Function at 0x14000895c
Capabilities:
Check http status code
Get session user name
Impersonate user
Initialize winhttp library
Prepare http request
Read file on windows
Read http header
Receive http response
Terminate process

Disassembly:
mov qword [rsp + 0x20], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
mov eax, 0x3d60
call fcn.14001f7f4
sub rsp, rax
mov rax, qword [0x140027028]
xor rax, rsp
mov qword [rsp + 0x3d50], rax
mov r14, qword [rsp + 0x3dc8]
mov rdi, qword [rsp + 0x3dd8]
xor eax, eax
lea ebx, [rax + 0x38]
mov qword [rsp + 0xc8], rcx
mov rbp, r8
mov qword [rsp + 0x90], r8
mov qword [rsp + 0xa0], rdx
lea rcx, [rsp + 0x120]
or r13, 0xffffffffffffffff
mov r8, rbx
xor edx, edx
mov r12, r9
mov qword [rsp + 0x70], rax
mov r15d, eax
mov dword [rsp + 0x40], eax
mov dword [rsp + 0x78], eax
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x48], rax
mov rsi, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x98], rax
mov dword [rsp + 0x6c], eax
mov dword [rsp + 0xd8], 0x100
call fcn.140014560
lea eax, [rsi + 1]
mov dword [rsp + 0x124], eax
mov dword [rsp + 0x120], ebx
call fcn.140005870
mov rcx, qword [0x1400284a8]
lea r8, [rsp + 0x70]
lea rdx, str.system:write
mov rax, qword [rcx]
call qword [rax + 0x40]
mov ebx, eax
test eax, eax
js 0x140009832
mov ebx, 0x2608
lea rcx, [rsp + 0x1d0]
xor edx, edx
mov r8, rbx
call fcn.140014560
mov rsi, qword [rsp + 0xa0]
lea r9, [rsp + 0x1d0]
mov rax, qword [rsi]
mov r8, rdi
xor edx, edx
mov rcx, rsi
mov dword [rsp + 0x1d0], ebx
mov dword [rsp + 0x1d4], 0x4000000
call qword [rax + 0x38]
mov ebx, eax
test eax, eax
js 0x140008aaa
mov rax, qword [rsi]
mov rcx, rsi
call qword [rax + 0x30]
test eax, eax
je 0x140008ab8
mov ebx, 0x80004004
mov rdi, r15
mov rsi, r15
mov rbp, rsi
jmp 0x14000910d
mov rax, qword [rdi]
mov rdx, qword [rsp + 0xc8]
mov rcx, rdi
call qword [rax + 0x10]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x27e0]
mov r15d, eax
mov dword [rsp + 0xd0], eax
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov rdi, qword [rsp + 0xc8]
lea r11, [rsp + 0x27e0]
lea rdx, [rsp + 0x120]
mov rcx, rdi
mov qword [rsp + 0x128], r11
call qword [sym.imp.USERENV.dll_LoadUserProfileA]
mov ecx, dword [rsp + 0x78]
mov rdx, rdi
test eax, eax
mov eax, 1
cmovne ecx, eax
mov dword [rsp + 0x78], ecx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
xor edi, edi
cmp eax, edi
jne 0x140008b51
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, edi
cmovle ebx, eax
cmp ebx, edi
jl 0x140009824
mov ecx, 1
mov dword [rsp + 0x40], ecx
cmp r15d, 2
je 0x1400093a1
cmp r15d, 3
je 0x1400093a1
cmp r15d, 4
jne 0x14000938e
lea r8d, [rcx + 0x5f]
lea rcx, [rsp + 0x168]
xor edx, edx
mov dword [rsp + 0x68], 0x824
xor r15b, r15b
call fcn.140014560
lea rax, [rsp + 0x28e0]
mov r13d, 0x80000000
lea r9, [rsp + 0x160]
mov qword [rsp + 0x178], rax
lea rax, [rsp + 0x2af0]
lea rcx, [rsp + 0x1790]
mov r8d, r13d
xor edx, edx
mov dword [rsp + 0x160], 0x68
mov qword [rsp + 0x1a8], rax
mov dword [rsp + 0x180], 0x104
mov dword [rsp + 0x1b0], 0x104
call qword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
test eax, eax
jne 0x140008c2a
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, 0x80070000
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x140008c2f
mov r13, qword [rsp + 0x60]
mov rdi, qword [rsp + 0x58]
mov rsi, rdi
mov rbp, rdi
jmp 0x140009108
mov edi, 0x80070000
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x2d00]
lea rcx, [rsp + 0x160]
mov edx, r13d
call qword [sym.imp.WINHTTP.dll_WinHttpCreateUrl]
test eax, eax
jne 0x140008c65
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140008c15
and dword [rsp + 0x20], 0
lea rcx, [0x140021058]
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rbp, rax
mov qword [rsp + 0x48], rax
test rax, rax
jne 0x140008ca4
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, edi
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140009812
xor ebp, ebp
mov rdi, rbp
and dword [rsp + 0x88], 0
and dword [rsp + 0x7c], 0
mov dword [rsp + 0xd4], 4
test rdi, rdi
je 0x140008ccf
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x50]
test rcx, rcx
je 0x140008cdf
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rsp + 0x48]
lea rdx, [rsp + 0x28e0]
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov rsi, rax
mov qword [rsp + 0x50], rax
test rax, rax
jne 0x140008d21
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14000983a
and dword [rsp + 0x30], 0
and qword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
lea r8, [rsp + 0x2af0]
lea rdx, [0x140021330]
xor r9d, r9d
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rdi, rax
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x140008d76
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14000983a
xor esi, esi
and dword [rsp + 0xa8], 0
xor eax, eax
lea rcx, [rsp + 0xe0]
lea r8d, [rax + 0x20]
xor edx, edx
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xb8], rax
call fcn.140014560
and qword [rsp + 0x108], 0
and qword [rsp + 0x110], 0
and dword [rsp + 0x118], 0
mov edx, 1
xor edi, edi
mov dword [rsp + 0x100], edx
mov dword [rsp + 0x11c], edx
mov dword [rsp + 0x104], 3
mov ecx, esi
test esi, esi
je 0x140008e93
sub ecx, edx
je 0x140008e03
cmp ecx, edx
jne 0x140008f1d
mov dword [rsp + 0xa8], edx
mov edi, edx
jmp 0x140008f00
lea rcx, [rsp + 0xe0]
call qword [sym.imp.WINHTTP.dll_WinHttpGetIEProxyConfigForCurrentUser]
test eax, eax
je 0x140008f1d
cmp qword [rsp + 0xf0], rdi
je 0x140008f1d
mov edx, 0x208
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov edx, 0x208
xor ecx, ecx
mov qword [rsp + 0xb0], rax
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, qword [rsp + 0xb0]
mov qword [rsp + 0xb8], rax
test rcx, rcx
je 0x140008f1d
test rax, rax
je 0x140008f1d
mov r8, qword [rsp + 0xf0]
or r9, 0xffffffffffffffff
mov edx, 0x104
mov dword [rsp + 0xa8], 3
call fcn.140014638
mov edi, 1
jmp 0x140008f00
lea rcx, [rsp + 0xe0]
call qword [sym.imp.WINHTTP.dll_WinHttpGetIEProxyConfigForCurrentUser]
test eax, eax
je 0x140008f1d
cmp dword [rsp + 0xe0], edi
je 0x140008f1d
mov rax, qword [rsp + 0xe8]
test rax, rax
je 0x140008ecb
or dword [rsp + 0x100], 2
mov qword [rsp + 0x108], rax
mov rcx, qword [rsp + 0x48]
mov eax, 1
lea r9, [rsp + 0xa8]
lea r8, [rsp + 0x100]
lea rdx, [rsp + 0x2d00]
mov dword [rsp + 0x11c], eax
call qword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
mov edi, eax
test eax, eax
je 0x140008f1d
mov rcx, qword [rsp + 0x48]
mov r9d, 0x18
lea r8, [rsp + 0xa8]
lea edx, [r9 + 0xe]
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov rcx, qword [rsp + 0xe8]
test rcx, rcx
je 0x140008f39
call qword [sym.imp.KERNEL32.dll_GlobalFree]
and qword [rsp + 0xe8], 0
mov rcx, qword [rsp + 0xf0]
test rcx, rcx
je 0x140008f55
call qword [sym.imp.KERNEL32.dll_GlobalFree]
and qword [rsp + 0xf0], 0
mov rcx, qword [rsp + 0xf8]
test rcx, rcx
je 0x140008f71
call qword [sym.imp.KERNEL32.dll_GlobalFree]
and qword [rsp + 0xf8], 0
mov rcx, qword [rsp + 0xb0]
test rcx, rcx
je 0x140008f8d
call qword [sym.imp.KERNEL32.dll_GlobalFree]
and qword [rsp + 0xb0], 0
mov rax, qword [rsp + 0xb8]
test rax, rax
je 0x140008fac
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalFree]
and qword [rsp + 0xb8], 0
test edi, edi
mov rdi, qword [rsp + 0x58]
je 0x140008fde
and qword [rsp + 0x30], 0
and dword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
jne 0x1400091cb
inc esi
cmp esi, 3
jl 0x140008d78
mov esi, 1
test r15b, r15b
jne 0x140008ffb
test ebx, ebx
js 0x1400090f9
xor edx, edx
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x140009012
test ebx, ebx
js 0x1400090f9
lea rax, [rsp + 0x7c]
lea r9, [rsp + 0x88]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0xd4]
mov edx, 0x20000013
mov rcx, rdi
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x140009062
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x1400090f9
mov eax, dword [rsp + 0x88]
cmp eax, 0x194
ja 0x140009256
je 0x14000929c
cmp eax, 0xc8
je 0x140009252
cmp eax, 0x12c
jbe 0x1400092a6
cmp eax, 0x12f
ja 0x140009284
and dword [rsp + 0x7c], 0
lea rax, [rsp + 0x7c]
xor r8d, r8d
mov qword [rsp + 0x28], rax
lea rax, [rsp + 0x68]
lea r9, [rsp + 0x2d00]
lea edx, [r8 + 0x33]
mov rcx, rdi
mov dword [rsp + 0x68], 0x824
mov qword [rsp + 0x20], rax
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
test eax, eax
jne 0x1400091d8
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov ebp, 0x80070000
movzx ebx, ax
or ebx, ebp
test eax, eax
cmovle ebx, eax
test ebx, ebx
jns 0x1400091dd
mov r13, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x50]
mov rbp, qword [rsp + 0x48]
mov r15d, dword [rsp + 0x40]
mov rcx, qword [rsp + 0xa0]
mov rax, qword [rcx]
call qword [rax + 0xc8]
mov rax, qword [rsp + 0x98]
test rax, rax
je 0x14000913c
xor edx, edx
mov r8d, 0x8000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_VirtualFree]
test rdi, rdi
je 0x14000914a
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
xor edi, edi
cmp rsi, rdi
je 0x14000915a
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
cmp rbp, rdi
je 0x140009168
mov rcx, rbp
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
cmp r13, 0xffffffffffffffff
je 0x140009177
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r15d, edi
je 0x140009844
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_SetThreadToken]
cmp eax, edi
jne 0x140009844
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, 0xc0000015
mov qword [rsp + 0x28], rdi
movzx ebx, ax
mov qword [rsp + 0x20], rdi
or ebx, 0x80070000
cmp eax, edi
cmovle ebx, eax
xor r9d, r9d
xor r8d, r8d
mov ecx, ebx
call fcn.140013084
mov ecx, ebx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, 1
mov r15b, sil
jmp 0x140008fee
mov ebp, 0x80070000
lea r9, [rsp + 0x160]
lea rcx, [rsp + 0x2d00]
xor r8d, r8d
xor edx, edx
call qword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
test eax, eax
jne 0x140009214
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, ebp
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x1400090f9
lea r9, [rsp + 0x68]
lea r8, [rsp + 0x2d00]
lea rcx, [rsp + 0x160]
mov edx, r13d
call qword [sym.imp.WINHTTP.dll_WinHttpCreateUrl]
test eax, eax
jne 0x14000924e
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, ebp
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x1400090f9
mov ebp, esi
jmp 0x140009277
xor ebp, ebp
jmp 0x140009277
cmp eax, 0x198
je 0x140009272
cmp eax, 0x1f5
jbe 0x1400092a6
cmp eax, 0x1f7
jbe 0x14000929c
cmp eax, 0x1f8
jne 0x1400092a6
mov ebx, 0x80070102
test ebx, ebx
jne 0x1400092b0
test ebp, ebp
je 0x1400092b6
jmp 0x140008ca9
cmp eax, 0x191
je 0x140009292
cmp eax, 0x193
jne 0x1400092a6
mov ebx, 0x80070005
jmp 0x1400090f9
mov ebx, 0x80070002
jmp 0x1400090f9
mov ebx, 0x8000ffff
jmp 0x1400090f9
js 0x1400090f9
lea rdx, [rsp + 0x80]
mov rcx, rdi
call fcn.14001400c
mov ebx, eax
test eax, eax
js 0x1400090f9
test r12, r12
je 0x14000935a
mov eax, dword [rsp + 0x84]
cmp eax, dword [r12 + 4]
jb 0x140009311
jne 0x1400092f6
mov eax, dword [r12]
cmp dword [rsp + 0x80], eax
jbe 0x140009311
mov rcx, qword [rsp + 0xa0]
xor r8d, r8d
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0xa0]
xor r12d, r12d
jmp 0x140009362
mov esi, dword [rsp + 0x3dd0]
xor edi, edi
test esi, esi
je 0x14000934e
mov rdx, qword [r14]
mov rcx, qword [rsp + 0x70]
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
or r9, 0xffffffffffffffff
lea r8d, [r9 + 4]
call fcn.14000f2b4
mov ebx, eax
test eax, eax
js 0x140009350
inc edi
add r14, 8
cmp edi, esi
jb 0x14000931e
xor ebx, ebx
mov rdi, qword [rsp + 0x58]
jmp 0x1400090f9
mov r12, qword [rsp + 0x90]
lea rdx, [rsp + 0xc0]
mov rcx, rdi
call fcn.140013fa4
mov r13, qword [rsp + 0x60]
mov ebx, eax
test eax, eax
js 0x1400090fe
mov r15d, dword [rsp + 0xd0]
jmp 0x1400094d3
mov ebx, 0x8007000f
mov r15d, ecx
mov rsi, rdi
mov rbp, rdi
jmp 0x14000910d
mov eax, 0x8000080
cmp r15d, 2
jne 0x1400093b4
cmp dword [0x140028488], edi
je 0x1400093c2
cmp r15d, 3
jne 0x1400093c7
cmp dword [0x140028490], edi
jne 0x1400093c7
mov eax, 0x28000080
mov r8d, ecx
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], eax
lea rcx, [rsp + 0x1790]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x20], 3
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov r13, rax
mov qword [rsp + 0x60], rax
cmp rax, 0xffffffffffffffff
jne 0x14000941b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
cmp eax, edi
cmovle ebx, eax
cmp ebx, edi
jl 0x14000980d
lea rdx, [rsp + 0x80]
mov rcx, r13
call fcn.140010bac
cmp eax, edi
mov ebx, eax
jl 0x14000980d
cmp r12, rdi
je 0x14000947a
mov eax, dword [rsp + 0x84]
cmp eax, dword [r12 + 4]
jb 0x14000951f
jne 0x14000945f
mov eax, dword [r12]
cmp dword [rsp + 0x80], eax
jbe 0x14000951f
mov rax, qword [rsi]
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [rax + 0xa0]
xor ebp, ebp
mov qword [rsp + 0x90], rbp
lea rdx, [rsp + 0xc0]
mov rcx, r13
call fcn.1400108c8
mov ebx, eax
test eax, eax
js 0x14000980d
test rbp, rbp
jle 0x1400094cb
xor r9d, r9d
xor r8d, r8d
mov rdx, rbp
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
jne 0x1400094cb
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x14000980d
mov r12, qword [rsp + 0x90]
mov esi, dword [rsp + 0x3dd0]
xor edi, edi
test esi, esi
je 0x14000956e
mov rbp, r14
mov rcx, qword [rbp]
mov rdx, qword [rsp + 0xc0]
lea r9, [rsp + 0x80]
mov rax, qword [rcx]
mov r8, r12
call qword [rax + 0x48]
mov ebx, eax
test eax, eax
js 0x140009803
mov edx, 1
add rbp, 8
add edi, edx
cmp edi, esi
jb 0x1400094e7
jmp 0x140009573
mov esi, dword [rsp + 0x3dd0]
test esi, esi
je 0x14000955e
mov rdx, qword [r14]
mov rcx, qword [rsp + 0x70]
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
or r9, 0xffffffffffffffff
lea r8d, [r9 + 4]
call fcn.14000f2b4
mov ebx, eax
test eax, eax
js 0x140008c1a
inc edi
add r14, 8
cmp edi, esi
jb 0x14000952a
xor ebx, ebx
mov rdi, rbx
mov rsi, rbx
mov rbp, rbx
jmp 0x140009108
mov edx, 1
cmp qword [rsp + 0xc0], 0
jne 0x1400095f3
xor edi, edi
test esi, esi
je 0x14000934e
or rbp, 0xffffffffffffffff
mov rcx, qword [rsp + 0x70]
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov r8d, edx
mov rdx, qword [r14]
mov r9, rbp
call fcn.14000f2b4
mov ebx, eax
test eax, eax
js 0x140009803
mov rdx, qword [r14]
mov rcx, qword [rsp + 0x70]
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov r9, rbp
mov r8d, 2
call fcn.14000f2b4
mov ebx, eax
test eax, eax
js 0x140009803
mov edx, 1
add r14, 8
add edi, edx
cmp edi, esi
jb 0x14000958c
jmp 0x14000934e
mov ecx, r15d
sub ecx, 2
je 0x140009624
sub ecx, edx
je 0x14000961c
cmp ecx, edx
je 0x14000960a
mov edi, 0x10000
jmp 0x14000963b
mov eax, dword [0x14002849c]
mov ecx, dword [0x140028480]
lea edi, [rax + rcx - 1]
jmp 0x140009634
mov eax, dword [0x140028494]
jmp 0x140009610
mov ecx, dword [0x140028480]
mov eax, dword [0x14002848c]
lea edi, [rax + rcx - 1]
lea eax, [rcx - 1]
not eax
and edi, eax
xor ecx, ecx
mov edx, edi
mov r8d, 0x3000
lea r9d, [rcx + 4]
call qword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov r12, rax
mov qword [rsp + 0x98], rax
test rax, rax
jne 0x14000967b
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x140009803
movsxd r13, r15d
test ebx, ebx
jne 0x14000934e
mov r15, qword [rsp + 0x58]
jmp 0x140009695
mov r12, qword [rsp + 0x98]
mov rcx, qword [rsp + 0xa0]
mov rax, qword [rcx]
call qword [rax + 0x30]
test eax, eax
jne 0x1400097b7
cmp r13, 2
je 0x1400096cd
cmp r13, 3
je 0x1400096cd
lea r9, [rsp + 0x6c]
mov r8d, edi
mov rdx, r12
mov rcx, r15
call qword [sym.imp.WINHTTP.dll_WinHttpReadData]
jmp 0x1400096e9
mov rcx, qword [rsp + 0x60]
and qword [rsp + 0x20], 0
lea r9, [rsp + 0x6c]
mov r8d, edi
mov rdx, r12
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x140009709
call qword [sym.imp.KERNEL32.dll_GetLastError]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
test ebx, ebx
js 0x1400097fb
mov eax, dword [rsp + 0x6c]
test eax, eax
je 0x140009762
xor r12d, r12d
test esi, esi
je 0x1400097aa
mov rbp, r14
mov rdx, qword [rbp]
mov rcx, qword [rsp + 0x70]
mov dword [rsp + 0x28], eax
mov rax, qword [rsp + 0x98]
or r9, 0xffffffffffffffff
lea r8d, [r9 + 2]
mov qword [rsp + 0x20], rax
call fcn.14000f2b4
mov ebx, eax
test eax, eax
js 0x1400097fb
inc r12d
add rbp, 8
cmp r12d, esi
jae 0x1400097aa
mov eax, dword [rsp + 0x6c]
jmp 0x14000971f
xor ebp, ebp
test esi, esi
je 0x1400097a3
mov r12, r14
mov rdx, qword [r12]
mov rcx, qword [rsp + 0x70]
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
or r9, 0xffffffffffffffff
lea r8d, [r9 + 3]
call fcn.14000f2b4
mov ebx, eax
test eax, eax
js 0x1400097fb
mov eax, 1
add r12, 8
add ebp, eax
cmp ebp, esi
jb 0x14000976b
jmp 0x1400097a8
mov eax, 1
mov ebx, eax
test ebx, ebx
je 0x14000968d
jmp 0x14000934e
xor edi, edi
test esi, esi
je 0x14000934e
or rbp, 0xffffffffffffffff
mov rdx, qword [r14]
mov rcx, qword [rsp + 0x70]
and dword [rsp + 0x28], 0
and qword [rsp + 0x20], 0
mov r9, rbp
mov r8d, 4
call fcn.14000f2b4
mov ebx, eax
test eax, eax
js 0x1400097fb
inc edi
add r14, 8
cmp edi, esi
jb 0x1400097c5
jmp 0x14000934e
mov rdi, r15
jmp 0x1400090f9
mov rdi, qword [rsp + 0x58]
jmp 0x1400090fe
jmp 0x140008c1f
mov rdi, qword [rsp + 0x58]
mov r13, qword [rsp + 0x60]
mov rsi, rdi
jmp 0x140009108
mov rsi, rdi
mov rbp, rdi
mov r15d, esi
jmp 0x14000910d
mov rdi, rsi
jmp 0x140008ab0
mov r13, qword [rsp + 0x60]
jmp 0x140009103
cmp dword [rsp + 0x78], edi
je 0x140009860
mov rdx, qword [rsp + 0x150]
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.USERENV.dll_UnloadUserProfile]
mov rcx, qword [rsp + 0x70]
cmp rcx, rdi
je 0x140009870
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, ebx
mov rcx, qword [rsp + 0x3d50]
xor rcx, rsp
call fcn.1400143fc
mov rbx, qword [rsp + 0x3db8]
add rsp, 0x3d60
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret