Function at 0x14000b710
Capabilities:
Capture network configuration via ipconfig
Execute command
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x1400ae0c0]
xor rax, rsp
mov qword [rbp + 0x118], rax
xor r15d, r15d
mov r13d, r15d
mov dword [rsp + 0x38], r15d
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r15
mov qword [rbp + 0xb8], r15
lea r8d, [r15 + 0x51]
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e972_e325_11ce_bfc1_08002be10318000
lea rcx, [rbp + 0xa0]
call fcn.140004490
nop
mov eax, r15d
mov dword [rsp + 0x40], eax
movzx edi, byte [rsp + 0x30]
movzx ebx, byte [rsp + 0x30]
movzx esi, byte [rsp + 0x30]
movzx r14d, byte [rsp + 0x30]
nop
lea r10, [rbp + 0x115]
mov r8d, eax
test eax, eax
jns 0x14000b7f0
neg r8d
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x14000b7b1
dec r10
mov byte [r10], reloc.WLDAP32.dll_Ordinal_45
jmp 0x14000b81a
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x14000b7f0
lea r9, [rsp + 0x30]
lea r8, [rbp + 0x115]
mov rdx, r10
lea rcx, [rbp - 0x20]
call fcn.140013110
or r13d, 0xc00
mov rcx, qword [rbp + 0xb0]
mov qword [rsp + 0x48], rcx
lea r12, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0xf
cmova r12, qword [rbp + 0xa0]
mov r8, qword [rbp - 0x10]
mov rdx, qword [rbp - 8]
mov rax, rdx
sub rax, r8
cmp rcx, rax
ja 0x14000b901
lea rax, [rcx + r8]
mov qword [rbp - 0x10], rax
lea r15, [rbp - 0x20]
cmp rdx, 0xf
cmova r15, qword [rbp - 0x20]
lea rax, [r12 + rcx]
cmp rax, r15
jbe 0x14000b8b7
lea rax, [r15 + r8]
cmp r12, rax
ja 0x14000b8b7
cmp r15, r12
ja 0x14000b8aa
mov qword [rsp + 0x38], 0
jmp 0x14000b8bc
mov rax, r15
sub rax, r12
mov qword [rsp + 0x38], rax
jmp 0x14000b8bc
mov qword [rsp + 0x38], rcx
inc r8
add rcx, r15
mov rdx, r15
call sub.VCRUNTIME140.dll_memmove
mov r8, qword [rsp + 0x38]
mov rdx, r12
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov r8, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
sub r8, rcx
lea rdx, [rcx + r12]
add rdx, qword [rsp + 0x48]
add rcx, r15
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x20]
xor r15d, r15d
jmp 0x14000b91e
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r12
xor r9d, r9d
movzx r8d, dil
mov rdx, rcx
lea rcx, [rbp - 0x20]
call fcn.140013240
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
bts r13d, 0xc
lea rdx, [rbp]
call fcn.14000b300
movzx r15d, al
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14000b998
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b993
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bf47
call fcn.140089574
test r15b, r15b
je 0x14000beeb
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xor r15d, r15d
mov qword [rsp + 0x68], r15
mov r12d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x70], r12
mov byte [rsp + 0x58], r15b
bts r13d, 0xd
mov dword [rsp + 0x38], r13d
lea edi, [r15 + 0xc]
nop
call fcn.14000b3f0
cmp r15, r12
jae 0x14000b9fe
lea rcx, [r15 + 1]
mov qword [rsp + 0x68], rcx
lea rcx, [rsp + 0x58]
cmp r12, 0xf
cmova rcx, qword [rsp + 0x58]
mov byte [rcx + r15], al
mov byte [rcx + r15 + 1], 0
jmp 0x14000ba15
movzx r9d, al
movzx r8d, bl
mov edx, 1
lea rcx, [rsp + 0x58]
call fcn.140004760
sub rdi, 1
je 0x14000ba27
mov r12, qword [rsp + 0x70]
mov r15, qword [rsp + 0x68]
jmp 0x14000b9d0
mov r8d, dword [rsp + 0x40]
test r8d, r8d
movzx edi, byte [rsp + 0x30]
lea r10, [rbp + 0x115]
jns 0x14000ba80
neg r8d
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x14000ba40
dec r10
mov byte [r10], reloc.WLDAP32.dll_Ordinal_45
jmp 0x14000baaa
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x14000ba80
lea r9, [rsp + 0x30]
lea r8, [rbp + 0x115]
mov rdx, r10
lea rcx, [rbp - 0x40]
call fcn.140013110
or r13d, 0xc000
mov dword [rsp + 0x38], r13d
mov rdx, qword [rbp + 0xb0]
mov qword [rsp + 0x50], rdx
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rdx
cmp rax, 0x1c
jb 0x14000c728
lea r9, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0xf
cmova r9, qword [rbp + 0xa0]
mov qword [rsp + 0x48], r9
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xor r8d, r8d
mov qword [rbp - 0x70], r8
mov qword [rbp - 0x68], r8
lea rax, [rdx + 0x1c]
mov qword [rsp + 0x78], rax
mov r15d, reloc.WS2_32.dll_ntohs
lea r12, [rbp - 0x80]
cmp rax, r15
jbe 0x14000bbd8
mov r15, rax
or r15, 0xf
cmp r15, rcx
jbe 0x14000bb5d
mov r15, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x14000bb84
cmp r15, 0x16
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmovb r15, rcx
lea rcx, [r15 + 1]
cmp rcx, 0x1000
jb 0x14000bbb3
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000c722
mov rcx, rax
call fcn.140089530
test rax, rax
je 0x14000bf63
lea r12, [rax + 0x27]
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
mov rax, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x50]
mov r9, qword [rsp + 0x48]
jmp 0x14000bbd4
test rcx, rcx
je 0x14000bbd1
call fcn.140089530
mov r12, rax
mov rax, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x50]
mov r9, qword [rsp + 0x48]
jmp 0x14000bbd4
mov r12, r8
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], r15
movups xmm0, xmmword [str.REG_ADD__HKEY_LOCAL_MACHINE_]
movups xmmword [r12], xmm0
movsd xmm0, qword [0x14009d250]
movsd qword [r12 + 0x10], xmm0
mov eax, dword [0x14009d258]
mov dword [r12 + 0x18], eax
lea rcx, [r12 + 0x1c]
mov r8, rdx
mov rdx, r9
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x50]
mov byte [r12 + rax + 0x1c], 0
bts r13d, 0x10
mov dword [rsp + 0x38], r13d
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x80]
movzx edx, sil
lea rcx, [rbp + 0x40]
call fcn.140012e30
bts r13d, 0x11
mov dword [rsp + 0x38], r13d
mov r8d, reloc.WLDAP32.dll_Ordinal_33
lea rdx, str.___v_NetworkAddress__t_REG_SZ__d
lea rcx, [rbp + 0x40]
call fcn.140003cd0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
xor r15d, r15d
mov qword [rax + 0x10], r15
mov byte [rax], r15b
bts r13d, 0x12
mov dword [rsp + 0x38], r13d
lea r9, [rsp + 0x58]
lea r8, [rbp - 0x60]
movzx edx, r14b
lea rcx, [rbp + 0x20]
call fcn.140012e30
bts r13d, 0x14
mov dword [rsp + 0x38], r13d
lea r8d, [r15 + 0xe]
lea rdx, str.__f__NUL_2_NUL
lea rcx, [rbp + 0x20]
call fcn.140003cd0
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], r15
mov qword [rbp + 0xd8], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xc0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xd0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r15b
bts r13d, 0x13
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x14000bd3b
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bd36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bf4e
call fcn.140089574
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x14000bd87
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bd81
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bf55
call fcn.140089574
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x14000bdc2
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bdbd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bf5c
call fcn.140089574
mov qword [rbp + 0x50], r15
mov qword [rbp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x40], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x14000be0e
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000be08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bf63
call fcn.140089574
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x14000be49
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000be44
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bf6a
call fcn.140089574
btr r13d, 0xd
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x14000be8b
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000be86
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bf71
call fcn.140089574
lea rcx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0xf
cmova rcx, qword [rbp + 0xc0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0xf
jbe 0x14000beee
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bee4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000bf78
call fcn.140089574
jmp 0x14000beee
xor r15d, r15d
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
cmp eax, 9
jle 0x14000b7a0
mov rax, qword [rbp + 0xb8]
cmp rax, 0x50
jb 0x14000bf7f
lea rbx, [rbp + 0xa0]
cmp rax, 0xf
cmova rbx, qword [rbp + 0xa0]
mov qword [rbp + 0xb0], 0x50
mov r8d, 0x50
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e972_e325_11ce_bfc1_08002be1031800
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x50], 0
jmp 0x14000bf97
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea r9, str.SYSTEMCurrentControlSetControlClass4d36e972_e325_11ce_bfc1_08002be1031800
mov edx, 0x50
lea rcx, [rbp + 0xa0]
call fcn.140004bf0
mov r12d, 0xa
mov dword [rsp + 0x40], r12d
movzx ebx, byte [rsp + 0x30]
movzx edi, byte [rsp + 0x30]
movzx esi, byte [rsp + 0x30]
lea r10, [rbp + 0x115]
mov r8d, r12d
test r12d, r12d
jns 0x14000c010
neg r8d
nop dword [rax]
nop word [rax + rax]
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x14000bfd0
dec r10
mov byte [r10], reloc.WLDAP32.dll_Ordinal_45
jmp 0x14000c03a
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x14000c010
lea r9, [rsp + 0x30]
lea r8, [rbp + 0x115]
mov rdx, r10
lea rcx, [rbp - 0x40]
call fcn.140013110
or r13d, 3
lea r8, [rbp - 0x40]
lea rdx, [rbp + 0xa0]
lea rcx, [rbp - 0x60]
call fcn.140012080
mov rdx, rax
call fcn.14000b300
movzx r14d, al
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x14000c0b1
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c0ac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c6af
call fcn.140089574
test r14b, r14b
je 0x14000c613
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov r14, r15
mov qword [rsp + 0x68], r15
mov r15d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x70], r15
mov byte [rsp + 0x58], 0
or r13d, 4
mov dword [rsp + 0x38], r13d
lea r12d, [r15 - 3]
call fcn.14000b3f0
cmp r14, r15
jae 0x14000c115
lea rcx, [r14 + 1]
mov qword [rsp + 0x68], rcx
lea rcx, [rsp + 0x58]
cmp r15, 0xf
cmova rcx, qword [rsp + 0x58]
mov byte [rcx + r14], al
mov byte [rcx + r14 + 1], 0
jmp 0x14000c12c
movzx r9d, al
movzx r8d, bl
mov edx, 1
lea rcx, [rsp + 0x58]
call fcn.140004760
sub r12, 1
je 0x14000c13e
mov r15, qword [rsp + 0x70]
mov r14, qword [rsp + 0x68]
jmp 0x14000c0e7
mov r12d, dword [rsp + 0x40]
lea r10, [rbp + 0x115]
test r12d, r12d
jns 0x14000c192
mov ecx, r12d
neg ecx
nop dword [rax]
nop dword [rax + rax]
dec r10
mov eax, 0xcccccccd
mul ecx
shr edx, 3
movzx eax, dl
shl al, 2
lea r8d, [rax + rdx]
add r8b, r8b
sub cl, r8b
add cl, 0x30
mov byte [r10], cl
mov ecx, edx
test edx, edx
jne 0x14000c160
dec r10
mov byte [r10], reloc.WLDAP32.dll_Ordinal_45
jmp 0x14000c1ca
mov r8d, r12d
nop word [rax + rax]
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x14000c1a0
lea r9, [rsp + 0x30]
lea r8, [rbp + 0x115]
mov rdx, r10
lea rcx, [rbp - 0x40]
call fcn.140013110
or r13d, 0x18
mov dword [rsp + 0x38], r13d
mov rdx, qword [rbp + 0xb0]
mov qword [rsp + 0x50], rdx
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rdx
cmp rax, 0x1c
jb 0x14000c71c
lea r9, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0xf
cmova r9, qword [rbp + 0xa0]
mov qword [rsp + 0x78], r9
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xor r8d, r8d
mov qword [rbp - 0x70], r8
mov qword [rbp - 0x68], r8
lea rax, [rdx + 0x1c]
mov qword [rsp + 0x48], rax
mov r14d, reloc.WS2_32.dll_ntohs
lea r15, [rbp - 0x80]
cmp rax, r14
jbe 0x14000c2f4
mov r14, rax
or r14, 0xf
cmp r14, rcx
jbe 0x14000c27a
mov r14, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x14000c2a1
cmp r14, 0x16
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmovb r14, rcx
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x14000c2cf
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000c72e
mov rcx, rax
call fcn.140089530
test rax, rax
je 0x14000c6cb
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov r9, qword [rsp + 0x78]
jmp 0x14000c2f0
test rcx, rcx
je 0x14000c2ed
call fcn.140089530
mov r15, rax
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov r9, qword [rsp + 0x78]
jmp 0x14000c2f0
mov r15, r8
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], r14
movups xmm0, xmmword [str.REG_ADD__HKEY_LOCAL_MACHINE_]
movups xmmword [r15], xmm0
movsd xmm0, qword [0x14009d250]
movsd qword [r15 + 0x10], xmm0
mov eax, dword [0x14009d258]
mov dword [r15 + 0x18], eax
lea rcx, [r15 + 0x1c]
mov r8, rdx
mov rdx, r9
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x50]
mov byte [r15 + rax + 0x1c], 0
bts r13d, 8
mov dword [rsp + 0x38], r13d
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x80]
movzx edx, dil
lea rcx, [rbp + 0x80]
call fcn.140012e30
or r13d, 0x20
mov dword [rsp + 0x38], r13d
mov r8d, reloc.WLDAP32.dll_Ordinal_33
lea rdx, str.___v_NetworkAddress__t_REG_SZ__d
lea rcx, [rbp + 0x80]
call fcn.140003cd0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
xor r15d, r15d
mov qword [rax + 0x10], r15
mov byte [rax], r15b
or r13d, 0x40
mov dword [rsp + 0x38], r13d
lea r9, [rsp + 0x58]
lea r8, [rbp - 0x60]
movzx edx, sil
lea rcx, [rbp + 0x60]
call fcn.140012e30
bts r13d, 7
mov dword [rsp + 0x38], r13d
lea r8d, [r15 + 0xe]
lea rdx, str.__f__NUL_2_NUL
lea rcx, [rbp + 0x60]
call fcn.140003cd0
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r15
mov qword [rbp + 0xf8], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xe0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xf0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r15b
bts r13d, 9
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x14000c457
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c452
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c6b6
call fcn.140089574
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x60], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x14000c4a3
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c49d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c6bd
call fcn.140089574
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x14000c4e4
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c4df
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c6c4
call fcn.140089574
mov qword [rbp + 0x90], r15
mov qword [rbp + 0x98], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x14000c539
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c533
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c6cb
call fcn.140089574
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x14000c574
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c56f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c6d2
call fcn.140089574
and r13d, 0xfffffffb
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x14000c5b5
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c5b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c6d9
call fcn.140089574
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0xf
cmova rcx, qword [rbp + 0xe0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x14000c613
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c60e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c6e0
call fcn.140089574
inc r12d
mov dword [rsp + 0x40], r12d
cmp r12d, 0x63
jle 0x14000bfb1
lea rcx, str.netsh_int_ip_reset__NUL_2_NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ipconfig__release__NUL_2_NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ipconfig__renew__NUL_2_NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._3__Spoofed.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140003fd0
lea rdx, [0x1400041a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x14000c6ec
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c6e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000c6e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140089574
mov rcx, qword [rbp + 0x118]
xor rcx, rsp
call fcn.140089510
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001f10
nop
call fcn.140001e70
int3
call fcn.140001f10
nop
call fcn.140001e70
int3