Function at 0x140003650
Capabilities:
Create process on windows
Download url
Receive data

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x2b8]
sub rsp, 0x390
mov rax, qword [0x14001a440]
xor rax, rsp
mov qword [rbp + 0x280], rax
mov r15, rcx
xor r12d, r12d
mov r8d, 0x104
lea rdx, [rbp + 0x70]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov r8b, r12b
lea rdx, [rbp + 0x70]
lea rcx, [rbp + 0x10]
call fcn.14000159c
nop
lea rax, [rbp + 0x10]
cmp qword [rbp + 0x28], 7
cmova rax, qword [rbp + 0x10]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp + 0x20]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x50], xmm0
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x40]
call fcn.140004f58
mov r8b, r12b
mov rdx, rax
lea rcx, [rbp - 0x70]
call fcn.140001668
nop
lea rax, [rbp - 0x70]
cmp qword [rbp - 0x58], 7
cmova rax, qword [rbp - 0x70]
mov qword [rsp + 0x40], rax
mov rax, qword [rbp - 0x60]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x50], xmm0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x10]
call fcn.140001718
nop
lea rcx, [rbp - 0x70]
call fcn.1400054a4
mov r8b, r12b
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x30]
call fcn.140001624
nop
mov r8b, r12b
lea rdx, [0x140011d58]
lea rcx, [rbp - 0x70]
call fcn.14000159c
nop
lea rdx, [rbp - 0x70]
lea rcx, [rbp + 0x30]
call fcn.140003cb8
mov rbx, rax
lea rcx, [rbp - 0x70]
call fcn.1400054a4
mov rcx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140003785
mov rcx, qword [rbx]
mov rax, qword [rbx + 0x10]
mov qword [rsp + 0x40], rcx
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x50], xmm0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
lea rcx, [rbp - 0x50]
call fcn.140001718
nop
lea rcx, [rbp + 0x30]
call fcn.1400054a4
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
mov r8d, 0x46
lea rdx, str.https:__raw.githubusercontent.com_flarialmc_newcdn_main_dll_latest.dll
lea rcx, [rbp - 0x30]
call fcn.14000120c
nop
lea r8, [rbp - 0x50]
mov r13d, 0xf
cmp qword [rbp - 0x38], r13
cmova r8, qword [rbp - 0x50]
lea rdx, [rbp - 0x30]
cmp qword [rbp - 0x18], r13
cmova rdx, qword [rbp - 0x30]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor ecx, ecx
call sub.urlmon.dll_URLDownloadToFileA
test eax, eax
jns 0x140003924
mov rcx, qword [r15]
lea r9d, [r13 + 1]
lea r8, str.Error
lea rdx, str.Failed_to_download_the_DLL.
mov rcx, qword [rcx]
call qword [sym.imp.USER32.dll_MessageBoxW]
nop
mov ebx, 0x1000
mov rdx, qword [rbp - 0x18]
cmp rdx, r13
jbe 0x140003872
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, rbx
jb 0x14000386d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bc2
call fcn.14000f404
movdqa xmm0, xmmword [0x140011f10]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], r12b
mov rdx, qword [rbp - 0x38]
cmp rdx, r13
jbe 0x1400038c1
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, rbx
jb 0x1400038b4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003c0c
call fcn.14000f404
movdqa xmm0, xmmword [0x140011f10]
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], r13
mov byte [rbp - 0x50], r12b
mov rdx, qword [rbp + 8]
cmp rdx, r13
jbe 0x14000390b
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, rbx
jb 0x1400038fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003c59
call fcn.14000f404
movdqa xmm0, xmmword [0x140011f10]
movdqu xmmword [rbp], xmm0
mov byte [rbp - 0x10], r12b
lea rcx, [rbp + 0x10]
call fcn.1400054a4
xor eax, eax
jmp 0x140003c7f
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], r12
mov qword [rsp + 0x68], r12
mov rsi, qword [rbp - 0x40]
lea r14, [rbp - 0x50]
cmp qword [rbp - 0x38], r13
cmova r14, qword [rbp - 0x50]
movabs rdi, 0x7fffffffffffffff
cmp rsi, rdi
ja 0x140003caf
mov ebx, 0x1000
cmp rsi, r13
ja 0x140003976
mov qword [rsp + 0x68], r13
lea rax, [rsp + 0x50]
mov r8d, 0x10
jmp 0x1400039c9
mov rax, rsi
or rax, r13
cmp rax, rdi
jbe 0x14000398d
movabs rcx, 0x8000000000000000
jmp 0x1400039af
mov rdi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
test rcx, rcx
jne 0x1400039aa
mov rax, r12
jmp 0x1400039bb
cmp rcx, rbx
jb 0x1400039b6
call fcn.1400011d0
jmp 0x1400039bb
call fcn.14000f3c8
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x68], rdi
lea r8, [rsi + 1]
mov qword [rsp + 0x60], rsi
mov rdx, r14
mov rcx, rax
call sub.VCRUNTIME140.dll_memcpy
lea rdx, str.S_1_15_2_1
lea rcx, [rsp + 0x50]
call fcn.14000437c
mov rcx, qword [r15]
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, str.minecraft:__
lea rdx, str.open
mov rcx, qword [rcx]
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
mov esi, 0x15
mov r8d, esi
lea rdx, str.Minecraft.Windows.exe
lea rcx, [rbp - 0x70]
call fcn.14000120c
nop
mov edx, 0xa0
lea rcx, [rbp - 0x70]
call fcn.140004508
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, r13
jbe 0x140003a84
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, rbx
jb 0x140003a7f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003a7f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000f404
lea rax, [rsp + 0x70]
mov qword [rsp + 0x40], rax
mov r8b, r12b
lea rdx, [rbp - 0x10]
lea rcx, [rbp + 0x50]
call fcn.140001624
nop
mov r8b, r12b
lea rdx, str.latest.dll
lea rcx, [rbp + 0x30]
call fcn.1400015e0
nop
lea rdx, [rbp + 0x30]
lea rcx, [rbp + 0x50]
call fcn.140003cb8
mov rdi, rax
lea rcx, [rbp + 0x30]
call fcn.1400054a4
mov rcx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140003ad9
mov rcx, qword [rdi]
mov rax, qword [rdi + 0x10]
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x58], rax
movaps xmm0, xmmword [rsp + 0x50]
movdqa xmmword [rsp + 0x50], xmm0
lea r8, [rsp + 0x30]
lea rdx, [rsp + 0x50]
lea rcx, [rsp + 0x70]
call fcn.140001718
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x60], xmm1
mov r8, rsi
lea rdx, str.Minecraft.Windows.exe
lea rcx, [rbp - 0x70]
call fcn.14000120c
nop
lea rcx, [rbp - 0x70]
call fcn.140004048
nop
lea rdx, [rsp + 0x70]
mov ecx, eax
call fcn.1400061a4
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, r13
jbe 0x140003b7a
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, rbx
jb 0x140003b75
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003b75
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000f404
movdqa xmm0, xmmword [0x140011f10]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], r12b
lea rcx, [rbp + 0x50]
call fcn.1400054a4
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, r13
jbe 0x140003bce
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, rbx
jb 0x140003bc9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003bc9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000f404
movdqa xmm0, xmmword [0x140011f10]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], r12b
mov rdx, qword [rbp - 0x38]
cmp rdx, r13
jbe 0x140003c20
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, rbx
jb 0x140003c13
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003c13
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000f404
movdqa xmm0, xmmword [0x140011f10]
mov qword [rbp - 0x40], r12
mov qword [rbp - 0x38], r13
mov byte [rbp - 0x50], r12b
mov rdx, qword [rbp + 8]
cmp rdx, r13
jbe 0x140003c6d
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, rbx
jb 0x140003c60
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003c60
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000f404
movdqa xmm0, xmmword [0x140011f10]
movdqu xmmword [rbp], xmm0
mov byte [rbp - 0x10], r12b
lea rcx, [rbp + 0x10]
call fcn.1400054a4
mov rcx, qword [rbp + 0x280]
xor rcx, rsp
call fcn.14000f760
lea r11, [rsp + 0x390]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.140005524
nop
int3