Function at 0x1400333f0
Capabilities:
Check for debugger via api
Enumerate processes
Get networking parameters
Query service status

Disassembly:
push rbp
push rbx
push rdi
sub rsp, 0xc90
lea rbp, [rsp + 0x40]
and rbp, 0xffffffffffffffe0
lea rdi, [rsp + 0x20]
mov ecx, 0x31c
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x1400a5100]
xor rax, rsp
mov qword [rbp + 0xc40], rax
mov dword [rbp + 0xb60], 0
mov dword [rbp], 0
mov eax, dword [rbp]
inc eax
mov dword [rbp], eax
cmp dword [rbp], 1
je 0x14003344b
call fcn.1400316a0
nop
mov edx, 0x18
lea rcx, [rbp + 0x18]
call fcn.14002cd70
lea rcx, [rbp + 0x18]
call fcn.140032d90
nop
movzx eax, byte [0x1400a8380]
test eax, eax
je 0x1400335bc
mov dword [rbp + 0x34], 0
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea rdx, [rbp + 0x34]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov r8d, 0x48
lea rdx, [rbp + 0x50]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_K32GetProcessMemoryInfo]
call qword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1400334b8
mov byte [rbp + 0xb64], 1
jmp 0x1400334bf
mov byte [rbp + 0xb64], 0
movzx eax, byte [rbp + 0xb64]
mov byte [rbp + 0xa4], al
cmp dword [rbp + 0x34], 0
je 0x1400334db
mov byte [rbp + 0xb65], 1
jmp 0x1400334e2
mov byte [rbp + 0xb65], 0
movzx eax, byte [rbp + 0xb65]
mov byte [rbp + 0xa5], al
cmp qword [rbp + 0x60], 0x34bf15
jbe 0x140033505
mov dword [rbp + 0xb68], 1
jmp 0x14003350f
mov dword [rbp + 0xb68], 0
movzx eax, byte [rbp + 0xb68]
mov byte [rbp + 0xa6], al
movzx eax, byte [rbp + 0xa4]
test eax, eax
jne 0x14003353d
movzx eax, byte [rbp + 0xa5]
test eax, eax
jne 0x14003353d
movzx eax, byte [rbp + 0xa6]
test eax, eax
je 0x1400335bc
lea rax, [rbp + 0xae8]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xae9]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xae8]
movzx r8d, byte [rbp + 0xae9]
movzx edx, byte [rbp + 0xaea]
lea rcx, [rbp + 0xc0]
call fcn.1400431a0
mov rcx, rax
call fcn.140035a60
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.140017fd0
nop
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x18]
call fcn.1400362e0
nop
lea rcx, [rbp + 0xe0]
call fcn.140017eb0
nop
mov eax, dword [rbp]
inc eax
mov dword [rbp], eax
cmp dword [rbp], 2
je 0x1400335d0
call fcn.1400316a0
nop
movzx eax, byte [0x1400a8381]
test eax, eax
je 0x140033acc
lea rax, [0x1400a8428]
mov qword [rbp + 0x100], rax
mov rcx, qword [rbp + 0x100]
call fcn.140037470
mov qword [rbp + 0x108], rax
mov rcx, qword [rbp + 0x100]
call fcn.140037450
mov qword [rbp + 0x110], rax
jmp 0x140033629
mov rax, qword [rbp + 0x108]
add rax, 0x88
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x110]
cmp qword [rbp + 0x108], rax
je 0x140033acc
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x118], rax
lea rax, [rbp + 0xaeb]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xaec]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xaeb]
movzx r8d, byte [rbp + 0xaec]
movzx edx, byte [rbp + 0xaed]
lea rcx, [rbp + 0x120]
call fcn.14003b2b0
mov rcx, rax
call fcn.140037280
mov rcx, qword [rbp + 0x118]
add rcx, 0x20
mov rdx, rax
call fcn.140043260
movzx eax, al
test eax, eax
jne 0x1400337b3
mov rax, qword [rbp + 0x118]
add rax, 0x20
mov rcx, rax
call fcn.140017ea0
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x1400337b3
lea rax, [rbp + 0xaee]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xaef]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xaee]
movzx r8d, byte [rbp + 0xaef]
movzx edx, byte [rbp + 0xaf0]
lea rcx, [rbp + 0x140]
call fcn.140043290
mov rcx, rax
call fcn.140035d00
mov rdx, rax
lea rcx, [rbp + 0x180]
call fcn.140017fd0
mov qword [rbp + 0xb70], rax
mov rax, qword [rbp + 0xb70]
mov qword [rbp + 0xb78], rax
mov rax, qword [rbp + 0x118]
mov r8, rax
mov rdx, qword [rbp + 0xb78]
lea rcx, [rbp + 0x1a0]
call fcn.1400190a0
mov qword [rbp + 0xb80], rax
mov rax, qword [rbp + 0xb80]
mov qword [rbp + 0xb88], rax
mov rdx, qword [rbp + 0xb88]
lea rcx, [rbp + 0x18]
call fcn.1400362e0
nop
lea rcx, [rbp + 0x1a0]
call fcn.140017eb0
nop
lea rcx, [rbp + 0x180]
call fcn.140017eb0
nop
lea rax, [rbp + 0xaf1]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xaf2]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xaf1]
movzx r8d, byte [rbp + 0xaf2]
movzx edx, byte [rbp + 0xaf3]
lea rcx, [rbp + 0x1c0]
call fcn.14003b2b0
mov rcx, rax
call fcn.140037280
mov rcx, qword [rbp + 0x118]
add rcx, 0x40
mov rdx, rax
call fcn.140043260
movzx eax, al
test eax, eax
jne 0x14003391b
mov rax, qword [rbp + 0x118]
add rax, 0x40
mov rcx, rax
call fcn.140017ea0
xor edx, edx
mov rcx, rax
call qword [sym.imp.USER32.dll_FindWindowA]
test rax, rax
je 0x14003391b
lea rax, [rbp + 0xaf4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xaf5]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xaf4]
movzx r8d, byte [rbp + 0xaf5]
movzx edx, byte [rbp + 0xaf6]
lea rcx, [rbp + 0x1e0]
call fcn.1400433a0
mov rcx, rax
call fcn.140035d00
mov rdx, rax
lea rcx, [rbp + 0x220]
call fcn.140017fd0
mov qword [rbp + 0xb90], rax
mov rax, qword [rbp + 0xb90]
mov qword [rbp + 0xb98], rax
mov rax, qword [rbp + 0x118]
mov r8, rax
mov rdx, qword [rbp + 0xb98]
lea rcx, [rbp + 0x240]
call fcn.1400190a0
mov qword [rbp + 0xba0], rax
mov rax, qword [rbp + 0xba0]
mov qword [rbp + 0xba8], rax
mov rdx, qword [rbp + 0xba8]
lea rcx, [rbp + 0x18]
call fcn.1400362e0
nop
lea rcx, [rbp + 0x240]
call fcn.140017eb0
nop
lea rcx, [rbp + 0x220]
call fcn.140017eb0
nop
mov rax, qword [rbp + 0x118]
add rax, 0x60
mov rcx, rax
call fcn.140017ea0
test rax, rax
je 0x140033ac7
xor edx, edx
mov ecx, 2
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov qword [rbp + 0x260], rax
cmp qword [rbp + 0x260], 0xffffffffffffffff
jne 0x14003395a
jmp 0x140033615
lea rax, [rbp + 0x280]
mov rdi, rax
xor eax, eax
mov ecx, 0x130
rep stosb byte [rdi], al
mov dword [rbp + 0x280], 0x130
mov byte [rbp + 0x3b4], 0
lea rdx, [rbp + 0x280]
mov rcx, qword [rbp + 0x260]
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x140033ab9
lea rdx, [rbp + 0x280]
mov rcx, qword [rbp + 0x260]
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
je 0x140033ab9
mov rax, qword [rbp + 0x118]
add rax, 0x60
mov rcx, rax
call fcn.140017ea0
lea rdx, [rbp + 0x2ac]
mov rcx, rax
call fcn.14007b310
test eax, eax
jne 0x140033ab4
lea rax, [rbp + 0xaf7]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xaf8]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xaf7]
movzx r8d, byte [rbp + 0xaf8]
movzx edx, byte [rbp + 0xaf9]
lea rcx, [rbp + 0x3c0]
call fcn.1400434b0
mov rcx, rax
call fcn.140035d00
mov rdx, rax
lea rcx, [rbp + 0x400]
call fcn.140017fd0
mov qword [rbp + 0xbb0], rax
mov rax, qword [rbp + 0xbb0]
mov qword [rbp + 0xbb8], rax
mov rax, qword [rbp + 0x118]
mov r8, rax
mov rdx, qword [rbp + 0xbb8]
lea rcx, [rbp + 0x420]
call fcn.1400190a0
mov qword [rbp + 0xbc0], rax
mov rax, qword [rbp + 0xbc0]
mov qword [rbp + 0xbc8], rax
mov rdx, qword [rbp + 0xbc8]
lea rcx, [rbp + 0x18]
call fcn.1400362e0
nop
lea rcx, [rbp + 0x420]
call fcn.140017eb0
nop
lea rcx, [rbp + 0x400]
call fcn.140017eb0
nop
jmp 0x140033ab9
jmp 0x14003399a
mov rcx, qword [rbp + 0x260]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
jmp 0x140033615
mov eax, dword [rbp]
inc eax
mov dword [rbp], eax
cmp dword [rbp], 3
je 0x140033ae0
call fcn.1400316a0
nop
movzx eax, byte [0x1400a8382]
test eax, eax
je 0x140033cd3
lea rax, [0x1400a8440]
mov qword [rbp + 0x440], rax
mov rcx, qword [rbp + 0x440]
call fcn.140037470
mov qword [rbp + 0x448], rax
mov rcx, qword [rbp + 0x440]
call fcn.140037450
mov qword [rbp + 0x450], rax
jmp 0x140033b37
mov rax, qword [rbp + 0x448]
add rax, 0x28
mov qword [rbp + 0x448], rax
mov rax, qword [rbp + 0x450]
cmp qword [rbp + 0x448], rax
je 0x140033cd3
mov rax, qword [rbp + 0x448]
mov qword [rbp + 0x458], rax
mov r8d, 4
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov qword [rbp + 0x460], rax
cmp qword [rbp + 0x460], 0
jne 0x140033b7c
jmp 0x140033b25
mov rax, qword [rbp + 0x458]
mov rcx, rax
call fcn.140017ea0
mov r8d, 4
mov rdx, rax
mov rcx, qword [rbp + 0x460]
call qword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov qword [rbp + 0x468], rax
cmp qword [rbp + 0x468], 0
jne 0x140033bb7
jmp 0x140033b25
lea rdx, [rbp + 0x478]
mov rcx, qword [rbp + 0x468]
call qword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
test eax, eax
jne 0x140033bd4
jmp 0x140033b25
mov rcx, qword [rbp + 0x468]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov rcx, qword [rbp + 0x460]
call qword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
nop
cmp dword [rbp + 0x47c], 4
jne 0x140033cce
lea rax, [rbp + 0xafa]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xafb]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xafa]
movzx r8d, byte [rbp + 0xafb]
movzx edx, byte [rbp + 0xafc]
lea rcx, [rbp + 0x4c0]
call fcn.1400435c0
mov rcx, rax
call fcn.140035a60
mov rdx, rax
lea rcx, [rbp + 0x4e0]
call fcn.140017fd0
mov qword [rbp + 0xbd0], rax
mov rax, qword [rbp + 0xbd0]
mov qword [rbp + 0xbd8], rax
mov rax, qword [rbp + 0x458]
mov r8, rax
mov rdx, qword [rbp + 0xbd8]
lea rcx, [rbp + 0x500]
call fcn.1400190a0
mov qword [rbp + 0xbe0], rax
mov rax, qword [rbp + 0xbe0]
mov qword [rbp + 0xbe8], rax
mov rdx, qword [rbp + 0xbe8]
lea rcx, [rbp + 0x18]
call fcn.1400362e0
nop
lea rcx, [rbp + 0x500]
call fcn.140017eb0
nop
lea rcx, [rbp + 0x4e0]
call fcn.140017eb0
nop
jmp 0x140033b25
mov eax, dword [rbp]
inc eax
mov dword [rbp], eax
cmp dword [rbp], 4
je 0x140033ce7
call fcn.1400316a0
nop
lea rdx, [0x140095e02]
lea rcx, [0x1400a8388]
call fcn.140043260
movzx eax, al
test eax, eax
jne 0x140033e2e
lea rcx, [rbp + 0x520]
call fcn.140021270
mov qword [rbp + 0xbf0], rax
mov rax, qword [rbp + 0xbf0]
mov qword [rbp + 0xbf8], rax
mov rax, qword [rbp + 0xbf8]
mov qword [rbp + 0xc00], rax
lea rdx, [rbp + 0x540]
mov rcx, qword [rbp + 0xc00]
call fcn.140031630
mov qword [rbp + 0xc08], rax
lea rdx, [0x1400a8388]
mov rcx, qword [rbp + 0xc08]
call fcn.14002beb0
movzx eax, al
test eax, eax
jne 0x140033d74
mov dword [rbp + 0xc10], 1
jmp 0x140033d7e
mov dword [rbp + 0xc10], 0
movzx eax, byte [rbp + 0xc10]
mov byte [rbp + 0xafd], al
lea rcx, [rbp + 0x540]
call fcn.140017eb0
nop
lea rcx, [rbp + 0x520]
call fcn.140020c40
movzx eax, byte [rbp + 0xafd]
test eax, eax
je 0x140033e2e
lea rax, [rbp + 0xafe]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xaff]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xafe]
movzx r8d, byte [rbp + 0xaff]
movzx edx, byte [rbp + 0xb00]
lea rcx, [rbp + 0x560]
call fcn.140043680
mov rcx, rax
call fcn.140035a60
mov rdx, rax
lea rcx, [rbp + 0x580]
call fcn.140017fd0
nop
lea rdx, [rbp + 0x580]
lea rcx, [rbp + 0x18]
call fcn.1400362e0
nop
lea rcx, [rbp + 0x580]
call fcn.140017eb0
nop
mov eax, dword [rbp]
inc eax
mov dword [rbp], eax
cmp dword [rbp], 5
je 0x140033e42
call fcn.1400316a0
nop
lea rdx, [0x140095e03]
lea rcx, [0x1400a83a8]
call fcn.140043260
movzx eax, al
test eax, eax
jne 0x140033ff7
mov r8d, 0x104
lea rdx, [rbp + 0x5b0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rbp + 0x5b0]
lea rcx, [rbp + 0x6d8]
call fcn.140017fd0
nop
lea rax, [rbp + 0xb02]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xb03]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xb02]
movzx r8d, byte [rbp + 0xb03]
movzx edx, byte [rbp + 0xb04]
lea rcx, [rbp + 0x710]
call fcn.140043740
mov rcx, rax
call fcn.140037280
mov r8, 0xffffffffffffffff
mov rdx, rax
lea rcx, [rbp + 0x6d8]
call fcn.1400376a0
inc rax
mov r9, 0xffffffffffffffff
mov r8, rax
lea rdx, [rbp + 0x720]
lea rcx, [rbp + 0x6d8]
call fcn.14001ca90
mov qword [rbp + 0xc18], rax
lea rdx, [0x1400a83a8]
mov rcx, qword [rbp + 0xc18]
call fcn.14002beb0
movzx eax, al
test eax, eax
jne 0x140033f3d
mov dword [rbp + 0xc20], 1
jmp 0x140033f47
mov dword [rbp + 0xc20], 0
movzx eax, byte [rbp + 0xc20]
mov byte [rbp + 0xb01], al
lea rcx, [rbp + 0x720]
call fcn.140017eb0
movzx eax, byte [rbp + 0xb01]
test eax, eax
je 0x140033fea
lea rax, [rbp + 0xb05]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xb06]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xb05]
movzx r8d, byte [rbp + 0xb06]
movzx edx, byte [rbp + 0xb07]
lea rcx, [rbp + 0x740]
call fcn.1400437b0
mov rcx, rax
call fcn.140035a60
mov rdx, rax
lea rcx, [rbp + 0x760]
call fcn.140017fd0
nop
lea rdx, [rbp + 0x760]
lea rcx, [rbp + 0x18]
call fcn.1400362e0
nop
lea rcx, [rbp + 0x760]
call fcn.140017eb0
nop
lea rcx, [rbp + 0x6d8]
call fcn.140017eb0
nop
mov eax, dword [rbp]
inc eax
mov dword [rbp], eax
cmp dword [rbp], 6
je 0x14003400b
call fcn.1400316a0
nop
movzx eax, byte [0x1400a83c8]
test eax, eax
je 0x140034421
cmp dword [0x1400a83d0], 1
jle 0x1400342fc
mov ecx, 0x258
call fcn.140062da0
mov qword [rbp + 0x780], rax
mov dword [rbp + 0x788], 0x258
lea rdx, [rbp + 0x788]
mov rcx, qword [rbp + 0x780]
call qword [sym.imp.IPHLPAPI.DLL_GetNetworkParams]
lea rdx, [rbp + 0x788]
mov rcx, qword [rbp + 0x780]
call qword [sym.imp.IPHLPAPI.DLL_GetNetworkParams]
mov byte [rbp + 0x78c], 0
mov rax, qword [rbp + 0x780]
add rax, 0x84
mov rdx, rax
lea rcx, [rbp + 0x798]
call fcn.140017fd0
nop
lea rcx, [rbp + 0x798]
call fcn.140017e90
movzx eax, al
test eax, eax
jne 0x140034258
lea rax, [rbp + 0xb08]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xb09]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xb08]
movzx r8d, byte [rbp + 0xb09]
movzx edx, byte [rbp + 0xb0a]
lea rcx, [rbp + 0x7d0]
call fcn.140043870
mov rcx, rax
call fcn.140037280
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x798]
call fcn.140037710
cmp rax, 0xffffffffffffffff
jne 0x140034251
lea rax, [rbp + 0xb0b]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xb0c]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xb0b]
movzx r8d, byte [rbp + 0xb0c]
movzx edx, byte [rbp + 0xb0d]
lea rcx, [rbp + 0x7e0]
call fcn.1400438e0
mov rcx, rax
call fcn.140037280
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x798]
call fcn.140037710
cmp rax, 0xffffffffffffffff
jne 0x140034251
lea rax, [rbp + 0xb0e]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xb0f]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xb0e]
movzx r8d, byte [rbp + 0xb0f]
movzx edx, byte [rbp + 0xb10]
lea rcx, [rbp + 0x7f0]
call fcn.140043950
mov rcx, rax
call fcn.140037280
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x798]
call fcn.140037710
cmp rax, 0xffffffffffffffff
jne 0x140034251
lea rax, [rbp + 0xb11]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xb12]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xb11]
movzx r8d, byte [rbp + 0xb12]
movzx edx, byte [rbp + 0xb13]
lea rcx, [rbp + 0x800]
call fcn.1400439c0
mov rcx, rax
call fcn.140037280
xor r8d, r8d
mov rdx, rax
lea rcx, [rbp + 0x798]
call fcn.140037710
cmp rax, 0xffffffffffffffff
je 0x140034258
mov byte [rbp + 0x78c], 1
mov rcx, qword [rbp + 0x780]
call fcn.14005aff0
nop
movzx eax, byte [rbp + 0x78c]
test eax, eax
je 0x1400342ef
lea rax, [rbp + 0xb14]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xb15]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xb14]
movzx r8d, byte [rbp + 0xb15]
movzx edx, byte [rbp + 0xb16]
lea rcx, [rbp + 0x810]
call fcn.140043a30
mov rcx, rax
call fcn.140037280
mov rdx, rax
lea rcx, [rbp + 0x820]
call fcn.140017fd0
nop
lea rdx, [rbp + 0x820]
lea rcx, [rbp + 0x18]
call fcn.1400362e0
nop
lea rcx, [rbp + 0x820]
call fcn.140017eb0
nop
lea rcx, [rbp + 0x798]
call fcn.140017eb0
nop
cmp dword [0x1400a83d0], 1
jle 0x140034421
mov dword [rbp + 0x848], 0x20
mov qword [rbp + 0x850], 0
mov dword [rbp + 0x858], 2
mov dword [rbp + 0x85c], 0
lea rax, [rbp + 0x888]
mov qword [rbp + 0x860], rax
mov eax, reloc.WS2_32.dll_recv
imul rax, rax, 0
mov dword [rbp + rax + 0x888], 1
mov eax, reloc.WS2_32.dll_recv
imul rax, rax, 1
mov dword [rbp + rax + 0x888], 2
lea r9, [rbp + 0x848]
lea r8, [rbp + 0x848]
mov edx, 0x4b
xor ecx, ecx
call qword [sym.imp.WININET.dll_InternetQueryOptionA]
test eax, eax
je 0x140034421
mov eax, reloc.WS2_32.dll_recv
imul rax, rax, 0
mov eax, dword [rbp + rax + 0x890]
and eax, 2
test eax, eax
je 0x140034421
lea rax, [rbp + 0xb17]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xb18]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xb17]
movzx r8d, byte [rbp + 0xb18]
movzx edx, byte [rbp + 0xb19]
lea rcx, [rbp + 0x8c0]
call fcn.140043a30
mov rcx, rax
call fcn.140037280
mov rdx, rax
lea rcx, [rbp + 0x8d0]
call fcn.140017fd0
nop
lea rdx, [rbp + 0x8d0]
lea rcx, [rbp + 0x18]
call fcn.1400362e0
nop
lea rcx, [rbp + 0x8d0]
call fcn.140017eb0
nop
mov eax, dword [rbp]
inc eax
mov dword [rbp], eax
cmp dword [rbp], 7
je 0x140034435
call fcn.1400316a0
nop
movzx eax, byte [0x1400a83c9]
test eax, eax
je 0x140034505
cmp dword [0x1400a83d0], 1
jle 0x140034505
mov eax, 1
xor ecx, ecx
cpuid
lea rdi, [rbp + 0x8f8]
mov dword [rdi], eax
mov dword [rdi + 4], ebx
mov dword [rdi + 8], ecx
mov dword [rdi + 0xc], edx
mov eax, 4
imul rax, rax, 2
mov eax, dword [rbp + rax + 0x8f8]
sar eax, 0x1f
and eax, 1
test eax, eax
je 0x140034505
lea rax, [rbp + 0xb1a]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xb1b]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xb1a]
movzx r8d, byte [rbp + 0xb1b]
movzx edx, byte [rbp + 0xb1c]
lea rcx, [rbp + 0x920]
call fcn.140043aa0
mov rcx, rax
call fcn.140037280
mov rdx, rax
lea rcx, [rbp + 0x930]
call fcn.140017fd0
nop
lea rdx, [rbp + 0x930]
lea rcx, [rbp + 0x18]
call fcn.1400362e0
nop
lea rcx, [rbp + 0x930]
call fcn.140017eb0
nop
mov eax, dword [rbp]
inc eax
mov dword [rbp], eax
cmp dword [rbp], 8
je 0x140034519
call fcn.1400316a0
nop
movzx eax, byte [0x1400a83ca]
test eax, eax
je 0x1400345fd
cmp dword [0x1400a83d0], 1
jle 0x1400345fd
mov eax, 0xffffffff
mov qword [rbp + 0x950], rax
lea rax, [rbp + 0xa70]
mov r8d, 8
lea rdx, [rbp + 0x950]
mov rcx, rax
call fcn.14007a750
nop
lea rax, [rbp + 0xa70]
mov r8d, 8
lea rdx, [rbp + 0x950]
mov rcx, rax
call fcn.14007add0
test eax, eax
je 0x1400345fd
lea rax, [rbp + 0xb1d]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xb1e]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xb1d]
movzx r8d, byte [rbp + 0xb1e]
movzx edx, byte [rbp + 0xb1f]
lea rcx, [rbp + 0xaa0]
call fcn.140043b10
mov rcx, rax
call fcn.140035a60
mov rdx, rax
lea rcx, [rbp + 0xac0]
call fcn.140017fd0
nop
lea rdx, [rbp + 0xac0]
lea rcx, [rbp + 0x18]
call fcn.1400362e0
nop
lea rcx, [rbp + 0xac0]
call fcn.140017eb0
nop
mov eax, dword [rbp]
inc eax
mov dword [rbp], eax
cmp dword [rbp], 9
je 0x140034611
call fcn.1400316a0
nop
lea rcx, [rbp + 0x18]
call fcn.140036170
test rax, rax
jbe 0x140034692
mov rax, qword [0x1400a83d8]
mov qword [rbp + 0xc28], rax
lea rax, [rbp + 0xb20]
mov qword [rbp + 0xb38], rax
lea rdx, [rbp + 0x18]
mov rcx, qword [rbp + 0xb38]
call fcn.140036340
mov qword [rbp + 0xc30], rax
mov rcx, qword [rbp + 0xc30]
call qword [rbp + 0xc28]
nop
lea rax, [rbp + 0xb40]
mov qword [rbp + 0xb58], rax
lea rdx, [rbp + 0x18]
mov rcx, qword [rbp + 0xb58]
call fcn.140036340
mov qword [rbp + 0xc38], rax
mov rcx, qword [rbp + 0xc38]
call fcn.140032e70
nop
mov eax, dword [rbp]
inc eax
mov dword [rbp], eax
cmp dword [rbp], 0xa
je 0x1400346a6
call fcn.1400316a0
nop
lea rcx, [rbp + 0x18]
call fcn.14002b910
nop
lea rcx, [rbp - 0x20]
lea rdx, [0x1400993c0]
call fcn.140079b68
mov rcx, qword [rbp + 0xc40]
xor rcx, rsp
call fcn.140052020
add rsp, 0xc90
pop rdi
pop rbx
pop rbp
ret