Function at 0x14001fc00
Capabilities:
Access the windows event log
Create process on windows
Delete file
Move file

Disassembly:
mov r11, rsp
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x940
mov qword [r11 - 0x6f8], 0xfffffffffffffffe
mov qword [r11 + 0x10], rbx
mov qword [r11 + 0x18], rsi
mov rax, qword [0x14010d268]
xor rax, rsp
mov qword [rsp + 0x930], rax
mov rsi, rcx
mov qword [rsp + 0x70], rcx
mov rdx, qword [rcx + 0x78]
movdqa xmm0, xmmword [0x1400c8c30]
movdqu xmmword [rsp + 0x3a8], xmm0
xor r12d, r12d
mov word [r11 - 0x5d0], r12w
mov r13, 0xffffffffffffffff
mov r8, r13
nop word [rax + rax]
inc r8
cmp word [rdx + r8*2], r12w
jne 0x14001fc70
lea rcx, [rsp + 0x398]
call fcn.1400143b0
nop
mov r14, qword [rsi + 8]
mov qword [rsp + 0x180], r14
mov r15, qword [rsi + 0x10]
mov qword [rsp + 0x1d8], r15
mov rcx, qword [rsi + 0x18]
mov qword [rsp + 0x138], rcx
mov rax, qword [rsi + 0x30]
mov qword [rsp + 0x188], rax
lea rdx, [0x1400ca530]
mov qword [rsp + 0x20], rdx
mov r9, rcx
mov r8, r15
mov rdx, r14
lea rcx, [rsp + 0x158]
call fcn.140028ef0
nop
lea rdx, [rsp + 0x398]
lea rcx, [rsp + 0x278]
call fcn.1400096d0
lea rdx, [rsp + 0x278]
lea rcx, [rsp + 0xf0]
call fcn.14001f140
nop
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x160], xmm0
mov qword [rsp + 0x170], r12
lea rax, [rsp + 0xb8]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x1b0]
mov qword [rsp + 0x110], rax
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0xf0], r12
mov qword [rsp + 0xb8], rax
mov qword [rsp + 0x1c0], r12
mov qword [rsp + 0x1c8], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x1b0], 0
mov r8d, 0x1c
lea rdx, str.application_x_zip_compressed
lea rcx, [rsp + 0x1b0]
call fcn.14001d4c0
nop
mov qword [rsp + 0x1a0], r12
mov qword [rsp + 0x1a8], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x190], 0
mov r8d, listen
lea rdx, str.minidumpZip
lea rcx, [rsp + 0x190]
call fcn.14001d4c0
nop
movups xmm0, xmmword [rsp + 0x190]
movaps xmmword [rsp + 0x420], xmm0
movups xmm1, xmmword [rsp + 0x1a0]
movaps xmmword [rsp + 0x430], xmm1
mov qword [rsp + 0x1a0], r12
mov qword [rsp + 0x1a8], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x190], 0
movups xmm0, xmmword [rsp + 0x1b0]
movaps xmmword [rsp + 0x440], xmm0
movups xmm1, xmmword [rsp + 0x1c0]
movaps xmmword [rsp + 0x450], xmm1
mov qword [rsp + 0x1c0], r12
mov qword [rsp + 0x1c8], reloc.WS2_32.dll_ntohs
mov byte [rsp + 0x1b0], 0
movdqa xmm0, xmmword [0x1400cafe0]
movdqa xmmword [rsp + 0x470], xmm0
mov byte [rsp + 0x460], 0
mov rax, qword [rsp + 0xb8]
mov qword [rsp + 0xb8], r12
mov qword [rsp + 0x480], rax
lea rcx, [rsp + 0x190]
call fcn.1400176a0
lea rcx, [rsp + 0x1b0]
call fcn.1400176a0
mov rcx, qword [rsp + 0xb8]
test rcx, rcx
je 0x14001fe9b
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
nop
lea r8, [rsp + 0x420]
xor edx, edx
lea rcx, [rsp + 0x160]
call fcn.140015400
nop
mov rcx, qword [rsp + 0x480]
test rcx, rcx
je 0x14001feca
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
lea rcx, [rsp + 0x460]
call fcn.1400176a0
lea rcx, [rsp + 0x440]
call fcn.1400176a0
lea rcx, [rsp + 0x420]
call fcn.1400176a0
lea rcx, [rsp + 0x398]
cmp qword [rsp + 0x3b0], 8
cmovae rcx, qword [rsp + 0x398]
mov qword [rsp + 0x1f0], rcx
mov rax, r13
inc rax
cmp word [rcx + rax*2], 0
jne 0x14001ff16
mov qword [rsp + 0x1f8], rax
movaps xmm0, xmmword [rsp + 0x1f0]
movdqa xmmword [rsp + 0x240], xmm0
lea rdx, [rsp + 0x240]
lea rcx, [rsp + 0x490]
call fcn.14006a490
mov rdi, rax
mov rbx, qword [rsp + 0x160]
add rbx, 0x40
cmp rbx, rax
je 0x14001ff87
mov rcx, rbx
call fcn.14001ba50
movups xmm0, xmmword [rdi]
movups xmmword [rbx], xmm0
movups xmm1, xmmword [rdi + 0x10]
movups xmmword [rbx + 0x10], xmm1
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rdi], 0
mov rdx, qword [rsp + 0x4a8]
cmp rdx, 0x10
jb 0x14001ffce
inc rdx
mov rcx, qword [rsp + 0x490]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001ffc8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14001ffc8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14005f1b8
nop
mov rcx, rbx
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x14001ffde
mov rcx, qword [rbx]
mov rax, qword [rbx + 0x10]
add rax, rcx
cmp rdx, 0x10
jb 0x14001ffee
mov rbx, qword [rbx]
mov rcx, rbx
mov rdx, rax
sub rdx, rbx
cmp rbx, rax
cmova rdx, r12
test rdx, rdx
je 0x140020019
cmp byte [rcx], 0x5c
jne 0x14002000b
mov byte [rcx], 0x2f
inc rcx
mov rax, rcx
sub rax, rbx
cmp rax, rdx
jne 0x140020003
mov rax, qword [rsp + 0x158]
mov qword [rsp + 0x200], rax
mov rcx, r13
nop dword [rax]
inc rcx
cmp word [rax + rcx*2], 0
jne 0x140020030
mov qword [rsp + 0x208], rcx
movaps xmm0, xmmword [rsp + 0x200]
movdqa xmmword [rsp + 0x250], xmm0
lea rdx, [rsp + 0x250]
lea rcx, [rsp + 0x2b8]
call fcn.14006a490
mov rdx, rax
lea rcx, [rsp + 0x4b0]
call fcn.140053680
nop
lea rax, [rsp + 0x2d8]
mov qword [rsp + 0xa0], rax
lea rax, [rsp + 0x130]
mov qword [rsp + 0x110], rax
mov ecx, gethostname
call fcn.14005f8a8
mov rbx, rax
test rax, rax
je 0x1400200d6
lea rax, vtable.nitro::string_io_stream.0
mov qword [rbx], rax
lea rax, vtable.nitro::string_io_stream.1.0
mov qword [rbx + 8], rax
mov qword [rbx + 0x20], r12
mov qword [rbx + 0x28], reloc.WS2_32.dll_ntohs
mov byte [rbx + 0x10], 0
mov qword [rbx + 0x30], r12
jmp 0x1400200d9
mov rbx, r12
lea rax, [rsp + 0x338]
mov qword [rsp + 0x108], rax
lea rax, [rsp + 0x118]
mov qword [rsp + 0x100], rax
lea rax, [rsp + 0xa8]
mov qword [rsp + 0xc0], rax
movdqa xmm0, xmmword [0x1400cafe0]
movdqa xmmword [rsp + 0x3f0], xmm0
mov byte [rsp + 0x3e0], 0
mov r8d, 6
lea rdx, str.Cookie
lea rcx, [rsp + 0x3e0]
call fcn.14001d4c0
nop
lea rdx, [rsi + 0xa8]
lea rcx, [rsp + 0x400]
call fcn.140016570
nop
lea rsi, [rsp + 0x318]
mov qword [rsp + 0xf8], rsi
mov qword [rsp + 0x310], r12
mov qword [rsp + 0x130], rbx
movups xmm0, xmmword [rsp + 0x160]
movups xmmword [rsp + 0x118], xmm0
movsd xmm1, qword [rsp + 0x170]
movsd qword [rsp + reloc.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t_], xmm1
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x160], xmm0
mov qword [rsp + 0x170], r12
lea rax, [rsp + 0x118]
mov qword [rsp + 0xf8], rax
mov qword [rsp + 0xa8], r12
mov qword [rsp + 0xb0], r12
lea rcx, [rsp + 0xa8]
call fcn.14001b2e0
mov rbx, rax
mov qword [rsp + 0xa8], rax
lea rdi, [rsp + 0x3e0]
lea rax, [rsp + 0x420]
cmp rdi, rax
je 0x140020234
mov rdx, rdi
lea rcx, [rsp + 0xa8]
call fcn.140015330
lea r9, [rax + 0x20]
mov qword [rsp + 0x20], rax
mov r8, rbx
lea rdx, [rsp + 0x220]
lea rcx, [rsp + 0xa8]
call fcn.140015970
add rdi, 0x40
mov rbx, qword [rsp + 0xa8]
jmp 0x1400201e8
lea rax, [rsp + 0xa8]
mov qword [rsp + 0x178], rax
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
mov r8d, reloc.WS2_32.dll_setsockopt
lea rdx, str._post_post_action.php
mov rcx, rsi
call fcn.14001d4c0
mov qword [rsp + 0x100], rsi
lea rdi, [rsp + 0x338]
mov dword [rdi], r12d
movups xmm0, xmmword [rsi]
movups xmmword [rdi + 8], xmm0
movups xmm1, xmmword [rsi + 0x10]
movups xmmword [rdi + 0x18], xmm1
mov qword [rsi + 0x10], r12
mov qword [rsi + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rsi], 0
lea rbx, [rdi + 0x28]
mov qword [rsp + 0xc0], rbx
mov qword [rbx], r12
mov qword [rbx + 8], r12
mov rcx, rbx
call fcn.14001b2e0
mov qword [rbx], rax
lea rbx, [rdi + 0x38]
mov qword [rsp + 0xc0], rbx
mov qword [rbx], r12
mov qword [rbx + 8], r12
mov rcx, rbx
call fcn.14001b2e0
mov qword [rsp + 0x228], rax
lea rdx, [rsp + 0xa8]
mov rcx, qword [rdx]
mov qword [rbx], rcx
mov qword [rdx], rax
mov rcx, qword [rbx + 8]
mov qword [rsp + 0x230], rcx
mov rax, qword [rdx + 8]
mov qword [rbx + 8], rax
mov qword [rdx + 8], rcx
mov rax, qword [rsp + 0x118]
mov qword [rdi + 0x48], rax
mov rax, qword [rsp + 0x120]
mov qword [rdi + 0x50], rax
mov rax, qword [rsp + reloc.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t_]
mov qword [rdi + 0x58], rax
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x118], xmm0
mov qword [rsp + reloc.mfc140u.dll_ATL::CStringT_wchar_t_StrTraitMFC_DLL_wchar_t_ATL::ChTraitsCRT_wchar_t_], r12
mov rcx, rsi
call fcn.1400176a0
nop
lea rsi, [rsp + 0xa8]
mov rbx, qword [rsi]
mov rdx, qword [rbx + 8]
mov rcx, rsi
call fcn.14001b530
mov rax, qword [rsi]
mov qword [rax + 8], rbx
mov rax, qword [rsi]
mov qword [rax], rbx
mov rax, qword [rsi]
mov qword [rax + 0x10], rbx
mov qword [rsi + 8], r12
mov edx, 0x60
mov rcx, qword [rsi]
call fcn.14005f1b8
nop
lea rcx, [rsp + 0x118]
call fcn.1400178d0
nop
lea rax, [rsp + 0x2d8]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x130]
mov r8, rdi
lea rdx, [rsp + 0x298]
lea rcx, [rsp + 0x4b0]
call fcn.140055490
nop
lea r9, [0x140017890]
mov edx, 0x40
lea r8d, [rdx - 0x3f]
lea rcx, [rsp + 0x3e0]
call fcn.14005fc78
lea rdx, [rsp + 0x4d8]
mov rcx, qword [rsp + 0x2a0]
call fcn.1400215f0
nop
mov rcx, rax
cmp qword [rax + 0x18], 0x10
jb 0x1400203fd
mov rcx, qword [rax]
mov qword [rsp + 0x210], rcx
mov rax, qword [rax + 0x10]
mov qword [rsp + 0x218], rax
movaps xmm0, xmmword [rsp + 0x210]
movdqa xmmword [rsp + 0x260], xmm0
lea rdx, [rsp + 0x260]
lea rcx, [rsp + 0x3b8]
call fcn.14006a630
nop
cmp qword [rax + 0x18], 8
jb 0x140020442
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140001700
nop
mov r8, qword [rsp + 0x3d0]
cmp r8, 8
jb 0x140020476
inc r8
mov rdx, qword [rsp + 0x3b8]
lea rcx, [rsp + 0x3b8]
call fcn.140014590
movdqa xmm0, xmmword [0x1400c8c30]
movdqu xmmword [rsp + 0x3c8], xmm0
mov word [rsp + 0x3b8], r12w
lea rcx, [rsp + 0x4d8]
call fcn.1400176a0
lea rdx, str.HTTP_post_response:
xor ecx, ecx
call fcn.14001eff0
mov rdx, qword [rsp + 0x50]
xor ecx, ecx
call fcn.14001eff0
lea rdx, str._____________________________
xor ecx, ecx
call fcn.14001eff0
call fcn.140002320
mov rcx, rax
test rax, rax
je 0x14002149c
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xe8], rax
mov rax, qword [rsp + 0x138]
mov qword [rsp + 0x20], rax
mov r9, r15
mov r8, r14
lea rdx, [0x1400c9de0]
lea rcx, [rsp + 0xe8]
call fcn.14000bc50
call fcn.140002320
mov rcx, rax
test rax, rax
je 0x1400214a7
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0xe0], rax
lea r8, [rsp + 0xe0]
lea rdx, str.LogPostResponse
mov rcx, qword [rsp + 0xe8]
call fcn.140029360
mov rcx, r12
mov rdx, qword [rsp + 0xe0]
lea r8, str.True
movzx eax, word [rdx + rcx*2]
inc rcx
cmp ax, word [r8 + rcx*2 - 2]
jne 0x1400205be
cmp rcx, 5
jne 0x140020560
mov qword [rsp + 0xc8], r12
lea r8, [0x1400ca62c]
lea rdx, str.BugSplatPost.log
lea rcx, [rsp + 0xc8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
mov rcx, qword [rsp + 0xc8]
test rcx, rcx
je 0x1400205be
mov rdx, qword [rsp + 0x50]
call fcn.1400226a0
mov rcx, qword [rsp + 0xc8]
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov dword [rsp + 0x68], 2
mov rcx, qword [rsp + 0x50]
cmp dword [rcx - 0x10], 0
jl 0x140021364
lea rdx, str.:::::_DB_UPDATED_
call sub.VCRUNTIME140.dll_wcsstr
mov rbx, rax
test rax, rax
je 0x140021364
sub rbx, qword [rsp + 0x50]
sar rbx, 1
test ebx, ebx
js 0x140021364
mov dword [rsp + 0x68], r12d
call fcn.140002320
mov rcx, rax
test rax, rax
je 0x1400214b2
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x88], rax
call fcn.140002320
mov rcx, rax
test rax, rax
je 0x1400214bd
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x80], rax
call fcn.140002320
mov rcx, rax
test rax, rax
je 0x1400214c8
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x60], rax
call fcn.140002320
mov rcx, rax
test rax, rax
je 0x1400214d3
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x90], rax
call fcn.140002320
mov rcx, rax
test rax, rax
je 0x1400214de
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea r8d, [rbx + 0x16]
lea rdx, [rsp + 0x1d0]
lea rcx, [rsp + 0x50]
call fcn.14001a160
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140001ae0
nop
mov rdx, qword [rsp + 0x1d0]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400206f2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, qword [rsp + 0x50]
cmp dword [rcx - 0x10], 0
jl 0x140020b5f
lea rdx, [0x1400ca710]
call sub.VCRUNTIME140.dll_wcsstr
mov rdi, rax
test rax, rax
je 0x140020b5f
mov rcx, qword [rsp + 0x50]
sub rdi, rcx
sar rdi, 1
test edi, edi
js 0x140020b5f
cmp edi, dword [rcx - 0x10]
jl 0x140020748
add rcx, 0xffffffffffffffe8
call fcn.140002030
lea rbx, [rax + 0x18]
mov qword [rsp + 0xd0], rbx
jmp 0x14002078a
mov rcx, qword [rcx - 0x18]
test rcx, rcx
je 0x14002075c
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x14002076a
call fcn.140002320
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov r9, rax
mov r8d, edi
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0xd0]
call fcn.1400164d0
mov rbx, qword [rsp + 0xd0]
lea rdx, [rsp + 0xd0]
lea rcx, [rsp + 0x88]
call fcn.140001ae0
nop
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400207ba
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
lea r8d, [rdi + 2]
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0x50]
call fcn.14001a160
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140001ae0
nop
mov rdx, qword [rsp + 0x1e0]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140020801
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, qword [rsp + 0x50]
cmp dword [rcx - 0x10], 0
jl 0x140020b5f
lea rdx, [0x1400ca710]
call sub.VCRUNTIME140.dll_wcsstr
mov rdi, rax
test rax, rax
je 0x140020b5f
mov rcx, qword [rsp + 0x50]
sub rdi, rcx
sar rdi, 1
test edi, edi
js 0x140020b5f
cmp edi, dword [rcx - 0x10]
jl 0x140020857
add rcx, 0xffffffffffffffe8
call fcn.140002030
lea rbx, [rax + 0x18]
mov qword [rsp + 0xd8], rbx
jmp 0x140020899
mov rcx, qword [rcx - 0x18]
test rcx, rcx
je 0x14002086b
mov rax, qword [rcx]
call qword [rax + 0x20]
test rax, rax
jne 0x140020879
call fcn.140002320
mov rdx, qword [rax]
mov rcx, rax
call qword [rdx + 0x20]
mov r9, rax
mov r8d, edi
mov rdx, qword [rsp + 0x50]
lea rcx, [rsp + 0xd8]
call fcn.1400164d0
mov rbx, qword [rsp + 0xd8]
lea rdx, [rsp + 0xd8]
lea rcx, [rsp + 0x80]
call fcn.140001ae0
nop
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400208c9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
lea r8d, [rdi + 2]
lea rdx, [rsp + 0x178]
lea rcx, [rsp + 0x50]
call fcn.14001a160
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140001ae0
nop
mov rdx, qword [rsp + 0x178]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140020910
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, qword [rsp + 0x50]
cmp dword [rcx - 0x10], 0
jl 0x140020b5f
lea rdx, [0x1400ca710]
call sub.VCRUNTIME140.dll_wcsstr
mov rbx, rax
test rax, rax
je 0x140020b5f
sub rbx, qword [rsp + 0x50]
sar rbx, 1
test ebx, ebx
js 0x140020b5f
mov r8d, ebx
lea rdx, [rsp + 0xf8]
lea rcx, [rsp + 0x50]
call fcn.14001a0d0
nop
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140001ae0
nop
mov rdx, qword [rsp + 0xf8]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002098d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
lea r8d, [rbx + 2]
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x50]
call fcn.14001a160
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140001ae0
nop
mov rdx, qword [rsp + 0xc0]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400209d4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, qword [rsp + 0x50]
cmp dword [rcx - 0x10], 0
jl 0x140020b5f
lea rdx, [0x1400ca710]
call sub.VCRUNTIME140.dll_wcsstr
mov rbx, rax
test rax, rax
je 0x140020b5f
sub rbx, qword [rsp + 0x50]
sar rbx, 1
test ebx, ebx
js 0x140020b5f
mov r8d, ebx
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x50]
call fcn.14001a0d0
nop
mov rdx, rax
lea rcx, [rsp + 0x90]
call fcn.140001ae0
nop
mov rdx, qword [rsp + 0x100]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140020a54
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
lea r8d, [rbx + 2]
lea rdx, [rsp + 0x108]
lea rcx, [rsp + 0x50]
call fcn.14001a160
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140001ae0
nop
mov rdx, qword [rsp + 0x108]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140020a9b
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rcx, qword [rsp + 0x50]
cmp dword [rcx - 0x10], 0
jl 0x140020b5f
lea rdx, [0x1400ca710]
call sub.VCRUNTIME140.dll_wcsstr
mov rbx, rax
test rax, rax
je 0x140020b5f
sub rbx, qword [rsp + 0x50]
sar rbx, 1
test ebx, ebx
js 0x140020b5f
mov r8d, ebx
lea rdx, [rsp + 0x110]
lea rcx, [rsp + 0x50]
call fcn.14001a0d0
nop
mov rdx, rax
lea rcx, [rsp + 0x78]
call fcn.140001ae0
nop
mov rdx, qword [rsp + 0x110]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140020b18
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
lea r8d, [rbx + 2]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x50]
call fcn.14001a160
nop
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140001ae0
nop
mov rdx, qword [rsp + 0xa0]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140020b5f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rsi, qword [rsp + 0x88]
mov rdx, rsi
lea rcx, str.HTTP_request_succeeded
call fcn.14001eff0
mov rdx, rsi
xor ecx, ecx
call fcn.14001eff0
mov r14, qword [rsp + 0x80]
mov rdx, r14
xor ecx, ecx
call fcn.14001eff0
mov rdi, qword [rsp + 0x60]
mov rdx, rdi
xor ecx, ecx
call fcn.14001eff0
mov r15, qword [rsp + 0x90]
mov rdx, r15
xor ecx, ecx
call fcn.14001eff0
mov rbx, qword [rsp + 0x78]
mov rdx, rbx
xor ecx, ecx
call fcn.14001eff0
cmp dword [r15 - 0x10], 0
jle 0x1400210b8
mov rcx, r15
call qword [sym.imp.api_ms_win_crt_convert_l1_1_0.dll__wtoi]
test eax, eax
mov rax, qword [rsp + 0x70]
js 0x140020f8c
cmp byte [rax + 0x80], 0
jne 0x140020f8c
mov r13, rbx
movzx ecx, word [r13]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x140020c08
add r13, 2
jmp 0x140020bf3
cmp r13, rbx
je 0x140020c92
sub r13, rbx
sar r13, 1
mov edx, dword [rbx - 0x10]
test edx, edx
js 0x1400214e9
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edx
or eax, ecx
jge 0x140020c42
lea rcx, [rsp + 0x78]
call fcn.140002930
mov rbx, qword [rsp + 0x78]
movsxd rax, r13d
lea r8, [rbx + rax*2]
mov ecx, dword [rbx - 0x10]
mov eax, ecx
sub eax, r13d
mov dword [rsp + 0x98], eax
inc eax
movsxd r9, eax
add r9, r9
lea eax, [rcx + 1]
movsxd rdx, eax
add rdx, rdx
mov rcx, rbx
call fcn.14001f1e0
movsxd rax, dword [rsp + 0x98]
test eax, eax
js 0x1400214f3
cmp eax, dword [rbx - 0xc]
jg 0x1400214f3
mov dword [rbx - 0x10], eax
mov word [rbx + rax*2], r12w
mov rax, rbx
mov qword [rsp + 0x98], rbx
mov r13, r12
movzx ecx, word [rax]
test cx, cx
je 0x140020cf3
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_iswspace]
test eax, eax
je 0x140020cda
mov rax, qword [rsp + 0x98]
test r13, r13
cmovne rax, r13
mov r13, rax
mov rax, qword [rsp + 0x98]
add rax, 2
mov qword [rsp + 0x98], rax
jmp 0x140020ca0
mov r13, r12
mov rax, qword [rsp + 0x98]
add rax, 2
mov qword [rsp + 0x98], rax
jmp 0x140020ca0
test r13, r13
je 0x140020d41
sub r13, rbx
sar r13, 1
test r13d, r13d
js 0x1400214fd
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, r13d
or eax, ecx
jge 0x140020d2b
mov edx, r13d
lea rcx, [rsp + 0x78]
call fcn.140002930
mov rbx, qword [rsp + 0x78]
cmp r13d, dword [rbx - 0xc]
jg 0x140021507
mov dword [rbx - 0x10], r13d
movsxd rax, r13d
mov word [rbx + rax*2], r12w
cmp dword [rbx - 0x10], 0
je 0x140020d75
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, rbx
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov r13, 0xffffffffffffffff
jmp 0x140020f87
call fcn.140002320
mov rcx, rax
test rax, rax
je 0x140021511
mov rax, qword [rax]
call qword [rax + 0x18]
add rax, 0x18
mov qword [rsp + 0x58], rax
lea r9, [rsp + 0x58]
mov r14, qword [rsp + 0x138]
mov r8, r14
mov rsi, qword [rsp + 0x1d8]
mov rdx, rsi
mov rbx, qword [rsp + 0x180]
mov rcx, rbx
call fcn.140028e20
test al, al
jne 0x140020e3d
lea rax, [0x1400ca748]
mov qword [rsp + 0x20], rax
mov r9, r14
mov r8, rsi
mov rdx, rbx
lea rcx, [rsp + 0x140]
call fcn.140028ef0
nop
mov r8, qword [rsp + 0x140]
lea rdx, str._s_browse_crashinfo.php
lea rcx, [rsp + 0x58]
call fcn.14000bc50
nop
mov rdx, qword [rsp + 0x140]
add rdx, 0xffffffffffffffe8
mov r13, 0xffffffffffffffff
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140020e2e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rdi, qword [rsp + 0x60]
mov r15, qword [rsp + 0x90]
jmp 0x140020e44
mov r13, 0xffffffffffffffff
lea rdx, str._vendor
lea rcx, [rsp + 0x58]
call fcn.140018590
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.140018660
lea rdx, str.app
lea rcx, [rsp + 0x58]
call fcn.140018590
mov rdx, rsi
lea rcx, [rsp + 0x58]
call fcn.140018660
lea rdx, [0x1400ca7a0]
lea rcx, [rsp + 0x58]
call fcn.140018590
mov rdx, r14
lea rcx, [rsp + 0x58]
call fcn.140018660
mov rbx, qword [rsp + 0x188]
test rbx, rbx
je 0x140020edd
mov rax, r13
nop
inc rax
cmp word [rbx + rax*2], 0
jne 0x140020eb0
test rax, rax
je 0x140020edd
lea rdx, str.key
lea rcx, [rsp + 0x58]
call fcn.140018590
mov rdx, rbx
lea rcx, [rsp + 0x58]
call fcn.140018660
lea rdx, str.id
lea rcx, [rsp + 0x58]
call fcn.140018590
mov r8d, dword [r15 - 0x10]
mov rdx, r15
lea rcx, [rsp + 0x58]
call fcn.140001f00
lea rdx, str.row
lea rcx, [rsp + 0x58]
call fcn.140018590
mov r8d, dword [rdi - 0x10]
mov rdx, rdi
lea rcx, [rsp + 0x58]
call fcn.140001f00
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, qword [rsp + 0x58]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov rdx, qword [rsp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140020f65
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
mov rbx, qword [rsp + 0x78]
mov r15, qword [rsp + 0x90]
mov rdi, qword [rsp + 0x60]
mov r14, qword [rsp + 0x80]
mov rsi, qword [rsp + 0x88]
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x70]
cmp dword [rax - 0x10], 0
jle 0x1400210b8
mov rax, qword [rsp + 0x70]
mov rax, qword [rax + 0x90]
cmp dword [rax - 0x10], 0
jle 0x1400210b8
mov r8, rsi
mov edx, 0x104
lea rcx, [rsp + 0x510]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea r8, [0x1400ca7c4]
mov edx, 0x104
lea rcx, [rsp + 0x510]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov r8, r14
mov edx, 0x104
lea rcx, [rsp + 0x510]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x1400ca7c4]
mov edx, 0x104
lea rcx, [rsp + 0x510]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov r8, r15
mov edx, 0x104
lea rcx, [rsp + 0x510]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x1400ca7c4]
mov edx, 0x104
lea rcx, [rsp + 0x510]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov r8, rdi
mov edx, 0x104
lea rcx, [rsp + 0x510]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
lea r8, [0x1400ca7c8]
mov edx, 0x104
lea rcx, [rsp + 0x510]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscat_s]
mov r15, qword [rsp + 0x70]
mov r8, qword [r15 + 0x70]
mov edx, 0x104
lea rcx, [rsp + 0x720]
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcscpy_s]
lea rdx, [rsp + 0x510]
lea rcx, [rsp + 0x720]
call qword [sym.imp.SHLWAPI.dll_PathAppendW]
lea rdx, [rsp + 0x720]
mov rcx, qword [r15 + 0x90]
call qword [sym.imp.KERNEL32.dll_MoveFileW]
nop
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0xc8]
cmp dword [rcx - 0x10], 0
jle 0x140021130
lea rax, [rsp + 0x148]
mov qword [rsp + 0x188], rax
add rcx, 0xffffffffffffffe8
call fcn.140002030
add rax, 0x18
mov qword [rsp + 0x148], rax
lea rcx, [rdi - 0x18]
call fcn.140002030
add rax, 0x18
mov qword [rsp + 0x150], rax
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x150]
call fcn.14001f730
test al, al
je 0x140021130
mov rax, qword [rsp + 0x70]
mov rcx, qword [rax + 0xc8]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
jmp 0x140021154
xor edx, edx
lea rcx, str.BugSplat
call fcn.1400274d0
lea rdx, str.BugSplat
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_RegisterEventSourceW]
mov r15, rax
test rax, rax
je 0x1400212bf
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
or eax, ecx
jge 0x1400211a3
xor edx, edx
lea rcx, [rsp + 0x88]
call fcn.140002930
mov rsi, qword [rsp + 0x88]
mov qword [rsp + 0x4f8], rsi
mov ecx, 1
sub ecx, dword [r14 - 8]
mov eax, dword [r14 - 0xc]
or eax, ecx
jge 0x1400211d3
xor edx, edx
lea rcx, [rsp + 0x80]
call fcn.140002930
mov r14, qword [rsp + 0x80]
mov qword [rsp + 0x500], r14
mov ecx, 1
sub ecx, dword [rdi - 8]
mov eax, dword [rdi - 0xc]
or eax, ecx
jge 0x1400211fb
xor edx, edx
lea rcx, [rsp + 0x60]
call fcn.140002930
mov rdi, qword [rsp + 0x60]
mov qword [rsp + 0x508], rdi
mov ecx, 3
xor r8d, r8d
lea edx, [rcx - 2]
mov qword [rsp + 0x40], r12
lea rax, [rsp + 0x4f8]
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x30], r12d
mov word [rsp + 0x28], cx
mov qword [rsp + 0x20], r12
mov r9d, edx
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_ReportEventW]
movsxd rdx, dword [rsi - 0xc]
mov rcx, rsi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
test eax, eax
js 0x140021530
cmp eax, dword [rsi - 0xc]
jg 0x140021530
mov dword [rsi - 0x10], eax
cdqe
mov word [rsi + rax*2], r12w
movsxd rdx, dword [r14 - 0xc]
mov rcx, r14
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
test eax, eax
js 0x140021526
cmp eax, dword [r14 - 0xc]
jg 0x140021526
mov dword [r14 - 0x10], eax
cdqe
mov word [r14 + rax*2], r12w
movsxd rdx, dword [rdi - 0xc]
mov rcx, rdi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcsnlen]
test eax, eax
js 0x14002151c
cmp eax, dword [rdi - 0xc]
jg 0x14002151c
mov dword [rdi - 0x10], eax
cdqe
mov word [rdi + rax*2], r12w
mov rcx, r15
call qword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
nop
lea rdx, [rbx - 0x18]
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400212da
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x90]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400212fd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x60]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14002131d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x80]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140021340
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x88]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140021373
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
jmp 0x140021373
xor edx, edx
lea rcx, str.Server_error._HTTP_request_succeeded__but_report_failed_to_post
call fcn.14001eff0
nop
mov rdx, qword [rsp + 0xe0]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140021396
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0xe8]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400213b9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
mov rdx, qword [rsp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, r13d
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400213d9
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
lea rcx, [rsp + 0x298]
call fcn.140018130
nop
lea rcx, [rsp + 0x4b0]
call fcn.140053af0
nop
lea rcx, [rsp + 0x160]
call fcn.1400178d0
nop
mov rcx, qword [rsp + 0xf0]
test rcx, rcx
je 0x14002141b
mov rax, qword [rcx]
mov edx, 1
call qword [rax]
nop
cmp dword [rsp + 0x68], 0
jne 0x14002143b
xor edx, edx
lea rcx, [rsp + 0x398]
call fcn.14006e110
nop
jmp 0x14002143b
mov rdx, qword [rsp + 0x158]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], r13d
sub r13d, 1
jg 0x14002145d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
nop
lea rcx, [rsp + 0x398]
call fcn.140013e20
nop
mov eax, dword [rsp + 0x68]
mov rcx, qword [rsp + 0x930]
xor rcx, rsp
call fcn.14005f850
lea r11, [rsp + 0x940]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rdi
ret
mov ecx, 0x80004005
call fcn.140001ff0
nop
mov ecx, 0x80004005
call fcn.140001ff0
nop
mov ecx, 0x80004005
call fcn.140001ff0
nop
mov ecx, 0x80004005
call fcn.140001ff0
nop
mov ecx, 0x80004005
call fcn.140001ff0
nop
mov ecx, 0x80004005
call fcn.140001ff0
nop
mov ecx, 0x80004005
call fcn.140001ff0
nop
mov ecx, 0x80070057
call fcn.140001ff0
mov ecx, 0x80070057
call fcn.140001ff0
mov ecx, 0x80070057
call fcn.140001ff0
mov ecx, 0x80070057
call fcn.140001ff0
mov ecx, 0x80004005
call fcn.140001ff0
int3
mov ecx, 0x80070057
call fcn.140001ff0
mov ecx, 0x80070057
call fcn.140001ff0
mov ecx, 0x80070057
call fcn.140001ff0
int3