Function at 0x140068e57
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x698
mov r15, r8
mov rdi, rdx
mov qword [rsp + 0x68], rcx
mov rdx, qword [rdx + 0x3f0]
add rdx, 0x10
lea rsi, [rsp + 0x2b0]
mov rcx, rsi
call fcn.140022f54
lea rdx, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_h2_src_proto_streams_streams.rs
mov rcx, rsi
call fcn.14005d3a5
mov rcx, qword [rax + 0x168]
or rcx, qword [rax + 0x178]
je 0x140068eb9
mov rcx, rax
call fcn.1400cc967
jmp 0x140068ee5
mov rsi, qword [rax + 0x218]
mov rcx, rax
call fcn.1400cc967
cmp rsi, 1
ja 0x140068ee5
lea rcx, [rdi + 0x390]
mov rdx, qword [rdi + 0x3f0]
add rdx, 0x10
call fcn.140071e58
mov rax, qword [rdi + 0x368]
cmp rax, 2
jne 0x140068f00
mov qword [rsp + 0x2b0], 2
jmp 0x140068f50
lea rsi, [rdi + 0x368]
lea rbx, [rdi + 0x380]
mov rcx, qword [rdi + 0x370]
mov r8, qword [rdi + 0x378]
test rax, rax
je 0x140068f2f
mov rdx, r8
call fcn.1400d1200
mov rcx, rax
mov r8, rdx
mov rdx, rbx
call qword [r8 + 0x70]
mov rbx, rax
lea r14, [rsp + 0x2b0]
mov rcx, r14
mov rdx, rsi
call fcn.1400d1131
mov qword [r14 + 0x18], rbx
mov rax, qword [rdi + 0x388]
mov rcx, qword [rsp + 0x2b0]
mov rdx, qword [rsp + 0x2b8]
movups xmm0, xmmword [rsp + 0x2c0]
movaps xmmword [rsp + 0x420], xmm0
mov qword [rsp + 0x410], rcx
mov qword [rsp + 0x418], rdx
mov qword [rsp + 0x430], rax
cmp dword [rsp + 0x410], 2
je 0x140068fae
lea rdx, [rsp + 0x428]
lea rcx, [rsp + 0x410]
call fcn.1400d1213
mov qword [rsp + 0x5a8], 2
and qword [rsp + 0x5c8], 0
lea r14, [rdi + 0x48]
lea rax, [rdi + 0x400]
mov qword [rsp + 0x150], rax
lea rax, [rdi + 0x390]
mov qword [rsp + 0x158], rax
lea r12, [rsp + 0x288]
mov dword [rsp + 0x5c], eax
mov qword [rsp + 0x70], r15
mov qword [rsp + 0x90], r14
movzx eax, byte [rdi + 0x3e8]
test rax, rax
je 0x140069077
cmp eax, 1
jne 0x14006a597
mov esi, dword [rdi + 0x3ec]
mov bl, byte [rdi + 0x3e9]
mov rcx, r14
mov rdx, r15
call fcn.140071e9f
test rax, rax
jne 0x14006a573
test rdx, rdx
jne 0x14006a580
mov rcx, qword [rdi + 0x178]
mov rax, qword [rdi + 0x180]
mov rdx, r15
call qword [rax + 0x30]
test rax, rax
jne 0x14006a573
test rdx, rdx
jne 0x14006a580
mov byte [rdi + 0x3e8], 2
mov byte [rdi + 0x3e9], bl
mov dword [rdi + 0x3ec], esi
jmp 0x140068ffe
mov rcx, r12
mov rdx, rdi
mov r8, r15
call fcn.14006a8bc
movzx eax, byte [rsp + 0x288]
cmp rax, 4
je 0x140069446
cmp al, 3
jne 0x1400690b0
mov word [rdi + 0x3e8], 0x101
and dword [rdi + 0x3ec], 0
jmp 0x140068ffe
mov r12d, dword [rsp + 0x28c]
mov ecx, dword [rsp + 0x290]
mov r14, qword [rdi + 0x3f0]
mov rsi, qword [rdi + 0x3f8]
add r14, 0x10
add rsi, 0x10
test rax, rax
je 0x1400691b1
mov bpl, byte [rsp + 0x289]
mov r13d, dword [rsp + 0x294]
mov r15, qword [rsp + 0x298]
mov rbx, qword [rsp + 0x2a0]
cmp eax, 1
jne 0x14006a706
mov rax, qword [rsp + 0x2a8]
mov dword [rsp + 0x490], ecx
mov dword [rsp + 0x494], r13d
mov qword [rsp + 0x498], r15
mov qword [rsp + 0x4a0], rbx
mov qword [rsp + 0x4a8], rax
lea rcx, [rsp + 0x168]
lea rdx, [rsp + 0x490]
call fcn.140012213
mov dword [rsp + 0x164], r12d
mov byte [rsp + 0x161], bpl
mov byte [rsp + 0x160], 1
cmp dword [rdi + 0x3b8], 0
je 0x14006927c
cmp dword [rdi + 0x3c0], r12d
jne 0x14006927c
mov byte [rdi + 0x3e8], 1
mov byte [rdi + 0x3e9], bpl
mov dword [rdi + 0x3ec], r12d
lea rcx, [rsp + 0x160]
call fcn.14005d6e4
lea rcx, [rsp + 0x490]
call fcn.140030d51
jmp 0x140069345
mov qword [rsp + 0x80], rcx
lea rbx, [rsp + 0x2b0]
mov rcx, rbx
mov rdx, r14
call fcn.140022f54
mov rcx, rbx
lea rdx, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_h2_src_proto_streams_streams.rs
call fcn.14005d3a5
mov r13, rax
mov ebp, edx
lea r14, [rax + 0x10]
lea rbx, [rax + 0x1a8]
lea rcx, [rsp + 0x490]
mov rdx, rbx
mov r8d, r12d
call fcn.14002c965
cmp qword [rsp + 0x490], 0
je 0x14006934f
movups xmm0, xmmword [rsp + 0x490]
movups xmm1, xmmword [rsp + 0x4a0]
movaps xmmword [rsp + 0x170], xmm1
movaps xmmword [rsp + 0x160], xmm0
mov cl, byte [r13 + 0x1a0]
mov edx, r12d
call fcn.1400240b6
test al, al
je 0x14006936e
cmp dword [r13 + 0xb0], 0
jne 0x14006938c
cmp dword [r13 + 0xb4], r12d
ja 0x14006938c
lea eax, [r12 + 2]
mov ecx, eax
shr ecx, 0x1f
mov dword [r13 + 0xb0], ecx
mov dword [r13 + 0xb4], eax
jmp 0x14006938c
mov rax, qword [rsp + 0x180]
mov qword [rsp + 0x2d0], rax
mov al, byte [rsp + 0x160]
mov cl, byte [rsp + 0x161]
movzx edx, word [rsp + 0x162]
mov r8d, dword [rsp + 0x164]
mov r9, qword [rsp + 0x168]
movups xmm0, xmmword [rsp + 0x170]
movaps xmmword [rsp + 0x2c0], xmm0
mov byte [rsp + 0x2b0], al
mov byte [rsp + 0x2b1], cl
mov word [rsp + 0x2b2], dx
mov dword [rsp + 0x2b4], r8d
mov qword [rsp + 0x2b8], r9
mov rcx, r14
mov rdx, rsi
lea rsi, [rsp + 0x2b0]
mov r8, rsi
call fcn.140072ac2
movups xmm0, xmmword [rsp + 0x490]
movups xmm1, xmmword [rsp + 0x4a0]
movaps xmmword [rsp + 0x2c0], xmm1
movaps xmmword [rsp + 0x2b0], xmm0
mov rcx, r14
call fcn.14007274e
mov dword [rsp + 0x2d0], eax
mov dword [rsp + 0x2d4], r12d
mov rcx, qword [rsp + 0x158]
mov rdx, rsi
call fcn.14002aff7
mov r15, qword [rsp + 0x70]
jmp 0x140069431
mov rcx, qword [rsp + 0x498]
mov rdx, qword [rsp + 0x4a0]
call fcn.14002cb71
lea r12, [rsp + 0x2b0]
jmp 0x1400693b5
cmp dword [r14], 0
jne 0x14006938c
cmp dword [r13 + 0x14], r12d
ja 0x14006938c
lea eax, [r12 + 2]
mov ecx, eax
shr ecx, 0x1f
mov dword [r13 + 0x10], ecx
mov dword [r13 + 0x14], eax
lea rcx, [rsp + 0x2b0]
mov edx, r12d
mov r12, rcx
xor r8d, r8d
xor r9d, r9d
call fcn.14002cc17
lea rcx, [rsp + 0x160]
mov rdx, r12
call fcn.14002cbbe
mov dword [rsp + 0x498], eax
mov dword [rsp + 0x49c], edx
mov qword [rsp + 0x490], rbx
mov rcx, r12
mov rdx, rsi
call fcn.140037386
mov rcx, r12
lea rdx, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_h2_src_proto_streams_streams.rs
call fcn.14005d3ed
mov rsi, rax
mov ebx, edx
add rax, 0x10
mov rcx, r13
add rcx, 0x160
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov rcx, r14
lea rdx, [rsp + 0x490]
mov r8, qword [rsp + 0x80]
mov r9b, 1
call fcn.14005efae
mov rcx, rsi
mov edx, ebx
call fcn.1400cc967
mov rcx, r13
mov edx, ebp
call fcn.1400cc967
mov r14, qword [rsp + 0x90]
lea r12, [rsp + 0x288]
jmp 0x140068ffe
mov rdx, qword [rdi + 0x3f0]
add rdx, 0x10
lea rsi, [rsp + 0x2b0]
mov rcx, rsi
call fcn.140022f54
mov rcx, rsi
lea rdx, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_h2_src_proto_streams_streams.rs
call fcn.14005d3a5
mov r15, rax
mov byte [rsp + 0x3c], dl
mov rdx, qword [rdi + 0x3f8]
add rdx, 0x10
mov rcx, rsi
call fcn.140037386
mov rcx, rsi
lea rdx, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_h2_src_proto_streams_streams.rs
call fcn.14005d3ed
mov r12, rax
mov byte [rsp + 0x3b], dl
mov esi, dword [r15 + 0x58]
mov edx, dword [r15 + 0x5c]
mov ecx, esi
call fcn.14002488d
cmp eax, 1
mov qword [rsp + 0x148], r12
jne 0x140069549
mov ebx, edx
mov rcx, r14
mov rdx, qword [rsp + 0x70]
call fcn.140072788
test rax, rax
jne 0x1400696e7
mov r12, rdx
test rdx, rdx
jne 0x1400696f8
and dword [rsp + 0x2b4], 0
mov dword [rsp + 0x2b8], ebx
mov byte [rsp + 0x2b0], 7
mov rcx, r14
lea rdx, [rsp + 0x2b0]
call fcn.1400586b0
mov r8d, 0x1b
mov ecx, eax
lea rdx, str.invalid_WINDOW_UPDATE_frame
lea r9, [0x1401b4090]
call fcn.1400590d4
add esi, ebx
mov ecx, 1
jo 0x140069535
mov dword [r15 + 0x58], esi
xor ecx, ecx
lea rdx, [0x1401b40a8]
call fcn.140072a8a
mov r12, qword [rsp + 0x148]
lea rax, [r12 + 0x10]
mov qword [rsp + 0xc0], rax
lea rsi, [r15 + 0x1a8]
lea rax, [r15 + 0x160]
mov qword [rsp + 0x80], rax
lea rbp, [r15 + 0x60]
mov rcx, r14
mov rdx, qword [rsp + 0x70]
call fcn.140072788
test rax, rax
jne 0x1400696e7
mov r12, rdx
test rdx, rdx
jne 0x1400696f8
lea r12, [rsp + 0x2b0]
mov rcx, r12
mov rdx, rbp
mov r8, rsi
call fcn.14002c9eb
cmp qword [rsp + 0x2b0], 0
je 0x1400696d5
movups xmm0, xmmword [rsp + 0x2b0]
movaps xmmword [rsp + 0x160], xmm0
lea rbx, [rsp + 0x160]
mov rcx, rbx
call fcn.140023ae3
mov r14d, dword [rax + 0x48]
mov rcx, rbx
call fcn.140023ae3
lea rcx, [rax + 0x50]
call fcn.1400248b3
test al, al
je 0x14006969d
lea rcx, [rsp + 0x160]
call fcn.140023ae3
mov ecx, dword [rax + 0xa0]
mov edx, dword [rax + 0xa4]
call fcn.14002488d
cmp eax, 1
jne 0x14006969d
mov ebx, edx
lea r13, [rsp + 0x160]
mov rcx, r13
call fcn.140023ae3
mov eax, dword [rax + 0x114]
mov dword [rsp + 0x2b4], eax
mov dword [rsp + 0x2b8], ebx
mov byte [rsp + 0x2b0], 7
mov rcx, qword [rsp + 0x90]
mov rdx, r12
call fcn.1400586b0
mov r8d, 0x1b
mov ecx, eax
lea rdx, str.invalid_WINDOW_UPDATE_frame
lea r9, [0x1401b4040]
call fcn.1400590d4
mov rcx, r13
call fcn.140023acc
add ebx, dword [rax + 0xa0]
mov ecx, 1
jo 0x140069691
mov dword [rax + 0xa0], ebx
xor ecx, ecx
lea rdx, [0x1401b4078]
call fcn.140072a8a
cmp r14d, 0x3b9aca00
setne r8b
movaps xmm0, xmmword [rsp + 0x160]
movaps xmmword [rsp + 0x2b0], xmm0
mov rcx, qword [rsp + 0x80]
mov rdx, r12
call fcn.140023d97
mov r14, qword [rsp + 0x90]
jmp 0x140069570
mov rcx, r14
mov rdx, qword [rsp + 0x70]
call fcn.140072788
test rax, rax
je 0x1400696ec
mov r13, rax
jmp 0x1400696fb
mov r12, rdx
test rdx, rdx
je 0x1400697d7
xor r13d, r13d
mov bl, byte [rsp + 0x3c]
mov dl, byte [rsp + 0x3b]
mov rcx, qword [rsp + 0x148]
call fcn.1400cc967
mov rcx, r15
mov edx, ebx
call fcn.1400cc967
test r13, r13
jne 0x14006a573
test r12, r12
jne 0x14006a86b
mov rax, qword [rsp + 0x150]
cmp qword [rax], 0
lea rsi, [rsp + 0x2b0]
jne 0x14006976c
cmp byte [rdi + 0x3c4], 0
jne 0x14006a573
cmp dword [rdi + 0x3b8], 0
je 0x14006a573
cmp dword [rdi + 0x3bc], 0x7fffffff
je 0x14006a573
mov rdx, qword [rdi + 0x3f0]
add rdx, 0x10
mov rcx, rsi
call fcn.140022f54
mov rcx, rsi
lea rdx, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_h2_src_proto_streams_streams.rs
call fcn.14005d3a5
mov rsi, qword [rax + 0x168]
mov rbx, qword [rax + 0x178]
mov rcx, rax
call fcn.1400cc967
or rbx, rsi
jne 0x14006a573
mov rdx, qword [rdi + 0x3f0]
add rdx, 0x10
mov rcx, qword [rsp + 0x158]
call fcn.140071e58
mov r15, qword [rsp + 0x70]
lea r12, [rsp + 0x288]
jmp 0x140068ffe
lea rcx, [r15 + 0xb8]
mov qword [rsp + 0xb8], rcx
mov rbp, qword [rsp + 0xc0]
mov rdx, rbp
mov r8, rsi
mov r9, rdi
call fcn.1400727f0
mov eax, dword [rdi + 0x170]
mov qword [rsp + 0x400], rax
lea rax, [r15 + 0xf0]
mov qword [rsp + 0x408], rax
lea rax, [r15 + 0xc8]
mov qword [rsp + 0xc8], rax
mov rax, r15
add rax, 0xbc
mov qword [rsp + 0x3f8], rax
lea rbx, [rsp + 0x2b0]
lea r12, [rsp + 0xa0]
mov rax, qword [r15 + 0x160]
cmp rax, qword [r15 + 0x168]
jbe 0x1400698be
lea rcx, [rsp + 0x160]
mov rdx, qword [rsp + 0x408]
mov r8, rsi
call fcn.14002b593
cmp qword [rsp + 0x160], 0
je 0x1400698be
movups xmm0, xmmword [rsp + 0x160]
movaps xmmword [rsp + 0x2b0], xmm0
mov rcx, qword [rsp + 0x80]
mov rdx, rbx
call fcn.14002b0d3
mov rcx, qword [rsp + 0xc8]
mov rdx, rbx
call fcn.140024cee
mov rcx, rbx
call fcn.140023acc
mov rcx, rax
call fcn.140024fee
jmp 0x140069849
mov qword [rsp + 0x558], 2
and qword [rsp + 0x578], 0
lea rcx, [rsp + 0x440]
mov rdx, qword [rsp + 0xc8]
mov r8, rsi
call fcn.14002caae
cmp qword [rsp + 0x440], 0
je 0x140069b4c
movups xmm0, xmmword [rsp + 0x440]
movaps xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0x580], 2
and qword [rsp + 0x5a0], 0
mov rcx, r12
call fcn.140023ae3
mov r13d, dword [rax + 0x48]
mov rcx, r12
call fcn.140023acc
lea rcx, [rsp + 0x160]
mov rdx, rax
mov r8, rbp
call fcn.14005f245
movzx eax, byte [rsp + 0x160]
cmp rax, 9
jne 0x140069996
mov rcx, r12
call fcn.140023ae3
cmp byte [rax + 0x50], 5
je 0x140069e83
cmp r13d, 0x3b9aca00
setne r8b
movaps xmm0, xmmword [rsp + 0xa0]
movaps xmmword [rsp + 0x2b0], xmm0
mov rcx, qword [rsp + 0x80]
mov rdx, rbx
call fcn.140023d97
jmp 0x140069b0a
test rax, rax
jne 0x140069b6d
lea rax, [rsp + 0x168]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movups xmm2, xmmword [rax + 0x20]
movaps xmmword [rsp + 0x130], xmm2
movaps xmmword [rsp + 0x120], xmm1
movaps xmmword [rsp + 0x110], xmm0
mov rcx, r12
call fcn.140023ae3
mov ebx, dword [rax + 0x84]
lea rcx, [rsp + 0x110]
call fcn.14005ee84
test rax, rax
je 0x140069a54
mov r12, rax
test ebx, ebx
mov eax, 0
jne 0x140069a59
lea r12, [rsp + 0xa0]
mov rcx, r12
call fcn.140023acc
movaps xmm0, xmmword [rsp + 0x110]
movaps xmm1, xmmword [rsp + 0x120]
movaps xmm2, xmmword [rsp + 0x130]
lea rcx, [rsp + 0x2b8]
movups xmmword [rcx + 0x20], xmm2
movups xmmword [rcx + 0x10], xmm1
movups xmmword [rcx], xmm0
mov byte [rsp + 0x2b0], 0
mov rcx, rax
mov rdx, rbp
lea rbx, [rsp + 0x2b0]
mov r8, rbx
call fcn.1400729fa
jmp 0x140069b0a
xor r12d, r12d
xor eax, eax
mov dword [rsp + 0x8c], r13d
mov rcx, qword [rsp + 0x400]
cmp r12, rcx
cmovae r12, rcx
test ebx, ebx
cmovle ebx, eax
cmp r12, rbx
cmovae r12, rbx
test r12, r12
mov ebp, 0
lea r13, [rsp + 0xa0]
je 0x140069cf9
mov rcx, r13
call fcn.140023ae3
mov eax, dword [rax + 0x80]
test eax, eax
cmovle eax, ebp
cmp eax, r12d
jae 0x140069cf9
mov rcx, r13
call fcn.140023acc
movaps xmm0, xmmword [rsp + 0x110]
movaps xmm1, xmmword [rsp + 0x120]
movaps xmm2, xmmword [rsp + 0x130]
lea rcx, [rsp + 0x2b8]
movups xmmword [rcx + 0x20], xmm2
movups xmmword [rcx + 0x10], xmm1
movups xmmword [rcx], xmm0
mov byte [rsp + 0x2b0], 0
mov rcx, rax
mov rbp, qword [rsp + 0xc0]
mov rdx, rbp
lea rbx, [rsp + 0x2b0]
mov r8, rbx
call fcn.1400729fa
mov r12, r13
movzx eax, byte [rsp + 0x160]
cmp rax, 9
je 0x140069b2f
test rax, rax
je 0x140069b2f
cmp eax, 3
je 0x140069b2f
lea rcx, [rsp + 0x160]
call fcn.14005c35c
lea r13, [rsp + 0x580]
mov rcx, r13
call fcn.140024d83
mov rcx, r13
call fcn.14005d815
jmp 0x1400698d3
lea rbx, [rsp + 0x558]
mov rcx, rbx
call fcn.140024d83
mov rcx, rbx
call fcn.14005d815
mov ebx, dword [rsp + 0x54]
jmp 0x14006a234
mov dword [rsp + 0x8c], r13d
cmp eax, 3
jne 0x140069eee
mov eax, dword [rsp + 0x168]
mov dword [rsp + 0x44], eax
lea rax, [rsp + 0x16c]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0x110], xmm0
movaps xmmword [rsp + 0x120], xmm1
mov eax, dword [rax + 0x20]
mov dword [rsp + 0x130], eax
mov r12, qword [rsp + 0x190]
mov eax, dword [rsp + 0x198]
mov dword [rsp + 0x50], eax
mov eax, dword [rsp + 0x19c]
mov dword [rsp + 0x4c], eax
mov al, byte [rsp + 0x1a0]
mov byte [rsp + 0x3f], al
lea rcx, [rsp + 0x1a1]
mov eax, dword [rcx]
mov ecx, dword [rcx + 3]
mov dword [rsp + 0xdb], ecx
mov dword [rsp + 0xd8], eax
mov eax, dword [rsp + 0x1a8]
mov dword [rsp + 0x58], eax
mov al, byte [rsp + 0x1ac]
mov byte [rsp + 0x3e], al
mov al, byte [rsp + 0x1ad]
mov byte [rsp + 0x3d], al
mov al, byte [rsp + 0x1ae]
mov dword [rsp + 0x5c], eax
mov r8d, 0xc5
lea rcx, [rsp + 0x2b0]
lea rdx, [rsp + 0x1af]
call sub.msvcrt.dll_memcpy
mov ebp, dword [rsp + 0x274]
mov r13, qword [rsp + 0x278]
mov rdx, qword [rsp + 0xa0]
mov dword [rsp + 0x10c], ebp
lea rcx, [rsp + 0x450]
lea r8, [rsp + 0x10c]
call fcn.14002c82a
cmp qword [rsp + 0x450], 0
je 0x14006a880
movups xmm0, xmmword [rsp + 0x450]
movaps xmmword [rsp + 0x3e0], xmm0
lea rbx, [rsp + 0x3e0]
mov rcx, rbx
call fcn.140023acc
mov byte [rax + 0x125], 0
mov rcx, rbx
call fcn.140023ae3
cmp qword [rax], 0
je 0x14006a018
mov rax, qword [r15 + 0x160]
cmp rax, qword [r15 + 0x168]
jbe 0x14006a003
mov rcx, qword [rsp + 0x80]
lea rbx, [rsp + 0x3e0]
mov rdx, rbx
call fcn.14002b0d3
mov rcx, qword [rsp + 0xc8]
mov rdx, rbx
call fcn.140024cee
jmp 0x14006a018
mov qword [rsp + 0x2b0], 2
and qword [rsp + 0x2d0], 0
mov rcx, r13
call fcn.140023acc
mov rbx, rax
mov r13, qword [r15 + 0xc0]
mov r14d, dword [rax + 0x84]
test r14d, r14d
cmovle r14d, ebp
lea rcx, [rax + 0x80]
cmp r14, r13
cmovae r14, r13
sub r14, qword [rax + 0x88]
cmovb r14, rbp
mov edx, r12d
call fcn.14002b147
mov rax, qword [rbx + 0x88]
sub rax, r12
mov qword [rbx + 0x88], rax
sub dword [rbx + 0x118], r12d
mov ecx, dword [rbx + 0x84]
test ecx, ecx
cmovle ecx, ebp
cmp rcx, r13
cmovb r13, rcx
sub r13, rax
cmovb r13, rbp
cmp r14d, r13d
jae 0x140069d8d
mov rcx, rbx
call fcn.140024fe2
mov rcx, qword [rsp + 0x3f8]
mov edx, r12d
call fcn.140024864
lea r14, [rsp + 0x2b0]
mov rcx, r14
call fcn.140024d83
mov rcx, r14
call fcn.14005d815
mov qword [rsp + 0x2b0], 2
and qword [rsp + 0x2d0], 0
mov rcx, qword [rsp + 0xb8]
mov edx, r12d
call fcn.14002b147
movzx ebx, byte [rsp + 0x13e]
mov eax, ebx
and al, 1
mov byte [rsp + 0x3f], al
lea rcx, [rsp + 0x110]
call fcn.14005ee84
mov ecx, ebx
and cl, 0xfe
cmp rax, r12
movzx eax, cl
cmovbe eax, ebx
mov dword [rsp + 0x5c], eax
mov rcx, r14
call fcn.140024d83
mov rcx, r14
call fcn.14005d815
mov eax, dword [rsp + 0x110]
mov dword [rsp + 0x44], eax
mov r8d, dword [rsp + 0x138]
lea rax, [rsp + 0x114]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xf0], xmm1
mov eax, dword [rax + 0x20]
mov dword [rsp + 0x100], eax
mov cl, byte [rsp + 0x13c]
mov dl, byte [rsp + 0x13d]
mov r9d, dword [rsp + 0xa8]
mov r10d, dword [rsp + 0xac]
xor r13d, r13d
mov r14, qword [rsp + 0x90]
jmp 0x14006a0a6
mov dword [rsp + 0x8c], r13d
mov r13d, dword [rax + 0x54]
mov rcx, r12
call fcn.140023ae3
mov ebx, dword [rax + 0x114]
mov rcx, r12
call fcn.140023acc
lea rcx, [rax + 0x50]
mov edx, ebx
mov dword [rsp + 0x44], r13d
mov r8d, r13d
mov r9b, 1
call fcn.14002c773
mov rcx, r12
call fcn.140023ae3
mov r11d, dword [rax + 0x114]
mov r13b, 8
mov r12, qword [rsp + 0x78]
mov cl, byte [rsp + 0x3e]
mov dl, byte [rsp + 0x3d]
mov r8d, dword [rsp + 0x58]
mov r9d, dword [rsp + 0x50]
mov r10d, dword [rsp + 0x4c]
jmp 0x14006a0b3
mov ecx, dword [rsp + 0x164]
mov dword [rsp + 0x40], ecx
mov ecx, dword [rsp + 0x168]
mov dword [rsp + 0x44], ecx
mov rbx, qword [rsp + 0x190]
mov r12d, dword [rsp + 0x198]
mov r13b, 7
mov edx, dword [rsp + 0x19c]
dec rax
lea rcx, [0x14006a89c]
movsxd rax, dword [rcx + rax*4]
add rax, rcx
jmp rax
mov rax, qword [rsp + 0x278]
mov qword [rsp + 0x140], rax
mov eax, dword [rsp + 0x274]
mov dword [rsp + 0xb4], eax
mov al, byte [rsp + 0x1ae]
mov dword [rsp + 0x5c], eax
mov al, byte [rsp + 0x1ad]
mov byte [rsp + 0x3d], al
mov al, byte [rsp + 0x1ac]
mov byte [rsp + 0x3e], al
mov eax, dword [rsp + 0x1a8]
mov dword [rsp + 0x58], eax
mov al, byte [rsp + 0x1a0]
mov byte [rsp + 0x3f], al
lea rax, [rsp + 0x16c]
movups xmm0, xmmword [rax]
movups xmm1, xmmword [rax + 0x10]
movaps xmmword [rsp + 0xe0], xmm0
movaps xmmword [rsp + 0xf0], xmm1
mov eax, dword [rax + 0x20]
mov dword [rsp + 0x100], eax
lea rcx, [rsp + 0x1a1]
mov eax, dword [rcx]
mov ecx, dword [rcx + 3]
mov dword [rsp + 0x9b], ecx
mov dword [rsp + 0x98], eax
mov r8d, 0xc5
lea rcx, [rsp + 0x490]
mov dword [rsp + 0x4c], edx
lea rdx, [rsp + 0x1af]
call sub.msvcrt.dll_memcpy
mov r13b, 1
mov eax, dword [rsp + 0x48]
mov dword [rsp + 0x40], eax
mov qword [rsp + 0x78], rbx
mov dword [rsp + 0x50], r12d
jmp 0x14006a0f0
mov rcx, qword [rsp + 0xb8]
lea rdx, [rsp + 0x3e0]
call fcn.14002b198
mov qword [rsp + 0x140], r13
mov dword [rsp + 0xb4], ebp
mov eax, dword [rsp + 0x130]
mov dword [rsp + 0x100], eax
movaps xmm0, xmmword [rsp + 0x110]
movaps xmm1, xmmword [rsp + 0x120]
movaps xmmword [rsp + 0xf0], xmm1
movaps xmmword [rsp + 0xe0], xmm0
mov eax, dword [rsp + 0xd8]
mov ecx, dword [rsp + 0xdb]
mov dword [rsp + 0x98], eax
mov dword [rsp + 0x9b], ecx
mov r8d, 0xc5
lea rcx, [rsp + 0x490]
lea rdx, [rsp + 0x2b0]
call sub.msvcrt.dll_memcpy
mov r13b, 3
mov cl, byte [rsp + 0x3e]
mov dl, byte [rsp + 0x3d]
mov r8d, dword [rsp + 0x58]
mov r9d, dword [rsp + 0x50]
mov r10d, dword [rsp + 0x4c]
mov r11d, dword [rsp + 0x48]
mov rbp, qword [rsp + 0xc0]
movzx eax, byte [rsp + 0x160]
cmp rax, 9
mov byte [rsp + 0x3e], cl
mov byte [rsp + 0x3d], dl
mov dword [rsp + 0x58], r8d
mov dword [rsp + 0x50], r9d
mov dword [rsp + 0x4c], r10d
je 0x14006a0e6
test rax, rax
je 0x14006a0e6
cmp eax, 3
jne 0x14006a412
mov dword [rsp + 0x40], r11d
mov qword [rsp + 0x78], r12
lea rbx, [rsp + 0xa0]
mov rcx, rbx
call fcn.140023ae3
cmp qword [rax], 0
jne 0x14006a114
mov rcx, rbx
call fcn.140023ae3
cmp byte [rax + 0x50], 5
jne 0x14006a124
mov rcx, qword [rsp + 0xc8]
mov rdx, rbx
call fcn.140024cee
cmp dword [rsp + 0x8c], 0x3b9aca00
setne r8b
movaps xmm0, xmmword [rsp + 0xa0]
movaps xmmword [rsp + 0x2b0], xmm0
mov rcx, qword [rsp + 0x80]
lea rbx, [rsp + 0x2b0]
mov rdx, rbx
call fcn.140023d97
movzx eax, word [rsp + 0x64]
mov word [rsp + 0x60], ax
mov al, byte [rsp + 0x66]
mov byte [rsp + 0x62], al
movaps xmm0, xmmword [rsp + 0xe0]
movaps xmm1, xmmword [rsp + 0xf0]
movaps xmmword [rsp + 0x460], xmm0
movaps xmmword [rsp + 0x470], xmm1
mov eax, dword [rsp + 0x100]
mov dword [rsp + 0x480], eax
mov eax, dword [rsp + 0x98]
mov ecx, dword [rsp + 0x9b]
mov dword [rsp + 0xd0], eax
mov dword [rsp + 0xd3], ecx
mov r8d, 0xc5
lea rcx, [rsp + 0x5d3]
lea rdx, [rsp + 0x490]
call sub.msvcrt.dll_memcpy
lea r12, [rsp + 0x580]
mov rcx, r12
call fcn.140024d83
mov rcx, r12
call fcn.14005d815
lea r12, [rsp + 0x558]
mov rcx, r12
call fcn.140024d83
mov rcx, r12
call fcn.14005d815
test r13b, r13b
je 0x14006a27d
movzx eax, r13b
cmp eax, 9
mov r8b, byte [rsp + 0x3f]
mov r9d, dword [rsp + 0x5c]
mov r10d, dword [rsp + 0x4c]
mov r11, qword [rsp + 0x78]
jne 0x14006a2ae
mov ebx, dword [rsp + 0x44]
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x48], eax
mov rcx, r14
mov rdx, qword [rsp + 0x70]
call fcn.140071e9f
test rax, rax
mov dword [rsp + 0x54], ebx
jne 0x14006a4f6
mov r12, rdx
test rdx, rdx
jne 0x1400696f8
mov rcx, qword [rsp + 0xb8]
mov rdx, rbp
mov r8, rsi
mov r9, rdi
call fcn.1400727f0
test al, al
jne 0x140069839
jmp 0x14006a4fb
mov dword [r15 + 0x104], 1
mov eax, dword [rsp + 0x50]
mov dword [r15 + 0x108], eax
mov r10d, dword [rsp + 0x4c]
mov dword [r15 + 0x10c], r10d
mov r8b, byte [rsp + 0x3f]
mov r9d, dword [rsp + 0x5c]
mov r11, qword [rsp + 0x78]
mov byte [rsp + 0x2b0], r13b
mov al, byte [rsp + 0x62]
lea rdx, [rsp + 0x2b8]
mov byte [rdx - 5], al
movzx eax, word [rsp + 0x60]
mov word [rdx - 7], ax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x2b4], eax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x2b8], eax
mov eax, dword [rsp + 0x480]
mov dword [rdx + 0x24], eax
movaps xmm0, xmmword [rsp + 0x460]
movaps xmm1, xmmword [rsp + 0x470]
movups xmmword [rdx + 0x14], xmm1
movups xmmword [rdx + 4], xmm0
mov qword [rsp + 0x2e0], r11
mov eax, dword [rsp + 0x50]
mov dword [rsp + 0x2e8], eax
mov dword [rsp + 0x2ec], r10d
mov byte [rsp + 0x2f0], r8b
mov eax, dword [rsp + 0xd0]
mov ecx, dword [rsp + 0xd3]
mov dword [rdx + 0x3c], ecx
mov dword [rdx + 0x39], eax
mov eax, dword [rsp + 0x58]
mov dword [rsp + 0x2f8], eax
mov al, byte [rsp + 0x3e]
mov byte [rsp + 0x2fc], al
mov al, byte [rsp + 0x3d]
mov byte [rsp + 0x2fd], al
mov byte [rsp + 0x2fe], r9b
mov r8d, 0xc5
lea rcx, [rsp + 0x2ff]
lea rdx, [rsp + 0x5d3]
call sub.msvcrt.dll_memcpy
mov eax, dword [rsp + 0xb4]
mov dword [rsp + 0x3c4], eax
mov rax, qword [rsp + 0x140]
mov qword [rsp + 0x3c8], rax
mov rcx, r14
mov rdx, rbx
call fcn.1400586b0
mov r8d, 0xd
mov ecx, eax
lea rdx, [0x1401b3f07]
lea r9, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_h2_src_proto_streams_prioritize.rsinvalid_frame
call fcn.1400590d4
mov rcx, r14
mov rdx, qword [rsp + 0x70]
call fcn.140072788
test rax, rax
jne 0x14006a53e
mov r12, rdx
test rdx, rdx
jne 0x14006a55e
mov rcx, qword [rsp + 0xb8]
mov rdx, rbp
mov r8, rsi
mov r9, rdi
call fcn.1400727f0
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x54], eax
jmp 0x140069839
lea rcx, [rsp + 0x160]
mov ebx, r11d
call fcn.14005c35c
mov dword [rsp + 0x40], ebx
jmp 0x14006a0eb
mov eax, dword [rsp + 0x16c]
mov dword [rsp + 0xe0], eax
mov r13b, 2
jmp 0x14006a0f0
lea rcx, [rsp + 0x16c]
mov eax, dword [rcx + 0x20]
mov dword [rsp + 0x100], eax
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movaps xmmword [rsp + 0xf0], xmm1
movaps xmmword [rsp + 0xe0], xmm0
mov r13b, 4
mov qword [rsp + 0x78], rbx
mov dword [rsp + 0x50], r12d
mov dword [rsp + 0x4c], edx
jmp 0x14006a0f0
mov r13, rax
jmp 0x14006a551
mov rax, qword [rsp + 0x70]
mov rax, qword [rax]
mov rdx, qword [rax]
mov rcx, qword [rax + 8]
call qword [rdx]
mov rsi, rax
mov rbx, rdx
mov rax, qword [r15 + 0x150]
test rax, rax
je 0x14006a528
mov rcx, qword [r15 + 0x158]
call qword [rax + 0x18]
mov qword [r15 + 0x150], rsi
mov qword [r15 + 0x158], rbx
xor r12d, r12d
jmp 0x1400696f8
mov r13, rax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x54], eax
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x48], eax
mov bl, byte [rsp + 0x3c]
mov dl, byte [rsp + 0x3b]
jmp 0x140069703
mov eax, dword [rsp + 0x40]
mov dword [rsp + 0x48], eax
mov eax, dword [rsp + 0x44]
mov dword [rsp + 0x54], eax
jmp 0x1400696f8
mov byte [rsp + 0x160], 4
jmp 0x14006a7d2
mov rdi, qword [rsp + 0x68]
lea rcx, [rsp + 0x160]
call fcn.14002794c
jmp 0x14006a7d7
mov ebx, dword [rdi + 0x3ec]
mov bpl, byte [rdi + 0x3e9]
mov rcx, qword [rsp + 0x150]
mov rax, qword [rcx + 0x20]
mov qword [rsp + 0x180], rax
movups xmm0, xmmword [rcx]
movups xmm1, xmmword [rcx + 0x10]
movaps xmmword [rsp + 0x170], xmm1
and qword [rdi + 0x400], 0
movaps xmmword [rsp + 0x160], xmm0
and dword [rsp + 0x2d0], 0
mov rax, qword [rsp + 0x160]
xorps xmm0, xmm0
movups xmmword [rsp + 0x2c0], xmm0
lea rdi, [0x1401b5390]
mov qword [rsp + 0x2b0], rdi
lea r14, [0x1401e5048]
mov qword [rsp + 0x2b8], r14
test rax, rax
je 0x14006a63f
lea rcx, [rsp + 0x490]
lea rsi, [rsp + 0x160]
mov rdx, rsi
call fcn.140012213
mov esi, dword [rsi + 0x24]
lea rcx, [rsp + 0x2b0]
call fcn.140030d51
jmp 0x14006a67f
mov rsi, qword [rsp + 0x2d0]
mov qword [rsp + 0x4b0], rsi
mov rax, qword [rsp + 0x2b0]
mov rcx, qword [rsp + 0x2b8]
movups xmm0, xmmword [rsp + 0x2c0]
movaps xmmword [rsp + 0x4a0], xmm0
mov qword [rsp + 0x490], rax
mov qword [rsp + 0x498], rcx
mov rax, qword [rsp + 0x490]
mov rcx, qword [rsp + 0x498]
movaps xmm0, xmmword [rsp + 0x4a0]
movaps xmmword [rsp + 0x2c0], xmm0
mov qword [rsp + 0x2b0], rax
mov qword [rsp + 0x2b8], rcx
lea rcx, [rsp + 0x160]
call fcn.140068980
mov eax, esi
or eax, ebx
je 0x14006a6fc
test esi, esi
je 0x14006a724
movaps xmm0, xmmword [rsp + 0x2b0]
movaps xmm1, xmmword [rsp + 0x2c0]
movups xmmword [rsp + 0x178], xmm1
movups xmmword [rsp + 0x168], xmm0
mov dword [rsp + 0x164], esi
mov word [rsp + 0x160], 0x201
jmp 0x14006a7d2
mov byte [rsp + 0x160], 3
jmp 0x14006a756
shl r13, 0x20
or r13, rcx
je 0x14006a765
lea rcx, [rsp + 0x160]
mov rdx, r13
mov r8, rbx
call fcn.140010880
jmp 0x14006a76e
xorps xmm0, xmm0
movups xmmword [rsp + 0x178], xmm0
mov byte [rsp + 0x160], 1
mov byte [rsp + 0x161], bpl
mov dword [rsp + 0x164], ebx
mov qword [rsp + 0x168], rdi
mov qword [rsp + 0x170], r14
lea rcx, [rsp + 0x2b0]
call fcn.140030d51
jmp 0x14006a7d2
and qword [rsp + 0x160], 0
lea r8, [rsp + 0x2b0]
mov byte [r8 + 1], bpl
mov rax, qword [rsp + 0x170]
lea rcx, [rsp + 0x2b8]
mov qword [rcx + 0x10], rax
movups xmm0, xmmword [rsp + 0x160]
movups xmmword [rcx], xmm0
mov dil, 2
mov byte [r8], dil
mov rcx, r14
mov rdx, rsi
call fcn.140072ac2
mov byte [rsp + 0x161], bpl
mov qword [rsp + 0x168], r13
mov qword [rsp + 0x170], r15
mov qword [rsp + 0x178], rbx
mov byte [rsp + 0x160], dil
mov rdi, qword [rsp + 0x68]
lea rsi, [rsp + 0x5a8]
mov rcx, rsi
call fcn.140024d83
mov rcx, rsi
call fcn.14005d815
lea rsi, [rsp + 0x410]
mov rcx, rsi
call fcn.140024d83
mov rcx, rsi
call fcn.14005d815
movzx eax, byte [rsp + 0x160]
cmp eax, 3
je 0x14006a81e
cmp eax, 4
jne 0x14006a823
mov byte [rdi], 6
jmp 0x14006a856
mov byte [rdi], 5
jmp 0x14006a856
mov rax, qword [rsp + 0x180]
lea rdx, [rsp + 0x2b0]
mov qword [rdx + 0x20], rax
movups xmm0, xmmword [rsp + 0x160]
movups xmm1, xmmword [rsp + 0x170]
movaps xmmword [rdx + 0x10], xmm1
movaps xmmword [rdx], xmm0
mov rcx, rdi
call fcn.14002abab
nop
add rsp, 0x698
pop rbx
pop rbp
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
ret
lea rcx, [rsp + 0x160]
mov rdx, r12
call fcn.14002794c
jmp 0x14006a7d2
lea rcx, str.called__Option::unwrap____on_a__None__value
lea r8, str._Users_halo_Desktop_code_phishing_mpclient_dll_hijack_only_cs_vendor_h2_src_proto_streams_prioritize.rsinvalid_frame
mov edx, 0x2b
call fcn.140013970
ud2