Function at 0x14001afc0
Capabilities:
Create process on windows
Get common file path

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x110]
sub rsp, 0x210
mov rax, qword [0x1400ab900]
xor rax, rsp
mov qword [rbp + 0x100], rax
mov r14, rcx
xor ebx, ebx
mov dword [rbp - 0x80], ebx
mov edi, ebx
or edi, 2
lea rax, [rbp - 0x10]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
mov r15, 0xffffffffffffffff
xorps xmm0, xmm0
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], rbx
movups xmmword [rbp - 0x50], xmm0
test eax, eax
js 0x1400079ef
lea rax, [rbp - 0x10]
mov r8, r15
nop
inc r8
cmp byte [rax + r8], bl
jne 0x1400079e0
lea rdx, [rbp - 0x10]
jmp 0x1400079f9
xor r8d, r8d
lea rdx, [0x14009a369]
lea rcx, [rbp - 0x50]
call fcn.14000d040
nop
mov r12, qword [r14 + 8]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r13, qword [rbp - 0x40]
sub rax, r13
cmp rax, 1
jb 0x1400080bb
lea rdx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova rdx, qword [rbp - 0x50]
mov qword [rbp - 0x80], rdx
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
lea rax, [r13 + 1]
mov ebx, reloc.WS2_32.dll_ntohs
lea rsi, [rsp + 0x50]
cmp rax, rbx
jbe 0x140007ae4
mov rbx, rax
or rbx, 0xf
cmp rbx, rcx
jbe 0x140007a97
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140081cf4
test rax, rax
je 0x140007ac8
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140007ad7
mov ecx, socket
cmp rbx, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140007ab0
xor esi, esi
jmp 0x140007adf
cmp rcx, 0x1000
jb 0x140007acf
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400080b5
jmp 0x140007a7c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140081cf4
mov rsi, rax
mov rdx, qword [rbp - 0x80]
lea rax, [r13 + 1]
mov qword [rsp + 0x50], rsi
mov qword [rsp + 0x60], rax
mov qword [rsp + 0x68], rbx
mov r8, r13
mov rcx, rsi
call sub.VCRUNTIME140.dll_memcpy
mov word [rsi + r13], 0x5c
or edi, 4
mov r8, qword [r12 + 0x10]
cmp qword [r12 + 0x18], 0xf
jbe 0x140007b14
mov r12, qword [r12]
mov rdx, r12
lea rcx, [rsp + 0x50]
call fcn.14000a510
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xor esi, esi
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], rsi
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], rsi
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], sil
or edi, 8
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140007b93
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007b8e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007b8e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140082040
movdqa xmm0, xmmword [0x14009c280]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
lea rax, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova rax, qword [rbp - 0x70]
mov qword [rsp + 0x70], rax
mov rax, qword [rbp - 0x60]
mov qword [rsp + 0x78], rax
call fcn.14008109c
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm0
lea r8, [rsp + 0x70]
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.140001c00
or edi, 0x30
or edi, 1
mov dword [rbp - 0x80], edi
mov qword [rsp + 0x70], rsi
lea r12, [0x1400ab988]
mov qword [rsp + 0x78], r12
lea rdx, [rsp + 0x70]
lea rcx, [rsp + 0x30]
call fcn.140002d20
cmp dword [rsp + 0x70], 0
jne 0x1400080c1
test al, al
jne 0x140007c2c
mov rdx, qword [r14 + 8]
call fcn.1400068c0
test al, al
jne 0x140007c2c
xor bl, bl
jmp 0x140007c2e
mov bl, 1
test dil, 1
je 0x140007c79
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140007c79
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007c74
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007c74
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140082040
test bl, bl
je 0x140007fa4
lea r8, str..rar
mov rdx, qword [r14 + 8]
lea rcx, [rsp + 0x30]
call fcn.14000bcd0
nop
mov rdx, qword [r14 + 8]
add rdx, 0x20
lea r9, [rbp - 0x70]
mov r8, rax
call fcn.140006d70
movzx ebx, al
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140007cee
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007ce9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007ce9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140082040
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test bl, bl
je 0x140007d61
lea rdx, str.Download_complete:
call fcn.14000be30
mov rdx, qword [r14 + 8]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x140007d17
mov rdx, qword [rdx]
mov rcx, rax
call fcn.140011610
lea rdx, [0x14000c010]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea r8, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova r8, qword [rbp - 0x70]
mov dword [rsp + 0x28], 0xa
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x140007fe2
lea rdx, str.Download_failed:
call fcn.14000be30
mov rdx, qword [r14 + 8]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x140007d7f
mov rdx, qword [rdx]
mov rcx, rax
call fcn.140011610
lea rdx, [0x14000c010]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
lea rax, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova rax, qword [rbp - 0x70]
mov qword [rsp + 0x70], rax
mov rax, qword [rbp - 0x60]
mov qword [rsp + 0x78], rax
call fcn.14008109c
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm0
lea r8, [rsp + 0x70]
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.140001c00
nop
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rcx, qword [rsp + 0x30]
mov r9d, 0xffffffff
mov r8d, listen
lea rdx, [rbp - 0x30]
call fcn.140081304
mov dword [rsp + 0x70], eax
mov qword [rsp + 0x78], r12
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm0
test eax, eax
je 0x140007e1b
xor dil, dil
jmp 0x140007ea1
test byte [rbp - 0x20], 0x10
jne 0x140007e2c
cmp qword [rbp - 0x28], 0
sete dil
jmp 0x140007ea1
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x80], xmm1
lea rdx, [rsp + 0x30]
lea rcx, [rbp - 0x80]
call fcn.14000b870
mov dword [rsp + 0x70], eax
mov qword [rsp + 0x78], r12
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm0
test eax, eax
jne 0x140007e66
cmp qword [rbp - 0x80], 0
jne 0x140007e66
mov dil, 1
jmp 0x140007e69
xor dil, dil
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x140007ea1
mov eax, r15d
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x140007ea1
mov rbx, qword [rbp - 0x78]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
lock xadd dword [rbx + 0xc], r15d
cmp r15d, 1
jne 0x140007ea1
mov rcx, qword [rbp - 0x78]
mov rax, qword [rcx]
call qword [rax + reloc.WS2_32.dll_htonl]
cmp dword [rsp + 0x70], 0
jne 0x1400080d8
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140007ef1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007eec
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007eec
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140082040
test dil, dil
je 0x140007fe2
lea rax, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova rax, qword [rbp - 0x70]
mov qword [rsp + 0x70], rax
mov rax, qword [rbp - 0x60]
mov qword [rsp + 0x78], rax
call fcn.14008109c
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x70], xmm0
lea r8, [rsp + 0x70]
mov edx, eax
lea rcx, [rsp + 0x30]
call fcn.140001c00
nop
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 7
cmova rcx, qword [rsp + 0x30]
call fcn.140081684
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x14000809f
mov rdx, qword [rsp + 0x48]
cmp rdx, 7
jbe 0x140007fe2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140007f9d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140007f9d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140082040
jmp 0x140007fe2
lea rdx, str.Failed_to_create_folder_for:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000be30
mov rdx, qword [r14 + 8]
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0xf
jbe 0x140007fc9
mov rdx, qword [rdx]
mov rcx, rax
call fcn.140011610
lea rdx, [0x14000c010]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140008020
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000801b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000801b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140082040
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], reloc.WS2_32.dll_ntohs
mov byte [rbp - 0x70], 0
mov rax, qword [rbp - 0x38]
cmp rax, 0xf
jbe 0x14000806f
lea rdx, [rax + 1]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000806a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000806a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140082040
mov rcx, qword [rbp + 0x100]
xor rcx, rsp
call fcn.140081950
lea r11, [rsp + 0x210]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
shr rdx, 0x20
lea r8, [rsp + 0x30]
lea rcx, str.remove
call fcn.140002870
nop
call fcn.140001210
int3
call fcn.1400012b0
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x70]
lea rcx, str.exists
call fcn.1400028e0
nop
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x70]
lea rcx, str.is_empty
call fcn.1400028e0
int3
add rcx, 8
jmp 0x140007960