsi + 8], xmm0
mov qword [rsi], rax
lea rdi, [rsp + 0xf0]
mov rcx, rdi
mov rdx, rsi
mov r8b, 1
call fcn.1400bd69e
mov rax, qword [rsi + 0x30]
mov qword [rsp + 0x410], rax
movdqu xmm0, xmmword [rsi]
movdqu xmm1, xmmword [rsi + 0x10]
movdqu xmm2, xmmword [rsi + 0x20]
movdqa xmmword [rsp + 0x400], xmm2
movdqa xmmword [rsp + 0x3f0], xmm1
movdqa xmmword [rsp + 0x3e0], xmm0
mov edi, dword [rdi + 4]
cmp edi, 2
jne 0x1400c0a25
lea rcx, [rsp + 0x3e0]
call fcn.1400bba4c
mov r14d, 8
xor edi, edi
mov rbx, qword [rsp + 0x280]
test rbx, rbx
je 0x1400beb3d
mov rsi, qword [rsp + 0x270]
mov r15, qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsi + 0x48], 0
je 0x1400beb27
mov r8, qword [rsi + 0x40]
mov rcx, qword [0x1401529c8]
xor edx, edx
call r15
cmp dword [rsi], 2
je 0x1400beb34
mov rcx, rsi
call fcn.1400bba4c
add rsi, 0x60
dec rbx
jne 0x1400beb10
cmp qword [rsp + 0x278], 0
je 0x1400beb5f
mov r8, qword [rsp + 0x270]
mov rcx, qword [0x1401529c8]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov qword [rsp + 0x270], r14
mov qword [rsp + 0x278], rdi
mov qword [rsp + 0x280], rdi
mov r13, qword [rsp + 0x58]
cmp byte [r13 + 1], 0
je 0x1400bf32e
lea rcx, [rsp + 0xf0]
mov qword [rcx], 0
call sub.iphlpapi.dll_GetIfTable2
test eax, eax
jne 0x1400c0088
mov rax, qword [rsp + 0x218]
mov rcx, qword [rsp + 0x220]
lea rdx, [rcx + rax]
inc rdx
movdqa xmm0, xmmword [rax]
pmovmskb r8d, xmm0
not r8d
mov r9, qword [rsp + 0x230]
lea rcx, [rsp + 0x3e0]
mov qword [rcx], rax
add rax, 0x10
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rdx
mov word [rcx + 0x18], r8w
mov qword [rcx + 0x20], r9
call fcn.1400bb3fd
test rax, rax
je 0x1400bec11
lea rsi, [rsp + 0x3e0]
mov byte [rdx + 0x6e], 0
mov rcx, rsi
call fcn.1400bb3fd
test rax, rax
jne 0x1400bec00
mov eax, dword [0x140152a74]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
cmp qword [rax + 0x130], 0
jne 0x1400bec33
call fcn.140051877
mov eax, dword [0x140152a74]
mov rcx, qword gs:[0x58]
mov rax, qword [rcx + rax*8]
mov rcx, qword [rax + 0x138]
mov rdx, qword [rax + 0x140]
lea r8, [rcx + 1]
mov qword [rax + 0x138], r8
lea rax, [0x14013f8f0]
mov qword [rsp + 0x3e0], rax
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x3e8], xmm0
mov qword [rsp + 0x3f8], 0
mov qword [rsp + 0x400], rcx
mov qword [rsp + 0x408], rdx
mov qword [rsp + 0x60], 8
movdqu xmmword [rsp + 0x68], xmm0
mov r12, qword [rsp + 0xf0]
mov edi, dword [r12]
test rdi, rdi
je 0x1400bfb62
add r12, 8
xor r13d, r13d
pcmpeqd xmm6, xmm6
mov qword [rsp + 0xe8], r12
mov qword [rsp + 0x50], rdi
imul rsi, r13, 0x548
cmp qword [r12 + rsi + 0x4a8], 0
jne 0x1400becf4
cmp qword [r12 + rsi + 0x4b0], 0
je 0x1400bef48
cmp dword [r12 + rsi + 0x48c], 2
je 0x1400bef48
cmp dword [r12 + rsi + 0x420], 0
je 0x1400bef48
mov al, byte [0x140152a70]
mov ecx, 0x14
mov edx, 2
call fcn.140041bf0
test rax, rax
je 0x1400c0b60
mov r14, rax
mov eax, dword [r12 + rsi + 0x10]
movzx ecx, byte [r12 + rsi + 0x14]
movzx edx, byte [r12 + rsi + 0x15]
movzx r8d, byte [r12 + rsi + 0x16]
movzx r9d, byte [r12 + rsi + 0x17]
movzx r10d, byte [r12 + rsi + 0x18]
movzx r11d, byte [r12 + rsi + 0x19]
movzx ebx, byte [r12 + rsi + 0x1a]
movzx esi, byte [r12 + rsi + 0x1b]
mov dword [r14], eax
mov word [r14 + 4], cx
mov word [r14 + 6], dx
mov word [r14 + 8], r8w
mov word [r14 + 0xa], r9w
mov word [r14 + 0xc], r10w
mov word [r14 + 0xe], r11w
mov word [r14 + 0x10], bx
mov word [r14 + 0x12], si
mov ecx, 0xa
call fcn.1400b998e
mov r15, rax
mov qword [rsp + 0x48], rdx
movups xmm0, xmmword [r14]
movups xmmword [rax], xmm0
mov eax, dword [r14 + 0x10]
mov dword [r15 + 0x10], eax
mov rcx, qword [rsp + 0x400]
mov rdx, qword [rsp + 0x408]
mov r9d, 0xa
mov r8, r15
call fcn.1400bb5f8
mov rsi, rax
mov r12, rax
shr r12, 0x39
mov rbp, qword [rsp + 0x3e0]
mov rax, qword [rsp + 0x3e8]
mov rcx, rax
and rcx, rsi
movd xmm0, r12d
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm0, xmm0, 0
lea rdx, [rbp - 0x20]
xor r8d, r8d
mov r9, rcx
movdqu xmm1, xmmword [rbp + r9]
movdqa xmm2, xmm1
pcmpeqb xmm2, xmm0
pmovmskb r10d, xmm2
test r10d, r10d
je 0x1400bee89
bsf edi, r10d
add rdi, r9
and rdi, rax
mov r11, rdi
shl r11, 5
mov rbx, rdx
sub rbx, r11
cmp qword [rbx + 0x10], 0xa
jne 0x1400bee79
mov r11, qword [rbx]
movdqu xmm2, xmmword [r11]
movdqu xmm3, xmmword [r15]
pcmpeqb xmm3, xmm2
movd xmm2, dword [r11 + 0x10]
movd xmm4, dword [r15 + 0x10]
pcmpeqb xmm4, xmm2
pand xmm4, xmm3
pmovmskb r11d, xmm4
cmp r11d, 0xffff
je 0x1400beeae
lea r11d, [r10 - 1]
and r11d, r10d
mov r10d, r11d
test r11w, r11w
jne 0x1400bee28
pcmpeqb xmm1, xmm6
pmovmskb r10d, xmm1
test r10d, r10d
jne 0x1400bef59
add r9, r8
add r9, 0x10
add r8, 0x10
and r9, rax
jmp 0x1400bee0f
neg rdi
shl rdi, 5
add rbp, rdi
cmp qword [rsp + 0x48], 0
je 0x1400beed2
mov rcx, qword [0x1401529c8]
xor edx, edx
mov r8, r15
call qword [sym.imp.kernel32.dll_HeapFree]
mov r12, qword [rsp + 0xe8]
mov rdi, qword [rsp + 0x50]
mov eax, dword [rbp - 8]
inc eax
mov dword [rbp - 8], eax
cmp eax, 1
jle 0x1400bef00
mov rcx, qword [0x1401529c8]
xor edx, edx
mov r8, r14
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1400bef48
mov rdx, qword [rsp + 0x70]
cmp rdx, qword [rsp + 0x68]
jne 0x1400bef1b
lea rcx, [rsp + 0x60]
call fcn.1400bb8c8
mov rdx, qword [rsp + 0x70]
mov rax, qword [rsp + 0x60]
mov rcx, rdx
shl rcx, 5
mov dword [rax + rcx], r13d
mov qword [rax + rcx + 8], r14
mov r8d, 0xa
mov qword [rax + rcx + 0x10], r8
mov qword [rax + rcx + 0x18], r8
inc rdx
mov qword [rsp + 0x70], rdx
inc r13
cmp r13, rdi
jne 0x1400becd3
jmp 0x1400bf490
cmp qword [rsp + 0x3f0], 0
je 0x1400bf01b
movdqu xmm0, xmmword [rbp + rcx]
pmovmskb edx, xmm0
test edx, edx
mov rdi, qword [rsp + 0x50]
jne 0x1400bef99
mov r8d, 0x10
add rcx, r8
and rcx, rax
movdqu xmm0, xmmword [rbp + rcx]
pmovmskb edx, xmm0
add r8, 0x10
test edx, edx
je 0x1400bef81
bsf edx, edx
add rdx, rcx
and rdx, rax
mov cl, byte [rbp + rdx]
test cl, cl
js 0x1400befba
movdqa xmm0, xmmword [rbp]
pmovmskb ecx, xmm0
bsf edx, ecx
mov cl, byte [rbp + rdx]
lea r8, [rdx - 0x10]
and r8, rax
mov byte [rbp + rdx], r12b
mov byte [r8 + rbp + 0x10], r12b
shl rdx, 5
mov rax, rbp
sub rax, rdx
and cl, 1
movzx ecx, cl
sub qword [rsp + 0x3f0], rcx
neg rdx
mov qword [rbp + rdx - 0x20], r15
mov rcx, qword [rsp + 0x48]
mov qword [rax - 0x18], rcx
mov qword [rax - 0x10], 0xa
mov dword [rax - 8], 0
inc qword [rsp + 0x3f8]
mov rbp, rax
mov r12, qword [rsp + 0xe8]
jmp 0x1400beedf
lea rcx, [rsp + 0x3e0]
lea rdx, [rsp + 0x400]
call fcn.1401100c6
mov rbp, qword [rsp + 0x3e0]
mov rax, qword [rsp + 0x3e8]
and rsi, rax
mov rcx, rsi
jmp 0x1400bef68
cmp byte [r15 + 5], 0
je 0x1400beb77
mov rax, qword [rsp + 0x280]
test rax, rax
je 0x1400beb77
mov r14, qword [rsp + 0x270]
lea rsi, [rsp + 0xa8]
shl rax, 5
lea rdi, [rax + rax*2]
xor ebx, ebx
lea r15, [rsp + 0x60]
lea r12, [rsp + 0x3e0]
lea r13, [rsp + 0xf0]
lea rbp, [rsp + 0xa0]
mov rax, qword [r14]
cmp rax, 2
jne 0x1400bf20e
xor ecx, ecx
xor edx, edx
call sub.ole32.dll_CoInitializeEx
cmp eax, 2
mov qword [rsp + 0x3e0], rbx
mov qword [rsp + 0x3f0], rbx
mov qword [rsp + 0x400], rbx
setb byte [rsp + 0x410]
mov rcx, r15
mov rdx, r12
call fcn.1400bd337
cmp dword [rsp + 0x60], 2
je 0x1400bf198
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x410], rax
movdqu xmm0, xmmword [rsp + 0x60]
movups xmm1, xmmword [rsp + 0x70]
movups xmm2, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x400], xmm2
movaps xmmword [rsp + 0x3f0], xmm1
movdqa xmmword [rsp + 0x3e0], xmm0
mov rcx, r13
mov rdx, r12
call fcn.1400bd3af
cmp qword [rsp + 0xf0], 2
je 0x1400bf198
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x410], rax
movdqu xmm0, xmmword [rsp + 0xf0]
movups xmm1, xmmword [rsp + 0x100]
movups xmm2, xmmword [rsp + 0x110]
movaps xmmword [rsp + 0x400], xmm2
movaps xmmword [rsp + 0x3f0], xmm1
movdqa xmmword [rsp + 0x3e0], xmm0
mov rcx, r15
mov rdx, r12
call fcn.1400bd451
cmp qword [rsp + 0x60], 2
jne 0x1400bf2e2
mov qword [rsp + 0xf0], 2
mov rax, qword [rsp + 0x120]
mov qword [r14 + 0x30], rax
movups xmm0, xmmword [rsp + 0xf0]
movups xmm1, xmmword [rsp + 0x100]
movups xmm2, xmmword [rsp + 0x110]
movups xmmword [r14 + 0x20], xmm2
movups xmmword [r14 + 0x10], xmm1
movups xmmword [r14], xmm0
mov rax, qword [r14]
movups xmm0, xmmword [r14 + 8]
movups xmm1, xmmword [r14 + 0x18]
movups xmm2, xmmword [r14 + 0x28]
movaps xmmword [rsp + 0x80], xmm2
movaps xmmword [rsp + 0x70], xmm1
movaps xmmword [rsp + 0x60], xmm0
cmp rax, 2
jne 0x1400bf22f
mov qword [rsp + 0x3e0], 2
jmp 0x1400bf25f
movups xmm0, xmmword [r14 + 8]
movups xmm1, xmmword [r14 + 0x18]
movups xmm2, xmmword [r14 + 0x28]
movaps xmmword [rsp + 0x80], xmm2
movaps xmmword [rsp + 0x70], xmm1
movaps xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0xa0], rax
movaps xmm0, xmmword [rsp + 0x60]
movaps xmm1, xmmword [rsp + 0x70]
movaps xmm2, xmmword [rsp + 0x80]
movups xmmword [rsi + 0x20], xmm2
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rcx, r12
mov rdx, rbp
call fcn.1400bd5b0
mov rax, qword [rsp + 0x410]
mov qword [r14 + 0x30], rax
movups xmm0, xmmword [rsp + 0x3e0]
movdqu xmm1, xmmword [rsp + 0x3f0]
movdqu xmm2, xmmword [rsp + 0x400]
movdqu xmmword [r14 + 0x20], xmm2
movdqu xmmword [r14 + 0x10], xmm1
movups xmmword [r14], xmm0
cmp dword [r14], 2
je 0x1400bf2cf
mov rcx, r12
mov rdx, r14
xor r8d, r8d
call fcn.1400bd69e
cmp dword [rsp + 0x3e4], 2
je 0x1400bf2cf
movss xmm0, dword [rsp + 0x3e0]
movss dword [r14 + 0x58], xmm0
ucomiss xmm0, dword [r14 + 0x5c]
jbe 0x1400bf2cf
movss dword [r14 + 0x5c], xmm0
add r14, 0x60
add rdi, 0xffffffffffffffa0
jne 0x1400bf09e
jmp 0x1400beb77
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0x410], rax
movdqu xmm0, xmmword [rsp + 0x60]
movups xmm1, xmmword [rsp + 0x70]
movups xmm2, xmmword [rsp + 0x80]
movaps xmmword [rsp + 0x400], xmm2
movaps xmmword [rsp + 0x3f0], xmm1
movdqa xmmword [rsp + 0x3e0], xmm0
mov rcx, r13
mov rdx, r12
call fcn.1400bd52d
jmp 0x1400bf1a4
cmp byte [r13], 0
je 0x1400c0088
lea rcx, [rsp + 0x3e0]
mov r8d, 0x548
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov rax, qword [rsp + 0x218]
mov rcx, qword [rsp + 0x220]
lea rdx, [rcx + rax]
inc rdx
movdqa xmm0, xmmword [rax]
pmovmskb r8d, xmm0
not r8d
mov r9, qword [rsp + 0x230]
lea rcx, [rsp + 0xa0]
mov qword [rcx], rax
add rax, 0x10
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rdx
mov word [rcx + 0x18], r8w
mov qword [rcx + 0x20], r9
call fcn.1400bb3fd
test rax, rax
je 0x1400c0088
mov r14, rdx
lea rsi, [rsp + 0x3e0]
mov rdi, 0xffffffffffffffff
lea r15, [rsp + 0xa0]
mov rax, qword [r14]
mov qword [rsp + 0x3e0], rax
mov dword [rsp + 0x3e8], 0
mov rcx, rsi
call sub.iphlpapi.dll_GetIfEntry2
test eax, eax
jne 0x1400bf477
mov rax, qword [r14 + 8]
mov rcx, qword [r14 + 0x18]
mov qword [r14 + 0x10], rax
mov rax, qword [rsp + 0x8e0]
mov qword [r14 + 8], rax
mov qword [r14 + 0x20], rcx
mov rax, qword [rsp + 0x898]
mov qword [r14 + 0x18], rax
mov rax, qword [r14 + 0x28]
mov qword [r14 + 0x30], rax
mov rax, qword [rsp + 0x8a0]
add rax, qword [rsp + 0x8a8]
cmovb rax, rdi
mov qword [r14 + 0x28], rax
mov rax, qword [r14 + 0x38]
mov qword [r14 + 0x40], rax
mov rax, qword [rsp + 0x8e8]
add rax, qword [rsp + 0x8f0]
cmovb rax, rdi
mov qword [r14 + 0x38], rax
mov rax, qword [r14 + 0x48]
mov qword [r14 + 0x50], rax
mov rax, qword [rsp + 0x8b8]
mov qword [r14 + 0x48], rax
mov rax, qword [r14 + 0x58]
mov qword [r14 + 0x60], rax
mov rax, qword [rsp + 0x900]
mov qword [r14 + 0x58], rax
mov rcx, r15
call fcn.1400bb3fd
mov r14, rdx
test rax, rax
jne 0x1400bf3c1
jmp 0x1400c0088
mov rcx, qword [rsp + 0x60]
mov rax, qword [rsp + 0x68]
mov qword [rsp + 0x348], rax
mov rax, qword [rsp + 0x70]
mov rsi, rax
shl rsi, 5
add rsi, rcx
mov qword [rsp + 0x178], rcx
mov rdi, rcx
test rax, rax
mov r13, qword [rsp + 0x58]
je 0x1400bfb11
pcmpeqd xmm6, xmm6
mov rdi, qword [rsp + 0x178]
mov qword [rsp + 0x190], rsi
mov rax, rdi
add rdi, 0x20
mov rcx, qword [rax + 8]
mov qword [rsp + 0x48], rcx
test rcx, rcx
je 0x1400bfb11
mov rbx, qword [rax + 0x10]
mov edx, dword [rax]
cmp qword [rsp + 0x3f8], 0
mov qword [rsp + 0x1a0], rdi
mov qword [rsp + 0x198], rbx
je 0x1400bf644
mov qword [rsp + 0x98], rdx
mov rsi, qword [rax + 0x18]
mov rcx, qword [rsp + 0x400]
mov rdx, qword [rsp + 0x408]
mov r8, qword [rsp + 0x48]
mov r9, rsi
call fcn.1400bb5f8
mov rcx, qword [rsp + 0x3e0]
mov rdi, qword [rsp + 0x3e8]
mov r15, rdi
and r15, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
lea r14, [rsi + rsi]
lea r13, [rcx - 0x20]
xor r12d, r12d
mov qword [rsp + 0x50], rcx
movdqu xmm8, xmmword [rcx + r15]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb ebp, xmm0
test ebp, ebp
je 0x1400bf5d4
bsf ebx, ebp
add rbx, r15
and rbx, rdi
mov rcx, rbx
shl rcx, 5
mov rax, r13
sub rax, rcx
cmp rsi, qword [rax + 0x10]
jne 0x1400bf5c8
mov rdx, qword [rax]
mov rcx, qword [rsp + 0x48]
mov r8, r14
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400bf5fb
lea eax, [rbp - 1]
and eax, ebp
mov ebp, eax
test ax, ax
jne 0x1400bf598
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x1400bf944
add r15, r12
add r15, 0x10
add r12, 0x10
and r15, rdi
mov rcx, qword [rsp + 0x50]
jmp 0x1400bf581
neg rbx
shl rbx, 5
mov rcx, qword [rsp + 0x50]
add rcx, rbx
lea rax, [rcx - 0x20]
test rcx, rcx
cmove rax, rcx
mov r13, qword [rsp + 0x58]
mov r12, qword [rsp + 0xe8]
mov rsi, qword [rsp + 0x190]
mov rdi, qword [rsp + 0x1a0]
mov rbx, qword [rsp + 0x198]
mov rdx, qword [rsp + 0x98]
jmp 0x1400bf646
xor eax, eax
lea rcx, [rax + 0x18]
test rax, rax
lea rax, [0x14013b570]
cmove rcx, rax
cmp dword [rcx], 1
jg 0x1400bf803
imul r14, rdx, 0x548
lea r15, [r12 + r14]
lea rdx, [r12 + r14]
add rdx, 0x1c
xor r8d, r8d
cmp word [rdx + r8*2], 0
je 0x1400bf693
inc r8
cmp r8, 0x101
jne 0x1400bf677
mov r8d, 0x101
jmp 0x1400bf6a0
cmp r8, 0x102
jae 0x1400c0b84
lea rcx, [rsp + 0xa0]
call fcn.1400428c0
mov r8, qword [rsp + 0xa0]
test r8, r8
je 0x1400bf803
mov qword [rsp + 0x358], r15
mov qword [rsp + 0x180], r14
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x188], rax
mov r15, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x238]
mov rdx, qword [rsp + 0x240]
mov qword [rsp + 0x50], r8
mov r9, r15
call fcn.1400bb481
mov rcx, rax
shr rcx, 0x39
mov rdx, qword [rsp + 0x218]
mov rsi, qword [rsp + 0x220]
mov rdi, rsi
mov qword [rsp + 0x350], rax
and rdi, rax
mov qword [rsp + 0x360], rcx
movd xmm0, ecx
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
lea r13, [rdx - 0x88]
xor eax, eax
mov qword [rsp + 0x98], rax
mov rbx, rdi
mov qword [rsp + 0x130], rdx
movdqu xmm8, xmmword [rdx + rbx]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb r12d, xmm0
test r12d, r12d
je 0x1400bf7c6
bsf ecx, r12d
add rcx, rbx
and rcx, rsi
mov r14, rcx
neg r14
shl rcx, 3
mov rbp, r14
shl rbp, 7
mov rax, rbp
sub rax, rcx
cmp qword [r13 + rax + 0x10], r15
jne 0x1400bf7b6
add rax, r13
mov rcx, qword [rax]
mov rdx, qword [rsp + 0x50]
mov r8, r15
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400bf82a
lea eax, [r12 - 1]
and eax, r12d
mov r12d, eax
test ax, ax
jne 0x1400bf777
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x1400bf94b
mov rax, qword [rsp + 0x98]
add rbx, rax
add rbx, 0x10
add rax, 0x10
mov qword [rsp + 0x98], rax
and rbx, rsi
mov rdx, qword [rsp + 0x130]
jmp 0x1400bf75e
test rbx, rbx
je 0x1400bf81c
mov rcx, qword [0x1401529c8]
xor edx, edx
mov r8, qword [rsp + 0x48]
call qword [sym.imp.kernel32.dll_HeapFree]
cmp rdi, rsi
jne 0x1400bf4de
jmp 0x1400bfb11
lea rax, [r14*8]
add rax, rbp
mov r8, qword [rsp + 0x130]
mov rcx, qword [r8 + rax - 0x68]
mov rdx, qword [r8 + rax - 0x58]
mov qword [r8 + rax - 0x60], rcx
mov r12, qword [rsp + 0xe8]
mov r9, qword [rsp + 0x180]
mov rcx, qword [r12 + r9 + 0x500]
mov qword [r8 + rax - 0x68], rcx
mov qword [r8 + rax - 0x50], rdx
mov rcx, qword [r12 + r9 + 0x4b8]
mov qword [r8 + rax - 0x58], rcx
mov rcx, qword [r8 + rax - 0x48]
mov qword [r8 + rax - 0x40], rcx
mov rcx, qword [r12 + r9 + 0x4c0]
add rcx, qword [r12 + r9 + 0x4c8]
mov rdx, 0xffffffffffffffff
cmovb rcx, rdx
mov qword [r8 + rax - 0x48], rcx
mov rcx, qword [r8 + rax - 0x38]
mov qword [r8 + rax - 0x30], rcx
mov rcx, qword [r12 + r9 + 0x508]
add rcx, qword [r12 + r9 + 0x510]
cmovb rcx, rdx
mov qword [r8 + rax - 0x38], rcx
mov rcx, qword [r8 + rax - 0x28]
mov qword [r8 + rax - 0x20], rcx
mov rcx, qword [r12 + r9 + 0x4d8]
mov qword [r8 + rax - 0x28], rcx
mov rcx, qword [r8 + rax - 0x18]
mov qword [r8 + rax - 0x10], rcx
mov rcx, qword [r12 + r9 + 0x520]
mov qword [r8 + rax - 0x18], rcx
mov byte [r8 + rax - 2], 1
cmp qword [rsp + 0x188], 0
mov r13, qword [rsp + 0x58]
je 0x1400bf920
mov rcx, qword [0x1401529c8]
xor edx, edx
mov r8, qword [rsp + 0x50]
call qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsp + 0x198], 0
mov rsi, qword [rsp + 0x190]
mov rdi, qword [rsp + 0x1a0]
jne 0x1400bf808
jmp 0x1400bf81c
xor ecx, ecx
jmp 0x1400bf60a
cmp qword [rsp + 0x228], 0
mov r12, qword [rsp + 0xe8]
mov rbp, qword [rsp + 0x130]
je 0x1400bfadc
mov rbx, qword [rsp + 0x180]
mov rax, qword [r12 + rbx + 0x4c0]
add rax, qword [r12 + rbx + 0x4c8]
mov rdx, 0xffffffffffffffff
cmovb rax, rdx
mov rcx, qword [r12 + rbx + 0x508]
add rcx, qword [r12 + rbx + 0x510]
cmovb rcx, rdx
mov r9, qword [r12 + rbx + 0x4b8]
mov rdx, qword [rsp + 0x358]
mov r11, qword [rdx]
mov r10, qword [r12 + rbx + 0x500]
mov r8, qword [r12 + rbx + 0x4d8]
mov rdx, qword [r12 + rbx + 0x520]
movdqu xmm0, xmmword [rbp + rdi]
pmovmskb ebx, xmm0
test ebx, ebx
mov r13, qword [rsp + 0x58]
jne 0x1400bf9fd
mov r14d, 0x10
add rdi, r14
and rdi, rsi
movdqu xmm0, xmmword [rbp + rdi]
pmovmskb ebx, xmm0
add r14, 0x10
test ebx, ebx
je 0x1400bf9e5
bsf ebx, ebx
add rbx, rdi
and rbx, rsi
mov dil, byte [rbp + rbx]
test dil, dil
js 0x1400bfa21
movdqa xmm0, xmmword [rbp]
pmovmskb edi, xmm0
bsf ebx, edi
mov dil, byte [rbp + rbx]
lea r14, [rbx - 0x10]
and r14, rsi
mov rsi, qword [rsp + 0x360]
mov byte [rbp + rbx], sil
mov byte [r14 + rbp + 0x10], sil
and dil, 1
movzx esi, dil
sub qword [rsp + 0x228], rsi
mov rsi, rbx
neg rsi
shl rbx, 3
shl rsi, 7
sub rsi, rbx
mov rdi, qword [rsp + 0x50]
mov qword [rbp + rsi - 0x88], rdi
mov rdi, qword [rsp + 0x188]
mov qword [rbp + rsi - 0x80], rdi
mov qword [rbp + rsi - 0x78], r15
mov qword [rbp + rsi - 0x70], r11
mov qword [rbp + rsi - 0x68], r10
mov qword [rbp + rsi - 0x60], r10
mov qword [rbp + rsi - 0x58], r9
mov qword [rbp + rsi - 0x50], r9
mov qword [rbp + rsi - 0x48], rax
mov qword [rbp + rsi - 0x40], rax
mov qword [rbp + rsi - 0x38], rcx
mov qword [rbp + rsi - 0x30], rcx
mov qword [rbp + rsi - 0x28], r8
mov qword [rbp + rsi - 0x20], r8
mov qword [rbp + rsi - 0x18], rdx
mov qword [rbp + rsi - 0x10], rdx
mov dword [rbp + rsi - 8], 0
mov word [rbp + rsi - 4], 0
mov byte [rbp + rsi - 2], 1
inc qword [rsp + 0x230]
jmp 0x1400bf920
lea rcx, [rsp + 0x218]
lea rdx, [rsp + 0x238]
call fcn.140110356
mov rbp, qword [rsp + 0x218]
mov rsi, qword [rsp + 0x220]
mov rdi, qword [rsp + 0x350]
and rdi, rsi
jmp 0x1400bf96a
sub rsi, rdi
je 0x1400bfb40
shr rsi, 5
add rdi, 0x10
cmp qword [rdi], 0
je 0x1400bfb37
mov r8, qword [rdi - 8]
mov rcx, qword [0x1401529c8]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
add rdi, 0x20
dec rsi
jne 0x1400bfb1e
cmp qword [rsp + 0x348], 0
je 0x1400bfb62
mov rcx, qword [0x1401529c8]
xor edx, edx
mov r8, qword [rsp + 0x178]
call qword [sym.imp.kernel32.dll_HeapFree]
mov rcx, qword [rsp + 0xf0]
call sub.iphlpapi.dll_FreeMibTable
mov rdx, qword [rsp + 0x3e8]
test rdx, rdx
je 0x1400bfc12
mov rsi, qword [rsp + 0x3f8]
test rsi, rsi
je 0x1400bfc05
mov rdi, qword [rsp + 0x3e0]
movdqa xmm0, xmmword [rdi]
pmovmskb eax, xmm0
not eax
lea rbx, [rdi + 0x10]
mov r14, qword [sym.imp.kernel32.dll_HeapFree]
test ax, ax
jne 0x1400bfbca
movdqa xmm0, xmmword [rbx]
pmovmskb eax, xmm0
add rdi, 0xfffffffffffffe00
add rbx, 0x10
cmp ax, 0xffff
je 0x1400bfbaf
not eax
bsf ecx, eax
lea ebp, [rax - 1]
and ebp, eax
shl rcx, 5
mov rax, rdi
sub rax, rcx
dec rsi
cmp qword [rax - 0x18], 0
je 0x1400bfbf6
mov r8, qword [rax - 0x20]
mov rcx, qword [0x1401529c8]
xor edx, edx
call r14
mov eax, ebp
test rsi, rsi
jne 0x1400bfbaa
mov rdx, qword [rsp + 0x3e8]
mov rcx, qword [rsp + 0x3e0]
call fcn.1400bbac3
mov rsi, qword [rsp + 0x230]
test rsi, rsi
je 0x1400bfd4a
mov rdi, qword [rsp + 0x218]
lea rbx, [rdi + 0x10]
movdqa xmm0, xmmword [rdi]
pmovmskb ebp, xmm0
not ebp
movabs r14, 0xf0f0f0f0f0f0f0f1
pcmpeqd xmm6, xmm6
mov r15, qword [sym.imp.kernel32.dll_HeapFree]
test bp, bp
jne 0x1400bfc6e
movdqa xmm0, xmmword [rbx]
pmovmskb ebp, xmm0
add rdi, 0xfffffffffffff780
add rbx, 0x10
cmp bp, 0xffff
je 0x1400bfc53
not ebp
mov eax, ebp
bsf ecx, eax
lea ebp, [rax - 1]
and ebp, eax
mov rax, rcx
neg rax
shl rcx, 3
shl rax, 7
sub rax, rcx
dec rsi
cmp byte [rdi + rax - 2], 0
jne 0x1400bfd41
add rax, rdi
mov rcx, qword [rsp + 0x218]
mov rdx, rcx
sub rdx, rax
sar rdx, 3
imul rdx, r14
lea r8, [rdx - 0x10]
and r8, qword [rsp + 0x220]
movdqu xmm0, xmmword [rcx + r8]
pcmpeqb xmm0, xmm6
psllw xmm0, 7
pmovmskb r9d, xmm0
test r9d, r9d
je 0x1400bfce0
bsr r9w, r9w
xor r9d, 0xf
jmp 0x1400bfce5
mov r9w, 0x10
movdqu xmm0, xmmword [rcx + rdx]
pcmpeqb xmm0, xmm6
pmovmskb r10d, xmm0
or r10d, 0x10000
bsf r10d, r10d
add r9d, r10d
mov r10b, 0x80
cmp r9w, 0xf
ja 0x1400bfd16
inc qword [rsp + 0x228]
mov r10b, 0xff
mov byte [rcx + rdx], r10b
mov byte [r8 + rcx + 0x10], r10b
dec qword [rsp + 0x230]
cmp qword [rax - 0x80], 0
je 0x1400bfd41
mov r8, qword [rax - 0x88]
mov rcx, qword [0x1401529c8]
xor edx, edx
call r15
test rsi, rsi
jne 0x1400bfc4e
lea rdi, [rsp + 0x370]
mov dword [rdi], 0x3c00
mov ebx, 3
mov ecx, dword [rsp + 0x370]
call sub.api_ms_win_crt_heap_l1_1_0.dll_malloc
test rax, rax
je 0x1400bfdcc
mov rsi, rax
mov qword [rsp + 0x20], rdi
xor ecx, ecx
mov edx, 0xe
xor r8d, r8d
mov r9, rax
call sub.iphlpapi.dll_GetAdaptersAddresses
mov dword [rsp + 0x140], eax
cmp eax, 0x6f
jne 0x1400bfda5
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
dec ebx
jne 0x1400bfd5d
jmp 0x1400bfe27
test eax, eax
jne 0x1400bfe1f
mov qword [rsp + 0xa8], rsi
mov qword [rsp + 0xb0], rsi
mov qword [rsp + 0xa0], 0
xor esi, esi
jmp 0x1400bfe80
mov ecx, 0x32
call fcn.14008bd36
mov rsi, rax
movups xmm0, xmmword [str.failed_to_allocate_memory_for_IP_ADAPTER_ADDRESSESGetAdaptersAddresses___failed_with_code]
movups xmmword [rax], xmm0
movups xmm0, xmmword [0x14013b89a]
movups xmmword [rax + 0x10], xmm0
movdqu xmm0, xmmword [0x14013b8aa]
movdqu xmmword [rax + 0x20], xmm0
mov word [rax + 0x30], 0x5345
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rdx
mov qword [rsp + 0xb0], 0x32
jmp 0x1400bfe80
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
lea rax, [rsp + 0x140]
lea rcx, [rsp + 0x60]
mov qword [rcx], rax
lea rax, [0x14004c6f0]
mov qword [rcx + 8], rax
lea rax, [0x14013b8e8]
lea rdx, [rsp + 0x3e0]
mov qword [rdx], rax
mov eax, 1
mov qword [rdx + 8], rax
mov qword [rdx + 0x20], 0
mov qword [rdx + 0x10], rcx
mov qword [rdx + 0x18], rax
lea rsi, [rsp + 0xa0]
mov rcx, rsi
call fcn.1400424d0
mov rsi, qword [rsi]
test rsi, rsi
je 0x1400bfeab
cmp qword [rsp + 0xa8], 0
je 0x1400c0088
mov rcx, qword [0x1401529c8]
xor edx, edx
mov r8, rsi
call qword [sym.imp.kernel32.dll_HeapFree]
jmp 0x1400c0088
movdqu xmm0, xmmword [rsp + 0xa8]
lea rdx, [rsp + 0x60]
movdqu xmmword [rdx], xmm0
lea rsi, [rsp + 0x3e0]
mov rcx, rsi
call fcn.1400bd1f2
mov r12, qword [rsi]
test r12, r12
je 0x1400c007e
pcmpeqd xmm6, xmm6
mov rax, qword [rsp + 0x3e8]
mov qword [rsp + 0x98], rax
cmp qword [rsp + 0x230], 0
je 0x1400c001c
mov rsi, qword [rsp + 0x3f0]
mov rcx, qword [rsp + 0x238]
mov rdx, qword [rsp + 0x240]
mov r8, r12
mov r9, rsi
call fcn.1400bb481
mov rcx, qword [rsp + 0x218]
mov r14, qword [rsp + 0x220]
mov rbx, r14
and rbx, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
mov qword [rsp + 0x50], rcx
lea r15, [rcx - 0x88]
xor eax, eax
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x50]
movdqu xmm8, xmmword [rax + rbx]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb r13d, xmm0
test r13d, r13d
je 0x1400bffc8
bsf ecx, r13d
add rcx, rbx
and rcx, r14
mov rdi, rcx
neg rdi
shl rcx, 3
mov rbp, rdi
shl rbp, 7
mov rax, rbp
sub rax, rcx
cmp rsi, qword [r15 + rax + 0x10]
jne 0x1400bffb9
add rax, r15
mov rdx, qword [rax]
mov rcx, r12
mov r8, rsi
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400bfff3
lea eax, [r13 - 1]
and eax, r13d
mov r13d, eax
test ax, ax
jne 0x1400bff7c
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x1400c001c
mov rax, qword [rsp + 0x48]
add rbx, rax
add rbx, 0x10
add rax, 0x10
mov qword [rsp + 0x48], rax
and rbx, r14
jmp 0x1400bff5e
lea rax, [rdi*8]
add rax, rbp
lea rdx, [rsp + 0x3f8]
movzx ecx, word [rdx + 4]
mov r8, qword [rsp + 0x50]
mov word [r8 + rax - 4], cx
mov ecx, dword [rdx]
mov dword [r8 + rax - 8], ecx
cmp qword [rsp + 0x98], 0
je 0x1400c0039
mov rcx, qword [0x1401529c8]
xor edx, edx
mov r8, r12
call qword [sym.imp.kernel32.dll_HeapFree]
lea rcx, [rsp + 0x3e0]
lea rdx, [rsp + 0x60]
call fcn.1400bd1f2
mov r12, qword [rsp + 0x3e0]
test r12, r12
jne 0x1400bfedd
mov rsi, qword [rsp + 0xa0]
mov rcx, qword [rsp + 0x60]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
test rsi, rsi
mov r13, qword [rsp + 0x58]
jne 0x1400bfe85
jmp 0x1400c0088
mov rcx, qword [rsp + 0x60]
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
movzx edx, word [r13 + 8]
cmp dl, 2
je 0x1400c00a9
movzx eax, byte [r13 + 0xa]
shl eax, 0x10
or edx, eax
lea rcx, [rsp + 0x1a8]
call fcn.1400bbe3e
cmp byte [r13 + 2], 0
je 0x1400c029a
lea rsi, [rsp + 0x288]
call sub.kernel32.dll_GetLogicalDrives
mov dword [rsp + 0x370], eax
test eax, eax
je 0x1400c0319
mov qword [rsp + 0x140], 8
pxor xmm0, xmm0
movdqu xmmword [rsp + 0x148], xmm0
lea rax, [rsp + 0x370]
mov qword [rsp + 0x3e0], rax
movabs rax, 0x2000000000
mov qword [rsp + 0x3e8], rax
call fcn.14008d284
lea rcx, [rsp + 0x3e0]
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], 0x20
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 1
lea rsi, [rsp + 0xf0]
mov edx, 0x20
mov rcx, rsi
xor r8d, r8d
mov r9, rax
call fcn.1400b9fc9
mov rax, qword [rsi + 0x10]
test rax, rax
je 0x1400c0185
mov rcx, qword [rsp + 0xf0]
test rcx, rcx
je 0x1400c0185
xor r8d, r8d
add r8, qword [rcx + 0x10]
dec rax
je 0x1400c017c
mov rcx, qword [rcx + 0x18]
test rcx, rcx
jne 0x1400c016a
test r8, r8
jne 0x1400c0a11
mov rax, qword [rsp + 0x100]
lea rdx, [rsp + 0x60]
mov qword [rdx + 0x10], rax
movups xmm0, xmmword [rsp + 0xf0]
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0xa0]
mov rcx, rsi
call fcn.1400bb77a
cmp qword [rsi], 0
je 0x1400c032e
lea rsi, [rsp + 0x140]
mov r13, qword [rsi + 0x10]
lea rbx, [rsp + 0x3e0]
lea r15, [rsp + 0xa0]
lea r12, [rsp + 0x60]
movups xmm0, xmmword [rsp + 0xa0]
movaps xmmword [rsp + 0x3e0], xmm0
mov rbp, qword [rsp + 0xb0]
mov qword [rsp + 0x3f0], rbp
mov rdi, qword [rsp + 0x3e0]
mov rax, qword [rsp + 0x148]
sub rax, r13
cmp rax, rbp
jb 0x1400c027f
mov r14, qword [rsp + 0x140]
lea rcx, [r13*8]
add rcx, r13
shl rcx, 4
add rcx, r14
mov rax, rbp
shl rax, 4
lea r8, [rax + rax*8]
mov rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
add r13, rbp
mov qword [rsp + 0x150], r13
mov qword [rsp + 0x3f0], 0
mov rcx, rbx
call fcn.1400b68e8
mov rcx, r15
mov rdx, r12
call fcn.1400bb77a
cmp qword [rsp + 0xa0], 0
jne 0x1400c01dc
jmp 0x1400c0336
mov rcx, rsi
mov rdx, r13
mov r8, rbp
call fcn.140110093
mov r13, qword [rsp + 0x150]
jmp 0x1400c0214
cmp byte [r13 + 3], 0
je 0x1400c0380
mov rax, qword [rsp + 0x298]
test rax, rax
je 0x1400c0380
mov rdi, qword [rsp + 0x288]
shl rax, 4
lea rbx, [rax + rax*8]
xor r14d, r14d
lea rsi, [rsp + 0x3e0]
cmp qword [rdi + r14 + 0x78], 0
je 0x1400c030b
mov qword [rsp + 0x3e0], 0
mov rcx, qword [rdi + r14 + 0x48]
xor edx, edx
xor r8d, r8d
mov r9, rsi
call sub.kernel32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x1400c030b
mov rax, qword [rsp + 0x3e0]
mov qword [rdi + r14 + 0x80], rax
add r14, 0x90
cmp rbx, r14
jne 0x1400c02d1
jmp 0x1400c0380
pxor xmm0, xmm0
movdqa xmmword [rsp + 0x3e0], xmm0
mov r14d, 8
jmp 0x1400c0362
mov r14, qword [rsp + 0x140]
lea rcx, [rsp + 0x60]
call fcn.1400babde
lea rax, [rsp + 0x148]
movdqu xmm0, xmmword [rax]
movdqa xmmword [rsp + 0x3e0], xmm0
mov r13, qword [rsp + 0x58]
lea rsi, [rsp + 0x288]
mov rcx, rsi
call fcn.1400b68e8
mov qword [rsp + 0x288], r14
movdqa xmm0, xmmword [rsp + 0x3e0]
movdqu xmmword [rsi + 8], xmm0
cmp byte [r13 + 7], 0
je 0x1400c0809
lea rax, [rsp + 0xf0]
mov qword [rax], 8
pxor xmm6, xmm6
movdqu xmmword [rax + 8], xmm6
lea rax, [rsp + 0x370]
mov qword [rax], 0
xor eax, eax
lea rcx, [rsp + 0x12c]
mov dword [rcx], eax
lea rcx, [rsp + 0x138]
mov dword [rcx], eax
lea rcx, [rsp + 0x13c]
mov dword [rcx], eax
lea r15, [rsp + 0x3e0]
lea r12, [rsp + 0xa0]
lea rax, [rsp + 0x13c]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x138]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x12c]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0xffffffff
xor ecx, ecx
xor edx, edx
mov r8d, 2
lea r9, [rsp + 0x370]
call sub.netapi32.dll_NetUserEnum
mov dword [rsp + 0x48], eax
test eax, eax
je 0x1400c043e
cmp dword [rsp + 0x48], 0xea
jne 0x1400c06f0
mov r13, qword [rsp + 0x370]
mov eax, dword [rsp + 0x12c]
test rax, rax
je 0x1400c06f8
lea rbp, [rax*8]
add rbp, r13
mov rdx, qword [r13]
test rdx, rdx
je 0x1400c06e3
mov qword [rsp + 0x140], 0
xor eax, eax
mov dword [rsp + 0xe4], eax
mov dword [rsp + 0x3a8], eax
lea rax, [rsp + 0x3a8]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0xe4]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x140]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 0xffffffff
lea rcx, [0x14013b888]
xor r8d, r8d
mov r9d, 1
call sub.netapi32.dll_NetUserGetLocalGroups
test eax, eax
je 0x1400c0505
lea rax, [rsp + 0xa8]
movdqu xmmword [rax], xmm6
mov qword [rsp + 0xa0], 8
mov rcx, qword [rsp + 0x140]
test rcx, rcx
je 0x1400c0601
call sub.netapi32.dll_NetApiBufferFree
jmp 0x1400c0601
mov edi, dword [rsp + 0xe4]
test rdi, rdi
je 0x1400c053d
lea rax, [rdi*8]
lea rbx, [rax + rax*2]
mov al, byte [0x140152a70]
mov edx, 8
mov rcx, rbx
call fcn.140041bf0
mov rsi, rax
test rax, rax
jne 0x1400c0542
jmp 0x1400c0b37
mov esi, 8
mov qword [rsp + 0xa0], rsi
mov qword [rsp + 0xa8], rdi
mov qword [rsp + 0xb0], 0
mov rcx, qword [rsp + 0x140]
test rcx, rcx
je 0x1400c0601
mov r14d, dword [rsp + 0xe4]
test r14, r14
je 0x1400c04fb
xor ebx, ebx
xor edi, edi
mov rax, qword [rsp + 0x140]
test rax, rax
je 0x1400c0601
mov rdx, qword [rax + rdi*8]
inc rdi
mov rcx, r15
call fcn.1400b93f9
cmp rbx, qword [rsp + 0xa8]
jne 0x1400c05c5
mov rcx, r12
mov rdx, rbx
call fcn.1400b97e9
mov rsi, qword [rsp + 0xa0]
mov rbx, qword [rsp + 0xb0]
lea rax, [rbx + rbx*2]
mov rcx, qword [rsp + 0x3f0]
mov qword [rsi + rax*8 + 0x10], rcx
movdqu xmm0, xmmword [rsp + 0x3e0]
movdqu xmmword [rsi + rax*8], xmm0
mov rbx, qword [rsp + 0xb0]
inc rbx
mov qword [rsp + 0xb0], rbx
cmp r14, rdi
jne 0x1400c0584
jmp 0x1400c04ea
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x70], rax
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x68], rax
mov rdx, qword [r13]
mov rcx, r12
call fcn.1400b93f9
mov rdx, qword [rsp + 0xa0]
mov r8, qword [rsp + 0xb0]
mov rcx, r15
call fcn.140042a30
mov rcx, r15
call fcn.1400b9451
mov rsi, qword [rsp + 0x3e0]
mov rdi, qword [rsp + 0x3f0]
mov rdx, qword [rsp + 0x100]
cmp rdx, qword [rsp + 0xf8]
jne 0x1400c068b
lea rcx, [rsp + 0xf0]
call fcn.140055a9f
mov rdx, qword [rsp + 0x100]
mov rax, qword [rsp + 0xf0]
lea rcx, [rdx + rdx*8]
mov qword [rax + rcx*8], rsi
mov qword [rax + rcx*8 + 8], rdi
movups xmm0, xmmword [rsp + 0xa0]
movups xmmword [rax + rcx*8 + 0x10], xmm0
mov r8, qword [rsp + 0xb0]
mov qword [rax + rcx*8 + 0x20], r8
movdqa xmm0, xmmword [rsp + 0x60]
movdqu xmmword [rax + rcx*8 + 0x28], xmm0
mov r8, qword [rsp + 0x70]
mov qword [rax + rcx*8 + 0x38], r8
mov dword [rax + rcx*8 + 0x40], 0
inc rdx
mov qword [rsp + 0x100], rdx
add r13, 8
cmp r13, rbp
jne 0x1400c0461
mov r13, qword [rsp + 0x370]
test r13, r13
je 0x1400c0711
mov rcx, r13
call sub.netapi32.dll_NetApiBufferFree
mov qword [rsp + 0x370], 0
cmp dword [rsp + 0x48], 0xea
je 0x1400c03e2
lea rcx, [rsp + 0x3a8]
mov dword [rcx], 0
lea rdx, [rsp + 0x140]
mov qword [rdx], 0
call sub.secur32.dll_LsaEnumerateLogonSessions
test eax, eax
je 0x1400c0851
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x3f0], rax
movups xmm0, xmmword [rsp + 0xf0]
movaps xmmword [rsp + 0x3e0], xmm0
mov rdi, qword [rsp + 0x2b0]
test rdi, rdi
je 0x1400c07c6
mov rsi, qword [rsp + 0x2a0]
add rsi, 0x28
mov rbx, qword [sym.imp.kernel32.dll_HeapFree]
cmp qword [rsi - 0x20], 0
je 0x1400c079f
mov r8, qword [rsi - 0x28]
mov rcx, qword [0x1401529c8]
xor edx, edx
call rbx
cmp qword [rsi - 0x10], 0
je 0x1400c07b5
mov r8, qword [rsi - 0x18]
mov rcx, qword [0x1401529c8]
xor edx, edx
call rbx
mov rcx, rsi
call fcn.1400b6add
add rsi, 0x48
dec rdi
jne 0x1400c0789
cmp qword [rsp + 0x2a8], 0
je 0x1400c07e8
mov r8, qword [rsp + 0x2a0]
mov rcx, qword [0x1401529c8]
xor edx, edx
call qword [sym.imp.kernel32.dll_HeapFree]
mov rax, qword [rsp + 0x3f0]
lea rcx, [rsp + 0x2a0]
mov qword [rcx + 0x10], rax
movdqa xmm0, xmmword [rsp + 0x3e0]
movdqu xmmword [rcx], xmm0
lea rdx, [rsp + 0x1a8]
mov r8d, 0x1a0
mov rcx, qword [rsp + 0x368]
call sub.VCRUNTIME140.dll_memcpy
movaps xmm6, xmmword [rsp + 0x930]
movaps xmm7, xmmword [rsp + 0x940]
movaps xmm8, xmmword [rsp + 0x950]
add rsp, 0x968
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov ebp, dword [rsp + 0x3a8]
test rbp, rbp
je 0x1400c0749
xor r15d, r15d
lea rsi, [rsp + 0x60]
pxor xmm6, xmm6
mov rcx, r15
inc r15
shl rcx, 3
add rcx, qword [rsp + 0x140]
mov qword [rsp + 0x60], 0
mov rdx, rsi
call sub.secur32.dll_LsaGetLogonSessionData
test eax, eax
je 0x1400c08a5
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400c08b5
call sub.secur32.dll_LsaFreeReturnBuffer
jmp 0x1400c08b5
mov rax, qword [rsp + 0x60]
test rax, rax
je 0x1400c08b5
cmp dword [rax + 0x40], 3
jne 0x1400c08bf
cmp r15, rbp
jne 0x1400c086d
jmp 0x1400c0749
mov rdx, qword [rax + 0x18]
lea rcx, [rsp + 0xa0]
call fcn.1400b93f9
mov rbx, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0x100]
test rsi, rsi
je 0x1400c092d
mov r12, qword [rsp + 0xa0]
mov r13, qword [rsp + 0xb0]
lea rax, [rsi*8]
lea r14, [rax + rax*8]
xor edi, edi
cmp qword [rbx + rdi + 0x20], r13
jne 0x1400c0922
mov rcx, qword [rbx + rdi + 0x10]
mov rdx, r12
mov r8, r13
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400c09ea
add rdi, 0x48
cmp r14, rdi
jne 0x1400c0903
jmp 0x1400c093d
mov r12, qword [rsp + 0xa0]
mov r13, qword [rsp + 0xb0]
lea rdi, [rsp + 0x3e0]
mov rcx, rdi
mov rdx, r12
mov r8, r13
call fcn.140042a30
mov rcx, rdi
call fcn.1400b9451
mov rdi, qword [rsp + 0x3e0]
mov r14, qword [rsp + 0x3f0]
cmp rsi, qword [rsp + 0xf8]
jne 0x1400c0995
lea rcx, [rsp + 0xf0]
mov rdx, rsi
call fcn.140055a9f
mov rbx, qword [rsp + 0xf0]
mov rsi, qword [rsp + 0x100]
lea rax, [rsi + rsi*8]
mov qword [rbx + rax*8], rdi
mov qword [rbx + rax*8 + 8], r14
movdqu xmm0, xmmword [rsp + 0xa0]
movdqu xmmword [rbx + rax*8 + 0x10], xmm0
mov rcx, qword [rsp + 0xb0]
mov qword [rbx + rax*8 + 0x20], rcx
mov qword [rbx + rax*8 + 0x28], 8
movdqu xmmword [rbx + rax*8 + 0x30], xmm6
mov dword [rbx + rax*8 + 0x40], 0
inc rsi
mov qword [rsp + 0x100], rsi
lea rsi, [rsp + 0x60]
jmp 0x1400c0894
cmp qword [rsp + 0xa8], 0
je 0x1400c0a07
mov rcx, qword [0x1401529c8]
xor edx, edx
mov r8, r12
call qword [sym.imp.kernel32.dll_HeapFree]
lea rsi, [rsp + 0x60]
jmp 0x1400c08b5
lea rcx, [rsp + 0x140]
xor edx, edx
call fcn.140110093
jmp 0x1400c0185
lea rax, [rsp + 0x3b0]
movd xmm6, dword [rsp + 0xf0]
movd xmm7, dword [rsp + 0xf8]
mov rbx, qword [rax - 8]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmm2, xmmword [rax + 0x20]
movaps xmmword [rsp + 0xa0], xmm0
movaps xmmword [rsp + 0xb0], xmm1
movaps xmmword [rsp + 0xc0], xmm2
mov r14d, 8
mov ecx, 8
call fcn.14008bd36
mov rsi, rax
movabs rax, 0x72657475706d6f43
mov qword [rsi], rax
movdqa xmm0, xmmword [rsp + 0xa0]
movdqa xmm1, xmmword [rsp + 0xb0]
movdqa xmm2, xmmword [rsp + 0xc0]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmmword [rsp + 0x70], xmm1
movdqa xmmword [rsp + 0x80], xmm2
cmp rbx, 3
je 0x1400beaf2
mov r15, rdx
mov al, byte [0x140152a70]
mov ecx, 0x60
mov edx, 8
call fcn.140041bf0
test rax, rax
je 0x1400c0bb2
mov r14, rax
mov qword [rax], rbx
movdqa xmm0, xmmword [rsp + 0x60]
movdqa xmm1, xmmword [rsp + 0x70]
movdqa xmm2, xmmword [rsp + 0x80]
movdqu xmmword [rax + 8], xmm0
movdqu xmmword [rax + 0x18], xmm1
movdqu xmmword [rax + 0x28], xmm2
mov dword [rax + 0x38], edi
movd dword [rax + 0x3c], xmm7
mov qword [rax + 0x40], rsi
mov qword [rax + 0x48], r15
mov qword [rax + 0x50], 8
movd dword [rax + 0x58], xmm6
movd dword [rax + 0x5c], xmm6
mov edi, 1
jmp 0x1400beaf4
mov ecx, 8
mov rdx, rbx
call fcn.1401093b0
ud2
lea rcx, str.key_used_disappeared
lea r8, [0x14013b830]
mov edx, 0x14
call fcn.140109c60
ud2
mov ecx, 2
mov edx, 0x14
jmp 0x1400c0b3f
mov ecx, 0x54410
call fcn.140061d80
ud2
mov ecx, 8
mov edx, 0x120
jmp 0x1400c0b3f
lea rax, str.C:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_sysinfo_0.27.8_srcwindows_network.rs
mov edx, 0x101
mov rcx, r8
mov r8, rax
call fcn.1401098b0
ud2
lea rcx, str.global_key_idle_disappearedC:Users_runneradmin.cargo_registry_srcindex.crates.io_6f17d22bba15001f_sysinfo_0.27.8_srcwindows_system.rs
lea r8, [0x14013b800]
mov edx, 0x1b
jmp 0x1400c0b59
mov ecx, 8
mov edx, 0x60
jmp 0x1400c0b3f