Function at 0x1400dbca0
Capabilities:
Delete file

Disassembly:
mov rax, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x3c0
mov qword [rax - 0x368], 0xfffffffffffffffe
mov qword [rax + 0x10], rbx
mov qword [rax + 0x20], rsi
mov rax, qword [0x14030bc70]
xor rax, rsp
mov qword [rsp + 0x3b0], rax
mov r15, r8
mov rsi, rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x60], r8
lea rcx, [rsp + 0x40]
call fcn.14001da60
nop
xor edi, edi
mov r13d, edi
mov dword [rsp + 0x68], edi
mov qword [rsp + 0x78], rdi
mov cl, 1
call fcn.140101bd0
nop
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [rsp + 0x78], rax
test rax, rax
je 0x1400dbd4f
mov dword [rsp + 0x20], edi
lea r9d, [rdi + 2]
lea r8, [0x14030b3a0]
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.1400599d0
mov r14d, 1
test eax, eax
cmovne r13d, r14d
mov dword [rsp + 0x68], r13d
jmp 0x1400dbd55
mov r14d, 1
jmp 0x1400dbd6c
mov dword [rsp + 0x6c], edi
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x190]
call fcn.140141ad0
mov r8d, 0x104
lea rdx, [rsp + 0x190]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rcx, [rsp + 0x190]
call fcn.140158fe0
lea rdx, str.spclientsvc
lea rcx, [rsp + 0x190]
call fcn.140158dcc
test rax, rax
je 0x1400dbffe
mov dword [0x140312190], r14d
mov r8d, 0x104
lea rbx, [0x140312a70]
mov rdx, rbx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathRemoveFileSpecA]
mov rcx, rbx
call qword [sym.imp.SHLWAPI.dll_PathAddBackslashA]
dec rbx
nop dword [rax]
lea rbx, [rbx + 1]
cmp byte [rbx], 0
jne 0x1400dbe00
movups xmm0, xmmword [str.msocxushell2.dll]
movups xmmword [rbx], xmm0
movzx eax, byte [0x14021b288]
mov byte [rbx + 0x10], al
mov dword [rsp + 0x6c], r14d
lea rdx, [rsp + 0x190]
lea rcx, [rsp + 0x88]
call fcn.140022180
nop
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x110]
call fcn.14002d2b0
nop
lea rcx, [rsp + 0x88]
call fcn.1400091f0
lea rdx, str..log
lea rcx, [rsp + 0x88]
call fcn.140022180
nop
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x110]
call fcn.14002d670
nop
lea rcx, [rsp + 0x88]
call fcn.1400091f0
xor eax, eax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0xc0], reloc.WSOCK32.dll_ntohs
mov qword [rsp + 0xb8], rdi
mov byte [rsp + 0xa8], al
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0x110]
call fcn.14002d550
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, eax
lea r8, [rsp + 0xa8]
mov rdx, rbx
mov ecx, 4
call fcn.1400296d0
nop
lea rcx, [rsp + 0x88]
call fcn.1400091f0
nop
lea rcx, [rsp + 0xa8]
call fcn.1400091f0
nop
call fcn.140029640
mov rbx, rax
lea rdx, str.COMMON
lea rcx, [rsp + 0x88]
call fcn.140022180
nop
mov qword [rsp + 0x20], r15
lea r9, str.Start_of_Client_Service_code___s_
lea r8, [rsp + 0x88]
mov edx, 2
mov rcx, rbx
call fcn.140027ff0
nop
lea rcx, [rsp + 0x88]
call fcn.1400091f0
nop
jmp 0x1400dbf93
lea rax, [rsp + 0x170]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x170]
call fcn.1400091f0
nop
lea rax, [rsp + 0x150]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x150]
call fcn.1400091f0
nop
lea rax, [rsp + 0x130]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x130]
call fcn.1400091f0
nop
lea rax, [rsp + 0x110]
mov qword [rsp + 0x50], rax
lea rcx, [rsp + 0x110]
jmp 0x1400dc0cf
mov qword [rsp + 0x88], rax
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x98], rax
mov qword [rsp + 0xa0], rax
mov qword [rsp + 0xa8], rax
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0xc0], rax
mov qword [rsp + 0x98], rdi
mov qword [rsp + 0xa0], rdi
mov qword [rsp + 0xa0], reloc.WSOCK32.dll_ntohs
mov qword [rsp + 0x98], rdi
mov byte [rsp + 0x88], al
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0xc0], reloc.WSOCK32.dll_ntohs
mov qword [rsp + 0xb8], rdi
mov byte [rsp + 0xa8], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov r9d, eax
lea r8, [rsp + 0x88]
lea rdx, [rsp + 0xa8]
mov ecx, 4
call fcn.1400296d0
nop
lea rcx, [rsp + 0xa8]
call fcn.1400091f0
nop
lea rcx, [rsp + 0x88]
call fcn.1400091f0
xor eax, eax
movzx edx, al
lea rcx, [rsp + 0x58]
call fcn.1400dba30
nop
mov rcx, rsi
call fcn.140101430
or r12, 0xffffffffffffffff
mov dword [rsp + 0x5c], r12d
mov qword [0x140312348], rsi
mov qword [rsp + 0xf8], rdi
mov qword [rsp + 0x100], rdi
mov qword [rsp + 0x100], reloc.WSOCK32.dll_ntohs
mov qword [rsp + 0xf8], rdi
mov byte [rsp + 0xe8], 0
mov qword [rsp + 0xd8], rdi
mov qword [rsp + 0xe0], rdi
mov qword [rsp + 0xe0], reloc.WSOCK32.dll_ntohs
mov qword [rsp + 0xd8], rdi
mov byte [rsp + 0xc8], 0
lea rdx, str._sr__
mov rcx, r15
call fcn.1401422f8
test rax, rax
je 0x1400dc37c
lea rdx, [rax + 5]
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0xc0], reloc.WSOCK32.dll_ntohs
mov qword [rsp + 0xb8], rdi
mov byte [rsp + 0xa8], 0
cmp byte [rdx], 0
jne 0x1400dc1a6
mov r8, rdi
jmp 0x1400dc1ba
mov r8, r12
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400dc1b0
lea rcx, [rsp + 0xa8]
call fcn.140009d60
nop
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0xe8]
call fcn.140009230
nop
mov rax, qword [rsp + 0xc0]
cmp rax, 0x10
jb 0x1400dc23c
inc rax
mov rcx, qword [rsp + 0xa8]
cmp rax, 0x1000
jb 0x1400dc237
test cl, 0x1f
je 0x1400dc20a
call fcn.14014b4d8
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400dc219
call fcn.14014b4d8
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400dc228
call fcn.14014b4d8
int3
cmp rcx, 0x27
jbe 0x1400dc234
call fcn.14014b4d8
int3
mov rcx, rax
call fcn.1400dbae0
mov qword [rsp + 0xc0], reloc.WSOCK32.dll_ntohs
mov qword [rsp + 0xb8], rdi
mov byte [rsp + 0xa8], 0
mov rsi, qword [rsp + 0xf8]
test rsi, rsi
je 0x1400dc2d5
cmp rsi, 1
jb 0x1400dc2d5
lea rbx, [rsp + 0xe8]
cmp qword [rsp + 0x100], 0x10
cmovae rbx, qword [rsp + 0xe8]
test rsi, rsi
je 0x1400dc2d5
mov r8, rsi
mov edx, 0x22
mov rcx, rbx
call fcn.140141cac
mov r9, rax
test rax, rax
je 0x1400dc2d5
cmp byte [rax], 0x22
je 0x1400dc2b6
sub rbx, rax
dec rbx
add rsi, rbx
lea rbx, [rax + 1]
jmp 0x1400dc285
lea rax, [rsp + 0xe8]
cmp qword [rsp + 0x100], 0x10
cmovae rax, qword [rsp + 0xe8]
sub r9, rax
jmp 0x1400dc2d8
mov r9, r12
xor r8d, r8d
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0xe8]
call fcn.1400150d0
nop
mov rdx, rax
lea rcx, [rsp + 0xe8]
call fcn.140009230
nop
mov rax, qword [rsp + 0xa0]
cmp rax, 0x10
jb 0x1400dc360
inc rax
mov rcx, qword [rsp + 0x88]
cmp rax, 0x1000
jb 0x1400dc35b
test cl, 0x1f
je 0x1400dc32e
call fcn.14014b4d8
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400dc33d
call fcn.14014b4d8
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400dc34c
call fcn.14014b4d8
int3
cmp rcx, 0x27
jbe 0x1400dc358
call fcn.14014b4d8
int3
mov rcx, rax
call fcn.1400dbae0
mov qword [rsp + 0xa0], reloc.WSOCK32.dll_ntohs
mov qword [rsp + 0x98], rdi
mov byte [rsp + 0x88], 0
lea rdx, [0x14021b2bc]
mov rcx, r15
call fcn.1401422f8
test rax, rax
je 0x1400dc59d
lea rdx, [rax + 6]
mov qword [rsp + 0xb8], rdi
mov qword [rsp + 0xc0], rdi
mov qword [rsp + 0xc0], reloc.WSOCK32.dll_ntohs
mov qword [rsp + 0xb8], rdi
mov byte [rsp + 0xa8], 0
cmp byte [rdx], 0
jne 0x1400dc3ce
mov r8, rdi
jmp 0x1400dc3db
mov r8, r12
inc r8
cmp byte [rdx + r8], 0
jne 0x1400dc3d1
lea rcx, [rsp + 0xa8]
call fcn.140009d60
nop
lea rdx, [rsp + 0xa8]
lea rcx, [rsp + 0xc8]
call fcn.140009230
nop
mov rax, qword [rsp + 0xc0]
cmp rax, 0x10
jb 0x1400dc45d
inc rax
mov rcx, qword [rsp + 0xa8]
cmp rax, 0x1000
jb 0x1400dc458
test cl, 0x1f
je 0x1400dc42b
call fcn.14014b4d8
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400dc43a
call fcn.14014b4d8
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400dc449
call fcn.14014b4d8
int3
cmp rcx, 0x27
jbe 0x1400dc455
call fcn.14014b4d8
int3
mov rcx, rax
call fcn.1400dbae0
mov qword [rsp + 0xc0], reloc.WSOCK32.dll_ntohs
mov qword [rsp + 0xb8], rdi
mov byte [rsp + 0xa8], 0
mov rsi, qword [rsp + 0xd8]
test rsi, rsi
je 0x1400dc4f6
cmp rsi, 1
jb 0x1400dc4f6
lea rbx, [rsp + 0xc8]
cmp qword [rsp + 0xe0], 0x10
cmovae rbx, qword [rsp + 0xc8]
test rsi, rsi
je 0x1400dc4f6
mov r8, rsi
mov edx, 0x22
mov rcx, rbx
call fcn.140141cac
mov r9, rax
test rax, rax
je 0x1400dc4f6
cmp byte [rax], 0x22
je 0x1400dc4d7
sub rbx, rax
dec rbx
add rsi, rbx
lea rbx, [rax + 1]
jmp 0x1400dc4a6
lea rax, [rsp + 0xc8]
cmp qword [rsp + 0xe0], 0x10
cmovae rax, qword [rsp + 0xc8]
sub r9, rax
jmp 0x1400dc4f9
mov r9, r12
xor r8d, r8d
lea rdx, [rsp + 0x88]
lea rcx, [rsp + 0xc8]
call fcn.1400150d0
nop
mov rdx, rax
lea rcx, [rsp + 0xc8]
call fcn.140009230
nop
mov rax, qword [rsp + 0xa0]
cmp rax, 0x10
jb 0x1400dc581
inc rax
mov rcx, qword [rsp + 0x88]
cmp rax, 0x1000
jb 0x1400dc57c
test cl, 0x1f
je 0x1400dc54f
call fcn.14014b4d8
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400dc55e
call fcn.14014b4d8
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400dc56d
call fcn.14014b4d8
int3
cmp rcx, 0x27
jbe 0x1400dc579
call fcn.14014b4d8
int3
mov rcx, rax
call fcn.1400dbae0
mov qword [rsp + 0xa0], reloc.WSOCK32.dll_ntohs
mov qword [rsp + 0x98], rdi
mov byte [rsp + 0x88], 0
lea rcx, [rsp + 0xe8]
call fcn.1400dde70
mov r14, rax
mov qword [rsp + 0x70], rax
test r13d, r13d
je 0x1400dc5d1
mov r9d, 2
lea r8, [0x14030b3a0]
mov rdx, qword [rsp + 0x78]
mov rcx, rax
call fcn.1400e06d0
mov rsi, rdi
mov qword [rsp + 0x48], rdi
lea rdx, [0x14021b2c4]
mov rcx, r15
call fcn.1401422f8
test rax, rax
je 0x1400dc937
mov rcx, qword [0x14030b570]
mov qword [rsp + 0x60], rcx
lea rdx, [rax + 2]
lea rcx, [rsp + 0x60]
call fcn.1400f82d0
lea rcx, [rsp + 0x60]
call fcn.1400f9550
lea rcx, [rsp + 0x60]
call fcn.1400f95d0
mov rax, qword [rsp + 0x60]
cmp qword [rax - 0x10], 0
cmovg rsi, rax
mov qword [rsp + 0x48], rsi
call fcn.140029640
mov rbx, rax
lea rdx, str.COMMON
lea rcx, [rsp + 0x88]
call fcn.140022180
nop
lea rax, str.local
test rsi, rsi
cmovne rax, rsi
mov qword [rsp + 0x20], rax
lea r9, str.Client_Install_Machine_Name___s_
lea r8, [rsp + 0x88]
mov edx, 2
mov rcx, rbx
call fcn.140027ff0
nop
lea rcx, [rsp + 0x88]
call fcn.1400091f0
nop
jmp 0x1400dc6a0
test rsi, rsi
je 0x1400dc6ce
cmp byte [rsi], 0
je 0x1400dc6ce
mov rcx, rsi
lea rdx, [0x140312350]
sub rdx, rsi
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400dc6c0
mov r15, rdi
test rsi, rsi
je 0x1400dc856
cmp byte [rsi], 0
je 0x1400dc856
mov edx, 0x5c
lea rcx, [rsp + 0x190]
call fcn.1401421b8
mov r8, rax
test rax, rax
je 0x1400dc702
inc r8
jmp 0x1400dc70a
lea r8, [rsp + 0x190]
movups xmm0, xmmword [str._SystemRoot_System32_]
movaps xmmword [rsp + 0x2a0], xmm0
mov eax, dword [0x14021b308]
mov dword [rsp + 0x2b0], eax
movzx eax, word [0x14021b30c]
mov word [rsp + 0x2b4], ax
movzx eax, byte [0x14021b30e]
mov byte [rsp + 0x2b6], al
lea rcx, [rsp + 0x2a0]
dec rcx
nop
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x1400dc750
xor edx, edx
nop dword [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x1400dc760
lea r15, [rsp + 0x2a0]
mov qword [rsp + 0x50], r15
call fcn.140029640
mov rbx, rax
lea rdx, str.COMMON
lea rcx, [rsp + 0x88]
call fcn.140022180
nop
lea rax, [rsp + 0x2a0]
mov qword [rsp + 0x20], rax
lea r9, str.Client_Service_Path___s_
lea r8, [rsp + 0x88]
mov edx, 2
mov rcx, rbx
call fcn.140027ff0
nop
lea rcx, [rsp + 0x88]
call fcn.1400091f0
nop
jmp 0x1400dc7ea
lea rcx, [r14 + 8]
xor eax, eax
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
lea r8d, [rax + 0x3f]
lea rdx, str.Systems_Events_Dispatchers_Bootstrap_
call fcn.140157390
lea rcx, [r14 + 0x48]
xor eax, eax
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
lea r8d, [rax + 0x3f]
lea rdx, str.Systems_Events_Dispatchers_Bootstrap_
call fcn.140157390
jmp 0x1400dc87b
cmp qword [rsp + 0xd8], 0
je 0x1400dc87b
lea r15, [rsp + 0xc8]
cmp qword [rsp + 0xe0], 0x10
cmovae r15, qword [rsp + 0xc8]
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rsi
mov r9d, 0x100
mov r8, r15
mov edx, 2
mov rcx, r14
call fcn.1400b5310
test eax, eax
je 0x1400dc910
call fcn.140029640
mov rbx, rax
lea rdx, str.COMMON
lea rcx, [rsp + 0x88]
call fcn.140022180
nop
lea rcx, [r14 + 8]
mov qword [rsp + 0x20], rcx
lea r9, str.Client_Service_Name___s_
lea r8, [rsp + 0x88]
mov edx, 2
mov rcx, rbx
call fcn.140027ff0
nop
lea rcx, [rsp + 0x88]
call fcn.1400091f0
nop
jmp 0x1400dc903
mov rcx, r14
call fcn.1400e06f0
mov r12d, edi
jmp 0x1400dc915
mov byte [rsp + 0x58], 1
test rsi, rsi
jne 0x1400dc928
test r12d, r12d
jne 0x1400dc928
mov rcx, r14
call fcn.1400ddce0
nop
lea rcx, [rsp + 0x60]
call fcn.1400f81a0
jmp 0x1400dce98
lea rdx, [0x14021b374]
mov rcx, r15
call fcn.1401422f8
test rax, rax
je 0x1400dcbd9
call fcn.140029640
mov rbx, rax
lea rdx, str.COMMON
lea rcx, [rsp + 0x88]
call fcn.140022180
nop
lea r9, str.Uninstalling_service...
lea r8, [rsp + 0x88]
mov edx, 2
mov rcx, rbx
call fcn.140027ff0
nop
lea rcx, [rsp + 0x88]
call fcn.1400091f0
nop
jmp 0x1400dc9af
mov rax, qword [0x14030b570]
mov qword [rsp + 0x50], rax
lea rdx, [0x14021b390]
mov rcx, r15
call fcn.1401422f8
test rax, rax
je 0x1400dcaf9
lea rdx, [rax + 3]
lea rcx, [rsp + 0x50]
call fcn.1400f82d0
lea rcx, [rsp + 0x50]
call fcn.1400f9550
lea rcx, [rsp + 0x50]
call fcn.1400f95d0
mov rax, qword [rsp + 0x50]
cmp qword [rax - 0x10], 0
jle 0x1400dca2e
mov rsi, rax
mov qword [rsp + 0x48], rax
cmp byte [rax], 0
je 0x1400dca2e
lea rdx, [0x140312350]
sub rdx, rax
nop dword [rax + rax]
movzx ecx, byte [rax]
mov byte [rdx + rax], cl
lea rax, [rax + 1]
test cl, cl
jne 0x1400dca20
call fcn.140029640
mov rbx, rax
lea rdx, str.COMMON
lea rcx, [rsp + 0x88]
call fcn.140022180
nop
lea r9, str.Uninstalling_service...service_only
lea r8, [rsp + 0x88]
mov edx, 2
mov rcx, rbx
call fcn.140027ff0
nop
lea rcx, [rsp + 0x88]
call fcn.1400091f0
nop
jmp 0x1400dca8e
lea rcx, [r14 + 8]
xor eax, eax
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
lea r8d, [rax + 0x3f]
lea rdx, str.Systems_Events_Dispatchers_Bootstrap_
call fcn.140157390
lea rcx, [r14 + 0x48]
xor eax, eax
mov qword [rcx], rax
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], rax
mov qword [rcx + 0x20], rax
mov qword [rcx + 0x28], rax
mov qword [rcx + 0x30], rax
mov qword [rcx + 0x38], rax
lea r8d, [rax + 0x3f]
lea rdx, str.Systems_Events_Dispatchers_Bootstrap_
call fcn.140157390
nop
call fcn.140029640
mov rbx, rax
lea rdx, str.COMMON
lea rcx, [rsp + 0x88]
call fcn.140022180
nop
lea rax, str.local
test rsi, rsi
cmovne rax, rsi
lea rcx, [r14 + 8]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r9, str.Uninstall_service_name___s__on___s_
lea r8, [rsp + 0x88]
mov edx, 2
mov rcx, rbx
call fcn.140027ff0
nop
lea rcx, [rsp + 0x88]
call fcn.1400091f0
nop
jmp 0x1400dcb75
mov rcx, r14
call fcn.1400e0720
test eax, eax
je 0x1400dcb91
mov rdx, rsi
mov rcx, r14
call fcn.1400b6600
mov r12d, edi
jmp 0x1400dcb96
mov byte [rsp + 0x58], 1
lea rdx, [0x14021b3e4]
mov rcx, r15
call fcn.1401422f8
test rax, rax
je 0x1400dcbca
xor edx, edx
lea rcx, [rsp + 0x190]
call fcn.1400fd640
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.1400fc770
nop
lea rcx, [rsp + 0x50]
call fcn.1400f81a0
jmp 0x1400dce98
lea rdx, [0x14021b3e8]
mov rcx, r15
call fcn.1401422f8
test rax, rax
je 0x1400dcc8a
call fcn.1400dbbe0
mov rbx, rax
test rax, rax
je 0x1400dcc72
xor edx, edx
mov r8d, 0x104
lea rcx, [rsp + 0x2a0]
call fcn.140141ad0
xor r9d, r9d
xor r8d, r8d
mov edx, 0x104
lea rcx, [rsp + 0x2a0]
call fcn.14010c600
test eax, eax
je 0x1400dcc53
mov rcx, rdi
lea rdx, str.msocxushell.dll
nop dword [rax]
movzx eax, byte [rsp + rcx + 0x2a0]
mov byte [rcx + rdx], al
lea rcx, [rcx + 1]
test al, al
jne 0x1400dcc40
mov eax, dword [rbx]
mov dword [0x140312330], eax
mov edx, 1
mov rcx, r14
call fcn.1400de1a0
call fcn.1400dbb80
jmp 0x1400dce98
lea r8, str.Could_not_open_global_test_info__
mov edx, gethostbyname
xor ecx, ecx
call fcn.1400fc1f0
jmp 0x1400dce98
lea rdx, [0x14021b414]
mov rcx, r15
call fcn.1401422f8
test rax, rax
je 0x1400dcd58
mov ebx, edi
lea rdx, [rax + 2]
lea rcx, [rsp + 0x48]
call fcn.1400f8110
nop
lea rdx, [0x14021b418]
mov rcx, r15
call fcn.1401422f8
lea rcx, [rsp + 0x48]
test rax, rax
je 0x1400dcd10
lea rdx, [rax + 3]
call fcn.1400f82d0
lea rcx, [rsp + 0x48]
call fcn.1400f9550
lea rcx, [rsp + 0x48]
call fcn.1400f95d0
mov rcx, qword [rsp + 0x48]
cmp qword [rcx - 0x10], 0
jle 0x1400dcd36
call fcn.1401501e8
test eax, eax
je 0x1400dcd36
mov r8d, 6
mov edx, eax
mov rcx, r14
call fcn.1400b6b80
jmp 0x1400dcd36
call fcn.1400f9550
lea rcx, [rsp + 0x48]
call fcn.1400f95d0
mov rcx, qword [rsp + 0x48]
cmp qword [rcx - 0x10], 0
jle 0x1400dcd34
call fcn.1401501e8
mov ebx, eax
jmp 0x1400dcd36
mov ebx, edi
mov r9d, ebx
xor r8d, r8d
xor edx, edx
mov rcx, r14
call fcn.1400b5bd0
mov r12d, edi
lea rcx, [rsp + 0x48]
call fcn.1400f81a0
jmp 0x1400dce98
lea rdx, [0x14021b41c]
mov rcx, r15
call fcn.1401422f8
test rax, rax
je 0x1400dcd7b
xor edx, edx
mov rcx, r14
call fcn.1400de1a0
jmp 0x1400dce98
lea rdx, [0x14021b420]
mov rcx, r15
call fcn.1401422f8
test rax, rax
je 0x1400dcd9e
xor edx, edx
mov rcx, r14
call fcn.1400b5b30
jmp 0x1400dce98
cmp dword [rsp + 0x6c], 0
jne 0x1400dce8c
xor edx, edx
lea r8d, [rdx + 0x7f]
lea rcx, [rsp + 0x111]
call fcn.140141ad0
movups xmm0, xmmword [str.SYSTEMCurrentControlSetServices_]
movaps xmmword [rsp + 0x110], xmm0
movups xmm1, xmmword [0x1402126f8]
movaps xmmword [rsp + 0x120], xmm1
movzx eax, word [0x140212708]
mov word [rsp + 0x130], ax
movzx eax, byte [0x14021270a]
mov byte [rsp + 0x132], al
lea rcx, [rsp + 0x110]
dec rcx
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x1400dce02
movups xmm0, xmmword [str.Systems_Events_Dispatchers_Bootstrap_]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [0x14021b340]
movups xmmword [rcx + 0x10], xmm1
mov eax, dword [0x14021b350]
mov dword [rcx + 0x20], eax
movzx eax, word [0x14021b354]
mov word [rcx + 0x24], ax
mov qword [rsp + 0x50], rdi
lea rax, [rsp + 0x50]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rsp + 0x110]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x1400dce8c
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x1400dce8c
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor r8d, r8d
lea rdx, [rsp + 0x110]
mov rcx, 0xffffffff80000002
call fcn.1400fc830
mov rax, qword [r14]
mov rcx, r14
call qword [rax + reloc.WSOCK32.dll_htonl]
mov r12d, edi
cmp dword [rsp + 0x6c], 0
jne 0x1400dcee6
mov edx, 0x2e
lea rcx, [rsp + 0x190]
call fcn.1401421b8
test rax, rax
je 0x1400dcee6
mov ecx, dword [str..log]
mov dword [rax], ecx
movzx ecx, byte [0x140286460]
mov byte [rax + 4], cl
xor edx, edx
lea rcx, [rsp + 0x190]
call fcn.1400fd640
lea rcx, [rsp + 0x190]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop
mov rax, qword [rsp + 0xe0]
cmp rax, 0x10
jb 0x1400dcf44
inc rax
mov rcx, qword [rsp + 0xc8]
cmp rax, 0x1000
jb 0x1400dcf3f
test cl, 0x1f
je 0x1400dcf12
call fcn.14014b4d8
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400dcf21
call fcn.14014b4d8
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400dcf30
call fcn.14014b4d8
int3
cmp rcx, 0x27
jbe 0x1400dcf3c
call fcn.14014b4d8
int3
mov rcx, rax
call fcn.1400dbae0
mov qword [rsp + 0xe0], reloc.WSOCK32.dll_ntohs
mov qword [rsp + 0xd8], rdi
mov byte [rsp + 0xc8], 0
mov rax, qword [rsp + 0x100]
cmp rax, 0x10
jb 0x1400dcfbe
inc rax
mov rcx, qword [rsp + 0xe8]
cmp rax, 0x1000
jb 0x1400dcfb9
test cl, 0x1f
je 0x1400dcf8c
call fcn.14014b4d8
int3
mov rax, qword [rcx - 8]
cmp rax, rcx
jb 0x1400dcf9b
call fcn.14014b4d8
int3
sub rcx, rax
cmp rcx, 8
jae 0x1400dcfaa
call fcn.14014b4d8
int3
cmp rcx, 0x27
jbe 0x1400dcfb6
call fcn.14014b4d8
int3
mov rcx, rax
call fcn.1400dbae0
mov qword [rsp + 0x100], reloc.WSOCK32.dll_ntohs
mov qword [rsp + 0xf8], rdi
mov byte [rsp + 0xe8], 0
lea rcx, [rsp + 0x58]
call fcn.1400dba60
nop
lea rcx, [rsp + 0x40]
call fcn.14001da50
mov eax, r12d
mov rcx, qword [rsp + 0x3b0]
xor rcx, rsp
call fcn.140113910
lea r11, [rsp + 0x3c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret