Function at 0x14010e160
Capabilities:
Capture network configuration via ipconfig
Execute command
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x300]
sub rsp, 0x400
xor ebx, ebx
vmovups xmm0, xmmword [str.DRKNuYIIP2]
vmovups xmmword [rsp + 0x40], xmm0
mov eax, dword [0x1401e7ea8]
mov dword [rsp + 0x50], eax
movzx ecx, byte [0x1401e7eac]
mov byte [rsp + 0x40], WSAStartup
xor byte [rsp + 0x41], 0x37
xor byte [rsp + 0x42], 0x38
xor byte [rsp + 0x43], 0x39
xor byte [rsp + 0x44], 0x3a
xor byte [rsp + 0x45], 0x3b
xor byte [rsp + 0x46], 0x3c
xor byte [rsp + 0x47], 0x3d
xor byte [rsp + 0x48], 0x3e
xor byte [rsp + 0x49], 0x3f
xor byte [rsp + 0x4a], 0x40
xor byte [rsp + 0x4b], 0x41
xor byte [rsp + 0x4c], 0x42
xor byte [rsp + 0x4d], 0x43
xor byte [rsp + 0x4e], 0x44
xor byte [rsp + 0x4f], 0x45
xor al, 0x46
mov byte [rsp + 0x50], al
xor byte [rsp + 0x51], 0x47
xor byte [rsp + 0x52], 0x48
xor byte [rsp + 0x53], 0x49
xor cl, 0x4a
mov byte [rsp + 0x54], cl
lea rcx, [rsp + 0x40]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBeginUltra]
mov cl, 1
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsDebuggerPresent]
mov cl, 1
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsDebuggerPresent]
mov cl, 1
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsDebuggerPresent]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsProtected]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsVirtualMachinePresent]
lea rcx, str.netsh_interface_ipv6_uninstall
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_firewall_set_rule_group_File_and_Printer_Sharing__new_enableno
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_int_tcp_set_global_autotuninglevelnormal
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_interface_set_interface__Microsoft_Network_Adapter_Multiplexor_Protocol__admindisabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_config_lltdsvc_startdisabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpip6Parameters___v_DisabledComponents__t_REG_DWORD__d_0xFFFFFFFF__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_firewall_set_rule_group_Network_Discovery__new_enableno
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_config_lltdsvc_startdisabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v_EEE__t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSYSTEMCurrentControlSetServicesTcpipParametersInterfaces___v_NetworkAddress__t_REG_SZ__d_____f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v_ArpOffload__t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v_TcpAckFrequency__t_REG_DWORD__d_1__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v_TcpChecksumOffloadIPv4__t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v_LargeSendOffloadv2IPv6__t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v_TcpChecksumOffloadIPv6__t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v_UdpChecksumOffloadIPv6__t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Network_properties_have_been_configured.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14009d640
lea rdx, [0x14009dbb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
lea r8d, [rbx + 0x46]
lea rdx, str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpip6Parameters
lea rcx, [rsp + 0x40]
call fcn.14009dee0
nop
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], rbx
mov qword [rbp + 0xf8], rbx
lea r8d, [rbx + 0x10]
lea rdx, str.Dhcpv6DNSServers
lea rcx, [rbp + 0xe0]
call fcn.14009dee0
nop
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], rbx
mov qword [rbp + 0xd8], rbx
lea r8d, [rbx + 0x16]
lea rdx, str.Dhcpv6DomainSearchList
lea rcx, [rbp + 0xc0]
call fcn.14009dee0
nop
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], rbx
mov qword [rbp + 0xb8], rbx
lea r8d, [rbx + 0xa]
lea rdx, [0x1401e8538]
lea rcx, [rbp + 0xa0]
call fcn.14009dee0
nop
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], rbx
lea r8d, [rbx + 0x12]
lea rdx, str.DisabledComponents
lea rcx, [rbp + 0x80]
call fcn.14009dee0
nop
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x60], bl
vmovups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x80], bl
vmovups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x60], bl
lea r12d, [rbx + 0xe]
movzx ebx, byte [rbp + 0x340]
movzx edi, byte [rbp + 0x340]
movzx esi, byte [rbp + 0x340]
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x14010e496
dec eax
or eax, 0xffffff00
inc eax
mov r8d, eax
lea rdx, str._02X
lea rcx, [rbp + 0x340]
call fcn.1400ea170
lea rax, [rbp + 0x340]
mov r15, 0xffffffffffffffff
nop word [rax + rax]
inc r15
cmp byte [rax + r15], 0
jne 0x14010e4c0
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
mov rax, rdx
sub rax, rcx
cmp r15, rax
ja 0x14010e50e
lea rax, [rcx + r15]
mov qword [rbp - 0x50], rax
lea r14, [rbp - 0x60]
cmp rdx, 0xf
cmova r14, qword [rbp - 0x60]
add r14, rcx
mov r8, r15
lea rdx, [rbp + 0x340]
mov rcx, r14
call sub.VCRUNTIME140.dll_memmove
mov byte [r15 + r14], 0
jmp 0x14010e52a
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x340]
movzx r8d, bl
mov rdx, r15
lea rcx, [rbp - 0x60]
call fcn.14009e610
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x14010e540
dec eax
or eax, 0xffffff00
inc eax
mov r8d, eax
lea rdx, str._02X
lea rcx, [rbp + 0x348]
call fcn.1400ea170
lea rax, [rbp + 0x348]
mov r15, 0xffffffffffffffff
inc r15
cmp byte [rax + r15], 0
jne 0x14010e564
mov rcx, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x68]
mov rax, rdx
sub rax, rcx
cmp r15, rax
ja 0x14010e5b2
lea rax, [r15 + rcx]
mov qword [rbp - 0x70], rax
lea r14, [rbp - 0x80]
cmp rdx, 0xf
cmova r14, qword [rbp - 0x80]
add r14, rcx
mov r8, r15
lea rdx, [rbp + 0x348]
mov rcx, r14
call sub.VCRUNTIME140.dll_memmove
mov byte [r15 + r14], 0
jmp 0x14010e5ce
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x348]
movzx r8d, dil
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.14009e610
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x14010e5e4
dec eax
or eax, 0xffffff00
inc eax
mov r8d, eax
lea rdx, str._02X
lea rcx, [rbp + 0x350]
call fcn.1400ea170
lea rax, [rbp + 0x350]
mov r14, 0xffffffffffffffff
nop dword [rax + rax]
inc r14
cmp byte [rax + r14], 0
jne 0x14010e610
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x14010e663
lea rax, [r14 + rcx]
mov qword [rsp + 0x70], rax
lea r15, [rsp + 0x60]
cmp rdx, 0xf
cmova r15, qword [rsp + 0x60]
add r15, rcx
mov r8, r14
lea rdx, [rbp + 0x350]
mov rcx, r15
call sub.VCRUNTIME140.dll_memmove
mov byte [r14 + r15], 0
jmp 0x14010e680
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x350]
movzx r8d, sil
mov rdx, r14
lea rcx, [rsp + 0x60]
call fcn.14009e610
sub r12, 1
jne 0x14010e480
movabs rsi, 0x7fffffffffffffff
mov rax, rsi
mov r15, qword [rsp + 0x50]
sub rax, r15
cmp rax, 9
jb 0x14010f967
lea r12, [rsp + 0x40]
mov r13, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0x340], rax
cmp rax, 0xf
cmova r12, r13
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x40], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp - 0x30], xmm1
lea r14, [r15 + 9]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rbp - 0x40]
cmp r14, rbx
jbe 0x14010e768
mov rbx, r14
or rbx, 0xf
cmp rbx, rsi
jbe 0x14010e723
mov rbx, rsi
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1401cb054
test rax, rax
je 0x14010e74c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14010e764
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14010e753
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14010f961
jmp 0x14010e708
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14010e762
call fcn.1401cb054
mov rdi, rax
jmp 0x14010e764
xor edi, edi
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], rbx
vmovsd xmm0, qword [str.reg_add__]
vmovsd qword [rdi], xmm0
movzx eax, byte [0x1401e8588]
mov byte [rdi + 8], al
lea rcx, [rdi + 9]
mov r8, r15
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov rdi, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
sub rax, rdi
cmp rax, 6
jb 0x14010e7e4
lea rax, [rdi + 6]
mov qword [rbp - 0x30], rax
lea rbx, [rbp - 0x40]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x40]
lea rcx, [rbx + rdi]
mov r8d, 6
lea rdx, str.___v__
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi + 6], 0
lea rax, [rbp - 0x40]
jmp 0x14010e80a
mov qword [rsp + 0x20], 6
lea r9, str.___v__
movzx r8d, byte [rbp + 0x340]
mov edx, 6
lea rcx, [rbp - 0x40]
call fcn.14009e610
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x1e0], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x1f0], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x1e0], ymm0
xor edi, edi
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], dil
lea rdx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0xf
cmova rdx, qword [rbp + 0xe0]
mov r8, qword [rbp + 0xf0]
lea rcx, [rbp + 0x1e0]
vzeroupper
call fcn.14009cc10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x1c0], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x1d0], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x1c0], ymm0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rax + 0x10], rdi
mov byte [rax], dil
lea r8d, [rdi + 0x13]
lea rdx, str.___t_REG_BINARY__d
lea rcx, [rbp + 0x1c0]
vzeroupper
call fcn.14009cc10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x1a0], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x1b0], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x1a0], ymm0
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], dil
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x50]
lea rcx, [rbp + 0x1a0]
vzeroupper
call fcn.14009cc10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x180], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x190], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x180], ymm0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rax + 0x10], rdi
mov byte [rax], dil
lea r8d, [rdi + 3]
lea rdx, [0x1401e855c]
lea rcx, [rbp + 0x180]
vzeroupper
call fcn.14009cc10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x60], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x70], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x60], ymm0
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], dil
mov rdx, qword [rbp + 0x198]
cmp rdx, 0xf
jbe 0x14010e9ce
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010e9c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010e9c6
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.1401cb090
vmovdqu xmm0, xmmword [0x1401eca40]
vmovdqu xmmword [rbp + 0x190], xmm0
mov byte [rbp + 0x180], 0
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0xf
jbe 0x14010ea2f
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010ea27
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010ea27
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.1401cb090
vmovdqu xmm0, xmmword [0x1401eca40]
vmovdqu xmmword [rbp + 0x1b0], xmm0
mov byte [rbp + 0x1a0], 0
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0xf
jbe 0x14010ea90
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010ea88
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010ea88
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.1401cb090
vmovdqu xmm0, xmmword [0x1401eca40]
vmovdqu xmmword [rbp + 0x1d0], xmm0
mov byte [rbp + 0x1c0], 0
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 0xf
jbe 0x14010eaf1
inc rdx
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010eae9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010eae9
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.1401cb090
vmovdqu xmm0, xmmword [0x1401eca40]
vmovdqu xmmword [rbp + 0x1f0], xmm0
mov byte [rbp + 0x1e0], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x14010eb4c
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010eb44
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010eb44
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.1401cb090
vmovdqu xmm0, xmmword [0x1401eca40]
vmovdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov rax, rsi
sub rax, r15
cmp rax, 9
jb 0x14010f96d
lea rax, [rsp + 0x40]
cmp qword [rbp + 0x340], 0xf
cmova rax, r13
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.reg_add__
lea r8, [rsp + 0x40]
movzx edx, byte [rbp + 0x340]
lea rcx, [rbp + 0x2c0]
vzeroupper
call fcn.14009f1b0
nop
mov r8d, 6
lea rdx, str.___v__
lea rcx, [rbp + 0x2c0]
call fcn.14009cc10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x260], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x270], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x260], ymm0
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0xf
cmova rdx, qword [rbp + 0xc0]
mov r8, qword [rbp + 0xd0]
lea rcx, [rbp + 0x260]
vzeroupper
call fcn.14009cc10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x240], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x250], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x240], ymm0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rax + 0x10], rdi
mov byte [rax], 0
mov r8d, reloc.WS2_32.dll_send
lea rdx, str.___t_REG_BINARY__d
lea rcx, [rbp + 0x240]
vzeroupper
call fcn.14009cc10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x220], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x230], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x220], ymm0
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova rdx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x70]
lea rcx, [rbp + 0x220]
vzeroupper
call fcn.14009cc10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x200], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x210], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x200], ymm0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rax + 0x10], rdi
mov byte [rax], 0
mov r8d, 3
lea rdx, [0x1401e855c]
lea rcx, [rbp + 0x200]
vzeroupper
call fcn.14009cc10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x40], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x50], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x40], ymm0
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0x218]
cmp rdx, 0xf
jbe 0x14010ed93
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010ed8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010ed8b
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.1401cb090
vmovdqu xmm0, xmmword [0x1401eca40]
vmovdqu xmmword [rbp + 0x210], xmm0
mov byte [rbp + 0x200], 0
mov rdx, qword [rbp + 0x238]
cmp rdx, 0xf
jbe 0x14010edf4
inc rdx
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010edec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010edec
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.1401cb090
vmovdqu xmm0, xmmword [0x1401eca40]
vmovdqu xmmword [rbp + 0x230], xmm0
mov byte [rbp + 0x220], 0
mov rdx, qword [rbp + 0x258]
cmp rdx, 0xf
jbe 0x14010ee55
inc rdx
mov rcx, qword [rbp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010ee4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010ee4d
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.1401cb090
vmovdqu xmm0, xmmword [0x1401eca40]
vmovdqu xmmword [rbp + 0x250], xmm0
mov byte [rbp + 0x240], 0
mov rdx, qword [rbp + 0x278]
cmp rdx, 0xf
jbe 0x14010eeb6
inc rdx
mov rcx, qword [rbp + 0x260]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010eeae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010eeae
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.1401cb090
vmovdqu xmm0, xmmword [0x1401eca40]
vmovdqu xmmword [rbp + 0x270], xmm0
mov byte [rbp + 0x260], 0
lea rcx, [rbp + 0x2c0]
vzeroupper
call fcn.14009c960
mov rax, rsi
mov rcx, qword [rsp + 0x50]
sub rax, rcx
cmp rax, 9
jb 0x14010f976
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.reg_add__
lea r8, [rsp + 0x40]
movzx edx, byte [rbp + 0x340]
lea rcx, [rbp + 0x2e0]
call fcn.14009f1b0
nop
mov r8d, 6
lea rdx, str.___v__
lea rcx, [rbp + 0x2e0]
call fcn.14009cc10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x160], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x170], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x160], ymm0
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0xf
cmova rdx, qword [rbp + 0xa0]
mov r8, qword [rbp + 0xb0]
lea rcx, [rbp + 0x160]
vzeroupper
call fcn.14009cc10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x140], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x150], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x140], ymm0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rax + 0x10], rdi
mov byte [rax], 0
mov r8d, reloc.WS2_32.dll_send
lea rdx, str.___t_REG_BINARY__d
lea rcx, [rbp + 0x140]
vzeroupper
call fcn.14009cc10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x120], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x130], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x120], ymm0
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
lea rcx, [rbp + 0x120]
vzeroupper
call fcn.14009cc10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x100], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x110], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x100], ymm0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rax + 0x10], rdi
mov byte [rax], 0
mov r8d, 3
lea rdx, [0x1401e855c]
lea rcx, [rbp + 0x100]
vzeroupper
call fcn.14009cc10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x20], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x30], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x20], ymm0
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r8, qword [rbp + 0x118]
cmp r8, 0xf
jbe 0x14010f0f1
mov rdx, qword [rbp + 0x100]
lea rcx, [rbp + 0x100]
vzeroupper
call fcn.14009d2a0
vmovdqu xmm0, xmmword [0x1401eca40]
vmovdqu xmmword [rbp + 0x110], xmm0
mov byte [rbp + 0x100], 0
mov r8, qword [rbp + 0x138]
cmp r8, 0xf
jbe 0x14010f12b
mov rdx, qword [rbp + 0x120]
lea rcx, [rbp + 0x120]
vzeroupper
call fcn.14009d2a0
vmovdqu xmm0, xmmword [0x1401eca40]
vmovdqu xmmword [rbp + 0x130], xmm0
mov byte [rbp + 0x120], 0
mov r8, qword [rbp + 0x158]
cmp r8, 0xf
jbe 0x14010f165
mov rdx, qword [rbp + 0x140]
lea rcx, [rbp + 0x140]
vzeroupper
call fcn.14009d2a0
vmovdqu xmm0, xmmword [0x1401eca40]
vmovdqu xmmword [rbp + 0x150], xmm0
mov byte [rbp + 0x140], 0
mov r8, qword [rbp + 0x178]
cmp r8, 0xf
jbe 0x14010f19f
mov rdx, qword [rbp + 0x160]
lea rcx, [rbp + 0x160]
vzeroupper
call fcn.14009d2a0
vmovdqu xmm0, xmmword [0x1401eca40]
vmovdqu xmmword [rbp + 0x170], xmm0
mov byte [rbp + 0x160], 0
lea rcx, [rbp + 0x2e0]
vzeroupper
call fcn.14009c960
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova rcx, qword [rbp + 0x60]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova rcx, qword [rbp + 0x40]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0xf
cmova rcx, qword [rbp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [rsp + 0x50]
sub rsi, rcx
cmp rsi, 9
jb 0x14010f95b
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.reg_add__
lea r8, [rsp + 0x40]
movzx edx, byte [rbp + 0x340]
lea rcx, [rbp + 0x2a0]
call fcn.14009f1b0
nop
mov r8d, 6
lea rdx, str.___v__
lea rcx, [rbp + 0x2a0]
call fcn.14009cc10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x280], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x290], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x280], ymm0
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0xf
cmova rdx, qword [rbp + 0x80]
mov r8, qword [rbp + 0x90]
lea rcx, [rbp + 0x280]
vzeroupper
call fcn.14009cc10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x20], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp - 0x10], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp - 0x20], ymm0
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 8]
mov rax, rdx
sub rax, rcx
cmp rax, 0x16
jb 0x14010f348
lea rax, [rcx + 0x16]
mov qword [rbp - 0x10], rax
lea rbx, [rbp - 0x20]
cmp rdx, 0xf
cmova rbx, qword [rbp - 0x20]
add rbx, rcx
mov r8d, reloc.WLDAP32.dll_Ordinal_22
lea rdx, str.___t_REG_DWORD__d_1__f
mov rcx, rbx
vzeroupper
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x16], 0
lea rax, [rbp - 0x20]
jmp 0x14010f36f
mov eax, reloc.WLDAP32.dll_Ordinal_22
mov qword [rsp + 0x20], rax
lea r9, str.___t_REG_DWORD__d_1__f
movzx r8d, byte [rbp + 0x340]
mov edx, eax
lea rcx, [rbp - 0x20]
vzeroupper
call fcn.14009e610
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x10], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp], ymm0
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14010f3dd
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010f3d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010f3d5
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.1401cb090
vmovdqu xmm0, xmmword [0x1401eca40]
vmovdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp + 0x298]
cmp rdx, 0xf
jbe 0x14010f438
inc rdx
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010f430
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010f430
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.1401cb090
vmovdqu xmm0, xmmword [0x1401eca40]
vmovdqu xmmword [rbp + 0x290], xmm0
mov byte [rbp + 0x280], 0
mov rdx, qword [rbp + 0x2b8]
cmp rdx, 0xf
jbe 0x14010f499
inc rdx
mov rcx, qword [rbp + 0x2a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010f491
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010f491
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.1401cb090
vmovdqu xmm0, xmmword [0x1401eca40]
vmovdqu xmmword [rbp + 0x2b0], xmm0
mov byte [rbp + 0x2a0], 0
lea rcx, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rcx, qword [rbp]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Random_binary_values_and_DisabledComponents_set_for_registry_entries.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14009d640
lea rdx, [0x14009dbb0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.netsh_advfirewall_reset
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_winsock_reset
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ipconfig__release
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ipconfig__renew
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ipconfig__flushdns
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_winhttp_reset_autoproxy
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_winhttp_reset_proxy
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_winhttp_reset_tracing
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_interface_ipv4_reset
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_interface_portproxy_reset
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_interface_httpstunnel_reset
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_interface_tcp_reset
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_interface_teredo_set_state_disabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_interface_ipv6_6to4_set_state_statedisabled_undoonstopdisabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_interface_ipv6_isatap_set_state_statedisabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.arp__d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectEnd]
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x14010f5ff
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010f5fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010f5fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401cb090
vmovdqu xmm0, xmmword [0x1401eca40]
vmovdqu xmmword [rbp + 0x10], xmm0
mov byte [rbp], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x14010f64e
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010f649
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010f649
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401cb090
vmovdqu xmm0, xmmword [0x1401eca40]
vmovdqu xmmword [rbp + 0x30], xmm0
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x14010f69d
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010f698
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010f698
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401cb090
vmovdqu xmm0, xmmword [0x1401eca40]
vmovdqu xmmword [rbp + 0x50], xmm0
mov byte [rbp + 0x40], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x14010f6ec
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010f6e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010f6e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401cb090
vmovdqu xmm0, xmmword [0x1401eca40]
vmovdqu xmmword [rbp + 0x70], xmm0
mov byte [rbp + 0x60], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14010f73d
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010f738
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010f738
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401cb090
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x14010f78e
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010f789
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010f789
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401cb090
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x80], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x14010f7dc
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010f7d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010f7d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401cb090
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x14010f831
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010f82b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010f82b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401cb090
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x14010f876
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010f870
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010f870
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401cb090
nop
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0xf
jbe 0x14010f8bb
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010f8b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010f8b5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401cb090
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x14010f900
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010f8fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010f8fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401cb090
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x14010f940
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14010f93b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14010f93b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1401cb090
mov rbx, qword [rsp + 0x458]
add rsp, 0x400
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400840f0
nop
call fcn.140083f70
int3
call fcn.1400840f0
nop
vzeroupper
call fcn.1400840f0
nop
call fcn.1400840f0
int3