Function at 0x140008a84
Capabilities:
Check http status code
Get session user name
Impersonate user
Initialize winhttp library
Prepare http request
Read file on windows
Read http header
Receive http response
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x3d60
call fcn.1400200f4
sub rsp, rax
mov rax, qword [0x1400280c8]
xor rax, rsp
mov qword [rsp + 0x3d50], rax
mov r14, qword [rsp + 0x3dc8]
mov rdi, qword [rsp + 0x3dd8]
xor eax, eax
lea ebx, [rax + 0x38]
mov qword [rsp + 0xc8], rcx
mov rbp, r8
mov qword [rsp + 0x90], r8
mov qword [rsp + 0xa0], rdx
lea rcx, [rsp + 0x120]
or r13, 0xffffffffffffffff
mov r8, rbx
xor edx, edx
mov r12, r9
mov qword [rsp + 0x70], rax
mov r15d, eax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x78], eax
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x48], rax
mov rsi, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x6c], eax
mov dword [rsp + 0xd8], 0x100
call fcn.140014860
lea eax, [rsi + 1]
mov dword [rsp + 0x124], eax
mov dword [rsp + 0x120], ebx
call fcn.140005870
mov rcx, qword [0x140029548]
lea r8, [rsp + 0x70]
lea rdx, str.system:write
mov rax, qword [rcx]
call qword [rax + 0x40]
mov ebx, eax
test eax, eax
js 0x14000995a
mov ebx, 0x2608
lea rcx, [rsp + 0x1d0]
xor edx, edx
mov r8, rbx
call fcn.140014860
mov rsi, qword [rsp + 0xa0]
lea r9, [rsp + 0x1d0]
mov rax, qword [rsi]
mov r8, rdi
xor edx, edx
mov rcx, rsi
mov dword [rsp + 0x1d0], ebx
mov dword [rsp + 0x1d4], 0x4000000
call qword [rax + 0x38]
mov ebx, eax
test eax, eax
js 0x140008bd2
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x30]
test eax, eax
je 0x140008be0
mov ebx, 0x80004004
mov rdi, r15
mov rsi, r15
mov rbp, rsi
jmp 0x140009235
mov rax, qword [rdi]
mov rdx, qword [rsp + 0xc8]
mov rcx, rdi
call qword [rax + 0x10]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x27e0]
mov r15d, eax
mov dword [rsp + 0xd0], eax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov rdi, qword [rsp + 0xc8]
lea r11, [rsp + 0x27e0]
lea rdx, [rsp + 0x120]
mov rcx, rdi
mov qword [rsp + 0x128], r11
call qword [sym.imp.USERENV.dll_LoadUserProfileA]
mov ecx, dword [rsp + 0x78]
mov rdx, rdi
test eax, eax
mov eax, 1
cmovne ecx, eax
mov dword [rsp + 0x78], ecx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
xor edi, edi
cmp eax, edi
jne 0x140008c79
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, edi
cmovle ebx, eax
cmp ebx, edi
jl 0x14000994c
mov ecx, 1
mov dword [rsp + 0x40], ecx
cmp r15d, 2
je 0x1400094c9
cmp r15d, 3
je 0x1400094c9
cmp r15d, 4
jne 0x1400094b6
lea r8d, [rcx + 0x5f]
lea rcx, [rsp + 0x168]
xor edx, edx
mov dword [rsp + 0x68], 0x824
xor r15b, r15b
call fcn.140014860
lea rax, [rsp + 0x28e0]
mov r13d, 0x80000000
lea r9, [rsp + 0x160]
mov qword [rsp + 0x178], rax
lea rax, [rsp + 0x2af0]
lea rcx, [rsp + 0x1790]
mov r8d, r13d
xor edx, edx
mov dword [rsp + 0x160], 0x68
mov qword [rsp + 0x1a8], rax
mov dword [rsp + 0x180], 0x104
mov dword [rsp + 0x1b0], 0x104
call qword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
test eax, eax
jne 0x140008d52
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x80070000
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x140008d57
mov r13, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov rsi, rdi
mov rbp, rdi
jmp 0x140009230
mov edi, 0x80070000
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x2d00]
lea rcx, [rsp + 0x160]
mov edx, r13d
call qword [sym.imp.WINHTTP.dll_WinHttpCreateUrl]
test eax, eax
jne 0x140008d8d
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140008d3d
and dword [rsp + 0x20], 0
lea rcx, [0x140021fd8]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rbp, rax
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x140008dcc
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14000993a
xor ebp, ebp
mov rdi, rbp
and dword [rsp + 0x88], 0
and dword [rsp + 0x7c], 0
mov dword [rsp + 0xd4], 4
test rdi, rdi
je 0x140008df7
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140008e07
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x28e0]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov rsi, rax
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x140008e49
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140009962
and dword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x2af0]
lea rdx, [0x1400222f0]
xor r9d, r9d
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rdi, rax
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x140008e9e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140009962
xor esi, esi
and dword [rsp + 0xa8], 0
xor eax, eax
lea rcx, [rsp + 0xe0]
lea r8d, [rax + 0x20]
xor edx, edx
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rax
call fcn.140014860
and qword [rsp + 0x108], 0
and qword [rsp + 0x110], 0
and dword [rsp + 0x118], 0
mov edx, 1
xor edi, edi
mov dword [rsp + 0x100], edx
mov dword [rsp + 0x11c], edx
mov dword [rsp + 0x104], 3
mov ecx, esi
test esi, esi
je 0x140008fbb
sub ecx, edx
je 0x140008f2b
cmp ecx, edx
jne 0x140009045
mov dword [rsp + 0xa8], edx
mov edi, edx
jmp 0x140009028
lea rcx, [rsp + 0xe0]
call qword [sym.imp.WINHTTP.dll_WinHttpGetIEProxyConfigForCurrentUser]
test eax, eax
je 0x140009045
cmp qword [rsp + 0xf0], rdi
je 0x140009045
mov edx, 0x208
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edx, 0x208
xor ecx, ecx
mov qword [rsp + 0xb0], rax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0xb8], rax
test rcx, rcx
je 0x140009045
test rax, rax
je 0x140009045
mov r8, qword [rsp + 0xf0]
or r9, 0xffffffffffffffff
mov edx, 0x104
mov dword [rsp + 0xa8], 3
call fcn.140014938
mov edi, 1
jmp 0x140009028
lea rcx, [rsp + 0xe0]
call qword [sym.imp.WINHTTP.dll_WinHttpGetIEProxyConfigForCurrentUser]
test eax, eax
je 0x140009045
cmp dword [rsp + 0xe0], edi
je 0x140009045
mov rax, qword [rsp + 0xe8]
test rax, rax
je 0x140008ff3
or dword [rsp + 0x100], 2
mov qword [rsp + 0x108], rax
mov rcx, qword [rsp + 0x48]
mov eax, 1
lea r9, [rsp + 0xa8]
lea r8, [rsp + 0x100]
lea rdx, [rsp + 0x2d00]
mov dword [rsp + 0x11c], eax
call qword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
mov edi, eax
test eax, eax
je 0x140009045
mov rcx, qword [rsp + 0x48]
mov r9d, 0x18
lea r8, [rsp + 0xa8]
lea edx, [r9 + 0xe]
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov rcx, qword [rsp + 0xe8]
test rcx, rcx
je 0x140009061
call qword [sym.imp.KERNEL32.dll_GlobalFree]
and qword [rsp + 0xe8], 0
mov rcx, qword [rsp + 0xf0]
test rcx, rcx
je 0x14000907d
call qword [sym.imp.KERNEL32.dll_GlobalFree]
and qword [rsp + 0xf0], 0
mov rcx, qword [rsp + 0xf8]
test rcx, rcx
je 0x140009099
call qword [sym.imp.KERNEL32.dll_GlobalFree]
and qword [rsp + 0xf8], 0
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x1400090b5
call qword [sym.imp.KERNEL32.dll_GlobalFree]
and qword [rsp + 0xb0], 0
mov rax, qword [rsp + 0xb8]
test rax, rax
je 0x1400090d4
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
and qword [rsp + 0xb8], 0
test edi, edi
mov rdi, qword [rsp + 0x58]
je 0x140009106
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x1400092f3
inc esi
cmp esi, 3
jl 0x140008ea0
mov esi, 1
test r15b, r15b
jne 0x140009123
test ebx, ebx
js 0x140009221
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x14000913a
test ebx, ebx
js 0x140009221
lea rax, [rsp + 0x7c]
lea r9, [rsp + 0x88]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xd4]
mov edx, 0x20000013
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x14000918a
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140009221
mov eax, dword [rsp + 0x88]
cmp eax, 0x194
ja 0x14000937e
je 0x1400093c4
cmp eax, 0xc8
je 0x14000937a
cmp eax, 0x12c
jbe 0x1400093ce
cmp eax, 0x12f
ja 0x1400093ac
and dword [rsp + 0x7c], 0
lea rax, [rsp + 0x7c]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x2d00]
lea edx, [r8 + 0x33]
mov rcx, rdi
mov dword [rsp + 0x68], 0x824
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x140009300
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, 0x80070000
movzx ebx, ax
or ebx, ebp
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x140009305
mov r13, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov r15d, dword [rsp + 0x40]
mov rcx, qword [rsp + 0xa0]
mov rax, qword [rcx]
call qword [rax + 0xc8]
mov rax, qword [rsp + 0x98]
test rax, rax
je 0x140009264
xor edx, edx
mov r8d, 0x8000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test rdi, rdi
je 0x140009272
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
xor edi, edi
cmp rsi, rdi
je 0x140009282
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
cmp rbp, rdi
je 0x140009290
mov rcx, rbp
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
cmp r13, 0xffffffffffffffff
je 0x14000929f
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r15d, edi
je 0x14000996c
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
cmp eax, edi
jne 0x14000996c
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0xc0000015
mov qword [rsp + 0x28], rdi
movzx ebx, ax
mov qword [rsp + 0x20], rdi
or ebx, 0x80070000
cmp eax, edi
cmovle ebx, eax
xor r9d, r9d
xor r8d, r8d
mov ecx, ebx
call fcn.140013388
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, 1
mov r15b, sil
jmp 0x140009116
mov ebp, 0x80070000
lea r9, [rsp + 0x160]
lea rcx, [rsp + 0x2d00]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
test eax, eax
jne 0x14000933c
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, ebp
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140009221
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x2d00]
lea rcx, [rsp + 0x160]
mov edx, r13d
call qword [sym.imp.WINHTTP.dll_WinHttpCreateUrl]
test eax, eax
jne 0x140009376
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, ebp
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140009221
mov ebp, esi
jmp 0x14000939f
xor ebp, ebp
jmp 0x14000939f
cmp eax, 0x198
je 0x14000939a
cmp eax, 0x1f5
jbe 0x1400093ce
cmp eax, 0x1f7
jbe 0x1400093c4
cmp eax, 0x1f8
jne 0x1400093ce
mov ebx, 0x80070102
test ebx, ebx
jne 0x1400093d8
test ebp, ebp
je 0x1400093de
jmp 0x140008dd1
cmp eax, 0x191
je 0x1400093ba
cmp eax, 0x193
jne 0x1400093ce
mov ebx, 0x80070005
jmp 0x140009221
mov ebx, 0x80070002
jmp 0x140009221
mov ebx, 0x8000ffff
jmp 0x140009221
js 0x140009221
lea rdx, [rsp + 0x80]
mov rcx, rdi
call fcn.14001430c
mov ebx, eax
test eax, eax
js 0x140009221
test r12, r12
je 0x140009482
mov eax, dword [rsp + 0x84]
cmp eax, dword [r12 + 4]
jb 0x140009439
jne 0x14000941e
mov eax, dword [r12]
cmp dword [rsp + 0x80], eax
jbe 0x140009439
mov rcx, qword [rsp + 0xa0]
xor r8d, r8d
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0xa0]
xor r12d, r12d
jmp 0x14000948a
mov esi, dword [rsp + 0x3dd0]
xor edi, edi
test esi, esi
je 0x140009476
mov rdx, qword [r14]
mov rcx, qword [rsp + 0x70]
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
or r9, 0xffffffffffffffff
lea r8d, [r9 + 4]
call fcn.14000f3dc
mov ebx, eax
test eax, eax
js 0x140009478
inc edi
add r14, 8
cmp edi, esi
jb 0x140009446
xor ebx, ebx
mov rdi, qword [rsp + 0x58]
jmp 0x140009221
mov r12, qword [rsp + 0x90]
lea rdx, [rsp + 0xc0]
mov rcx, rdi
call fcn.1400142a4
mov r13, qword [rsp + 0x60]
mov ebx, eax
test eax, eax
js 0x140009226
mov r15d, dword [rsp + 0xd0]
jmp 0x1400095fb
mov ebx, 0x8007000f
mov r15d, ecx
mov rsi, rdi
mov rbp, rdi
jmp 0x140009235
mov eax, 0x8000080
cmp r15d, 2
jne 0x1400094dc
cmp dword [0x140029528], edi
je 0x1400094ea
cmp r15d, 3
jne 0x1400094ef
cmp dword [0x140029530], edi
jne 0x1400094ef
mov eax, 0x28000080
mov r8d, ecx
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x1790]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
mov qword [rsp + 0x60], rax
cmp rax, 0xffffffffffffffff
jne 0x140009543
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, edi
cmovle ebx, eax
cmp ebx, edi
jl 0x140009935
lea rdx, [rsp + 0x80]
mov rcx, r13
call fcn.140011034
cmp eax, edi
mov ebx, eax
jl 0x140009935
cmp r12, rdi
je 0x1400095a2
mov eax, dword [rsp + 0x84]
cmp eax, dword [r12 + 4]
jb 0x140009647
jne 0x140009587
mov eax, dword [r12]
cmp dword [rsp + 0x80], eax
jbe 0x140009647
mov rax, qword [rsi]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [rax + 0xa0]
xor ebp, ebp
mov qword [rsp + 0x90], rbp
lea rdx, [rsp + 0xc0]
mov rcx, r13
call fcn.1400109f0
mov ebx, eax
test eax, eax
js 0x140009935
test rbp, rbp
jle 0x1400095f3
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1400095f3
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140009935
mov r12, qword [rsp + 0x90]
mov esi, dword [rsp + 0x3dd0]
xor edi, edi
test esi, esi
je 0x140009696
mov rbp, r14
mov rcx, qword [rbp]
mov rdx, qword [rsp + 0xc0]
lea r9, [rsp + 0x80]
mov rax, qword [rcx]
mov r8, r12
call qword [rax + 0x48]
mov ebx, eax
test eax, eax
js 0x14000992b
mov edx, 1
add rbp, 8
add edi, edx
cmp edi, esi
jb 0x14000960f
jmp 0x14000969b
mov esi, dword [rsp + 0x3dd0]
test esi, esi
je 0x140009686
mov rdx, qword [r14]
mov rcx, qword [rsp + 0x70]
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
or r9, 0xffffffffffffffff
lea r8d, [r9 + 4]
call fcn.14000f3dc
mov ebx, eax
test eax, eax
js 0x140008d42
inc edi
add r14, 8
cmp edi, esi
jb 0x140009652
xor ebx, ebx
mov rdi, rbx
mov rsi, rbx
mov rbp, rbx
jmp 0x140009230
mov edx, 1
cmp qword [rsp + 0xc0], 0
jne 0x14000971b
xor edi, edi
test esi, esi
je 0x140009476
or rbp, 0xffffffffffffffff
mov rcx, qword [rsp + 0x70]
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov r8d, edx
mov rdx, qword [r14]
mov r9, rbp
call fcn.14000f3dc
mov ebx, eax
test eax, eax
js 0x14000992b
mov rdx, qword [r14]
mov rcx, qword [rsp + 0x70]
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov r9, rbp
mov r8d, 2
call fcn.14000f3dc
mov ebx, eax
test eax, eax
js 0x14000992b
mov edx, 1
add r14, 8
add edi, edx
cmp edi, esi
jb 0x1400096b4
jmp 0x140009476
mov ecx, r15d
sub ecx, 2
je 0x14000974c
sub ecx, edx
je 0x140009744
cmp ecx, edx
je 0x140009732
mov edi, 0x10000
jmp 0x140009763
mov eax, dword [0x14002953c]
mov ecx, dword [0x140029520]
lea edi, [rax + rcx - 1]
jmp 0x14000975c
mov eax, dword [0x140029534]
jmp 0x140009738
mov ecx, dword [0x140029520]
mov eax, dword [0x14002952c]
lea edi, [rax + rcx - 1]
lea eax, [rcx - 1]
not eax
and edi, eax
xor ecx, ecx
mov edx, edi
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
mov qword [rsp + 0x98], rax
test rax, rax
jne 0x1400097a3
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14000992b
movsxd r13, r15d
test ebx, ebx
jne 0x140009476
mov r15, qword [rsp + 0x58]
jmp 0x1400097bd
mov r12, qword [rsp + 0x98]
mov rcx, qword [rsp + 0xa0]
mov rax, qword [rcx]
call qword [rax + 0x30]
test eax, eax
jne 0x1400098df
cmp r13, 2
je 0x1400097f5
cmp r13, 3
je 0x1400097f5
lea r9, [rsp + 0x6c]
mov r8d, edi
mov rdx, r12
mov rcx, r15
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
jmp 0x140009811
mov rcx, qword [rsp + 0x60]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x6c]
mov r8d, edi
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140009831
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140009923
mov eax, dword [rsp + 0x6c]
test eax, eax
je 0x14000988a
xor r12d, r12d
test esi, esi
je 0x1400098d2
mov rbp, r14
mov rdx, qword [rbp]
mov rcx, qword [rsp + 0x70]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x98]
or r9, 0xffffffffffffffff
lea r8d, [r9 + 2]
mov qword [rsp + 0x20], rax
call fcn.14000f3dc
mov ebx, eax
test eax, eax
js 0x140009923
inc r12d
add rbp, 8
cmp r12d, esi
jae 0x1400098d2
mov eax, dword [rsp + 0x6c]
jmp 0x140009847
xor ebp, ebp
test esi, esi
je 0x1400098cb
mov r12, r14
mov rdx, qword [r12]
mov rcx, qword [rsp + 0x70]
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
or r9, 0xffffffffffffffff
lea r8d, [r9 + 3]
call fcn.14000f3dc
mov ebx, eax
test eax, eax
js 0x140009923
mov eax, 1
add r12, 8
add ebp, eax
cmp ebp, esi
jb 0x140009893
jmp 0x1400098d0
mov eax, 1
mov ebx, eax
test ebx, ebx
je 0x1400097b5
jmp 0x140009476
xor edi, edi
test esi, esi
je 0x140009476
or rbp, 0xffffffffffffffff
mov rdx, qword [r14]
mov rcx, qword [rsp + 0x70]
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov r9, rbp
mov r8d, 4
call fcn.14000f3dc
mov ebx, eax
test eax, eax
js 0x140009923
inc edi
add r14, 8
cmp edi, esi
jb 0x1400098ed
jmp 0x140009476
mov rdi, r15
jmp 0x140009221
mov rdi, qword [rsp + 0x58]
jmp 0x140009226
jmp 0x140008d47
mov rdi, qword [rsp + 0x58]
mov r13, qword [rsp + 0x60]
mov rsi, rdi
jmp 0x140009230
mov rsi, rdi
mov rbp, rdi
mov r15d, esi
jmp 0x140009235
mov rdi, rsi
jmp 0x140008bd8
mov r13, qword [rsp + 0x60]
jmp 0x14000922b
cmp dword [rsp + 0x78], edi
je 0x140009988
mov rdx, qword [rsp + 0x150]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, qword [rsp + 0x70]
cmp rcx, rdi
je 0x140009998
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, ebx
mov rcx, qword [rsp + 0x3d50]
xor rcx, rsp
call fcn.1400146fc
mov rbx, qword [rsp + 0x3db8]
add rsp, 0x3d60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret