Function at 0x140001f80
Capabilities:
Copy file
Get memory capacity
Persist via run registry key
Persist via windows service
Set registry value

Disassembly:
mov r11, rsp
push r14
sub rsp, 0x370
mov qword [r11 - 0x268], 0xfffffffffffffffe
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov rax, qword [0x140020008]
xor rax, rsp
mov qword [rsp + 0x360], rax
xor eax, eax
mov qword [r11 - 0x4c], rax
mov qword [r11 - 0x44], rax
mov qword [r11 - 0x3c], rax
mov qword [r11 - 0x34], rax
mov qword [r11 - 0x2c], rax
mov qword [r11 - 0x24], rax
mov dword [r11 - 0x1c], eax
mov dword [r11 - 0x50], 0x38
lea rcx, [r11 - 0x50]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov rbx, qword [rsp + 0x330]
shr rbx, 0x14
cmp ebx, 0x88b8
jl 0x1400020b7
lea r8, str.XfServer.exe
lea rdx, [0x140021dc8]
lea rcx, [rsp + 0x98]
call fcn.1400052b0
mov rdi, rax
lea r8, str.XfServer20.exe
lea rdx, [0x140021dc8]
lea rcx, [rsp + 0x90]
call fcn.1400052b0
mov r8d, 1
mov rdx, qword [rdi]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000206d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x98]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000208e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
cmp ebx, 0x7530
jl 0x140002139
cmp ebx, 0x3a98
jl 0x1400021bb
cmp ebx, 0x1d4c
jge 0x1400022bc
jmp 0x14000223d
cmp ebx, 0x7530
jl 0x140002136
lea r8, str.XfServer.exe
lea rdx, [0x140021dc8]
lea rcx, [rsp + 0xa8]
call fcn.1400052b0
mov rbx, rax
lea r8, str.XfServer16.exe
lea rdx, [0x140021dc8]
lea rcx, [rsp + 0x40]
call fcn.1400052b0
mov r8d, 1
mov rdx, qword [rbx]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rdx, qword [rsp + 0x40]
add rdx, 0xffffffffffffffe8
or edi, 0xffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140002129
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0xa8]
jmp 0x140002331
or edi, 0xffffffff
cmp ebx, 0x3a98
jl 0x1400021bb
lea r8, str.XfServer.exe
lea rdx, [0x140021dc8]
lea rcx, [rsp + 0xb8]
call fcn.1400052b0
mov rbx, rax
lea r8, str.XfServer10.exe
lea rdx, [0x140021dc8]
lea rcx, [rsp + 0xb0]
call fcn.1400052b0
mov r8d, 1
mov rdx, qword [rbx]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rdx, qword [rsp + 0xb0]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400021ae
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0xb8]
jmp 0x140002331
cmp ebx, 0x1d4c
jl 0x14000223d
lea r8, str.XfServer.exe
lea rdx, [0x140021dc8]
lea rcx, [rsp + 0xc8]
call fcn.1400052b0
mov rbx, rax
lea r8, str.XfServer5.exe
lea rdx, [0x140021dc8]
lea rcx, [rsp + 0xc0]
call fcn.1400052b0
mov r8d, 1
mov rdx, qword [rbx]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rdx, qword [rsp + 0xc0]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140002230
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0xc8]
jmp 0x140002331
cmp ebx, 0xdac
jl 0x1400022bc
lea r8, str.XfServer.exe
lea rdx, [0x140021dc8]
lea rcx, [rsp + 0xd8]
call fcn.1400052b0
mov rbx, rax
lea r8, str.XfServer4.exe
lea rdx, [0x140021dc8]
lea rcx, [rsp + 0xd0]
call fcn.1400052b0
mov r8d, 1
mov rdx, qword [rbx]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rdx, qword [rsp + 0xd0]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400022b2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0xd8]
jmp 0x140002331
lea r8, str.XfServer.exe
lea rdx, [0x140021dc8]
lea rcx, [rsp + 0xe8]
call fcn.1400052b0
mov rbx, rax
lea r8, str.XfServer2.exe
lea rdx, [0x140021dc8]
lea rcx, [rsp + 0xe0]
call fcn.1400052b0
mov r8d, 1
mov rdx, qword [rbx]
mov rcx, qword [rax]
call qword [sym.imp.KERNEL32.dll_CopyFileW]
mov rdx, qword [rsp + 0xe0]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140002329
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0xe8]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000234b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
jmp 0x140002350
call fcn.140004980
cmp dword [0x140021dac], 0
je 0x140002725
xor edx, edx
lea r8d, [rdx + 0x70]
lea rcx, [rsp + 0x190]
call fcn.140008d10
lea rsi, str.netsh
mov qword [rsp + 0x1a8], rsi
mov dword [rsp + 0x190], 0x70
lea r14, str.open
mov qword [rsp + 0x1a0], r14
mov dword [rsp + 0x194], 0x40
xor ebx, ebx
mov dword [rsp + 0x1c0], ebx
lea rax, str.advfirewall_firewall_delete_rule_nameXfServer
mov qword [rsp + 0x1b0], rax
lea rcx, [rsp + 0x190]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
or edx, 0xffffffff
mov rcx, qword [rsp + 0x1f8]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor edx, edx
lea r8d, [rbx + 0x70]
lea rcx, [rsp + 0x120]
call fcn.140008d10
mov qword [rsp + 0x138], rsi
mov dword [rsp + 0x120], 0x70
mov qword [rsp + 0x130], r14
mov dword [rsp + 0x124], 0x40
mov dword [rsp + 0x150], ebx
lea rax, str.advfirewall_firewall_delete_rule_nameXfServer_gx
mov qword [rsp + 0x140], rax
lea rcx, [rsp + 0x120]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
or edx, 0xffffffff
mov rcx, qword [rsp + 0x188]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
xor eax, eax
mov qword [rsp + 0x200], rax
lea r8, [0x140021dc8]
lea rdx, [0x14001b8f4]
lea rcx, [rsp + 0xf0]
call fcn.1400051d0
nop
lea r8, str.XfServer.exe
mov rdx, rax
lea rcx, [rsp + 0x200]
call fcn.1400052b0
nop
mov rdx, qword [rsp + 0xf0]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400024ad
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea r8, [0x14001b8f4]
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0xf8]
call fcn.1400052b0
nop
mov rdx, rax
lea rcx, [rsp + 0x200]
call fcn.140005830
nop
mov rdx, qword [rsp + 0xf8]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400024fc
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea r8, [rsp + 0x200]
lea rdx, str.advfirewall_firewall_add_rule_dirin_actionallow_enableyes_edgedeferapp_nameXfServer_program
lea rcx, [rsp + 0x70]
call fcn.1400051d0
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov r9, qword [rax]
mov r8, rsi
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rsp + 0x70]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000254d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea r8, [rsp + 0x200]
lea rdx, str.advfirewall_firewall_add_rule_protocolTCP_dirout_actionallow_nameXfServer_program
lea rcx, [rsp + 0xa0]
call fcn.1400051d0
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov r9, qword [rax]
mov r8, rsi
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400025a4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea r8, [rsp + 0x200]
lea rdx, str.advfirewall_firewall_add_rule_protocolUDP_dirout_actionallow_nameXfServer_program
lea rcx, [rsp + 0x88]
call fcn.1400051d0
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov r9, qword [rax]
mov r8, rsi
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400025fb
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea r8, [0x140021dc8]
lea rdx, [0x14001b8f4]
lea rcx, [rsp + 0x78]
call fcn.1400051d0
nop
lea r8, str.xfserver_gx.exe
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.1400052b0
nop
mov rdx, rax
lea rcx, [rsp + 0x200]
call fcn.140005830
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000265f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x78]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000267d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea r8, [0x14001b8f4]
lea rdx, [rsp + 0x200]
lea rcx, [rsp + 0x68]
call fcn.1400052b0
nop
mov rdx, rax
lea rcx, [rsp + 0x200]
call fcn.140005830
nop
mov rdx, qword [rsp + 0x68]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400026c6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea r8, [rsp + 0x200]
lea rdx, str.advfirewall_firewall_add_rule_dirin_actionallow_enableyes_edgedeferapp_nameXfServer_gx_program
lea rcx, [rsp + 0x60]
call fcn.1400051d0
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov r9, qword [rax]
mov r8, rsi
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140002718
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x200]
jmp 0x14000282a
lea r8, [0x140021dc8]
lea rdx, str.firewall_add_allowedprogram_name_XfServer__program_
lea rcx, [rsp + 0x50]
call fcn.1400051d0
nop
lea r8, str.XfServer.exe_
mov rdx, rax
lea rcx, [rsp + 0x58]
call fcn.1400052b0
xor ebx, ebx
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov r9, qword [rax]
lea rsi, str.netsh
mov r8, rsi
lea r14, str.open
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14000279b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400027b9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea r8, [0x140021dc8]
lea rdx, str.firewall_add_allowedprogram_name_XfServer_gx__program_
lea rcx, [rsp + 0x100]
call fcn.1400051d0
nop
lea r8, str.xfserver_gx.exe_
mov rdx, rax
lea rcx, [rsp + 0x48]
call fcn.1400052b0
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rbx
mov r9, qword [rax]
mov r8, rsi
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rsp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140002822
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
nop
mov rdx, qword [rsp + 0x100]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140002843
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
lea r8, [0x14001bd58]
lea rdx, [0x140021dc8]
lea rcx, [rsp + 0x108]
call fcn.1400052b0
mov r9, qword [rax]
lea r8, [0x14001bd70]
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersionRun
call fcn.140001d10
mov rdx, qword [rsp + 0x108]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x140002893
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + 8]
mov r9, qword [0x140021dc8]
lea r8, [0x14001a228]
lea rdx, str.SoftwareXfServer
call fcn.140001d10
xor eax, eax
mov qword [rsp + 0x258], rax
mov qword [rsp + 0x250], rbx
mov dword [rsp + 0x258], ebx
mov qword [rsp + 0x260], rbx
lea r8, str.SYSTEMCurrentControlSet_servicesTcpipParameters
lea rcx, [rsp + 0x250]
call fcn.140001680
mov rdi, qword [rsp + 0x250]
test eax, eax
jne 0x140002927
mov dword [rsp + 0x240], 0xfffe
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x240]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.MaxUserPort
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rdi, rdi
je 0x140002935
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov qword [rsp + 0x270], rax
mov qword [rsp + 0x268], rbx
mov dword [rsp + 0x270], ebx
mov qword [rsp + 0x278], rbx
lea r8, str.SYSTEMCurrentControlSet_servicesTcpipParameters
lea rcx, [rsp + 0x268]
call fcn.140001680
mov rdi, qword [rsp + 0x268]
test eax, eax
jne 0x1400029af
mov dword [rsp + 0x228], 0x3e80
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x228]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.MaxFreeTcbs
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rdi, rdi
je 0x1400029bd
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov qword [rsp + 0x288], rax
mov qword [rsp + 0x280], rbx
mov dword [rsp + 0x288], ebx
mov qword [rsp + 0x290], rbx
lea r8, str.SYSTEMCurrentControlSet_servicesTcpipParameters
lea rcx, [rsp + 0x280]
call fcn.140001680
mov rdi, qword [rsp + 0x280]
test eax, eax
jne 0x140002a37
mov dword [rsp + 0x220], 0x10000
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x220]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.MaxHashTableSize
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rdi, rdi
je 0x140002a45
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov qword [rsp + 0x2a0], rax
mov qword [rsp + 0x298], rbx
mov dword [rsp + 0x2a0], ebx
mov qword [rsp + 0x2a8], rbx
lea r8, str.SYSTEMCurrentControlSet_servicesTcpipParameters
lea rcx, [rsp + 0x298]
call fcn.140001680
mov rdi, qword [rsp + 0x298]
test eax, eax
jne 0x140002abf
mov dword [rsp + 0x218], 0x1e
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x218]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.TcpTimedWaitDelay
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rdi, rdi
je 0x140002acd
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov qword [rsp + 0x2b8], rax
mov qword [rsp + 0x2b0], rbx
mov dword [rsp + 0x2b8], ebx
mov qword [rsp + 0x2c0], rbx
lea r8, str.SYSTEMCurrentControlSet_servicesTcpipParameters
lea rcx, [rsp + 0x2b0]
call fcn.140001680
mov rdi, qword [rsp + 0x2b0]
test eax, eax
jne 0x140002b47
mov dword [rsp + 0x210], 0x7d0
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x210]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.TcpMaxHalfOpen
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rdi, rdi
je 0x140002b55
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov qword [rsp + 0x318], rax
mov qword [rsp + 0x310], rbx
mov dword [rsp + 0x318], ebx
mov qword [rsp + 0x320], rbx
lea r8, str.SYSTEMCurrentControlSet_servicesTcpipParameters
lea rcx, [rsp + 0x310]
call fcn.140001680
mov rdi, qword [rsp + 0x310]
test eax, eax
jne 0x140002bcf
mov dword [rsp + 0x208], 0x1d4c0
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x208]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.KeepAliveTime
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rdi, rdi
je 0x140002bdd
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov qword [rsp + 0x2d0], rax
mov qword [rsp + 0x2c8], rbx
mov dword [rsp + 0x2d0], ebx
mov qword [rsp + 0x2d8], rbx
lea r8, str.SYSTEMCurrentControlSet_servicesTcpipParameters
lea rcx, [rsp + 0x2c8]
call fcn.140001680
mov rdi, qword [rsp + 0x2c8]
test eax, eax
jne 0x140002c53
mov dword [rsp + 0x230], ebx
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x230]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.EnableIPAutoConfigurationLimits
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rdi, rdi
je 0x140002c61
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov qword [rsp + 0x2e8], rax
mov qword [rsp + 0x2e0], rbx
mov dword [rsp + 0x2e8], ebx
mov qword [rsp + 0x2f0], rbx
lea r8, str.SYSTEMCurrentControlSet_servicesNetBTParameters
lea rcx, [rsp + 0x2e0]
call fcn.140001680
mov rdi, qword [rsp + 0x2e0]
test eax, eax
jne 0x140002cdb
mov dword [rsp + 0x248], 0x12
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x248]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.BacklogIncrement
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rdi, rdi
je 0x140002ce9
mov rcx, rdi
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov qword [rsp + 0x300], rax
mov qword [rsp + 0x2f8], rbx
mov dword [rsp + 0x300], ebx
mov qword [rsp + 0x308], rbx
lea r8, str.SYSTEMCurrentControlSet_servicesNetBTParameters
lea rcx, [rsp + 0x2f8]
call fcn.140001680
mov rbx, qword [rsp + 0x2f8]
test eax, eax
jne 0x140002d63
mov dword [rsp + 0x238], 0xfffe
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x238]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.MaxConnBackLog
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test rbx, rbx
je 0x140002d71
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, qword [rsp + 0x360]
xor rcx, rsp
call fcn.140006200
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rdi, qword [r11 + 0x20]
mov rsp, r11
pop r14
ret