Function at 0x1400029b0
Capabilities:
Check for time delay via gettickcount
Create new key via cryptacquirecontext
Encode data using xor
Get hostname
Hash data using sha1
Hash data using sha1 via wincrypt
Hash data via wincrypt
Initialize hashing via wincrypt
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xba8]
sub rsp, 0xc80
mov rax, qword [0x140017008]
xor rax, rsp
mov qword [rbp + 0xb70], rax
mov r14, rcx
xor esi, esi
mov byte [rsp + 0x60], sil
xor eax, eax
mov dword [rbp + 0x320], eax
mov byte [rbp + 0x324], al
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
lea rax, vtable.CPointerList.0
mov qword [rbp + 0x1d0], rax
mov qword [rbp + 0x1d8], rsi
mov qword [rbp + 0x1e0], rsi
lea r13, [rcx + 0x30]
or rbx, 0xffffffffffffffff
cmp qword [r13], rbx
je 0x140002a40
mov rcx, qword [r13]
call fcn.14000b364
mov qword [r13], rbx
call fcn.140009d84
mov qword [r13], rax
cmp rax, rbx
je 0x140002c4d
cmp byte [r14 + 0x40], sil
je 0x140002a8a
mov rcx, qword [r14 + 0x38]
call fcn.140008d90
mov rcx, qword [r14 + 0x38]
call fcn.140008d0c
mov rdx, qword [r14 + 0x38]
add rdx, 8
call fcn.140008e10
test eax, eax
jne 0x140002c4d
mov rcx, qword [r14 + 0x38]
mov rax, qword [r13]
mov qword [rcx], rax
lea r12, [r14 + 0x254]
xor edx, edx
mov r8d, 0x800
mov rcx, r12
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x320]
call fcn.14000244c
lea rdx, [rbp - 0x40]
lea rax, [0x140000000]
lea rcx, [rax + 0xeaf0]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
mov eax, 0x80
add rdx, rax
movups xmm0, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm0
add rcx, rax
movups xmm1, xmmword [rcx]
movups xmmword [rdx], xmm1
movups xmm0, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm0
mov rax, qword [rcx + 0x20]
mov qword [rdx + 0x20], rax
mov eax, dword [rcx + 0x28]
mov dword [rdx + 0x28], eax
mov r8d, esi
lea r9, [rbp - 0x40]
mov r10d, 1
mov eax, 0x3521cfb3
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x35
mov al, r8b
sub al, cl
add al, 0x34
xor byte [r9], al
add r8d, r10d
add r9, r10
cmp r8d, 0xac
jl 0x140002b31
lea rax, [r14 + 0x142]
lea rcx, [0x14000e8cb]
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rax
mov r9, qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r8, [rbp + 0x320]
lea rdx, [rbp - 0x40]
mov rcx, r12
call qword [sym.imp.USER32.dll_wsprintfA]
lea rax, [r14 + 0x2b5a]
lea rcx, [r14 + 0x2d58]
lea r8, [r14 + 0x2c59]
lea r9, [r14 + 0x2a58]
lea rdx, [r14 + 0x41]
mov ebx, 0x7530
mov dword [rsp + 0x48], ebx
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rcx
movzx eax, word [r14 + 0x2b58]
mov qword [rsp + 0x30], r8
mov word [rsp + 0x28], ax
movzx r8d, word [r14 + 0x140]
mov qword [rsp + 0x20], r9
mov r9d, dword [r14 + 0x2a54]
cmp byte [r14 + 0x40], sil
je 0x140002c8b
mov rcx, qword [r14 + 0x38]
call fcn.140009380
test al, al
je 0x140002c4d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r8d, eax
mov rdx, r12
mov rcx, qword [r14 + 0x38]
call fcn.1400094fc
test al, al
je 0x140002c4d
lea r15, [r14 + 0xa54]
mov dword [rsp + 0x20], ebx
lea r9, [rsp + 0x64]
mov r8d, 0x2000
mov rdx, r15
mov rcx, qword [r14 + 0x38]
call fcn.140009a58
test al, al
jne 0x140002cdf
lea rcx, [rbp + 0x1d0]
call fcn.140001264
xor al, al
mov rcx, qword [rbp + 0xb70]
xor rcx, rsp
call fcn.14000c390
lea r11, [rsp + 0xc80]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, r13
call fcn.14000af80
test eax, eax
je 0x140002c4d
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r8d, eax
mov rdx, r12
mov rcx, qword [r13]
call fcn.14000a018
test eax, eax
je 0x140002c4d
lea r15, [r14 + 0xa54]
mov dword [rsp + 0x28], ebx
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
mov r9d, 0x2000
mov r8, r15
mov rdx, qword [r13]
call fcn.14000250c
jmp 0x140002c45
lea r8, [rbp + 0x200]
mov edx, dword [rsp + 0x64]
mov rcx, r15
call fcn.140001cd4
test al, al
je 0x140002c4d
cmp dword [rbp + 0x308], 0xc8
jne 0x140002c4d
cmp byte [rbp + 0x30d], sil
jne 0x140002c4d
mov rdi, qword [rbp + 0x310]
test rdi, rdi
jle 0x140002c4d
cmp rdi, 0x2000
ja 0x140002c4d
mov r9d, ebx
mov r8d, edi
mov rdx, r15
cmp byte [r14 + 0x40], sil
je 0x140002d55
mov rcx, qword [r14 + 0x38]
call fcn.140009604
test al, al
jne 0x140002d66
jmp 0x140002c4d
mov rcx, qword [r13]
call fcn.140009f6c
test eax, eax
je 0x140002c4d
mov qword [rbp + 0x1a0], rsi
mov qword [rbp - 0x70], rsi
mov rbx, r15
cmp edi, 0x36
jb 0x140002c4d
cmp dword [r15 + 2], edi
jne 0x140002c4d
cmp word [r15 + 6], si
jbe 0x140002c4d
cmp word [r15 + 8], si
jbe 0x140002c4d
mov eax, 0x18
cmp word [r15 + 0x1c], ax
jne 0x140002c4d
cmp dword [r15 + 0xa], edi
jg 0x140002c4d
movzx edi, word [r15 + 6]
movzx esi, word [r15 + 8]
movsxd rcx, edi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbp + 0x1a0], rax
test rax, rax
je 0x140002c4d
movsxd rcx, esi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r9, rax
mov qword [rbp - 0x50], rax
xor r10d, r10d
test rax, rax
jne 0x140002e04
lea rcx, [rbp + 0x1a0]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
jmp 0x140002c4d
mov eax, dword [r15 + 0xa]
add rbx, rax
mov rdx, qword [rbp + 0x1a0]
mov r11d, 1
test edi, edi
je 0x140002e41
mov r8, rdi
mov byte [rdx], r10b
mov ecx, r10d
mov al, byte [rbx]
add rbx, r11
and al, r11b
shl al, cl
or byte [rdx], al
add ecx, r11d
cmp ecx, 8
jl 0x140002e25
add rdx, r11
sub r8, r11
jne 0x140002e1f
mov rdx, r9
test esi, esi
je 0x140002e6d
mov r8, rsi
mov byte [rdx], r10b
mov ecx, r10d
mov al, byte [rbx]
add rbx, r11
and al, r11b
shl al, cl
or byte [rdx], al
add ecx, r11d
cmp ecx, 8
jl 0x140002e51
add rdx, r11
sub r8, r11
jne 0x140002e4b
mov rax, qword [rbp + 0x1a0]
mov qword [rbp - 0x60], rax
mov qword [rbp + 0x1b0], r10
mov qword [rbp + 0x1c0], r10
mov qword [rbp + 0x1b8], r10
movzx ebx, r10b
mov dword [rsp + 0x20], r10d
mov r9d, r11d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x140002ed5
mov dword [rsp + 0x20], 8
lea r9d, [rax + 1]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x1b0]
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x140002f7b
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x28], rax
xor eax, eax
mov dword [rsp + 0x20], eax
xor r9d, r9d
mov r8d, __WSAFDIsSet
lea rdx, [0x14000eba0]
mov rcx, qword [rbp + 0x1b0]
call qword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x140002f7b
lea rax, [rbp + 0x1b8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x8004
mov rcx, qword [rbp + 0x1b0]
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x140002f7b
xor r9d, r9d
mov r8d, edi
mov rdx, qword [rbp - 0x60]
mov rcx, qword [rbp + 0x1b8]
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
xor ecx, ecx
test eax, eax
je 0x140002f7b
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rcx
mov r9, qword [rbp + 0x1c0]
mov r8d, esi
mov rdx, qword [rbp - 0x50]
mov rcx, qword [rbp + 0x1b8]
call qword [sym.imp.ADVAPI32.dll_CryptVerifySignatureW]
test eax, eax
mov eax, 1
cmovne ebx, eax
mov rcx, qword [rbp + 0x1c0]
test rcx, rcx
je 0x140002f8d
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp + 0x1b8]
test rcx, rcx
je 0x140002f9f
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp + 0x1b0]
test rcx, rcx
je 0x140002fb3
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
test bl, bl
je 0x140003d4f
lea rcx, [rbp + 0x1f0]
call qword [sym.imp.ole32.dll_CoCreateGuid]
xor ebx, ebx
test eax, eax
jne 0x140003d4f
movaps xmm0, xmmword [rbp + 0x1f0]
movdqa xmmword [rbp - 0x60], xmm0
lea rcx, [r14 + 0x2e58]
lea esi, [rbx + 0x10]
mov r8d, esi
lea rdx, [rbp + 0x1f0]
call fcn.14000b3f0
test eax, eax
jne 0x140003d4f
lea rax, [rbp - 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x70]
lea r8, [rbp - 0x70]
mov edx, edi
mov rcx, qword [rbp + 0x1a0]
call fcn.140008a1c
test al, al
je 0x140003d4f
mov dword [rbp + 0x1c8], esi
lea rdx, [rbp + 0x1c8]
lea rcx, [rbp + 0x328]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x140003d4f
lea rcx, [rbp + 0x750]
call fcn.1400025bc
mov sil, al
mov dword [r15], ebx
mov ecx, dword [rsp + 0x70]
mov word [r15 + 4], cx
lea rdi, [r15 + 6]
mov ebx, ecx
mov r8d, ecx
mov rdx, qword [rbp - 0x70]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
add rdi, rbx
mov qword [rbp + 0x1b0], rdi
mov rbx, rdi
mov eax, ebx
sub eax, r14d
add eax, 0xfffff5ac
movsxd rdi, eax
mov dword [rbx], 0x18f
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov ecx, eax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
xor edx, edx
or ecx, 0xffffffff
div ecx
inc edx
mov dword [r14 + 0x248], edx
mov dword [rbx + 4], edx
xor eax, eax
cmp byte [r14 + 0x40], al
setne al
mov byte [rbx + 8], al
mov eax, dword [r14 + 0x244]
mov dword [rbx + 9], eax
lea rcx, [rbp + 0x328]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add ax, ax
mov word [rbx + 0xd], ax
add rbx, 0xf
mov qword [rbp + 0x1b0], rbx
movzx ebx, ax
mov r8d, ebx
lea rdx, [rbp + 0x328]
mov rcx, qword [rbp + 0x1b0]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbp + 0x1b0], rbx
lea rcx, [rbp + 0x750]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
add ax, ax
mov rcx, qword [rbp + 0x1b0]
mov word [rcx], ax
add rcx, 2
mov qword [rbp + 0x1b0], rcx
movzx ebx, ax
mov r8d, ebx
lea rdx, [rbp + 0x750]
call sub.VCRUNTIME140.dll_memcpy
add qword [rbp + 0x1b0], rbx
mov rbx, qword [rbp + 0x1b0]
mov byte [rbx], sil
mov esi, 1
add rbx, rsi
mov byte [rbx], sil
add rbx, rsi
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbx], eax
add rbx, 4
sub ebx, r14d
sub ebx, edi
sub ebx, 0xa45
and ebx, 0xfffffff0
lea rdx, [r14 + 0xa54]
add rdx, rdi
mov r8d, ebx
mov rcx, r14
call fcn.1400028c8
test al, al
je 0x140003d4f
add ebx, edi
mov dword [rsp + 0x64], ebx
xor edx, edx
mov r8d, 0x800
mov rcx, r12
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x320]
call fcn.14000244c
lea rdx, [rbp - 0x40]
lea rcx, [0x140000000]
lea rcx, [rcx + 0xe930]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
lea eax, [rsi + 0x7f]
add rdx, rax
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
add rcx, rax
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
mov rax, qword [rcx + 0x60]
mov qword [rdx + 0x60], rax
mov al, byte [rcx + 0x68]
mov byte [rdx + 0x68], al
xor eax, eax
mov r8d, eax
lea r9, [rbp - 0x40]
mov eax, 0x3521cfb3
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x35
mov al, r8b
sub al, cl
add al, 0x34
xor byte [r9], al
add r8d, esi
add r9, rsi
cmp r8d, 0xe9
jl 0x140003264
mov dword [rsp + 0x30], ebx
lea rax, [0x14000e8cb]
mov qword [rsp + 0x28], rax
lea rsi, [r14 + 0x142]
mov qword [rsp + 0x20], rsi
mov r9, qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r8, [rbp + 0x320]
lea rdx, [rbp - 0x40]
mov rcx, r12
call qword [sym.imp.USER32.dll_wsprintfA]
xor eax, eax
mov rcx, r12
cmp byte [r14 + 0x40], al
je 0x14000332f
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r8d, eax
mov rdx, r12
mov rcx, qword [r14 + 0x38]
call fcn.1400094fc
test al, al
je 0x140003d4f
mov r8d, ebx
mov rdx, r15
mov rcx, qword [r14 + 0x38]
call fcn.1400094fc
test al, al
je 0x140003d4f
mov edi, 0x7530
mov dword [rsp + 0x20], edi
lea r9, [rsp + 0x64]
mov r8d, 0x2000
mov rdx, r15
mov rcx, qword [r14 + 0x38]
call fcn.140009a58
jmp 0x140003388
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r8d, eax
mov rdx, r12
mov rcx, qword [r13]
call fcn.14000a018
test eax, eax
je 0x140003d4f
mov r8d, ebx
mov rdx, r15
mov rcx, qword [r13]
call fcn.14000a018
test eax, eax
je 0x140003d4f
mov edi, 0x7530
mov dword [rsp + 0x28], edi
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
mov r9d, 0x2000
mov r8, r15
mov rdx, qword [r13]
call fcn.14000250c
test al, al
je 0x140003d4f
lea r8, [rbp + 0x200]
mov edx, dword [rsp + 0x64]
mov rcx, r15
call fcn.140001cd4
xor ecx, ecx
test al, al
je 0x140003d4f
cmp dword [rbp + 0x308], 0xc8
jne 0x140003d4f
cmp byte [rbp + 0x30d], cl
jne 0x140003d4f
mov rbx, qword [rbp + 0x310]
test rbx, rbx
jle 0x140003d4f
cmp rbx, 0x2000
ja 0x140003d4f
mov r9d, edi
mov r8d, ebx
mov rdx, r15
cmp byte [r14 + 0x40], cl
je 0x140003402
mov rcx, qword [r14 + 0x38]
call fcn.140009604
test al, al
jmp 0x14000340d
mov rcx, qword [r13]
call fcn.140009f6c
test eax, eax
je 0x140003d4f
mov r8d, ebx
mov rdx, r15
mov rcx, r14
call fcn.14000293c
xor ecx, ecx
test al, al
je 0x140003d4f
mov rdi, r15
movsxd rax, ebx
cmp rax, 4
jb 0x140003d4f
cmp dword [r15], 0x190
jne 0x140003d4f
add rdi, 4
lea eax, [rbx - 4]
lea r9d, [rcx + 1]
cmp eax, r9d
jb 0x140003d4f
cmp byte [rdi], cl
jne 0x140003d4f
add rdi, r9
lea ecx, [rax - 1]
mov eax, dword [r14 + 0x248]
inc eax
mov dword [r14 + 0x248], eax
cmp ecx, 4
jb 0x140003d4f
cmp dword [rdi], eax
jne 0x140003d4f
lea eax, [rcx - 4]
cmp eax, 4
jb 0x140003d4f
mov ecx, dword [rdi + 4]
mov dword [r14 + 0x24c], ecx
lea edx, [rax - 4]
cmp edx, 4
jb 0x140003d4f
mov eax, dword [rdi + 8]
mov dword [r14 + 0x250], eax
add edx, 0xfffffffc
mov dword [r14 + 0x244], eax
cmp edx, 4
jb 0x140003d4f
mov eax, dword [rdi + 0xc]
mov dword [rbp + 0x1b8], eax
add rdi, 0x10
lea ebx, [rdx - 4]
mov dword [rsp + 0x64], ebx
xor edx, edx
mov dword [rsp + 0x70], edx
test eax, eax
je 0x140003b7d
movsxd rax, ebx
cmp rax, 4
jb 0x140003d4f
mov r10d, dword [rdi]
mov dword [rsp + 0x74], r10d
lea eax, [rbx - 4]
cmp eax, 4
jb 0x140003d4f
mov r11d, dword [rdi + 4]
mov dword [rbp - 0x80], r11d
add eax, 0xfffffffc
cmp eax, 4
jb 0x140003d4f
mov ecx, dword [rdi + 8]
mov dword [rsp + 0x78], ecx
add eax, 0xfffffffc
cmp eax, 4
jb 0x140003d4f
mov esi, dword [rdi + 0xc]
mov dword [rsp + 0x68], esi
add rdi, 0x10
lea ebx, [rax - 4]
mov dword [rsp + 0x64], ebx
mov dword [rsp + 0x6c], r9d
xor eax, eax
mov edx, eax
mov r8d, dword [r14 + 0x3050]
test r8d, r8d
jle 0x1400035ca
test edx, edx
js 0x140003576
cmp edx, r8d
jge 0x140003576
movsxd rcx, edx
mov rax, qword [r14 + 0x3048]
lea rsi, [rax + rcx*8]
xor eax, eax
jmp 0x14000357d
lea rsi, [0x140017820]
mov rsi, qword [rsi]
cmp dword [rsi], r10d
je 0x140003591
inc edx
cmp edx, r8d
jl 0x14000355b
mov eax, r9d
jmp 0x1400035be
cmp r11d, dword [rsi + 4]
jbe 0x1400035be
lea rcx, [r14 + 0x3040]
call fcn.140001358
mov rcx, qword [rsi + 8]
call fcn.140001c44
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov eax, dword [rsp + 0x6c]
mov r10d, dword [rsp + 0x74]
mov esi, dword [rsp + 0x68]
mov r9d, 1
jmp 0x1400035cd
mov eax, r9d
test eax, eax
je 0x140003b58
mov dword [rbp + 0x350], 0x191
add dword [r14 + 0x24c], r9d
mov eax, dword [r14 + 0x24c]
mov dword [rbp + 0x354], eax
mov dword [rbp + 0x358], r10d
mov byte [rbp + 0x35c], r9b
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [rbp + 0x35d], eax
lea rbx, [rbp + 0x361]
lea rax, [rbp + 0x350]
sub ebx, eax
add ebx, 0xf
and ebx, 0xfffffff0
mov r8d, ebx
lea rdx, [rbp + 0x350]
mov rcx, r14
call fcn.1400028c8
xor edx, edx
mov r8d, 0x800
mov rcx, r12
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x320]
call fcn.14000244c
lea rdx, [rbp + 0xb0]
lea rax, [0x140000000]
lea rcx, [rax + 0xe930]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
mov eax, 0x80
add rdx, rax
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
add rcx, rax
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
mov rax, qword [rcx + 0x60]
mov qword [rdx + 0x60], rax
mov al, byte [rcx + 0x68]
mov byte [rdx + 0x68], al
xor eax, eax
mov r8d, eax
lea r9, [rbp + 0xb0]
lea r13d, [rax + 1]
mov eax, 0x3521cfb3
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x35
mov al, r8b
sub al, cl
add al, 0x34
xor byte [r9], al
add r8d, r13d
add r9, r13
cmp r8d, 0xe9
jl 0x1400036fb
lea r13, [r14 + 0x30]
mov dword [rsp + 0x30], ebx
lea rax, [0x14000e8cb]
mov qword [rsp + 0x28], rax
lea rax, [r14 + 0x142]
mov qword [rsp + 0x20], rax
mov r9, qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r8, [rbp + 0x320]
lea rdx, [rbp + 0xb0]
mov rcx, r12
call qword [sym.imp.USER32.dll_wsprintfA]
xor eax, eax
mov rcx, r12
cmp byte [r14 + 0x40], al
je 0x1400037d6
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r8d, eax
mov rdx, r12
mov rcx, qword [r14 + 0x38]
call fcn.1400094fc
test al, al
je 0x140003d4f
mov r8d, ebx
lea rdx, [rbp + 0x350]
mov rcx, qword [r14 + 0x38]
call fcn.1400094fc
xor ebx, ebx
test al, al
je 0x140003d4f
mov dword [rsp + 0x20], 0x2bf20
lea r9, [rsp + 0x64]
mov r8d, 0x3ff
lea rdx, [rbp + 0x350]
mov rcx, qword [r14 + 0x38]
call fcn.140009a58
jmp 0x140003838
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r8d, eax
mov rdx, r12
mov rcx, qword [r13]
call fcn.14000a018
test eax, eax
je 0x140003d4f
mov r8d, ebx
lea rdx, [rbp + 0x350]
mov rcx, qword [r13]
call fcn.14000a018
xor ebx, ebx
test eax, eax
je 0x140003d4f
mov dword [rsp + 0x28], 0x2bf20
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
mov r9d, 0x3ff
lea r8, [rbp + 0x350]
mov rdx, qword [r13]
call fcn.14000250c
test al, al
je 0x140003d4f
lea r8, [rbp + 0x200]
mov edx, dword [rsp + 0x64]
lea rcx, [rbp + 0x350]
call fcn.140001cd4
test al, al
je 0x140003d4f
cmp dword [rbp + 0x308], 0xc8
jne 0x140003d4f
cmp byte [rbp + 0x30d], bl
jne 0x140003d4f
mov rbx, qword [rbp + 0x310]
mov qword [rbp - 0x78], rbx
test rbx, rbx
jle 0x140003d4f
mov dword [rsp + 0x64], ebx
cmp ebx, esi
jne 0x140003d4f
movsxd rcx, ebx
add rcx, 8
mov rax, 0xffffffffffffffff
cmovb rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rsi, rax
xor ecx, ecx
test rax, rax
je 0x140003d4f
mov r9d, 0x7530
mov r8d, ebx
lea rdx, [rax + 8]
cmp byte [r14 + 0x40], cl
je 0x1400038e1
mov rcx, qword [r14 + 0x38]
call fcn.140009604
test al, al
jmp 0x1400038ec
mov rcx, qword [r13]
call fcn.140009f6c
test eax, eax
je 0x140003d46
mov ecx, dword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rsp + 0x78], rax
xor ecx, ecx
test rax, rax
je 0x140003d46
mov dword [rsp + 0x6c], ecx
lea r9, [rsp + 0x6c]
mov r8, rax
mov edx, dword [rsp + 0x68]
lea rcx, [rsi + 8]
call fcn.140009af8
test eax, eax
jne 0x140003b3e
lea ecx, [rax + 0x18]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov qword [rbp - 0x60], rax
test rax, rax
je 0x140003d9e
mov ecx, dword [rsp + 0x74]
mov dword [rax], ecx
mov ecx, dword [rbp - 0x80]
mov dword [rax + 4], ecx
mov ebx, dword [rsp + 0x6c]
mov edx, ebx
mov rcx, qword [rsp + 0x78]
call fcn.1400015f0
mov rcx, qword [rbp - 0x60]
mov qword [rcx + 8], rax
lea rdx, str.GetObj
mov rcx, rax
call fcn.140001b4c
mov rdx, qword [rbp - 0x60]
mov qword [rdx + 0x10], rax
lea rcx, [r14 + 0x3040]
call fcn.140001318
mov eax, dword [rsp + 0x68]
add eax, 8
mov dword [rsi], eax
mov dword [rsi + 4], ebx
mov r9d, 0xa
mov r8d, 0x104
lea rdx, [rbp + 0xa60]
mov ecx, dword [rsp + 0x74]
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__itoa_s]
xor ebx, ebx
mov qword [rbp + 0x1a8], rbx
mov word [rbp + 0x850], bx
movaps xmm0, xmmword [str.gzpcoxh_pW2.1__1]
movaps xmmword [rbp - 0x40], xmm0
movaps xmm1, xmmword [0x14000ea70]
movaps xmmword [rbp - 0x30], xmm1
movaps xmm0, xmmword [0x14000ea80]
movaps xmmword [rbp - 0x20], xmm0
movaps xmm1, xmmword [0x14000ea90]
movaps xmmword [rbp - 0x10], xmm1
movaps xmm0, xmmword [0x14000eaa0]
movaps xmmword [rbp], xmm0
movaps xmm1, xmmword [0x14000eab0]
movaps xmmword [rbp + 0x10], xmm1
movzx eax, word [0x14000eac0]
mov word [rbp + 0x20], ax
mov r8d, ebx
lea r9, [rbp - 0x40]
lea r12d, [rbx + 1]
mov eax, 0x3521cfb3
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movzx eax, ax
imul ecx, eax, 0x35
movzx eax, r8w
sub ax, cx
add ax, 0x34
xor word [r9], ax
add r8d, r12d
lea r9, [r9 + 2]
cmp r8d, 0x31
jl 0x140003a1b
lea r12, [r14 + 0x254]
lea r8, [rbp - 0x40]
mov edx, 0x104
lea rcx, [rbp + 0x850]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rax, [rbp + 0x850]
or rcx, 0xffffffffffffffff
inc rcx
cmp word [rax + rcx*2], bx
jne 0x140003a79
mov eax, 0x104
sub eax, ecx
mov dword [rbp + 0x1c0], eax
movsxd rax, ecx
lea rcx, [rbp + 0x850]
lea rcx, [rcx + rax*2]
lea rdx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
jne 0x140003ab4
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rax, [rbp + 0x1b0]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x1a8]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0xf003f
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x850]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x140003b3a
mov eax, dword [rsp + 0x68]
add eax, 8
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
mov r9d, 3
xor r8d, r8d
lea rdx, [rbp + 0xa60]
mov rcx, qword [rbp + 0x1a8]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x1a8]
test rcx, rcx
je 0x140003b3a
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rbx, qword [rbp - 0x78]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov r9d, 1
mov edx, dword [rsp + 0x70]
add edx, r9d
mov dword [rsp + 0x70], edx
cmp edx, dword [rbp + 0x1b8]
jb 0x1400034ec
mov ecx, dword [r14 + 0x24c]
lea rsi, [r14 + 0x142]
mov dword [r15], 0x18f
lea eax, [rcx + 1]
mov dword [r14 + 0x24c], eax
mov dword [r15 + 4], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [r15 + 8], eax
lea rbx, [r15 + 0xc]
sub ebx, r14d
sub ebx, 0xa45
and ebx, 0xfffffff0
mov r8d, ebx
mov rdx, r15
mov rcx, r14
call fcn.1400028c8
xor edx, edx
mov r8d, 0x800
mov rcx, r12
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x320]
call fcn.14000244c
lea rdx, [rbp + 0xb0]
lea rax, [0x140000000]
lea rcx, [rax + 0xe930]
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
movups xmm0, xmmword [rcx + 0x60]
movups xmmword [rdx + 0x60], xmm0
mov eax, 0x80
add rdx, rax
movups xmm1, xmmword [rcx + 0x70]
movups xmmword [rdx - 0x10], xmm1
add rcx, rax
movups xmm0, xmmword [rcx]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rdx + 0x10], xmm1
movups xmm0, xmmword [rcx + 0x20]
movups xmmword [rdx + 0x20], xmm0
movups xmm1, xmmword [rcx + 0x30]
movups xmmword [rdx + 0x30], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rdx + 0x40], xmm0
movups xmm1, xmmword [rcx + 0x50]
movups xmmword [rdx + 0x50], xmm1
mov rax, qword [rcx + 0x60]
mov qword [rdx + 0x60], rax
mov al, byte [rcx + 0x68]
mov byte [rdx + 0x68], al
xor eax, eax
mov r8d, eax
lea r9, [rbp + 0xb0]
lea edi, [rax + 1]
mov eax, 0x3521cfb3
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x35
mov al, r8b
sub al, cl
add al, 0x34
xor byte [r9], al
add r8d, edi
add r9, rdi
cmp r8d, 0xe9
jl 0x140003c7f
mov dword [rsp + 0x30], ebx
lea rax, [0x14000e8cb]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
mov r9, qword [sym.imp.KERNEL32.dll_GetTickCount]
lea r8, [rbp + 0x320]
lea rdx, [rbp + 0xb0]
mov rcx, r12
call qword [sym.imp.USER32.dll_wsprintfA]
xor eax, eax
mov rcx, r12
cmp byte [r14 + 0x40], al
je 0x140003dae
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r8d, eax
mov rdx, r12
mov rcx, qword [r14 + 0x38]
call fcn.1400094fc
test al, al
je 0x140003d4f
mov r8d, ebx
mov rdx, r15
mov rcx, qword [r14 + 0x38]
call fcn.1400094fc
xor ebx, ebx
test al, al
je 0x140003d4f
mov dword [rsp + 0x20], 0x2bf20
lea r9, [rsp + 0x64]
mov r8d, 0x2000
mov rdx, r15
mov rcx, qword [r14 + 0x38]
call fcn.140009a58
jmp 0x140003e04
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov ebx, dword [rsp + 0x60]
mov rcx, qword [rbp + 0x1a0]
test rcx, rcx
je 0x140003d6e
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
xor eax, eax
mov qword [rbp + 0x1a0], rax
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rax, qword [rbp - 0x70]
test rax, rax
je 0x140003d8b
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
nop
lea rcx, [rbp + 0x1d0]
call fcn.140001264
mov al, bl
jmp 0x140002c5b
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rsp + 0x78]
jmp 0x140003d49
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov r8d, eax
mov rdx, r12
mov rcx, qword [r13]
call fcn.14000a018
test eax, eax
je 0x140003d4f
mov r8d, ebx
mov rdx, r15
mov rcx, qword [r13]
call fcn.14000a018
xor ebx, ebx
test eax, eax
je 0x140003d4f
mov dword [rsp + 0x28], 0x2bf20
lea rax, [rsp + 0x64]
mov qword [rsp + 0x20], rax
mov r9d, 0x2000
mov r8, r15
mov rdx, qword [r13]
call fcn.14000250c
test al, al
je 0x140003d4f
lea r8, [rbp + 0x200]
mov edx, dword [rsp + 0x64]
mov rcx, r15
call fcn.140001cd4
test al, al
je 0x140003d4f
cmp dword [rbp + 0x308], 0xc8
jne 0x140003d4f
cmp byte [rbp + 0x30d], bl
mov ebx, dword [rsp + 0x60]
jne 0x140003d53
movzx ebx, bl
xor ecx, ecx
cmp qword [rbp + 0x310], rcx
cmove ebx, edi
jmp 0x140003d53