000000014001C1DE | 48 8D 15 E3 31 FF FF | lea rdx,qword ptr ds:[14000F3C8] | 14000F3C8:"OnlineVersion"
000000014001C1E5 | 45 33 C9 | xor r9d,r9d |
000000014001C1E8 | 45 33 C0 | xor r8d,r8d |
000000014001C1EB | C7 84 24 58 08 00 00 00 | mov dword ptr ss:[rsp+858],400 |
000000014001C1F6 | 48 89 44 24 20 | mov qword ptr ss:[rsp+20],rax | rax:EntryPoint
000000014001C1FB | FF 15 27 4E FE FF | call qword ptr ds:[<&RegQueryValueExA>] |
000000014001C201 | 85 C0 | test eax,eax |
000000014001C203 | 0F 85 F6 01 00 00 | jne unlocker.14001C3FF |
000000014001C209 | 48 8D 94 24 A0 02 00 00 | lea rdx,qword ptr ss:[rsp+2A0] | rdx:EntryPoint
000000014001C211 | 66 B9 01 01 | mov cx,101 |
000000014001C215 | E8 74 02 00 00 | call <unlocker.WSAStartup> |
000000014001C21A | 85 C0 | test eax,eax |
000000014001C21C | 0F 85 CF 01 00 00 | jne unlocker.14001C3F1 |
000000014001C222 | 8D 50 01 | lea edx,dword ptr ds:[rax+1] |
000000014001C225 | 8D 48 02 | lea ecx,dword ptr ds:[rax+2] |
000000014001C228 | 45 33 C0 | xor r8d,r8d |
000000014001C22B | E8 58 02 00 00 | call <unlocker.socket> |
000000014001C230 | 48 83 F8 FF | cmp rax,FFFFFFFFFFFFFFFF |
000000014001C234 | 48 8B F8 | mov rdi,rax |
000000014001C237 | 0F 84 B4 01 00 00 | je unlocker.14001C3F1 |
000000014001C23D | 48 8D 0D 6C 31 FF FF | lea rcx,qword ptr ds:[14000F3B0] | 14000F3B0:"www.emptyloop.com"
000000014001C244 | E8 39 02 00 00 | call <unlocker.gethostbyname> |
000000014001C249 | 48 85 C0 | test rax,rax |
000000014001C24C | 0F 84 9F 01 00 00 | je unlocker.14001C3F1 |
000000014001C252 | 48 8B 48 18 | mov rcx,qword ptr ds:[rax+18] |
000000014001C256 | 66 C7 44 24 48 02 00 | mov word ptr ss:[rsp+48],2 |
000000014001C25D | 48 8B 11 | mov rdx,qword ptr ds:[rcx] |
000000014001C260 | 8B 0A | mov ecx,dword ptr ds:[rdx] |
000000014001C262 | 89 4C 24 4C | mov dword ptr ss:[rsp+4C],ecx |
000000014001C266 | 66 B9 50 00 | mov cx,50 | 50:'P'
000000014001C26A | E8 0D 02 00 00 | call <unlocker.ntohs> |
000000014001C26F | 48 8D 54 24 48 | lea rdx,qword ptr ss:[rsp+48] | rdx:EntryPoint
000000014001C274 | 41 B8 10 00 00 00 | mov r8d,10 |
000000014001C27A | 48 8B CF | mov rcx,rdi |
000000014001C27D | 66 89 44 24 4A | mov word ptr ss:[rsp+4A],ax |
000000014001C282 | E8 EF 01 00 00 | call <unlocker.connect> |
000000014001C287 | 85 C0 | test eax,eax |
000000014001C289 | 0F 85 62 01 00 00 | jne unlocker.14001C3F1 |
000000014001C28F | 48 8D 4C 24 60 | lea rcx,qword ptr ss:[rsp+60] |
000000014001C294 | 48 8D 15 D5 30 FF FF | lea rdx,qword ptr ds:[14000F370] | 14000F370:"GET /unlocker/version.txt HTTP/1.0\r\nHost: www.emptyloop.com\r\n\r\n"
|
