Function at 0x180005360
Capabilities:
Create thread
Set registry value

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
sub rsp, 0x680
mov qword [rsp + 0x410], 0xfffffffffffffffe
mov qword [rsp + 0x6c0], rbx
mov rax, qword [0x180101090]
xor rax, rsp
mov qword [rsp + 0x678], rax
mov r12, rcx
xor r13d, r13d
mov dword [rsp + 0x90], r13d
test r8d, r8d
jne 0x180005bcc
test rdx, rdx
je 0x180005bc5
cmp byte [rdx], r13b
je 0x180005bc5
lea rcx, [rsp + 0x160]
call fcn.180002380
nop
mov qword [rsp + 0x670], 0xf
mov qword [rsp + 0x668], r13
mov byte [rsp + 0x658], r13b
lea r8d, [r13 + 0xb]
lea rdx, str.BanSendFile
lea rcx, [rsp + 0x650]
call fcn.18000f0f0
nop
xor bl, bl
and dword [rsp + 0x40], 0xfffffe00
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x650]
lea rcx, [rsp + 0x160]
call fcn.180002430
movzx ecx, byte [rsp + 0x40]
test al, al
je 0x1800054a7
cmp cl, 7
jne 0x1800054a7
lea r8, [0x1800cda9a]
lea rdx, str.value_bool
lea rcx, [rsp + 0x38]
call fcn.1800671b4
mov rcx, rax
call fcn.18006789c
test al, al
jne 0x180005475
lea rcx, [rsp + 0x38]
call fcn.180066210
jmp 0x18000550f
lea r8, [0x1800cda9a]
lea rdx, str.value_bool
lea rcx, [rsp + 0x38]
call fcn.1800671b4
mov rcx, rax
call fcn.180066570
cmp eax, 1
sete bl
lea rcx, [rsp + 0x38]
call fcn.180066210
jmp 0x18000550f
movsx eax, cl
cmp eax, 4
je 0x1800054d3
add eax, 0xfffffffa
cmp eax, 1
ja 0x1800054e5
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x1800054e5
mov rcx, rdi
call fcn.18006afa0
mov rcx, rdi
call fcn.18009a864
jmp 0x1800054e5
bt dword [rsp + 0x40], 8
jae 0x1800054e5
mov rcx, qword [rsp + 0x38]
call fcn.18009a9fc
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x18000550f
lea rdi, [rcx - 8]
lea r9, [0x180065be8]
mov r8d, dword [rdi]
mov edx, 8
call fcn.18009ae90
mov rcx, rdi
call fcn.18009af58
mov eax, r13d
test bl, bl
setne al
mov dword [rsp + 0x90], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [0x1800cddb8]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
nop
cmp qword [rsp + 0x670], 0x10
jb 0x18000556d
mov rcx, qword [rsp + 0x658]
call fcn.18009a864
mov qword [rsp + 0x670], 0xf
mov qword [rsp + 0x668], r13
mov byte [rsp + 0x658], 0
mov r8d, 0xb
lea rdx, str.BanSendFile
lea rcx, [rsp + 0x650]
call fcn.18000f0f0
nop
and dword [rsp + 0x40], 0xfffffe00
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x650]
lea rcx, [rsp + 0x160]
call fcn.180002430
movzx ecx, byte [rsp + 0x40]
test al, al
je 0x180005650
cmp cl, 7
jne 0x180005650
lea r8, [0x1800cda9a]
lea rdx, str.value_bool
lea rcx, [rsp + 0x38]
call fcn.1800671b4
mov rcx, rax
call fcn.18006789c
test al, al
jne 0x180005616
lea rcx, [rsp + 0x38]
call fcn.180066210
jmp 0x1800056b8
lea r8, [0x1800cda9a]
lea rdx, str.value_bool
lea rcx, [rsp + 0x38]
call fcn.1800671b4
mov rcx, rax
call fcn.180066570
cmp eax, 1
sete dil
lea rcx, [rsp + 0x38]
call fcn.180066210
test dil, dil
je 0x1800056b8
mov al, 1
jmp 0x1800056ba
movsx eax, cl
cmp eax, 4
je 0x18000567c
add eax, 0xfffffffa
cmp eax, 1
ja 0x18000568e
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x18000568e
mov rcx, rdi
call fcn.18006afa0
mov rcx, rdi
call fcn.18009a864
jmp 0x18000568e
bt dword [rsp + 0x40], 8
jae 0x18000568e
mov rcx, qword [rsp + 0x38]
call fcn.18009a9fc
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1800056b8
lea rdi, [rcx - 8]
lea r9, [0x180065be8]
mov r8d, dword [rdi]
mov edx, 8
call fcn.18009ae90
mov rcx, rdi
call fcn.18009af58
xor al, al
test al, al
sete dil
cmp qword [rsp + 0x670], 0x10
jb 0x1800056d8
mov rcx, qword [rsp + 0x658]
call fcn.18009a864
test dil, dil
je 0x1800056f1
lea rcx, [rsp + 0x160]
call fcn.180066210
xor eax, eax
jmp 0x180007211
mov qword [rsp + 0x670], 0xf
mov qword [rsp + 0x668], r13
mov byte [rsp + 0x658], 0
mov r8d, 0xe
lea rdx, str.BanSendFileLog
lea rcx, [rsp + 0x650]
call fcn.18000f0f0
nop
xor bl, bl
and dword [rsp + 0x40], 0xfffffe00
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x650]
lea rcx, [rsp + 0x160]
call fcn.180002430
movzx ecx, byte [rsp + 0x40]
test al, al
je 0x1800057ce
cmp cl, 7
jne 0x1800057ce
lea r8, [0x1800cda9a]
lea rdx, str.value_bool
lea rcx, [rsp + 0x38]
call fcn.1800671b4
mov rcx, rax
call fcn.18006789c
test al, al
jne 0x18000579c
lea rcx, [rsp + 0x38]
call fcn.180066210
jmp 0x180005836
lea r8, [0x1800cda9a]
lea rdx, str.value_bool
lea rcx, [rsp + 0x38]
call fcn.1800671b4
mov rcx, rax
call fcn.180066570
cmp eax, 1
sete bl
lea rcx, [rsp + 0x38]
call fcn.180066210
jmp 0x180005836
movsx eax, cl
cmp eax, 4
je 0x1800057fa
add eax, 0xfffffffa
cmp eax, 1
ja 0x18000580c
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x18000580c
mov rcx, rdi
call fcn.18006afa0
mov rcx, rdi
call fcn.18009a864
jmp 0x18000580c
bt dword [rsp + 0x40], 8
jae 0x18000580c
mov rcx, qword [rsp + 0x38]
call fcn.18009a9fc
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x180005836
lea rdi, [rcx - 8]
lea r9, [0x180065be8]
mov r8d, dword [rdi]
mov edx, 8
call fcn.18009ae90
mov rcx, rdi
call fcn.18009af58
mov eax, r13d
test bl, bl
setne al
mov dword [rsp + 0x90], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [0x1800cdde0]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
nop
cmp qword [rsp + 0x670], 0x10
jb 0x180005894
mov rcx, qword [rsp + 0x658]
call fcn.18009a864
mov qword [rsp + 0x670], 0xf
mov qword [rsp + 0x668], r13
mov byte [rsp + 0x658], 0
mov r8d, reloc.WS2_32.dll_sendto
lea rdx, str.AllowSendFileRequest
lea rcx, [rsp + 0x650]
call fcn.18000f0f0
nop
xor bl, bl
and dword [rsp + 0x40], 0xfffffe00
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], r13
lea r8, [rsp + 0x38]
lea rdx, [rsp + 0x650]
lea rcx, [rsp + 0x160]
call fcn.180002430
movzx ecx, byte [rsp + 0x40]
test al, al
je 0x180005971
cmp cl, 7
jne 0x180005971
lea r8, [0x1800cda9a]
lea rdx, str.value_bool
lea rcx, [rsp + 0x38]
call fcn.1800671b4
mov rcx, rax
call fcn.18006789c
test al, al
jne 0x18000593f
lea rcx, [rsp + 0x38]
call fcn.180066210
jmp 0x1800059d9
lea r8, [0x1800cda9a]
lea rdx, str.value_bool
lea rcx, [rsp + 0x38]
call fcn.1800671b4
mov rcx, rax
call fcn.180066570
cmp eax, 1
sete bl
lea rcx, [rsp + 0x38]
call fcn.180066210
jmp 0x1800059d9
movsx eax, cl
cmp eax, 4
je 0x18000599d
add eax, 0xfffffffa
cmp eax, 1
ja 0x1800059af
mov rdi, qword [rsp + 0x38]
test rdi, rdi
je 0x1800059af
mov rcx, rdi
call fcn.18006afa0
mov rcx, rdi
call fcn.18009a864
jmp 0x1800059af
bt dword [rsp + 0x40], 8
jae 0x1800059af
mov rcx, qword [rsp + 0x38]
call fcn.18009a9fc
mov rcx, qword [rsp + 0x48]
test rcx, rcx
je 0x1800059d9
lea rdi, [rcx - 8]
lea r9, [0x180065be8]
mov r8d, dword [rdi]
mov edx, 8
call fcn.18009ae90
mov rcx, rdi
call fcn.18009af58
mov eax, r13d
test bl, bl
setne al
mov dword [rsp + 0x90], eax
mov dword [rsp + 0x28], 4
lea rax, [rsp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 4
lea r8, [0x1800cde10]
lea rdx, str.SoftwareWOW6432Nodeprojonepodlp_smprule_
mov rcx, 0xffffffff80000002
call qword [sym.imp.SHLWAPI.dll_SHSetValueW]
nop
cmp qword [rsp + 0x670], 0x10
jb 0x180005a37
mov rcx, qword [rsp + 0x658]
call fcn.18009a864
mov qword [rsp + 0x670], 0xf
mov qword [rsp + 0x668], r13
mov byte [rsp + 0x658], 0
mov r8d, socket
lea rdx, str.AllowSendEncryptedFile
lea rcx, [rsp + 0x650]
call fcn.18000f0f0
nop
lea r8, [0x1800cde58]
lea rdx, [rsp + 0x650]
lea rcx, [rsp + 0x160]
call fcn.180003e70
nop
cmp qword [rsp + 0x670], 0x10
jb 0x180005aa3
mov rcx, qword [rsp + 0x658]
call fcn.18009a864
mov qword [rsp + 0x670], 0xf
mov qword [rsp + 0x668], r13
mov byte [rsp + 0x658], 0
mov r8d, socket
lea rdx, str.AllowSendDocwmFile
lea rcx, [rsp + 0x650]
call fcn.18000f0f0
nop
lea r8, [0x1800cdea0]
lea rdx, [rsp + 0x650]
lea rcx, [rsp + 0x160]
call fcn.180003e70
nop
cmp qword [rsp + 0x670], 0x10
jb 0x180005b0f
mov rcx, qword [rsp + 0x658]
call fcn.18009a864
mov qword [rsp + 0x670], 0xf
mov qword [rsp + 0x668], r13
mov byte [rsp + 0x658], 0
mov r8d, sendto
lea rdx, str.BanSendSensFile
lea rcx, [rsp + 0x650]
call fcn.18000f0f0
nop
lea r8, [0x1800cdee0]
lea rdx, [rsp + 0x650]
lea rcx, [rsp + 0x160]
call fcn.180003e70
nop
cmp qword [rsp + 0x670], 0x10
jb 0x180005b7b
mov rcx, qword [rsp + 0x658]
call fcn.18009a864
cmp dword [0x1801053c4], 0
je 0x180005bb3
mov dword [0x1801053c4], r13d
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
xor r9d, r9d
lea r8, [0x18000b7b0]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
lea rcx, [rsp + 0x160]
call fcn.180066210
jmp 0x18000720c
xor eax, eax
jmp 0x180007211
mov qword [rsp + 0x358], 7
mov qword [rsp + 0x350], r13
mov word [rsp + 0x340], r13w
xor eax, eax
or rcx, 0xffffffffffffffff
lea rdi, [0x180108f60]
repne scasw ax, word [rdi]
not rcx
lea r8, [rcx - 1]
lea rdx, [0x180108f60]
lea rcx, [rsp + 0x338]
call fcn.18000f510
nop
lea rdx, [rsp + 0x338]
lea rcx, [rsp + 0x650]
call fcn.180012880
nop
cmp qword [rsp + 0x358], 8
jb 0x180005c43
mov rcx, qword [rsp + 0x340]
call fcn.18009a864
mov qword [rsp + 0x358], 7
mov qword [rsp + 0x350], r13
mov word [rsp + 0x340], r13w
mov qword [rsp + 0x308], socket
mov qword [rsp + 0x300], r13
mov byte [rsp + 0x2f0], 0
mov r8d, 7
lea rdx, str.docSafe
lea rcx, [rsp + 0x2e8]
call fcn.18000f0f0
nop
mov r8b, 1
lea rdx, [rsp + 0x2e8]
lea rcx, [rsp + 0x160]
call fcn.180002060
nop
cmp qword [rsp + 0x308], 0x10
jb 0x180005cc8
mov rcx, qword [rsp + 0x2f0]
call fcn.18009a864
mov qword [rsp + 0x308], socket
mov qword [rsp + 0x300], r13
mov byte [rsp + 0x2f0], 0
cmp byte [rsp + 0x168], 7
je 0x180005d1b
lea rcx, [rsp + 0x160]
call fcn.180066210
nop
cmp qword [rsp + 0x670], 8
jb 0x180005d14
mov rcx, qword [rsp + 0x658]
call fcn.18009a864
xor eax, eax
jmp 0x180007211
mov qword [rsp + 0x1a8], socket
mov qword [rsp + 0x1a0], r13
mov byte [rsp + 0x190], 0
mov r8d, 0xb
lea rdx, str.BanSendFile
lea rcx, [rsp + 0x188]
call fcn.18000f0f0
nop
mov byte [rsp + 0x30], 0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x160]
call fcn.180002810
test al, al
je 0x180005d83
cmp byte [rsp + 0x30], 0
je 0x180005d83
mov eax, 1
jmp 0x180005d86
mov eax, r13d
test al, al
sete dil
cmp qword [rsp + 0x1a8], 0x10
jb 0x180005da4
mov rcx, qword [rsp + 0x190]
call fcn.18009a864
test dil, dil
je 0x180005dd9
lea rcx, [rsp + 0x160]
call fcn.180066210
nop
cmp qword [rsp + 0x670], 8
jb 0x180005dcf
mov rcx, qword [rsp + 0x658]
call fcn.18009a864
mov eax, 1
jmp 0x180007211
and dword [rsp + 0x190], 0xfffffe00
mov qword [rsp + 0x198], r13
mov qword [rsp + 0x1a0], r13
mov qword [rsp + 0x1a8], r13
mov qword [rsp + 0xe8], socket
mov qword [rsp + 0xe0], r13
mov byte [rsp + 0xd0], 0
mov r8d, sendto
lea rdx, str.BanSendFileRules
lea rcx, [rsp + 0xc8]
call fcn.18000f0f0
nop
lea r8, [rsp + 0x188]
lea rdx, [rsp + 0xc8]
lea rcx, [rsp + 0x160]
call fcn.180002b70
movzx edi, al
cmp qword [rsp + 0xe8], 0x10
jb 0x180005e6b
mov rcx, qword [rsp + 0xd0]
call fcn.18009a864
test dil, dil
je 0x180006b5a
lea rax, [rsp + 0x68]
mov qword [rsp + 0x90], rax
lea rax, [rsp + 0x380]
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x238], socket
mov qword [rsp + 0x230], r13
mov byte [rsp + 0x220], 0
xor r8d, r8d
lea rdx, [0x1800cda5f]
lea rcx, [rsp + 0x218]
call fcn.18000f0f0
nop
mov qword [rsp + 0x58], socket
mov qword [rsp + 0x50], r13
mov byte [rsp + 0x40], 0
mov r8d, 8
lea rdx, str.chatApps
lea rcx, [rsp + 0x38]
call fcn.18000f0f0
nop
lea rdx, [fcn.180012880]
lea rcx, [rsp + 0x68]
call fcn.180012d40
mov rdi, rax
lea rbx, [0x1800ced80]
mov qword [rsp + 0x380], rbx
lea rsi, [fcn.180001500]
mov qword [rsp + 0x388], rsi
lea rax, [rsp + 0x380]
mov qword [rsp + 0x398], rax
lea rdx, [rsp + 0x38]
lea rcx, [rsp + 0xa0]
call fcn.180002fa0
nop
lea r8, [rsp + 0x218]
mov rdx, rax
lea rcx, [rsp + 0x490]
call fcn.180001aa0
nop
mov rdx, rax
lea rcx, [rsp + 0x240]
call fcn.1800125e0
nop
lea r8, [rsp + 0x380]
mov rdx, rax
lea rcx, [rsp + 0x120]
call fcn.180012bb0
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x590]
call fcn.180012bb0
nop
lea rcx, [rsp + 0x120]
call fcn.18000eae0
nop
mov rcx, qword [rsp + 0x120]
call fcn.18009a864
nop
lea rcx, [rsp + 0x240]
call fcn.18000e590
nop
mov rcx, qword [rsp + 0x240]
call fcn.18009a864
nop
lea rcx, [rsp + 0x490]
call fcn.18000dfb0
mov rcx, qword [rsp + 0x490]
call fcn.18009a864
nop
lea rcx, [rsp + 0xa0]
call fcn.180066210
nop
cmp qword [rsp + 0x58], 0x10
jb 0x18000600c
mov rcx, qword [rsp + 0x40]
call fcn.18009a864
mov qword [rsp + 0x58], socket
mov qword [rsp + 0x50], r13
mov byte [rsp + 0x40], 0
cmp qword [rsp + 0x238], 0x10
jb 0x180006037
mov rcx, qword [rsp + 0x220]
call fcn.18009a864
mov qword [rsp + 0x238], socket
mov qword [rsp + 0x230], r13
mov byte [rsp + 0x220], 0
lea rax, [rsp + 0x568]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x360]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0x110], socket
mov qword [rsp + 0x108], r13
mov byte [rsp + 0xf8], 0
xor r8d, r8d
lea rdx, [0x1800cda5f]
lea rcx, [rsp + 0xf0]
call fcn.18000f0f0
nop
mov qword [rsp + 0x1d0], socket
mov qword [rsp + 0x1c8], r13
mov byte [rsp + 0x1b8], 0
mov r8d, 8
lea rdx, str.browsers
lea rcx, [rsp + 0x1b0]
call fcn.18000f0f0
nop
lea rdx, [fcn.180012880]
lea rcx, [rsp + 0x568]
call fcn.180012d40
mov rdi, rax
mov qword [rsp + 0x360], rbx
mov qword [rsp + 0x368], rsi
lea rax, [rsp + 0x360]
mov qword [rsp + 0x378], rax
lea rdx, [rsp + 0x1b0]
lea rcx, [rsp + 0x4c0]
call fcn.180002fa0
nop
lea r8, [rsp + 0xf0]
mov rdx, rax
lea rcx, [rsp + 0x418]
call fcn.180001aa0
nop
mov rdx, rax
lea rcx, [rsp + 0x528]
call fcn.1800125e0
nop
lea r8, [rsp + 0x360]
mov rdx, rax
lea rcx, [rsp + 0x4e8]
call fcn.180012bb0
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x610]
call fcn.180012bb0
nop
lea rcx, [rsp + 0x4e8]
call fcn.18000eae0
nop
mov rcx, qword [rsp + 0x4e8]
call fcn.18009a864
nop
lea rcx, [rsp + 0x528]
call fcn.18000e590
nop
mov rcx, qword [rsp + 0x528]
call fcn.18009a864
nop
lea rcx, [rsp + 0x418]
call fcn.18000dfb0
mov rcx, qword [rsp + 0x418]
call fcn.18009a864
nop
lea rcx, [rsp + 0x4c0]
call fcn.180066210
nop
cmp qword [rsp + 0x1d0], 0x10
jb 0x1800061f8
mov rcx, qword [rsp + 0x1b8]
call fcn.18009a864
mov qword [rsp + 0x1d0], socket
mov qword [rsp + 0x1c8], r13
mov byte [rsp + 0x1b8], 0
cmp qword [rsp + 0x110], 0x10
jb 0x18000622c
mov rcx, qword [rsp + 0xf8]
call fcn.18009a864
mov qword [rsp + 0x110], socket
mov qword [rsp + 0x108], r13
mov byte [rsp + 0xf8], 0
lea rax, [rsp + 0x218]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x68]
mov qword [rsp + 0x90], rax
mov qword [rsp + 0xe8], socket
mov qword [rsp + 0xe0], r13
mov byte [rsp + 0xd0], 0
xor r8d, r8d
lea rdx, [0x1800cda5f]
lea rcx, [rsp + 0xc8]
call fcn.18000f0f0
nop
mov qword [rsp + 0x2e0], socket
mov qword [rsp + 0x2d8], r13
mov byte [rsp + 0x2c8], 0
mov r8d, 0xb
lea rdx, str.mailClients
lea rcx, [rsp + 0x2c0]
call fcn.18000f0f0
nop
lea rdx, [fcn.180012880]
lea rcx, [rsp + 0x218]
call fcn.180012d40
mov rdi, rax
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x80], rax
lea rdx, [rsp + 0x2c0]
lea rcx, [rsp + 0x310]
call fcn.180002fa0
nop
lea r8, [rsp + 0xc8]
mov rdx, rax
lea rcx, [rsp + 0x240]
call fcn.180001aa0
nop
mov rdx, rax
lea rcx, [rsp + 0x1d8]
call fcn.1800125e0
nop
lea r8, [rsp + 0x68]
mov rdx, rax
lea rcx, [rsp + 0x280]
call fcn.180012bb0
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x5d0]
call fcn.180012bb0
nop
lea rcx, [rsp + 0x280]
call fcn.18000eae0
nop
mov rcx, qword [rsp + 0x280]
call fcn.18009a864
nop
lea rcx, [rsp + 0x1d8]
call fcn.18000e590
nop
mov rcx, qword [rsp + 0x1d8]
call fcn.18009a864
nop
lea rcx, [rsp + 0x240]
call fcn.18000dfb0
mov rcx, qword [rsp + 0x240]
call fcn.18009a864
nop
lea rcx, [rsp + 0x310]
call fcn.180066210
nop
cmp qword [rsp + 0x2e0], 0x10
jb 0x1800063de
mov rcx, qword [rsp + 0x2c8]
call fcn.18009a864
mov qword [rsp + 0x2e0], socket
mov qword [rsp + 0x2d8], r13
mov byte [rsp + 0x2c8], 0
cmp qword [rsp + 0xe8], 0x10
jb 0x180006412
mov rcx, qword [rsp + 0xd0]
call fcn.18009a864
mov qword [rsp + 0xe8], socket
mov qword [rsp + 0xe0], r13
mov byte [rsp + 0xd0], 0
mov ebx, r13d
lea rcx, [rsp + 0x188]
call fcn.180066d5c
test eax, eax
je 0x180006b02
nop word [rax + rax]
mov edx, ebx
lea rcx, [rsp + 0x188]
call fcn.180066df0
mov rsi, rax
mov qword [rsp + 0x110], socket
mov qword [rsp + 0x108], r13
mov byte [rsp + 0xf8], 0
mov r8d, 4
lea rdx, str.type
lea rcx, [rsp + 0xf0]
call fcn.18000f0f0
nop
mov r8d, 0x63
lea rdx, [rsp + 0xf0]
mov rcx, rsi
call fcn.180001870
mov edi, eax
cmp qword [rsp + 0x110], 0x10
jb 0x1800064c9
mov rcx, qword [rsp + 0xf8]
call fcn.18009a864
mov qword [rsp + 0x110], socket
mov qword [rsp + 0x108], r13
mov byte [rsp + 0xf8], 0
mov r8d, 4
lea rdx, str.rule
lea rcx, [rsp + 0xf0]
call fcn.18000f0f0
nop
xor r8d, r8d
lea rdx, [rsp + 0xf0]
mov rcx, rsi
call fcn.180001870
mov ebp, eax
cmp qword [rsp + 0x110], 0x10
jb 0x18000652d
mov rcx, qword [rsp + 0xf8]
call fcn.18009a864
mov qword [rsp + 0x110], socket
mov qword [rsp + 0x108], r13
mov byte [rsp + 0xf8], 0
lea rcx, [rsp + 0x120]
call fcn.18000ce30
nop
cmp edi, 0x63
jne 0x18000657c
lea rcx, [rsp + 0x120]
call fcn.18000eae0
nop
mov rcx, qword [rsp + 0x120]
call fcn.18009a864
jmp 0x180006920
test edi, edi
jne 0x180006618
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x98], rax
mov rcx, qword [rsp + 0x120]
mov qword [rsp + 0x90], rcx
mov rax, qword [rax]
mov qword [rsp + 0x3e8], rax
mov qword [rsp + 0x3e0], rcx
movaps xmm0, xmmword [rsp + 0x90]
movdqa xmmword [rsp + 0x480], xmm0
movaps xmm1, xmmword [rsp + 0x3e0]
movdqa xmmword [rsp + 0x470], xmm1
lea r9, [rsp + 0x480]
lea r8, [rsp + 0x470]
lea rdx, [rsp + 0x568]
lea rcx, [rsp + 0x120]
call fcn.18000e860
lea rdx, [rsp + 0x590]
lea rcx, [rsp + 0x120]
call fcn.18000ea30
jmp 0x1800068ce
cmp edi, 1
jne 0x1800066b5
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x3d8], rax
mov rcx, qword [rsp + 0x120]
mov qword [rsp + 0x3d0], rcx
mov rax, qword [rax]
mov qword [rsp + 0x3b8], rax
mov qword [rsp + 0x3b0], rcx
movaps xmm0, xmmword [rsp + 0x3d0]
movdqa xmmword [rsp + 0x400], xmm0
movaps xmm1, xmmword [rsp + 0x3b0]
movdqa xmmword [rsp + 0x450], xmm1
lea r9, [rsp + 0x400]
lea r8, [rsp + 0x450]
lea rdx, [rsp + 0x360]
lea rcx, [rsp + 0x120]
call fcn.18000e860
lea rdx, [rsp + 0x610]
lea rcx, [rsp + 0x120]
call fcn.18000ea30
jmp 0x1800068ce
cmp edi, 2
jne 0x180006752
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x3c8], rax
mov rcx, qword [rsp + 0x120]
mov qword [rsp + 0x3c0], rcx
mov rax, qword [rax]
mov qword [rsp + 0x3a8], rax
mov qword [rsp + 0x3a0], rcx
movaps xmm0, xmmword [rsp + 0x3c0]
movdqa xmmword [rsp + 0x3f0], xmm0
movaps xmm1, xmmword [rsp + 0x3a0]
movdqa xmmword [rsp + 0x460], xmm1
lea r9, [rsp + 0x3f0]
lea r8, [rsp + 0x460]
lea rdx, [rsp + 0x380]
lea rcx, [rsp + 0x120]
call fcn.18000e860
lea rdx, [rsp + 0x5d0]
lea rcx, [rsp + 0x120]
call fcn.18000ea30
jmp 0x1800068ce
cmp edi, 3
jne 0x180006905
lea rax, [rsp + 0x38]
mov qword [rsp + 0x60], rax
lea rdx, str.name
lea rcx, [rsp + 0xa0]
call fcn.18000cae0
nop
lea rdx, [fcn.180012880]
lea rcx, [rsp + 0x38]
call fcn.180012d40
mov rdi, rax
lea rdx, [0x1800cda5f]
lea rcx, [rsp + 0x490]
call fcn.18000cae0
mov r9, rax
lea r8, [rsp + 0xa0]
mov rdx, rsi
lea rcx, [rsp + 0x4c0]
call fcn.180001940
nop
mov rdx, rax
lea rcx, [rsp + 0x1b0]
call fcn.180001500
nop
cmp qword [rax + 0x20], 8
jb 0x1800067dc
mov rdx, qword [rax + 8]
jmp 0x1800067e0
lea rdx, [rax + 8]
lea r8, [0x1800cdf68]
lea rcx, [rsp + 0x418]
call fcn.180053294
nop
mov rdx, rax
lea rcx, [rsp + 0x4e8]
call fcn.1800124e0
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x528]
call fcn.180012bb0
nop
mov rdx, rax
lea rcx, [rsp + 0x120]
call fcn.18000d300
nop
lea rcx, [rsp + 0x528]
call fcn.18000eae0
nop
mov rcx, qword [rsp + 0x528]
call fcn.18009a864
nop
lea rcx, [rsp + 0x4e8]
call fcn.18000eae0
nop
mov rcx, qword [rsp + 0x4e8]
call fcn.18009a864
nop
lea rcx, [rsp + 0x418]
call fcn.18000e7d0
mov rcx, qword [rsp + 0x418]
call fcn.18009a864
nop
cmp qword [rsp + 0x1d0], 8
jb 0x180006896
mov rcx, qword [rsp + 0x1b8]
call fcn.18009a864
mov qword [rsp + 0x1d0], 7
mov qword [rsp + 0x1c8], r13
mov word [rsp + 0x1b8], r13w
lea rcx, [rsp + 0x4c0]
call fcn.18000cb70
nop
lea rcx, [rsp + 0xa0]
call fcn.18000cb70
lea rdx, [rsp + 0x650]
lea rcx, [rsp + 0x120]
call fcn.18000d380
test rax, rax
jne 0x18000693c
lea rcx, [rsp + 0x120]
call fcn.18000eae0
nop
mov rcx, qword [rsp + 0x120]
call fcn.18009a864
jmp 0x180006920
lea rcx, [rsp + 0x120]
call fcn.18000eae0
nop
mov rcx, qword [rsp + 0x120]
call fcn.18009a864
inc ebx
lea rcx, [rsp + 0x188]
call fcn.180066d5c
cmp ebx, eax
jae 0x180006b02
jmp 0x180006450
mov dword [r12 + 8], ebp
cmp ebp, 2
je 0x18000694f
cmp ebp, 3
jne 0x180006abf
lea rax, [rsp + 0x38]
mov qword [rsp + 0x60], rax
lea rdx, [0x1800cdf84]
lea rcx, [rsp + 0xa0]
call fcn.18000cae0
nop
lea rdx, [fcn.180012880]
lea rcx, [rsp + 0x38]
call fcn.180012d40
mov rdi, rax
lea rdx, [0x1800cda5f]
lea rcx, [rsp + 0x490]
call fcn.18000cae0
mov r9, rax
lea r8, [rsp + 0xa0]
mov rdx, rsi
lea rcx, [rsp + 0x310]
call fcn.180001940
nop
mov rdx, rax
lea rcx, [rsp + 0xc8]
call fcn.180001500
nop
cmp qword [rax + 0x20], 8
jb 0x1800069d0
mov rdx, qword [rax + 8]
jmp 0x1800069d4
lea rdx, [rax + 8]
lea r8, [0x1800cdf78]
lea rcx, [rsp + 0x240]
call fcn.180053294
nop
mov rdx, rax
lea rcx, [rsp + 0x280]
call fcn.1800124e0
nop
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x1d8]
call fcn.180012bb0
nop
lea rcx, [r12 + 0x10]
mov rdx, rax
call fcn.18000d300
nop
lea rcx, [rsp + 0x1d8]
call fcn.18000eae0
nop
mov rcx, qword [rsp + 0x1d8]
call fcn.18009a864
nop
lea rcx, [rsp + 0x280]
call fcn.18000eae0
nop
mov rcx, qword [rsp + 0x280]
call fcn.18009a864
nop
lea rcx, [rsp + 0x240]
call fcn.18000e7d0
mov rcx, qword [rsp + 0x240]
call fcn.18009a864
nop
cmp qword [rsp + 0xe8], 8
jb 0x180006a87
mov rcx, qword [rsp + 0xd0]
call fcn.18009a864
mov qword [rsp + 0xe8], 7
mov qword [rsp + 0xe0], r13
mov word [rsp + 0xd0], r13w
lea rcx, [rsp + 0x310]
call fcn.18000cb70
nop
lea rcx, [rsp + 0xa0]
call fcn.18000cb70
mov rax, qword [r12 + 0x48]
mov dword [rsp + 0x20], eax
mov r9d, ebp
lea r8, [0x180108f60]
lea rdx, str.ban_send_file_rule_hit:__s__d___d_exts
lea rcx, str.banSendFileDbg
call fcn.18005c640
nop
lea rcx, [rsp + 0x120]
call fcn.18000eae0
nop
mov rcx, qword [rsp + 0x120]
call fcn.18009a864
nop
lea rcx, [rsp + 0x5d0]
call fcn.18000eae0
nop
mov rcx, qword [rsp + 0x5d0]
call fcn.18009a864
nop
lea rcx, [rsp + 0x610]
call fcn.18000eae0
nop
mov rcx, qword [rsp + 0x610]
call fcn.18009a864
nop
lea rcx, [rsp + 0x590]
call fcn.18000eae0
nop
mov rcx, qword [rsp + 0x590]
call fcn.18009a864
jmp 0x1800071d8
lea rcx, [rsp + 0x120]
call fcn.18000ce30
nop
lea rdx, str.BanSendFileIM
lea rcx, [rsp + 0xa0]
call fcn.18000cae0
nop
mov byte [rsp + 0x30], 0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x160]
call fcn.180002810
test al, al
je 0x180006bac
cmp byte [rsp + 0x30], 0
je 0x180006bac
mov dil, 1
jmp 0x180006baf
xor dil, dil
lea rcx, [rsp + 0xa0]
call fcn.18000cb70
lea rbx, [0x1800ced80]
lea rsi, [fcn.180001500]
test dil, dil
je 0x180006d01
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
lea rdx, [0x1800cda5f]
lea rcx, [rsp + 0xc8]
call fcn.18000cae0
nop
lea rdx, str.chatApps
lea rcx, [rsp + 0xa0]
call fcn.18000cae0
nop
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x80], rax
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x310]
call fcn.180002fa0
nop
lea r8, [rsp + 0xc8]
mov rdx, rax
lea rcx, [rsp + 0x240]
call fcn.180001aa0
nop
mov rdx, rax
lea rcx, [rsp + 0x280]
call fcn.1800125e0
nop
lea r8, [rsp + 0x68]
mov rdx, rax
lea rcx, [rsp + 0x1d8]
call fcn.180012bb0
nop
mov rdx, rax
lea rcx, [rsp + 0x120]
call fcn.180012d70
nop
lea rcx, [rsp + 0x1d8]
call fcn.18000eae0
nop
mov rcx, qword [rsp + 0x1d8]
call fcn.18009a864
nop
lea rcx, [rsp + 0x280]
call fcn.18000e590
nop
mov rcx, qword [rsp + 0x280]
call fcn.18009a864
nop
lea rcx, [rsp + 0x240]
call fcn.18000dfb0
mov rcx, qword [rsp + 0x240]
call fcn.18009a864
nop
lea rcx, [rsp + 0x310]
call fcn.180066210
nop
lea rcx, [rsp + 0xa0]
call fcn.18000cb70
nop
lea rcx, [rsp + 0xc8]
call fcn.18000cb70
lea rdx, str.BanSendFileBrowser
lea rcx, [rsp + 0xa0]
call fcn.18000cae0
nop
mov byte [rsp + 0x30], 0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x160]
call fcn.180002810
test al, al
je 0x180006d45
cmp byte [rsp + 0x30], 0
je 0x180006d45
mov dil, 1
jmp 0x180006d48
xor dil, dil
lea rcx, [rsp + 0xa0]
call fcn.18000cb70
test dil, dil
je 0x180006e8c
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
lea rdx, [0x1800cda5f]
lea rcx, [rsp + 0xc8]
call fcn.18000cae0
nop
lea rdx, str.browsers
lea rcx, [rsp + 0xa0]
call fcn.18000cae0
nop
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x80], rax
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x310]
call fcn.180002fa0
nop
lea r8, [rsp + 0xc8]
mov rdx, rax
lea rcx, [rsp + 0x240]
call fcn.180001aa0
nop
mov rdx, rax
lea rcx, [rsp + 0x280]
call fcn.1800125e0
nop
lea r8, [rsp + 0x68]
mov rdx, rax
lea rcx, [rsp + 0x1d8]
call fcn.180012bb0
nop
mov rdx, rax
lea rcx, [rsp + 0x120]
call fcn.180012d70
nop
lea rcx, [rsp + 0x1d8]
call fcn.18000eae0
nop
mov rcx, qword [rsp + 0x1d8]
call fcn.18009a864
nop
lea rcx, [rsp + 0x280]
call fcn.18000e590
nop
mov rcx, qword [rsp + 0x280]
call fcn.18009a864
nop
lea rcx, [rsp + 0x240]
call fcn.18000dfb0
mov rcx, qword [rsp + 0x240]
call fcn.18009a864
nop
lea rcx, [rsp + 0x310]
call fcn.180066210
nop
lea rcx, [rsp + 0xa0]
call fcn.18000cb70
nop
lea rcx, [rsp + 0xc8]
call fcn.18000cb70
lea rdx, str.BanSendFileMailClient
lea rcx, [rsp + 0xa0]
call fcn.18000cae0
nop
mov byte [rsp + 0x30], 0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x160]
call fcn.180002810
test al, al
je 0x180006ed0
cmp byte [rsp + 0x30], 0
je 0x180006ed0
mov dil, 1
jmp 0x180006ed3
xor dil, dil
lea rcx, [rsp + 0xa0]
call fcn.18000cb70
test dil, dil
je 0x180007017
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
lea rdx, [0x1800cda5f]
lea rcx, [rsp + 0xc8]
call fcn.18000cae0
nop
lea rdx, str.mailClients
lea rcx, [rsp + 0xa0]
call fcn.18000cae0
nop
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x80], rax
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x310]
call fcn.180002fa0
nop
lea r8, [rsp + 0xc8]
mov rdx, rax
lea rcx, [rsp + 0x240]
call fcn.180001aa0
nop
mov rdx, rax
lea rcx, [rsp + 0x280]
call fcn.1800125e0
nop
lea r8, [rsp + 0x68]
mov rdx, rax
lea rcx, [rsp + 0x1d8]
call fcn.180012bb0
nop
mov rdx, rax
lea rcx, [rsp + 0x120]
call fcn.180012d70
nop
lea rcx, [rsp + 0x1d8]
call fcn.18000eae0
nop
mov rcx, qword [rsp + 0x1d8]
call fcn.18009a864
nop
lea rcx, [rsp + 0x280]
call fcn.18000e590
nop
mov rcx, qword [rsp + 0x280]
call fcn.18009a864
nop
lea rcx, [rsp + 0x240]
call fcn.18000dfb0
mov rcx, qword [rsp + 0x240]
call fcn.18009a864
nop
lea rcx, [rsp + 0x310]
call fcn.180066210
nop
lea rcx, [rsp + 0xa0]
call fcn.18000cb70
nop
lea rcx, [rsp + 0xc8]
call fcn.18000cb70
lea rdx, str.BanSendFileManual
lea rcx, [rsp + 0xa0]
call fcn.18000cae0
nop
mov byte [rsp + 0x30], 0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x160]
call fcn.180002810
test al, al
je 0x18000705b
cmp byte [rsp + 0x30], 0
je 0x18000705b
mov dil, 1
jmp 0x18000705e
xor dil, dil
lea rcx, [rsp + 0xa0]
call fcn.18000cb70
test dil, dil
je 0x180007134
lea rax, [rsp + 0x68]
mov qword [rsp + 0x60], rax
lea rdx, str.BanSendFileManualRules
lea rcx, [rsp + 0xa0]
call fcn.18000cae0
nop
mov qword [rsp + 0x68], rbx
mov qword [rsp + 0x70], rsi
lea rax, [rsp + 0x68]
mov qword [rsp + 0x80], rax
lea r8, [rsp + 0xa0]
lea rdx, [rsp + 0x160]
lea rcx, [rsp + 0x280]
call fcn.180002ee0
nop
lea r8, [rsp + 0x68]
mov rdx, rax
lea rcx, [rsp + 0x1d8]
call fcn.180012bb0
nop
mov rdx, rax
lea rcx, [rsp + 0x120]
call fcn.180012d70
nop
lea rcx, [rsp + 0x1d8]
call fcn.18000eae0
nop
mov rcx, qword [rsp + 0x1d8]
call fcn.18009a864
nop
lea rcx, [rsp + 0x280]
call fcn.18000e590
nop
mov rcx, qword [rsp + 0x280]
call fcn.18009a864
nop
lea rcx, [rsp + 0xa0]
call fcn.18000cb70
lea rdx, [fcn.180012880]
lea rcx, [rsp + 0x38]
call fcn.180012d40
mov r8, rax
lea rdx, [rsp + 0x120]
lea rcx, [rsp + 0x1d8]
call fcn.180012bb0
nop
mov rdx, rax
lea rcx, [rsp + 0x120]
call fcn.18000d300
nop
lea rcx, [rsp + 0x1d8]
call fcn.18000eae0
nop
mov rcx, qword [rsp + 0x1d8]
call fcn.18009a864
lea rdx, [rsp + 0x650]
lea rcx, [rsp + 0x120]
call fcn.18000d380
test rax, rax
je 0x1800071bc
lea rdx, str.old_rule:_BSFM_DENIED
lea rcx, str.banSendFileDbg
call fcn.18005c640
mov dword [r12 + 8], r13d
lea rcx, [rsp + 0x120]
call fcn.18000eae0
nop
mov rcx, qword [rsp + 0x120]
call fcn.18009a864
nop
lea rcx, [rsp + 0x188]
call fcn.180066210
nop
lea rcx, [rsp + 0x160]
call fcn.180066210
nop
cmp qword [rsp + 0x670], 8
jb 0x18000720c
mov rcx, qword [rsp + 0x658]
call fcn.18009a864
mov eax, 1
mov rcx, qword [rsp + 0x678]
xor rcx, rsp
call fcn.180099fe0
mov rbx, qword [rsp + 0x6c0]
add rsp, 0x680
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret