Function at 0x14000afb0
Capabilities:
Get file size
Initialize winhttp library
Prepare http request
Read file on windows
Receive http response

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2e0]
sub rsp, 0x3e0
mov rax, qword [0x1400a20c0]
xor rax, rsp
mov qword [rbp + 0x2d0], rax
mov r15, r9
movsxd r13, r8d
mov r14, rdx
mov rsi, rcx
mov qword [rbp - 0x18], rcx
mov qword [rbp - 0x10], rdx
mov qword [rbp - 0x20], r9
mov rax, qword [rbp + 0x340]
mov qword [rsp + 0x60], rax
mov rcx, qword [r9 + 0x10]
movabs rbx, 0x7ffffffffffffffe
mov rax, rbx
sub rax, rcx
cmp rax, 1
jb 0x14000c75f
mov rax, r9
cmp qword [r9 + 0x18], 7
jbe 0x14000b02f
mov rax, qword [r9]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 1
lea r9, [0x140092e98]
lea rcx, [rbp + 0xb8]
call fcn.140027860
nop
lea rdx, [rbp + 0xb8]
mov rcx, rsi
call fcn.140024350
nop
mov rdx, qword [rbp + 0xd0]
cmp rdx, 7
jbe 0x14000b0ac
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b0a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c7c5
call fcn.140054120
mov rax, qword [rsi + 0x10]
cmp qword [rsi + 0x18], 7
jbe 0x14000b0c3
mov rcx, qword [rsi]
lea r8, [rcx + rax*2]
mov rdx, rcx
jmp 0x14000b0ca
lea r8, [rsi + rax*2]
mov rdx, rsi
lea rcx, [rbp + 0x18]
call fcn.1400255c0
nop
lea r12, [rbp + 0x18]
cmp qword [rbp + 0x30], 7
cmova r12, qword [rbp + 0x18]
mov rcx, qword [r14 + 0x10]
sub rbx, rcx
cmp rbx, 0xe
jb 0x14000c765
mov rax, r14
cmp qword [r14 + 0x18], 7
jbe 0x14000b100
mov rax, qword [r14]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], recv
lea r9, str.RBNDOWNSTART_
lea rcx, [rbp - 8]
call fcn.140027860
nop
mov rax, qword [0x1400a6130]
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x10]
lea rax, [rbp - 0x48]
mov qword [rbp - 0x70], rax
lea rcx, [rbp + 0x1a0]
call fcn.140021a50
nop
lea r8, [rbp - 8]
cmp qword [rbp + 0x10], 7
cmova r8, qword [rbp - 8]
mov rax, qword [rbp + 8]
lea r9, [r8 + rax*2]
lea rdx, [rbp + 0x58]
lea rcx, [rbp + 0x1a0]
call fcn.140023880
nop
lea rcx, [rbp + 0x1a0]
call fcn.140021960
nop
lea rdx, [rbp + 0x58]
lea rcx, [rbp - 0x48]
call fcn.140003a00
mov rbx, rax
lea rcx, [rbp + 0x120]
call fcn.140021a50
nop
lea r8, [0x1400a60b0]
cmp qword [0x1400a60c8], 7
cmova r8, qword [0x1400a60b0]
mov rax, qword [0x1400a60c0]
lea r9, [r8 + rax*2]
lea rdx, [rbp + 0xb8]
lea rcx, [rbp + 0x120]
call fcn.140023880
nop
lea rcx, [rbp + 0x120]
call fcn.140021960
nop
mov r8, rbx
lea rdx, [rbp + 0xb8]
lea rcx, [rbp + 0x98]
call fcn.140004040
nop
mov rdx, rax
mov rcx, qword [0x1400a6130]
call rdi
nop
mov rdx, qword [rbp + 0xb0]
cmp rdx, 0xf
jbe 0x14000b240
inc rdx
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b23b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c76b
call fcn.140054120
xor edi, edi
mov qword [rbp + 0xa8], rdi
mov qword [rbp + 0xb0], recv
mov byte [rbp + 0x98], dil
mov rdx, qword [rbp + 0x70]
cmp rdx, 0xf
jbe 0x14000b296
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b291
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c771
call fcn.140054120
mov qword [rbp + 0x68], rdi
mov qword [rbp + 0x70], recv
mov byte [rbp + 0x58], 0
mov rcx, qword [0x1400a6130]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.http_1.0
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rbx, rax
mov qword [rbp - 0x78], rax
test rax, rax
jne 0x14000b469
mov rdx, qword [rbp + 0x10]
cmp rdx, 7
jbe 0x14000b31e
mov rcx, qword [rbp - 8]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b319
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c7bf
call fcn.140054120
mov qword [rbp + 8], rdi
mov qword [rbp + 0x10], 7
mov word [rbp - 8], di
mov rdx, qword [rbp + 0x30]
cmp rdx, 7
jbe 0x14000b36e
mov rcx, qword [rbp + 0x18]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b369
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c7c5
call fcn.140054120
mov qword [rbp + 0x28], rdi
mov qword [rbp + 0x30], 7
mov word [rbp + 0x18], di
mov rdx, qword [rsi + 0x18]
cmp rdx, 7
jbe 0x14000b3bd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsi]
cmp rdx, 0x1000
jb 0x14000b3b8
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000c7cb
mov rcx, r8
call fcn.140054120
mov word [rsi], di
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rdi
mov rdx, qword [r14 + 0x18]
cmp rdx, 7
jbe 0x14000b40b
lea rdx, [rdx*2 + 2]
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x14000b406
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000c74d
mov rcx, r8
call fcn.140054120
mov qword [r14 + 0x10], rdi
mov qword [r14 + 0x18], 7
mov word [r14], di
mov rdx, qword [r15 + 0x18]
cmp rdx, 7
jbe 0x14000b45a
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
mov rcx, qword [r15]
jb 0x14000b455
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000c759
mov rcx, r8
call fcn.140054120
mov qword [r15 + 0x10], rdi
mov word [r15], di
xor al, al
jmp 0x14000c71b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
mov qword [rbp + 0x180], rax
mov dword [rbp + 0x120], WSAGetLastError
mov dword [rbp + 0x130], 0xffffffff
mov dword [rbp + 0x140], 0xffffffff
mov dword [rbp + 0x170], 0xffffffff
mov dword [rbp + 0x180], 0xffffffff
lea r9, [rbp + 0x120]
xor r8d, r8d
xor edx, edx
mov rcx, r12
call qword [sym.imp.WINHTTP.dll_WinHttpCrackUrl]
lea rcx, [rbp + 0x120]
test eax, eax
cmove rcx, qword [rbp - 0x20]
movups xmm0, xmmword [rcx]
movaps xmmword [rbp + 0x1a0], xmm0
movups xmm1, xmmword [rcx + 0x10]
movaps xmmword [rbp + 0x1b0], xmm1
movups xmm0, xmmword [rcx + 0x20]
movaps xmmword [rbp + 0x1c0], xmm0
movups xmm1, xmmword [rcx + 0x30]
movaps xmmword [rbp + 0x1d0], xmm1
movups xmm0, xmmword [rcx + 0x40]
movups xmmword [rbp - 0x58], xmm0
movups xmm0, xmmword [rcx + 0x50]
movaps xmmword [rbp + 0x1f0], xmm0
movsd xmm1, qword [rcx + 0x60]
movsd qword [rbp + 0x200], xmm1
mov rcx, r12
call fcn.140004840
lea rdx, [0x1400a6110]
mov rax, qword [0x1400a6120]
cmp qword [0x1400a6128], 7
jbe 0x14000b566
mov rdx, qword [0x1400a6110]
lea r8, [rdx + rax*2]
lea rcx, [rbp + 0x38]
call fcn.1400255c0
nop
lea rdx, [rbp + 0x38]
cmp qword [rbp + 0x50], 7
cmova rdx, qword [rbp + 0x38]
mov r8d, 0x1bb
xor r9d, r9d
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov qword [rbp - 0x60], rax
test rax, rax
jne 0x14000b5f2
mov rdx, qword [rbp + 0x50]
cmp rdx, 7
jbe 0x14000b5dd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14000b5d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c7b9
call fcn.140054120
mov qword [rbp + 0x48], rdi
mov qword [rbp + 0x50], 7
mov word [rbp + 0x38], di
jmp 0x14000b2de
mov dword [rsp + 0x30], 0x800000
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
movups xmm0, xmmword [rbp - 0x58]
psrldq xmm0, 8
movq qword [rbp - 0x70], xmm0
movq r8, xmm0
lea rdx, str.POST
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov qword [rsp + 0x78], rax
test rax, rax
je 0x14000b59d
mov dword [rsp + 0x44], 0x3300
mov r9d, 4
lea r8, [rsp + 0x44]
lea edx, [r9 + 0x1b]
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
mov rcx, r14
cmp qword [r14 + 0x18], 7
jbe 0x14000b665
mov rcx, qword [r14]
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov edx, 0x80000000
lea r8d, [r9 + 1]
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rdi, rax
mov qword [rsp + 0x50], rax
mov ecx, 0x19000
call fcn.1400543a4
mov rbx, rax
mov qword [rbp - 0x80], rax
xor r12d, r12d
mov dword [rsp + 0x40], r12d
lea rdx, [rsp + 0x68]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x14000b8ca
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea r8d, [r12 + 0x14]
lea rdx, str.Cant_Get_File_Size.
mov rcx, qword [rsp + 0x60]
call fcn.140024400
mov rcx, rbx
call fcn.140054120
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, 7
jbe 0x14000b72b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b726
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c7b9
call fcn.140054120
mov qword [rbp + 0x48], r12
mov qword [rbp + 0x50], 7
mov word [rbp + 0x38], r12w
mov rdx, qword [rbp + 0x10]
cmp rdx, 7
jbe 0x14000b77c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b777
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c7bf
call fcn.140054120
mov qword [rbp + 8], r12
mov qword [rbp + 0x10], 7
mov word [rbp - 8], r12w
mov rdx, qword [rbp + 0x30]
cmp rdx, 7
jbe 0x14000b7cd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b7c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c7c5
call fcn.140054120
mov qword [rbp + 0x28], r12
mov qword [rbp + 0x30], 7
mov word [rbp + 0x18], r12w
mov rdx, qword [rsi + 0x18]
cmp rdx, 7
jbe 0x14000b81d
mov rcx, qword [rsi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000b818
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000c7cb
mov rcx, r8
call fcn.140054120
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], 7
mov word [rsi], r12w
mov rdx, qword [r14 + 0x18]
cmp rdx, 7
jbe 0x14000b86c
mov rcx, qword [r14]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000b867
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000c74d
mov rcx, r8
call fcn.140054120
mov qword [r14 + 0x10], r12
mov qword [r14 + 0x18], 7
mov word [r14], r12w
mov rdx, qword [r15 + 0x18]
cmp rdx, 7
jbe 0x14000b8bb
lea rdx, [rdx*2 + 2]
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x14000b8b6
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000c759
mov rcx, r8
call fcn.140054120
mov qword [r15 + 0x10], r12
mov word [r15], r12w
xor al, al
jmp 0x14000c71b
mov r12, qword [rsp + 0x68]
movabs r8, 0x47ae147ae147ae15
mov rax, r8
mul r12
sub r12, rdx
shr r12, 1
add r12, rdx
shr r12, 0xf
inc r12
xor r9d, r9d
mov edi, r9d
mov rcx, r13
mov rax, r8
mul r13
sub rcx, rdx
shr rcx, 1
add rcx, rdx
shr rcx, 0xf
mov qword [rbp - 0x68], rcx
mov qword [rsp + 0x20], r9
lea r9, [rsp + 0x40]
mov r8d, 0xc800
mov rdx, rbx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r13, qword [rsp + 0x48]
test eax, eax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x58], rax
je 0x14000c0e0
xor ecx, ecx
mov r8, 0xffffffffffffffff
mov eax, dword [rsp + 0x40]
test eax, eax
je 0x14000c0e0
inc rdi
mov qword [rsp + 0x48], rdi
add rcx, 0x50
mov qword [rsp + 0x70], rcx
cmp rdi, qword [rbp - 0x68]
jbe 0x14000bebb
cmp rdi, r12
jne 0x14000b9d7
mov eax, 1
sub rax, r12
imul r13, rax, 0xc800
add r13, qword [rsp + 0x68]
mov eax, 2
mul r13
cmovo rax, r8
mov rcx, rax
call fcn.1400543a4
mov qword [rsp + 0x58], rax
test r13, r13
je 0x14000bebb
mov rcx, rax
mov r8, rbx
sub r8, rax
mov rdx, r13
nop dword [rax + rax]
movzx eax, word [r8 + rcx]
mov word [rcx], ax
lea rcx, [rcx + 2]
sub rdx, 1
jne 0x14000b9c0
jmp 0x14000bebb
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], eax
mov dword [rsp + 0x20], eax
mov r9, rbx
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
xor edx, edx
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
je 0x14000beed
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
mov rax, qword [rsp + 0x70]
div r12
mov rcx, rax
lea r9, [rbp + 0x2ca]
test eax, eax
jns 0x14000ba80
neg ecx
nop word [rax + rax]
sub r9, 2
mov eax, 0xcccccccd
mul ecx
shr edx, 3
movzx eax, dx
shl ax, 2
lea r8d, [rax + rdx]
add r8w, r8w
sub cx, r8w
add cx, 0x30
mov word [r9], cx
mov ecx, edx
test edx, edx
jne 0x14000ba40
add r9, 0xfffffffffffffffe
mov word [r9], reloc.Cabinet.dll_CloseDecompressor
jmp 0x14000baaf
sub r9, 2
mov eax, 0xcccccccd
mul ecx
shr edx, 3
movzx eax, dx
shl ax, 2
lea r8d, [rax + rdx]
add r8w, r8w
sub cx, r8w
add cx, 0x30
mov word [r9], cx
mov ecx, edx
test edx, edx
jne 0x14000ba80
lea r8, [rbp + 0x2ca]
mov rdx, r9
lea rcx, [rbp + 0xf8]
call fcn.1400280d0
nop
mov r9d, recv
lea r8, str.RBNDOWNSTATE_
lea rcx, [rbp + 0xf8]
call fcn.1400274b0
xorps xmm0, xmm0
movups xmmword [rbp + 0x58], xmm0
xor ebx, ebx
mov qword [rbp + 0x68], rbx
mov qword [rbp + 0x70], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x58], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x68], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
lea rdx, [0x140092c60]
lea rcx, [rbp + 0x58]
call fcn.1400242c0
xorps xmm0, xmm0
movups xmmword [rbp + 0xd8], xmm0
mov qword [rbp + 0xe8], rbx
mov qword [rbp + 0xf0], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xd8], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xe8], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, r14
lea rcx, [rbp + 0xd8]
call fcn.140024350
xorps xmm0, xmm0
movups xmmword [rbp + 0x78], xmm0
mov qword [rbp + 0x88], rbx
mov qword [rbp + 0x90], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x88], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 7
mov word [rax], bx
mov rdx, qword [rbp + 0xf0]
cmp rdx, 7
jbe 0x14000bbe5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xd8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bbe0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c777
call fcn.140054120
mov qword [rbp + 0xe8], rbx
mov qword [rbp + 0xf0], 7
mov word [rbp + 0xd8], bx
mov rdx, qword [rbp + 0x70]
cmp rdx, 7
jbe 0x14000bc3e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bc39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c77d
call fcn.140054120
mov qword [rbp + 0x68], rbx
mov qword [rbp + 0x70], 7
mov word [rbp + 0x58], bx
mov rdx, qword [rbp + 0x110]
cmp rdx, 7
jbe 0x14000bc94
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xf8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bc8f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c783
call fcn.140054120
mov qword [rbp + 0x108], rbx
mov qword [rbp + 0x110], 7
mov word [rbp + 0xf8], bx
mov rax, qword [0x1400a6130]
mov rcx, qword [rax]
mov rdi, qword [rcx + 0x10]
lea rax, [rbp + 0x2a0]
mov qword [rbp - 0x28], rax
lea rcx, [rbp + 0x1a0]
call fcn.140021a50
nop
lea r8, [rbp + 0x78]
cmp qword [rbp + 0x90], 7
cmova r8, qword [rbp + 0x78]
mov rax, qword [rbp + 0x88]
lea r9, [r8 + rax*2]
lea rdx, [rbp + 0x98]
lea rcx, [rbp + 0x1a0]
call fcn.140023880
nop
lea rcx, [rbp + 0x1a0]
call fcn.140021960
nop
lea rdx, [rbp + 0x98]
lea rcx, [rbp + 0x2a0]
call fcn.140003a00
mov rbx, rax
lea rcx, [rbp + 0x220]
call fcn.140021a50
nop
lea r8, [0x1400a60b0]
cmp qword [0x1400a60c8], 7
cmova r8, qword [0x1400a60b0]
mov rax, qword [0x1400a60c0]
lea r9, [r8 + rax*2]
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x220]
call fcn.140023880
nop
lea rcx, [rbp + 0x220]
call fcn.140021960
nop
mov r8, rbx
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0xb8]
call fcn.140004040
nop
mov rdx, rax
mov rcx, qword [0x1400a6130]
call rdi
nop
mov rdx, qword [rbp + 0xd0]
cmp rdx, 0xf
jbe 0x14000bdd5
inc rdx
mov rcx, qword [rbp + 0xb8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bdd0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c789
call fcn.140054120
xor ebx, ebx
mov qword [rbp + 0xc8], rbx
mov qword [rbp + 0xd0], recv
mov byte [rbp + 0xb8], bl
mov rdx, qword [rbp + 0xb0]
cmp rdx, 0xf
jbe 0x14000be30
inc rdx
mov rcx, qword [rbp + 0x98]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000be2b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c78f
call fcn.140054120
mov qword [rbp + 0xa8], rbx
mov qword [rbp + 0xb0], recv
mov byte [rbp + 0x98], 0
mov rcx, qword [0x1400a6130]
mov rax, qword [rcx]
xor edx, edx
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x90]
cmp rdx, 7
jbe 0x14000be9c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000be97
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c795
call fcn.140054120
mov qword [rbp + 0x88], rbx
mov qword [rbp + 0x90], 7
mov word [rbp + 0x78], bx
mov rbx, qword [rbp - 0x80]
mov rdi, qword [rsp + 0x48]
xor eax, eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
mov r8d, 0xc800
mov rdx, rbx
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x14000c0e0
mov rcx, qword [rsp + 0x70]
jmp 0x14000b946
mov r8d, reloc.Cabinet.dll_CreateCompressor
lea rdx, str.There_is_no_result_of_Request.
mov rcx, qword [rsp + 0x60]
call fcn.140024400
mov rcx, rbx
call fcn.140054120
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, 7
jbe 0x14000bf4d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bf48
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c79b
call fcn.140054120
xor ebx, ebx
mov qword [rbp + 0x48], rbx
mov qword [rbp + 0x50], 7
mov word [rbp + 0x38], bx
mov rdx, qword [rbp + 0x10]
cmp rdx, 7
jbe 0x14000bf9f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bf9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c7a1
call fcn.140054120
mov qword [rbp + 8], rbx
mov qword [rbp + 0x10], 7
mov word [rbp - 8], bx
mov rdx, qword [rbp + 0x30]
cmp rdx, 7
jbe 0x14000bfef
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bfea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c7a7
call fcn.140054120
mov qword [rbp + 0x28], rbx
mov qword [rbp + 0x30], 7
mov word [rbp + 0x18], bx
mov rdx, qword [rsi + 0x18]
cmp rdx, 7
jbe 0x14000c03e
mov rcx, qword [rsi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000c039
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000c7ad
mov rcx, r8
call fcn.140054120
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], 7
mov word [rsi], bx
mov rdx, qword [r14 + 0x18]
cmp rdx, 7
jbe 0x14000c08c
mov rcx, qword [r14]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000c087
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000c7b3
mov rcx, r8
call fcn.140054120
mov qword [r14 + 0x10], rbx
mov qword [r14 + 0x18], 7
mov word [r14], bx
mov rdx, qword [r15 + 0x18]
cmp rdx, 7
jbe 0x14000c305
lea rdx, [rdx*2 + 2]
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x14000c300
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000c753
jmp 0x14000c2fd
mov rcx, rbx
call fcn.140054120
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, qword [rbp - 0x78]
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
xor ebx, ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.http_1.0
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov r12, rax
test rax, rax
jne 0x14000c30c
mov rdx, qword [rbp + 0x50]
cmp rdx, 7
jbe 0x14000c179
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14000c174
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c7b9
call fcn.140054120
mov word [rbp + 0x38], bx
mov qword [rbp + 0x50], 7
mov qword [rbp + 0x48], rbx
mov rdx, qword [rbp + 0x10]
cmp rdx, 7
jbe 0x14000c1c9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14000c1c4
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c7bf
call fcn.140054120
mov word [rbp - 8], bx
mov qword [rbp + 0x10], 7
mov qword [rbp + 8], rbx
mov rdx, qword [rbp + 0x30]
cmp rdx, 7
jbe 0x14000c219
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14000c214
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c7c5
call fcn.140054120
mov word [rbp + 0x18], bx
mov qword [rbp + 0x30], 7
mov qword [rbp + 0x28], rbx
mov rdx, qword [rsi + 0x18]
cmp rdx, 7
jbe 0x14000c268
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
mov rcx, qword [rsi]
jb 0x14000c263
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000c7cb
mov rcx, r8
call fcn.140054120
mov word [rsi], bx
mov qword [rsi + 0x18], 7
mov qword [rsi + 0x10], rbx
mov rdx, qword [r14 + 0x18]
cmp rdx, 7
jbe 0x14000c2b6
lea rdx, [rdx*2 + 2]
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x14000c2b1
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000c74d
mov rcx, r8
call fcn.140054120
mov qword [r14 + 0x10], rbx
mov qword [r14 + 0x18], 7
mov word [r14], bx
mov rdx, qword [r15 + 0x18]
cmp rdx, 7
jbe 0x14000c305
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
mov rcx, qword [r15]
jb 0x14000c300
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000c759
mov rcx, r8
call fcn.140054120
xor al, al
jmp 0x14000c713
lea rdx, [rbp + 0x38]
cmp qword [rbp + 0x50], 7
cmova rdx, qword [rbp + 0x38]
mov r8d, 0x1bb
xor r9d, r9d
mov rcx, r12
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov rdi, rax
test rax, rax
je 0x14000c139
mov dword [rsp + 0x30], 0x800000
mov qword [rsp + 0x28], rbx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8, qword [rbp - 0x70]
lea rdx, str.POST
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov rbx, rax
test rax, rax
jne 0x14000c4b2
mov rdx, qword [rbp + 0x50]
cmp rdx, 7
jbe 0x14000c3ad
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14000c3a8
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c7b9
call fcn.140054120
xor ebx, ebx
mov word [rbp + 0x38], bx
mov qword [rbp + 0x50], 7
mov qword [rbp + 0x48], rbx
mov rdx, qword [rbp + 0x10]
cmp rdx, 7
jbe 0x14000c3ff
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14000c3fa
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c7bf
call fcn.140054120
mov word [rbp - 8], bx
mov qword [rbp + 0x10], 7
mov qword [rbp + 8], rbx
mov rdx, qword [rbp + 0x30]
cmp rdx, 7
jbe 0x14000c44f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14000c44a
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c7c5
call fcn.140054120
mov word [rbp + 0x18], bx
mov qword [rbp + 0x30], 7
mov qword [rbp + 0x28], rbx
mov rdx, qword [rsi + 0x18]
cmp rdx, 7
jbe 0x14000c49e
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
mov rcx, qword [rsi]
jb 0x14000c499
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000c7cb
mov rcx, r8
call fcn.140054120
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], 7
mov word [rsi], bx
jmp 0x14000c277
mov r9d, 4
lea r8, [rsp + 0x44]
lea edx, [r9 + 0x1b]
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], r13d
mov r13, qword [rsp + 0x58]
mov r9, r13
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
xor edx, edx
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
test eax, eax
jne 0x14000c523
lea r8d, [rax + 0x1e]
lea rdx, str.There_is_no_result_of_Request.
mov rcx, qword [rsp + 0x60]
call fcn.140024400
mov rcx, qword [rbp - 0x80]
call fcn.140054120
jmp 0x14000c36d
mov rcx, r13
call fcn.140054120
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rdi
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, r12
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, 7
jbe 0x14000c587
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c582
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c7b9
call fcn.140054120
xor ebx, ebx
mov qword [rbp + 0x48], rbx
mov qword [rbp + 0x50], 7
mov word [rbp + 0x38], bx
mov rdx, qword [rbp + 0x10]
cmp rdx, 7
jbe 0x14000c5d9
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c5d4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c7bf
call fcn.140054120
mov qword [rbp + 8], rbx
mov qword [rbp + 0x10], 7
mov word [rbp - 8], bx
mov rdx, qword [rbp + 0x30]
cmp rdx, 7
jbe 0x14000c629
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c624
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c7c5
call fcn.140054120
mov qword [rbp + 0x28], rbx
mov qword [rbp + 0x30], 7
mov word [rbp + 0x18], bx
mov rdx, qword [rsi + 0x18]
cmp rdx, 7
jbe 0x14000c678
mov rcx, qword [rsi]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000c673
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000c7cb
mov rcx, r8
call fcn.140054120
mov qword [rsi + 0x10], rbx
mov qword [rsi + 0x18], 7
mov word [rsi], bx
mov rdx, qword [r14 + 0x18]
cmp rdx, 7
jbe 0x14000c6c6
mov rcx, qword [r14]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x14000c6c1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000c74d
mov rcx, r8
call fcn.140054120
mov qword [r14 + 0x10], rbx
mov qword [r14 + 0x18], 7
mov word [r14], bx
mov rdx, qword [r15 + 0x18]
cmp rdx, 7
jbe 0x14000c711
lea rdx, [rdx*2 + 2]
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x14000c70c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000c759
mov rcx, r8
call fcn.140054120
mov al, 1
mov word [r15], bx
mov qword [r15 + 0x10], rbx
mov qword [r15 + 0x18], 7
mov rcx, qword [rbp + 0x2d0]
xor rcx, rsp
call fcn.140054100
mov rbx, qword [rsp + 0x430]
add rsp, 0x3e0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.14006a6c0
nop
call fcn.14006a6c0
int3
call fcn.14006a6c0
nop
call fcn.1400015e0
nop
call fcn.1400015e0
nop
call fcn.14006a6c0
nop
call fcn.14006a6c0
nop
call fcn.14006a6c0
nop
call fcn.14006a6c0
nop
call fcn.14006a6c0
nop
call fcn.14006a6c0
nop
call fcn.14006a6c0
nop
call fcn.14006a6c0
nop
call fcn.14006a6c0
nop
call fcn.14006a6c0
nop
call fcn.14006a6c0
nop
call fcn.14006a6c0
nop
call fcn.14006a6c0
nop
call fcn.14006a6c0
nop
call fcn.14006a6c0
nop
call fcn.14006a6c0
nop
call fcn.14006a6c0
int3