Function at 0x14000fb20
Capabilities:
Create thread
Read file on windows
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x78]
sub rsp, 0x150
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x140070040]
xor rax, rsp
mov qword [rbp + 0x28], rax
movzx edi, dl
mov byte [rsp + 0x31], dl
mov r12, rcx
xor ebx, ebx
lea rax, [0x140073ac0]
mov qword [rsp + 0x50], rax
mov rcx, rax
call fcn.14002d124
test eax, eax
jne 0x1400101db
mov eax, dword [0x140073b0c]
cmp eax, 0x7fffffff
je 0x1400101e6
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], 3
mov esi, reloc.OLEAUT32.dll_SafeArrayDestroy
mov qword [rbp - 0x68], rsi
mov eax, dword [0x1400633fc]
mov word [rbp - 0x80], ax
movzx eax, byte [0x1400633fe]
mov byte [rbp - 0x7e], al
mov byte [rbp - 0x7d], bl
movups xmmword [rbp - 0x18], xmm0
mov qword [rbp - 8], rbx
mov qword [rbp], rbx
lea r8d, [rbx + 5]
lea rdx, [0x140063190]
lea rcx, [rbp - 0x18]
call fcn.140002770
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], rbx
lea r8d, [rbx + 4]
lea rdx, str.DXWM
lea rcx, [rbp - 0x38]
call fcn.140002770
nop
mov rcx, qword [r12 + 0x520]
lea r8, [rcx + 8]
lea rax, [rbp - 0x18]
mov qword [rsp + 0x20], rax
lea r9, [rbp - 0x38]
lea rdx, [rbp + 8]
mov rcx, qword [rcx]
call fcn.14000cd00
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 7
jbe 0x14000fc6c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fc67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400101f9
call fcn.14002d920
mov qword [rbp - 0x28], rbx
mov qword [rbp - 0x20], 7
mov word [rbp - 0x38], bx
mov rdx, qword [rbp]
cmp rdx, 7
jbe 0x14000fcbc
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fcb7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400101ff
call fcn.14002d920
mov qword [rbp - 8], rbx
mov qword [rbp], 7
mov word [rbp - 0x18], bx
lea rcx, [rbp + 8]
mov r13, qword [rbp + 0x20]
cmp r13, 7
seta bl
mov byte [rsp + 0x30], bl
mov r15, qword [rbp + 8]
cmova rcx, r15
mov r14, qword [rbp + 0x18]
cmp r14, 0x12
jne 0x14000fd1f
mov r8, r14
lea rdx, str.SyK3aYzQCG44zzWsj3
test r14, r14
je 0x14000ff19
movzx eax, word [rdx]
cmp word [rcx], ax
jne 0x14000fd1f
add rcx, 2
add rdx, 2
sub r8, 1
jne 0x14000fd04
jmp 0x14000ff19
mov r13, qword [0x140073aa0]
test r13, r13
je 0x14000fefb
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, 0x2f
jb 0x140010205
lea rdx, [0x140073a90]
cmp qword [0x140073aa8], 0xf
cmova rdx, qword [0x140073a90]
mov qword [rsp + 0x40], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xor r8d, r8d
mov qword [rsp + 0x70], r8
mov qword [rsp + 0x78], r8
lea rax, [r13 + 0x2f]
mov ebx, reloc.OLEAUT32.dll_SafeArrayDestroy
lea rdi, [rsp + 0x60]
lea r9d, [r8 + 0x16]
cmp rax, rbx
jbe 0x14000fe1d
mov rbx, rax
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000fdda
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14002d954
test rax, rax
je 0x14001020b
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
lea rax, [r13 + 0x2f]
mov rdx, qword [rsp + 0x40]
jmp 0x14000fe18
cmp rbx, r9
cmovb rbx, r9
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14000fdfd
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400101d5
jmp 0x14000fdb2
test rcx, rcx
je 0x14000fe15
call fcn.14002d954
mov rdi, rax
lea rax, [r13 + 0x2f]
mov rdx, qword [rsp + 0x40]
jmp 0x14000fe18
mov rdi, r8
mov qword [rsp + 0x60], rdi
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rbx
movups xmm0, xmmword [str.https:__flingtrainer.com_download.php_title_id]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x140063428]
movups xmmword [rdi + 0x10], xmm1
movsd xmm0, qword [0x140063438]
movsd qword [rdi + 0x20], xmm0
mov eax, dword [0x140063440]
mov dword [rdi + 0x28], eax
movzx eax, word [0x140063444]
mov word [rdi + 0x2c], ax
movzx eax, byte [0x140063446]
mov byte [rdi + 0x2e], al
lea rcx, [rdi + 0x2f]
mov r8, r13
call fcn.14004ff70
mov byte [rdi + r13 + 0x2f], 0
mov r8d, SafeArrayUnaccessData
lea rdx, str.sourcetrainer_banner
lea rcx, [rsp + 0x60]
call fcn.140002220
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], 0
mov qword [rax + 0x18], reloc.OLEAUT32.dll_SafeArrayDestroy
mov byte [rax], 0
movups xmmword [rbp - 0x80], xmm6
movups xmmword [rbp - 0x70], xmm7
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14000feef
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000feea
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14001020b
call fcn.14002d920
movzx ebx, byte [rsp + 0x30]
movzx edi, byte [rsp + 0x31]
jmp 0x14000ff11
mov r8d, 0x4e
lea rdx, str.https:__flingtrainer.com_download.php_title_id999999999sourcetrainer_banner
lea rcx, [rbp - 0x80]
call fcn.1400020c0
mov rsi, qword [rbp - 0x68]
mov r13, qword [rbp + 0x20]
mov eax, 0xa
mov dword [rsp + 0x40], eax
xor eax, eax
mov dword [rsp + 0x34], eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x34]
lea r8d, [rax + 4]
lea rdx, [rsp + 0x40]
mov rcx, qword [r12 + 8]
call qword [sym.imp.KERNEL32.dll_WriteFile]
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], 5
mov qword [rsp + 0x78], reloc.OLEAUT32.dll_SafeArrayDestroy
mov eax, dword [str.WMURL]
mov dword [rsp + 0x60], eax
movzx eax, byte [0x1400634a4]
mov byte [rsp + 0x64], al
mov byte [rsp + 0x65], 0
lea rdx, [rsp + 0x60]
mov rcx, r12
call fcn.14000ac40
xor eax, eax
mov dword [rsp + 0x34], eax
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x40]
lea r8d, [rax + 4]
lea rdx, [rsp + 0x34]
mov rcx, qword [r12 + 8]
call qword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [rsp + 0x34], 1
jne 0x14000ffd3
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.140001fa0
mov rdx, rax
mov rcx, r12
call fcn.14000ac40
mov rsi, qword [rbp - 0x68]
test dil, dil
je 0x14001011a
mov qword [rbp - 0x60], r12
xorps xmm0, xmm0
movups xmmword [rbp - 0x58], xmm0
xor eax, eax
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rax
lea rdi, [rbp + 8]
test bl, bl
cmovne rdi, r15
movabs rbx, 0x7ffffffffffffffe
cmp r14, rbx
ja 0x140010211
cmp r14, 7
ja 0x140010029
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], 7
movups xmm6, xmmword [rdi]
movups xmmword [rbp - 0x58], xmm6
jmp 0x140010082
mov rax, r14
or rax, 7
cmp rax, rbx
ja 0x140010045
mov rbx, rax
cmp rax, 0xa
mov eax, 0xa
cmovb rbx, rax
inc rbx
mov qword [rsp + 0x40], rbx
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x58]
call fcn.140002640
lea rcx, [rbx - 1]
mov qword [rbp - 0x58], rax
mov qword [rbp - 0x48], r14
mov qword [rbp - 0x40], rcx
lea r8, [r14*2 + 2]
mov rdx, rdi
mov rcx, rax
call fcn.14004ff70
movups xmm6, xmmword [rbp - 0x58]
mov ecx, 0x28
call fcn.14002d954
mov rbx, rax
mov qword [rax], r12
xor edi, edi
movups xmmword [rax + 8], xmm6
movups xmm0, xmmword [rbp - 0x48]
movups xmmword [rax + 0x18], xmm0
mov qword [rbp - 0x48], rdi
mov qword [rbp - 0x40], 7
mov word [rbp - 0x58], di
mov qword [rsp + 0x40], rdi
lea rcx, [rsp + 0x40]
call fcn.140011f50
mov qword [rsp + 0x40], rbx
lea rax, [rsp + 0x68]
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], edi
mov r9, rbx
lea r8, [0x1400122e0]
xor edx, edx
xor ecx, ecx
call fcn.140038c98
mov qword [rsp + 0x60], rax
test rax, rax
je 0x140010228
cmp dword [rsp + 0x68], edi
je 0x14001021d
movaps xmm0, xmmword [rsp + 0x60]
movdqa xmmword [rsp + 0x40], xmm0
lea rcx, [rsp + 0x40]
call fcn.14002d084
test eax, eax
jne 0x14001021d
cmp byte [rsp + 0x30], 0
je 0x140010157
lea rdx, [r13*2 + 2]
mov rax, r15
cmp rdx, 0x1000
jb 0x14001014e
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010217
mov rcx, r15
call fcn.14002d920
nop
cmp rsi, 0xf
jbe 0x14001018c
lea rdx, [rsi + 1]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010186
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400101cf
call fcn.14002d920
nop
lea rcx, [0x140073ac0]
call fcn.14002d12c
mov rcx, qword [rbp + 0x28]
xor rcx, rsp
call fcn.14002d900
lea r11, [rsp + 0x150]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.14003474c
nop
call fcn.140001260
nop
mov ecx, 5
call fcn.14002cfe8
int3
dec eax
mov dword [0x140073b0c], eax
mov ecx, 6
call fcn.14002cfe8
nop
call fcn.14003474c
nop
call fcn.14003474c
int3
call fcn.140001300
int3
call fcn.14003474c
int3
call fcn.140001300
nop
call fcn.14003474c
nop
mov ecx, 1
call fcn.14002cfe8
nop
mov dword [rsp + 0x68], edi
mov ecx, 6
call fcn.14002cfe8
int3