Function at 0x180007c20
Capabilities:
Access firewall policy via inetfwpolicy2
Get common file path
Get cpu information
Get hostname
Get system information on windows
Query or enumerate registry value
Reference wmi statements

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x8e8]
sub rsp, 0x9e8
call fcn.18000c174
xor r15d, r15d
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x50]
mov dword [rsp + 0x50], reloc.WS2_32.dll_recv
lea rcx, [rbp + 0xc0]
mov r14b, r15b
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
test eax, eax
je 0x180007c97
lea rcx, [rbp + 0xc0]
call fcn.180004dc0
mov r8, rax
lea rdx, [0x1800016b0]
mov rcx, rsi
mov rbx, rax
call fcn.18000c5b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
lea rdx, [0x1800016c0]
mov rcx, rsi
call fcn.18000c3b8
lea rcx, [0x1800016d0]
mov rbx, rax
call fcn.18000bb7c
mov r8, rax
lea rdx, [0x180001674]
mov rcx, rbx
call fcn.18000bc64
call fcn.1800050d0
mov rdi, rax
mov r13d, 1
test rax, rax
je 0x180007d24
mov ecx, dword [rax + 0xc]
lea rdx, [0x1800016e0]
mov r9d, dword [rax + 8]
mov r8d, dword [rax + 4]
mov dword [rsp + 0x20], ecx
lea rcx, [rbp - 0x80]
call qword [sym.imp.USER32.dll_wsprintfA]
lea rcx, [rbp - 0x80]
call fcn.18000bb7c
mov r8, rax
lea rdx, [0x1800016a8]
mov rcx, rbx
call fcn.18000bc64
cmp dword [rdi + 0xc], 0x55f0
movzx r14d, r14b
cmovae r14d, r13d
lea rcx, [0x1800010a0]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rcx, rax
lea rdx, [0x180001088]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
lea rcx, [rbp + 0x90]
test rax, rax
je 0x180007d51
call rax
jmp 0x180007d57
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp word [rbp + 0x90], 9
lea r15, [0x1800016ec]
lea r12, [0x1800016f8]
je 0x180007d7c
cmp word [rbp + 0x90], 6
mov rcx, r12
jne 0x180007d7f
mov rcx, r15
call fcn.18000bb7c
mov r8, rax
lea rdx, [0x1800016f0]
mov rcx, rbx
call fcn.18000bc64
mov ebx, 0x200
mov dword [rbp + 0x938], 0x100
mov r8d, ebx
lea rcx, [rbp + 0xe0]
xor edx, edx
call fcn.180025ca4
mov r8d, ebx
lea rcx, [rbp + 0x2e0]
xor edx, edx
call fcn.180025ca4
lea rax, [rsp + 0x30]
mov dword [rsp + 0x54], 4
xor ebx, ebx
mov qword [rsp + 0x20], rax
mov r9d, r13d
mov dword [rbp + 0x940], ebx
xor r8d, r8d
lea rdx, [0x180001700]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x180007e42
lea r13, [0x18000175a]
mov rcx, r13
call fcn.18000bb7c
mov r8, rax
lea rdx, [0x180001674]
mov rcx, rsi
call fcn.18000bc64
mov rcx, r13
call fcn.18000bb7c
mov r8, rax
lea rdx, [0x180001760]
mov rcx, rsi
call fcn.18000bc64
xor r8d, r8d
jmp 0x1800081c6
mov rcx, qword [rsp + 0x30]
lea rax, [rbp + 0x938]
mov qword [rsp + 0x28], rax
lea rdx, [0x180001780]
lea rax, [rbp + 0xe0]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
lea r13, [0x18000175a]
test eax, eax
jne 0x18000805b
cmp dword [rbp + 0x938], 0x100
ja 0x18000805b
call fcn.1800050d0
test rax, rax
je 0x180007ea9
mov ecx, dword [rax + 4]
mov eax, dword [rax + 8]
lea edx, [rcx + rcx*4]
lea ecx, [rax + rdx*2]
jmp 0x180007eae
mov ecx, 0x3c
cmp ecx, 0x34
jne 0x180007fea
test rdi, rdi
je 0x180007fea
movzx eax, word [rdi + 0x118]
lea edx, [rcx - 0x32]
test dl, al
je 0x180007efb
lea rax, [rbp + 0xe0]
sub rax, rdx
add rax, rdx
cmp word [rax], bx
jne 0x180007ed8
movups xmm0, xmmword [0x1800017a0]
movups xmm1, xmmword [0x1800017b0]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1800017c0]
jmp 0x180007f76
mov ecx, 0x4000
test cx, ax
je 0x180007f47
lea rcx, [rbp + 0xe0]
sub rcx, rdx
add rcx, rdx
cmp word [rcx], bx
jne 0x180007f0f
movups xmm0, xmmword [0x1800017c8]
movzx eax, word [0x1800017f8]
movups xmm1, xmmword [0x1800017d8]
movups xmmword [rcx], xmm0
movups xmm0, xmmword [0x1800017e8]
movups xmmword [rcx + 0x10], xmm1
movups xmmword [rcx + 0x20], xmm0
mov word [rcx + 0x30], ax
jmp 0x180007fea
test al, al
jns 0x180007f81
lea rax, [rbp + 0xe0]
sub rax, rdx
add rax, rdx
cmp word [rax], bx
jne 0x180007f55
movups xmm0, xmmword [0x180001800]
movups xmm1, xmmword [0x180001810]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x180001820]
movups xmmword [rax + 0x10], xmm1
movsd qword [rax + 0x20], xmm0
jmp 0x180007fea
mov ecx, 0x400
test cx, ax
lea rcx, [rbp + 0xe0]
je 0x180007fc1
sub rcx, rdx
add rcx, rdx
cmp word [rcx], bx
jne 0x180007f95
movups xmm0, xmmword [0x180001828]
movzx eax, word [0x180001840]
movsd xmm1, qword [0x180001838]
movups xmmword [rcx], xmm0
movsd qword [rcx + 0x10], xmm1
mov word [rcx + 0x18], ax
jmp 0x180007fea
sub rcx, rdx
add rcx, rdx
cmp word [rcx], bx
jne 0x180007fc4
movups xmm0, xmmword [0x180001848]
mov eax, dword [0x180001868]
movups xmm1, xmmword [0x180001858]
movups xmmword [rcx], xmm0
movups xmmword [rcx + 0x10], xmm1
mov dword [rcx + 0x20], eax
lea rcx, [rbp + 0xe0]
call fcn.180004dc0
mov rbx, rax
test rax, rax
je 0x180008075
test r14b, r14b
je 0x18000803e
lea rdx, [0x18000186c]
mov rcx, rax
call fcn.180005170
mov rdx, rax
test rax, rax
je 0x18000803e
lea rcx, [0x180001870]
mov r8d, 2
sub rdx, rcx
mov al, byte [rcx]
dec r8
mov byte [rdx + rcx], al
inc rcx
test al, al
je 0x18000803e
test r8, r8
jne 0x18000802a
mov r8, rbx
lea rdx, [0x180001798]
mov rcx, rsi
call fcn.18000c5b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x180008075
mov rcx, r13
call fcn.18000bb7c
mov r8, rax
lea rdx, [0x180001798]
mov rcx, rsi
call fcn.18000bc64
mov rcx, qword [rsp + 0x30]
lea rax, [rbp + 0x938]
mov qword [rsp + 0x28], rax
lea rdx, [0x180001878]
lea rax, [rbp + 0x2e0]
mov r14d, 0x100
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x938], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800080bf
cmp dword [rbp + 0x938], r14d
jbe 0x18000813e
mov rcx, qword [rsp + 0x30]
lea rax, [rbp + 0x938]
mov qword [rsp + 0x28], rax
lea rdx, [0x180001890]
lea rax, [rbp + 0x2e0]
mov dword [rbp + 0x938], r14d
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180008103
cmp dword [rbp + 0x938], r14d
jbe 0x18000813e
mov rcx, qword [rsp + 0x30]
lea rax, [rbp + 0x938]
mov qword [rsp + 0x28], rax
lea rdx, [0x1800018a8]
lea rax, [rbp + 0x2e0]
mov dword [rbp + 0x938], r14d
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x18000816f
lea rcx, [rbp + 0x2e0]
call fcn.180004dc0
mov rbx, rax
test rax, rax
je 0x180008189
mov r8, rax
lea rdx, [0x180001760]
mov rcx, rsi
call fcn.18000c5b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x180008189
mov rcx, r13
call fcn.18000bb7c
mov r8, rax
lea rdx, [0x180001760]
mov rcx, rsi
call fcn.18000bc64
mov rcx, qword [rsp + 0x30]
lea rax, [rsp + 0x54]
mov qword [rsp + 0x28], rax
lea rdx, [0x1800018c8]
lea rax, [rbp + 0x940]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180007e3a
mov r8d, dword [rbp + 0x940]
lea rdx, [0x180001770]
mov rcx, rsi
call fcn.18000c448
mov rcx, qword [rsp + 0x30]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
test rdi, rdi
je 0x180008243
cmp byte [rdi + 0x11a], 1
lea rcx, [0x1800018e0]
mov rbx, rsi
je 0x1800081ff
lea rcx, [0x1800018f4]
call fcn.18000bb7c
lea r14, [0x1800018e8]
mov r8, rax
mov rdx, r14
mov rcx, rbx
call fcn.18000bc64
cmp byte [rdi + 0x11a], 1
lea rcx, [0x1800018e0]
je 0x180008230
lea rcx, [0x1800018f4]
call fcn.18000bb7c
mov r8, rax
mov rdx, r14
mov rcx, rsi
call fcn.18000bc64
lea rax, [rsp + 0x58]
mov r9d, 1
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea rdx, [0x180001900]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
xor edi, edi
test eax, eax
je 0x18000829e
mov rcx, r13
call fcn.18000bb7c
mov r8, rax
lea rdx, [0x180001960]
mov rcx, rsi
call fcn.18000bc64
mov rcx, r15
call fcn.18000bb7c
lea rdx, [0x18000196c]
jmp 0x180008440
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x938]
mov qword [rsp + 0x28], rax
lea rdx, [0x180001970]
lea rax, [rbp + 0x4e0]
mov r14d, 0x100
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x938], r14d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1800083a2
cmp dword [rbp + 0x938], r14d
ja 0x1800083a2
movzx r8d, word [rbp + 0x4e0]
lea rax, [rbp + 0x4e0]
lea r9, [0x180000000]
test r8w, r8w
je 0x180008346
mov rcx, rdi
mov rdx, rdi
mov ebx, 0x36
cmp word [rdx + rax], bx
jne 0x180008332
inc rcx
lea rdx, [rcx + rcx]
movzx ebx, word [rdx + r9 + 0x1988]
test bx, bx
jne 0x180008317
cmp word [r9 + rcx*2 + 0x1988], di
je 0x180008349
add rax, 2
cmp word [rax], di
jne 0x18000830c
mov rax, rdi
test rax, rax
jne 0x1800083a2
lea rax, [rbp + 0x4e0]
test r8w, r8w
je 0x180008395
mov rcx, rdi
mov rdx, rdi
mov ebx, 0x38
cmp word [rdx + rax], bx
jne 0x180008381
inc rcx
lea rdx, [rcx + rcx]
movzx ebx, word [rdx + r9 + 0x1990]
test bx, bx
jne 0x180008366
cmp word [r9 + rcx*2 + 0x1990], di
je 0x180008398
add rax, 2
cmp word [rax], di
jne 0x18000835b
mov rax, rdi
test rax, rax
cmove r12, r15
mov r15, r12
mov rcx, r15
call fcn.18000bb7c
mov r8, rax
lea rdx, [0x18000196c]
mov rcx, rsi
call fcn.18000bc64
mov rcx, qword [rsp + 0x58]
lea rax, [rbp + 0x938]
mov qword [rsp + 0x28], rax
lea rdx, [0x180001998]
lea rax, [rbp + 0x6e0]
mov dword [rbp + 0x938], r14d
xor r9d, r9d
mov qword [rsp + 0x20], rax
xor r8d, r8d
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x180008431
cmp dword [rbp + 0x938], r14d
ja 0x180008431
lea rcx, [rbp + 0x6e0]
call fcn.180004dc0
mov rbx, rax
test rax, rax
je 0x18000844b
mov r8, rax
lea rdx, [0x180001960]
mov rcx, rsi
call fcn.18000c5b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x18000844b
mov rcx, r13
call fcn.18000bb7c
lea rdx, [0x180001960]
mov r8, rax
mov rcx, rsi
call fcn.18000bc64
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [rsp + 0x60]
mov qword [rsp + 0x60], rdi
lea rdx, [0x180007a10]
lea rcx, [0x1800019c0]
call fcn.180007090
test eax, eax
js 0x18000848f
mov r8, qword [rsp + 0x60]
lea rdx, [0x1800019e4]
shr r8, 0x14
mov rcx, rsi
call fcn.18000c448
or r14, 0xffffffffffffffff
mov r15d, 0x104
cmp qword [0x180027678], rdi
jne 0x180008518
mov edx, r15d
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea r9, [rbp - 0x80]
mov r8d, r15d
lea rdx, [0x180001084]
lea rcx, [rbp - 0x80]
call fcn.1800049fc
lea r9, [rbp - 0x80]
mov r8d, r15d
lea rdx, [0x180001a00]
lea rcx, [rbp - 0x80]
call fcn.1800049fc
lea rcx, [rbp - 0x80]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
jne 0x1800084f8
mov qword [0x180027678], rdi
jmp 0x1800086f5
lea rdx, [0x1800019f0]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x180027678], rax
test rax, rax
je 0x1800086f5
mov edx, 0x2c0
xor ecx, ecx
mov dword [rbp + 0x930], edx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x38], rax
mov rdi, rax
test rax, rax
je 0x1800086f3
lea rdx, [rbp + 0x930]
mov rcx, rax
call qword [0x180027678]
cmp eax, 0x6f
jne 0x180008589
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [rbp + 0x930]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov qword [rsp + 0x38], rax
mov rdi, rax
test rax, rax
je 0x1800086f3
lea rdx, [rbp + 0x930]
mov rcx, rax
call qword [0x180027678]
test eax, eax
jne 0x1800086ea
lea rdx, [0x180001a10]
mov rcx, rsi
call fcn.18000c400
mov rsi, rax
lea r13, [rbp - 0x80]
lea rax, [rdi + 0x110]
mov r15, rdi
mov qword [rbp + 0x948], rax
mov rdi, rax
mov rcx, rsi
call fcn.18000c2c0
mov rcx, rdi
mov r12, rax
call fcn.180004ed8
mov r8, rax
lea rdx, [0x180001a18]
mov rcx, r12
mov rbx, rax
call fcn.18000c5b0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor ecx, ecx
mov ebx, ecx
mov byte [rbp - 0x80], cl
cmp dword [r15 + 0x194], ecx
jbe 0x18000863e
mov eax, ebx
lea rdx, [0x180001a24]
lea rcx, [rsp + 0x68]
movzx r8d, byte [rax + r15 + 0x198]
call qword [sym.imp.USER32.dll_wsprintfA]
lea r9, [rbp - 0x80]
mov r8d, 0x80
lea rdx, [rsp + 0x68]
lea rcx, [rbp - 0x80]
call fcn.1800049fc
inc ebx
cmp ebx, dword [r15 + 0x194]
jb 0x1800085fc
xor ecx, ecx
lea rdx, [rbp - 0x80]
mov rax, r14
inc rax
cmp byte [rdx + rax], cl
jne 0x180008645
mov byte [rax + r13 - 1], cl
lea rcx, [rbp - 0x80]
call fcn.18000bb7c
mov r8, rax
lea rdx, [0x180001a2c]
mov rcx, r12
call fcn.18000bc64
lea rbx, [r15 + 0x1b8]
mov r15, qword [r15]
test rbx, rbx
je 0x1800086da
lea rcx, [rbx + 8]
lea rdx, [0x180001a30]
call fcn.180025cc8
test eax, eax
je 0x1800086d1
lea rdx, [0x180001a38]
mov rcx, r12
call fcn.18000c400
mov r12, rax
xor edi, edi
lea rcx, [rbx + 8]
test rcx, rcx
jne 0x1800086b2
mov rax, rdi
jmp 0x1800086b7
call fcn.18000bb7c
mov rdx, rax
mov rcx, r12
call fcn.18000bd44
mov rbx, qword [rbx]
test rbx, rbx
jne 0x1800086a4
mov rdi, qword [rbp + 0x948]
test r15, r15
jne 0x1800085bb
mov rsi, qword [rsp + 0x48]
mov r15d, 0x104
mov rdi, qword [rsp + 0x38]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_LocalFree]
xor edi, edi
lea rdx, [0x180001a40]
mov rcx, rsi
call fcn.18000c3b8
mov r8, rax
lea rdx, [0x180007a94]
lea rcx, [0x180001a50]
call fcn.180007090
cmp byte [0x180027690], dil
jne 0x180008732
xor r8d, r8d
lea rcx, [0x180027690]
call fcn.180005038
lea rcx, [0x180027690]
call fcn.18000bb7c
mov r8, rax
lea rdx, [0x180001a80]
mov rcx, rsi
call fcn.18000bc64
cmp byte [section..data], dil
mov r12d, 1
je 0x180008883
xor eax, eax
mov byte [section..data], dil
mov qword [rsp + 0x38], rax
xor ecx, ecx
mov qword [rsp + 0x40], rax
mov eax, r12d
cpuid
mov dword [rsp + 0x40], ecx
mov r8d, edx
mov byte [0x180027648], dil
lea rdx, [0x1800010d0]
lea rcx, [0x180027648]
mov dword [rsp + 0x3c], ebx
mov edi, eax
call qword [sym.imp.USER32.dll_wsprintfA]
mov r8d, edi
lea rdx, [0x1800010d0]
lea rcx, [0x180027650]
call qword [sym.imp.USER32.dll_wsprintfA]
mov ebx, 0x100
lea rcx, [rbp - 0x80]
mov r8d, ebx
xor edx, edx
call fcn.180025ca4
call fcn.180005760
xor edi, edi
cmp qword [0x1800274f0], rdi
je 0x1800087ef
lea rdx, [rbp - 0x80]
lea rcx, [0x1800010f8]
call fcn.1800058b0
call fcn.180005838
lea rcx, [rbp - 0x80]
mov rax, r14
inc rax
cmp word [rcx + rax*2], di
jne 0x1800087fb
add eax, r12d
cmp eax, r15d
jg 0x180008823
lea r8, [rbp - 0x80]
lea rdx, [0x18000112c]
lea rcx, [0x180027790]
call fcn.18000542c
mov r8, rbx
lea rcx, [rbp - 0x80]
xor edx, edx
call fcn.180025ca4
call fcn.180005760
cmp qword [0x1800274f0], rdi
je 0x18000884f
lea rdx, [rbp - 0x80]
lea rcx, [0x180001130]
call fcn.1800058b0
call fcn.180005838
lea rcx, [rbp - 0x80]
mov rax, r14
inc rax
cmp word [rcx + rax*2], di
jne 0x18000885b
add eax, r12d
cmp eax, r15d
jg 0x180008883
lea r8, [rbp - 0x80]
lea rdx, [0x18000112c]
lea rcx, [0x180027530]
call fcn.18000542c
lea rcx, [0x180027648]
call fcn.18000bb7c
mov r8, rax
lea rdx, [0x180001a88]
mov rcx, rsi
call fcn.18000bc64
lea rcx, [0x180027790]
call fcn.18000bb7c
mov r8, rax
lea rdx, [0x180001a90]
mov rcx, rsi
call fcn.18000bc64
lea rcx, [0x180027530]
call fcn.18000bb7c
mov r8, rax
lea rdx, [0x180001a98]
mov rcx, rsi
call fcn.18000bc64
call fcn.1800050d0
test rax, rax
je 0x1800088f5
mov ecx, dword [rax + 4]
mov eax, dword [rax + 8]
lea edx, [rcx + rcx*4]
lea ecx, [rax + rdx*2]
jmp 0x1800088fa
mov ecx, 0x3c
cmp ecx, 0x3c
jge 0x1800089f9
lea rax, [rsp + 0x38]
mov dword [rsp + 0x48], edi
mov r9d, 0x20019
mov qword [rsp + 0x20], rax
xor r8d, r8d
mov dword [rbp + 0x930], 4
lea rdx, [0x180001ac0]
mov qword [rsp + 0x38], rdi
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x18000897d
mov rcx, qword [rsp + 0x38]
lea rax, [rbp + 0x930]
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x948]
xor r8d, r8d
mov qword [rsp + 0x20], rdi
lea rdx, [0x180001aa8]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
test eax, eax
je 0x1800089aa
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea r8, [0x18000175a]
lea rdx, [0x180001b28]
mov rcx, rsi
call fcn.18000c5b0
mov rax, rsi
add rsp, 0x9e8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
lea rax, [rbp + 0x930]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea r9, [rbp + 0x948]
lea rax, [rsp + 0x48]
lea rdx, [0x180001aa8]
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov rcx, qword [rsp + 0x38]
test eax, eax
jne 0x180008977
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [rbp + 0x948], 4
jne 0x18000897d
mov r14d, dword [rsp + 0x48]
jmp 0x180008a9b
mov edx, 2
mov qword [rbp + 0x948], rdi
xor ecx, ecx
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov ebx, eax
mov eax, 0x80000000
lea ecx, [rbx + rax]
test eax, ecx
jne 0x180008a23
cmp ebx, 0x80010106
jne 0x180008a7f
lea rax, [rbp + 0x948]
mov r8d, r12d
lea r9, [0x180001030]
mov qword [rsp + 0x20], rax
xor edx, edx
lea rcx, [0x180001040]
call qword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x180008a7f
mov rcx, qword [rbp + 0x948]
lea r8, [rbp + 0x930]
mov word [rbp + 0x930], di
mov edx, 2
mov rax, qword [rcx]
call qword [rax + 0x40]
test eax, eax
js 0x180008a7f
cmp word [rbp + 0x930], di
mov eax, edi
setne al
mov r14d, eax
mov rcx, qword [rbp + 0x948]
test rcx, rcx
je 0x180008a91
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
test ebx, ebx
js 0x180008a9b
call qword [sym.imp.ole32.dll_CoUninitialize]
test r14d, r14d
jne 0x180008aac
lea r8, [0x180001b1c]
jmp 0x180008984
lea r8, [0x18000175a]
cmp r14d, r12d
lea rax, [0x180001b20]
cmovne rax, r8
mov r8, rax
jmp 0x180008984