Function at 0x140003370
Capabilities:
Create process on windows
Initialize winhttp library
Reference http user-agent string
Terminate process

Disassembly:
mov r11, rsp
mov qword [r11 + 8], rbx
mov qword [r11 + 0x10], rsi
mov qword [r11 + 0x18], rdi
mov qword [r11 + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x260
mov rax, qword [0x1400b21c0]
xor rax, rsp
mov qword [rsp + 0x250], rax
xor edi, edi
mov dword [rsp + 0x34], edi
mov qword [r11 - 0x70], rdi
mov qword [r11 - 0x88], rdi
lea rax, [0x14009b520]
mov qword [r11 - 0x80], rax
lea rsi, str.Mozilla_5.0__compatible__MSIE_9.0__Windows_NT_6.1__Trident_5.0_
mov qword [r11 - 0x78], rsi
xorps xmm0, xmm0
movups xmmword [rsp + 0x110], xmm0
mov qword [r11 - 0x158], rdi
mov qword [r11 - 0x150], 0xf
mov byte [rsp + 0x110], dil
lea ecx, [rdi + 8]
call fcn.140089e00
mov rbx, rax
mov qword [rsp + 0x38], rax
xor eax, eax
mov qword [rbx], rax
lea ecx, [rdi + 1]
call fcn.140089e00
mov qword [rsp + 0x38], rax
mov qword [rbx], rax
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov qword [rsp + 0x1f0], rax
test rax, rax
jne 0x14000347d
mov rdx, qword [rsp + 0x128]
cmp rdx, 0xf
jbe 0x140003478
inc rdx
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003473
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004518
call fcn.14008a07c
jmp 0x140004413
xorps xmm0, xmm0
movups xmmword [rsp + 0x170], xmm0
mov qword [rsp + 0x180], rdi
mov qword [rsp + 0x188], 0xf
mov byte [rsp + 0x170], 0
lea r9, str.start
lea r8, [0x14009a9dc]
lea rdx, [0x140094704]
lea rcx, [rsp + 0x110]
call fcn.140057880
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x38], rax
lea rbx, [0x1400b6b10]
mov rdx, rbx
lea rcx, [rsp + 0xb0]
call fcn.14000d700
mov rdi, rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x68], rax
lea rsi, [0x1400b6ad0]
mov rdx, rsi
lea rcx, [rsp + 0x90]
call fcn.14000d700
mov r14, rax
lea rdx, [0x1400b6b30]
lea rcx, [rsp + 0x70]
call fcn.14000d700
nop
mov r9, rdi
mov r8, r14
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140010a20
nop
cmp qword [rax + 0x18], 0xf
jbe 0x140003544
mov rax, qword [rax]
mov r9, rax
lea r8, [0x14009a9dc]
lea rdx, str.bcde
lea rcx, [rsp + 0x110]
call fcn.140057880
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x1400035a3
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000359e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000359e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008a07c
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x60], rax
mov rdx, rbx
lea rcx, [rsp + 0xb0]
call fcn.14000d700
mov r14, rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x68], rax
mov rdx, rsi
lea rcx, [rsp + 0x90]
call fcn.14000d700
mov rdi, rax
lea rdx, [0x1400b6b50]
lea rcx, [rsp + 0x70]
call fcn.14000d700
nop
mov r9, r14
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140010a20
nop
cmp qword [rax + 0x18], 0xf
jbe 0x140003613
mov rax, qword [rax]
mov r9, rax
lea r8, [0x14009a9dc]
lea rdx, [0x140094794]
lea rcx, [rsp + 0x110]
call fcn.140057880
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140003672
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000366d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000366d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008a07c
lea rax, [rsp + 0xb0]
mov qword [rsp + 0x60], rax
mov rdx, rbx
lea rcx, [rsp + 0xb0]
call fcn.14000d700
mov r14, rax
lea rax, [rsp + 0x90]
mov qword [rsp + 0x68], rax
mov rdx, rsi
lea rcx, [rsp + 0x90]
call fcn.14000d700
mov rdi, rax
lea rdx, [0x1400b6b70]
lea rcx, [rsp + 0x70]
call fcn.14000d700
nop
mov r9, r14
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140010a20
nop
cmp qword [rax + 0x18], 0xf
jbe 0x1400036e2
mov rax, qword [rax]
mov r9, rax
lea r8, [0x14009a9dc]
lea rdx, [0x140094798]
lea rcx, [rsp + 0x110]
call fcn.140057880
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140003741
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000373c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000373c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008a07c
lea r9, [0x1400b6af0]
cmp qword [0x1400b6b08], 0xf
cmova r9, qword [0x1400b6af0]
lea r8, [0x14009a9dc]
lea rdx, [0x14009479c]
lea rcx, [rsp + 0x110]
call fcn.140057880
lea r9, [0x1400b6ab0]
cmp qword [0x1400b6ac8], 0xf
cmova r9, qword [0x1400b6ab0]
lea r8, [0x14009a9dc]
lea rdx, [0x1400947a0]
lea rcx, [rsp + 0x110]
call fcn.140057880
lea rdx, str.https:__api.auth.gg_v6_api.php
lea rcx, [rsp + 0x40]
call fcn.14000d430
lea r9, [rsp + 0x110]
lea r8, [rsp + 0x170]
mov rdx, rax
lea rcx, [rsp + 0x1f0]
call fcn.140058260
lea rdi, [rsp + 0x170]
mov r13, qword [rsp + 0x188]
cmp r13, 0xf
seta r12b
mov r14, qword [rsp + 0x170]
cmova rdi, r14
mov rax, qword [rsp + 0x180]
cmp rax, 1
jb 0x140003851
lea r15, [rax + rdi]
mov r8, r15
sub r8, rdi
mov edx, 0x7c
mov rcx, rdi
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140003851
cmp byte [rax], 0x7c
jne 0x14000382d
xor ecx, ecx
jmp 0x140003832
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x140003899
inc rax
mov r8, r15
sub r8, rax
mov edx, 0x7c
mov rcx, rax
call sub.VCRUNTIME140.dll_memchr
test rax, rax
jne 0x140003824
call fcn.140002a10
call fcn.140003370
nop
test r12b, r12b
je 0x1400044de
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400044d5
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400044d5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
sub rax, rdi
cmp rax, 0xffffffffffffffff
je 0x140003851
lea rax, [rsp + 0x70]
mov qword [rsp + 0x60], rax
cmp qword [0x1400b6b28], 0xf
cmova rbx, qword [0x1400b6b10]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
xor r15d, r15d
mov qword [rsp + 0x80], r15
mov qword [rsp + 0x88], r15
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rbx + r8], r15b
jne 0x1400038e1
mov rdx, rbx
lea rcx, [rsp + 0x70]
call fcn.14000e3b0
nop
lea rax, [rsp + 0x90]
mov qword [rsp + 0x68], rax
cmp qword [0x1400b6ae8], 0xf
cmova rsi, qword [0x1400b6ad0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x90], xmm0
mov qword [rsp + 0xa0], r15
mov qword [rsp + 0xa8], r15
mov r8, rdi
inc r8
cmp byte [rsi + r8], 0
jne 0x140003933
mov rdx, rsi
lea rcx, [rsp + 0x90]
call fcn.14000e3b0
nop
lea rdx, [rsp + 0x170]
test r12b, r12b
cmovne rdx, r14
xorps xmm0, xmm0
movups xmmword [rsp + 0xb0], xmm0
mov qword [rsp + 0xc0], r15
mov qword [rsp + 0xc8], r15
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140003980
lea rcx, [rsp + 0xb0]
call fcn.14000e3b0
nop
lea r9, [rsp + 0x70]
lea r8, [rsp + 0x90]
lea rdx, [rsp + 0xb0]
lea rcx, [rsp + 0x40]
call fcn.140010e50
nop
cmp qword [rax + 0x18], 0xf
jbe 0x1400039c2
mov rax, qword [rax]
xorps xmm0, xmm0
movups xmmword [rsp + 0xf0], xmm0
mov qword [rsp + 0x100], r15
mov qword [rsp + 0x108], r15
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x1400039e0
mov rdx, rax
lea rcx, [rsp + 0xf0]
call fcn.14000e3b0
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140003a3b
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003a36
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003a36
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008a07c
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], 0xf
mov byte [rsp + 0x40], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x130], xmm0
mov qword [rsp + 0x140], r15
mov qword [rsp + 0x148], r15
mov r8d, 1
lea rdx, [0x1400947e8]
lea rcx, [rsp + 0x130]
call fcn.14000e3b0
nop
xorps xmm0, xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xd8], xmm1
mov qword [rsp + 0xe8], r15
movups xmmword [rsp + 0x150], xmm0
mov qword [rsp + 0x160], r15
mov esi, 0xf
mov qword [rsp + 0x168], rsi
mov byte [rsp + 0x150], 0
psrldq xmm1, 8
movq rbx, xmm1
mov rax, qword [rsp + 0x130]
lea r9, [rsp + 0x130]
cmp qword [rsp + 0x148], 0xf
seta byte [rsp + 0x30]
cmova r9, rax
lea rcx, [rsp + 0xf0]
cmp qword [rsp + 0x108], 0xf
seta r13b
mov r12, qword [rsp + 0xf0]
cmova rcx, r12
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x20], rax
mov r14, qword [rsp + 0x100]
mov rdx, r14
call fcn.14000e2f0
mov r15, rax
cmp rax, 0xffffffffffffffff
je 0x140003c85
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xor eax, eax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rax
mov r8, r15
cmp r14, r15
cmovb r8, r14
lea rdx, [rsp + 0xf0]
test r13b, r13b
cmovne rdx, r12
lea rcx, [rsp + 0x40]
call fcn.14000e3b0
or dword [rsp + 0x34], 1
cmp rsi, 0xf
jbe 0x140003baf
lea rdx, [rsi + 1]
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003baa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004217
call fcn.14008a07c
movups xmm0, xmmword [rsp + 0x40]
movups xmmword [rsp + 0x150], xmm0
movups xmm1, xmmword [rsp + 0x50]
movups xmmword [rsp + 0x160], xmm1
mov rax, qword [rsp + 0x140]
add rax, r15
mov rbx, qword [rsp + 0x100]
cmp rbx, rax
cmovb rax, rbx
lea rcx, [rsp + 0xf0]
cmp qword [rsp + 0x108], 0xf
cmova rcx, qword [rsp + 0xf0]
sub rbx, rax
lea r8, [rbx + 1]
lea rdx, [rcx + rax]
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x100], rbx
mov rax, qword [rsp + 0xe0]
cmp rax, qword [rsp + 0xe8]
je 0x140003c58
lea rdx, [rsp + 0x150]
mov rcx, rax
call fcn.14000d700
mov rbx, qword [rsp + 0xe0]
add rbx, 0x20
mov qword [rsp + 0xe0], rbx
mov rsi, qword [rsp + 0x168]
jmp 0x140003aca
lea r8, [rsp + 0x150]
mov rdx, rax
lea rcx, [rsp + 0xd8]
call fcn.14000eb90
mov rbx, qword [rsp + 0xe0]
mov rsi, qword [rsp + 0x168]
jmp 0x140003aca
cmp rbx, qword [rsp + 0xe8]
je 0x140003caa
lea rdx, [rsp + 0xf0]
mov rcx, rbx
call fcn.14000d700
add qword [rsp + 0xe0], 0x20
jmp 0x140003cc2
lea r8, [rsp + 0xf0]
mov rdx, rbx
lea rcx, [rsp + 0xd8]
call fcn.14000eb90
mov rdx, qword [rsp + 0xd8]
cmp qword [rdx + 0x18], 0xf
jbe 0x140003cd4
mov rdx, qword [rdx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x1d0], xmm0
xor r15d, r15d
mov qword [rsp + 0x1e0], r15
mov qword [rsp + 0x1e8], r15
mov r8, rdi
inc r8
cmp byte [rdx + r8], r15b
jne 0x140003cf5
lea rcx, [rsp + 0x1d0]
call fcn.14000e3b0
nop
mov rdx, qword [rsp + 0xd8]
add rdx, 0x20
cmp qword [rdx + 0x18], 0xf
jbe 0x140003d22
mov rdx, qword [rdx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x230], xmm0
mov qword [rsp + 0x240], r15
mov qword [rsp + 0x248], r15
mov r8, rdi
inc r8
cmp byte [rdx + r8], 0
jne 0x140003d40
lea rcx, [rsp + 0x230]
call fcn.14000e3b0
nop
mov rdx, qword [rsp + 0xd8]
add rdx, 0x40
cmp qword [rdx + 0x18], 0xf
jbe 0x140003d6e
mov rdx, qword [rdx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x210], xmm0
mov qword [rsp + 0x220], r15
mov qword [rsp + 0x228], r15
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140003d90
lea rcx, [rsp + 0x210]
call fcn.14000e3b0
nop
mov rdx, qword [rsp + 0xd8]
add rdx, 0x60
cmp qword [rdx + 0x18], 0xf
jbe 0x140003dbe
mov rdx, qword [rdx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x1b0], xmm0
mov qword [rsp + 0x1c0], r15
mov qword [rsp + 0x1c8], r15
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140003de0
lea rcx, [rsp + 0x1b0]
call fcn.14000e3b0
nop
mov rdx, qword [rsp + 0xd8]
sub rdx, 0xffffffffffffff80
cmp qword [rdx + 0x18], 0xf
jbe 0x140003e0e
mov rdx, qword [rdx]
xorps xmm0, xmm0
movups xmmword [rsp + 0x190], xmm0
mov qword [rsp + 0x1a0], r15
mov qword [rsp + 0x1a8], r15
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140003e30
lea rcx, [rsp + 0x190]
call fcn.14000e3b0
nop
mov r9, qword [rsp + 0xd8]
add r9, 0xa0
cmp qword [r9 + 0x18], 0xf
jbe 0x140003e61
mov r9, qword [r9]
mov rbx, rdi
inc rbx
cmp byte [r9 + rbx], 0
jne 0x140003e64
mov rax, qword [0x1400b6c28]
cmp rbx, rax
ja 0x140003ea9
lea r14, [0x1400b6c10]
cmp rax, 0xf
cmova r14, qword [0x1400b6c10]
mov qword [0x1400b6c20], rbx
mov r8, rbx
mov rdx, r9
mov rcx, r14
call sub.VCRUNTIME140.dll_memmove
mov byte [r14 + rbx], 0
jmp 0x140003eb8
mov rdx, rbx
lea rcx, [0x1400b6c10]
call fcn.14000e6a0
mov r9, qword [rsp + 0xd8]
add r9, 0xc0
cmp qword [r9 + 0x18], 0xf
jbe 0x140003ed1
mov r9, qword [r9]
mov rbx, rdi
inc rbx
cmp byte [r9 + rbx], 0
jne 0x140003ed4
mov rax, qword [0x1400b6be8]
cmp rbx, rax
ja 0x140003f19
lea r14, [0x1400b6bd0]
cmp rax, 0xf
cmova r14, qword [0x1400b6bd0]
mov qword [0x1400b6be0], rbx
mov r8, rbx
mov rdx, r9
mov rcx, r14
call sub.VCRUNTIME140.dll_memmove
mov byte [r14 + rbx], 0
jmp 0x140003f28
mov rdx, rbx
lea rcx, [0x1400b6bd0]
call fcn.14000e6a0
mov r9, qword [rsp + 0xd8]
add r9, 0xe0
cmp qword [r9 + 0x18], 0xf
jbe 0x140003f41
mov r9, qword [r9]
mov rbx, rdi
inc rbx
cmp byte [r9 + rbx], 0
jne 0x140003f44
mov rax, qword [0x1400b6bc8]
cmp rbx, rax
ja 0x140003f89
lea r14, [0x1400b6bb0]
cmp rax, 0xf
cmova r14, qword [0x1400b6bb0]
mov qword [0x1400b6bc0], rbx
mov r8, rbx
mov rdx, r9
mov rcx, r14
call sub.VCRUNTIME140.dll_memmove
mov byte [r14 + rbx], 0
jmp 0x140003f98
mov rdx, rbx
lea rcx, [0x1400b6bb0]
call fcn.14000e6a0
mov r9, qword [rsp + 0xd8]
add r9, 0x100
cmp qword [r9 + 0x18], 0xf
jbe 0x140003fb1
mov r9, qword [r9]
inc rdi
cmp byte [r9 + rdi], 0
jne 0x140003fb1
mov rax, qword [0x1400b6c08]
cmp rdi, rax
ja 0x140003ff5
lea rbx, [0x1400b6bf0]
cmp rax, 0xf
cmova rbx, qword [0x1400b6bf0]
mov qword [0x1400b6c00], rdi
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
jmp 0x140004004
mov rdx, rdi
lea rcx, [0x1400b6bf0]
call fcn.14000e6a0
lea rdx, [0x1400b6b90]
cmp qword [0x1400b6ba8], 0xf
cmova rdx, qword [0x1400b6b90]
lea rcx, [rsp + 0x1b0]
mov r14, qword [rsp + 0x1c8]
cmp r14, 0xf
seta r12b
mov rbx, qword [rsp + 0x1b0]
cmova rcx, rbx
mov r8, qword [rsp + 0x1c0]
cmp r8, qword [0x1400b6ba0]
jne 0x140004478
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140004478
lea rcx, [rsp + 0x1d0]
mov r15, qword [rsp + 0x1e8]
cmp r15, 0xf
seta r13b
mov rdi, qword [rsp + 0x1d0]
cmova rcx, rdi
mov r8, qword [rsp + 0x1e0]
cmp r8, 7
jne 0x140004445
lea rdx, str.Enabled
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140004445
mov rcx, qword [rsp + 0x1f0]
test rcx, rcx
je 0x1400040bf
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
nop
mov rdx, qword [rsp + 0x1a8]
cmp rdx, 0xf
jbe 0x140004105
inc rdx
mov rcx, qword [rsp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004100
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004100
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008a07c
mov qword [rsp + 0x1a0], 0
mov qword [rsp + 0x1a8], 0xf
mov byte [rsp + 0x190], 0
test r12b, r12b
je 0x14000415f
lea rdx, [r14 + 1]
mov rax, rbx
cmp rdx, 0x1000
jb 0x140004156
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004156
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
call fcn.14008a07c
nop
mov rdx, qword [rsp + 0x228]
cmp rdx, 0xf
jbe 0x1400041a6
inc rdx
mov rcx, qword [rsp + 0x210]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400041a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400041a0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008a07c
nop
mov rdx, qword [rsp + 0x248]
cmp rdx, 0xf
jbe 0x1400041ed
inc rdx
mov rcx, qword [rsp + 0x230]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400041e7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400041e7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008a07c
nop
test r13b, r13b
je 0x140004227
lea rdx, [r15 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000421e
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000421e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14008a07c
nop
cmp rsi, 0xf
jbe 0x140004267
lea rdx, [rsi + 1]
mov rcx, qword [rsp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004261
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004261
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008a07c
nop
mov rcx, qword [rsp + 0xd8]
test rcx, rcx
je 0x1400042dd
mov rdx, qword [rsp + 0xe0]
call fcn.14000e4b0
mov rdx, qword [rsp + 0xe8]
mov rcx, qword [rsp + 0xd8]
sub rdx, rcx
and rdx, 0xffffffffffffffe0
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400042c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400042c0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008a07c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0xd8], xmm0
mov qword [rsp + 0xe8], 0
cmp byte [rsp + 0x30], 0
je 0x140004325
mov rdx, qword [rsp + 0x148]
inc rdx
mov rcx, qword [rsp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000431f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000431f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008a07c
nop
mov rdx, qword [rsp + 0x108]
cmp rdx, 0xf
jbe 0x14000436b
inc rdx
mov rcx, qword [rsp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004366
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004366
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008a07c
mov qword [rsp + 0x100], 0
mov qword [rsp + 0x108], 0xf
mov byte [rsp + 0xf0], 0
mov rdx, qword [rsp + 0x188]
cmp rdx, 0xf
jbe 0x1400043cf
inc rdx
mov rcx, qword [rsp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400043c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003892
call fcn.14008a07c
nop
mov rdx, qword [rsp + 0x128]
cmp rdx, 0xf
jbe 0x140004413
inc rdx
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000440d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140004518
call fcn.14008a07c
nop
mov rcx, qword [rsp + 0x250]
xor rcx, rsp
call fcn.140089de0
lea r11, [rsp + 0x260]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
mov r9d, 0x30
lea r8, str.INFO_
lea rdx, str.Application_Disabled_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x2b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r9d, 0x30
lea r8, str.Error_
lea rdx, str.Update_Availiable_
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
lea rcx, [rsp + 0x190]
call fcn.14000d580
mov r8, rax
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, 0x2b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
mov rcx, r14
call fcn.14008a07c
nop
mov rdx, qword [rsp + 0x128]
cmp rdx, 0xf
jbe 0x140004524
inc rdx
mov rcx, qword [rsp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000451f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000451f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14008a07c
jmp 0x140004413