Function at 0x140041f59
Capabilities:
Enumerate processes via ntquerysysteminformation
Get disk information
Get disk size
Get local ipv4 addresses
Get logon sessions
Get memory capacity
Get system information on windows
List groups for user account
List user accounts

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0xa98
movaps xmmword [rsp + 0xa80], xmm9
movaps xmmword [rsp + 0xa70], xmm8
movaps xmmword [rsp + 0xa60], xmm7
movaps xmmword [rsp + 0xa50], xmm6
mov qword [rsp + 0x68], rdx
mov qword [rsp + 0x4c0], rcx
lea rsi, [rsp + 0x500]
nop
push rsi
pop rcx
call fcn.140044d99
nop
push rsi
pop rcx
call fcn.140044eef
nop
push rax
pop rsi
push rdx
pop rdi
nop
lea rbx, [rsp + 0x500]
mov edx, 0x158
mov r8d, 0x1f4
push rbx
pop rcx
nop
call fcn.14004102f
movups xmm0, xmmword [rbx]
movups xmm1, xmmword [rbx + 0x10]
movaps xmmword [rsp + 0x390], xmm1
movaps xmmword [rsp + 0x380], xmm0
mov ecx, 9
xor edx, edx
call fcn.14000e00d
mov r14, rax
mov r15, rdx
movabs rax, 0x5043206c61746f54
mov qword [rdx], rax
mov byte [rdx + 8], 0x55
mov ecx, 8
mov edx, 0x120
call fcn.14000c493
test rax, rax
je 0x140044d4a
push rax
pop rbx
nop
lea r12, [rsp + 0x500]
mov rcx, r12
call fcn.140044d99
mov rcx, r12
call fcn.140044eef
mov r12, rax
mov r13, rdx
call fcn.140036d50
mov r8d, edx
lea rbp, [rsp + 0x500]
mov rcx, rbp
mov edx, eax
call fcn.140036de0
cmp qword [rbp], 0
je 0x14004206c
xor ebp, ebp
jmp 0x14004208d
mov rbp, qword [rsp + 0x508]
call sub.KERNEL32.dll_GetTickCount64
xor ecx, ecx
mov r8d, 0x3e8
xor edx, edx
div r8
sub rbp, rax
cmovb rbp, rcx
movaps xmm0, xmmword [rsp + 0x380]
movaps xmm1, xmmword [rsp + 0x390]
movups xmmword [rsp + 0x2b8], xmm0
movups xmmword [rsp + 0x2c8], xmm1
mov qword [rsp + 0x2d8], rsi
mov qword [rsp + 0x2e0], rdi
xorps xmm8, xmm8
movups xmmword [rsp + 0x318], xmm8
movups xmmword [rsp + 0x328], xmm8
mov qword [rsp + 0x1e0], r14
mov qword [rsp + 0x1e8], r15
mov qword [rsp + 0x1f0], 9
and qword [rsp + 0x1f8], 0
movabs rsi, 0x8000000000000000
mov eax, 1
mov qword [rsp + 0x200], rax
movups xmmword [rsp + 0x208], xmm8
mov qword [rsp + 0x218], rax
and qword [rsp + 0x220], 0
mov qword [rsp + 0x228], rsi
and qword [rsp + 0x240], 0
and dword [rsp + 0x248], 0
and qword [rsp + 0x250], 0
mov eax, 8
mov qword [rsp + 0x258], rax
and qword [rsp + 0x260], 0
mov byte [rsp + 0x268], 0
and qword [rsp + 0x270], 0
mov qword [rsp + 0x278], rax
and qword [rsp + 0x280], 0
mov qword [rsp + 0x288], 2
mov qword [rsp + 0x290], rbx
and qword [rsp + 0x298], 0
and qword [rsp + 0x338], 0
movdqu xmm6, xmmword [0x1400b80d0]
movdqu xmmword [rsp + 0x2f8], xmm6
movdqu xmm7, xmmword [0x1400b80c0]
movdqu xmmword [rsp + 0x2e8], xmm7
mov qword [rsp + 0x308], r12
mov qword [rsp + 0x310], r13
mov qword [rsp + 0x378], rbp
and qword [rsp + 0x2a0], 0
mov qword [rsp + 0x2a8], rax
and qword [rsp + 0x2b0], 0
mov r14, qword [rsp + 0x68]
cmp byte [r14 + 4], 0
je 0x1400422e4
lea rsi, [rsp + 0x380]
movaps xmmword [rsi], xmm8
movaps xmmword [rsi + 0x30], xmm8
movaps xmmword [rsi + 0x20], xmm8
movaps xmmword [rsi + 0x10], xmm8
mov dword [rsi], 0x40
nop
push rsi
pop rcx
call sub.KERNEL32.dll_GlobalMemoryStatusEx
movups xmm0, xmmword [rsi + 8]
movups xmmword [rsp + 0x318], xmm0
lea rcx, [rsp + 0x500]
movaps xmmword [rcx + 0x50], xmm8
movaps xmmword [rcx + 0x40], xmm8
movaps xmmword [rcx + 0x30], xmm8
movaps xmmword [rcx + 0x20], xmm8
movaps xmmword [rcx + 0x10], xmm8
movaps xmmword [rcx], xmm8
and qword [rcx + 0x60], 0
mov edx, 0x68
call sub.PSAPI.DLL_GetPerformanceInfo
cmp eax, 1
jne 0x1400422da
mov rdx, qword [rsp + 0x510]
mov r9, qword [rsp + 0x520]
xor r10d, r10d
sub rdx, r9
cmovb rdx, r10
mov rcx, qword [rsp + 0x550]
push rcx
nop
pop rax
mul rdx
mov r8, rax
mov r11, 0xffffffffffffffff
cmovo r8, r11
mov rdx, qword [rsp + 0x508]
sub rdx, r9
cmovb rdx, r10
mov rax, rcx
mul rdx
cmovo rax, r11
mov qword [rsp + 0x328], r8
mov qword [rsp + 0x330], rax
movabs rsi, 0x8000000000000000
cmp byte [r14 + 0xb], 2
je 0x1400426be
lea r12, [rsp + 0x228]
lea r15, [rsp + 0x338]
mov bpl, byte [r14 + 0xc]
cmp qword [r15], 0
je 0x140042419
mov rcx, qword [rsp + 0x368]
call sub.pdh.dll_PdhCollectQueryData
cmp qword [rsp + 0x228], rsi
je 0x14004234c
mov rcx, r15
mov rdx, r12
call fcn.14004639f
test eax, eax
je 0x140044d80
movss xmm1, dword [0x14004b9f0]
subss xmm1, xmm0
movss dword [rsp + 0x248], xmm1
mov edx, ebp
and dl, 1
lea rcx, [rsp + 0x1e0]
call fcn.14004637d
push rax
pop rdi
nop
nop
push rdx
pop rbx
add rdi, 0x48
movss xmm8, dword [0x14004b9f0]
lea rax, [rdi - 0x48]
cmp rax, rbx
je 0x1400423a5
cmp qword [rdi], rsi
je 0x14004239f
mov rcx, r15
mov rdx, rdi
call fcn.14004639f
test eax, eax
je 0x140044d32
movaps xmm1, xmm8
subss xmm1, xmm0
movss dword [rdi + 0x20], xmm1
add rdi, 0x70
jmp 0x140042371
test bpl, 1
je 0x1400426be
cmp byte [rsp + 0x268], 0
jne 0x1400426be
mov rsi, qword [rsp + 0x260]
lea rdi, [rsp + 0x500]
push rdi
pop rcx
nop
nop
push rsi
pop rdx
call fcn.1400457c2
mov rbx, qword [rsp + 0x258]
mov rcx, qword [rdi]
mov rdx, qword [rdi + 8]
mov rax, qword [rdi + 0x10]
shl rax, 3
imul r8, rsi, 0x70
sub r9d, r9d
mov r10, rbx
test r8, r8
je 0x14004243c
cmp rax, r9
je 0x14004243c
mov r11, qword [rdx + r9]
mov qword [r10 + 0x60], r11
add r10, 0x70
add r9, 8
add r8, 0xffffffffffffff90
jmp 0x1400423f9
lea r8, [rsp + 0x380]
and qword [r8], 0
sub ecx, ecx
sub edx, edx
call sub.pdh.dll_PdhOpenQueryA
test eax, eax
je 0x140042453
lea rbx, [rsp + 0x110]
jmp 0x140042482
call fcn.1400403db
or rsi, rsi
je 0x1400426ac
mov rax, qword [rbx + 0x60]
jmp 0x1400426ae
mov rsi, qword [rsp + 0x380]
lea rbx, [rsp + 0x500]
push rbx
pop rcx
nop
call fcn.140044d99
nop
push rbx
pop rcx
call fcn.140044eef
lea rcx, [0x1400b80b0]
mov qword [rsp + 0x110], rcx
and qword [rbx], 0
mov rcx, qword [rsp + 0x110]
mov qword [rsp + 0x338], rcx
and qword [rsp + 0x350], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x340], xmm0
mov qword [rsp + 0x358], rax
mov qword [rsp + 0x360], rdx
mov qword [rsp + 0x368], rsi
mov rax, qword [rsp + 0x500]
mov qword [rsp + 0x370], rax
or rcx, rcx
je 0x1400426be
mov byte [rsp + 0x58], bpl
and bpl, 1
sub eax, eax
mov qword [rsp + 0x40], rax
mov ecx, 0x1e
xor edx, edx
call fcn.14000e00d
movups xmm0, xmmword [str.Processor__Total___Idle_Timetot_0Processor____Idle_Time]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [0x1400b8a76]
movups xmmword [rdx + 0xe], xmm0
lea rsi, [rsp + 0x380]
mov qword [rsi], rax
mov qword [rsi + 8], rdx
mov qword [rsi + 0x10], 0x1e
mov ecx, 5
sub edx, edx
call fcn.14000e00d
mov dword [rdx], 0x5f746f74
mov byte [rdx + 4], 0x30
lea r9, [rsp + 0x500]
mov qword [r9], rax
mov qword [r9 + 8], rdx
mov qword [r9 + 0x10], 5
push rsi
nop
pop rcx
mov rdx, r15
mov r8, r12
call fcn.140046017
lea rcx, [rsp + 0x1e0]
mov edx, ebp
call fcn.14004637d
mov r15, rax
mov qword [rsp + 0x48], rdx
mov r14d, 2
mov r13d, 1
cmp r15, qword [rsp + 0x48]
je 0x140042677
mov rax, qword [rsp + 0x40]
mov qword [rsp + 0xd0], rax
inc rax
mov qword [rsp + 0x40], rax
lea rax, [0x1400b8aa8]
mov qword [rsp + 0x500], rax
mov qword [rsp + 0x508], r14
and qword [rsp + 0x520], 0
lea rsi, [rsp + 0xd0]
mov qword [rsp + 0x70], rsi
lea rbx, [fcn.140003f70]
mov qword [rsp + 0x78], rbx
lea rbp, [rsp + 0x70]
mov qword [rsp + 0x510], rbp
mov qword [rsp + 0x518], r13
lea rdi, [rsp + 0x110]
mov rcx, rdi
lea r12, [rsp + 0x500]
mov rdx, r12
call fcn.14003e378
lea rax, str.cannot_access_a_Thread_Local_Storage_value_during_or_after_destruction_rustc_25ef9e3d85d934b27d9dada2f9dd52b1dc63bb04library_std_src_threadlocal.rs
mov qword [rsp + 0x500], rax
mov qword [rsp + 0x508], r14
and qword [rsp + 0x520], 0
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x510], rbp
mov qword [rsp + 0x518], r13
lea rsi, [rsp + 0x380]
nop
push rsi
pop rcx
mov rdx, r12
call fcn.14003e378
lea r8, [r15 + 0x48]
nop
push rdi
pop rcx
lea rdx, [rsp + 0x338]
mov r9, rsi
call fcn.140046017
add r15, 0x70
jmp 0x140042581
cmp qword [rsp + 0x338], 0
movabs rsi, 0x8000000000000000
mov r14, qword [rsp + 0x68]
mov bpl, byte [rsp + 0x58]
lea r15, [rsp + 0x338]
lea r12, [rsp + 0x228]
jne 0x14004230d
jmp 0x1400426be
xor eax, eax
mov qword [rsp + 0x240], rax
mov byte [rsp + 0x268], 1
cmp byte [r14 + 6], 0
je 0x1400429c8
lea rsi, [rsp + 0x380]
push rsi
pop rcx
nop
call fcn.140045ae0
cmp dword [rsi], 2
je 0x1400428fe
mov rax, qword [rsp + 0x3b0]
lea rdx, [rsp + 0x500]
mov qword [rdx + 0x30], rax
movups xmm0, xmmword [rsp + 0x380]
movups xmm1, xmmword [rsp + 0x390]
movups xmm2, xmmword [rsp + 0x3a0]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0x110]
nop
push rsi
pop rcx
call fcn.140045b0c
cmp qword [rsi], 2
je 0x1400428fe
mov rax, qword [rsp + 0x140]
lea rdx, [rsp + 0x500]
mov qword [rdx + 0x30], rax
movups xmm0, xmmword [rsp + 0x110]
movups xmm1, xmmword [rsp + 0x120]
movups xmm2, xmmword [rsp + 0x130]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0x70]
mov rcx, rsi
call fcn.140045b86
cmp qword [rsi], 2
je 0x1400428fe
mov rax, qword [rsp + 0xa0]
lea rdx, [rsp + 0x500]
mov qword [rdx + 0x30], rax
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rsp + 0x80]
movups xmm2, xmmword [rsp + 0x90]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0xd0]
mov rcx, rsi
call fcn.140045c1c
cmp qword [rsi], 2
je 0x1400428fe
mov rax, qword [rsp + 0x100]
lea rdx, [rsp + 0x500]
mov qword [rdx + 0x30], rax
movups xmm0, xmmword [rsp + 0xd0]
movups xmm1, xmmword [rsp + 0xe0]
movups xmm2, xmmword [rsp + 0xf0]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0x1a0]
nop
push rsi
pop rcx
call fcn.140045ce6
cmp qword [rsi], 2
je 0x1400428fe
mov rax, qword [rsp + 0x1d0]
lea rdx, [rsp + 0x500]
mov qword [rdx + 0x30], rax
movups xmm0, xmmword [rsp + 0x1a0]
movups xmm1, xmmword [rsp + 0x1b0]
movups xmm2, xmmword [rsp + 0x1c0]
movaps xmmword [rdx + 0x20], xmm2
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
lea rsi, [rsp + 0x450]
push rsi
pop rcx
nop
call fcn.140045d63
mov rax, qword [rsi]
cmp rax, 2
je 0x1400428fe
movups xmm0, xmmword [rsp + 0x458]
movups xmm1, xmmword [rsp + 0x468]
movups xmm2, xmmword [rsp + 0x478]
lea rsi, [rsp + 0x4c8]
movups xmmword [rsi + 0x28], xmm2
movups xmmword [rsi + 0x18], xmm1
movups xmmword [rsi + 8], xmm0
mov qword [rsi], rax
lea rdi, [rsp + 0x70]
nop
push rdi
pop rcx
push rsi
pop rdx
nop
mov r8b, 1
call fcn.140045e42
mov rax, qword [rsi + 0x30]
mov qword [rsp + 0x530], rax
movups xmm0, xmmword [rsi]
movups xmm1, xmmword [rsi + 0x10]
movups xmm2, xmmword [rsi + 0x20]
movaps xmmword [rsp + 0x520], xmm2
movaps xmmword [rsp + 0x510], xmm1
movaps xmmword [rsp + 0x500], xmm0
mov ebp, dword [rdi + 4]
cmp ebp, 2
jne 0x140044c1e
lea rcx, [rsp + 0x500]
call fcn.140040a20
mov esi, 8
xor r14d, r14d
mov rcx, qword [rsp + 0x278]
mov rdx, qword [rsp + 0x280]
call fcn.1400409e2
mov rcx, qword [rsp + 0x270]
mov rdx, qword [rsp + 0x278]
call fcn.140040ae5
mov qword [rsp + 0x270], r14
mov qword [rsp + 0x278], rsi
mov qword [rsp + 0x280], r14
mov r15, qword [rsp + 0x68]
cmp byte [r15 + 1], 0
je 0x140042c9a
lea rcx, [rsp + 0x70]
and qword [rcx], 0
call sub.IPHLPAPI.DLL_GetIfTable2
or eax, eax
jne 0x140043bd3
lea r8, [rsp + 0x308]
mov rax, qword [r8 - 0x20]
mov rcx, qword [r8 - 0x18]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [r8 - 8]
lea rsi, [rsp + 0x500]
mov qword [rsi], rax
add rax, 0x10
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov word [rsi + 0x18], dx
mov qword [rsi + 0x20], r8
push rsi
nop
pop rcx
call fcn.140040be6
test rax, rax
je 0x140042dd2
mov byte [rdx + 0x6e], 0
jmp 0x1400429b1
cmp byte [r14 + 5], 0
je 0x140042948
mov rsi, qword [rsp + 0x278]
lea r14, [rsp + 0x388]
imul rbp, qword [rsp + 0x280], 0x60
lea rdi, [rsp + 0x110]
lea rbx, [rsp + 0x70]
lea r15, [rsp + 0x500]
lea r12, [rsp + 0xd0]
lea r13, [rsp + 0x380]
or rbp, rbp
je 0x140042948
mov rax, qword [rsi]
cmp rax, 2
jne 0x140042b9c
nop
push rdi
pop rcx
call fcn.140045ae0
cmp dword [rsp + 0x110], 2
je 0x140042b41
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x530], rax
movups xmm0, xmmword [rsp + 0x110]
movups xmm1, xmmword [rsp + 0x120]
movups xmm2, xmmword [rsp + 0x130]
movaps xmmword [rsp + 0x520], xmm2
movaps xmmword [rsp + 0x510], xmm1
movaps xmmword [rsp + 0x500], xmm0
push rbx
pop rcx
nop
mov rdx, r15
call fcn.140045b0c
cmp qword [rsp + 0x70], 2
je 0x140042b41
mov rax, qword [rsp + 0xa0]
mov qword [rsp + 0x530], rax
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rsp + 0x80]
movups xmm2, xmmword [rsp + 0x90]
movaps xmmword [rsp + 0x520], xmm2
movaps xmmword [rsp + 0x510], xmm1
movaps xmmword [rsp + 0x500], xmm0
mov rcx, r12
mov rdx, r15
call fcn.140045b86
cmp qword [rsp + 0xd0], 2
je 0x140042b41
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x530], rax
movups xmm0, xmmword [rsp + 0xd0]
movups xmm1, xmmword [rsp + 0xe0]
movups xmm2, xmmword [rsp + 0xf0]
movaps xmmword [rsp + 0x520], xmm2
movaps xmmword [rsp + 0x510], xmm1
movaps xmmword [rsp + 0x500], xmm0
mov rcx, rdi
mov rdx, r15
call fcn.140045c1c
cmp qword [rsp + 0x110], 2
jne 0x140042c4a
mov qword [rsp + 0x70], 2
push rsi
pop rcx
nop
call fcn.140040a16
mov rax, qword [rsp + 0xa0]
mov qword [rsi + 0x30], rax
movups xmm0, xmmword [rsp + 0x70]
movups xmm1, xmmword [rsp + 0x80]
movups xmm2, xmmword [rsp + 0x90]
movups xmmword [rsi + 0x20], xmm2
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
mov rax, qword [rsi]
mov qword [rsi], 2
cmp rax, 2
jne 0x140042ba3
mov qword [rsp + 0x500], 2
jmp 0x140042bd0
mov qword [rsi], 2
mov qword [rsp + 0x380], rax
movups xmm0, xmmword [rsi + 8]
movups xmm1, xmmword [rsi + 0x18]
movups xmm2, xmmword [rsi + 0x28]
movups xmmword [r14 + 0x20], xmm2
movups xmmword [r14 + 0x10], xmm1
movups xmmword [r14], xmm0
mov rcx, r15
mov rdx, r13
call fcn.140045d63
push rsi
pop rcx
nop
call fcn.140040a16
mov rax, qword [rsp + 0x530]
mov qword [rsi + 0x30], rax
movups xmm0, xmmword [rsp + 0x500]
movups xmm1, xmmword [rsp + 0x510]
movups xmm2, xmmword [rsp + 0x520]
movups xmmword [rsi + 0x20], xmm2
movups xmmword [rsi + 0x10], xmm1
movups xmmword [rsi], xmm0
cmp dword [rsi], 2
je 0x140042c3d
mov rcx, r15
nop
push rsi
pop rdx
sub r8d, r8d
call fcn.140045e42
cmp dword [rsp + 0x504], 2
je 0x140042c3d
movss xmm0, dword [rsp + 0x500]
movss dword [rsi + 0x58], xmm0
ucomiss xmm0, dword [rsi + 0x5c]
jbe 0x140042c3d
movss dword [rsi + 0x5c], xmm0
add rsi, 0x60
add rbp, 0xffffffffffffffa0
jmp 0x140042a11
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x530], rax
movups xmm0, xmmword [rsp + 0x110]
movups xmm1, xmmword [rsp + 0x120]
movups xmm2, xmmword [rsp + 0x130]
movaps xmmword [rsp + 0x520], xmm2
movaps xmmword [rsp + 0x510], xmm1
movaps xmmword [rsp + 0x500], xmm0
nop
push rbx
pop rcx
mov rdx, r15
call fcn.140045ce6
jmp 0x140042b4a
cmp byte [r15], 0
je 0x140043bd3
lea rsi, [rsp + 0x500]
mov r8d, 0x548
mov rcx, rsi
xor edx, edx
call sub.msvcrt.dll_memset
mov rax, qword [rsp + 0x2e8]
mov rcx, qword [rsp + 0x2f0]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [rsp + 0x300]
lea rdi, [rsp + 0x380]
mov qword [rdi], rax
add rax, 0x10
mov qword [rdi + 8], rax
mov qword [rdi + 0x10], rcx
mov word [rdi + 0x18], dx
mov qword [rdi + 0x20], r8
mov r14, 0xffffffffffffffff
push rdi
pop rcx
nop
call fcn.140040be6
test rax, rax
je 0x140043bd3
push rdx
nop
pop rbx
mov rax, qword [rdx]
mov qword [rsp + 0x500], rax
and dword [rsp + 0x508], 0
push rsi
pop rcx
nop
call sub.IPHLPAPI.DLL_GetIfEntry2
or eax, eax
jne 0x140042d0a
mov rax, qword [rbx + 8]
mov rcx, qword [rbx + 0x18]
mov qword [rbx + 0x10], rax
mov rax, qword [rsp + 0xa00]
mov qword [rbx + 8], rax
mov qword [rbx + 0x20], rcx
mov rax, qword [rsp + 0x9b8]
mov qword [rbx + 0x18], rax
mov rax, qword [rbx + 0x28]
mov qword [rbx + 0x30], rax
mov rax, qword [rsp + 0x9c0]
add rax, qword [rsp + 0x9c8]
cmovb rax, r14
mov qword [rbx + 0x28], rax
mov rax, qword [rbx + 0x38]
mov qword [rbx + 0x40], rax
mov rax, qword [rsp + 0xa08]
add rax, qword [rsp + 0xa10]
cmovb rax, r14
mov qword [rbx + 0x38], rax
mov rax, qword [rbx + 0x48]
mov qword [rbx + 0x50], rax
mov rax, qword [rsp + 0x9d8]
mov qword [rbx + 0x48], rax
mov rax, qword [rbx + 0x58]
mov qword [rbx + 0x60], rax
mov rax, qword [rsp + 0xa20]
mov qword [rbx + 0x58], rax
jmp 0x140042d0a
lea rsi, [rsp + 0x500]
nop
push rsi
pop rcx
call fcn.140044d99
nop
push rsi
pop rcx
call fcn.140044eef
movdqa xmmword [rsi], xmm7
movdqa xmmword [rsi + 0x10], xmm6
lea rcx, [rsp + 0x520]
mov qword [rcx], rax
lea rax, [rsp + 0x110]
and qword [rax], 0
mov qword [rax + 8], 8
and qword [rax + 0x10], 0
mov qword [rcx + 8], rdx
mov r14, qword [rsp + 0x70]
mov ebx, dword [r14]
add r14, 8
lea r15, [rsp + 0x380]
pcmpeqd xmm6, xmm6
xor r13d, r13d
mov qword [rsp + 0xb0], r14
mov qword [rsp + 0x60], rbx
cmp r13, rbx
je 0x14004313f
mov rsi, r13
inc r13
imul rdi, rsi, 0x548
cmp qword [r14 + rdi + 0x4a8], 0
jne 0x140042e6f
cmp qword [r14 + rdi + 0x4b0], 0
je 0x140042e43
cmp dword [r14 + rdi + 0x48c], 2
je 0x140042e43
cmp dword [r14 + rdi + 0x420], 0
je 0x140042e43
mov qword [rsp + 0x48], r13
mov ecx, 0x14
mov edx, 2
call fcn.14000b8a9
mov r12, rax
mov eax, dword [r14 + rdi + 0x10]
movzx ecx, byte [r14 + rdi + 0x14]
movzx edx, byte [r14 + rdi + 0x15]
movzx r8d, byte [r14 + rdi + 0x16]
movzx r9d, byte [r14 + rdi + 0x17]
movzx r10d, byte [r14 + rdi + 0x18]
movzx r11d, byte [r14 + rdi + 0x19]
movzx ebx, byte [r14 + rdi + 0x1a]
movzx edi, byte [r14 + rdi + 0x1b]
mov dword [r12], eax
mov word [r12 + 4], cx
mov word [r12 + 6], dx
mov word [r12 + 8], r8w
mov word [r12 + 0xa], r9w
mov word [r12 + 0xc], r10w
mov word [r12 + 0xe], r11w
mov word [r12 + 0x10], bx
mov word [r12 + 0x12], di
mov ecx, 0xa
xor edx, edx
call fcn.14003beaf
mov qword [rsp + 0x58], rax
nop
push rdx
pop rdi
movups xmm0, xmmword [r12]
movups xmmword [rdx], xmm0
mov eax, dword [r12 + 0x10]
mov dword [rdx + 0x10], eax
mov rcx, qword [rsp + 0x520]
mov rdx, qword [rsp + 0x528]
mov r9d, 0xa
mov r8, rdi
call fcn.14004041d
mov r14, qword [rsp + 0x500]
mov r13, qword [rsp + 0x508]
mov rbx, r13
and rbx, rax
mov qword [rsp + 0xc0], rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
sub eax, eax
mov qword [rsp + 0x40], rax
movdqu xmm8, xmmword [r14 + rbx]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0x380], ax
mov rcx, r15
call fcn.14003f044
test rax, rax
je 0x140042fd6
add rdx, rbx
and rdx, r13
shl rdx, 5
mov rbp, r14
sub rbp, rdx
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x10]
mov r9d, 0xa
mov r8, rdi
call fcn.14004054e
test al, al
je 0x140042f9d
jmp 0x140043002
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x1400430ad
mov rax, qword [rsp + 0x40]
add rbx, rax
add rbx, 0x10
add rax, 0x10
mov qword [rsp + 0x40], rax
and rbx, r13
jmp 0x140042f82
movabs rax, 0x8000000000000000
mov rcx, qword [rsp + 0x58]
cmp rcx, rax
je 0x14004301e
mov rdx, rdi
call fcn.14003b970
mov r14, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0x60]
mov r13, qword [rsp + 0x48]
mov eax, dword [rbp - 8]
inc eax
mov dword [rbp - 8], eax
cmp eax, 1
jle 0x14004304f
mov ecx, 0xa
mov rdx, r12
call fcn.14003b970
jmp 0x140042e43
mov rdx, qword [rsp + 0x120]
cmp rdx, qword [rsp + 0x110]
jne 0x140043076
lea rcx, [rsp + 0x110]
call fcn.140040897
mov rdx, qword [rsp + 0x120]
mov rax, qword [rsp + 0x118]
push rdx
pop rcx
nop
shl rcx, 5
mov dword [rax + rcx], esi
mov r8d, 0xa
mov qword [rax + rcx + 8], r8
mov qword [rax + rcx + 0x10], r12
mov qword [rax + rcx + 0x18], r8
inc rdx
mov qword [rsp + 0x120], rdx
jmp 0x140042e43
cmp qword [rsp + 0x510], 0
je 0x140043115
mov rcx, r14
mov rdx, r13
mov r8, qword [rsp + 0xc0]
call fcn.140040c06
mov rcx, qword [rsp + 0x500]
shl rax, 5
push rcx
pop rbp
nop
and dl, 1
movzx edx, dl
sub qword [rsp + 0x510], rdx
sub rbp, rax
neg rax
mov rdx, qword [rsp + 0x58]
mov qword [rcx + rax - 0x20], rdx
mov qword [rbp - 0x18], rdi
mov qword [rbp - 0x10], 0xa
and dword [rbp - 8], 0
inc qword [rsp + 0x518]
jmp 0x14004301e
lea rcx, [rsp + 0x500]
lea rdx, [rsp + 0x520]
call fcn.140041168
mov r14, qword [rsp + 0x500]
mov r13, qword [rsp + 0x508]
jmp 0x1400430b8
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x4b0], rax
mov rax, qword [rsp + 0x118]
mov rbx, qword [rsp + 0x120]
shl rbx, 5
add rbx, rax
lea r15, [rsp + 0x380]
pcmpeqd xmm6, xmm6
mov qword [rsp + 0x4a8], rax
mov r12, rax
mov qword [rsp + 0xc0], rbx
mov rdi, r12
cmp r12, rbx
movabs rax, 0x8000000000000000
je 0x1400436f3
lea r12, [rdi + 0x20]
mov r13, qword [rdi + 8]
cmp r13, rax
je 0x1400436f0
mov rsi, qword [rdi + 0x10]
mov edx, dword [rdi]
cmp qword [rsp + 0x518], 0
je 0x1400432e2
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x48], r12
mov rdi, qword [rdi + 0x18]
mov rcx, qword [rsp + 0x520]
mov rdx, qword [rsp + 0x528]
mov r8, rsi
mov r9, rdi
call fcn.14004041d
mov rbp, qword [rsp + 0x500]
mov r12, qword [rsp + 0x508]
mov r13, r12
and r13, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
sub eax, eax
mov qword [rsp + 0x40], rax
movdqu xmm8, xmmword [rbp + r13]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0x380], ax
mov rcx, r15
call fcn.14003f044
mov rbx, rax
test rax, rax
je 0x14004327d
mov r14, rdx
add r14, r13
and r14, r12
mov rax, r14
shl rax, 5
push rbp
nop
pop rcx
sub rcx, rax
mov r8, qword [rcx - 0x18]
mov r9, qword [rcx - 0x10]
push rsi
pop rcx
nop
push rdi
pop rdx
nop
call fcn.14004054e
test al, al
je 0x14004323e
jmp 0x1400432a8
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
test eax, eax
jne 0x1400432a8
mov rax, qword [rsp + 0x40]
add r13, rax
add r13, 0x10
add rax, 0x10
mov qword [rsp + 0x40], rax
and r13, r12
jmp 0x140043222
shl r14, 5
sub rbp, r14
or rbx, rbx
cmove rbp, rbx
add rbp, 0xffffffffffffffe0
or rbx, rbx
cmove rbp, rbx
mov r14, qword [rsp + 0xb0]
mov rbx, qword [rsp + 0xc0]
mov r12, qword [rsp + 0x48]
mov r13, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
jmp 0x1400432e4
sub ebp, ebp
lea rax, [rbp + 0x18]
or rbp, rbp
lea rcx, [0x1400b86c0]
cmove rax, rcx
cmp dword [rax], 1
jg 0x14004353e
imul rdi, rdx, 0x548
lea rbp, [r14 + rdi]
lea rcx, [r14 + rdi]
add rcx, 0x1c
xor r8d, r8d
cmp r8, 0x101
je 0x14004332b
cmp word [rcx + r8*2], 0
je 0x140043331
inc r8
jmp 0x140043315
mov r8d, 0x101
mov edx, 0x101
lea r9, str._home_torcrypt_.cargo_registry_src_index.crates.io_6f17d22bba15001f_sysinfo_0.29.11_src_windows_network.rs
call fcn.14003bc8f
mov r8, rdx
mov rcx, r15
nop
push rax
pop rdx
call fcn.140003c30
mov rcx, qword [rsp + 0x380]
movabs rax, 0x8000000000000000
cmp rcx, rax
je 0x14004353e
mov qword [rsp + 0x188], rbp
mov qword [rsp + 0x1d8], rcx
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x48], r12
mov rbp, qword [rsp + 0x388]
mov r14, qword [rsp + 0x390]
mov rcx, qword [rsp + 0x308]
mov rdx, qword [rsp + 0x310]
mov r8, rbp
mov r9, r14
call fcn.1400404b3
mov r13, qword [rsp + 0x2e8]
mov rbx, qword [rsp + 0x2f0]
mov r12, rbx
and r12, rax
mov qword [rsp + 0x4b8], rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
xor eax, eax
mov qword [rsp + 0x40], rax
movdqu xmm8, xmmword [r13 + r12]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0x380], ax
mov rcx, r15
call fcn.14003f044
test rax, rax
je 0x140043444
add rdx, r12
and rdx, rbx
neg rdx
imul rdi, rdx, 0x88
mov rcx, qword [r13 + rdi - 0x80]
mov rdx, qword [r13 + rdi - 0x78]
mov r8, rbp
mov r9, r14
call fcn.140040549
test al, al
je 0x14004340c
jmp 0x140043470
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
or eax, eax
jne 0x14004354e
mov rax, qword [rsp + 0x40]
add r12, rax
add r12, 0x10
add rax, 0x10
mov qword [rsp + 0x40], rax
and r12, rbx
jmp 0x1400433f0
add r13, rdi
mov rax, qword [r13 - 0x68]
mov rcx, qword [r13 - 0x58]
mov qword [r13 - 0x60], rax
mov r14, qword [rsp + 0xb0]
mov rdx, qword [rsp + 0x60]
mov rax, qword [r14 + rdx + 0x500]
mov qword [r13 - 0x68], rax
mov qword [r13 - 0x50], rcx
mov rax, qword [r14 + rdx + 0x4b8]
mov qword [r13 - 0x58], rax
mov rax, qword [r13 - 0x48]
mov qword [r13 - 0x40], rax
mov rax, qword [r14 + rdx + 0x4c0]
add rax, qword [r14 + rdx + 0x4c8]
mov rcx, 0xffffffffffffffff
cmovb rax, rcx
mov qword [r13 - 0x48], rax
mov rax, qword [r13 - 0x38]
mov qword [r13 - 0x30], rax
mov rax, qword [r14 + rdx + 0x508]
add rax, qword [r14 + rdx + 0x510]
cmovb rax, rcx
mov qword [r13 - 0x38], rax
mov rax, qword [r13 - 0x28]
mov qword [r13 - 0x20], rax
mov rax, qword [r14 + rdx + 0x4d8]
mov qword [r13 - 0x28], rax
mov rax, qword [r13 - 0x18]
mov qword [r13 - 0x10], rax
mov rax, qword [r14 + rdx + 0x520]
mov qword [r13 - 0x18], rax
mov byte [r13 - 2], 1
mov rcx, qword [rsp + 0x1d8]
mov rdx, rbp
call fcn.14000c812
mov rbx, qword [rsp + 0xc0]
mov r12, qword [rsp + 0x48]
mov r13, qword [rsp + 0x58]
mov rcx, r13
mov rdx, rsi
call fcn.14003b970
jmp 0x140043185
cmp qword [rsp + 0x2f8], 0
je 0x1400436c6
mov rdi, qword [rsp + 0xb0]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rdi + rcx + 0x4c0]
add rdx, qword [rdi + rcx + 0x4c8]
mov rax, qword [rdi + rcx + 0x4b8]
mov qword [rsp + 0x40], rax
mov rax, 0xffffffffffffffff
cmovb rdx, rax
mov qword [rsp + 0x4a0], rdx
mov r12, qword [rdi + rcx + 0x508]
add r12, qword [rdi + rcx + 0x510]
cmovb r12, rax
mov rax, qword [rsp + 0x188]
mov rax, qword [rax]
mov qword [rsp + 0x498], rax
mov rax, qword [rdi + rcx + 0x500]
mov qword [rsp + 0x490], rax
mov rax, qword [rdi + rcx + 0x4d8]
mov qword [rsp + 0x188], rax
mov rax, qword [rdi + rcx + 0x520]
mov qword [rsp + 0x60], rax
mov rcx, r13
nop
push rbx
pop rdx
mov r8, qword [rsp + 0x4b8]
call fcn.140040c06
mov rcx, qword [rsp + 0x2e8]
neg rax
and dl, 1
movzx edx, dl
sub qword [rsp + 0x2f8], rdx
imul rax, rax, 0x88
mov rdx, qword [rsp + 0x1d8]
mov qword [rcx + rax - 0x88], rdx
mov qword [rcx + rax - 0x80], rbp
mov qword [rcx + rax - 0x78], r14
mov r14, rdi
mov rdx, qword [rsp + 0x498]
mov qword [rcx + rax - 0x70], rdx
mov rdx, qword [rsp + 0x490]
mov qword [rcx + rax - 0x68], rdx
mov qword [rcx + rax - 0x60], rdx
mov rdx, qword [rsp + 0x40]
mov qword [rcx + rax - 0x58], rdx
mov qword [rcx + rax - 0x50], rdx
mov rdx, qword [rsp + 0x4a0]
mov qword [rcx + rax - 0x48], rdx
mov qword [rcx + rax - 0x40], rdx
mov qword [rcx + rax - 0x38], r12
mov qword [rcx + rax - 0x30], r12
mov rdx, qword [rsp + 0x188]
mov qword [rcx + rax - 0x28], rdx
mov qword [rcx + rax - 0x20], rdx
mov rdx, qword [rsp + 0x60]
mov qword [rcx + rax - 0x18], rdx
mov qword [rcx + rax - 0x10], rdx
and dword [rcx + rax - 8], 0
and word [rcx + rax - 4], 0
mov byte [rcx + rax - 2], 1
inc qword [rsp + 0x300]
jmp 0x14004352c
lea rcx, [rsp + 0x2e8]
lea rdx, [rsp + 0x308]
call fcn.140040cc0
mov r13, qword [rsp + 0x2e8]
mov rbx, qword [rsp + 0x2f0]
jmp 0x14004355d
mov rdi, r12
sub rbx, rdi
shr rbx, 5
add rdi, 0x10
lea r14, [rsp + 0x2e8]
sub rbx, 1
jb 0x14004371e
mov rcx, qword [rdi - 8]
mov rdx, qword [rdi]
call fcn.14003b970
add rdi, 0x20
jmp 0x140043706
mov r8, qword [rsp + 0x4b0]
test r8, r8
je 0x140043741
shl r8, 5
mov edx, 8
mov rcx, qword [rsp + 0x4a8]
call fcn.14003b512
mov rcx, qword [rsp + 0x70]
call sub.IPHLPAPI.DLL_FreeMibTable
mov rdx, qword [rsp + 0x508]
test rdx, rdx
je 0x140043846
mov rcx, qword [rsp + 0x500]
mov rax, qword [rsp + 0x518]
test rax, rax
je 0x14004383b
add rdx, rcx
inc rdx
movdqa xmm0, xmmword [rcx]
pmovmskb r8d, xmm0
not r8d
lea rsi, [rsp + 0x398]
mov qword [rsi - 0x18], rcx
add rcx, 0x10
mov qword [rsi - 0x10], rcx
mov qword [rsi - 8], rdx
mov word [rsi], r8w
mov qword [rsi + 8], rax
mov edi, 1
test rdi, rdi
je 0x14004382b
push rsi
pop rcx
nop
call fcn.14003f044
cmp rax, 1
je 0x1400437f3
mov rax, qword [rsp + 0x388]
movdqa xmm0, xmmword [rax]
pmovmskb ecx, xmm0
not ecx
mov word [rsp + 0x398], cx
add qword [rsp + 0x380], 0xfffffffffffffe00
add rax, 0x10
mov qword [rsp + 0x388], rax
jmp 0x1400437b1
shl rdx, 5
mov rax, qword [rsp + 0x380]
mov rdi, qword [rsp + 0x3a0]
mov rcx, rax
sub rcx, rdx
dec rdi
mov qword [rsp + 0x3a0], rdi
mov rcx, qword [rcx - 0x20]
neg rdx
mov rdx, qword [rax + rdx - 0x18]
call fcn.14003b970
jmp 0x1400437ac
mov rcx, qword [rsp + 0x500]
mov rdx, qword [rsp + 0x508]
mov r8d, 0x20
call fcn.140040aff
mov rax, qword [rsp + 0x2e8]
mov rcx, qword [rsp + 0x2f0]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [rsp + 0x300]
lea rsi, [rsp + 0x500]
mov qword [rsi], rax
add rax, 0x10
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov word [rsi + 0x18], dx
mov qword [rsi + 0x20], r8
mov ebx, 0x88
push rsi
nop
pop rcx
call fcn.140040357
or rax, rax
je 0x1400438d5
nop
push rax
pop rdi
cmp byte [rax - 2], 0
jne 0x140043892
mov rax, qword [rsp + 0x2e8]
sub rax, rdi
cqo
idiv rbx
mov rcx, r14
nop
push rax
pop rdx
call fcn.140041ee5
mov rcx, qword [rdi - 0x88]
mov rdx, qword [rdi - 0x80]
call fcn.14000c812
jmp 0x140043892
and dword [rsp + 0xd0], 0
lea r15, [rsp + 0x1a0]
mov dword [r15], 0x3c00
mov ebp, 4
xor esi, esi
dec ebp
je 0x1400439cb
mov edx, dword [rsp + 0x1a0]
nop
push rsi
pop rcx
call sub.msvcrt.dll_realloc
or rax, rax
je 0x140043917
push rax
pop rdi
nop
push rax
pop rsi
nop
jmp 0x140043974
mov edi, 0x32
mov ecx, 0x32
xor edx, edx
call fcn.14000e00d
push rax
nop
pop rbx
mov r14, rdx
movups xmm0, xmmword [str.failed_to_allocate_memory_for_IP_ADAPTER_ADDRESSESGetAdaptersAddresses___failed_with_code]
movups xmmword [rdx], xmm0
movups xmm0, xmmword [0x1400b8c12]
movups xmmword [rdx + 0x10], xmm0
movdqu xmm0, xmmword [0x1400b8c22]
movdqu xmmword [rdx + 0x20], xmm0
mov word [rdx + 0x30], 0x5345
mov rcx, rsi
call sub.msvcrt.dll_free
movabs rsi, 0x8000000000000000
cmp rbx, rsi
jne 0x140044bf8
mov rsi, r14
mov qword [rsp + 0x20], r15
sub ecx, ecx
mov edx, 0xe
sub r8d, r8d
mov r9, rsi
call sub.IPHLPAPI.DLL_GetAdaptersAddresses
mov dword [rsp + 0xd0], eax
cmp eax, 0x6f
je 0x1400438f3
or eax, eax
mov r15, qword [rsp + 0x68]
jne 0x1400439d0
mov qword [rsp + 0x388], rsi
mov qword [rsp + 0x390], rdi
movabs rsi, 0x8000000000000000
mov qword [rsp + 0x380], rsi
push rsi
pop rbx
nop
jmp 0x140043a44
mov r15, qword [rsp + 0x68]
lea rax, [rsp + 0xd0]
mov qword [rsp + 0x110], rax
lea rax, [0x1400b8c60]
lea rdx, [rsp + 0x500]
mov qword [rdx], rax
mov eax, 1
mov qword [rdx + 8], rax
and qword [rdx + 0x20], 0
lea rcx, [0x140005cd0]
mov qword [rsp + 0x118], rcx
lea rcx, [rsp + 0x110]
mov qword [rdx + 0x10], rcx
mov qword [rdx + 0x18], rax
lea rdi, [rsp + 0x380]
mov rcx, rdi
call fcn.14003e378
mov rcx, rsi
call sub.msvcrt.dll_free
mov rbx, qword [rdi]
movabs rsi, 0x8000000000000000
cmp rbx, rsi
jne 0x140043baf
movdqu xmm0, xmmword [rsp + 0x388]
lea rax, [rsp + 0x110]
movdqu xmmword [rax], xmm0
lea rbx, [rsp + 0xd0]
pcmpeqd xmm6, xmm6
lea rcx, [rsp + 0x500]
lea rdx, [rsp + 0x110]
call fcn.140045960
mov r14, qword [rsp + 0x500]
cmp r14, rsi
je 0x140043bc1
mov r15, qword [rsp + 0x508]
cmp qword [rsp + 0x300], 0
je 0x140043b95
mov r12, qword [rsp + 0x510]
mov rcx, qword [rsp + 0x308]
mov rdx, qword [rsp + 0x310]
mov r8, r15
mov r9, r12
call fcn.1400404b3
mov rbp, qword [rsp + 0x2e8]
mov rsi, qword [rsp + 0x2f0]
push rsi
nop
pop rdi
and rdi, rax
shr rax, 0x39
movd xmm0, eax
punpcklbw xmm0, xmm0
pshuflw xmm0, xmm0, 0
pshufd xmm7, xmm0, 0
sub eax, eax
mov qword [rsp + 0x40], rax
movdqu xmm8, xmmword [rbp + rdi]
movdqa xmm0, xmm8
pcmpeqb xmm0, xmm7
pmovmskb eax, xmm0
mov word [rsp + 0xd0], ax
mov rcx, rbx
call fcn.14003f044
test rax, rax
je 0x140043b55
add rdx, rdi
and rdx, rsi
neg rdx
imul r13, rdx, 0x88
mov r8, qword [rbp + r13 - 0x80]
mov r9, qword [rbp + r13 - 0x78]
mov rcx, r15
mov rdx, r12
call fcn.140040549
test al, al
je 0x140043b1d
jmp 0x140043b7d
pcmpeqb xmm8, xmm6
pmovmskb eax, xmm8
or eax, eax
jne 0x140043b95
mov rax, qword [rsp + 0x40]
add rdi, rax
add rdi, 0x10
add rax, 0x10
mov qword [rsp + 0x40], rax
and rdi, rsi
jmp 0x140043b01
add rbp, r13
lea rcx, [rsp + 0x518]
movzx eax, word [rcx + 4]
mov word [rbp - 4], ax
mov eax, dword [rcx]
mov dword [rbp - 8], eax
mov rcx, r14
mov rdx, r15
call fcn.14000c812
movabs rsi, 0x8000000000000000
jmp 0x140043a6e
mov rdx, qword [rsp + 0x388]
push rbx
nop
pop rcx
call fcn.14000c812
jmp 0x140043bd3
mov rcx, qword [rsp + 0x110]
call sub.msvcrt.dll_free
mov r15, qword [rsp + 0x68]
movzx ebp, word [r15 + 8]
cmp bpl, 2
je 0x1400442a2
movzx eax, byte [r15 + 0xa]
shl eax, 0x10
mov ecx, ebp
or ecx, eax
mov word [rsp + 0x54], cx
shr ecx, 0x10
mov byte [rsp + 0x56], cl
mov edi, 0x80000
mov ecx, 0x80000
xor edx, edx
call fcn.14000e00d
lea rbx, [rsp + 0x1a0]
mov qword [rbx], rax
mov qword [rbx + 8], rdx
and qword [rbx + 0x10], 0
lea r14, [rsp + 0x500]
and dword [rsp + 0x500], 0
push rbx
pop rcx
nop
push rdi
nop
pop rdx
call fcn.14000b78d
mov rsi, qword [rsp + 0x1a8]
mov ecx, 5
push rsi
nop
pop rdx
mov r8d, edi
mov r9, r14
call sub.ntdll.dll_NtQuerySystemInformation
cmp eax, 0xc0000004
jne 0x140043c74
mov eax, dword [rsp + 0x500]
add rdi, rdi
lea ecx, [rax + 0x2800]
test eax, eax
cmovne rdi, rcx
jmp 0x140043c27
or eax, eax
jne 0x140043d2f
mov qword [rsp + 0x1b0], rdi
mov ecx, 8
mov edx, 0xfa0
call fcn.14000c493
or rax, rax
je 0x140044d59
lea rdi, [rsp + 0xd0]
mov qword [rdi], 0x1f4
mov qword [rdi + 8], rax
and qword [rdi + 0x10], 0
sub edx, edx
xor ebx, ebx
cmp rdx, qword [rsp + 0xd0]
jne 0x140043cda
push rdi
pop rcx
nop
call fcn.140040683
mov rax, qword [rsp + 0xd8]
mov rdx, qword [rsp + 0xe0]
lea rcx, [rsi + rbx]
mov qword [rax + rdx*8], rcx
mov rdx, qword [rsp + 0xe0]
inc rdx
mov qword [rsp + 0xe0], rdx
mov ecx, dword [rcx]
add rbx, rcx
test rcx, rcx
jne 0x140043cb8
lea rax, [rsp + 0x2b8]
mov qword [rsp + 0x190], rax
test bpl, bpl
je 0x140043d3f
lea rsi, [rsp + 0x1e0]
mov rcx, rsi
sub edx, edx
call fcn.140045064
mov rax, qword [rsi + 0x80]
jmp 0x140043d41
mov rcx, qword [rsp + 0x1a0]
push rsi
pop rdx
nop
jmp 0x14004429d
xor eax, eax
mov qword [rsp + 0xb8], rax
call fcn.140036d50
mov r8d, edx
lea rsi, [rsp + 0x500]
mov rcx, rsi
mov edx, eax
call fcn.140036de0
cmp qword [rsi], 0
je 0x140043d6d
sub eax, eax
jmp 0x140043d75
mov rax, qword [rsp + 0x508]
lea rcx, [rsp + 0x4c8]
mov qword [rcx], rax
mov rbx, qword [rsp + 0xe0]
mov qword [rsp + 0x510], rbx
movups xmm0, xmmword [rsp + 0xd0]
movaps xmmword [rsp + 0x500], xmm0
and qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 8
and qword [rsp + 0x80], 0
lea rax, [rsp + 0x190]
mov qword [rsp + 0x518], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x520], rax
lea rax, [rsp + 0xb8]
mov qword [rsp + 0x528], rax
mov qword [rsp + 0x530], rcx
mov rdi, qword [rsp + 0x500]
cmp rdi, rbx
jb 0x140044d68
lea rsi, [rsp + 0x518]
mov r14, qword [rsi - 0x10]
nop
push rbx
pop rcx
call fcn.1400403b8
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], 1
lea rsi, [rsp + 0x110]
push rsi
nop
pop rcx
nop
push rbx
pop rdx
xor r8d, r8d
mov r9, rax
call fcn.14003bf8d
or rdi, rdi
je 0x140043e5c
shl rdi, 3
mov edx, 8
mov rcx, r14
mov r8, rdi
call fcn.14003b512
mov rax, qword [rsp + 0x120]
sub edx, edx
sub rax, 1
jb 0x140043e7e
mov rsi, qword [rsi]
test rsi, rsi
je 0x140043e7e
add rdx, qword [rsi + 0x10]
add rsi, 0x18
jmp 0x140043e66
lea rcx, [rsp + 0x70]
call fcn.140040576
mov rax, qword [rsp + 0x120]
lea rsi, [rsp + 0x380]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x110]
movaps xmmword [rsi], xmm0
lea rbx, [rsp + 0x508]
lea rdi, [rsp + 0x500]
push rsi
nop
pop rcx
call fcn.14003dde8
or rax, rax
je 0x140043f62
mov r14, qword [rax]
movups xmm0, xmmword [rax + 8]
movaps xmmword [rsp + 0x450], xmm0
push rax
nop
pop rcx
call fcn.14003de16
movabs rax, 0x8000000000000000
cmp r14, rax
je 0x140043f62
mov qword [rsp + 0x500], r14
movaps xmm0, xmmword [rsp + 0x450]
movups xmmword [rbx], xmm0
mov r14, qword [rsp + 0x508]
mov r15, qword [rsp + 0x510]
lea rcx, [rsp + 0x70]
mov rdx, r15
call fcn.140040576
mov r12, qword [rsp + 0x80]
imul rcx, r12, 0x150
add rcx, qword [rsp + 0x78]
imul r8, r15, 0x150
mov rdx, r14
call sub.msvcrt.dll_memcpy
add r12, r15
mov qword [rsp + 0x80], r12
and qword [rsp + 0x510], 0
mov rcx, rdi
call fcn.14003b720
jmp 0x140043eb7
lea rcx, [rsp + 0x380]
call fcn.14003ddb6
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x40], rax
imul rbx, qword [rsp + 0x80], 0x150
mov r13, qword [rsp + 0x78]
lea rax, [rbx + r13]
mov qword [rsp + 0x58], rax
lea r15, [rsp + 0x500]
mov qword [rsp + 0x48], r13
or rbx, rbx
je 0x1400441c5
mov rbp, qword [r13]
cmp rbp, 2
je 0x1400441be
lea rsi, [r13 + 0xe0]
mov r12, qword [r13 + 0xd8]
lea rdx, [r13 + 8]
mov r8d, 0xd0
lea rcx, [rsp + 0x380]
call sub.msvcrt.dll_memcpy
mov ecx, 0xe
lea rdi, [rsp + 0x110]
rep movsq qword [rdi], qword [rsi]
mov qword [rsp + 0x450], r12
mov rcx, qword [rsp + 0x2d8]
mov rdx, qword [rsp + 0x2e0]
mov r8, r12
call fcn.14003efc9
mov rsi, rax
lea rax, [rsp + 0x450]
mov qword [rsp + 0x70], rax
cmp qword [rsp + 0x2c8], 0
je 0x1400441a4
lea rax, [rsp + 0x70]
mov qword [rsp + 0x500], rax
lea rax, [rsp + 0x2b8]
mov qword [rsp + 0x508], rax
mov rcx, qword [rsp + 0x2b8]
mov rdx, qword [rsp + 0x2c0]
lea rax, [0x140041760]
mov qword [rsp + 0x20], rax
mov r8, rsi
mov r9, r15
call fcn.140041624
or rax, rax
je 0x14004410e
mov rdi, qword [rsp + 0x2b8]
movzx eax, byte [rdi + rdx]
and eax, 1
sub qword [rsp + 0x2c8], rax
mov rax, qword [rsp + 0x450]
shr rsi, 0x39
lea rcx, [rdx - 0x10]
and rcx, qword [rsp + 0x2c0]
mov byte [rdi + rdx], sil
mov byte [rcx + rdi + 0x10], sil
inc qword [rsp + 0x2d0]
neg rdx
imul r14, rdx, 0x158
lea rsi, [rdi + r14]
add rsi, 0xfffffffffffffeb8
mov qword [rsi - 0x10], rax
mov qword [rsi - 8], rbp
mov r8d, 0xd0
push rsi
nop
pop rcx
lea rdx, [rsp + 0x380]
call sub.msvcrt.dll_memcpy
mov qword [rsi + 0xd0], r12
add rdi, r14
add rdi, 0xffffffffffffff90
mov ecx, 0xe
lea rsi, [rsp + 0x110]
rep movsq qword [rdi], qword [rsi]
jmp 0x140044191
mov rdi, qword [rsp + 0x2b8]
neg rdx
imul r14, rdx, 0x158
lea rsi, [rdi + r14]
add rsi, 0xfffffffffffffeb0
mov r8d, 0x150
mov rcx, r15
push rsi
pop rdx
nop
call sub.msvcrt.dll_memcpy
mov qword [rsi], rbp
lea rsi, [rdi + r14]
add rsi, 0xfffffffffffffeb8
mov r8d, 0xd0
push rsi
nop
pop rcx
lea rdx, [rsp + 0x380]
call sub.msvcrt.dll_memcpy
mov qword [rsi + 0xd0], r12
add rdi, r14
add rdi, 0xffffffffffffff90
mov ecx, 0xe
lea rsi, [rsp + 0x110]
rep movsq qword [rdi], qword [rsi]
cmp qword [rsp + 0x500], 2
je 0x140044191
mov rcx, r15
call fcn.14003b791
add r13, 0x150
add rbx, 0xfffffffffffffeb0
jmp 0x140043fa0
lea rcx, [rsp + 0x2b8]
lea rdx, [rsp + 0x2d8]
call fcn.140041786
jmp 0x14004402b
add r13, 0x150
mov rax, qword [rsp + 0x58]
sub rax, r13
mov ecx, 0x150
xor edx, edx
div rcx
mov rcx, r13
push rax
nop
pop rdx
call fcn.14003b767
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
call fcn.14003b74a
mov rax, qword [rsp + 0x2b8]
mov rcx, qword [rsp + 0x2c0]
add rcx, rax
inc rcx
movdqa xmm0, xmmword [rax]
pmovmskb edx, xmm0
not edx
mov r8, qword [rsp + 0x2d0]
lea rsi, [rsp + 0x500]
mov qword [rsi], rax
add rax, 0x10
mov qword [rsi + 8], rax
mov qword [rsi + 0x10], rcx
mov word [rsi + 0x18], dx
mov qword [rsi + 0x20], r8
mov ebx, 0x158
mov r15, qword [rsp + 0x68]
nop
push rsi
pop rcx
call fcn.140040b85
test rax, rax
je 0x14004428d
push rax
nop
pop rdi
cmp byte [rax - 4], 0
mov byte [rax - 4], 0
jne 0x140044242
mov rax, qword [rsp + 0x2b8]
sub rax, rdi
cqo
idiv rbx
lea rcx, [rsp + 0x2b8]
push rax
pop rdx
nop
call fcn.140041ee5
add rdi, 0xfffffffffffffeb0
mov rcx, rdi
call fcn.14003b791
jmp 0x140044242
mov rcx, qword [rsp + 0x1a0]
mov rdx, qword [rsp + 0x1a8]
call fcn.14000c812
cmp byte [r15 + 2], 0
je 0x140044477
lea rsi, [rsp + 0x288]
call sub.KERNEL32.dll_GetLogicalDrives
mov dword [rsp + 0x1a0], eax
or eax, eax
je 0x1400444ef
and qword [rsp + 0x70], 0
mov qword [rsp + 0x78], 8
and qword [rsp + 0x80], 0
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x500], rax
movabs rax, 0x2000000000
mov qword [rsp + 0x508], rax
mov ecx, 0x20
call fcn.1400403b8
lea rcx, [rsp + 0x500]
mov qword [rsp + 0x38], rcx
and dword [rsp + 0x28], 0
mov dword [rsp + 0x30], 0x20
mov qword [rsp + 0x20], 1
sub ebx, ebx
lea rdi, [rsp + 0x110]
mov edx, 0x20
push rdi
pop rcx
nop
sub r8d, r8d
mov r9, rax
call fcn.14003f2d7
mov rax, qword [rdi + 0x10]
sub rax, 1
jb 0x140044369
mov rdi, qword [rdi]
or rdi, rdi
je 0x140044369
add rbx, qword [rdi + 0x10]
add rdi, 0x18
jmp 0x140044351
lea rdi, [rsp + 0x70]
push rdi
nop
pop rcx
push rbx
pop rdx
nop
call fcn.1400405a3
mov rax, qword [rsp + 0x120]
lea rbx, [rsp + 0x380]
mov qword [rbx + 0x10], rax
movups xmm0, xmmword [rsp + 0x110]
movaps xmmword [rbx], xmm0
lea r13, [rsp + 0x508]
lea r14, [rsp + 0x500]
nop
push rbx
pop rcx
call fcn.14003dde8
test rax, rax
je 0x140044453
mov r15, qword [rax]
movups xmm0, xmmword [rax + 8]
movaps xmmword [rsp + 0xd0], xmm0
push rax
pop rcx
nop
call fcn.14003de16
movabs rax, 0x8000000000000000
cmp r15, rax
je 0x140044453
mov qword [rsp + 0x500], r15
movaps xmm0, xmmword [rsp + 0xd0]
movups xmmword [r13], xmm0
mov r15, qword [rsp + 0x508]
mov r12, qword [rsp + 0x510]
mov rcx, rdi
mov rdx, r12
call fcn.1400405a3
mov rbp, qword [rsp + 0x80]
imul rcx, rbp, 0x90
add rcx, qword [rsp + 0x78]
imul r8, r12, 0x90
mov rdx, r15
call sub.msvcrt.dll_memcpy
add rbp, r12
mov qword [rsp + 0x80], rbp
and qword [rsp + 0x510], 0
mov rcx, r14
call fcn.14003b8d0
jmp 0x1400443a8
lea rcx, [rsp + 0x380]
call fcn.14003fdb9
mov rbx, qword [rsp + 0x70]
mov rdi, qword [rsp + 0x78]
mov r14, qword [rsp + 0x80]
jmp 0x1400444f9
cmp byte [r15 + 3], 0
je 0x140044519
imul rdi, qword [rsp + 0x298], 0x90
mov rbx, qword [rsp + 0x290]
xor r14d, r14d
lea rsi, [rsp + 0x500]
mov r15, rbx
cmp rdi, r14
je 0x140044519
cmp qword [r15 + 0x78], 0
je 0x1400444df
and qword [rsp + 0x500], 0
mov rcx, qword [rbx + r14 + 0x50]
xor edx, edx
xor r8d, r8d
mov r9, rsi
call sub.KERNEL32.dll_GetDiskFreeSpaceExW
test eax, eax
je 0x1400444df
mov rax, qword [rsp + 0x500]
mov qword [rbx + r14 + 0x80], rax
add r15, 0x90
add r14, 0x90
jmp 0x1400444a4
mov edi, 8
sub ebx, ebx
xor r14d, r14d
nop
push rsi
pop rcx
call fcn.14003b8d0
mov qword [rsp + 0x288], rbx
mov qword [rsp + 0x290], rdi
mov qword [rsp + 0x298], r14
mov rax, qword [rsp + 0x68]
cmp byte [rax + 7], 0
je 0x140044ba7
lea rbx, [rsp + 0x1a0]
and qword [rbx], 0
mov qword [rbx + 8], 8
and qword [rbx + 0x10], 0
lea rax, [rsp + 0x198]
and dword [rax], 0
lea rdi, [rsp + 0x4c8]
lea r12, [rsp + 0xd0]
lea rbp, [rsp + 0x380]
movabs rsi, 0x8000000000000000
and qword [rsp + 0xb8], 0
and dword [rsp + 0xcc], 0
and dword [rsp + 0x19c], 0
lea rax, [rsp + 0x198]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x19c]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0xcc]
mov qword [rsp + 0x28], rax
or dword [rsp + 0x20], 0xffffffff
sub ecx, ecx
sub edx, edx
mov r8d, 2
lea r9, [rsp + 0xb8]
call sub.NETAPI32.dll_NetUserEnum
or eax, eax
je 0x1400445d9
cmp eax, 0xea
jne 0x1400448f4
mov dword [rsp + 0x40], eax
mov r14, qword [rsp + 0xb8]
mov eax, dword [rsp + 0xcc]
lea r13, [r14 + rax*8]
cmp r14, r13
je 0x1400448d8
mov r15, r14
add r14, 8
cmp qword [r15], 0
je 0x1400445f0
and qword [rsp + 0x4c8], 0
mov rdx, qword [r15]
xor ecx, ecx
mov r8d, 0x17
mov r9, rdi
call sub.NETAPI32.dll_NetUserGetInfo
test eax, eax
jne 0x1400448bd
mov rax, qword [rsp + 0x4c8]
mov rdx, qword [rax + 0x20]
mov rcx, r12
call fcn.14003e5fb
cmp qword [rsp + 0xd0], rsi
je 0x1400448bd
mov rdx, qword [rsp + 0xd8]
lea rcx, [rsp + 0x500]
call fcn.140044f44
cmp qword [rsp + 0x500], rsi
jne 0x14004467a
mov rdx, qword [r15]
lea rcx, [rsp + 0x70]
call fcn.14003b51c
jmp 0x140044697
mov rax, qword [rsp + 0x510]
mov qword [rsp + 0x80], rax
movups xmm0, xmmword [rsp + 0x500]
movaps xmmword [rsp + 0x70], xmm0
mov rdx, qword [r15]
and qword [rsp + 0x450], 0
and dword [rsp + 0x54], 0
and dword [rsp + 0x190], 0
lea rax, [rsp + 0x190]
mov qword [rsp + 0x38], rax
lea rax, [rsp + 0x54]
mov qword [rsp + 0x30], rax
lea rax, [rsp + 0x450]
mov qword [rsp + 0x20], rax
or dword [rsp + 0x28], 0xffffffff
lea rcx, [0x1400b8c00]
sub r8d, r8d
mov r9d, 1
call sub.NETAPI32.dll_NetUserGetLocalGroups
test eax, eax
je 0x14004470e
and qword [rsp + 0x110], 0
mov qword [rsp + 0x118], 8
xor edx, edx
jmp 0x140044823
mov edi, dword [rsp + 0x54]
test rdi, rdi
je 0x140044732
imul r12, rdi, 0x18
mov ecx, 8
mov rdx, r12
call fcn.14000c493
or rax, rax
jne 0x140044737
jmp 0x140044d25
mov eax, 8
mov qword [rsp + 0x110], rdi
mov qword [rsp + 0x118], rax
and qword [rsp + 0x120], 0
mov r15, qword [rsp + 0x450]
test r15, r15
je 0x140044793
mov r12d, dword [rsp + 0x54]
cmp edi, r12d
jae 0x1400447c4
lea rcx, [rsp + 0x110]
xor edx, edx
mov r8, r12
call fcn.14003edc0
mov rcx, rax
call fcn.14000c1cc
mov rax, qword [rsp + 0x118]
mov rdi, qword [rsp + 0x120]
jmp 0x1400447d3
mov rax, qword [rsp + 0x120]
lea rdi, [rsp + 0x518]
mov qword [rdi + 0x28], rax
mov rax, qword [rsp + 0x110]
mov qword [rdi + 0x18], rax
mov rax, qword [rsp + 0x118]
mov qword [rdi + 0x20], rax
jmp 0x140044861
mov edi, 0
mov edx, 0
test r12, r12
je 0x140044823
imul rsi, rdi, 0x18
add rsi, rax
sub ebx, ebx
mov rdx, qword [r15 + rbx*8]
nop
push rbp
pop rcx
call fcn.14003b51c
mov rax, qword [rsp + 0x390]
mov qword [rsi + 0x10], rax
movups xmm0, xmmword [rsp + 0x380]
movups xmmword [rsi], xmm0
inc rbx
add rsi, 0x18
cmp r12, rbx
jne 0x1400447dc
add rdi, rbx
push rdi
pop rdx
nop
movabs rsi, 0x8000000000000000
lea rbx, [rsp + 0x1a0]
mov qword [rsp + 0x120], rdx
mov rcx, qword [rsp + 0x450]
lea rdi, [rsp + 0x518]
mov qword [rdi + 0x28], rdx
mov rax, qword [rsp + 0x110]
mov qword [rdi + 0x18], rax
mov rax, qword [rsp + 0x118]
mov qword [rdi + 0x20], rax
or rcx, rcx
je 0x140044861
call sub.NETAPI32.dll_NetApiBufferFree
movups xmm0, xmmword [rsp + 0xd0]
movaps xmmword [rsp + 0x500], xmm0
mov rax, qword [rsp + 0xe0]
mov qword [rsp + 0x510], rax
and dword [rsp + 0x548], 0
mov rax, qword [rsp + 0x80]
mov qword [rdi + 0x10], rax
movaps xmm0, xmmword [rsp + 0x70]
movups xmmword [rdi], xmm0
nop
push rbx
pop rcx
lea rdx, [rsp + 0x500]
call fcn.140045023
lea rdi, [rsp + 0x4c8]
lea r12, [rsp + 0xd0]
mov rcx, qword [rsp + 0x4c8]
or rcx, rcx
je 0x1400445f0
call sub.NETAPI32.dll_NetApiBufferFree
jmp 0x1400445f0
mov rcx, qword [rsp + 0xb8]
cmp dword [rsp + 0x40], 0xea
jne 0x1400448fc
call fcn.140044f30
jmp 0x14004456e
mov rcx, qword [rsp + 0xb8]
call fcn.140044f30
lea rcx, [rsp + 0x450]
and dword [rcx], 0
lea rsi, [rsp + 0xd0]
and qword [rsi], 0
push rsi
pop rdx
nop
call sub.Secur32.dll_LsaEnumerateLogonSessions
mov rcx, qword [rsi]
or eax, eax
jne 0x140044b34
mov eax, dword [rsp + 0x450]
lea r14, [rcx + rax*8]
lea rsi, [rsp + 0x110]
lea rbp, [rsp + 0x500]
cmp rcx, r14
je 0x140044b2c
lea rdi, [rcx + 8]
and qword [rsp + 0x110], 0
push rsi
pop rdx
nop
call sub.Secur32.dll_LsaGetLogonSessionData
mov rcx, qword [rsp + 0x110]
or eax, eax
je 0x14004497a
call fcn.140044f3a
push rdi
pop rcx
nop
jmp 0x140044946
test rcx, rcx
je 0x140044a22
cmp dword [rcx + 0x40], 3
je 0x140044970
movzx ebx, word [rcx + 0x10]
mov r12, qword [rcx + 0x18]
mov rdx, qword [rcx + 0x48]
push rbp
pop rcx
nop
call fcn.14003e5fb
mov r15, qword [rsp + 0x500]
movabs rax, 0x8000000000000000
cmp r15, rax
je 0x140044b1f
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x40], rbx
mov r12, qword [rsp + 0x508]
mov r13, qword [rsp + 0x510]
mov rdx, qword [rsp + 0x1a8]
imul rbx, qword [rsp + 0x1b0], 0x50
or rbx, rbx
je 0x140044a29
lea rbp, [rdx + 0x50]
mov rcx, qword [rdx + 8]
mov rdx, qword [rdx + 0x10]
mov r8, r12
mov r9, r13
call fcn.140040549
add rbx, 0xffffffffffffffb0
mov rdx, rbp
test al, al
je 0x1400449e3
mov rcx, r15
mov rdx, r12
call fcn.14000c812
lea rbp, [rsp + 0x500]
jmp 0x140044b1f
xor ecx, ecx
jmp 0x140044970
lea rcx, [rsp + 0x380]
mov rdx, r12
call fcn.140044f44
mov rax, qword [rsp + 0x380]
movabs rbx, 0x8000000000000000
cmp rax, rbx
jne 0x140044aa1
mov r8, qword [rsp + 0x40]
shr r8d, 1
lea rbp, [rsp + 0x500]
push rbp
pop rcx
nop
mov rdx, qword [rsp + 0x48]
call fcn.140003c30
mov rax, qword [rsp + 0x500]
cmp rax, rbx
mov r8d, 0
cmove rax, r8
mov rcx, qword [rsp + 0x508]
mov edx, 1
cmove rcx, rdx
mov rdx, qword [rsp + 0x510]
cmove rdx, r8
jmp 0x140044ab9
mov rcx, qword [rsp + 0x388]
mov rdx, qword [rsp + 0x390]
lea rbp, [rsp + 0x500]
mov qword [rsp + 0x500], r15
mov qword [rsp + 0x508], r12
mov qword [rsp + 0x510], r13
and dword [rsp + 0x548], 0
mov qword [rsp + 0x518], rax
mov qword [rsp + 0x520], rcx
mov qword [rsp + 0x528], rdx
and qword [rsp + 0x530], 0
mov qword [rsp + 0x538], 8
and qword [rsp + 0x540], 0
lea rcx, [rsp + 0x1a0]
nop
push rbp
pop rdx
call fcn.140045023
mov rcx, qword [rsp + 0x110]
jmp 0x140044970
mov rcx, qword [rsp + 0xd0]
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x510], rax
movups xmm0, xmmword [rsp + 0x1a0]
movaps xmmword [rsp + 0x500], xmm0
test rcx, rcx
je 0x140044b5e
call fcn.1400467cc
mov rcx, qword [rsp + 0x2a8]
mov rdx, qword [rsp + 0x2b0]
call fcn.14004099d
mov rcx, qword [rsp + 0x2a0]
mov rdx, qword [rsp + 0x2a8]
call fcn.140040ab1
mov rax, qword [rsp + 0x510]
lea rcx, [rsp + 0x2a0]
mov qword [rcx + 0x10], rax
movaps xmm0, xmmword [rsp + 0x500]
movups xmmword [rcx], xmm0
lea rdx, [rsp + 0x1e0]
mov r8d, 0x1a0
mov rcx, qword [rsp + 0x4c0]
call sub.msvcrt.dll_memcpy
movaps xmm6, xmmword [rsp + 0xa50]
movaps xmm7, xmmword [rsp + 0xa60]
movaps xmm8, xmmword [rsp + 0xa70]
movaps xmm9, xmmword [rsp + 0xa80]
add rsp, 0xa98
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov qword [rsp + 0x380], rbx
mov qword [rsp + 0x388], r14
mov qword [rsp + 0x390], 0x32
mov r15, qword [rsp + 0x68]
jmp 0x140043a44
lea rax, [rsp + 0x4d0]
movss xmm8, dword [rsp + 0x70]
movss xmm9, dword [rsp + 0x78]
mov r15, qword [rax - 8]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmm2, xmmword [rax + 0x20]
movaps xmmword [rsp + 0x380], xmm0
movaps xmmword [rsp + 0x390], xmm1
movaps xmmword [rsp + 0x3a0], xmm2
xor r14d, r14d
mov esi, 8
mov ecx, 8
xor edx, edx
call fcn.14000e00d
nop
push rax
pop rdi
movabs rax, 0x72657475706d6f43
mov qword [rdx], rax
movaps xmm0, xmmword [rsp + 0x380]
movaps xmm1, xmmword [rsp + 0x390]
movaps xmm2, xmmword [rsp + 0x3a0]
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x120], xmm1
movaps xmmword [rsp + 0x130], xmm2
cmp r15, 3
je 0x140042906
push rdx
pop rbx
nop
mov ecx, 0x60
mov edx, 8
call fcn.14000b8a9
nop
push rax
pop rsi
mov qword [rax], r15
movaps xmm0, xmmword [rsp + 0x110]
movaps xmm1, xmmword [rsp + 0x120]
movaps xmm2, xmmword [rsp + 0x130]
movups xmmword [rax + 8], xmm0
movups xmmword [rax + 0x18], xmm1
movups xmmword [rax + 0x28], xmm2
mov qword [rax + 0x38], rdi
mov qword [rax + 0x40], rbx
mov qword [rax + 0x48], 8
mov dword [rax + 0x50], ebp
movss dword [rax + 0x54], xmm9
movss dword [rax + 0x58], xmm8
movss dword [rax + 0x5c], xmm8
mov r14d, 1
jmp 0x140042906
mov ecx, 8
mov rdx, r12
call fcn.1400032e0
lea rcx, str.key_used_disappeared
lea r8, [0x1400b8ba8]
mov edx, 0x14
call fcn.140005e10
mov ecx, 8
mov edx, 0x120
call fcn.1400032e0
mov ecx, 8
mov edx, 0xfa0
call fcn.1400032e0
lea rcx, str.assertion_failed:_vec.capacity_____start___len_home_torcrypt_.cargo_registry_src_index.crates.io_6f17d22bba15001f_rayon_1.10.0_src_vec.rs
lea r8, [0x1400b8288]
mov edx, 0x2f
call fcn.140004c80
lea rcx, str.global_key_idle_disappeared_home_torcrypt_.cargo_registry_src_index.crates.io_6f17d22bba15001f_sysinfo_0.29.11_src_windows_system.rs
lea r8, [0x1400b8b78]
mov edx, 0x1b
call fcn.140005e10
int3