Function at 0x14004a030
Capabilities:
Contain obfuscated stackstrings
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x20]
sub rsp, 0x120
mov rax, qword [0x140236800]
xor rax, rsp
mov qword [rbp + 0x18], rax
movzx r10d, byte [rsp + 0x30]
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp - 0x7a], rax
movups xmmword [rsp + 0x76], xmm0
mov dword [rbp - 0x72], eax
movabs r13, 0xf212aba58234d1d0
mov byte [rbp - 0x6e], al
movabs r14, 0xdb881493ae553610
mov dword [rsp + 0x40], 0x27d02028
movabs r15, 0x702332ddb2adebf0
mov dword [rsp + 0x44], 0x22d424d3
movabs r12, 0x8bfddb92ae444850
mov dword [rsp + 0x48], 0xd82fdbd4
mov dword [rsp + 0x4c], 0x2cdcd823
mov dword [rsp + 0x50], 0xe3131c15
mov dword [rsp + 0x54], 0xc4cfe6e8
mov dword [rsp + 0x58], 0x3bf7fccc
mov dword [rsp + 0x5c], 0xf0cdf8ee
mov dword [rsp + 0x60], 0xe6e1d3d5
mov dword [rsp + 0x64], 0xeff6f9d7
mov dword [rsp + 0x68], 0xe8e3dad1
mov dword [rsp + 0x6c], 0x22ee1ed
mov dword [rsp + 0x70], 0x211d1c15
mov word [rsp + 0x74], 0xb52d
nop dword [rax]
nop word [rax + rax]
mov r8, qword [0x14023d108]
mov r9, qword [0x14023d100]
nop
xor r11d, r11d
cmp r11, 0x53
jae 0x14004adcb
movzx ebx, byte [rsp + r11 + 0x40]
mov edi, ebx
nop word [rax + rax]
mov rsi, rdi
cmp r8, r11
ja 0x14004adc2
lea rax, [r9 + 1]
cmp r8, rax
jae 0x14004a17f
lea rcx, [r11 + r13]
mov rax, rcx
and rax, rdi
imul r10, rax, 0xfffffffffffffffe
add r10, rcx
add r10, rdi
add r10b, 0x50
jmp 0x14004a1d0
je 0x14004ad41
inc rax
cmp r8, rax
je 0x14004acdc
lea rax, [r9 + 3]
cmp r8, rax
je 0x14004ac88
lea rcx, [r9 + 4]
cmp r8, rcx
je 0x14004ac4a
lea rax, [r9 + 5]
cmp r8, rax
je 0x14004ac03
lea rax, [r9 + 7]
cmp r8, rax
je 0x14004abd3
cmp r8, rcx
je 0x14004ab80
nop
cmp r9, r11
ja 0x14004adb9
lea rax, [r9 + 0x40]
cmp r8, rax
jae 0x14004a1fe
lea rdx, [r11 + r14]
movzx r10d, dil
movzx eax, dl
and al, sil
add al, al
sub r10b, al
sub r10b, 0x70
add r10b, dl
jmp 0x14004a231
lea rax, [r9 + 1]
cmp r8, rax
je 0x14004ab5c
inc rax
cmp r8, rax
je 0x14004ab2f
lea rax, [r9 + 4]
cmp r8, rax
je 0x14004ab0c
lea rax, [r9 + 3]
cmp r8, rax
je 0x14004aae5
lea rax, [r9 + r8]
cmp rax, r11
jbe 0x14004a843
nop
lea rax, [r9 + 9]
cmp r8, rax
je 0x14004a81b
lea rax, [r9 + 8]
cmp r8, rax
je 0x14004a7ff
lea rax, [r9 + 0x64]
cmp r8, rax
je 0x14004a7d6
lea rax, [r9 + 0x41]
cmp r8, rax
je 0x14004a7c7
lea rax, [r9 + 6]
cmp r8, rax
je 0x14004a7a4
lea rax, [r9 + 0x42]
cmp r8, rax
je 0x14004a781
lea rax, [r9 + 0x7a]
cmp r8, rax
je 0x14004a759
lea rax, [r9 + 5]
cmp r8, rax
je 0x14004a736
lea rax, [r9 + 0x40]
cmp r8, rax
je 0x14004a6ff
lea rax, [r9 + 0x61]
cmp r8, rax
je 0x14004a240
lea r8, [r9 + 0x2a]
lea r9, [r8 + 0x1000]
lea rax, [r9 + 0x5a]
cmp r8, rax
jb 0x14004ad96
lea rax, [r9 + 8]
cmp r8, rax
jb 0x14004ad73
lea rax, [r9 + 0x64]
cmp r8, rax
jb 0x14004a42d
lea rax, [r9 + 0x41]
cmp r8, rax
jb 0x14004a40e
lea rax, [r9 + 6]
cmp r8, rax
jb 0x14004a3ee
lea rax, [r9 + 0x42]
cmp r8, rax
jb 0x14004a69c
lea rax, [r9 + 0x7a]
cmp r8, rax
jb 0x14004a62c
lea rax, [r9 + 5]
cmp r8, rax
jb 0x14004a5db
lea rax, [r9 + 0x40]
cmp r8, rax
jb 0x14004a5b0
lea rax, [r9 + 0x28]
cmp r8, rax
jb 0x14004a240
lea r8, [r9 + 0x80]
lea r9, [r8 + 0x1000]
lea rax, [r9 + 0x5a]
cmp r8, rax
ja 0x14004a57e
lea rax, [r9 + 8]
cmp r8, rax
ja 0x14004a556
lea rax, [r9 + 0x64]
cmp r8, rax
ja 0x14004a52f
lea rax, [r9 + 0x41]
cmp r8, rax
ja 0x14004a507
lea rax, [r9 + 6]
cmp r8, rax
ja 0x14004a4f4
lea rax, [r9 + 0x42]
cmp r8, rax
ja 0x14004a4d1
lea rax, [r9 + 0x7a]
cmp r8, rax
ja 0x14004a4a3
lea rax, [r9 + 5]
cmp r8, rax
ja 0x14004a477
lea rax, [r9 + 4]
cmp r8, rax
ja 0x14004a454
lea rax, [r9 + 0x28]
cmp r8, rax
ja 0x14004a240
lea r8, [r9 + 0x80]
lea r9, [r8 + 0x1000]
jmp 0x14004a240
lea rdx, [r11 + r15]
mov ecx, gethostname
movzx eax, sil
and al, dl
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dil
add r10b, dl
jmp 0x14004a231
lea rdx, [r11 + r12]
movzx eax, sil
and al, dl
movzx r10d, dil
add al, al
sub r10b, al
sub r10b, 0x30
add r10b, dl
jmp 0x14004a1d0
mov eax, Ordinal_26
movabs rcx, 0xa7d88447a9daa4b0
add rcx, r11
and sil, cl
sub al, sil
lea r10d, [rax + rax]
add r10b, dil
add r10b, cl
jmp 0x14004a150
movabs rcx, 0xdc40a49d72a9b080
movzx eax, bl
add rcx, r11
and al, cl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
add r10b, 0x80
jmp 0x14004aba1
movzx eax, bl
movabs rcx, 0xf81b4d526e400ce0
add rcx, r11
inc r9
and al, cl
dec r11
add al, al
sub bl, al
lea r10d, [rcx + rbx]
sub r10b, 0x20
inc r11
jmp 0x14004a133
mov ecx, reloc.WLDAP32.dll_Ordinal_32
movabs rdx, 0x13f5f60769d66940
add rdx, r11
movzx eax, bl
and al, dl
dec r11
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
inc r11
jmp 0x14004a133
movabs rcx, 0x2fd09ebc656cc5a0
movzx eax, bl
add rcx, r11
and al, cl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x60
jmp 0x14004ac25
movzx eax, bl
and al, r11b
add al, al
sub bl, al
lea r10d, [r11 + rbx]
jmp 0x14004ac6c
mov ecx, Ordinal_50
movabs rdx, 0x6785f0265c997e60
add rdx, r11
movzx eax, bl
and al, dl
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
jmp 0x14004ac6f
movabs rdx, 0x836098db582fdac0
movzx eax, bl
add rdx, r11
movzx r10d, bl
and al, dl
add al, al
sub r10b, al
sub r10b, 0x40
add r10b, dl
jmp 0x14004acaa
mov ecx, reloc.WS2_32.dll_recv
movabs rdx, 0x9f3b419053c63720
add rdx, r11
movzx eax, bl
and al, dl
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
jmp 0x14004acfd
movzx eax, bl
movabs rcx, 0xbb15ea454f5c9380
add rcx, r11
and al, cl
add al, al
sub bl, al
movzx eax, byte [rsp + r11 + 0x40]
add rax, r9
add r11, rax
lea r10d, [rcx + rbx]
add r10b, 0x80
inc r11
jmp 0x14004a133
movzx eax, bl
movabs rcx, 0xb89009c4547a70
add rcx, r11
and al, cl
add al, al
sub bl, al
lea r10d, [rcx + rbx]
sub r10b, 0x10
mov byte [rsp + r11 + 0x40], r10b
inc r11
jmp 0x14004a133
mov ecx, Ordinal_41
movabs rdx, 0x1c9338bebfead6d0
add rdx, r11
movzx eax, bl
and al, dl
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
cmp r9, 1
jb 0x14004a5ce
movzx ecx, bl
movabs rdx, 0x737063f1e10b98e0
add rdx, r11
movzx eax, bl
and al, dl
add al, al
sub cl, al
add cl, dl
lea r10d, [rcx*2 - 0x40]
jmp 0x14004aba1
movabs rdx, 0x386de173bb813330
movzx eax, bl
add rdx, r11
movzx r10d, bl
and al, dl
add al, al
sub r10b, al
sub r10b, 0x50
add r10b, dl
cmp r8, 1
jae 0x14004aa8c
lea rax, [r9 + 1]
cmp r8, rax
jne 0x14004aa06
movzx eax, bl
mov ecx, reloc.WLDAP32.dll_Ordinal_32
movabs rdx, 0x6e20524eb954d840
add rdx, r11
and al, dl
sub cl, al
movzx eax, byte [rsp + r11 + 0x40]
add rax, r9
add r11, rax
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
inc r11
jmp 0x14004a133
mov ecx, 8
movabs rdx, 0x54488a28b7178f90
add rdx, r11
movzx eax, bl
and al, dl
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
lea rax, [r9 + r8]
cmp rax, 1
je 0x14004aab8
lea rax, [r9 + 5]
cmp r8, rax
jbe 0x14004a940
mov ecx, 8
movabs rdx, 0xae72e6700695fe90
add rdx, r11
movzx eax, bl
and al, dl
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
jmp 0x14004a64b
movzx eax, bl
mov ecx, Ordinal_50
movabs rdx, 0x25307b7615ff4460
add rdx, r11
and al, dl
sub cl, al
movzx eax, byte [rsp + r11 + 0x40]
add rax, r9
add r11, rax
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
inc r11
jmp 0x14004a133
movabs rcx, 0x410b242b1195a0c0
movzx eax, bl
add rcx, r11
and al, cl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x40
jmp 0x14004acfd
mov ecx, reloc.WS2_32.dll_recv
movabs rdx, 0x5ce5cce00d2bfd20
add rdx, r11
movzx eax, bl
and al, dl
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
jmp 0x14004acaa
movzx eax, bl
movabs rcx, 0x78c0759508c25980
add rcx, r11
and al, cl
add al, al
sub bl, al
lea r10d, [rcx + rbx]
add r10b, 0x80
jmp 0x14004ac6f
movzx eax, bl
movabs rcx, 0x949b1e4a0458b5e0
add rcx, r11
and al, cl
add al, al
sub bl, al
lea r10d, [rcx + rbx]
sub r10b, 0x20
jmp 0x14004ac6c
movabs rdx, 0xb075c6feffef1240
jmp 0x14004a8ec
movzx eax, bl
movabs rcx, 0xcc506fb3fb856ea0
add rcx, r11
dec r11
and al, cl
add al, al
sub bl, al
lea r10d, [rcx + rbx]
sub r10b, 0x60
inc r11
jmp 0x14004a133
movzx eax, bl
inc r9
and al, r11b
add al, al
sub bl, al
lea r10d, [r11 + rbx]
dec r11
inc r11
jmp 0x14004a133
mov ecx, Ordinal_50
movabs rdx, 0x405c11df2b22760
add rdx, r11
movzx eax, bl
and al, dl
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
jmp 0x14004aba1
lea rax, [r9 + 0xa]
cmp r8, rax
jae 0x14004a86a
lea rcx, [r11 + r13]
mov eax, Ordinal_41
and sil, cl
sub al, sil
lea r10d, [rax + rax]
add r10b, dil
add r10b, cl
jmp 0x14004a6bf
lea rax, [r9 + 1]
cmp r8, rax
jne 0x14004a8aa
movzx eax, bl
mov ecx, reloc.WS2_32.dll_recv
movabs rdx, 0xb71029275caa6c20
add rdx, r11
and al, dl
sub cl, al
movzx eax, byte [rsp + r11 + 0x40]
add rax, r9
add r11, rax
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
inc r11
jmp 0x14004a133
inc rax
cmp r8, rax
jne 0x14004a8d9
movabs rdx, 0x9b35807261140fc0
movzx eax, bl
add rdx, r11
movzx r10d, bl
and al, dl
add al, al
sub r10b, al
sub r10b, 0x40
add r10b, dl
jmp 0x14004acfd
lea rax, [r9 + 4]
cmp r8, rax
jne 0x14004a90a
movabs rdx, 0x2bcadd9e72ba9e40
add rdx, r11
mov ecx, reloc.WLDAP32.dll_Ordinal_32
movzx eax, bl
and al, dl
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
jmp 0x14004ac25
lea rax, [r9 + 5]
cmp r8, rax
jne 0x14004a6bf
movzx eax, bl
movabs rcx, 0xff034e9772441e0
add rcx, r11
dec r11
and al, cl
add al, al
sub bl, al
lea r10d, [rcx + rbx]
sub r10b, 0x20
inc r11
jmp 0x14004a133
lea rax, [r9 + 1]
cmp r8, rax
jne 0x14004a96c
movabs rcx, 0x92983dbb0affa230
movzx eax, bl
add rcx, r11
and al, cl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x50
jmp 0x14004aba1
inc rax
cmp r8, rax
jne 0x14004a9a5
mov ecx, Ordinal_41
movabs rdx, 0x76bd95060f6945d0
add rdx, r11
movzx eax, bl
and al, dl
inc r9
sub cl, al
dec r11
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
inc r11
jmp 0x14004a133
lea rax, [r9 + 4]
cmp r8, rax
jne 0x14004a9d1
movzx eax, bl
movabs rcx, 0x752f232210fd450
add rcx, r11
and al, cl
add al, al
sub bl, al
lea r10d, [rcx + rbx]
sub r10b, 0x30
jmp 0x14004ac6f
lea rax, [r9 + 3]
cmp r8, rax
jne 0x14004a64e
mov ecx, gethostname
movabs rdx, 0xeb78497d257977f0
add rdx, r11
movzx eax, bl
and al, dl
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
jmp 0x14004acaa
inc rax
cmp r8, rax
jne 0x14004aa35
movabs rdx, 0x5245a999bdbe7be0
movzx eax, bl
add rdx, r11
movzx r10d, bl
and al, dl
add al, al
sub r10b, al
sub r10b, 0x20
add r10b, dl
jmp 0x14004acfd
lea rax, [r9 + 5]
cmp r8, rax
jne 0x14004aa66
mov ecx, Ordinal_50
movabs rdx, 0xe2db06c5cf650a60
add rdx, r11
movzx eax, bl
and al, dl
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
jmp 0x14004ac25
lea rax, [r9 + 3]
cmp r8, rax
jne 0x14004a5fe
movzx eax, bl
and al, r11b
add al, al
sub bl, al
lea r10d, [r11 + rbx]
dec r11
inc r11
jmp 0x14004a133
movzx r10d, byte [rsp + r11 + 0x40]
movabs rdx, 0x5795bb3ce5753c80
add rdx, r11
movzx eax, bl
and al, dl
add al, al
sub r10b, al
add r10b, 0x80
add r10b, bl
add r10b, dl
jmp 0x14004ac25
mov ecx, reloc.WS2_32.dll_recv
movabs rdx, 0x3bbb1287e9dee020
add rdx, r11
movzx eax, bl
and al, dl
sub cl, al
lea r10d, [rcx + rcx]
sub r10b, byte [rsp + r11 + 0x40]
add r10b, bl
add r10b, dl
jmp 0x14004acaa
mov eax, Ordinal_41
movabs rcx, 0x34682055c8cf0bd0
add rcx, r11
and sil, cl
sub al, sil
lea r10d, [rax + rax]
add r10b, dil
add r10b, cl
jmp 0x14004ac6f
movabs rax, 0x5042c90ac4656830
add rax, r11
and sil, al
add sil, sil
sub dil, sil
lea r10d, [rax + rdi]
sub r10b, 0x50
jmp 0x14004ac6c
mov eax, gethostname
movabs rcx, 0x87f81a74bb9220f0
add rcx, r11
dec r11
and sil, cl
sub al, sil
lea r10d, [rax + rax]
add r10b, dil
add r10b, cl
inc r11
jmp 0x14004a133
mov eax, Ordinal_26
movabs rcx, 0xbfad6bdeb2bed9b0
add rcx, r11
and sil, cl
sub al, sil
lea r10d, [rax + rax]
add r10b, cl
add r10b, dil
jmp 0x14004aba1
movabs rcx, 0xf762bd48a9eb9270
movzx r10d, dil
add rcx, r11
and sil, cl
add sil, sil
sub r10b, sil
sub r10b, 0x10
add r10b, cl
movabs rdx, 0x65830f9763406ab0
mov ecx, Ordinal_26
add rdx, r11
inc r9
movzx eax, dl
and al, bl
sub cl, al
add cl, cl
add cl, dl
add cl, bl
mov byte [rsp + r11 + 0x40], cl
dec r11
inc r11
jmp 0x14004a133
mov eax, Ordinal_41
movabs rcx, 0x133d65fda581eed0
add rcx, r11
and sil, cl
sub al, sil
lea r10d, [rax + rax]
add r10b, dil
add r10b, cl
inc r9
dec r11
inc r11
jmp 0x14004a133
mov eax, 8
movabs rcx, 0x4af2b7679caea790
add rcx, r11
and sil, cl
sub al, sil
lea r10d, [rax + rax]
add r10b, dil
add r10b, cl
movabs rcx, 0x49a866e267aa0e50
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
sub cl, 0x30
add cl, bl
add cl, r10b
mov byte [rsp + r11 + 0x40], cl
jmp 0x14004ac6c
mov eax, gethostname
movabs rcx, 0x66cd601c984503f0
add rcx, r11
and sil, cl
sub al, sil
lea r10d, [rax + rax]
add r10b, dil
add r10b, cl
add r8, r9
movzx eax, r10b
mov rcx, 0xffffffffffffffff
sub rcx, rax
add r11, rcx
inc r11
jmp 0x14004a133
mov eax, Ordinal_26
movabs rcx, 0x9e82b1868f71bcb0
add rcx, r11
and sil, cl
sub al, sil
lea r10d, [rax + rax]
add r10b, dil
add r10b, cl
movzx eax, bl
inc r9
movabs rdx, 0x2dcdbe2d6c13b1f0
mov ecx, gethostname
add rdx, r11
and al, dl
sub cl, al
add cl, cl
add cl, bl
add cl, dl
movzx eax, cl
mov byte [rsp + r11 + 0x40], al
add rax, r9
sub r11, rax
jmp 0x14004acfd
movabs rcx, 0xba5d5a3b8b081910
movzx r10d, dil
add rcx, r11
and sil, cl
add sil, sil
sub r10b, sil
sub r10b, 0x70
add r10b, cl
movzx eax, bl
inc r8
movabs rcx, 0x1fe069d2ee4883c0
add rcx, r11
and al, cl
add al, al
sub bl, al
mov rax, 0xffffffffffffffff
sub rax, r8
sub bl, 0x40
add bl, cl
mov byte [rsp + r11 + 0x40], bl
add r11, rax
movzx eax, byte [rsp + r11 + 0x40]
add rax, r9
add r11, rax
inc r11
jmp 0x14004a133
movabs rax, 0xd63802f0869e7570
add rax, r11
and sil, al
add sil, sil
sub dil, sil
lea r10d, [rax + rdi]
sub r10b, 0x10
movzx eax, byte [rsp + r11 + 0x40]
add rax, r9
add r11, rax
inc r11
jmp 0x14004a133
movzx eax, bl
movabs rcx, 0xc3b32cfca5710110
add rcx, r11
and al, cl
add al, al
sub bl, al
lea r10d, [rcx + rbx]
sub r10b, 0x70
jmp 0x14004a130
movzx eax, bl
movabs rcx, 0xdf8dd5b1a1075d70
add rcx, r11
and al, cl
add al, al
sub bl, al
lea r10d, [rcx + rbx]
sub r10b, 0x10
jmp 0x14004a120
lea rdx, [rbp + 0x17cf700]
jmp 0x14004add0
lea rdx, [rbp + 0xf1c8d0]
jmp 0x14004add0
lea rdx, [rsp + 0x40]
lea rax, [rbp - 8]
mov r9d, 0x20019
xor r8d, r8d
mov qword [rsp + 0x20], rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
movzx r10d, byte [rsp + 0x30]
xor eax, eax
xorps xmm0, xmm0
mov dword [rbp - 0x44], eax
movups xmmword [rbp - 0x54], xmm0
mov word [rbp - 0x40], ax
movabs rdi, 0x263cb61c4451b615
mov byte [rbp - 0x3e], al
movabs rsi, 0xd885a93501290a8b
mov dword [rbp - 0x60], 0x6c7a5934
movabs r15, 0x26646a321ba25e01
mov dword [rbp - 0x5c], 0x60747c70
movabs r14, 0x8bbcd4d0c9e44e89
mov dword [rbp - 0x58], 0xb606672
movabs r12, 0x3ef4006c929f9287
movabs r13, 0xe51cdc7deb48f4a6
nop dword [rax]
mov r8, qword [0x14023d108]
mov r9, qword [0x14023d100]
nop
xor r11d, r11d
cmp r11, 0x23
jae 0x14004bac0
movzx ebx, byte [rbp + r11 - 0x60]
mov rdx, rbx
cmp r8, r11
ja 0x14004bab7
lea rax, [r9 + 1]
cmp r8, rax
jae 0x14004aeb2
lea rcx, [r11 + r15]
mov rax, rcx
and rax, rbx
imul r10, rax, 0xfffffffffffffffe
add r10, rcx
add r10, rbx
sub r10b, 7
jmp 0x14004aee0
je 0x14004ba36
lea rax, [r9 + 2]
cmp r8, rax
je 0x14004b9a1
lea rax, [r9 + 3]
cmp r8, rax
je 0x14004b96a
lea rax, [r9 + 5]
cmp r8, rax
je 0x14004b941
nop
cmp r9, r11
ja 0x14004baae
lea rax, [r9 + 4]
cmp r8, rax
jae 0x14004af09
lea rcx, [r11 + rdi]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
add r10b, 0x6d
jmp 0x14004af60
lea rax, [r9 + 1]
cmp r8, rax
je 0x14004b8f5
inc rax
cmp r8, rax
je 0x14004b8a9
lea rax, [r9 + 3]
cmp r8, rax
je 0x14004b883
lea rax, [r9 + 4]
cmp r8, rax
je 0x14004b860
lea rax, [r9 + 5]
cmp r8, rax
je 0x14004b83d
lea rax, [r9 + 8]
cmp r8, rax
je 0x14004b80b
nop word [rax + rax]
lea rax, [r9 + r8]
cmp rax, r11
jbe 0x14004b4fa
nop dword [rax]
lea rax, [r9 + 0x7a]
cmp r8, rax
je 0x14004b4d7
lea rax, [r9 + 3]
cmp r8, rax
je 0x14004b4ab
lea rax, [r9 + 0xa]
cmp r8, rax
je 0x14004b482
lea rax, [r9 + 0x5a]
cmp r8, rax
je 0x14004b45f
lea rax, [r9 + 5]
cmp r8, rax
je 0x14004b439
lea rax, [r9 + 0x20]
cmp r8, rax
je 0x14004b416
lea rax, [r9 + 1]
cmp r8, rax
je 0x14004b3f3
lea rax, [r9 + 8]
cmp r8, rax
je 0x14004b3d0
lea rax, [r9 + 0x40]
cmp r8, rax
je 0x14004b39e
lea r8, [r9 + 6]
lea r9, [r8 + 0xa]
lea rax, [r9 + 0x28]
cmp r8, rax
jb 0x14004ba8b
lea rax, [r9 + 0x3e8]
cmp r8, rax
jb 0x14004ba68
lea rax, [r9 + 9]
cmp r8, rax
jb 0x14004b118
lea rax, [r9 + 0x42]
cmp r8, rax
jb 0x14004b0fe
lea rax, [r9 + 0x1000]
cmp r8, rax
jb 0x14004b0e4
lea rax, [r9 + 1]
cmp r8, rax
jb 0x14004b342
lea rax, [r9 + 0x80]
cmp r8, rax
jb 0x14004b2e2
lea rax, [r9 + 0x7a]
cmp r8, rax
jb 0x14004b296
lea rax, [r9 + 3]
cmp r8, rax
jb 0x14004b26b
lea r8, [r9 + 0x61]
lea r9, [r8 + 0x5a]
lea rax, [r9 + 2]
cmp r8, rax
ja 0x14004b239
lea rax, [r9 + 9]
cmp r8, rax
ja 0x14004b212
lea rax, [r9 + 0x41]
cmp r8, rax
ja 0x14004b1ef
lea rax, [r9 + 4]
cmp r8, rax
ja 0x14004b1cc
lea rax, [r9 + 0x10]
cmp r8, rax
ja 0x14004b1a6
lea rax, [r9 + 0x2a]
cmp r8, rax
ja 0x14004b183
lea rax, [r9 + 6]
cmp r8, rax
ja 0x14004b15a
lea rax, [r9 + 0x28]
cmp r8, rax
ja 0x14004b132
lea r8, [r9 + 0x20]
lea r9, [r8 + 0x42]
jmp 0x14004af70
lea rcx, [r11 + rsi]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
add r10b, 0x33
jmp 0x14004af60
lea rcx, [r11 + r14]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
add r10b, 0x41
jmp 0x14004aee0
lea rcx, [r11 + r12]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
add r10b, 0x4f
jmp 0x14004ae83
lea rdx, [r11 + r13]
mov ecx, Ordinal_60
movzx eax, dl
inc r9
and al, bl
dec r11
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
inc r11
jmp 0x14004ae73
movabs rcx, 0x98540819b40438a4
add rcx, r11
dec r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x7c
inc r11
jmp 0x14004ae73
movabs rcx, 0x4b8b33b57cbf7ca2
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x6e
jmp 0x14004b8c7
movabs rcx, 0xfec25f51457ac0a0
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x60
add r8, r9
jmp 0x14004b988
movabs rcx, 0xb1f98aed0e36049e
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x52
jmp 0x14004b988
movabs rcx, 0x6530b688d6f1489c
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x44
jmp 0x14004b9bf
movabs rdx, 0x1867e2249fac8c9a
movzx r10d, bl
add rdx, r11
movzx eax, dl
and al, bl
add al, al
sub r10b, al
sub r10b, 0x36
add r10b, dl
jmp 0x14004b9ee
movabs rcx, 0xcb9f0dc06867d098
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
movzx eax, byte [rbp + r11 - 0x60]
add rax, r9
add r11, rax
lea r10d, [rbx + rcx]
sub r10b, 0x28
inc r11
jmp 0x14004ae73
movabs rcx, 0xba8fac5de3bfa93
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 5
mov byte [rbp + r11 - 0x60], r10b
inc r11
jmp 0x14004ae73
movabs rcx, 0xbee02661a6f73e91
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
add r10b, 9
cmp r9, 0x42
jb 0x14004b289
mov edx, reloc.WLDAP32.dll_Ordinal_27
movabs rcx, 0x4c024ff702b17466
add rcx, r11
movzx eax, cl
and al, bl
sub dl, al
add dl, dl
add dl, cl
add dl, bl
lea r10d, [rdx + rdx]
jmp 0x14004b913
movabs rdx, 0x721751fd6fb2828f
movzx eax, bl
add rdx, r11
movzx r10d, bl
and al, dl
add al, al
sub r10b, al
add r10b, 0x17
add r10b, dl
cmp r8, 0x64
jae 0x14004b7b1
lea rax, [r9 + 2]
cmp r8, rax
jbe 0x14004b6a7
movabs rdx, 0x4c2a040cda021c52
movzx eax, bl
add rdx, r11
movzx r10d, bl
and al, dl
add al, al
sub r10b, al
sub r10b, 0x3e
add r10b, dl
jmp 0x14004b2b4
movabs rcx, 0x254e7d99386dc68d
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
add r10b, 0x25
lea rax, [r9 + r8]
cmp rax, 0x2a
je 0x14004b7de
lea rax, [r9 + 3]
cmp r8, rax
jbe 0x14004b5ea
movabs rcx, 0x25ed4df095b0663d
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
add r10b, 0x55
jmp 0x14004b304
movabs rcx, 0xe56c44a999ea447e
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
movzx eax, byte [rbp + r11 - 0x60]
add rax, r9
add r11, rax
lea r10d, [rbx + rcx]
sub r10b, 0x72
inc r11
jmp 0x14004ae73
movabs rcx, 0x98a3704562a5887c
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x64
jmp 0x14004b9ee
movabs rcx, 0x4bda9be12b60cc7a
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x56
jmp 0x14004b9bf
movabs rcx, 0xff11c77cf41c1078
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x48
jmp 0x14004b988
movabs rcx, 0xb248f318bcd75476
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x3a
add r8, r9
jmp 0x14004b988
movabs rcx, 0x65801eb485929874
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x2c
jmp 0x14004b8c7
movabs rcx, 0x18b74a504e4ddc72
add rcx, r11
dec r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x1e
inc r11
jmp 0x14004ae73
movabs rcx, 0xcbee75ec17092070
inc r9
add rcx, r11
dec r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x10
inc r11
jmp 0x14004ae73
movabs rcx, 0x7f25a187dfc4646e
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 2
jmp 0x14004b913
lea rax, [r9 + 0x80]
cmp r8, rax
jae 0x14004b520
lea rcx, [r11 + r15]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 7
jmp 0x14004b360
lea rax, [r9 + 1]
cmp r8, rax
jne 0x14004b55b
movabs rcx, 0x4c796c3888a36c2a
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
movzx eax, byte [rbp + r11 - 0x60]
add rax, r9
add r11, rax
lea r10d, [rbx + rcx]
sub r10b, 0x26
inc r11
jmp 0x14004ae73
inc rax
cmp r8, rax
jne 0x14004b586
movabs rcx, 0xe60b1500f72ce42e
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x42
jmp 0x14004b9bf
lea rax, [r9 + 3]
cmp r8, rax
jne 0x14004b5b5
movabs rcx, 0x7f9cbdc965b65c32
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x5e
add r8, r9
jmp 0x14004b988
lea rax, [r9 + 8]
cmp r8, rax
jne 0x14004b360
mov ecx, gethostname
movabs rdx, 0xb2c00f5a42c94c3a
add rdx, r11
movzx eax, dl
and al, bl
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
jmp 0x14004b913
lea rcx, [r9 + 1]
cmp r8, rcx
jne 0x14004b616
movabs rcx, 0x72b62254ccf5223f
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
add r10b, 0x47
jmp 0x14004b913
lea rax, [r9 + 3]
cmp r8, rax
jne 0x14004b648
movabs rcx, 0xc47cb1d3b7e9a43
add rcx, r11
dec r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
add r10b, 0x2b
inc r11
jmp 0x14004ae73
lea rax, [rcx + 1]
cmp r8, rax
jne 0x14004b677
movabs rcx, 0xa5d973e5aa081247
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
add r10b, 0xf
add r8, r9
jmp 0x14004b988
lea rax, [r9 + 4]
cmp r8, rax
jne 0x14004b304
movabs rcx, 0x3f6b1cae18918a4b
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0xd
jmp 0x14004b9bf
lea rax, [r9 + 1]
cmp r8, rax
jne 0x14004b6e2
movzx eax, bl
movabs rcx, 0x98f2d8711146d854
add rcx, r11
and al, cl
add al, al
sub bl, al
movzx eax, byte [rbp + r11 - 0x60]
add rax, r9
add r11, rax
lea r10d, [rcx + rbx]
sub r10b, 0x4c
inc r11
jmp 0x14004ae73
inc rax
cmp r8, rax
jne 0x14004b711
movabs rdx, 0x328481397fd05058
movzx eax, bl
add rdx, r11
movzx r10d, bl
and al, dl
add al, al
sub r10b, al
sub r10b, 0x68
add r10b, dl
jmp 0x14004b9bf
lea rax, [r9 + 4]
cmp r8, rax
jne 0x14004b745
mov ecx, 0x3e
movabs rdx, 0xcc162a01ee59c85c
add rdx, r11
movzx eax, bl
and al, dl
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
add r8, r9
jmp 0x14004b988
lea rax, [r9 + 3]
cmp r8, rax
jne 0x14004b776
mov ecx, gethostname
movabs rdx, 0x18defe66259e845e
add rdx, r11
movzx eax, bl
and al, dl
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
jmp 0x14004b8c7
lea rax, [r9 + 6]
cmp r8, rax
jne 0x14004b2b4
mov ecx, Ordinal_50
movabs rdx, 0x65a7d2ca5ce34060
add rdx, r11
movzx eax, bl
and al, dl
dec r11
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
inc r11
jmp 0x14004ae73
mov ecx, reloc.WS2_32.dll_sendto
movabs rdx, 0x98cb245b39f63068
add rdx, r11
movzx eax, bl
and al, dl
sub cl, al
lea r10d, [rcx + rcx]
add r10b, byte [rbp + r11 - 0x60]
add r10b, bl
add r10b, dl
jmp 0x14004b8c7
mov ecx, reloc.WS2_32.dll_listen
movabs rdx, 0xe593f8bf713aec6a
add rdx, r11
movzx eax, bl
and al, dl
sub cl, al
lea r10d, [rcx + rcx]
sub r10b, byte [rbp + r11 - 0x60]
add r10b, bl
add r10b, dl
jmp 0x14004b9bf
movabs rcx, 0xd94c2da235bc5227
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
movzx eax, byte [rbp + r11 - 0x60]
add rax, r9
add r11, rax
lea r10d, [rbx + rcx]
sub r10b, 0x11
inc r11
jmp 0x14004ae73
movabs rcx, 0x8c83593dfe779625
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 3
jmp 0x14004b9ee
movabs rcx, 0xf2f1b0758fee1e21
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
add r10b, 0x19
jmp 0x14004b988
movabs rcx, 0xa628dc1158a9621f
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
add r10b, 0x27
add r8, r9
jmp 0x14004b988
movabs rcx, 0x596007ad2164a61d
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
add r10b, 0x35
movabs rdx, 0xbf2f8e8d55988e69
movzx ecx, r10b
add rdx, r11
movzx eax, dl
and al, bl
add al, al
sub cl, al
add cl, 0x21
add cl, dl
add cl, bl
mov byte [rbp + r11 - 0x60], cl
add r8, r9
jmp 0x14004b988
movabs rcx, 0x73058a807b967217
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
add r10b, 0x5f
movzx eax, bl
movabs rcx, 0x7266ba291e53d267
add rcx, r11
and al, cl
add al, al
sub bl, al
add bl, 0x2f
add bl, cl
mov byte [rbp + r11 - 0x60], bl
inc r9
dec r11
inc r11
jmp 0x14004ae73
movabs rcx, 0x3fe238ef9e83820f
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x69
dec r11
inc r11
jmp 0x14004ae73
movabs rcx, 0x5987bbc2f8b54e09
add rcx, r11
movzx eax, cl
and al, dl
add al, al
sub dl, al
lea r10d, [rcx + rdx]
sub r10b, 0x3f
movzx eax, r10b
mov rcx, 0xffffffffffffffff
sub rcx, rax
add r11, rcx
inc r11
jmp 0x14004ae73
mov rbx, rdx
movabs rax, 0xcbee75ec1709207
add rax, r11
and dl, al
add dl, dl
sub al, dl
lea r10d, [rbx + rax]
sub r10b, 0x31
movzx eax, bl
inc r9
movabs rdx, 0xbf862f18cdd4a6b
movzx ecx, bl
add rdx, r11
and al, dl
add al, al
sub cl, al
add cl, 0x13
add cl, dl
movzx eax, cl
mov byte [rbp + r11 - 0x60], al
add rax, r9
sub r11, rax
movzx eax, bl
inc r8
movabs rdx, 0x325ccd23a87fa86c
mov ecx, 6
add rdx, r11
and al, dl
sub cl, al
mov rax, 0xffffffffffffffff
sub rax, r8
add cl, cl
add cl, bl
add cl, dl
mov byte [rbp + r11 - 0x60], cl
add r11, rax
movzx eax, byte [rbp + r11 - 0x60]
add rax, r9
add r11, rax
inc r11
jmp 0x14004ae73
movzx eax, dl
movabs rcx, 0x732d3e9652e71a03
add rcx, r11
and al, cl
add al, al
sub dl, al
lea r10d, [rcx + rdx]
sub r10b, 0x15
movzx eax, byte [rbp + r11 - 0x60]
add rax, r9
add r11, rax
inc r11
jmp 0x14004ae73
movabs rcx, 0xf22b2c085b5ad685
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
add r10b, 0x5d
jmp 0x14004ae70
movabs rcx, 0xa56257a424161a83
add rcx, r11
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
add r10b, 0x6b
jmp 0x14004ae60
lea rdx, [rbp + 0x157284c]
jmp 0x14004bac4
lea rdx, [rbp + 0x79864d]
jmp 0x14004bac4
lea rdx, [rbp - 0x60]
mov rcx, qword [rbp - 8]
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x10]
xor r8d, r8d
mov qword [rsp + 0x20], 0
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov ecx, dword [rbp - 0x10]
call fcn.1401991a8
movzx r10d, byte [rsp + 0x30]
mov rsi, rax
xor eax, eax
mov dword [rbp - 0x38], 0x627095ae
xorps xmm0, xmm0
mov dword [rbp - 0x1c], eax
mov word [rbp - 0x18], ax
movabs r13, 0x690120765c1252e0
mov byte [rbp - 0x16], al
movabs r14, 0x9d17a9b58d80cc60
mov dword [rbp - 0x34], 0x666a766a
movabs r15, 0x39ca043fdf2ffa0
mov dword [rbp - 0x30], 0xcb6e6c7c
movabs r12, 0x319a5f5745ce59e0
movups xmmword [rbp - 0x2c], xmm0
nop dword [rax + rax]
mov rax, qword [0x14023d108]
mov r9, qword [0x14023d100]
nop
xor edi, edi
cmp rdi, 0x23
jae 0x14004c719
movzx ebx, byte [rbp + rdi - 0x38]
mov r11, rbx
cmp rax, rdi
ja 0x14004c710
lea rcx, [r9 + 1]
cmp rax, rcx
jae 0x14004bba1
lea rdx, [rdi + r13]
mov r10, rbx
movzx ecx, dl
and cl, r11b
add cl, cl
sub r10b, cl
sub r10b, 0x20
add r10b, dl
jmp 0x14004bbd0
je 0x14004c688
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x14004c5f3
lea rcx, [r9 + 4]
cmp rax, rcx
je 0x14004c5b9
lea rcx, [r9 + 2]
cmp rax, rcx
je 0x14004c56c
nop
cmp r9, rdi
ja 0x14004c707
lea rcx, [r9 + 0x40]
cmp rax, rcx
jae 0x14004bbff
lea r8, [rdi + r14]
mov edx, Ordinal_50
movzx ecx, r8b
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
jmp 0x14004bc50
lea rcx, [r9 + 1]
cmp rax, rcx
je 0x14004c515
lea rdx, [r9 + 3]
cmp rax, rdx
je 0x14004c4ec
inc rcx
cmp rax, rcx
je 0x14004c4c3
lea rcx, [r9 + 5]
cmp rax, rcx
je 0x14004c49a
lea rcx, [r9 + 7]
cmp rax, rcx
je 0x14004c477
cmp rax, rdx
je 0x14004c440
nop dword [rax + rax]
lea rcx, [r9 + rax]
cmp rcx, rdi
jbe 0x14004c167
nop dword [rax]
lea rcx, [r9 + 0x10]
cmp rax, rcx
je 0x14004c153
lea rcx, [r9 + 9]
cmp rax, rcx
je 0x14004c224
lea rcx, [r9 + 6]
cmp rax, rcx
je 0x14004c12a
lea rcx, [r9 + 4]
cmp rax, rcx
je 0x14004c11b
lea rcx, [r9 + 0x3e8]
cmp rax, rcx
je 0x14004c0f2
lea rcx, [r9 + 0x80]
cmp rax, rcx
je 0x14004c0db
lea rcx, [r9 + 0x42]
cmp rax, rcx
je 0x14004c0b8
lea rcx, [r9 + 0x28]
cmp rax, rcx
je 0x14004c0a9
lea rax, [r9 + 0x64]
lea r9, [rax + 0x7a]
lea rcx, [r9 + 0x40]
cmp rax, rcx
jb 0x14004c6e4
lea rcx, [r9 + 0x20]
cmp rax, rcx
jb 0x14004c6bb
lea rcx, [r9 + 0x2a]
cmp rax, rcx
jb 0x14004be0e
lea rcx, [r9 + 0x41]
cmp rax, rcx
jb 0x14004bdf4
lea rcx, [r9 + 0x61]
cmp rax, rcx
jb 0x14004bdda
lea rcx, [r9 + 0x400]
cmp rax, rcx
jb 0x14004c041
lea rcx, [r9 + 0x200]
cmp rax, rcx
jb 0x14004bfde
lea rcx, [r9 + 0x64]
cmp rax, rcx
jb 0x14004bf90
lea rcx, [r9 + 4]
cmp rax, rcx
jb 0x14004bf65
lea rcx, [r9 + 2]
cmp rax, rcx
jb 0x14004bc60
lea rax, [r9 + 0x3e8]
lea r9, [rax + 0x2a]
lea rcx, [r9 + 8]
cmp rax, rcx
ja 0x14004bf40
lea rcx, [r9 + 5]
cmp rax, rcx
ja 0x14004bf18
lea rcx, [r9 + 3]
cmp rax, rcx
ja 0x14004bef5
lea rcx, [r9 + 1]
cmp rax, rcx
ja 0x14004becc
lea rcx, [r9 + 0x5a]
cmp rax, rcx
ja 0x14004beb5
lea rcx, [r9 + 0x7a]
cmp rax, rcx
ja 0x14004be92
lea rcx, [r9 + 0x20]
cmp rax, rcx
ja 0x14004be69
lea rcx, [r9 + 0xa]
cmp rax, rcx
ja 0x14004be37
lea rax, [r9 + 0x28]
lea r9, [rax + 3]
jmp 0x14004bc60
lea rdx, [rdi + r15]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x60
jmp 0x14004bc50
lea rdx, [rdi + r12]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x20
jmp 0x14004bbd0
mov edx, reloc.WS2_32.dll_recv
movabs r8, 0x5f981e6a8da9b420
add r8, rdi
movzx ecx, r8b
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
jmp 0x14004bb71
mov edx, reloc.WLDAP32.dll_Ordinal_32
movabs r8, 0x16bb0cbfb3e1bd40
add r8, rdi
inc r9
movzx ecx, r8b
dec rdi
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
inc rdi
jmp 0x14004bb62
movabs rdx, 0x44b8cbd2fbbd1780
add rdx, rdi
dec rdi
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
add r10b, 0x80
inc rdi
jmp 0x14004bb62
movabs rdx, 0x72b68ae6439871c0
add rdx, rdi
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x40
jmp 0x14004c590
movzx edx, dil
movzx r10d, dil
and dl, bl
add dl, dl
sub r10b, dl
add r10b, bl
jmp 0x14004c5d7
mov edx, reloc.WLDAP32.dll_Ordinal_32
movabs r8, 0xceb2090cd34f2640
add r8, rdi
movzx ecx, r8b
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
jmp 0x14004c5da
movabs rdx, 0xfcafc8201b2a8080
add rdx, rdi
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
add r10b, 0x80
jmp 0x14004c61b
movabs r8, 0x2aad87336305dac0
movzx r10d, bl
add r8, rdi
movzx ecx, r8b
and cl, bl
add cl, cl
sub r10b, cl
sub r10b, 0x40
add r10b, r8b
jmp 0x14004c646
movzx ecx, byte [rbp + rdi - 0x38]
movzx edx, dil
movzx r10d, dil
and dl, bl
add dl, dl
add rcx, r9
sub r10b, dl
add rdi, rcx
add r10b, bl
inc rdi
jmp 0x14004bb62
movabs rdx, 0x4ba5a3f6de8596a0
add rdx, rdi
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x60
mov byte [rbp + rdi - 0x38], r10b
inc rdi
jmp 0x14004bb62
movabs rdx, 0x79a3630a2660f0e0
add rdx, rdi
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x20
cmp r9, 2
jb 0x14004bf83
movzx edx, bl
movabs r8, 0xd672ef28af4d0540
add r8, rdi
movzx ecx, r8b
and cl, bl
add cl, cl
sub dl, cl
add dl, r8b
lea r10d, [rdx*2 + 0x80]
jmp 0x14004c539
mov edx, reloc.WS2_32.dll_recv
movabs r8, 0xa7a1221d6e3c4b20
add r8, rdi
movzx ecx, bl
and cl, r8b
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, bl
add r10b, r8b
cmp rax, 0x5a
jae 0x14004c3fd
lea rcx, [r9 + 0x64]
cmp rax, rcx
jbe 0x14004c30d
movabs r8, 0xa25c65e97dde8bc0
movzx ecx, bl
add r8, rdi
movzx r10d, bl
and cl, r8b
add cl, cl
sub r10b, cl
sub r10b, 0x40
add r10b, r8b
jmp 0x14004bfae
mov edx, Ordinal_50
movabs r8, 0xd59ee130b617a560
add r8, rdi
movzx ecx, r8b
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
lea rcx, [r9 + rax]
cmp rcx, 5
je 0x14004c419
lea rcx, [r9 + 0x28]
cmp rax, rcx
jbe 0x14004c279
mov edx, Ordinal_50
movabs r8, 0x544bc33f05dbf60
add r8, rdi
movzx ecx, r8b
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
jmp 0x14004c002
movabs rdx, 0xdc8bb95498e02480
jmp 0x14004c1d6
movabs rdx, 0xa897867e0bb7ec0
add rdx, rdi
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x40
jmp 0x14004c61b
movzx edx, dil
movzx r10d, dil
and dl, bl
add dl, dl
sub r10b, dl
add r10b, bl
jmp 0x14004c5da
mov edx, reloc.WLDAP32.dll_Ordinal_32
movabs r8, 0x6684f68e70723340
add r8, rdi
movzx ecx, r8b
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
jmp 0x14004c5d7
movabs rdx, 0x9482b5a1b84d8d80
jmp 0x14004c202
movabs rdx, 0xc28074b50028e7c0
add rdx, rdi
dec rdi
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x40
inc rdi
jmp 0x14004bb62
movabs r8, 0x1e7bf2db8fdf9c40
mov edx, reloc.WLDAP32.dll_Ordinal_32
jmp 0x14004c524
lea rcx, [r9 + 0x2a]
cmp rax, rcx
jae 0x14004c18a
lea rdx, [rdi + r13]
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x20
jmp 0x14004c065
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x14004c1c4
movabs rdx, 0x3a2f536b1b0198c0
add rdx, rdi
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
movzx ecx, byte [rbp + rdi - 0x38]
add rcx, r9
add rdi, rcx
lea r10d, [rbx + rdx]
sub r10b, 0x40
inc rdi
jmp 0x14004bb62
inc rcx
cmp rax, rcx
jne 0x14004c1ef
movabs rdx, 0xc319457d3263e80
add rdx, rdi
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
add r10b, 0x80
jmp 0x14004c646
lea rcx, [r9 + 5]
cmp rax, rcx
jne 0x14004c21b
movabs rdx, 0x543a980ab3b8d580
add rdx, rdi
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
add r10b, 0x80
jmp 0x14004c590
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x14004c244
movzx edx, dil
movzx r10d, dil
and dl, bl
inc r9
add dl, dl
dec rdi
sub r10b, dl
add r10b, bl
inc rdi
jmp 0x14004bb62
lea rcx, [r9 + 9]
cmp rax, rcx
jne 0x14004c065
movabs r8, 0xca415ad0dc26c6c0
movzx r10d, bl
add r8, rdi
movzx ecx, r8b
and cl, bl
add cl, cl
sub r10b, cl
sub r10b, 0x40
add r10b, r8b
jmp 0x14004c539
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x14004c291
movabs r8, 0xd746fd20a8826520
jmp 0x14004c51f
inc rcx
cmp rax, rcx
jne 0x14004c2c5
movabs rdx, 0xa9493e0d60a70ae0
inc r9
add rdx, rdi
dec rdi
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x20
inc rdi
jmp 0x14004bb62
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x14004c2f1
movabs rdx, 0xf15241c04139a1e0
add rdx, rdi
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x20
jmp 0x14004c5da
lea rcx, [r9 + 4]
cmp rax, rcx
jne 0x14004c002
movabs rdx, 0xc35482acf95e47a0
jmp 0x14004c481
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x14004c347
movzx ecx, bl
movabs rdx, 0x745ea6d636033180
add rdx, rdi
and cl, dl
add cl, cl
sub bl, cl
movzx ecx, byte [rbp + rdi - 0x38]
add rcx, r9
add rdi, rcx
lea r10d, [rdx + rbx]
add r10b, 0x80
inc rdi
jmp 0x14004bb62
inc rcx
cmp rax, rcx
jne 0x14004c372
movzx ecx, bl
movabs rdx, 0xea65699c5e7122c0
add rdx, rdi
and cl, dl
add cl, cl
sub bl, cl
lea r10d, [rdx + rbx]
sub r10b, 0x40
jmp 0x14004c5da
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x14004c39e
movzx ecx, bl
movabs rdx, 0xbc67aa891695c880
add rdx, rdi
and cl, dl
add cl, cl
sub bl, cl
lea r10d, [rdx + rbx]
add r10b, 0x80
jmp 0x14004c5d7
lea rcx, [r9 + 5]
cmp rax, rcx
jne 0x14004c3c4
movabs r8, 0x8e69eb75ceba6e40
movzx ecx, bl
add r8, rdi
mov edx, reloc.WLDAP32.dll_Ordinal_32
and cl, r8b
jmp 0x14004c584
lea rcx, [r9 + 7]
cmp rax, rcx
jne 0x14004bfae
movzx ecx, bl
movabs rdx, 0x326e6d4f3f03b9c0
add rdx, rdi
inc r9
and cl, dl
dec rdi
add cl, cl
sub bl, cl
lea r10d, [rdx + rbx]
sub r10b, 0x40
inc rdi
jmp 0x14004bb62
movzx r10d, byte [rbp + rdi - 0x38]
movzx ecx, dil
and cl, bl
add cl, cl
sub r10b, cl
add r10b, bl
add r10b, dil
jmp 0x14004c590
movabs rdx, 0x7a7771021f9650c0
add rdx, rdi
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
sub dl, byte [rbp + rdi - 0x38]
lea r10d, [rbx + rdx]
sub r10b, 0x40
jmp 0x14004c61b
mov edx, reloc.WS2_32.dll_recv
movabs r8, 0xff2bf20806caa020
add r8, rdi
movzx ecx, r8b
and cl, bl
sub dl, cl
movzx ecx, byte [rbp + rdi - 0x38]
add rcx, r9
add rdi, rcx
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
inc rdi
jmp 0x14004bb62
movabs rdx, 0x5b27702e968154a0
add rdx, rdi
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x60
jmp 0x14004c61b
mov edx, reloc.WS2_32.dll_recv
movabs r8, 0xb722ee5526380920
add r8, rdi
movzx ecx, r8b
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
jmp 0x14004c5d7
mov edx, Ordinal_50
movabs r8, 0xe520ad686e136360
add r8, rdi
movzx ecx, r8b
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
jmp 0x14004c590
movabs rdx, 0x131e6c7bb5eebda0
add rdx, rdi
dec rdi
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x60
inc rdi
jmp 0x14004bb62
movabs r8, 0x6f19eaa245a57220
mov edx, reloc.WS2_32.dll_recv
add r8, rdi
movzx ecx, r8b
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
movabs r8, 0x3f740f9f0b5f5820
movzx ecx, bl
add r8, rdi
mov edx, reloc.WS2_32.dll_recv
and cl, r8b
sub dl, cl
add dl, dl
add dl, bl
add dl, r8b
mov byte [rbp + rdi - 0x38], dl
inc r9
dec rdi
inc rdi
jmp 0x14004bb62
movabs r8, 0x550ea602acee3560
mov edx, Ordinal_50
add r8, rdi
movzx ecx, r8b
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, bl
add r10b, r8b
movabs r8, 0x1176508bc383fde0
movzx edx, r10b
add r8, rdi
movzx ecx, r8b
and cl, bl
add cl, cl
sub dl, cl
sub dl, 0x20
add dl, r8b
add dl, bl
mov byte [rbp + rdi - 0x38], dl
jmp 0x14004c5d7
movabs rdx, 0x830c6515f4c98fa0
add rdx, rdi
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
lea r10d, [rbx + rdx]
sub r10b, 0x60
add rax, r9
movzx ecx, r10b
mov rdx, 0xffffffffffffffff
sub rdx, rcx
add rdi, rdx
inc rdi
jmp 0x14004bb62
mov edx, reloc.WS2_32.dll_recv
movabs r8, 0xdf07e33c84804420
add r8, rdi
mov rbx, r11
movzx ecx, r8b
and cl, r11b
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r11b
add r10b, r8b
inc r9
movabs rdx, 0xe37891787ba8a3a0
add rdx, rdi
movzx ecx, dl
and cl, bl
add cl, cl
sub dl, cl
sub dl, 0x60
add dl, bl
movzx ecx, dl
mov byte [rbp + rdi - 0x38], cl
add rcx, r9
sub rdi, rcx
movzx ecx, bl
inc rax
movabs rdx, 0x4c79b1eed7baf680
add rdx, rdi
and cl, dl
add cl, cl
sub bl, cl
mov rcx, 0xffffffffffffffff
sub rcx, rax
add bl, 0x80
add bl, dl
mov byte [rbp + rdi - 0x38], bl
add rdi, rcx
movzx ecx, byte [rbp + rdi - 0x38]
add rcx, r9
add rdi, rcx
inc rdi
jmp 0x14004bb62
movzx ecx, r11b
movabs rdx, 0x3b0361631436f8a0
add rdx, rdi
and cl, dl
add cl, cl
sub r11b, cl
lea r10d, [rdx + r11]
sub r10b, 0x60
movzx ecx, byte [rbp + rdi - 0x38]
add rcx, r9
add rdi, rcx
inc rdi
jmp 0x14004bb62
mov edx, Ordinal_50
movabs r8, 0x8d95dd7dd5850e60
add r8, rdi
movzx ecx, r8b
and cl, bl
sub dl, cl
lea r10d, [rdx + rdx]
add r10b, r8b
add r10b, bl
jmp 0x14004bb60
movabs rcx, 0xbb939c911d6068a0
add rcx, rdi
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x60
jmp 0x14004bb50
lea rdx, [rbp + 0x14fae48]
jmp 0x14004c71d
lea rdx, [rbp + 0x620128]
jmp 0x14004c71d
lea rdx, [rbp - 0x38]
mov rcx, qword [rbp - 8]
lea rax, [rbp - 0x10]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x10]
xor r8d, r8d
mov qword [rsp + 0x20], rsi
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov eax, dword [rsi + 0x10]
lea rbx, [rsi + 0x18]
test eax, eax
je 0x14004c771
mov edi, eax
nop dword [rax]
lea r9, [rbx + 8]
mov r8, rbx
lea rdx, [rbp]
lea rcx, [0x14023caa0]
call fcn.1400590c0
add rbx, 0x14
sub rdi, 1
jne 0x14004c750
mov rcx, rsi
call fcn.140198e14
mov rcx, qword [rbp - 8]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, 1
mov rcx, qword [rbp + 0x18]
xor rcx, rsp
call fcn.140198db0
lea r11, [rsp + 0x120]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret