Function at 0x1400103c0
Capabilities:
Create new key via cryptacquirecontext
Encode data using xor
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt
Get common file path
Get file size
Hash data via wincrypt
Initialize hashing via wincrypt
Read file on windows

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0x13b0]
mov eax, 0x14b0
call fcn.140007d80
sub rsp, rax
lea rcx, [rbp + 0x192]
xor ebx, ebx
xor edx, edx
mov r8d, 0x206
mov word [rbp + 0x190], bx
call fcn.1400033f0
lea rcx, [rbp - 0x7e]
xor edx, edx
mov r8d, 0x206
mov word [rbp - 0x80], bx
call fcn.1400033f0
lea rcx, [rbp + 0x3a1]
xor edx, edx
mov r8d, 0xffd
mov dword [rbp + 0x13f0], ebx
mov byte [rbp + 0x3a0], bl
call fcn.1400033f0
mov eax, 0x104
mov dword [rsp + 0x68], 0xf7a4a6
movdqa xmm0, xmmword [0x14001f370]
movdqa xmm1, xmmword [0x14001f360]
mov ecx, eax
lea rdx, [0x140046350]
movdqu xmmword [rsp + 0x48], xmm0
movdqu xmmword [rsp + 0x58], xmm1
dec rcx
mov byte [rcx + rdx], bl
jne 0x140010464
mov rcx, rax
lea rdx, [0x140046030]
dec rcx
mov byte [rcx + rdx], bl
jne 0x140010476
mov rcx, rax
lea rdx, [0x140045d10]
dec rcx
mov byte [rcx + rdx], bl
jne 0x140010488
mov rcx, rax
lea rdx, [0x1400459f0]
nop word [rax + rax]
dec rcx
mov byte [rcx + rdx], bl
jne 0x1400104a0
mov rcx, rax
lea rdx, [0x1400456d0]
dec rcx
mov byte [rcx + rdx], bl
jne 0x1400104b2
mov rcx, rax
lea rdx, [0x1400453b0]
dec rcx
mov byte [rcx + rdx], bl
jne 0x1400104c4
lea rcx, [0x140045090]
dec rax
mov byte [rax + rcx], bl
jne 0x1400104d3
mov ecx, 0x20
lea rdi, [0x140044e60]
mov eax, ecx
nop dword [rax]
dec rax
mov byte [rax + rdi], bl
jne 0x1400104f0
mov rax, rcx
lea r14, [0x140044e40]
dec rax
mov byte [rax + r14], bl
jne 0x140010502
mov rax, rcx
lea r15, [0x140044e20]
dec rax
mov byte [rax + r15], bl
jne 0x140010515
mov rax, rcx
lea r12, [0x140044e00]
nop dword [rax + rax]
dec rax
mov byte [rax + r12], bl
jne 0x140010530
mov rax, rcx
lea rdx, [0x140044de0]
dec rax
mov byte [rax + rdx], bl
jne 0x140010543
mov eax, pe_nt_image_headers64
lea rdx, [0x140044c20]
dec rax
mov byte [rax + rdx], bl
jne 0x140010557
mov rax, rcx
lea rdx, [0x140044dc0]
nop dword [rax]
dec rax
mov byte [rax + rdx], bl
jne 0x140010570
mov rax, rcx
lea rdx, [0x140044da0]
dec rax
mov byte [rax + rdx], bl
jne 0x140010582
lea rax, [0x140044d80]
dec rcx
mov byte [rcx + rax], bl
jne 0x140010591
xor r9d, r9d
lea rax, [rbp - 0x80]
xor r8d, r8d
lea edx, [r9 + 0x23]
xor ecx, ecx
mov dword [0x140044c10], ebx
mov dword [0x140044c0c], ebx
mov dword [0x140044c08], ebx
mov dword [0x140044c04], ebx
mov dword [0x140044c00], ebx
mov dword [0x140044bfc], ebx
mov dword [0x140044bf8], ebx
mov dword [0x140044bf4], ebx
mov dword [0x140044bf0], ebx
mov qword [rsp + 0x20], rax
call qword [sym.imp.SHELL32.dll_SHGetFolderPathW]
lea r8, [rbp - 0x80]
lea rdx, str._sint.bin
lea rcx, [rbp + 0x190]
call qword [sym.imp.USER32.dll_wsprintfW]
mov esi, 3
mov qword [rsp + 0x30], rbx
lea rcx, [rbp + 0x190]
lea r8d, [rsi + 4]
xor r9d, r9d
mov edx, 0x80000000
mov dword [rsp + 0x28], 2
mov dword [rsp + 0x20], esi
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x70], rax
cmp rax, 0xffffffffffffffff
je 0x1400117ed
xor edx, edx
mov rcx, rax
mov qword [rsp + 0x14a8], r13
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov rcx, qword [rsp + 0x70]
lea r9, [rbp + 0x13f0]
lea rdx, [rbp + 0x3a0]
mov r8d, eax
mov r13d, eax
mov qword [rsp + 0x20], rbx
call qword [sym.imp.KERNEL32.dll_ReadFile]
lea rax, [rsp + 0x68]
movdqu xmm0, xmmword [rsp + 0x48]
movdqu xmm1, xmmword [rsp + 0x58]
pxor xmm0, xmmword [0x14001f380]
pxor xmm1, xmmword [0x14001f380]
movdqu xmmword [rsp + 0x48], xmm0
movdqu xmmword [rsp + 0x58], xmm1
xor byte [rax], 0xc2
lea rax, [rax + 1]
dec rsi
jne 0x1400106a4
lea r9d, [rsi + 0x18]
lea rcx, [rbp + 0x1408]
xor r8d, r8d
xor edx, edx
mov dword [rbp + 0x13f8], r13d
mov qword [rbp + 0x1408], rbx
mov qword [rsp + 0x40], rbx
mov qword [rbp + 0x1400], rbx
mov dword [rsp + 0x20], 0xf0000000
call qword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0x1400107c1
mov rcx, qword [rbp + 0x1408]
lea rax, [rbp + 0x1400]
xor r9d, r9d
xor r8d, r8d
mov edx, 0x800c
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptCreateHash]
test eax, eax
je 0x1400107b2
lea rcx, [rsp + 0x48]
call qword [sym.imp.KERNEL32.dll_lstrlenA]
mov rcx, qword [rbp + 0x1400]
lea rdx, [rsp + 0x48]
mov r8d, eax
xor r9d, r9d
call qword [sym.imp.ADVAPI32.dll_CryptHashData]
test eax, eax
je 0x1400107a5
mov r8, qword [rbp + 0x1400]
mov rcx, qword [rbp + 0x1408]
lea rax, [rsp + 0x40]
lea r9d, [rsi + 1]
mov edx, 0x6610
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDeriveKey]
test eax, eax
je 0x1400107a5
mov rcx, qword [rsp + 0x40]
lea rax, [rbp + 0x13f8]
lea r8d, [rsi + 1]
mov qword [rsp + 0x28], rax
lea rax, [rbp + 0x3a0]
xor r9d, r9d
xor edx, edx
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_CryptDecrypt]
mov rcx, qword [rsp + 0x40]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov rcx, qword [rbp + 0x1400]
call qword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov rcx, qword [rbp + 0x1408]
xor edx, edx
call qword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov eax, 0x24
dec rax
mov byte [rsp + rax + 0x48], bl
jne 0x1400107c6
mov r13, qword [rsp + 0x70]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, 4
lea rax, [0x140046350]
mov ecx, esi
nop dword [rax + rax]
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
lea rax, [rax + 0x40]
mov qword [rax - 0x28], rbx
mov qword [rax - 0x20], rbx
mov qword [rax - 0x18], rbx
mov qword [rax - 0x10], rbx
mov qword [rax - 8], rbx
dec rcx
jne 0x1400107f0
lea rdx, str.cl_url1
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rcx, rax
test rax, rax
je 0x14001087d
lea rdx, str.cl_url1
mov rax, rdx
nop
inc rax
cmp byte [rax], bl
jne 0x140010840
sub rax, rdx
add rcx, rax
movzx edx, byte [rcx]
cmp dl, 0xa
je 0x140010883
mov rax, rbx
lea r8, [0x140046350]
nop
mov byte [rax + r8], dl
inc rax
lea rcx, [rcx + 1]
cmp rax, 0x100
jg 0x14001087d
movzx edx, byte [rcx]
cmp dl, 0xa
jne 0x140010860
jmp 0x140010883
mov byte [0x140046350], bl
lea rax, [0x140046030]
mov rcx, rsi
nop dword [rax]
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
lea rax, [rax + 0x40]
mov qword [rax - 0x28], rbx
mov qword [rax - 0x20], rbx
mov qword [rax - 0x18], rbx
mov qword [rax - 0x10], rbx
mov qword [rax - 8], rbx
dec rcx
jne 0x140010890
lea rdx, str.cl_url2
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rcx, rax
test rax, rax
je 0x14001091d
lea rdx, str.cl_url2
mov rax, rdx
nop
inc rax
cmp byte [rax], bl
jne 0x1400108e0
sub rax, rdx
add rcx, rax
movzx edx, byte [rcx]
cmp dl, 0xa
je 0x140010923
mov rax, rbx
lea r8, [0x140046030]
nop
mov byte [rax + r8], dl
inc rax
lea rcx, [rcx + 1]
cmp rax, 0x100
jg 0x14001091d
movzx edx, byte [rcx]
cmp dl, 0xa
jne 0x140010900
jmp 0x140010923
mov byte [0x140046030], bl
lea rax, [0x140045d10]
mov rcx, rsi
nop dword [rax]
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
lea rax, [rax + 0x40]
mov qword [rax - 0x28], rbx
mov qword [rax - 0x20], rbx
mov qword [rax - 0x18], rbx
mov qword [rax - 0x10], rbx
mov qword [rax - 8], rbx
dec rcx
jne 0x140010930
lea rdx, str.cl_url3
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rcx, rax
test rax, rax
je 0x1400109bd
lea rdx, str.cl_url3
mov rax, rdx
nop
inc rax
cmp byte [rax], bl
jne 0x140010980
sub rax, rdx
add rcx, rax
movzx edx, byte [rcx]
cmp dl, 0xa
je 0x1400109c3
mov rax, rbx
lea r8, [0x140045d10]
nop
mov byte [rax + r8], dl
inc rax
lea rcx, [rcx + 1]
cmp rax, 0x100
jg 0x1400109bd
movzx edx, byte [rcx]
cmp dl, 0xa
jne 0x1400109a0
jmp 0x1400109c3
mov byte [0x140045d10], bl
lea rax, [0x1400459f0]
mov rcx, rsi
nop dword [rax]
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
lea rax, [rax + 0x40]
mov qword [rax - 0x28], rbx
mov qword [rax - 0x20], rbx
mov qword [rax - 0x18], rbx
mov qword [rax - 0x10], rbx
mov qword [rax - 8], rbx
dec rcx
jne 0x1400109d0
lea rdx, str.cl_url4
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rcx, rax
test rax, rax
je 0x140010a5d
lea rdx, str.cl_url4
mov rax, rdx
nop
inc rax
cmp byte [rax], bl
jne 0x140010a20
sub rax, rdx
add rcx, rax
movzx edx, byte [rcx]
cmp dl, 0xa
je 0x140010a63
mov rax, rbx
lea r8, [0x1400459f0]
nop
mov byte [rax + r8], dl
inc rax
lea rcx, [rcx + 1]
cmp rax, 0x100
jg 0x140010a5d
movzx edx, byte [rcx]
cmp dl, 0xa
jne 0x140010a40
jmp 0x140010a63
mov byte [0x1400459f0], bl
lea rax, [0x1400456d0]
mov rcx, rsi
nop dword [rax]
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
lea rax, [rax + 0x40]
mov qword [rax - 0x28], rbx
mov qword [rax - 0x20], rbx
mov qword [rax - 0x18], rbx
mov qword [rax - 0x10], rbx
mov qword [rax - 8], rbx
dec rcx
jne 0x140010a70
lea rdx, str.cl_url5
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rcx, rax
test rax, rax
je 0x140010afd
lea rdx, str.cl_url5
mov rax, rdx
nop
inc rax
cmp byte [rax], bl
jne 0x140010ac0
sub rax, rdx
add rcx, rax
movzx edx, byte [rcx]
cmp dl, 0xa
je 0x140010b03
mov rax, rbx
lea r8, [0x1400456d0]
nop
mov byte [rax + r8], dl
inc rax
lea rcx, [rcx + 1]
cmp rax, 0x100
jg 0x140010afd
movzx edx, byte [rcx]
cmp dl, 0xa
jne 0x140010ae0
jmp 0x140010b03
mov byte [0x1400456d0], bl
lea rax, [0x1400453b0]
mov rcx, rsi
nop dword [rax]
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
lea rax, [rax + 0x40]
mov qword [rax - 0x28], rbx
mov qword [rax - 0x20], rbx
mov qword [rax - 0x18], rbx
mov qword [rax - 0x10], rbx
mov qword [rax - 8], rbx
dec rcx
jne 0x140010b10
lea rdx, str.cl_url6
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rcx, rax
test rax, rax
je 0x140010b9d
lea rdx, str.cl_url6
mov rax, rdx
nop
inc rax
cmp byte [rax], bl
jne 0x140010b60
sub rax, rdx
add rcx, rax
movzx edx, byte [rcx]
cmp dl, 0xa
je 0x140010ba3
mov rax, rbx
lea r8, [0x1400453b0]
nop
mov byte [rax + r8], dl
inc rax
lea rcx, [rcx + 1]
cmp rax, 0x100
jg 0x140010b9d
movzx edx, byte [rcx]
cmp dl, 0xa
jne 0x140010b80
jmp 0x140010ba3
mov byte [0x1400453b0], bl
lea rax, [0x140045090]
mov rcx, rsi
nop dword [rax]
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
lea rax, [rax + 0x40]
mov qword [rax - 0x28], rbx
mov qword [rax - 0x20], rbx
mov qword [rax - 0x18], rbx
mov qword [rax - 0x10], rbx
mov qword [rax - 8], rbx
dec rcx
jne 0x140010bb0
lea rdx, str.cl_url7
lea rcx, [rbp + 0x3a0]
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rcx, rax
test rax, rax
je 0x140010c3d
lea rdx, str.cl_url7
mov rax, rdx
nop
inc rax
cmp byte [rax], bl
jne 0x140010c00
sub rax, rdx
add rcx, rax
movzx edx, byte [rcx]
cmp dl, 0xa
je 0x140010c43
mov rax, rbx
lea r8, [0x140045090]
nop
mov byte [rax + r8], dl
inc rax
lea rcx, [rcx + 1]
cmp rax, 0x100
jg 0x140010c3d
movzx edx, byte [rcx]
cmp dl, 0xa
jne 0x140010c20
jmp 0x140010c43
mov byte [0x140045090], bl
lea rdx, str.time_site1
lea rcx, [rbp + 0x3a0]
mov qword [0x140044e60], rbx
mov qword [0x140044e68], rbx
mov qword [0x140044e70], rbx
mov qword [0x140044e78], rbx
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rcx, rax
test rax, rax
jne 0x140010c83
mov byte [0x140044e60], bl
jmp 0x140010ce8
lea rdx, str.time_site1
mov rax, rdx
nop dword [rax]
inc rax
cmp byte [rax], bl
jne 0x140010c90
sub rax, rdx
add rcx, rax
movzx edx, byte [rcx]
cmp dl, 0xa
je 0x140010cd0
mov rax, rbx
nop dword [rax + rax]
mov byte [rax + rdi], dl
inc rax
lea rcx, [rcx + 1]
cmp rax, 0x20
jg 0x140010cca
movzx edx, byte [rcx]
cmp dl, 0xa
jne 0x140010cb0
jmp 0x140010cd0
mov byte [0x140044e60], bl
cmp byte [0x140044e60], 0x20
jne 0x140010ce8
nop dword [rax]
inc rdi
cmp byte [rdi], 0x20
je 0x140010ce0
movzx edx, byte [rdi]
inc rdi
lea eax, [rdx - 0x2b]
mov r8d, edx
test eax, 0xfffffffd
jne 0x140010d01
movzx edx, byte [rdi]
inc rdi
mov ecx, ebx
lea eax, [rdx - 0x30]
cmp al, 9
ja 0x140010d1c
lea ecx, [rcx + rcx*4]
inc rdi
lea ecx, [rcx - 0x18]
lea ecx, [rdx + rcx*2]
movzx edx, byte [rdi - 1]
jmp 0x140010d03
cmp r8d, 0x2d
jne 0x140010d24
neg ecx
mov dword [0x140044c10], ecx
lea rdi, str.time_site2
lea rcx, [rbp + 0x3a0]
mov rdx, rdi
mov qword [0x140044e40], rbx
mov qword [0x140044e48], rbx
mov qword [0x140044e50], rbx
mov qword [0x140044e58], rbx
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rcx, rax
test rax, rax
jne 0x140010d6d
mov byte [0x140044e40], bl
jmp 0x140010dc9
mov rax, rdi
inc rax
cmp byte [rax], bl
jne 0x140010d70
sub rax, rdi
add rcx, rax
movzx edx, byte [rcx]
cmp dl, 0xa
je 0x140010db1
mov rax, rbx
nop dword [rax + rax]
mov byte [rax + r14], dl
inc rax
lea rcx, [rcx + 1]
cmp rax, 0x20
jg 0x140010dab
movzx edx, byte [rcx]
cmp dl, 0xa
jne 0x140010d90
jmp 0x140010db1
mov byte [0x140044e40], bl
cmp byte [0x140044e40], 0x20
jne 0x140010dc9
nop word [rax + rax]
inc r14
cmp byte [r14], 0x20
je 0x140010dc0
movzx edx, byte [r14]
inc r14
lea eax, [rdx - 0x2b]
mov r8d, edx
test eax, 0xfffffffd
jne 0x140010de4
movzx edx, byte [r14]
inc r14
mov ecx, ebx
lea eax, [rdx - 0x30]
cmp al, 9
ja 0x140010e00
lea ecx, [rcx + rcx*4]
inc r14
lea ecx, [rcx - 0x18]
lea ecx, [rdx + rcx*2]
movzx edx, byte [r14 - 1]
jmp 0x140010de6
cmp r8d, 0x2d
jne 0x140010e08
neg ecx
mov dword [0x140044c0c], ecx
lea rdi, str.time_site3
lea rcx, [rbp + 0x3a0]
mov rdx, rdi
mov qword [0x140044e20], rbx
mov qword [0x140044e28], rbx
mov qword [0x140044e30], rbx
mov qword [0x140044e38], rbx
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rcx, rax
test rax, rax
jne 0x140010e51
mov byte [0x140044e20], bl
jmp 0x140010ea9
mov rax, rdi
inc rax
cmp byte [rax], bl
jne 0x140010e54
sub rax, rdi
add rcx, rax
movzx edx, byte [rcx]
cmp dl, 0xa
je 0x140010e91
mov rax, rbx
nop dword [rax]
mov byte [rax + r15], dl
inc rax
lea rcx, [rcx + 1]
cmp rax, 0x20
jg 0x140010e8b
movzx edx, byte [rcx]
cmp dl, 0xa
jne 0x140010e70
jmp 0x140010e91
mov byte [0x140044e20], bl
cmp byte [0x140044e20], 0x20
jne 0x140010ea9
nop word [rax + rax]
inc r15
cmp byte [r15], 0x20
je 0x140010ea0
movzx edx, byte [r15]
inc r15
lea eax, [rdx - 0x2b]
mov r8d, edx
test eax, 0xfffffffd
jne 0x140010ec4
movzx edx, byte [r15]
inc r15
mov ecx, ebx
lea eax, [rdx - 0x30]
cmp al, 9
ja 0x140010ee0
lea ecx, [rcx + rcx*4]
inc r15
lea ecx, [rcx - 0x18]
lea ecx, [rdx + rcx*2]
movzx edx, byte [r15 - 1]
jmp 0x140010ec6
cmp r8d, 0x2d
jne 0x140010ee8
neg ecx
mov dword [0x140044c08], ecx
lea rdi, str.time_site4
lea rcx, [rbp + 0x3a0]
mov rdx, rdi
mov qword [0x140044e00], rbx
mov qword [0x140044e08], rbx
mov qword [0x140044e10], rbx
mov qword [0x140044e18], rbx
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rcx, rax
test rax, rax
jne 0x140010f31
mov byte [0x140044e00], bl
jmp 0x140010f8a
mov rax, rdi
inc rax
cmp byte [rax], bl
jne 0x140010f34
sub rax, rdi
add rcx, rax
movzx edx, byte [rcx]
cmp dl, 0xa
je 0x140010f71
mov rax, rbx
nop dword [rax]
mov byte [rax + r12], dl
inc rax
lea rcx, [rcx + 1]
cmp rax, 0x20
jg 0x140010f6b
movzx edx, byte [rcx]
cmp dl, 0xa
jne 0x140010f50
jmp 0x140010f71
mov byte [0x140044e00], bl
cmp byte [0x140044e00], 0x20
jne 0x140010f8a
nop word [rax + rax]
inc r12
cmp byte [r12], 0x20
je 0x140010f80
movzx edx, byte [r12]
inc r12
lea eax, [rdx - 0x2b]
mov r8d, edx
test eax, 0xfffffffd
jne 0x140010fa7
movzx edx, byte [r12]
inc r12
mov ecx, ebx
nop dword [rax]
lea eax, [rdx - 0x30]
cmp al, 9
ja 0x140010fcb
lea ecx, [rcx + rcx*4]
inc r12
lea ecx, [rcx - 0x18]
lea ecx, [rdx + rcx*2]
movzx edx, byte [r12 - 1]
jmp 0x140010fb0
cmp r8d, 0x2d
jne 0x140010fd3
neg ecx
mov dword [0x140044c04], ecx
lea rdi, str.time_site5
lea rcx, [rbp + 0x3a0]
mov rdx, rdi
mov qword [0x140044de0], rbx
mov qword [0x140044de8], rbx
mov qword [0x140044df0], rbx
mov qword [0x140044df8], rbx
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rcx, rax
test rax, rax
jne 0x140011023
mov byte [0x140044de0], bl
lea r9, [0x140044de0]
jmp 0x140011089
mov rax, rdi
inc rax
cmp byte [rax], bl
jne 0x140011026
sub rax, rdi
lea r9, [0x140044de0]
add rcx, rax
movzx edx, byte [rcx]
cmp dl, 0xa
je 0x140011071
mov rax, rbx
nop word [rax + rax]
mov byte [rax + r9], dl
inc rax
lea rcx, [rcx + 1]
cmp rax, 0x20
jg 0x14001106b
movzx edx, byte [rcx]
cmp dl, 0xa
jne 0x140011050
jmp 0x140011071
mov byte [0x140044de0], bl
cmp byte [0x140044de0], 0x20
jne 0x140011089
nop word [rax + rax]
inc r9
cmp byte [r9], 0x20
je 0x140011080
movzx edx, byte [r9]
inc r9
lea eax, [rdx - 0x2b]
mov r8d, edx
test eax, 0xfffffffd
jne 0x1400110a4
movzx edx, byte [r9]
inc r9
mov ecx, ebx
lea eax, [rdx - 0x30]
cmp al, 9
ja 0x1400110c0
lea ecx, [rcx + rcx*4]
inc r9
lea ecx, [rcx - 0x18]
lea ecx, [rdx + rcx*2]
movzx edx, byte [r9 - 1]
jmp 0x1400110a6
cmp r8d, 0x2d
jne 0x1400110c8
neg ecx
mov dword [0x140044c00], ecx
lea rdi, str.remove_cki
lea rcx, [rbp + 0x3a0]
mov rdx, rdi
mov qword [0x140044dc0], rbx
mov qword [0x140044dc8], rbx
mov qword [0x140044dd0], rbx
mov qword [0x140044dd8], rbx
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rcx, rax
test rax, rax
jne 0x140011118
mov byte [0x140044dc0], bl
lea r9, [0x140044dc0]
jmp 0x140011179
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp byte [rax], bl
jne 0x140011120
sub rax, rdi
lea r9, [0x140044dc0]
add rcx, rax
movzx edx, byte [rcx]
cmp dl, 0xa
je 0x140011161
mov rax, rbx
nop
mov byte [rax + r9], dl
inc rax
lea rcx, [rcx + 1]
cmp rax, 0x20
jg 0x14001115b
movzx edx, byte [rcx]
cmp dl, 0xa
jne 0x140011140
jmp 0x140011161
mov byte [0x140044dc0], bl
cmp byte [0x140044dc0], 0x20
jne 0x140011179
nop word [rax + rax]
inc r9
cmp byte [r9], 0x20
je 0x140011170
movzx edx, byte [r9]
inc r9
lea eax, [rdx - 0x2b]
mov r8d, edx
test eax, 0xfffffffd
jne 0x140011194
movzx edx, byte [r9]
inc r9
mov ecx, ebx
lea eax, [rdx - 0x30]
cmp al, 9
ja 0x1400111b0
lea ecx, [rcx + rcx*4]
inc r9
lea ecx, [rcx - 0x18]
lea ecx, [rdx + rcx*2]
movzx edx, byte [r9 - 1]
jmp 0x140011196
cmp r8d, 0x2d
jne 0x1400111b8
neg ecx
mov dword [0x140044bfc], ecx
lea rdi, str.time_fr
lea rcx, [rbp + 0x3a0]
mov rdx, rdi
mov qword [0x140044da0], rbx
mov qword [0x140044da8], rbx
mov qword [0x140044db0], rbx
mov qword [0x140044db8], rbx
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rcx, rax
test rax, rax
jne 0x140011208
mov byte [0x140044da0], bl
lea r9, [0x140044da0]
jmp 0x140011269
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp byte [rax], bl
jne 0x140011210
sub rax, rdi
lea r9, [0x140044da0]
add rcx, rax
movzx edx, byte [rcx]
cmp dl, 0xa
je 0x140011251
mov rax, rbx
nop
mov byte [rax + r9], dl
inc rax
lea rcx, [rcx + 1]
cmp rax, 0x20
jg 0x14001124b
movzx edx, byte [rcx]
cmp dl, 0xa
jne 0x140011230
jmp 0x140011251
mov byte [0x140044da0], bl
cmp byte [0x140044da0], 0x20
jne 0x140011269
nop word [rax + rax]
inc r9
cmp byte [r9], 0x20
je 0x140011260
movzx edx, byte [r9]
inc r9
lea eax, [rdx - 0x2b]
mov r8d, edx
test eax, 0xfffffffd
jne 0x140011284
movzx edx, byte [r9]
inc r9
mov ecx, ebx
lea eax, [rdx - 0x30]
cmp al, 9
ja 0x1400112a0
lea ecx, [rcx + rcx*4]
inc r9
lea ecx, [rcx - 0x18]
lea ecx, [rdx + rcx*2]
movzx edx, byte [r9 - 1]
jmp 0x140011286
cmp r8d, 0x2d
jne 0x1400112a8
neg ecx
mov dword [0x140044bf8], ecx
lea rdi, str.time_kill
lea rcx, [rbp + 0x3a0]
mov rdx, rdi
mov qword [0x140044d80], rbx
mov qword [0x140044d88], rbx
mov qword [0x140044d90], rbx
mov qword [0x140044d98], rbx
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rcx, rax
test rax, rax
jne 0x1400112f8
mov byte [0x140044d80], bl
lea r9, [0x140044d80]
jmp 0x140011359
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp byte [rax], bl
jne 0x140011300
sub rax, rdi
lea r9, [0x140044d80]
add rcx, rax
movzx edx, byte [rcx]
cmp dl, 0xa
je 0x140011341
mov rax, rbx
nop
mov byte [rax + r9], dl
inc rax
lea rcx, [rcx + 1]
cmp rax, 0x20
jg 0x14001133b
movzx edx, byte [rcx]
cmp dl, 0xa
jne 0x140011320
jmp 0x140011341
mov byte [0x140044d80], bl
cmp byte [0x140044d80], 0x20
jne 0x140011359
nop word [rax + rax]
inc r9
cmp byte [r9], 0x20
je 0x140011350
movzx edx, byte [r9]
inc r9
lea eax, [rdx - 0x2b]
mov r8d, edx
test eax, 0xfffffffd
jne 0x140011374
movzx edx, byte [r9]
inc r9
mov ecx, ebx
lea eax, [rdx - 0x30]
cmp al, 9
ja 0x140011390
lea ecx, [rcx + rcx*4]
inc r9
lea ecx, [rcx - 0x18]
lea ecx, [rdx + rcx*2]
movzx edx, byte [r9 - 1]
jmp 0x140011376
cmp r8d, 0x2d
jne 0x140011398
neg ecx
mov dword [0x140044bf4], ecx
lea rdi, str.socks
lea rcx, [rbp + 0x3a0]
mov rdx, rdi
mov qword [0x140044d60], rbx
mov qword [0x140044d68], rbx
mov qword [0x140044d70], rbx
mov qword [0x140044d78], rbx
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rdx, rax
test rax, rax
jne 0x1400113e8
mov byte [0x140044d60], bl
lea rcx, [0x140044d60]
jmp 0x140011448
mov rax, rdi
nop dword [rax + rax]
inc rax
cmp byte [rax], bl
jne 0x1400113f0
sub rax, rdi
lea rcx, [0x140044d60]
add rdx, rax
movzx r8d, byte [rdx]
cmp r8b, 0xa
je 0x140011434
mov rax, rbx
mov byte [rax + rcx], r8b
inc rax
lea rdx, [rdx + 1]
cmp rax, 0x20
jg 0x14001142e
movzx r8d, byte [rdx]
cmp r8b, 0xa
jne 0x140011411
jmp 0x140011434
mov byte [0x140044d60], bl
cmp byte [0x140044d60], 0x20
jne 0x140011448
nop dword [rax]
inc rcx
cmp byte [rcx], 0x20
je 0x140011440
movzx r8d, byte [rcx]
inc rcx
lea eax, [r8 - 0x2b]
mov r9d, r8d
test eax, 0xfffffffd
jne 0x140011464
movzx r8d, byte [rcx]
inc rcx
mov edx, ebx
lea eax, [r8 - 0x30]
cmp al, 9
ja 0x140011482
lea edx, [rdx + rdx*4]
inc rcx
lea edx, [rdx - 0x18]
lea edx, [r8 + rdx*2]
movzx r8d, byte [rcx - 1]
jmp 0x140011466
cmp r9d, 0x2d
jne 0x14001148a
neg edx
mov dword [0x140044c18], edx
lea rdi, str.srv_up_socks
lea rcx, [rbp + 0x3a0]
mov rdx, rdi
mov qword [0x140044d40], rbx
mov qword [0x140044d48], rbx
mov qword [0x140044d50], rbx
mov qword [0x140044d58], rbx
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rcx, rax
test rax, rax
je 0x14001150b
mov rax, rdi
nop
inc rax
cmp byte [rax], bl
jne 0x1400114d0
sub rax, rdi
add rcx, rax
movzx edx, byte [rcx]
cmp dl, 0xa
je 0x140011511
mov rax, rbx
lea r8, [0x140044d40]
nop
mov byte [rax + r8], dl
inc rax
lea rcx, [rcx + 1]
cmp rax, 0x20
jg 0x14001150b
movzx edx, byte [rcx]
cmp dl, 0xa
jne 0x1400114f0
jmp 0x140011511
mov byte [0x140044d40], bl
lea rdi, str.feno_clk
lea rcx, [rbp + 0x3a0]
mov qword [0x140044d20], rbx
mov rdx, rdi
mov qword [0x140044d28], rbx
mov qword [0x140044d30], rbx
mov qword [0x140044d38], rbx
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rdx, rax
test rax, rax
jne 0x14001155b
mov byte [0x140044d20], bl
lea rcx, [0x140044d20]
jmp 0x1400115b8
mov rax, rdi
nop
inc rax
cmp byte [rax], bl
jne 0x140011560
sub rax, rdi
lea rcx, [0x140044d20]
add rdx, rax
movzx r8d, byte [rdx]
cmp r8b, 0xa
je 0x1400115a4
mov rax, rbx
mov byte [rax + rcx], r8b
inc rax
lea rdx, [rdx + 1]
cmp rax, 0x20
jg 0x14001159e
movzx r8d, byte [rdx]
cmp r8b, 0xa
jne 0x140011581
jmp 0x1400115a4
mov byte [0x140044d20], bl
cmp byte [0x140044d20], 0x20
jne 0x1400115b8
nop dword [rax]
inc rcx
cmp byte [rcx], 0x20
je 0x1400115b0
movzx r8d, byte [rcx]
inc rcx
lea eax, [r8 - 0x2b]
mov r9d, r8d
test eax, 0xfffffffd
jne 0x1400115d4
movzx r8d, byte [rcx]
inc rcx
mov edx, ebx
lea eax, [r8 - 0x30]
cmp al, 9
ja 0x1400115f2
lea edx, [rdx + rdx*4]
inc rcx
lea edx, [rdx - 0x18]
lea edx, [r8 + rdx*2]
movzx r8d, byte [rcx - 1]
jmp 0x1400115d6
cmp r9d, 0x2d
jne 0x1400115fa
neg edx
lea r14, [0x140044c20]
mov dword [0x140044c14], edx
mov rax, r14
nop word [rax + rax]
mov qword [rax], rbx
mov qword [rax + 8], rbx
mov qword [rax + 0x10], rbx
lea rax, [rax + 0x40]
mov qword [rax - 0x28], rbx
mov qword [rax - 0x20], rbx
mov qword [rax - 0x18], rbx
mov qword [rax - 0x10], rbx
mov qword [rax - 8], rbx
dec rsi
jne 0x140011610
lea rdi, str.feno_url
lea rcx, [rbp + 0x3a0]
mov rdx, rdi
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rcx, rax
test rax, rax
je 0x14001169d
mov rax, rdi
nop word [rax + rax]
inc rax
cmp byte [rax], bl
jne 0x140011660
sub rax, rdi
add rcx, rax
movzx edx, byte [rcx]
cmp dl, 0xa
je 0x1400116a3
mov rax, rbx
nop dword [rax + rax]
mov byte [rax + r14], dl
inc rax
lea rcx, [rcx + 1]
cmp rax, 0x100
jg 0x14001169d
movzx edx, byte [rcx]
cmp dl, 0xa
jne 0x140011680
jmp 0x1400116a3
mov byte [0x140044c20], bl
lea rdi, str.up_plug
lea rcx, [rbp + 0x3a0]
mov qword [0x140044bd0], rbx
mov rdx, rdi
mov qword [0x140044bd8], rbx
mov qword [0x140044be0], rbx
mov qword [0x140044be8], rbx
call qword [sym.imp.SHLWAPI.dll_StrStrA]
mov rdx, rax
test rax, rax
jne 0x1400116ed
mov byte [0x140044bd0], bl
lea rcx, [0x140044bd0]
jmp 0x140011748
mov rax, rdi
inc rax
cmp byte [rax], bl
jne 0x1400116f0
sub rax, rdi
lea rcx, [0x140044bd0]
add rdx, rax
movzx r8d, byte [rdx]
cmp r8b, 0xa
je 0x140011734
mov rax, rbx
mov byte [rax + rcx], r8b
inc rax
lea rdx, [rdx + 1]
cmp rax, 0x20
jg 0x14001172e
movzx r8d, byte [rdx]
cmp r8b, 0xa
jne 0x140011711
jmp 0x140011734
mov byte [0x140044bd0], bl
cmp byte [0x140044bd0], 0x20
jne 0x140011748
nop dword [rax]
inc rcx
cmp byte [rcx], 0x20
je 0x140011740
movzx edx, byte [rcx]
inc rcx
lea eax, [rdx - 0x2b]
mov r8d, edx
test eax, 0xfffffffd
jne 0x140011761
movzx edx, byte [rcx]
inc rcx
lea eax, [rdx - 0x30]
cmp al, 9
ja 0x140011773
lea ebx, [rbx + rbx*4]
lea ebx, [rbx - 0x18]
lea ebx, [rdx + rbx*2]
jmp 0x14001175b
cmp r8d, 0x2d
jne 0x14001177b
neg ebx
cmp byte [0x140046350], 0
lea rcx, [0x140046350]
mov dword [0x140044bbc], ebx
mov rax, rcx
je 0x14001179c
inc rax
cmp byte [rax], 0
jne 0x140011794
cmp eax, ecx
jne 0x1400117bc
xor eax, eax
mov r13, qword [rsp + 0x14a8]
add rsp, 0x14b0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x208
dec rcx
mov byte [rbp + rcx - 0x80], 0
jne 0x1400117c1
mov ecx, 0xffe
dec rcx
mov byte [rbp + rcx + 0x3a0], 0
jne 0x1400117d0
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x1400117a2
or rcx, 0xffffffffffffffff
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
jmp 0x1400117aa