Function at 0x14003eb0c
Capabilities:
Check for time delay via gettickcount
Delete file
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x338]
sub rsp, 0x410
mov rax, qword [0x1400592a0]
xor rax, rsp
mov qword [rbp + 0x300], rax
lea r14, [rcx + 0x38]
mov rdi, rcx
xor r15d, r15d
mov rcx, r14
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
lea rdx, str.Starting_download._r_n
lea ecx, [r15 + 4]
call fcn.140019cbc
lea esi, [r15 + 2]
mov dword [rdi + 0x70], r15d
cmp dword [rdi + 0x60], esi
je 0x14003eb8f
lea rdx, str.ERROR:_Download_canceled.__Download_manager_is_not_ready._r_n
mov ecx, esi
call fcn.140019ae0
jmp 0x14003f1f1
mov rax, qword [rdi + 0x78]
mov r12d, 3
mov dword [rdi + 0x60], r12d
or rbx, 0xffffffffffffffff
inc rbx
cmp byte [rax + rbx], r15b
jne 0x14003eba1
inc rbx
mov rcx, rbx
call fcn.1400014a0
mov r13, rax
test rax, rax
jne 0x14003ebcb
mov ebx, 0x8007000e
lea rdx, str.ERROR:_Download_canceled.__Out_of_memory._r_n
jmp 0x14003eb83
mov r8, qword [rdi + 0x78]
lea rax, [rbx - 1]
mov edx, 0x7ffffffe
cmp rax, rdx
ja 0x14003ec12
sub rdx, rbx
mov rcx, r13
sub r8, r13
lea rax, [rdx + rbx]
test rax, rax
je 0x14003ec02
mov al, byte [r8 + rcx]
test al, al
je 0x14003ec02
mov byte [rcx], al
inc rcx
sub rbx, 1
jne 0x14003ebe6
test rbx, rbx
lea rax, [rcx - 1]
cmovne rax, rcx
mov byte [rax], r15b
jmp 0x14003ec1b
test rbx, rbx
je 0x14003ec1b
mov byte [r13], r15b
mov ebx, 0x68
lea rcx, [rsp + 0x70]
mov r8d, ebx
xor edx, edx
call sub.api_ms_win_crt_string_l1_1_0.dll_memset
lea rax, [rbp + 0xe0]
mov dword [rsp + 0x70], ebx
mov ecx, 0x104
mov qword [rbp - 0x78], rax
lea rax, [rbp + 0x1f0]
mov dword [rbp - 0x70], ecx
mov qword [rbp - 0x48], rax
mov dword [rbp - 0x40], ecx
movabs r10, 0xc0209e8d18d89970
mov rax, qword [rdi + 0x288]
lea r9, [rsp + 0x70]
xor r8d, r8d
xor edx, edx
mov rcx, r13
call qword [0x140048188]
test eax, eax
jne 0x14003ecb4
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x14003ec93
lea ebx, [rax + 0x57]
jmp 0x14003ec95
jle 0x14003ec9e
movzx ebx, bx
or ebx, 0x80070000
lea rdx, str.ERROR:_Could_not_crack_URL:_0x_x._r_n
mov r8d, ebx
mov ecx, esi
call fcn.140019b1c
jmp 0x14003f1dd
movabs r10, 0x8b793e1d5856d170
movzx r8d, word [rbp - 0x6c]
xor r9d, r9d
mov rdx, qword [rbp - 0x78]
mov rcx, qword [rdi + 0xa8]
mov rax, qword [rdi + 0x290]
mov qword [rsp + 0x38], r15
mov dword [rsp + 0x30], r15d
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r15
call qword [0x140048188]
mov qword [rdi + 0xb0], rax
test rax, rax
jne 0x14003ed2c
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x14003ed15
lea ebx, [rax + 0x57]
jmp 0x14003ed17
jle 0x14003ed20
movzx ebx, bx
or ebx, 0x80070000
lea rdx, str.ERROR:_Could_not_connect_to_host:_0x_x._r_n
jmp 0x14003eca5
movabs r10, 0x9ec527927ad4d270
mov r8, qword [rbp - 0x48]
lea rdx, [0x1400524c4]
mov qword [rsp + 0x38], r15
mov rcx, rax
mov rax, qword [rdi + 0x2b0]
xor r9d, r9d
mov dword [rsp + 0x30], 0x4400200
mov qword [rsp + 0x28], r15
mov qword [rsp + 0x20], r15
call qword [0x140048188]
mov qword [rdi + 0xb8], rax
mov r12, rax
test rax, rax
jne 0x14003eda8
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x14003ed91
lea ebx, [rax + 0x57]
jmp 0x14003ed93
jle 0x14003ed9c
movzx ebx, bx
or ebx, 0x80070000
lea rdx, str.ERROR:_Could_not_open_request:_0x_x._r_n
jmp 0x14003eca5
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov ebx, 4
lea rdx, str.Download_manager_now_connecting_to_URL._r_n
mov ecx, ebx
call fcn.140019cbc
movabs r10, 0xdb10af0074ded970
mov rax, qword [rdi + 0x2b8]
xor r9d, r9d
xor r8d, r8d
mov dword [rsp + 0x20], r15d
xor edx, edx
mov rcx, r12
call qword [0x140048188]
test eax, eax
je 0x14003f164
mov dword [rsp + 0x50], ebx
movabs r10, 0xb6a017c8325dcb70
mov rax, qword [rdi + 0x2c0]
lea r9, [rsp + 0x50]
lea r8, [rsp + 0x58]
mov qword [rsp + 0x20], r15
mov edx, 0x20000013
mov rcx, r12
call qword [0x140048188]
test eax, eax
je 0x14003f144
mov eax, dword [rsp + 0x58]
sub eax, 0xc8
je 0x14003eef8
sub eax, 0xc9
je 0x14003ee89
sub eax, esi
je 0x14003ee89
sub eax, 1
je 0x14003ee81
sub eax, 3
je 0x14003ee79
sub eax, 1
je 0x14003ee71
cmp eax, 0x5c
je 0x14003ee69
mov r8d, 0x800710e0
jmp 0x14003ee8f
mov r8d, 0x8007003a
jmp 0x14003ee8f
mov r8d, 0x8007041d
jmp 0x14003ee8f
mov r8d, 0x80070041
jmp 0x14003ee8f
mov r8d, 0x80070002
jmp 0x14003ee8f
mov r8d, 0x80070005
lea rdx, str.ERROR:_HTTPSendRequest_failed.__Result:_0x_x._r_n
mov ecx, esi
call fcn.140019b1c
cmp dword [rsp + 0x58], 0x197
jne 0x14003eee4
movabs r10, 0x9b812f5b1a545970
mov rcx, qword [rdi + 0x1338]
mov r9d, 7
mov rax, qword [rdi + 0x2a8]
mov r8d, 0x2eee
mov rdx, r12
mov qword [rsp + 0x20], r15
call qword [0x140048188]
cmp eax, 0x2f00
je 0x14003edca
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
jmp 0x14003f1d8
mov rcx, r14
mov ebx, r15d
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
cmp dword [rdi + 0x60], 3
je 0x14003ef9b
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x14003ef2b
lea ebx, [rax + 0x57]
jmp 0x14003ef2d
jle 0x14003ef36
movzx ebx, bx
or ebx, 0x80070000
movabs r10, 0xb2e10636105e9a70
mov rcx, qword [rdi + 0xb0]
mov rax, qword [rdi + 0x2a0]
call qword [0x140048188]
mov qword [rdi + 0xb0], r15
movabs r10, 0xb2e10636105e9a70
mov rcx, qword [rdi + 0xb8]
mov rax, qword [rdi + 0x2a0]
call qword [0x140048188]
mov r8d, ebx
mov qword [rdi + 0xb8], r15
lea rdx, str.ERROR:_Could_not_open_URL:_0x_x._r_n
mov ecx, esi
call fcn.140019b1c
mov ebx, 0x80004004
jmp 0x14003f1dd
mov esi, 4
mov rcx, r14
mov dword [rdi + 0x60], esi
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov dword [rsp + 0x50], esi
movabs r10, 0xb6a017c8325dcb70
mov rax, qword [rdi + 0x2c0]
lea r9, [rsp + 0x50]
lea r8, [rdi + 0x68]
mov qword [rsp + 0x20], r15
mov edx, 0x20000005
mov rcx, r12
call qword [0x140048188]
test eax, eax
jne 0x14003eff9
lea rdx, str.__Could_not_determine_download_size_for_URL._r_n
mov ecx, esi
call fcn.140019b1c
or dword [rdi + 0x68], 0xffffffff
mov dword [rsp + 0x54], r15d
mov dword [rsp + 0x5c], r15d
call qword [sym.imp.KERNEL32.dll_GetTickCount]
nop dword [rax + rax]
mov r15d, eax
lea rsi, [rdi + 0x320]
movabs r10, 0xce998fb610d75970
mov rax, qword [rdi + 0x298]
lea r9, [rsp + 0x54]
mov r8d, 0x1000
mov rdx, rsi
mov rcx, r12
call qword [0x140048188]
test eax, eax
je 0x14003f0f5
mov r8d, dword [rsp + 0x54]
test r8d, r8d
je 0x14003f123
mov rcx, qword [rdi + 0xc0]
lea r9, [rsp + 0x5c]
and qword [rsp + 0x20], rbx
mov rdx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax + rax]
test eax, eax
je 0x14003f0ba
mov eax, dword [rsp + 0x54]
add dword [rdi + 0x6c], eax
call qword [sym.imp.KERNEL32.dll_GetTickCount]
nop dword [rax + rax]
mov ecx, eax
sub ecx, r15d
cmp ecx, 0x3e8
jb 0x14003f019
mov eax, 0x10624dd3
mul ecx
mov eax, dword [rdi + 0x6c]
mov ecx, edx
xor edx, edx
shr ecx, 6
div ecx
mov dword [rdi + 0x70], eax
jmp 0x14003f019
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
xor r15d, r15d
mov ebx, eax
test eax, eax
jne 0x14003f0d4
lea ebx, [rax + 0x57]
jmp 0x14003f0d6
jle 0x14003f0df
movzx ebx, bx
or ebx, 0x80070000
lea rdx, str.ERROR:_WriteFile_failed.__Result:_0x_x._r_n
mov r8d, ebx
mov ecx, 2
call fcn.140019b1c
jmp 0x14003f126
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
xor r15d, r15d
mov ebx, eax
test eax, eax
jne 0x14003f10f
lea ebx, [rax + 0x57]
jmp 0x14003f111
jle 0x14003f11a
movzx ebx, bx
or ebx, 0x80070000
lea rdx, str.ERROR:_InternetReadFile_failed.__Result:_0x_x._r_n
jmp 0x14003f0e6
xor r15d, r15d
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
cmp dword [rdi + 0x60], 4
je 0x14003f1dd
jmp 0x14003ef91
mov rcx, r14
mov ebx, 0x8007000d
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
lea rdx, str.ERROR:_Could_not_obtain_connection_result:_0x_x._r_n
jmp 0x14003eca5
call qword [sym.imp.KERNEL32.dll_GetLastError]
nop dword [rax + rax]
mov ebx, eax
test eax, eax
jne 0x14003f17b
lea ebx, [rax + 0x57]
jmp 0x14003f17d
jle 0x14003f186
movzx ebx, bx
or ebx, 0x80070000
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
mov dword [rsp + 0x64], r15d
mov dword [rsp + 0x60], pe_nt_image_headers64
movabs r10, 0xf52c9e7d54dce270
mov rax, qword [rdi + 0x2c8]
lea r8, [rsp + 0x60]
lea rdx, [rbp - 0x20]
lea rcx, [rsp + 0x64]
call qword [0x140048188]
mov r8d, ebx
lea rdx, str.ERROR:_Could_not_open_URL.__Result:_0x_x._r_n
mov ecx, esi
call fcn.140019b1c
mov ebx, 0x80072efd
mov rcx, r13
call fcn.140001454
cmp ebx, 0x80004004
je 0x14003f2fc
mov r12d, 4
lea rdx, str.Download_complete._r_n
mov ecx, r12d
call fcn.140019cbc
mov eax, ebx
mov dword [rdi + 0x64], ebx
sar eax, 0x1f
and eax, 0xfffffffc
add eax, 5
mov dword [rdi + 0x60], eax
mov rcx, qword [rdi + 0xc0]
cmp rcx, 0xffffffffffffffff
je 0x14003f238
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [rax + rax]
or qword [rdi + 0xc0], 0xffffffffffffffff
test ebx, ebx
jns 0x14003f25a
cmp dword [rdi + 0x90], r15d
je 0x14003f25a
mov rcx, qword [rdi + 0x80]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
nop dword [rax + rax]
jmp 0x14003f261
mov dword [rdi + 0x90], r15d
mov rsi, qword [rdi + 0x318]
mov qword [rdi + 0x318], r15
test rsi, rsi
je 0x14003f2b1
mov ebx, dword [rdi + 0x74]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rax, qword [rsi]
movabs r10, 0xacc10fbc1a59f070
mov rax, qword [rax + 0x18]
mov edx, ebx
mov rcx, rsi
call qword [0x140048188]
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_EnterCriticalSection]
nop dword [rax + rax]
cmp dword [rdi + 0x60], 5
je 0x14003f2fc
mov rcx, qword [rdi + 0x78]
mov rax, r15
test rcx, rcx
je 0x14003f2d4
mov edx, 0x2f
call qword [sym.imp.api_ms_win_crt_private_l1_1_0.dll_strrchr]
nop dword [rax + rax]
mov edx, dword [rdi + 0x68]
lea r8, str.UNKNOWN
mov r9d, dword [rdi + 0x6c]
test rax, rax
mov dword [rsp + 0x20], edx
mov ecx, r12d
cmovne r8, rax
lea rdx, str.__Download_failed_for__hs_at__lu_of__lu_bytes._r_n
call fcn.140019b1c
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
nop dword [rax + rax]
mov rcx, qword [rbp + 0x300]
xor rcx, rsp
call fcn.1400017f0
lea r11, [rsp + 0x410]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret