Function at 0x140009600
Capabilities:
Capture network configuration via ipconfig
Execute command
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x120]
sub rsp, 0x220
mov rax, qword [0x1400aa0c0]
xor rax, rsp
mov qword [rbp + 0x118], rax
xor r15d, r15d
mov r13d, r15d
mov dword [rsp + 0x38], r15d
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r15
mov qword [rbp + 0xb8], r15
lea r8d, [r15 + 0x51]
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e972_e325_11ce_bfc1_08002be10318000
lea rcx, [rbp + 0xa0]
call fcn.140014cd0
nop
mov eax, r15d
mov dword [rsp + 0x40], eax
movzx edi, byte [rsp + 0x30]
movzx ebx, byte [rsp + 0x30]
movzx esi, byte [rsp + 0x30]
movzx r14d, byte [rsp + 0x30]
nop
lea r10, [rbp + 0x115]
mov r8d, eax
test eax, eax
jns 0x1400096e0
neg r8d
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x1400096a1
dec r10
mov byte [r10], reloc.WLDAP32.dll_Ordinal_45
jmp 0x14000970a
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x1400096e0
lea r9, [rsp + 0x30]
lea r8, [rbp + 0x115]
mov rdx, r10
lea rcx, [rbp - 0x20]
call fcn.1400159b0
or r13d, 0xc00
mov rcx, qword [rbp + 0xb0]
mov qword [rsp + 0x48], rcx
lea r12, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0xf
cmova r12, qword [rbp + 0xa0]
mov r8, qword [rbp - 0x10]
mov rdx, qword [rbp - 8]
mov rax, rdx
sub rax, r8
cmp rcx, rax
ja 0x1400097f1
lea rax, [rcx + r8]
mov qword [rbp - 0x10], rax
lea r15, [rbp - 0x20]
cmp rdx, 0xf
cmova r15, qword [rbp - 0x20]
lea rax, [r12 + rcx]
cmp rax, r15
jbe 0x1400097a7
lea rax, [r15 + r8]
cmp r12, rax
ja 0x1400097a7
cmp r15, r12
ja 0x14000979a
mov qword [rsp + 0x38], 0
jmp 0x1400097ac
mov rax, r15
sub rax, r12
mov qword [rsp + 0x38], rax
jmp 0x1400097ac
mov qword [rsp + 0x38], rcx
inc r8
add rcx, r15
mov rdx, r15
call sub.VCRUNTIME140.dll_memmove
mov r8, qword [rsp + 0x38]
mov rdx, r12
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
mov r8, qword [rsp + 0x48]
mov rcx, qword [rsp + 0x38]
sub r8, rcx
lea rdx, [rcx + r12]
add rdx, qword [rsp + 0x48]
add rcx, r15
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x20]
xor r15d, r15d
jmp 0x14000980e
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], r12
xor r9d, r9d
movzx r8d, dil
mov rdx, rcx
lea rcx, [rbp - 0x20]
call fcn.140015ca0
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r15
mov qword [rbp + 0x18], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
bts r13d, 0xc
lea rdx, [rbp]
call fcn.1400091f0
movzx r15d, al
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140009888
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009883
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009e37
call fcn.140085540
test r15b, r15b
je 0x140009ddb
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xor r15d, r15d
mov qword [rsp + 0x68], r15
mov r12d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x70], r12
mov byte [rsp + 0x58], r15b
bts r13d, 0xd
mov dword [rsp + 0x38], r13d
lea edi, [r15 + 0xc]
nop
call fcn.1400092e0
cmp r15, r12
jae 0x1400098ee
lea rcx, [r15 + 1]
mov qword [rsp + 0x68], rcx
lea rcx, [rsp + 0x58]
cmp r12, 0xf
cmova rcx, qword [rsp + 0x58]
mov byte [rcx + r15], al
mov byte [rcx + r15 + 1], 0
jmp 0x140009905
movzx r9d, al
movzx r8d, bl
mov edx, 1
lea rcx, [rsp + 0x58]
call fcn.140014b60
sub rdi, 1
je 0x140009917
mov r12, qword [rsp + 0x70]
mov r15, qword [rsp + 0x68]
jmp 0x1400098c0
mov r8d, dword [rsp + 0x40]
test r8d, r8d
movzx edi, byte [rsp + 0x30]
lea r10, [rbp + 0x115]
jns 0x140009970
neg r8d
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x140009930
dec r10
mov byte [r10], reloc.WLDAP32.dll_Ordinal_45
jmp 0x14000999a
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x140009970
lea r9, [rsp + 0x30]
lea r8, [rbp + 0x115]
mov rdx, r10
lea rcx, [rbp - 0x40]
call fcn.1400159b0
or r13d, 0xc000
mov dword [rsp + 0x38], r13d
mov rdx, qword [rbp + 0xb0]
mov qword [rsp + 0x50], rdx
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rdx
cmp rax, 0x1c
jb 0x14000a618
lea r9, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0xf
cmova r9, qword [rbp + 0xa0]
mov qword [rsp + 0x48], r9
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xor r8d, r8d
mov qword [rbp - 0x70], r8
mov qword [rbp - 0x68], r8
lea rax, [rdx + 0x1c]
mov qword [rsp + 0x78], rax
mov r15d, reloc.WS2_32.dll_ntohs
lea r12, [rbp - 0x80]
cmp rax, r15
jbe 0x140009ac8
mov r15, rax
or r15, 0xf
cmp r15, rcx
jbe 0x140009a4d
mov r15, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140009a74
cmp r15, 0x16
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmovb r15, rcx
lea rcx, [r15 + 1]
cmp rcx, 0x1000
jb 0x140009aa3
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000a612
mov rcx, rax
call fcn.140085350
test rax, rax
je 0x140009e53
lea r12, [rax + 0x27]
and r12, 0xffffffffffffffe0
mov qword [r12 - 8], rax
mov rax, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x50]
mov r9, qword [rsp + 0x48]
jmp 0x140009ac4
test rcx, rcx
je 0x140009ac1
call fcn.140085350
mov r12, rax
mov rax, qword [rsp + 0x78]
mov rdx, qword [rsp + 0x50]
mov r9, qword [rsp + 0x48]
jmp 0x140009ac4
mov r12, r8
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], r15
movups xmm0, xmmword [str.REG_ADD__HKEY_LOCAL_MACHINE_]
movups xmmword [r12], xmm0
movsd xmm0, qword [0x140098690]
movsd qword [r12 + 0x10], xmm0
mov eax, dword [0x140098698]
mov dword [r12 + 0x18], eax
lea rcx, [r12 + 0x1c]
mov r8, rdx
mov rdx, r9
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x50]
mov byte [r12 + rax + 0x1c], 0
bts r13d, 0x10
mov dword [rsp + 0x38], r13d
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x80]
movzx edx, sil
lea rcx, [rbp + 0x40]
call fcn.140015670
bts r13d, 0x11
mov dword [rsp + 0x38], r13d
mov r8d, reloc.WLDAP32.dll_Ordinal_33
lea rdx, str.___v_NetworkAddress__t_REG_SZ__d
lea rcx, [rbp + 0x40]
call fcn.140013110
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
xor r15d, r15d
mov qword [rax + 0x10], r15
mov byte [rax], r15b
bts r13d, 0x12
mov dword [rsp + 0x38], r13d
lea r9, [rsp + 0x58]
lea r8, [rbp - 0x60]
movzx edx, r14b
lea rcx, [rbp + 0x20]
call fcn.140015670
bts r13d, 0x14
mov dword [rsp + 0x38], r13d
lea r8d, [r15 + 0xe]
lea rdx, str.__f__NUL_2_NUL
lea rcx, [rbp + 0x20]
call fcn.140013110
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], r15
mov qword [rbp + 0xd8], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xc0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xd0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r15b
bts r13d, 0x13
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x140009c2b
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009c26
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009e3e
call fcn.140085540
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140009c77
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009c71
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009e45
call fcn.140085540
nop
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x140009cb2
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009cad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009e4c
call fcn.140085540
mov qword [rbp + 0x50], r15
mov qword [rbp + 0x58], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x40], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140009cfe
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009cf8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009e53
call fcn.140085540
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140009d39
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009d34
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009e5a
call fcn.140085540
btr r13d, 0xd
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140009d7b
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009d76
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009e61
call fcn.140085540
lea rcx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0xf
cmova rcx, qword [rbp + 0xc0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0xf
jbe 0x140009dde
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009dd4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009e68
call fcn.140085540
jmp 0x140009dde
xor r15d, r15d
mov eax, dword [rsp + 0x40]
inc eax
mov dword [rsp + 0x40], eax
cmp eax, 9
jle 0x140009690
mov rax, qword [rbp + 0xb8]
cmp rax, 0x50
jb 0x140009e6f
lea rbx, [rbp + 0xa0]
cmp rax, 0xf
cmova rbx, qword [rbp + 0xa0]
mov qword [rbp + 0xb0], 0x50
mov r8d, 0x50
lea rdx, str.SYSTEMCurrentControlSetControlClass4d36e972_e325_11ce_bfc1_08002be1031800
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x50], 0
jmp 0x140009e87
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea r9, str.SYSTEMCurrentControlSetControlClass4d36e972_e325_11ce_bfc1_08002be1031800
mov edx, 0x50
lea rcx, [rbp + 0xa0]
call fcn.1400154a0
mov r12d, 0xa
mov dword [rsp + 0x40], r12d
movzx ebx, byte [rsp + 0x30]
movzx edi, byte [rsp + 0x30]
movzx esi, byte [rsp + 0x30]
lea r10, [rbp + 0x115]
mov r8d, r12d
test r12d, r12d
jns 0x140009f00
neg r8d
nop dword [rax]
nop word [rax + rax]
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x140009ec0
dec r10
mov byte [r10], reloc.WLDAP32.dll_Ordinal_45
jmp 0x140009f2a
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x140009f00
lea r9, [rsp + 0x30]
lea r8, [rbp + 0x115]
mov rdx, r10
lea rcx, [rbp - 0x40]
call fcn.1400159b0
or r13d, 3
lea r8, [rbp - 0x40]
lea rdx, [rbp + 0xa0]
lea rcx, [rbp - 0x60]
call fcn.140013330
mov rdx, rax
call fcn.1400091f0
movzx r14d, al
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140009fa1
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009f9c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a59f
call fcn.140085540
test r14b, r14b
je 0x14000a503
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov r14, r15
mov qword [rsp + 0x68], r15
mov r15d, reloc.WS2_32.dll_ntohs
mov qword [rsp + 0x70], r15
mov byte [rsp + 0x58], 0
or r13d, 4
mov dword [rsp + 0x38], r13d
lea r12d, [r15 - 3]
call fcn.1400092e0
cmp r14, r15
jae 0x14000a005
lea rcx, [r14 + 1]
mov qword [rsp + 0x68], rcx
lea rcx, [rsp + 0x58]
cmp r15, 0xf
cmova rcx, qword [rsp + 0x58]
mov byte [rcx + r14], al
mov byte [rcx + r14 + 1], 0
jmp 0x14000a01c
movzx r9d, al
movzx r8d, bl
mov edx, 1
lea rcx, [rsp + 0x58]
call fcn.140014b60
sub r12, 1
je 0x14000a02e
mov r15, qword [rsp + 0x70]
mov r14, qword [rsp + 0x68]
jmp 0x140009fd7
mov r12d, dword [rsp + 0x40]
lea r10, [rbp + 0x115]
test r12d, r12d
jns 0x14000a082
mov ecx, r12d
neg ecx
nop dword [rax]
nop dword [rax + rax]
dec r10
mov eax, 0xcccccccd
mul ecx
shr edx, 3
movzx eax, dl
shl al, 2
lea r8d, [rax + rdx]
add r8b, r8b
sub cl, r8b
add cl, 0x30
mov byte [r10], cl
mov ecx, edx
test edx, edx
jne 0x14000a050
dec r10
mov byte [r10], reloc.WLDAP32.dll_Ordinal_45
jmp 0x14000a0ba
mov r8d, r12d
nop word [rax + rax]
dec r10
mov eax, 0xcccccccd
mul r8d
shr edx, 3
movzx eax, dl
shl al, 2
lea ecx, [rax + rdx]
add cl, cl
sub r8b, cl
add r8b, 0x30
mov byte [r10], r8b
mov r8d, edx
test edx, edx
jne 0x14000a090
lea r9, [rsp + 0x30]
lea r8, [rbp + 0x115]
mov rdx, r10
lea rcx, [rbp - 0x40]
call fcn.1400159b0
or r13d, 0x18
mov dword [rsp + 0x38], r13d
mov rdx, qword [rbp + 0xb0]
mov qword [rsp + 0x50], rdx
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rdx
cmp rax, 0x1c
jb 0x14000a60c
lea r9, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0xf
cmova r9, qword [rbp + 0xa0]
mov qword [rsp + 0x78], r9
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xor r8d, r8d
mov qword [rbp - 0x70], r8
mov qword [rbp - 0x68], r8
lea rax, [rdx + 0x1c]
mov qword [rsp + 0x48], rax
mov r14d, reloc.WS2_32.dll_ntohs
lea r15, [rbp - 0x80]
cmp rax, r14
jbe 0x14000a1e4
mov r14, rax
or r14, 0xf
cmp r14, rcx
jbe 0x14000a16a
mov r14, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x14000a191
cmp r14, 0x16
mov ecx, reloc.WLDAP32.dll_Ordinal_22
cmovb r14, rcx
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x14000a1bf
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000a61e
mov rcx, rax
call fcn.140085350
test rax, rax
je 0x14000a5bb
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov r9, qword [rsp + 0x78]
jmp 0x14000a1e0
test rcx, rcx
je 0x14000a1dd
call fcn.140085350
mov r15, rax
mov rax, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x50]
mov r9, qword [rsp + 0x78]
jmp 0x14000a1e0
mov r15, r8
mov qword [rbp - 0x80], r15
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], r14
movups xmm0, xmmword [str.REG_ADD__HKEY_LOCAL_MACHINE_]
movups xmmword [r15], xmm0
movsd xmm0, qword [0x140098690]
movsd qword [r15 + 0x10], xmm0
mov eax, dword [0x140098698]
mov dword [r15 + 0x18], eax
lea rcx, [r15 + 0x1c]
mov r8, rdx
mov rdx, r9
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rsp + 0x50]
mov byte [r15 + rax + 0x1c], 0
bts r13d, 8
mov dword [rsp + 0x38], r13d
lea r9, [rbp - 0x40]
lea r8, [rbp - 0x80]
movzx edx, dil
lea rcx, [rbp + 0x80]
call fcn.140015670
or r13d, 0x20
mov dword [rsp + 0x38], r13d
mov r8d, reloc.WLDAP32.dll_Ordinal_33
lea rdx, str.___v_NetworkAddress__t_REG_SZ__d
lea rcx, [rbp + 0x80]
call fcn.140013110
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
xor r15d, r15d
mov qword [rax + 0x10], r15
mov byte [rax], r15b
or r13d, 0x40
mov dword [rsp + 0x38], r13d
lea r9, [rsp + 0x58]
lea r8, [rbp - 0x60]
movzx edx, sil
lea rcx, [rbp + 0x60]
call fcn.140015670
bts r13d, 7
mov dword [rsp + 0x38], r13d
lea r8d, [r15 + 0xe]
lea rdx, str.__f__NUL_2_NUL
lea rcx, [rbp + 0x60]
call fcn.140013110
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r15
mov qword [rbp + 0xf8], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xe0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xf0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r15b
bts r13d, 9
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x14000a347
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a342
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a5a6
call fcn.140085540
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x60], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x14000a393
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a38d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a5ad
call fcn.140085540
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x14000a3d4
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a3cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a5b4
call fcn.140085540
mov qword [rbp + 0x90], r15
mov qword [rbp + 0x98], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x14000a429
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a423
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a5bb
call fcn.140085540
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x14000a464
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a45f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a5c2
call fcn.140085540
and r13d, 0xfffffffb
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x14000a4a5
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a4a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a5c9
call fcn.140085540
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0xf
cmova rcx, qword [rbp + 0xe0]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x14000a503
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a4fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a5d0
call fcn.140085540
inc r12d
mov dword [rsp + 0x40], r12d
cmp r12d, 0x63
jle 0x140009ea1
lea rcx, str.netsh_int_ip_reset__NUL_2_NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ipconfig__release__NUL_2_NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ipconfig__renew__NUL_2_NUL
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str._3__Spoofed.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140013620
lea rdx, [0x1400137f0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x14000a5dc
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a5d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000a5d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.140085540
mov rcx, qword [rbp + 0x118]
xor rcx, rsp
call fcn.140085210
lea r11, [rsp + 0x220]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001f40
nop
call fcn.140001ea0
int3
call fcn.140001f40
nop
call fcn.140001ea0
int3