Function at 0x1401adfe0
Capabilities:
Contain obfuscated stackstrings
Create process on windows
Manipulate boot configuration

Disassembly:
mov qword [rsp + 8], rcx
push rdi
sub rsp, 0x630
mov qword [rsp + 0x580], 0xfffffffffffffffe
mov rax, qword [0x1402bd5c0]
xor rax, rsp
mov qword [rsp + 0x620], rax
mov edx, 1
mov rcx, qword [rsp + 0x640]
call fcn.14007d790
mov byte [rsp + 0x48], WSACleanup
mov byte [rsp + 0x49], 0x65
mov byte [rsp + 0x4a], 0x67
mov byte [rsp + 0x4b], 0x2e
mov byte [rsp + 0x4c], 0x63
mov byte [rsp + 0x4d], 0x63
mov byte [rsp + 0x4e], 0x62
mov byte [rsp + 0x4f], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x50], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x51], reloc.WS2_32.dll_WSACleanup
mov byte [rsp + 0x52], 0x2e
mov byte [rsp + 0x53], 0x63
mov byte [rsp + 0x54], reloc.WS2_32.dll_WSAGetLastError
mov byte [rsp + 0x55], WSASetLastError
mov byte [rsp + 0x56], 0
mov r9d, 1
mov r8d, 0x1e
mov edx, 0xbb8
lea rcx, [rsp + 0x48]
call fcn.14018f500
mov dword [rsp + 0x38], eax
mov r8d, dword [rsp + 0x38]
lea rdx, str.Tracert:_d
xor ecx, ecx
call fcn.1400de020
cmp dword [rsp + 0x38], 1
jl 0x1401ae0c1
cmp dword [rsp + 0x38], 2
jg 0x1401ae0c1
xor r8d, r8d
mov edx, reloc.OLEAUT32.dll_SafeArrayGetDim
lea rcx, str.Check_tracert_failed.
call fcn.1400f0bf0
jmp 0x1401af71a
mov rcx, qword [rsp + 0x640]
add rcx, 0x210
call fcn.140050200
mov rcx, rax
call fcn.140005170
test eax, eax
je 0x1401af4ce
xor eax, eax
mov word [rsp + 0x60], ax
lea rdi, [rsp + 0x62]
xor eax, eax
mov ecx, 0x206
rep stosb byte [rdi], al
mov rcx, qword [rsp + 0x640]
add rcx, 0x210
call fcn.140050200
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.1400aac40
lea rdx, [rsp + 0x60]
mov qword [rsp + 0x20], rdx
mov r9d, 0x104
mov r8d, 0x804a
mov edx, 0xfffffffd
lea rcx, [0x1403c8c50]
call fcn.1400d8250
mov dword [rsp + 0x5c], eax
cmp dword [rsp + 0x5c], 0
jne 0x1401ae65a
mov eax, 0x2a
mov word [rsp + 0x280], ax
mov eax, 0x2a
mov word [rsp + 0x282], ax
mov eax, 0x2a
mov word [rsp + 0x284], ax
mov eax, 0x20
mov word [rsp + 0x286], ax
mov eax, 0x45
mov word [rsp + 0x288], ax
mov eax, WSACleanup
mov word [rsp + 0x28a], ax
mov eax, WSACleanup
mov word [rsp + 0x28c], ax
mov eax, reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x28e], ax
mov eax, WSACleanup
mov word [rsp + 0x290], ax
mov eax, 0x20
mov word [rsp + 0x292], ax
mov eax, 0x2a
mov word [rsp + 0x294], ax
mov eax, 0x2a
mov word [rsp + 0x296], ax
mov eax, 0x2a
mov word [rsp + 0x298], ax
mov eax, 0x20
mov word [rsp + 0x29a], ax
mov eax, 0x52
mov word [rsp + 0x29c], ax
mov eax, 0x65
mov word [rsp + 0x29e], ax
mov eax, 0x67
mov word [rsp + 0x2a0], ax
mov eax, 0x69
mov word [rsp + 0x2a2], ax
mov eax, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x2a4], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x2a6], ax
mov eax, WSACleanup
mov word [rsp + 0x2a8], ax
mov eax, 0x61
mov word [rsp + 0x2aa], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x2ac], ax
mov eax, 0x69
mov word [rsp + 0x2ae], ax
mov eax, reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x2b0], ax
mov eax, WSASetLastError
mov word [rsp + 0x2b2], ax
mov eax, 0x20
mov word [rsp + 0x2b4], ax
mov eax, 0x66
mov word [rsp + 0x2b6], ax
mov eax, 0x61
mov word [rsp + 0x2b8], ax
mov eax, 0x69
mov word [rsp + 0x2ba], ax
mov eax, WSASetLastError
mov word [rsp + 0x2bc], ax
mov eax, 0x65
mov word [rsp + 0x2be], ax
mov eax, 0x64
mov word [rsp + 0x2c0], ax
mov eax, 0x2e
mov word [rsp + 0x2c2], ax
mov eax, 0x20
mov word [rsp + 0x2c4], ax
mov eax, 0x50
mov word [rsp + 0x2c6], ax
mov eax, WSASetLastError
mov word [rsp + 0x2c8], ax
mov eax, 0x65
mov word [rsp + 0x2ca], ax
mov eax, 0x61
mov word [rsp + 0x2cc], ax
mov eax, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x2ce], ax
mov eax, 0x65
mov word [rsp + 0x2d0], ax
mov eax, 0x20
mov word [rsp + 0x2d2], ax
mov eax, WSASetLastError
mov word [rsp + 0x2d4], ax
mov eax, 0x61
mov word [rsp + 0x2d6], ax
mov eax, WSAGetLastError
mov word [rsp + 0x2d8], ax
mov eax, 0x65
mov word [rsp + 0x2da], ax
mov eax, 0x20
mov word [rsp + 0x2dc], ax
mov eax, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x2de], ax
mov eax, 0x75
mov word [rsp + 0x2e0], ax
mov eax, WSACleanup
mov word [rsp + 0x2e2], ax
mov eax, 0x65
mov word [rsp + 0x2e4], ax
mov eax, 0x20
mov word [rsp + 0x2e6], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x2e8], ax
mov eax, 0x68
mov word [rsp + 0x2ea], ax
mov eax, 0x61
mov word [rsp + 0x2ec], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x2ee], ax
mov eax, 0x20
mov word [rsp + 0x2f0], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x2f2], ax
mov eax, 0x68
mov word [rsp + 0x2f4], ax
mov eax, 0x65
mov word [rsp + 0x2f6], ax
mov eax, 0x20
mov word [rsp + 0x2f8], ax
mov eax, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x2fa], ax
mov eax, 0x65
mov word [rsp + 0x2fc], ax
mov eax, WSACleanup
mov word [rsp + 0x2fe], ax
mov eax, 0x76
mov word [rsp + 0x300], ax
mov eax, 0x65
mov word [rsp + 0x302], ax
mov eax, WSACleanup
mov word [rsp + 0x304], ax
mov eax, 0x20
mov word [rsp + 0x306], ax
mov eax, 0x69
mov word [rsp + 0x308], ax
mov eax, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x30a], ax
mov eax, 0x20
mov word [rsp + 0x30c], ax
mov eax, 0x63
mov word [rsp + 0x30e], ax
mov eax, reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x310], ax
mov eax, WSASetLastError
mov word [rsp + 0x312], ax
mov eax, WSASetLastError
mov word [rsp + 0x314], ax
mov eax, 0x65
mov word [rsp + 0x316], ax
mov eax, 0x63
mov word [rsp + 0x318], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x31a], ax
mov eax, 0x65
mov word [rsp + 0x31c], ax
mov eax, 0x64
mov word [rsp + 0x31e], ax
mov eax, 0x20
mov word [rsp + 0x320], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x322], ax
mov eax, reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x324], ax
mov eax, 0x20
mov word [rsp + 0x326], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x328], ax
mov eax, 0x68
mov word [rsp + 0x32a], ax
mov eax, 0x65
mov word [rsp + 0x32c], ax
mov eax, 0x20
mov word [rsp + 0x32e], ax
mov eax, 0x49
mov word [rsp + 0x330], ax
mov eax, WSASetLastError
mov word [rsp + 0x332], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x334], ax
mov eax, 0x65
mov word [rsp + 0x336], ax
mov eax, WSACleanup
mov word [rsp + 0x338], ax
mov eax, WSASetLastError
mov word [rsp + 0x33a], ax
mov eax, 0x65
mov word [rsp + 0x33c], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x33e], ax
mov eax, 0x2e
mov word [rsp + 0x340], ax
xor eax, eax
mov word [rsp + 0x342], ax
lea rdx, [rsp + 0x280]
mov ecx, 1
call fcn.1400de020
cmp dword [rsp + 0x5c], 0xffffffff
jne 0x1401af36b
lea rcx, [rsp + 0x518]
call fcn.140001000
mov qword [rsp + 0x588], rax
mov rax, qword [rsp + 0x588]
mov qword [rsp + 0x590], rax
lea r8, [0x14025a838]
mov rdx, qword [rsp + 0x590]
lea rcx, [rsp + 0x520]
call fcn.1400010b0
mov qword [rsp + 0x598], rax
mov rcx, qword [rsp + 0x598]
call fcn.140050200
mov r9, rax
xor r8d, r8d
lea rdx, [0x14025a850]
lea rcx, [0x14025a860]
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
lea rcx, [rsp + 0x520]
call fcn.140007060
nop
lea rcx, [rsp + 0x518]
call fcn.140007060
mov eax, 0x4c
mov word [rsp + 0x350], ax
mov eax, 0x69
mov word [rsp + 0x352], ax
mov eax, 0x63
mov word [rsp + 0x354], ax
mov eax, 0x65
mov word [rsp + 0x356], ax
mov eax, WSASetLastError
mov word [rsp + 0x358], ax
mov eax, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x35a], ax
mov eax, 0x65
mov word [rsp + 0x35c], ax
mov eax, 0x20
mov word [rsp + 0x35e], ax
mov eax, 0x69
mov word [rsp + 0x360], ax
mov eax, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x362], ax
mov eax, 0x20
mov word [rsp + 0x364], ax
mov eax, WSASetLastError
mov word [rsp + 0x366], ax
mov eax, reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x368], ax
mov eax, 0x63
mov word [rsp + 0x36a], ax
mov eax, WSAGetLastError
mov word [rsp + 0x36c], ax
mov eax, 0x65
mov word [rsp + 0x36e], ax
mov eax, 0x64
mov word [rsp + 0x370], ax
mov eax, 0x2c
mov word [rsp + 0x372], ax
mov eax, 0x20
mov word [rsp + 0x374], ax
mov eax, reloc.WS2_32.dll_WSASetLastError
mov word [rsp + 0x376], ax
mov eax, WSASetLastError
mov word [rsp + 0x378], ax
mov eax, 0x65
mov word [rsp + 0x37a], ax
mov eax, 0x61
mov word [rsp + 0x37c], ax
mov eax, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x37e], ax
mov eax, 0x65
mov word [rsp + 0x380], ax
mov eax, 0x20
mov word [rsp + 0x382], ax
mov eax, 0x67
mov word [rsp + 0x384], ax
mov eax, reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x386], ax
mov eax, 0x20
mov word [rsp + 0x388], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x38a], ax
mov eax, reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x38c], ax
mov eax, 0x20
mov word [rsp + 0x38e], ax
mov eax, 0x68
mov word [rsp + 0x390], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x392], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x394], ax
mov eax, reloc.WS2_32.dll_WSASetLastError
mov word [rsp + 0x396], ax
mov eax, 0x3a
mov word [rsp + 0x398], ax
mov eax, 0x2f
mov word [rsp + 0x39a], ax
mov eax, 0x2f
mov word [rsp + 0x39c], ax
mov eax, 0x63
mov word [rsp + 0x39e], ax
mov eax, reloc.WS2_32.dll_WSASetLastError
mov word [rsp + 0x3a0], ax
mov eax, 0x2e
mov word [rsp + 0x3a2], ax
mov eax, 0x79
mov word [rsp + 0x3a4], ax
mov eax, reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x3a6], ax
mov eax, 0x75
mov word [rsp + 0x3a8], ax
mov eax, WSASetLastError
mov word [rsp + 0x3aa], ax
mov eax, 0x67
mov word [rsp + 0x3ac], ax
mov eax, 0x7a
mov word [rsp + 0x3ae], ax
mov eax, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x3b0], ax
mov eax, reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x3b2], ax
mov eax, 0x66
mov word [rsp + 0x3b4], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x3b6], ax
mov eax, 0x2e
mov word [rsp + 0x3b8], ax
mov eax, 0x63
mov word [rsp + 0x3ba], ax
mov eax, reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x3bc], ax
mov eax, WSASetLastError
mov word [rsp + 0x3be], ax
mov eax, 0x2f
mov word [rsp + 0x3c0], ax
mov eax, 0x20
mov word [rsp + 0x3c2], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x3c4], ax
mov eax, reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x3c6], ax
mov eax, 0x20
mov word [rsp + 0x3c8], ax
mov eax, 0x61
mov word [rsp + 0x3ca], ax
mov eax, 0x63
mov word [rsp + 0x3cc], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x3ce], ax
mov eax, 0x69
mov word [rsp + 0x3d0], ax
mov eax, 0x76
mov word [rsp + 0x3d2], ax
mov eax, 0x65
mov word [rsp + 0x3d4], ax
mov eax, 0x20
mov word [rsp + 0x3d6], ax
mov eax, 0x69
mov word [rsp + 0x3d8], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x3da], ax
mov eax, 0x2e
mov word [rsp + 0x3dc], ax
xor eax, eax
mov word [rsp + 0x3de], ax
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x530]
call fcn.140002050
mov qword [rsp + 0x5a0], rax
mov rax, qword [rsp + 0x5a0]
mov qword [rsp + 0x5a8], rax
lea rdx, [rsp + 0x350]
mov rcx, qword [rsp + 0x5a8]
call fcn.1400060b0
test eax, eax
jne 0x1401aeae5
mov dword [rsp + 0x5b0], 1
jmp 0x1401aeaf0
mov dword [rsp + 0x5b0], 0
movzx eax, byte [rsp + 0x5b0]
mov byte [rsp + 0x528], al
lea rcx, [rsp + 0x530]
call fcn.140007060
movzx edx, byte [rsp + 0x528]
test edx, edx
je 0x1401af354
lea rdx, [0x14025a880]
lea rcx, [rsp + 0x540]
call fcn.1400f05c0
mov qword [rsp + 0x5b8], rax
lea rdx, [0x14025a870]
mov rcx, qword [rsp + 0x5b8]
call fcn.140006e10
mov byte [rsp + 0x538], al
lea rcx, [rsp + 0x540]
call fcn.140007060
movzx edx, byte [rsp + 0x538]
test edx, edx
je 0x1401aeb71
jmp 0x1401af71a
mov eax, 0x4c
mov word [rsp + 0x460], ax
mov eax, 0x69
mov word [rsp + 0x462], ax
mov eax, 0x63
mov word [rsp + 0x464], ax
mov eax, 0x65
mov word [rsp + 0x466], ax
mov eax, WSASetLastError
mov word [rsp + 0x468], ax
mov eax, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x46a], ax
mov eax, 0x65
mov word [rsp + 0x46c], ax
mov eax, 0x20
mov word [rsp + 0x46e], ax
mov eax, 0x69
mov word [rsp + 0x470], ax
mov eax, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x472], ax
mov eax, 0x20
mov word [rsp + 0x474], ax
mov eax, WSASetLastError
mov word [rsp + 0x476], ax
mov eax, reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x478], ax
mov eax, 0x63
mov word [rsp + 0x47a], ax
mov eax, WSAGetLastError
mov word [rsp + 0x47c], ax
mov eax, 0x65
mov word [rsp + 0x47e], ax
mov eax, 0x64
mov word [rsp + 0x480], ax
mov eax, 0x2c
mov word [rsp + 0x482], ax
mov eax, 0x20
mov word [rsp + 0x484], ax
mov eax, 0x44
mov word [rsp + 0x486], ax
mov eax, reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x488], ax
mov eax, 0x20
mov word [rsp + 0x48a], ax
mov eax, 0x79
mov word [rsp + 0x48c], ax
mov eax, reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x48e], ax
mov eax, 0x75
mov word [rsp + 0x490], ax
mov eax, 0x20
mov word [rsp + 0x492], ax
mov eax, 0x77
mov word [rsp + 0x494], ax
mov eax, 0x61
mov word [rsp + 0x496], ax
mov eax, WSASetLastError
mov word [rsp + 0x498], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x49a], ax
mov eax, 0x20
mov word [rsp + 0x49c], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x49e], ax
mov eax, reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x4a0], ax
mov eax, 0x20
mov word [rsp + 0x4a2], ax
mov eax, 0x67
mov word [rsp + 0x4a4], ax
mov eax, reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x4a6], ax
mov eax, 0x20
mov word [rsp + 0x4a8], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x4aa], ax
mov eax, reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x4ac], ax
mov eax, 0x20
mov word [rsp + 0x4ae], ax
mov eax, 0x68
mov word [rsp + 0x4b0], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x4b2], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x4b4], ax
mov eax, reloc.WS2_32.dll_WSASetLastError
mov word [rsp + 0x4b6], ax
mov eax, 0x3a
mov word [rsp + 0x4b8], ax
mov eax, 0x2f
mov word [rsp + 0x4ba], ax
mov eax, 0x2f
mov word [rsp + 0x4bc], ax
mov eax, 0x63
mov word [rsp + 0x4be], ax
mov eax, reloc.WS2_32.dll_WSASetLastError
mov word [rsp + 0x4c0], ax
mov eax, 0x2e
mov word [rsp + 0x4c2], ax
mov eax, 0x79
mov word [rsp + 0x4c4], ax
mov eax, reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x4c6], ax
mov eax, 0x75
mov word [rsp + 0x4c8], ax
mov eax, WSASetLastError
mov word [rsp + 0x4ca], ax
mov eax, 0x67
mov word [rsp + 0x4cc], ax
mov eax, 0x7a
mov word [rsp + 0x4ce], ax
mov eax, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x4d0], ax
mov eax, reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x4d2], ax
mov eax, 0x66
mov word [rsp + 0x4d4], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x4d6], ax
mov eax, 0x2e
mov word [rsp + 0x4d8], ax
mov eax, 0x63
mov word [rsp + 0x4da], ax
mov eax, reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x4dc], ax
mov eax, WSASetLastError
mov word [rsp + 0x4de], ax
mov eax, 0x2f
mov word [rsp + 0x4e0], ax
mov eax, 0x20
mov word [rsp + 0x4e2], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x4e4], ax
mov eax, reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x4e6], ax
mov eax, 0x20
mov word [rsp + 0x4e8], ax
mov eax, 0x61
mov word [rsp + 0x4ea], ax
mov eax, 0x63
mov word [rsp + 0x4ec], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x4ee], ax
mov eax, 0x69
mov word [rsp + 0x4f0], ax
mov eax, 0x76
mov word [rsp + 0x4f2], ax
mov eax, 0x65
mov word [rsp + 0x4f4], ax
mov eax, 0x20
mov word [rsp + 0x4f6], ax
mov eax, 0x69
mov word [rsp + 0x4f8], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x4fa], ax
mov eax, 0x3f
mov word [rsp + 0x4fc], ax
xor eax, eax
mov word [rsp + 0x4fe], ax
xor r8d, r8d
mov edx, reloc.WS2_32.dll_gethostbyname
lea rcx, [rsp + 0x460]
call fcn.1400f0bf0
cmp eax, 7
jne 0x1401aef9d
jmp 0x1401af71a
lea rcx, [rsp + 0x500]
call fcn.140002d10
nop
mov eax, 0x68
mov word [rsp + 0x3e0], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x3e2], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x3e4], ax
mov eax, reloc.WS2_32.dll_WSASetLastError
mov word [rsp + 0x3e6], ax
mov eax, 0x3a
mov word [rsp + 0x3e8], ax
mov eax, 0x2f
mov word [rsp + 0x3ea], ax
mov eax, 0x2f
mov word [rsp + 0x3ec], ax
mov eax, 0x75
mov word [rsp + 0x3ee], ax
mov eax, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x3f0], ax
mov eax, 0x65
mov word [rsp + 0x3f2], ax
mov eax, WSACleanup
mov word [rsp + 0x3f4], ax
mov eax, 0x2e
mov word [rsp + 0x3f6], ax
mov eax, 0x79
mov word [rsp + 0x3f8], ax
mov eax, reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x3fa], ax
mov eax, 0x75
mov word [rsp + 0x3fc], ax
mov eax, WSASetLastError
mov word [rsp + 0x3fe], ax
mov eax, 0x67
mov word [rsp + 0x400], ax
mov eax, 0x7a
mov word [rsp + 0x402], ax
mov eax, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x404], ax
mov eax, reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x406], ax
mov eax, 0x66
mov word [rsp + 0x408], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x40a], ax
mov eax, 0x2e
mov word [rsp + 0x40c], ax
mov eax, 0x63
mov word [rsp + 0x40e], ax
mov eax, reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x410], ax
mov eax, WSASetLastError
mov word [rsp + 0x412], ax
mov eax, 0x2f
mov word [rsp + 0x414], ax
mov eax, 0x61
mov word [rsp + 0x416], ax
mov eax, 0x63
mov word [rsp + 0x418], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x41a], ax
mov eax, 0x69
mov word [rsp + 0x41c], ax
mov eax, 0x76
mov word [rsp + 0x41e], ax
mov eax, 0x65
mov word [rsp + 0x420], ax
mov eax, 0x2e
mov word [rsp + 0x422], ax
mov eax, reloc.WS2_32.dll_WSASetLastError
mov word [rsp + 0x424], ax
mov eax, 0x68
mov word [rsp + 0x426], ax
mov eax, reloc.WS2_32.dll_WSASetLastError
mov word [rsp + 0x428], ax
mov eax, 0x3f
mov word [rsp + 0x42a], ax
mov eax, WSACleanup
mov word [rsp + 0x42c], ax
mov eax, 0x65
mov word [rsp + 0x42e], ax
mov eax, 0x67
mov word [rsp + 0x430], ax
mov eax, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x432], ax
mov eax, reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x434], ax
mov eax, 0x66
mov word [rsp + 0x436], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x438], ax
mov eax, 0x77
mov word [rsp + 0x43a], ax
mov eax, 0x61
mov word [rsp + 0x43c], ax
mov eax, WSACleanup
mov word [rsp + 0x43e], ax
mov eax, 0x65
mov word [rsp + 0x440], ax
mov eax, 0x3d
mov word [rsp + 0x442], ax
mov eax, 0x63
mov word [rsp + 0x444], ax
mov eax, 0x63
mov word [rsp + 0x446], ax
mov eax, 0x62
mov word [rsp + 0x448], ax
mov eax, reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x44a], ax
mov eax, reloc.WS2_32.dll_WSAGetLastError
mov word [rsp + 0x44c], ax
mov eax, reloc.WS2_32.dll_WSACleanup
mov word [rsp + 0x44e], ax
mov eax, 0x26
mov word [rsp + 0x450], ax
mov eax, WSACleanup
mov word [rsp + 0x452], ax
mov eax, 0x65
mov word [rsp + 0x454], ax
mov eax, 0x67
mov word [rsp + 0x456], ax
mov eax, reloc.WS2_32.dll_WSAStartup
mov word [rsp + 0x458], ax
mov eax, WSASetLastError
mov word [rsp + 0x45a], ax
mov eax, 0x3d
mov word [rsp + 0x45c], ax
xor eax, eax
mov word [rsp + 0x45e], ax
mov r9, qword [rsp + 0x640]
mov r9, qword [r9 + 0x210]
lea r8, [rsp + 0x3e0]
lea rdx, [0x14025a890]
lea rcx, [rsp + 0x500]
call fcn.140002ba0
lea rcx, [rsp + 0x500]
call fcn.140050200
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rax
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rsp + 0x500]
call fcn.140007060
jmp 0x1401af71a
xor r8d, r8d
mov edx, gethostbyname
lea rcx, [rsp + 0x60]
call fcn.1400f0bf0
jmp 0x1401af71a
lea rcx, [rsp + 0x548]
call fcn.140001000
mov qword [rsp + 0x5c0], rax
mov rax, qword [rsp + 0x5c0]
mov qword [rsp + 0x5c8], rax
lea r8, [0x14025a8a0]
mov rdx, qword [rsp + 0x5c8]
lea rcx, [rsp + 0x270]
call fcn.1400010b0
nop
lea rcx, [rsp + 0x548]
call fcn.140007060
lea rcx, [rsp + 0x270]
call fcn.140050200
mov rdi, rax
mov rcx, qword [rsp + 0x640]
add rcx, 0x210
call fcn.140050200
mov r9, rdi
mov r8, rax
lea rdx, [0x14025a8b8]
lea rcx, [0x14025a8c8]
call qword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
mov dword [rsp + 0x58], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8033
xor edx, edx
lea rcx, [0x1403c8c50]
call fcn.1400d8250
test rax, rax
je 0x1401af462
mov r8d, 0xffffffff
mov edx, 0x124
mov ecx, 0x89
call fcn.1400f2960
cmp eax, 6
jne 0x1401af44c
mov dword [rsp + 0x5d0], 1
jmp 0x1401af457
mov dword [rsp + 0x5d0], 0
mov eax, dword [rsp + 0x5d0]
mov dword [rsp + 0x58], eax
cmp dword [rsp + 0x58], 0
je 0x1401af4a9
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8003
xor edx, edx
lea rcx, [0x1403c8c50]
call fcn.1400d8250
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8d, 0x8002
xor edx, edx
lea rcx, [0x1403c8c50]
call fcn.1400d8250
mov r8d, 0xffffffff
mov edx, 0x40
mov ecx, 0x68
call fcn.1400f2960
nop
lea rcx, [rsp + 0x270]
call fcn.140007060
jmp 0x1401af4e8
mov r8d, 0xffffffff
mov edx, 0x40
mov ecx, 0x69
call fcn.1400f2960
jmp 0x1401af71a
mov qword [rsp + 0x30], 0
call fcn.14000f060
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x30], 0
je 0x1401af70d
lea rdx, [0x14025a8d8]
lea rcx, [rsp + 0x508]
call fcn.1400f05c0
nop
lea rcx, [rsp + 0x510]
call fcn.1400020b0
nop
lea rcx, [rsp + 0x510]
call fcn.1400019a0
cmp eax, 8
jne 0x1401af638
mov r9d, 4
mov r8d, 4
lea rdx, [rsp + 0x550]
lea rcx, [rsp + 0x510]
call fcn.1400021f0
mov qword [rsp + 0x5d8], rax
mov rax, qword [rsp + 0x5d8]
mov qword [rsp + 0x5e0], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [rsp + 0x558]
lea rcx, [rsp + 0x510]
call fcn.1400021f0
mov qword [rsp + 0x5e8], rax
mov rax, qword [rsp + 0x5e8]
mov qword [rsp + 0x5f0], rax
lea rdx, [0x14025a8e8]
lea rcx, [rsp + 0x560]
call fcn.1400f05c0
mov qword [rsp + 0x5f8], rax
mov rax, qword [rsp + 0x5f8]
mov qword [rsp + 0x600], rax
mov rcx, qword [rsp + 0x600]
call fcn.140050200
mov r9, qword [rsp + 0x5e0]
mov r9, qword [r9]
mov r8, qword [rsp + 0x5f0]
mov r8, qword [r8]
mov rdx, rax
lea rcx, [rsp + 0x508]
call fcn.140002ba0
nop
lea rcx, [rsp + 0x560]
call fcn.140007060
nop
lea rcx, [rsp + 0x558]
call fcn.140007060
nop
lea rcx, [rsp + 0x550]
call fcn.140007060
lea rdx, [0x14025a920]
lea rcx, [rsp + 0x570]
call fcn.1400f05c0
mov qword [rsp + 0x608], rax
lea rdx, [0x14025a910]
mov rcx, qword [rsp + 0x608]
call fcn.140006e10
mov byte [rsp + 0x568], al
lea rcx, [rsp + 0x570]
call fcn.140007060
movzx edx, byte [rsp + 0x568]
test edx, edx
je 0x1401af6d7
lea rdx, [0x14025a930]
lea rcx, [rsp + 0x578]
call fcn.1400f05c0
mov qword [rsp + 0x610], rax
mov rax, qword [rsp + 0x610]
mov qword [rsp + 0x618], rax
mov rdx, qword [rsp + 0x618]
lea rcx, [rsp + 0x508]
call fcn.140002ce0
nop
lea rcx, [rsp + 0x578]
call fcn.140007060
lea rcx, [rsp + 0x508]
call fcn.140050200
mov rdx, rax
mov rcx, qword [rsp + 0x30]
call fcn.140079b78
nop
lea rcx, [rsp + 0x510]
call fcn.140007060
nop
lea rcx, [rsp + 0x508]
call fcn.140007060
mov rcx, qword [rsp + 0x640]
call fcn.140082910
mov rcx, qword [rsp + 0x620]
xor rcx, rsp
call fcn.1400a9820
add rsp, 0x630
pop rdi
ret