Function at 0x14003de90
Capabilities:
Install driver
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x260]
sub rsp, 0x360
mov rax, qword [0x1400f3680]
xor rax, rsp
mov qword [rbp + 0x250], rax
mov r13, rcx
mov qword [rsp + 0x78], rcx
xor edi, edi
mov dword [rsp + 0x30], edi
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa0], xmm1
mov qword [rbp + 0xb0], rdi
mov ecx, 0x9e3f
call fcn.140097574
test rax, rax
je 0x14003eb7a
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rbp + 0xa0], rcx
lea rbx, [rcx + 0x9e18]
mov qword [rbp + 0xb0], rbx
mov r8d, 0x9e18
lea rdx, [0x1400e96e0]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0xa8], rbx
lea r8d, [rdi + 0x10]
lea rdx, [rbp + 0x60]
lea rcx, [0x1400fd454]
call fcn.14003dcd0
nop
lea rcx, [rbp]
call fcn.14003f5f0
nop
mov r15, rax
cmp qword [rax + 0x18], 7
jbe 0x14003df61
mov r15, qword [rax]
mov r14, qword [rax + 0x10]
call fcn.140096a9c
mov r12d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x58], 0
mov dword [rsp + 0x30], 0x20
test r14, r14
je 0x14003e07e
cmp r14, 0x7fffffff
ja 0x14003eb8b
mov dword [rsp + 0x20], edi
xor r9d, r9d
mov r8d, r14d
mov rdx, r15
mov ecx, eax
call fcn.140096b0c
mov rdi, rax
shr rax, 0x20
test eax, eax
jne 0x14003eb96
movsxd rcx, edi
mov rdx, qword [rsp + 0x68]
cmp rcx, rdx
ja 0x14003dff2
mov qword [rsp + 0x68], rcx
lea rax, [rsp + 0x58]
cmp qword [rsp + 0x70], 0xf
cmova rax, qword [rsp + 0x58]
mov byte [rax + rcx], 0
jmp 0x14003e04c
mov rsi, rcx
sub rsi, rdx
mov r8, qword [rsp + 0x70]
mov rax, r8
sub rax, rdx
cmp rsi, rax
ja 0x14003e032
mov qword [rsp + 0x68], rcx
lea rbx, [rsp + 0x58]
cmp r8, 0xf
cmova rbx, qword [rsp + 0x58]
add rbx, rdx
mov r8, rsi
xor edx, edx
mov rcx, rbx
call fcn.14009866e
mov byte [rbx + rsi], 0
jmp 0x14003e04c
mov byte [rsp + 0x20], 0
mov r9, rsi
movzx r8d, byte [rbp + 0x38]
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.14000b5d0
lea r9, [rsp + 0x58]
cmp qword [rsp + 0x70], 0xf
cmova r9, qword [rsp + 0x58]
mov dword [rsp + 0x20], edi
mov r8d, r14d
mov rdx, r15
mov ecx, r12d
call fcn.140096b0c
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x14003eba2
mov edi, 0x1c
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova rdx, qword [rbp + 0x60]
mov r8, qword [rbp + 0x70]
lea rcx, [rsp + 0x58]
call fcn.140022d60
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
xor r12d, r12d
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x90], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r12b
or edi, 0x40
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x14003e121
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e11c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003e11c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400975b0
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x58], 0
lea rcx, [rbp]
call fcn.140004b40
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x140]
call fcn.14009866e
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0xf
cmova rdx, qword [rbp + 0x80]
mov esi, 1
mov dword [rsp + 0x20], esi
lea r9d, [rsi + 0x3f]
lea r8d, [rsi + 0x1f]
lea rcx, [rbp + 0x140]
call fcn.14003d800
nop
mov r8, qword [rbp + 0xa8]
mov rdx, qword [rbp + 0xa0]
sub r8, rdx
lea rcx, [rbp + 0x140]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x148]
call fcn.140004bf0
test rax, rax
jne 0x14003e1d6
mov rax, qword [rbp + 0x140]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x140]
add rcx, rax
xor r8d, r8d
lea edx, [rsi + 1]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.SeLoadDriverPrivilege
lea rcx, [rbp - 0x40]
call fcn.140004200
mov qword [rbp + 0x30], r12
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x30]
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14003e222
mov bl, 1
jmp 0x14003e2a3
mov qword [rbp + 0xb8], r12
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 7
cmova rdx, qword [rbp - 0x40]
lea r8, [rbp + 0xb8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x14003e24e
mov bl, 1
jmp 0x14003e2a3
mov dword [rbp + 0xc0], esi
mov rax, qword [rbp + 0xb8]
mov qword [rbp + 0xc4], rax
mov dword [rbp + 0xcc], 2
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], r12
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rbp + 0xc0]
xor edx, edx
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x14003e297
mov bl, 1
jmp 0x14003e2a3
mov rcx, qword [rbp + 0x30]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x14003e2e6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e2e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003e2e1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400975b0
movdqa xmm0, xmmword [0x1400a9980]
movdqu xmmword [rbp - 0x30], xmm0
mov word [rbp - 0x40], r12w
test bl, bl
je 0x14003e304
mov ebx, r12d
jmp 0x14003e9ed
lea rax, [rbp - 0x60]
mov qword [rbp + 0x20], rax
mov rsi, qword [rbp + 0x90]
lea r14, [rbp + 0x80]
cmp qword [rbp + 0x98], 0xf
cmova r14, qword [rbp + 0x80]
call fcn.140096a9c
mov r15d, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r12w
bts edi, 9
mov dword [rsp + 0x30], edi
test rsi, rsi
je 0x14003e3c6
cmp rsi, 0x7fffffff
ja 0x14003ebac
mov dword [rsp + 0x20], r12d
xor r9d, r9d
mov r8d, esi
mov rdx, r14
mov ecx, eax
call fcn.140096ac4
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x14003ebb7
xor r8d, r8d
movsxd rdx, ebx
lea rcx, [rbp - 0x60]
call fcn.14003f550
lea r9, [rbp - 0x60]
cmp qword [rbp - 0x48], 7
cmova r9, qword [rbp - 0x60]
mov dword [rsp + 0x20], ebx
mov r8d, esi
mov rdx, r14
mov ecx, r15d
call fcn.140096ac4
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x14003ebc3
btr edi, 9
or edi, 0x180
mov dword [rsp + 0x30], edi
mov qword [rbp + 0x20], r12
lea rax, [0x1400e96c0]
mov qword [rbp + 0x28], rax
lea r8, [rbp + 0x20]
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x20]
call fcn.14003f3f0
bts edi, 0xa
mov dword [rsp + 0x30], edi
cmp dword [rbp + 0x20], 0
jne 0x14003ebcd
lea r12, [rbp - 0x20]
cmp qword [rbp - 8], 7
cmova r12, qword [rbp - 0x20]
mov r15, qword [rbp - 0x10]
call fcn.140096a9c
mov r13d, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xor r8d, r8d
mov qword [rsp + 0x48], r8
mov ecx, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x50], rcx
mov byte [rsp + 0x38], r8b
bts edi, 0xe
mov dword [rsp + 0x30], edi
test r15, r15
je 0x14003e541
cmp r15, 0x7fffffff
ja 0x14003ebe2
mov dword [rsp + 0x20], r8d
xor r9d, r9d
mov r8d, r15d
mov rdx, r12
mov ecx, eax
call fcn.140096b0c
mov rsi, rax
shr rax, 0x20
test eax, eax
jne 0x14003ebed
movsxd rcx, esi
mov rdx, qword [rsp + 0x48]
cmp rcx, rdx
ja 0x14003e4aa
mov qword [rsp + 0x48], rcx
lea rax, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova rax, qword [rsp + 0x38]
mov byte [rax + rcx], 0
jmp 0x14003e505
mov r14, rcx
sub r14, rdx
mov r8, qword [rsp + 0x50]
mov rax, r8
sub rax, rdx
cmp r14, rax
ja 0x14003e4eb
mov qword [rsp + 0x48], rcx
lea rbx, [rsp + 0x38]
cmp r8, 0xf
cmova rbx, qword [rsp + 0x38]
add rbx, rdx
mov r8, r14
xor edx, edx
mov rcx, rbx
call fcn.14009866e
mov byte [r14 + rbx], 0
jmp 0x14003e505
mov byte [rsp + 0x20], 0
mov r9, r14
movzx r8d, byte [rbp + 0x38]
mov rdx, r14
lea rcx, [rsp + 0x38]
call fcn.14000b5d0
lea r9, [rsp + 0x38]
cmp qword [rsp + 0x50], 0xf
cmova r9, qword [rsp + 0x38]
mov dword [rsp + 0x20], esi
mov r8d, r15d
mov rdx, r12
mov ecx, r13d
call fcn.140096b0c
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x14003eb81
mov rcx, qword [rsp + 0x50]
mov r8, qword [rsp + 0x48]
btr edi, 0xe
or edi, 0x3800
mov dword [rsp + 0x30], edi
mov rax, rcx
sub rax, r8
lea r14, str.___
cmp rax, 4
jb 0x14003e5e6
lea rax, [r8 + 4]
mov qword [rsp + 0x48], rax
lea rbx, [rsp + 0x38]
cmp rcx, 0xf
cmova rbx, qword [rsp + 0x38]
lea rax, [0x1400b0c70]
cmp rax, rbx
jbe 0x14003e5a4
lea rax, [rbx + r8]
cmp r14, rax
ja 0x14003e5a4
cmp rbx, r14
ja 0x14003e59c
xor esi, esi
jmp 0x14003e5a9
mov rsi, rbx
sub rsi, r14
jmp 0x14003e5a9
mov esi, 4
inc r8
lea rcx, [rbx + 4]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 4
sub r8, rsi
lea rdx, [r14 + 4]
add rdx, rsi
lea rcx, [rbx + rsi]
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x38]
jmp 0x14003e60a
mov qword [rsp + 0x28], 4
mov qword [rsp + 0x20], r14
xor r9d, r9d
movzx r8d, byte [rbp + 0x38]
lea edx, [r9 + 4]
lea rcx, [rsp + 0x38]
call fcn.14000b780
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
xor r12d, r12d
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r12b
bts edi, 0xf
mov dword [rsp + 0x30], edi
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], r12
lea r8d, [r12 + 0x22]
lea rdx, str.SystemCurrentControlSetServices_
lea rcx, [rbp + 0x40]
call fcn.140004100
nop
mov rdi, qword [rbp + 0x70]
lea r9, [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova r9, qword [rbp + 0x60]
mov rcx, qword [rbp + 0x50]
mov rdx, qword [rbp + 0x58]
mov rax, rdx
sub rax, rcx
cmp rdi, rax
ja 0x14003e6b8
lea rax, [rcx + rdi]
mov qword [rbp + 0x50], rax
lea rbx, [rbp + 0x40]
cmp rdx, 0xf
cmova rbx, qword [rbp + 0x40]
add rbx, rcx
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], r12b
jmp 0x14003e6ce
mov qword [rsp + 0x20], rdi
movzx r8d, byte [rbp + 0x38]
mov rdx, rdi
lea rcx, [rbp + 0x40]
call fcn.14000b440
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova rdx, qword [rbp + 0x40]
lea r8, [rbp + 0x20]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x14003e738
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x14003e72c
inc rdx
mov rcx, qword [rbp + 0x40]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14003e727
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003e88c
call fcn.1400975b0
mov bl, 1
mov esi, 1
jmp 0x14003e89d
mov byte [rbp + 0x39], 1
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x39]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14003e6f1
mov byte [rbp + 0x3a], 3
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x3a]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ErrorControl
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14003e6f1
mov byte [rbp + 0x38], 3
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x38]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Start
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14003e6f1
lea rcx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova rcx, qword [rbp - 0x80]
mov eax, dword [rbp - 0x70]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov esi, 1
mov r9d, esi
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x14003e84e
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x14003e84a
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e845
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003e88c
call fcn.1400975b0
mov bl, 1
jmp 0x14003e89d
mov rcx, qword [rbp + 0x20]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ebx, eax
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x14003e898
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e893
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003e893
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400975b0
test ebx, ebx
setne bl
mov byte [rbp + 0x40], 0
mov qword [rbp + 0x58], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x50], r12
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x14003e8eb
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003e8e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003e8e6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400975b0
movdqa xmm0, xmmword [0x1400a9990]
movdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x80], 0
mov r8, qword [rsp + 0x50]
cmp r8, 0xf
jbe 0x14003e916
mov rdx, qword [rsp + 0x38]
lea rcx, [rsp + 0x38]
call fcn.14001ed60
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x38], 0
lea rcx, [rbp - 0x20]
call fcn.140004b40
nop
lea rcx, [rbp - 0x60]
call fcn.140004b40
test bl, bl
je 0x14003e948
mov ebx, r12d
jmp 0x14003e9e8
xorps xmm0, xmm0
movups xmmword [rbp + 0xd0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe0], xmm1
mov r8d, 0x34
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
lea rcx, [rbp + 0xd0]
call fcn.140004100
nop
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova rdx, qword [rbp + 0x60]
mov r8, qword [rbp + 0x70]
lea rcx, [rbp + 0xd0]
call fcn.140022d60
lea rdx, [rbp + 0xd0]
cmp qword [rbp + 0xe8], 0xf
cmova rdx, qword [rbp + 0xd0]
lea rcx, [rbp + 0x118]
call sub.ntdll.dll_RtlInitAnsiString
mov r8b, 1
lea rdx, [rbp + 0x118]
lea rcx, [rbp + 0x128]
call sub.ntdll.dll_RtlAnsiStringToUnicodeString
lea rcx, [rbp + 0x128]
call sub.ntdll.dll_NtLoadDriver
mov ebx, eax
lea rcx, [rbp + 0xd0]
call fcn.140004790
mov r13, qword [rsp + 0x78]
mov dword [rbp + 0xf0], ebx
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0xf8]
call fcn.140005960
nop
lea rcx, [rbp + 0x140]
call fcn.140004870
nop
mov r8, qword [rbp + 0x98]
cmp r8, 0xf
jbe 0x14003ea31
mov rdx, qword [rbp + 0x80]
lea rcx, [rbp + 0x80]
call fcn.14001ed60
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x80], 0
mov r8, qword [rbp + 0x78]
cmp r8, 0xf
jbe 0x14003ea61
mov rdx, qword [rbp + 0x60]
lea rcx, [rbp + 0x60]
call fcn.14001ed60
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x60], 0
mov rcx, qword [rbp + 0xa0]
test rcx, rcx
je 0x14003eac6
mov rdx, qword [rbp + 0xb0]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003eaaf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003eaaf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400975b0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r12
cmp dword [rbp + 0xf0], 0
jl 0x14003eb39
lea rax, [rbp + 0xf8]
cmp r13, rax
je 0x14003eb3c
lea r9, [rbp + 0xf8]
cmp qword [rbp + 0x110], 0xf
cmova r9, qword [rbp + 0xf8]
mov rax, qword [r13 + 0x18]
mov rbx, qword [rbp + 0x108]
cmp rbx, rax
ja 0x14003eb27
mov rdi, r13
cmp rax, 0xf
jbe 0x14003eb0f
mov rdi, qword [r13]
mov qword [r13 + 0x10], rbx
mov r8, rbx
mov rdx, r9
mov rcx, rdi
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
jmp 0x14003eb3c
movzx r8d, byte [rbp + 0x38]
mov rdx, rbx
mov rcx, r13
call fcn.140005820
jmp 0x14003eb3c
mov esi, r12d
lea rcx, [rbp + 0xf0]
call fcn.140016fa0
mov eax, esi
mov rcx, qword [rbp + 0x250]
xor rcx, rsp
call fcn.140097850
lea r11, [rsp + 0x360]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
shr rcx, 0x20
call fcn.14003f3b0
nop
mov ecx, reloc.WS2_32.dll_shutdown
call fcn.140021ff0
int3
shr rdi, 0x20
mov ecx, edi
call fcn.14003f3b0
int3
shr rcx, 0x20
call fcn.14003f3b0
nop
mov ecx, reloc.WS2_32.dll_shutdown
call fcn.140021ff0
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.14003f3b0
int3
shr rcx, 0x20
call fcn.14003f3b0
nop
lea r8, [rbp - 0x60]
lea rdx, [rbp + 0x20]
lea rcx, str.absolute
call fcn.14003f2e0
nop
mov ecx, reloc.WS2_32.dll_shutdown
call fcn.140021ff0
int3
shr rsi, 0x20
mov ecx, esi
call fcn.14003f3b0
int3