Function at 0x1401cbd40
Capabilities:
Persist via windows service
Set registry value

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x158
lea rbp, [rsp + 0x80]
mov qword [rbp + 0xd0], 0xfffffffffffffffe
mov rdi, rcx
lea rsi, [rbp - 0x50]
mov rcx, rsi
call fcn.140172c70
lea rdx, str.SYSTEMCurrentControlSetServices_
lea rbx, [rbp - 0x30]
mov rcx, rbx
mov r8, rsi
call fcn.1401cd760
lea rdx, [0x1403f6770]
lea rsi, [rbp - 0x10]
mov rcx, rsi
mov r8, rdi
call fcn.1401cd760
mov qword [rbp + 0xb8], rbx
mov rax, qword [rbp + 0xb8]
mov ecx, dword [0x140837c20]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
sete cl
cmp dword [0x140837c24], 0xa
setl dl
or dl, cl
mov edi, 0xb3ce7c32
mov edx, 0x3722f1cd
cmove edi, edx
mov ecx, 0xbfdfa790
cmove ecx, edx
cmp qword [rbp - 0x18], 8
mov edx, 0xad6d326
mov ebx, 0xd8848f1c
cmovae ebx, edx
mov qword [rbp + 0xc0], rax
mov eax, 0x2da7141d
lea r14, [rbp + 0x30]
lea r15, [rbp + 0xc0]
nop dword [rax + rax]
cmp eax, 0xad6d325
jg 0x1401cbe30
cmp eax, 0xb3ce7c32
je 0x1401cbe53
cmp eax, 0xbfdfa790
je 0x1401cbe5d
cmp eax, 0xd8848f1c
jne 0x1401cbe10
jmp 0x1401cbe7a
cmp eax, 0xad6d326
je 0x1401cbe6f
cmp eax, 0x2da7141d
je 0x1401cbe73
cmp eax, 0x3722f1cd
jne 0x1401cbe10
mov rax, qword [rbp + 0xb8]
mov eax, 0xbfdfa790
jmp 0x1401cbe10
mov eax, 0xd8848f1c
mov rdx, qword [r14]
jmp 0x1401cbe10
mov rax, qword [rbp + 0xb8]
mov rax, qword [rax]
mov qword [rbp + 0x30], rax
mov eax, edi
jmp 0x1401cbe10
mov eax, ecx
jmp 0x1401cbe10
mov rdx, qword [r15]
mov eax, ebx
jmp 0x1401cbe10
lea r8, [rbp + 0x28]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
je 0x1401cc2b4
movups xmm0, xmmword [0x1403eee11]
mov eax, dword [0x140837d00]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x140837d04], 0xa
setl cl
or cl, al
mov ecx, 0xc0d2edbf
mov eax, 0x84ae86b8
cmove ecx, eax
movups xmmword [rbp + 0x3d], xmm0
mov r14d, 0x449d5bd3
cmove r14d, eax
mov r15d, 0x1344ee2f
mov eax, 0x1072dd68
cmove r15d, eax
mov r12d, 0xa211b30d
cmove r12d, eax
mov eax, dword [0x140837a90]
lea edi, [rax - 1]
imul edi, eax
test dil, 1
sete r8b
cmp dword [0x140837a94], 0xa
setl al
or al, r8b
mov r9d, 0x8dba1d35
mov eax, 0x13f2354a
cmove r9d, eax
movups xmm0, xmmword [0x1403eee04]
mov r10d, 0x14e85576
cmove r10d, eax
movaps xmmword [rbp + 0x30], xmm0
mov esi, 0xb6805a13
mov r8d, 0x1b4961a3
mov r11d, 0xd33233e5
jmp 0x1401cbf50
mov esi, 0x1b4961a3
nop dword [rax]
cmp esi, 0x13f23549
jle 0x1401cbf80
cmp esi, 0x13f2354a
je 0x1401cbfa1
cmp esi, 0x14e85576
je 0x1401cc0f6
cmp esi, 0x1b4961a3
jne 0x1401cbf50
jmp 0x1401cc276
cmp esi, 0x8dba1d35
je 0x1401cbf44
cmp esi, 0xb6805a13
je 0x1401cc264
cmp esi, 0x7de2ec5
jne 0x1401cbf50
mov esi, r10d
jmp 0x1401cbf50
mov eax, 0x191e013a
xor esi, esi
jmp 0x1401cbfb0
mov eax, 0x449d5bd3
nop
mov edi, eax
cmp eax, 0x1344ee2e
jg 0x1401cbff0
cmp edi, 0xc0d2edbe
jle 0x1401cc020
cmp edi, 0xd33233e5
je 0x1401cc089
cmp edi, 0x1072dd68
jne 0x1401cc0de
mov eax, dword [rbp + 0xc0]
mov eax, 0xa211b30d
jmp 0x1401cbfb0
cmp edi, 0x449d5bd2
jg 0x1401cc050
cmp edi, 0x1344ee2f
je 0x1401cc074
mov eax, edi
cmp edi, 0x191e013a
jne 0x1401cbfb0
mov dword [rbp + 0xc0], esi
mov eax, r12d
jmp 0x1401cbfb0
cmp edi, 0x84ae86b8
je 0x1401cbfaa
mov eax, edi
cmp edi, 0xa211b30d
jne 0x1401cbfb0
mov eax, dword [rbp + 0xc0]
cmp eax, 0x1d
setl byte [rbp + 0xb8]
mov eax, r15d
jmp 0x1401cbfb0
mov eax, ecx
cmp edi, 0x449d5bd3
je 0x1401cbfb0
mov eax, edi
cmp edi, 0x7ba68ae6
jne 0x1401cbfb0
mov eax, r14d
jmp 0x1401cbfb0
cmp byte [rbp + 0xb8], 0
mov eax, 0x7ba68ae6
cmovne eax, r11d
jmp 0x1401cbfb0
movsxd rax, dword [rbp + 0xc0]
movzx edx, byte [rbp + rax + 0x30]
movsxd rsi, dword [rbp + 0xc0]
imul rdi, rsi, 0x5397829d
mov rbx, rdi
shr rbx, 0x3f
sar rdi, 0x24
add edi, ebx
imul edi, edi, 0x31
sub esi, edi
lea edi, [rsi + 0x36]
mov ebx, 0xc9
sub ebx, esi
and ebx, edx
not edx
and edx, edi
or ebx, edx
mov byte [rbp + rax + 0x30], bl
mov esi, dword [rbp + 0xc0]
add esi, 1
mov eax, 0x191e013a
jmp 0x1401cbfb0
mov eax, edi
cmp edi, 0xc0d2edbf
jne 0x1401cbfb0
mov esi, 0x14e85576
jmp 0x1401cbf50
mov eax, 0x191e013a
xor esi, esi
jmp 0x1401cc110
mov eax, 0x449d5bd3
nop word cs:[rax + rax]
nop
mov edi, eax
cmp eax, 0x1344ee2e
jg 0x1401cc150
cmp edi, 0xc0d2edbe
jle 0x1401cc180
cmp edi, 0xd33233e5
je 0x1401cc1f9
cmp edi, 0x1072dd68
jne 0x1401cc24e
mov eax, dword [rbp + 0xc0]
mov eax, 0xa211b30d
jmp 0x1401cc110
cmp edi, 0x449d5bd2
jg 0x1401cc1c0
cmp edi, 0x1344ee2f
je 0x1401cc1e4
mov eax, edi
cmp edi, 0x191e013a
jne 0x1401cc110
mov dword [rbp + 0xc0], esi
mov eax, r12d
jmp 0x1401cc110
cmp edi, 0x84ae86b8
je 0x1401cc0ff
mov eax, edi
cmp edi, 0xa211b30d
jne 0x1401cc110
mov eax, dword [rbp + 0xc0]
cmp eax, 0x1d
setl byte [rbp + 0xb8]
mov eax, r15d
jmp 0x1401cc110
mov eax, ecx
cmp edi, 0x449d5bd3
je 0x1401cc110
mov eax, edi
cmp edi, 0x7ba68ae6
jne 0x1401cc110
mov eax, r14d
jmp 0x1401cc110
cmp byte [rbp + 0xb8], 0
mov eax, 0x7ba68ae6
cmovne eax, r11d
jmp 0x1401cc110
movsxd rax, dword [rbp + 0xc0]
movzx esi, byte [rbp + rax + 0x30]
movsxd rdi, dword [rbp + 0xc0]
imul rdx, rdi, 0x5397829d
mov rbx, rdx
shr rbx, 0x3f
sar rdx, 0x24
add edx, ebx
imul edx, edx, 0x31
sub edi, edx
lea edx, [rdi + 0x36]
mov ebx, 0xc9
sub ebx, edi
and ebx, esi
not esi
and esi, edx
or ebx, esi
mov byte [rbp + rax + 0x30], bl
mov esi, dword [rbp + 0xc0]
add esi, 1
mov eax, 0x191e013a
jmp 0x1401cc110
mov eax, edi
cmp edi, 0xc0d2edbf
jne 0x1401cc110
mov esi, r9d
jmp 0x1401cbf50
cmp byte [rbp + 0x4c], 0
mov esi, 0x7de2ec5
cmove esi, r8d
jmp 0x1401cbf50
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [rbp + 0x30]
call fcn.140180b20
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
jmp 0x1401cca77
mov eax, dword [rbp]
mov qword [rbp + 0xb8], rsi
mov rcx, qword [rbp + 0xb8]
mov edx, dword [0x140837c20]
lea ebx, [rdx - 1]
imul ebx, edx
test bl, 1
sete dl
cmp dword [0x140837c24], 0xa
setl bl
or bl, dl
mov edi, 0xb3ce7c32
mov ebx, 0x3722f1cd
cmove edi, ebx
mov edx, 0xbfdfa790
cmove edx, ebx
mov qword [rbp + 0xc0], rcx
cmp qword [rbp + 8], 8
mov ecx, 0xad6d326
mov ebx, 0xd8848f1c
cmovae ebx, ecx
mov ecx, 0x2da7141d
nop word cs:[rax + rax]
cmp ecx, 0xad6d325
jg 0x1401cc350
cmp ecx, 0xb3ce7c32
je 0x1401cc376
cmp ecx, 0xbfdfa790
je 0x1401cc380
cmp ecx, 0xd8848f1c
jne 0x1401cc320
jmp 0x1401cc39d
cmp ecx, 0xad6d326
je 0x1401cc392
cmp ecx, 0x2da7141d
je 0x1401cc396
cmp ecx, 0x3722f1cd
jne 0x1401cc320
mov rcx, qword [rbp + 0xb8]
mov ecx, 0xbfdfa790
jmp 0x1401cc320
mov ecx, 0xd8848f1c
mov rsi, qword [r14]
jmp 0x1401cc320
mov rcx, qword [rbp + 0xb8]
mov rcx, qword [rcx]
mov qword [rbp + 0x30], rcx
mov ecx, edi
jmp 0x1401cc320
mov ecx, edx
jmp 0x1401cc320
mov rsi, qword [r15]
mov ecx, ebx
jmp 0x1401cc320
add eax, eax
mov rcx, qword [rbp + 0x28]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rsi
lea r8, [0x1403f66a2]
xor edx, edx
mov r9d, 2
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov rcx, qword [rbp + 0x28]
test eax, eax
je 0x1401cc78d
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movups xmm0, xmmword [0x1403eee3d]
movups xmmword [rbp + 0x4c], xmm0
movups xmm0, xmmword [0x1403eee31]
movaps xmmword [rbp + 0x40], xmm0
movups xmm0, xmmword [0x1403eee21]
mov eax, dword [0x140837aa0]
lea ecx, [rax - 1]
imul ecx, eax
mov eax, dword [0x140837e80]
mov edx, dword [0x140837e84]
lea ebx, [rax - 1]
imul ebx, eax
mov dword [rbp + 0x9c], ebx
test bl, 1
sete al
mov dword [rbp + 0x98], edx
cmp edx, 0xa
setl dl
or dl, al
mov r13d, 0x52873d04
mov eax, 0x68599f88
cmove r13d, eax
mov edi, dword [0x140837aa4]
mov r8d, 0xf8217a88
cmove r8d, eax
mov r9d, 0xdb9d1bf3
mov esi, 0x650e127
cmove r9d, esi
test cl, 1
sete byte [rbp + 0xb6]
mov ecx, 0xdd7da184
mov r14d, 0xf783c97f
cmove r14d, ecx
cmp edi, 0xa
setl byte [rbp + 0xb5]
movaps xmmword [rbp + 0x30], xmm0
cmovl r14d, ecx
mov esi, 0x6a50a769
mov r12d, 0xaab4d85a
mov r15d, 0x757d3caf
nop word cs:[rax + rax]
nop dword [rax]
cmp esi, 0xf7fe973a
jg 0x1401cc4d0
cmp esi, 0xc0ab6f72
je 0x1401cc511
cmp esi, 0xdd7da184
je 0x1401cc719
cmp esi, 0xf783c97f
jne 0x1401cc4a0
mov esi, 0x738687e9
jmp 0x1401cc4a0
cmp esi, 0xf7fe973b
je 0x1401cc74f
cmp esi, 0x738687e9
je 0x1401cc732
cmp esi, 0x6a50a769
jne 0x1401cc4a0
mov cl, byte [rbp + 0xb6]
cmp byte [rbp + 0xb5], 0
mov esi, 0xf783c97f
mov eax, 0x738687e9
cmovne esi, eax
test cl, cl
cmovne esi, eax
jmp 0x1401cc4a0
test byte [rbp + 0x9c], 1
sete byte [rbp + 0xa8]
cmp dword [rbp + 0x98], 0xa
setl byte [rbp + 0xa0]
mov edi, 0x8cf2159f
jmp 0x1401cc5b0
movsxd rcx, dword [rbp + 0xc0]
mov eax, dword [rbp + 0xc0]
mov eax, dword [rbp + 0xc0]
movsxd rax, dword [rbp + 0xc0]
imul rdx, rax, 0x5397829d
mov rbx, rdx
shr rbx, 0x3f
sar rdx, 0x24
add edx, ebx
imul edx, edx, 0x31
sub eax, edx
mov edx, 0xc9
sub edx, eax
add eax, 0x36
and edx, 0x91
and eax, 0x6e
or eax, edx
xor al, byte [rbp + rcx + 0x30]
xor al, 0x91
mov byte [rbp + rcx + 0x30], al
mov eax, dword [rbp + 0xc0]
mov eax, dword [rbp + 0xc0]
mov eax, dword [rbp + 0xc0]
mov eax, dword [rbp + 0xc0]
mov eax, dword [rbp + 0xc0]
mov edi, 0xf8217a88
nop dword [rax]
mov ecx, edi
cmp edi, 0x650e126
jle 0x1401cc5f0
cmp ecx, 0x52873d03
jle 0x1401cc620
cmp ecx, 0x52873d04
je 0x1401cc6e7
cmp ecx, 0x68599f88
je 0x1401cc537
mov edi, ecx
cmp ecx, 0x757d3caf
jne 0x1401cc5b0
mov edi, r8d
jmp 0x1401cc5b0
cmp ecx, 0xdb9d1bf2
jg 0x1401cc660
cmp ecx, 0x8cf2159f
je 0x1401cc6f7
mov edi, r9d
cmp ecx, 0xaab4d85a
je 0x1401cc5b0
mov edi, ecx
cmp ecx, 0x8c60bd59
jne 0x1401cc5b0
jmp 0x1401cc745
cmp ecx, 0x650e127
je 0x1401cc6d1
mov edi, ecx
cmp ecx, 0xe4b8231
jne 0x1401cc5b0
mov dword [rbp + 0xc0], esi
mov ecx, dword [rbp + 0xc0]
cmp ecx, 0x2c
mov edi, 0x8c60bd59
cmovl edi, r15d
jmp 0x1401cc5b0
cmp ecx, 0xdb9d1bf3
je 0x1401cc6db
mov edi, ecx
cmp ecx, 0xf8217a88
jne 0x1401cc5b0
movsxd rcx, dword [rbp + 0xc0]
movzx edi, byte [rbp + rcx + 0x30]
movsxd rdx, dword [rbp + 0xc0]
imul r10, rdx, 0x5397829d
mov r11, r10
shr r11, 0x3f
sar r10, 0x24
add r10d, r11d
imul ebx, r10d, 0x31
sub edx, ebx
lea ebx, [rdx + 0x36]
mov eax, 0xc9
sub eax, edx
and eax, edi
not edi
and edi, ebx
or eax, edi
mov byte [rbp + rcx + 0x30], al
mov eax, dword [rbp + 0xc0]
add eax, 1
mov dword [rbp + 0xb8], eax
mov edi, r13d
jmp 0x1401cc5b0
mov edi, 0xaab4d85a
jmp 0x1401cc5b0
mov edi, 0xe4b8231
xor esi, esi
jmp 0x1401cc5b0
mov edi, 0xe4b8231
mov esi, dword [rbp + 0xb8]
jmp 0x1401cc5b0
movzx ecx, byte [rbp + 0xa8]
cmp byte [rbp + 0xa0], 0
mov edi, 0x650e127
cmovne edi, r12d
test cl, cl
cmovne edi, r12d
jmp 0x1401cc5b0
cmp byte [rbp + 0xb7], 0
mov esi, 0xf7fe973b
mov eax, 0xc0ab6f72
cmovne esi, eax
jmp 0x1401cc4a0
cmp byte [rbp + 0x5b], 0
setne byte [rbp + 0xb7]
mov esi, r14d
jmp 0x1401cc4a0
mov esi, 0xf7fe973b
jmp 0x1401cc4a0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [rbp + 0x30]
call fcn.140180b20
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
jmp 0x1401cca77
lea rax, [0x1403eee00]
mov qword [rsp + 0x20], rax
mov dword [rsp + 0x28], 4
lea r8, str.Type
xor edx, edx
mov r9d, 4
call qword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
mov esi, eax
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
je 0x1401ccaaa
mov rax, qword [0x1403eee6c]
mov qword [rbp + 0x4f], rax
movups xmm0, xmmword [0x1403eee5d]
mov eax, dword [0x140837e90]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x140837e94], 0xa
setl cl
or cl, al
mov r10d, 0x48ddb251
mov eax, 0x2c635e35
cmove r10d, eax
movaps xmmword [rbp + 0x40], xmm0
mov r11d, 0x69d760f1
cmove r11d, eax
mov r14d, 0x72bb7ac6
mov ebx, 0xdd3ba302
cmove r14d, ebx
movups xmm0, xmmword [0x1403eee4d]
mov r15d, 0x1c996cf4
cmove r15d, ebx
movaps xmmword [rbp + 0x30], xmm0
mov ebx, 0xe6d156cb
mov r9d, 0x8be479ef
mov r8d, 0xe47ee02c
nop dword [rax]
cmp ebx, 0xe47ee02c
je 0x1401cca3e
cmp ebx, 0x41ba8061
je 0x1401cc87b
cmp ebx, 0xe6d156cb
jne 0x1401cc850
cmp byte [rbp + 0x56], 0
mov ebx, 0x41ba8061
cmove ebx, r8d
jmp 0x1401cc850
mov ebx, 0x42f5e739
xor esi, esi
jmp 0x1401cc8a0
mov dword [rbp + 0xc0], esi
mov ebx, dword [rbp + 0xc0]
cmp ebx, 0x27
mov ebx, 0x5a113d75
cmovl ebx, r9d
nop dword [rax]
mov edi, ebx
cmp ebx, 0x42f5e738
jle 0x1401cc930
cmp edi, 0x5a113d74
jle 0x1401cc960
mov ebx, r15d
cmp edi, 0x5a113d75
je 0x1401cc8a0
cmp edi, 0x69d760f1
jne 0x1401cca26
movsxd rbx, dword [rbp + 0xc0]
movzx edi, byte [rbp + rbx + 0x30]
movsxd rcx, dword [rbp + 0xc0]
imul rdx, rcx, 0x5397829d
mov rax, rdx
shr rax, 0x3f
sar rdx, 0x24
add edx, eax
imul eax, edx, 0x31
sub ecx, eax
lea eax, [rcx + 0x36]
mov edx, 0xc9
sub edx, ecx
and edx, edi
not edi
and edi, eax
or edx, edi
mov byte [rbp + rbx + 0x30], dl
mov eax, dword [rbp + 0xc0]
add eax, 1
mov dword [rbp + 0xb8], eax
mov ebx, r10d
jmp 0x1401cc8a0
cmp edi, 0x1c996cf3
jg 0x1401cc990
mov ebx, r11d
cmp edi, 0x8be479ef
je 0x1401cc8a0
mov ebx, edi
cmp edi, 0xdd3ba302
jne 0x1401cc8a0
mov ebx, 0x1c996cf4
jmp 0x1401cc8a0
cmp edi, 0x42f5e739
je 0x1401cc884
mov ebx, edi
cmp edi, 0x48ddb251
jne 0x1401cc8a0
mov esi, dword [rbp + 0xb8]
mov ebx, 0x42f5e739
jmp 0x1401cc8a0
mov ebx, r14d
cmp edi, 0x1c996cf4
je 0x1401cc8a0
mov ebx, edi
cmp edi, 0x2c635e35
jne 0x1401cc8a0
movsxd rbx, dword [rbp + 0xc0]
mov eax, dword [rbp + 0xc0]
movsxd rax, dword [rbp + 0xc0]
imul rcx, rax, 0x5397829d
mov rdx, rcx
shr rdx, 0x3f
sar rcx, 0x24
add ecx, edx
imul ecx, ecx, 0x31
sub eax, ecx
mov ecx, 9
sub ecx, eax
add eax, 0x36
and ecx, 0x3b
and eax, 0xc4
or eax, ecx
xor al, byte [rbp + rbx + 0x30]
xor al, 0x3b
mov byte [rbp + rbx + 0x30], al
mov eax, dword [rbp + 0xc0]
mov eax, dword [rbp + 0xc0]
mov eax, dword [rbp + 0xc0]
mov eax, dword [rbp + 0xc0]
mov eax, dword [rbp + 0xc0]
mov eax, dword [rbp + 0xc0]
mov ebx, 0x69d760f1
jmp 0x1401cc8a0
mov ebx, edi
cmp edi, 0x72bb7ac6
jne 0x1401cc8a0
mov ebx, 0xe47ee02c
jmp 0x1401cc850
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
lea rdx, [rbp + 0x30]
call fcn.140180b20
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
xor esi, esi
lea rcx, [rbp - 0x10]
call fcn.140173050
lea rcx, [rbp - 0x30]
call fcn.140173050
lea rcx, [rbp - 0x50]
call fcn.140173050
mov eax, esi
add rsp, 0x158
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov eax, dword [0x140838280]
mov ecx, dword [0x140838284]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete byte [rbp + 0xb8]
mov edx, 0x8d1bfe88
mov eax, 0x867ccf55
cmove eax, edx
cmp ecx, 0xa
setl byte [rbp + 0xc0]
cmovl eax, edx
mov edx, 0xddabb07
mov ecx, 0x332989b4
nop word [rax + rax]
cmp edx, 0xddabb06
jg 0x1401ccb10
cmp edx, 0x867ccf55
je 0x1401ccb3d
cmp edx, 0x8d1bfe88
jne 0x1401ccaf0
jmp 0x1401ccb77
cmp edx, 0x332989b4
je 0x1401ccb5a
cmp edx, 0xddabb07
jne 0x1401ccaf0
movzx ebx, byte [rbp + 0xb8]
cmp byte [rbp + 0xc0], 0
mov edx, 0x867ccf55
cmovne edx, ecx
test bl, bl
cmovne edx, ecx
jmp 0x1401ccaf0
movzx edx, word [0x1403eeee1]
mov word [rbp + 0x38], dx
mov rdx, qword [0x1403eeed9]
mov qword [rbp + 0x30], rdx
mov edx, 0x332989b4
jmp 0x1401ccaf0
movzx edx, word [0x1403eeee1]
mov word [rbp + 0x38], dx
mov rdx, qword [0x1403eeed9]
mov qword [rbp + 0x30], rdx
mov edx, eax
jmp 0x1401ccaf0
mov eax, dword [0x140837ab8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x140837abc], 0xa
setl cl
or cl, al
mov r10d, 0xc2655c84
mov eax, 0x39ca1a6e
cmove r10d, eax
mov r11d, 0x3fdca39e
cmove r11d, eax
mov eax, dword [0x1408379f8]
lea edx, [rax - 1]
imul edx, eax
test dl, 1
sete al
cmp dword [0x1408379fc], 0xa
setl dl
or dl, al
mov r15d, 0xc2d74956
mov eax, 0x833057af
cmove r15d, eax
mov ebx, 0xb5192b05
cmove ebx, eax
mov eax, 0xcafd72c
mov r8d, 0x19f385e7
mov r9d, 0xd436d8c6
nop word cs:[rax + rax]
nop
cmp eax, 0x34a0642f
jg 0x1401ccc30
cmp eax, 0xc2655c84
je 0x1401ccd4d
cmp eax, 0xcafd72c
je 0x1401ccc4e
cmp eax, 0x19f385e7
jne 0x1401ccc00
mov eax, r11d
jmp 0x1401ccc00
cmp eax, 0x34a06430
je 0x1401ccc5d
cmp eax, 0x39ca1a6e
je 0x1401ccd39
cmp eax, 0x3fdca39e
jne 0x1401ccc00
mov eax, r10d
jmp 0x1401ccc00
cmp byte [rbp + 0x39], 0
mov eax, 0x34a06430
cmove eax, r8d
jmp 0x1401ccc00
xor edi, edi
mov eax, 0x669c9f05
nop word cs:[rax + rax]
nop
cmp eax, 0xd436d8c5
jle 0x1401ccca0
cmp eax, 0xd436d8c6
je 0x1401ccce9
cmp eax, 0x1010398e
je 0x1401ccd43
cmp eax, 0x669c9f05
jne 0x1401ccc70
mov dword [rbp + 0xc0], edi
mov eax, ebx
jmp 0x1401ccc70
cmp eax, 0x833057af
je 0x1401cccc7
cmp eax, 0xb5192b05
je 0x1401cccd4
cmp eax, 0xc2d74956
jne 0x1401ccc70
cmp byte [rbp + 0xb8], 0
mov eax, 0x1010398e
cmovne eax, r9d
jmp 0x1401ccc70
mov eax, dword [rbp + 0xc0]
mov eax, 0xb5192b05
jmp 0x1401ccc70
mov eax, dword [rbp + 0xc0]
cmp eax, 0xa
setl byte [rbp + 0xb8]
mov eax, r15d
jmp 0x1401ccc70
movsxd rax, dword [rbp + 0xc0]
movzx edi, byte [rbp + rax + 0x30]
movsxd rsi, dword [rbp + 0xc0]
imul rcx, rsi, 0x5397829d
mov rdx, rcx
shr rdx, 0x3f
sar rcx, 0x24
add ecx, edx
imul ecx, ecx, 0x31
sub esi, ecx
lea ecx, [rsi + 0x36]
mov edx, 0xc9
sub edx, esi
and edx, edi
not edi
and edi, ecx
or edx, edi
mov byte [rbp + rax + 0x30], dl
mov edi, dword [rbp + 0xc0]
add edi, 1
jmp 0x1401ccc5f
mov eax, 0x3fdca39e
jmp 0x1401ccc00
mov eax, 0x19f385e7
jmp 0x1401ccc00
mov qword [rbp + 0xc0], r14
mov rcx, qword [rbp + 0xc0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test rax, rax
je 0x1401cca77
mov rsi, rax
lea rdx, str.RtlAdjustPrivilege
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call rbx
mov rdi, rax
lea rdx, str.NtLoadDriver
mov rcx, rsi
call rbx
mov rsi, rax
lea r9, [rbp + 0xb7]
mov ecx, 0xa
mov dl, 1
xor r8d, r8d
call rdi
test eax, eax
js 0x1401ccedc
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
lea rdi, [rbp + 0x30]
lea r8, [rbp - 0x50]
mov rcx, rdi
call fcn.1401cd760
mov qword [rbp + 0xa8], rdi
mov rax, qword [rbp + 0xa8]
mov ecx, dword [0x140837c20]
lea edx, [rcx - 1]
imul edx, ecx
test dl, 1
sete cl
cmp dword [0x140837c24], 0xa
setl dl
or dl, cl
mov edi, 0xb3ce7c32
mov edx, 0x3722f1cd
cmove edi, edx
mov ecx, 0xbfdfa790
cmove ecx, edx
cmp qword [rbp + 0x48], 8
mov edx, 0xad6d326
mov ebx, 0xd8848f1c
cmovae ebx, edx
mov qword [rbp + 0xa0], rax
mov eax, 0x2da7141d
lea r8, [rbp + 0xb8]
lea r9, [rbp + 0xa0]
jmp 0x1401cce40
mov eax, ecx
nop word cs:[rax + rax]
nop
cmp eax, 0xad6d325
jg 0x1401cce60
cmp eax, 0xb3ce7c32
je 0x1401cce83
cmp eax, 0xbfdfa790
je 0x1401cce8d
cmp eax, 0xd8848f1c
jne 0x1401cce40
jmp 0x1401ccea9
cmp eax, 0xad6d326
je 0x1401cce33
cmp eax, 0x2da7141d
je 0x1401ccea2
cmp eax, 0x3722f1cd
jne 0x1401cce40
mov rax, qword [rbp + 0xa8]
mov eax, 0xbfdfa790
jmp 0x1401cce40
mov eax, 0xd8848f1c
mov rdx, qword [r8]
jmp 0x1401cce40
mov rax, qword [rbp + 0xa8]
mov rax, qword [rax]
mov qword [rbp + 0xb8], rax
mov eax, edi
jmp 0x1401cce40
mov rdx, qword [r9]
mov eax, ebx
jmp 0x1401cce40
lea rdi, [rbp + 0xc0]
mov rcx, rdi
call sub.ntdll.dll_RtlInitUnicodeString
mov rcx, rdi
call rsi
cmp eax, 0xc000010e
sete cl
test eax, eax
setns sil
or sil, cl
lea rcx, [rbp + 0x30]
call fcn.140173050
jmp 0x1401cca79
mov rax, qword [0x1403eeed1]
mov qword [rbp + 0x8d], rax
movups xmm0, xmmword [0x1403eeec4]
movaps xmmword [rbp + 0x80], xmm0
movups xmm0, xmmword [0x1403eeeb4]
movaps xmmword [rbp + 0x70], xmm0
movups xmm0, xmmword [0x1403eeea4]
movaps xmmword [rbp + 0x60], xmm0
movups xmm0, xmmword [0x1403eee94]
movaps xmmword [rbp + 0x50], xmm0
movups xmm0, xmmword [0x1403eee84]
movaps xmmword [rbp + 0x40], xmm0
movups xmm0, xmmword [0x1403eee74]
mov eax, dword [0x140837de8]
mov ecx, dword [0x140837dec]
lea edx, [rax - 1]
imul edx, eax
mov dword [rbp + 0x9c], edx
test dl, 1
sete al
mov dword [rbp + 0x98], ecx
cmp ecx, 0xa
setl cl
or cl, al
mov r13d, 0x3c3c8379
mov eax, 0x4f091e02
cmove r13d, eax
mov edi, 0x3e8f6ceb
cmove edi, eax
mov r12d, 0xef311d
mov eax, 0x92144a7d
cmove r12d, eax
mov eax, dword [0x140837ac8]
lea ecx, [rax - 1]
imul ecx, eax
test cl, 1
sete al
cmp dword [0x140837acc], 0xa
setl cl
or cl, al
mov r9d, 0x945c3404
mov eax, 0x41063dd9
cmove r9d, eax
movaps xmmword [rbp + 0x30], xmm0
mov ecx, 0x781990eb
cmove ecx, eax
mov dword [rbp + 0x14], ecx
mov ecx, 0xd3658fd8
mov eax, 0xa9634f3c
cmove ecx, eax
mov dword [rbp + 0x18], ecx
mov r15d, 0x3bf16fb4
cmove r15d, eax
mov eax, dword [0x140838418]
mov ecx, dword [0x14083841c]
lea edx, [rax - 1]
imul edx, eax
mov dword [rbp + 0x20], edx
test dl, 1
mov eax, 0xd60ff8f2
mov edx, 0x499692fd
cmove edx, eax
mov dword [rbp + 0x1c], ecx
cmp ecx, 0xa
cmovl edx, eax
mov dword [rbp + 0x24], edx
mov ebx, 0x5a35f284
mov r10d, 0x1b1a6df5
mov r11d, 0x73146603
jmp 0x1401cd020
mov ebx, 0x781990eb
nop dword [rax]
mov eax, ebx
cmp ebx, 0x41063dd8
jg 0x1401cd060
cmp eax, 0xc0ed151
jg 0x1401cd100
cmp eax, 0xa9634f3c
je 0x1401cd3a3
cmp eax, 0xd3658fd8
jne 0x1401cd600
mov ebx, 0x7cedb6f4
jmp 0x1401cd020
cmp eax, 0x781990ea
jg 0x1401cd380
cmp eax, 0x41063dd9
je 0x1401cd017
mov ebx, eax
cmp eax, 0x5a35f284
jne 0x1401cd020
test byte [rbp + 0x20], 1
sete byte [rbp + 0xa0]
cmp dword [rbp + 0x1c], 0xa
setl byte [rbp + 0xb8]
mov ebx, 0xc1e64013
mov r8b, byte [rbp + 0x94]
nop dword [rax]
cmp ebx, 0x499692fc
jg 0x1401cd0c0
cmp ebx, 0xc1e64013
je 0x1401cd0d5
cmp ebx, 0xd60ff8f2
jne 0x1401cd0a0
jmp 0x1401cd5dd
cmp ebx, 0x499692fd
je 0x1401cd0f7
cmp ebx, 0x63ae87c8
jne 0x1401cd0a0
mov ebx, dword [rbp + 0x24]
jmp 0x1401cd0a0
movzx eax, byte [rbp + 0xa0]
cmp byte [rbp + 0xb8], 0
mov ebx, 0x499692fd
mov ecx, 0x63ae87c8
cmovne ebx, ecx
test al, al
cmovne ebx, ecx
jmp 0x1401cd0a0
mov ebx, 0x63ae87c8
jmp 0x1401cd0a0
mov ebx, r15d
cmp eax, 0xc0ed152
je 0x1401cd020
mov ebx, eax
cmp eax, 0x3bf16fb4
jne 0x1401cd020
test byte [rbp + 0x9c], 1
sete byte [rbp + 0xa8]
cmp dword [rbp + 0x98], 0xa
setl byte [rbp + 0xa0]
mov eax, 0x5152bd2e
jmp 0x1401cd150
mov eax, 0xf3c9b9fa
mov r8d, dword [rbp + 0xb8]
nop word [rax + rax]
mov ebx, eax
cmp eax, 0x3c3c8378
jle 0x1401cd1b0
cmp ebx, 0x4f091e01
jle 0x1401cd200
cmp ebx, 0x4f091e02
je 0x1401cd2aa
mov eax, r12d
cmp ebx, 0x73146603
je 0x1401cd150
mov eax, ebx
cmp ebx, 0x5152bd2e
jne 0x1401cd150
movzx ebx, byte [rbp + 0xa8]
cmp byte [rbp + 0xa0], 0
mov eax, 0x92144a7d
cmovne eax, r11d
test bl, bl
cmovne eax, r11d
jmp 0x1401cd150
cmp ebx, 0xef311c
jg 0x1401cd280
cmp ebx, 0x92144a7d
je 0x1401cd352
cmp ebx, 0xf3c9b9fa
jne 0x1401cd35c
mov dword [rbp + 0xc0], r8d
mov eax, dword [rbp + 0xc0]
cmp eax, 0x65
mov eax, 0xc7bdd43e
cmovl eax, r10d
jmp 0x1401cd150
cmp ebx, 0x3c3c8379
je 0x1401cd13e
mov eax, ebx
cmp ebx, 0x3e8f6ceb
jne 0x1401cd150
movsxd rax, dword [rbp + 0xc0]
movsxd rsi, dword [rbp + 0xc0]
imul rbx, rsi, 0x5397829d
mov r14, rbx
shr r14, 0x3f
sar rbx, 0x24
add ebx, r14d
imul ebx, ebx, 0x31
sub esi, ebx
mov ebx, 0x49
sub ebx, esi
add esi, 0x36
and ebx, 0x50
and esi, 0xaf
or esi, ebx
xor sil, byte [rbp + rax + 0x30]
xor sil, 0x50
mov byte [rbp + rax + 0x30], sil
mov eax, dword [rbp + 0xc0]
add eax, 1
mov dword [rbp + 0xb8], eax
mov eax, r13d
jmp 0x1401cd150
cmp ebx, 0xef311d
je 0x1401cd29d
mov eax, ebx
cmp ebx, 0x1b1a6df5
jne 0x1401cd150
mov eax, edi
jmp 0x1401cd150
mov eax, 0xf3c9b9fa
xor r8d, r8d
jmp 0x1401cd150
movsxd rax, dword [rbp + 0xc0]
mov esi, dword [rbp + 0xc0]
mov esi, dword [rbp + 0xc0]
mov esi, dword [rbp + 0xc0]
mov esi, dword [rbp + 0xc0]
mov esi, dword [rbp + 0xc0]
movsxd rsi, dword [rbp + 0xc0]
imul rbx, rsi, 0x5397829d
mov rcx, rbx
shr rcx, 0x3f
sar rbx, 0x24
add ebx, ecx
imul ecx, ebx, 0x31
sub esi, ecx
mov ecx, 0xc9
sub ecx, esi
add esi, 0x36
and ecx, 0xd6
and esi, 0x29
or esi, ecx
xor sil, byte [rbp + rax + 0x30]
xor sil, 0xd6
mov byte [rbp + rax + 0x30], sil
mov eax, dword [rbp + 0xc0]
mov eax, dword [rbp + 0xc0]
mov eax, dword [rbp + 0xc0]
mov eax, dword [rbp + 0xc0]
mov eax, dword [rbp + 0xc0]
mov eax, dword [rbp + 0xc0]
mov eax, dword [rbp + 0xc0]
mov eax, dword [rbp + 0xc0]
mov eax, dword [rbp + 0xc0]
mov eax, 0x3e8f6ceb
jmp 0x1401cd150
mov eax, 0x73146603
jmp 0x1401cd150
mov eax, ebx
cmp ebx, 0xc7bdd43e
jne 0x1401cd150
mov ebx, dword [rbp + 0x18]
jmp 0x1401cd020
mov ebx, r9d
cmp eax, 0x781990eb
je 0x1401cd020
mov ebx, eax
cmp eax, 0x7cedb6f4
jne 0x1401cd020
mov ebx, dword [rbp + 0x14]
jmp 0x1401cd020
test byte [rbp + 0x9c], 1
sete byte [rbp + 0xa8]
cmp dword [rbp + 0x98], 0xa
setl byte [rbp + 0xa0]
mov esi, 0x5152bd2e
jmp 0x1401cd3e0
mov esi, 0xf3c9b9fa
mov ebx, dword [rbp + 0xb8]
nop word cs:[rax + rax]
nop dword [rax + rax]
mov eax, esi
cmp esi, 0x3c3c8378
jle 0x1401cd430
cmp eax, 0x4f091e01
jle 0x1401cd470
cmp eax, 0x4f091e02
je 0x1401cd517
mov esi, r12d
cmp eax, 0x73146603
je 0x1401cd3e0
mov esi, eax
cmp eax, 0x5152bd2e
jne 0x1401cd3e0
movzx eax, byte [rbp + 0xa8]
cmp byte [rbp + 0xa0], 0
mov esi, 0x92144a7d
cmovne esi, r11d
test al, al
cmovne esi, r11d
jmp 0x1401cd3e0
cmp eax, 0xef311c
jg 0x1401cd4f0
cmp eax, 0x92144a7d
je 0x1401cd5bc
cmp eax, 0xf3c9b9fa
jne 0x1401cd5c6
mov dword [rbp + 0xc0], ebx
mov eax, dword [rbp + 0xc0]
cmp eax, 0x65
mov esi, 0xc7bdd43e
cmovl esi, r10d
jmp 0x1401cd3e0
cmp eax, 0x3c3c8379
je 0x1401cd3c6
mov esi, eax
cmp eax, 0x3e8f6ceb
jne 0x1401cd3e0
movsxd rax, dword [rbp + 0xc0]
movsxd rcx, dword [rbp + 0xc0]
imul rsi, rcx, 0x5397829d
mov rdx, rsi
shr rdx, 0x3f
sar rsi, 0x24
add esi, edx
imul edx, esi, 0x31
sub ecx, edx
mov edx, 0x49
sub edx, ecx
add ecx, 0x36
and edx, 0x50
and ecx, 0xaf
or ecx, edx
xor cl, byte [rbp + rax + 0x30]
xor cl, 0x50
mov byte [rbp + rax + 0x30], cl
mov eax, dword [rbp + 0xc0]
add eax, 1
mov dword [rbp + 0xb8], eax
mov esi, r13d
jmp 0x1401cd3e0
cmp eax, 0xef311d
je 0x1401cd50b
mov esi, eax
cmp eax, 0x1b1a6df5
jne 0x1401cd3e0
mov esi, edi
jmp 0x1401cd3e0
mov esi, 0xf3c9b9fa
xor ebx, ebx
jmp 0x1401cd3e0
movsxd rax, dword [rbp + 0xc0]
mov ecx, dword [rbp + 0xc0]
mov ecx, dword [rbp + 0xc0]
mov ecx, dword [rbp + 0xc0]
mov ecx, dword [rbp + 0xc0]
mov ecx, dword [rbp + 0xc0]
movsxd rcx, dword [rbp + 0xc0]
imul rdx, rcx, 0x5397829d
mov rsi, rdx
shr rsi, 0x3f
sar rdx, 0x24
add edx, esi
imul edx, edx, 0x31
sub ecx, edx
mov edx, 0xc9
sub edx, ecx
add ecx, 0x36
and edx, 0xd6
and ecx, 0x29
or ecx, edx
xor cl, byte [rbp + rax + 0x30]
xor cl, 0xd6
mov byte [rbp + rax + 0x30], cl
mov eax, dword [rbp + 0xc0]
mov eax, dword [rbp + 0xc0]
mov eax, dword [rbp + 0xc0]
mov eax, dword [rbp + 0xc0]
mov eax, dword [rbp + 0xc0]
mov eax, dword [rbp + 0xc0]
mov eax, dword [rbp + 0xc0]
mov eax, dword [rbp + 0xc0]
mov eax, dword [rbp + 0xc0]
mov esi, 0x3e8f6ceb
jmp 0x1401cd3e0
mov esi, 0x73146603
jmp 0x1401cd3e0
mov esi, eax
cmp eax, 0xc7bdd43e
jne 0x1401cd3e0
mov ebx, 0x3bf16fb4
jmp 0x1401cd020
test r8b, r8b
setne byte [rbp + 0xc0]
cmp byte [rbp + 0xc0], 0
mov ebx, 0x7cedb6f4
mov eax, 0xc0ed152
cmovne ebx, eax
jmp 0x1401cd020
mov ebx, eax
cmp eax, 0x945c3404
jne 0x1401cd020
lea rax, [rbp + 0x30]
mov qword [rbp + 0xc0], rax
mov rdx, qword [rbp + 0xc0]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcout]
call fcn.140180b20
mov rsi, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rsi
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_wchar_t___cdecl_std::basic_ios_wchar_t__struct_std::char_traits_wchar_t__::widen_char_const___ptr64]
mov rcx, rsi
mov edx, eax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::put_wchar_t____ptr64]
mov rcx, rsi
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::flush_void____ptr64]
jmp 0x1401cca77