Function at 0x14011aea0
Capabilities:
Capture network configuration via ipconfig
Execute command
Persist via windows service
Set registry value

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x300]
sub rsp, 0x400
xor ebx, ebx
vmovups xmm0, xmmword [str.E_J_OrXJH_3_]
vmovups xmmword [rsp + 0x40], xmm0
mov eax, dword [0x1401bc5c8]
mov dword [rsp + 0x50], eax
movzx ecx, byte [0x1401bc5cc]
mov byte [rsp + 0x40], WSAStartup
xor byte [rsp + 0x41], 0x38
xor byte [rsp + 0x42], 0x39
xor byte [rsp + 0x43], 0x3a
xor byte [rsp + 0x44], 0x3b
xor byte [rsp + 0x45], 0x3c
xor byte [rsp + 0x46], 0x3d
xor byte [rsp + 0x47], 0x3e
xor byte [rsp + 0x48], 0x3f
xor byte [rsp + 0x49], 0x40
xor byte [rsp + 0x4a], 0x41
xor byte [rsp + 0x4b], 0x42
xor byte [rsp + 0x4c], 0x43
xor byte [rsp + 0x4d], 0x44
xor byte [rsp + 0x4e], 0x45
xor byte [rsp + 0x4f], 0x46
xor al, 0x47
mov byte [rsp + 0x50], al
xor byte [rsp + 0x51], 0x48
xor byte [rsp + 0x52], 0x49
xor byte [rsp + 0x53], 0x4a
xor cl, 0x4b
mov byte [rsp + 0x54], cl
lea rcx, [rsp + 0x40]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBeginUltra]
mov cl, 1
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsDebuggerPresent]
mov cl, 1
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsDebuggerPresent]
mov cl, 1
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsDebuggerPresent]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsProtected]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectIsVirtualMachinePresent]
lea rcx, str.netsh_interface_ipv6_uninstall
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_firewall_set_rule_group_File_and_Printer_Sharing__new_enableno
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_int_tcp_set_global_autotuninglevelnormal
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_interface_set_interface__Microsoft_Network_Adapter_Multiplexor_Protocol__admindisabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_config_lltdsvc_startdisabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpip6Parameters___v_DisabledComponents__t_REG_DWORD__d_0xFFFFFFFF__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_advfirewall_firewall_set_rule_group_Network_Discovery__new_enableno
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.sc_config_lltdsvc_startdisabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v_EEE__t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSYSTEMCurrentControlSetServicesTcpipParametersInterfaces___v_NetworkAddress__t_REG_SZ__d_____f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v_ArpOffload__t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v_TcpAckFrequency__t_REG_DWORD__d_1__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v_TcpChecksumOffloadIPv4__t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v_LargeSendOffloadv2IPv6__t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v_TcpChecksumOffloadIPv6__t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.reg_add__HKLMSYSTEMCurrentControlSetServicesTcpipParameters___v_UdpChecksumOffloadIPv6__t_REG_DWORD__d_0__f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Network_properties_have_been_configured.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14006fd10
lea rdx, [0x140070280]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rbx
lea r8d, [rbx + 0x46]
lea rdx, str.HKEY_LOCAL_MACHINESYSTEMCurrentControlSetServicesTcpip6Parameters
lea rcx, [rsp + 0x40]
call fcn.140070960
nop
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], rbx
mov qword [rbp + 0xf8], rbx
lea r8d, [rbx + 0x10]
lea rdx, str.Dhcpv6DNSServers
lea rcx, [rbp + 0xe0]
call fcn.140070960
nop
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0xc0], xmm0
mov qword [rbp + 0xd0], rbx
mov qword [rbp + 0xd8], rbx
lea r8d, [rbx + 0x16]
lea rdx, str.Dhcpv6DomainSearchList
lea rcx, [rbp + 0xc0]
call fcn.140070960
nop
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], rbx
mov qword [rbp + 0xb8], rbx
lea r8d, [rbx + 0xa]
lea rdx, [0x1401bcc58]
lea rcx, [rbp + 0xa0]
call fcn.140070960
nop
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], rbx
mov qword [rbp + 0x98], rbx
lea r8d, [rbx + 0x12]
lea rdx, str.DisabledComponents
lea rcx, [rbp + 0x80]
call fcn.140070960
nop
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x60], bl
vmovups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x68], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x80], bl
vmovups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x60], bl
lea r12d, [rbx + 0xe]
movzx ebx, byte [rbp + 0x340]
movzx edi, byte [rbp + 0x340]
movzx esi, byte [rbp + 0x340]
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x14011b1d6
dec eax
or eax, 0xffffff00
inc eax
mov r8d, eax
lea rdx, str._02X
lea rcx, [rbp + 0x340]
call fcn.1400c3320
lea rax, [rbp + 0x340]
mov r15, 0xffffffffffffffff
nop word [rax + rax]
inc r15
cmp byte [rax + r15], 0
jne 0x14011b200
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
mov rax, rdx
sub rax, rcx
cmp r15, rax
ja 0x14011b24e
lea rax, [rcx + r15]
mov qword [rbp - 0x50], rax
lea r14, [rbp - 0x60]
cmp rdx, 0xf
cmova r14, qword [rbp - 0x60]
add r14, rcx
mov r8, r15
lea rdx, [rbp + 0x340]
mov rcx, r14
call sub.VCRUNTIME140.dll_memmove
mov byte [r15 + r14], 0
jmp 0x14011b26a
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x340]
movzx r8d, bl
mov rdx, r15
lea rcx, [rbp - 0x60]
call fcn.140071100
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x14011b280
dec eax
or eax, 0xffffff00
inc eax
mov r8d, eax
lea rdx, str._02X
lea rcx, [rbp + 0x348]
call fcn.1400c3320
lea rax, [rbp + 0x348]
mov r15, 0xffffffffffffffff
inc r15
cmp byte [rax + r15], 0
jne 0x14011b2a4
mov rcx, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x68]
mov rax, rdx
sub rax, rcx
cmp r15, rax
ja 0x14011b2f2
lea rax, [r15 + rcx]
mov qword [rbp - 0x70], rax
lea r14, [rbp - 0x80]
cmp rdx, 0xf
cmova r14, qword [rbp - 0x80]
add r14, rcx
mov r8, r15
lea rdx, [rbp + 0x348]
mov rcx, r14
call sub.VCRUNTIME140.dll_memmove
mov byte [r15 + r14], 0
jmp 0x14011b30e
mov qword [rsp + 0x20], r15
lea r9, [rbp + 0x348]
movzx r8d, dil
mov rdx, r15
lea rcx, [rbp - 0x80]
call fcn.140071100
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
and eax, 0x800000ff
jge 0x14011b324
dec eax
or eax, 0xffffff00
inc eax
mov r8d, eax
lea rdx, str._02X
lea rcx, [rbp + 0x350]
call fcn.1400c3320
lea rax, [rbp + 0x350]
mov r14, 0xffffffffffffffff
nop dword [rax + rax]
inc r14
cmp byte [rax + r14], 0
jne 0x14011b350
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x14011b3a3
lea rax, [r14 + rcx]
mov qword [rsp + 0x70], rax
lea r15, [rsp + 0x60]
cmp rdx, 0xf
cmova r15, qword [rsp + 0x60]
add r15, rcx
mov r8, r14
lea rdx, [rbp + 0x350]
mov rcx, r15
call sub.VCRUNTIME140.dll_memmove
mov byte [r14 + r15], 0
jmp 0x14011b3c0
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x350]
movzx r8d, sil
mov rdx, r14
lea rcx, [rsp + 0x60]
call fcn.140071100
sub r12, 1
jne 0x14011b1c0
movabs rsi, 0x7fffffffffffffff
mov rax, rsi
mov r15, qword [rsp + 0x50]
sub rax, r15
cmp rax, 9
jb 0x14011c6a7
lea r12, [rsp + 0x40]
mov r13, qword [rsp + 0x40]
mov rax, qword [rsp + 0x58]
mov qword [rbp + 0x340], rax
cmp rax, 0xf
cmova r12, r13
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x40], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp - 0x30], xmm1
lea r14, [r15 + 9]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rbp - 0x40]
cmp r14, rbx
jbe 0x14011b4a8
mov rbx, r14
or rbx, 0xf
cmp rbx, rsi
jbe 0x14011b463
mov rbx, rsi
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14019eb90
test rax, rax
je 0x14011b48c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14011b4a4
cmp rbx, 0x16
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14011b493
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14011c6a1
jmp 0x14011b448
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14011b4a2
call fcn.14019eb90
mov rdi, rax
jmp 0x14011b4a4
xor edi, edi
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], rbx
vmovsd xmm0, qword [str.reg_add__]
vmovsd qword [rdi], xmm0
movzx eax, byte [0x1401bcca8]
mov byte [rdi + 8], al
lea rcx, [rdi + 9]
mov r8, r15
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov rdi, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
sub rax, rdi
cmp rax, 6
jb 0x14011b524
lea rax, [rdi + 6]
mov qword [rbp - 0x30], rax
lea rbx, [rbp - 0x40]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x40]
lea rcx, [rbx + rdi]
mov r8d, 6
lea rdx, str.___v__
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi + 6], 0
lea rax, [rbp - 0x40]
jmp 0x14011b54a
mov qword [rsp + 0x20], 6
lea r9, str.___v__
movzx r8d, byte [rbp + 0x340]
mov edx, 6
lea rcx, [rbp - 0x40]
call fcn.140071100
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x1e0], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x1f0], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x1e0], ymm0
xor edi, edi
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], dil
lea rdx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0xf
cmova rdx, qword [rbp + 0xe0]
mov r8, qword [rbp + 0xf0]
lea rcx, [rbp + 0x1e0]
vzeroupper
call fcn.14006ee10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x1c0], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x1d0], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x1c0], ymm0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rax + 0x10], rdi
mov byte [rax], dil
lea r8d, [rdi + 0x13]
lea rdx, str.___t_REG_BINARY__d
lea rcx, [rbp + 0x1c0]
vzeroupper
call fcn.14006ee10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x1a0], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x1b0], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x1a0], ymm0
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], dil
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 0xf
cmova rdx, qword [rbp - 0x60]
mov r8, qword [rbp - 0x50]
lea rcx, [rbp + 0x1a0]
vzeroupper
call fcn.14006ee10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x180], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x190], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x180], ymm0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rax + 0x10], rdi
mov byte [rax], dil
lea r8d, [rdi + 3]
lea rdx, [0x1401bcc7c]
lea rcx, [rbp + 0x180]
vzeroupper
call fcn.14006ee10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x60], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x70], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x60], ymm0
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], dil
mov rdx, qword [rbp + 0x198]
cmp rdx, 0xf
jbe 0x14011b70e
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011b706
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14011b706
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.14019ebcc
vmovdqu xmm0, xmmword [0x1401c35c0]
vmovdqu xmmword [rbp + 0x190], xmm0
mov byte [rbp + 0x180], 0
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0xf
jbe 0x14011b76f
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011b767
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14011b767
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.14019ebcc
vmovdqu xmm0, xmmword [0x1401c35c0]
vmovdqu xmmword [rbp + 0x1b0], xmm0
mov byte [rbp + 0x1a0], 0
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0xf
jbe 0x14011b7d0
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011b7c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14011b7c8
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.14019ebcc
vmovdqu xmm0, xmmword [0x1401c35c0]
vmovdqu xmmword [rbp + 0x1d0], xmm0
mov byte [rbp + 0x1c0], 0
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 0xf
jbe 0x14011b831
inc rdx
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011b829
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14011b829
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.14019ebcc
vmovdqu xmm0, xmmword [0x1401c35c0]
vmovdqu xmmword [rbp + 0x1f0], xmm0
mov byte [rbp + 0x1e0], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x14011b88c
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011b884
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14011b884
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.14019ebcc
vmovdqu xmm0, xmmword [0x1401c35c0]
vmovdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov rax, rsi
sub rax, r15
cmp rax, 9
jb 0x14011c6ad
lea rax, [rsp + 0x40]
cmp qword [rbp + 0x340], 0xf
cmova rax, r13
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.reg_add__
lea r8, [rsp + 0x40]
movzx edx, byte [rbp + 0x340]
lea rcx, [rbp + 0x2c0]
vzeroupper
call fcn.140071d90
nop
mov r8d, 6
lea rdx, str.___v__
lea rcx, [rbp + 0x2c0]
call fcn.14006ee10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x260], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x270], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x260], ymm0
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0xf
cmova rdx, qword [rbp + 0xc0]
mov r8, qword [rbp + 0xd0]
lea rcx, [rbp + 0x260]
vzeroupper
call fcn.14006ee10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x240], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x250], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x240], ymm0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rax + 0x10], rdi
mov byte [rax], 0
mov r8d, reloc.WS2_32.dll_send
lea rdx, str.___t_REG_BINARY__d
lea rcx, [rbp + 0x240]
vzeroupper
call fcn.14006ee10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x220], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x230], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x220], ymm0
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova rdx, qword [rbp - 0x80]
mov r8, qword [rbp - 0x70]
lea rcx, [rbp + 0x220]
vzeroupper
call fcn.14006ee10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x200], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x210], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x200], ymm0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rax + 0x10], rdi
mov byte [rax], 0
mov r8d, 3
lea rdx, [0x1401bcc7c]
lea rcx, [rbp + 0x200]
vzeroupper
call fcn.14006ee10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x40], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x50], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x40], ymm0
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp + 0x218]
cmp rdx, 0xf
jbe 0x14011bad3
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011bacb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14011bacb
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.14019ebcc
vmovdqu xmm0, xmmword [0x1401c35c0]
vmovdqu xmmword [rbp + 0x210], xmm0
mov byte [rbp + 0x200], 0
mov rdx, qword [rbp + 0x238]
cmp rdx, 0xf
jbe 0x14011bb34
inc rdx
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011bb2c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14011bb2c
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.14019ebcc
vmovdqu xmm0, xmmword [0x1401c35c0]
vmovdqu xmmword [rbp + 0x230], xmm0
mov byte [rbp + 0x220], 0
mov rdx, qword [rbp + 0x258]
cmp rdx, 0xf
jbe 0x14011bb95
inc rdx
mov rcx, qword [rbp + 0x240]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011bb8d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14011bb8d
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.14019ebcc
vmovdqu xmm0, xmmword [0x1401c35c0]
vmovdqu xmmword [rbp + 0x250], xmm0
mov byte [rbp + 0x240], 0
mov rdx, qword [rbp + 0x278]
cmp rdx, 0xf
jbe 0x14011bbf6
inc rdx
mov rcx, qword [rbp + 0x260]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011bbee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14011bbee
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.14019ebcc
vmovdqu xmm0, xmmword [0x1401c35c0]
vmovdqu xmmword [rbp + 0x270], xmm0
mov byte [rbp + 0x260], 0
lea rcx, [rbp + 0x2c0]
vzeroupper
call fcn.14006eb60
mov rax, rsi
mov rcx, qword [rsp + 0x50]
sub rax, rcx
cmp rax, 9
jb 0x14011c6b6
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.reg_add__
lea r8, [rsp + 0x40]
movzx edx, byte [rbp + 0x340]
lea rcx, [rbp + 0x2e0]
call fcn.140071d90
nop
mov r8d, 6
lea rdx, str.___v__
lea rcx, [rbp + 0x2e0]
call fcn.14006ee10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x160], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x170], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x160], ymm0
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0xf
cmova rdx, qword [rbp + 0xa0]
mov r8, qword [rbp + 0xb0]
lea rcx, [rbp + 0x160]
vzeroupper
call fcn.14006ee10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x140], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x150], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x140], ymm0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rax + 0x10], rdi
mov byte [rax], 0
mov r8d, reloc.WS2_32.dll_send
lea rdx, str.___t_REG_BINARY__d
lea rcx, [rbp + 0x140]
vzeroupper
call fcn.14006ee10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x120], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x130], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x120], ymm0
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [rsp + 0x60]
cmp qword [rsp + 0x78], 0xf
cmova rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x70]
lea rcx, [rbp + 0x120]
vzeroupper
call fcn.14006ee10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x100], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x110], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x100], ymm0
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rax + 0x10], rdi
mov byte [rax], 0
mov r8d, 3
lea rdx, [0x1401bcc7c]
lea rcx, [rbp + 0x100]
vzeroupper
call fcn.14006ee10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x20], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x30], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x20], ymm0
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov r8, qword [rbp + 0x118]
cmp r8, 0xf
jbe 0x14011be31
mov rdx, qword [rbp + 0x100]
lea rcx, [rbp + 0x100]
vzeroupper
call fcn.14006f520
vmovdqu xmm0, xmmword [0x1401c35c0]
vmovdqu xmmword [rbp + 0x110], xmm0
mov byte [rbp + 0x100], 0
mov r8, qword [rbp + 0x138]
cmp r8, 0xf
jbe 0x14011be6b
mov rdx, qword [rbp + 0x120]
lea rcx, [rbp + 0x120]
vzeroupper
call fcn.14006f520
vmovdqu xmm0, xmmword [0x1401c35c0]
vmovdqu xmmword [rbp + 0x130], xmm0
mov byte [rbp + 0x120], 0
mov r8, qword [rbp + 0x158]
cmp r8, 0xf
jbe 0x14011bea5
mov rdx, qword [rbp + 0x140]
lea rcx, [rbp + 0x140]
vzeroupper
call fcn.14006f520
vmovdqu xmm0, xmmword [0x1401c35c0]
vmovdqu xmmword [rbp + 0x150], xmm0
mov byte [rbp + 0x140], 0
mov r8, qword [rbp + 0x178]
cmp r8, 0xf
jbe 0x14011bedf
mov rdx, qword [rbp + 0x160]
lea rcx, [rbp + 0x160]
vzeroupper
call fcn.14006f520
vmovdqu xmm0, xmmword [0x1401c35c0]
vmovdqu xmmword [rbp + 0x170], xmm0
mov byte [rbp + 0x160], 0
lea rcx, [rbp + 0x2e0]
vzeroupper
call fcn.14006eb60
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova rcx, qword [rbp + 0x60]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova rcx, qword [rbp + 0x40]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0xf
cmova rcx, qword [rbp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [rsp + 0x50]
sub rsi, rcx
cmp rsi, 9
jb 0x14011c69b
lea rax, [rsp + 0x40]
cmp qword [rsp + 0x58], 0xf
cmova rax, qword [rsp + 0x40]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.reg_add__
lea r8, [rsp + 0x40]
movzx edx, byte [rbp + 0x340]
lea rcx, [rbp + 0x2a0]
call fcn.140071d90
nop
mov r8d, 6
lea rdx, str.___v__
lea rcx, [rbp + 0x2a0]
call fcn.14006ee10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x280], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x290], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp + 0x280], ymm0
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0xf
cmova rdx, qword [rbp + 0x80]
mov r8, qword [rbp + 0x90]
lea rcx, [rbp + 0x280]
vzeroupper
call fcn.14006ee10
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp - 0x20], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp - 0x10], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp - 0x20], ymm0
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rcx, qword [rbp - 0x10]
mov rdx, qword [rbp - 8]
mov rax, rdx
sub rax, rcx
cmp rax, 0x16
jb 0x14011c088
lea rax, [rcx + 0x16]
mov qword [rbp - 0x10], rax
lea rbx, [rbp - 0x20]
cmp rdx, 0xf
cmova rbx, qword [rbp - 0x20]
add rbx, rcx
mov r8d, reloc.WLDAP32.dll_Ordinal_22
lea rdx, str.___t_REG_DWORD__d_1__f
mov rcx, rbx
vzeroupper
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x16], 0
lea rax, [rbp - 0x20]
jmp 0x14011c0af
mov eax, reloc.WLDAP32.dll_Ordinal_22
mov qword [rsp + 0x20], rax
lea r9, str.___t_REG_DWORD__d_1__f
movzx r8d, byte [rbp + 0x340]
mov edx, eax
lea rcx, [rbp - 0x20]
vzeroupper
call fcn.140071100
vpxor xmm0, xmm0, xmm0
vmovups xmmword [rbp], xmm0
vpxor xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x10], xmm1
vmovups ymm0, ymmword [rax]
vmovups ymmword [rbp], ymm0
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x14011c11d
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011c115
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14011c115
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.14019ebcc
vmovdqu xmm0, xmmword [0x1401c35c0]
vmovdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp + 0x298]
cmp rdx, 0xf
jbe 0x14011c178
inc rdx
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011c170
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14011c170
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.14019ebcc
vmovdqu xmm0, xmmword [0x1401c35c0]
vmovdqu xmmword [rbp + 0x290], xmm0
mov byte [rbp + 0x280], 0
mov rdx, qword [rbp + 0x2b8]
cmp rdx, 0xf
jbe 0x14011c1d9
inc rdx
mov rcx, qword [rbp + 0x2a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011c1d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14011c1d1
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
vzeroupper
call fcn.14019ebcc
vmovdqu xmm0, xmmword [0x1401c35c0]
vmovdqu xmmword [rbp + 0x2b0], xmm0
mov byte [rbp + 0x2a0], 0
lea rcx, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova rcx, qword [rbp]
vzeroupper
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rdx, str.Random_binary_values_and_DisabledComponents_set_for_registry_entries.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14006fd10
lea rdx, [0x140070280]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rcx, str.netsh_advfirewall_reset
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_winsock_reset
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ipconfig__release
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ipconfig__renew
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.ipconfig__flushdns
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_winhttp_reset_autoproxy
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_winhttp_reset_proxy
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_winhttp_reset_tracing
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_interface_ipv4_reset
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_interface_portproxy_reset
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_interface_httpstunnel_reset
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_interface_tcp_reset
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_interface_teredo_set_state_disabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_interface_ipv6_6to4_set_state_statedisabled_undoonstopdisabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.netsh_interface_ipv6_isatap_set_state_statedisabled
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.arp__d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
call qword [sym.imp.VMProtectSDK64.dll_VMProtectEnd]
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x14011c33f
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011c33a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14011c33a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14019ebcc
vmovdqu xmm0, xmmword [0x1401c35c0]
vmovdqu xmmword [rbp + 0x10], xmm0
mov byte [rbp], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x14011c38e
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011c389
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14011c389
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14019ebcc
vmovdqu xmm0, xmmword [0x1401c35c0]
vmovdqu xmmword [rbp + 0x30], xmm0
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x14011c3dd
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011c3d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14011c3d8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14019ebcc
vmovdqu xmm0, xmmword [0x1401c35c0]
vmovdqu xmmword [rbp + 0x50], xmm0
mov byte [rbp + 0x40], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x14011c42c
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011c427
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14011c427
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14019ebcc
vmovdqu xmm0, xmmword [0x1401c35c0]
vmovdqu xmmword [rbp + 0x70], xmm0
mov byte [rbp + 0x60], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14011c47d
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011c478
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14011c478
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14019ebcc
mov qword [rsp + 0x70], rdi
mov qword [rsp + 0x78], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x14011c4ce
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011c4c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14011c4c9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14019ebcc
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x80], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x14011c51c
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011c517
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14011c517
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14019ebcc
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x60], 0
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x14011c571
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011c56b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14011c56b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14019ebcc
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x14011c5b6
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011c5b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14011c5b0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14019ebcc
nop
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0xf
jbe 0x14011c5fb
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011c5f5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14011c5f5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14019ebcc
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x14011c640
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011c63a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14011c63a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14019ebcc
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x14011c680
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14011c67b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14011c67b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14019ebcc
mov rbx, qword [rsp + 0x458]
add rsp, 0x400
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.140043fa0
nop
call fcn.140043e20
int3
call fcn.140043fa0
nop
vzeroupper
call fcn.140043fa0
nop
call fcn.140043fa0
int3