Function at 0x1400048b0
Capabilities:
Check if file exists
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1c0]
sub rsp, 0x2c0
mov rax, qword [0x140020208]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rax, qword [rbp + 0x230]
xor esi, esi
mov r13, qword [rbp + 0x220]
xor ecx, ecx
mov qword [rsp + 0x58], rax
xorps xmm0, xmm0
mov qword [rsp + 0x40], rcx
xorps xmm1, xmm1
mov r14, r8
mov r12, rdx
mov word [r13], si
mov dil, sil
mov word [rax], si
mov r15b, sil
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rsp + 0x30], xmm1
test r9b, r9b
jne 0x1400049a2
lea r8, [rsp + 0x48]
lea rdx, [rsp + 0x50]
call fcn.140004604
mov ebx, eax
test eax, eax
js 0x140004972
cmp dword [rsp + 0x48], esi
je 0x1400049a2
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_ImpersonateLoggedOnUser]
nop dword [rax + rax]
test eax, eax
jne 0x14000499f
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
mov eax, ebx
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.140015530
mov rbx, qword [rsp + 0x300]
add rsp, 0x2c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov r15b, 1
xorps xmm0, xmm0
lea rcx, [rsp + 0x60]
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
call qword [sym.imp.WINHTTP.dll_WinHttpGetIEProxyConfigForCurrentUser]
nop dword [rax + rax]
test eax, eax
jne 0x1400049f4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 2
je 0x1400049f4
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
movzx ebx, ax
or ebx, 0x80070000
test eax, eax
cmovle ebx, eax
jmp 0x140004c78
xor eax, eax
mov ebx, 0x3a
test eax, eax
jne 0x140004c02
test rsi, rsi
je 0x140004a26
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
cmp eax, 0x2eef
jne 0x140004b86
mov dword [rbp - 0x64], 1
mov rdx, qword [rsp + 0x68]
mov rax, rdx
mov qword [rbp - 0x78], rdx
neg rax
sbb ecx, ecx
neg ecx
inc ecx
neg rdx
mov dword [rbp - 0x80], ecx
sbb eax, eax
not eax
and eax, 3
mov dword [rbp - 0x7c], eax
test dil, dil
je 0x140004a88
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140004a6c
call qword [sym.imp.api_ms_win_downlevel_kernel32_l2_1_0.dll_GlobalFree]
nop dword [rax + rax]
and qword [rsp + 0x38], 0
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140004a88
call qword [sym.imp.api_ms_win_downlevel_kernel32_l2_1_0.dll_GlobalFree]
nop dword [rax + rax]
and qword [rsp + 0x40], 0
mov r8d, 8
lea rdx, str.https:__
mov rcx, r14
mov rbx, r14
call qword [sym.imp.msvcrt.dll__wcsnicmp]
nop dword [rax + rax]
test eax, eax
je 0x140004ada
lea r9, str.https:__
mov qword [rsp + 0x20], r14
lea r8, str._ls_ls
mov edx, 0x104
lea rcx, [rbp - 0x60]
call fcn.1400085fc
mov ebx, eax
test eax, eax
js 0x140004c78
lea rbx, [rbp - 0x60]
mov rcx, qword [r12]
lea r9, [rsp + 0x30]
lea r8, [rbp - 0x80]
mov rdx, rbx
call qword [sym.imp.WINHTTP.dll_WinHttpGetProxyForUrl]
nop dword [rax + rax]
inc rsi
mov dil, 1
cmp rsi, 2
jb 0x1400049f6
xor esi, esi
test eax, eax
jne 0x140004c04
lea ebx, [rsi + 0x3a]
mov rax, qword [rsp + 0x70]
test rax, rax
je 0x140004b8a
cmp word [rax], si
je 0x140004b8a
cmp word [rax], bx
jne 0x140004b2d
cmp word [rax + 2], si
je 0x140004b8a
test dil, dil
je 0x140004b6d
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140004b52
call qword [sym.imp.api_ms_win_downlevel_kernel32_l2_1_0.dll_GlobalFree]
nop dword [rax + rax]
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rsi
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140004b6d
call qword [sym.imp.api_ms_win_downlevel_kernel32_l2_1_0.dll_GlobalFree]
nop dword [rax + rax]
mov rax, qword [rsp + 0x70]
mov qword [rsp + 0x38], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x40], rax
mov dword [rsp + 0x30], 3
jmp 0x140004c04
xor esi, esi
jmp 0x140004b13
test dil, dil
je 0x140004bc5
mov rcx, qword [rsp + 0x38]
test rcx, rcx
je 0x140004baa
call qword [sym.imp.api_ms_win_downlevel_kernel32_l2_1_0.dll_GlobalFree]
nop dword [rax + rax]
mov qword [rsp + 0x38], rsi
mov rcx, qword [rsp + 0x40]
test rcx, rcx
je 0x140004bc5
call qword [sym.imp.api_ms_win_downlevel_kernel32_l2_1_0.dll_GlobalFree]
nop dword [rax + rax]
mov qword [rsp + 0x40], rsi
lea rcx, [rsp + 0x30]
call qword [sym.imp.WINHTTP.dll_WinHttpGetDefaultProxyConfiguration]
nop dword [rax + rax]
test eax, eax
je 0x1400049d5
mov rax, qword [rsp + 0x38]
test rax, rax
je 0x140004c76
cmp word [rax], si
je 0x140004c76
cmp word [rax], bx
jne 0x140004c04
cmp word [rax + 2], si
je 0x140004c76
jmp 0x140004c04
xor esi, esi
mov rcx, qword [r12]
lea r8, [rsp + 0x30]
mov r9d, 0x18
lea edx, [r9 + 0xe]
call qword [sym.imp.WINHTTP.dll_WinHttpSetOption]
nop dword [rax + rax]
test eax, eax
je 0x1400049d5
mov rbx, qword [rsp + 0x38]
test rbx, rbx
je 0x140004c76
cmp word [rbx], si
je 0x140004c76
mov edx, 0x3a
cmp word [rbx], dx
jne 0x140004c4a
cmp word [rbx + 2], si
je 0x140004c76
mov rcx, rbx
call qword [sym.imp.msvcrt.dll_wcsrchr]
nop dword [rax + rax]
test rax, rax
je 0x140004c61
mov word [rax], si
mov rax, qword [rsp + 0x58]
mov r8, r13
mov rdx, rbx
mov qword [rsp + 0x20], rax
call fcn.14000473c
mov ebx, esi
test r15b, r15b
je 0x140004972
call qword [sym.imp.api_ms_win_security_base_l1_1_0.dll_RevertToSelf]
nop dword [rax + rax]
test eax, eax
jne 0x140004972
call qword [sym.imp.api_ms_win_core_errorhandling_l1_1_0.dll_GetLastError]
nop dword [rax + rax]
mov ecx, eax
call qword [sym.imp.api_ms_win_core_processthreads_l1_1_0.dll_ExitProcess]