Function at 0x14002d148
Capabilities:
Delete file
Encode data using xor

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x1c8]
sub rsp, 0x2a0
mov ebx, 0x200000
mov ecx, ebx
call fcn.140037e70
mov r8d, ebx
xor edx, edx
mov rcx, rax
mov r15, rax
call fcn.14003a5c0
mov rdi, qword [0x1400c52d8]
mov rsi, qword [rdi + 8]
mov rbx, qword [rdi]
jmp 0x14002d1a9
mov rcx, rbx
call fcn.14002bcd4
add rbx, 0xa0
cmp rbx, rsi
jne 0x14002d19a
mov rax, qword [rdi]
lea rcx, [rbp + 0x70]
mov qword [rdi + 8], rax
xor edx, edx
lea rax, str.cdn.wb009.com_adhunter_key.html
mov qword [rsp + 0x60], rax
lea rax, str.home.wb009.com:8080_md_adhunter_key.html
mov qword [rsp + 0x68], rax
lea rax, str.122.224.171.229:8080_md_key.html
mov qword [rsp + 0x70], rax
lea r8d, [rdx + 0x28]
lea rax, str.dh.ywcywl.com_md_key.html
mov qword [rsp + 0x78], rax
lea rax, str.d.wb009.com:8081_md_adhunter_key.html
mov qword [rbp - 0x80], rax
call fcn.14003a5c0
call qword [sym.imp.KERNEL32.dll_GetTickCount]
xor r13d, r13d
or rsi, 0xffffffffffffffff
mov r9d, eax
mov r10d, r13d
mov eax, 0xcccccccd
mul r9d
lea edi, [rsi + 6]
shr edx, 2
lea r12d, [r13 + 1]
lea ecx, [rdx + rdx*4]
sub r9d, ecx
mov edx, r9d
cmp r9d, edi
jae 0x14002d272
movsxd rbx, r9d
lea r11, [rbp + 0x70]
mov r8, rbx
mov rax, qword [rsp + r8*8 + 0x60]
add r10d, r12d
mov qword [r11], rax
lea r11, [r11 + 8]
cmp r10d, edi
je 0x14002d272
mov rcx, rdi
movsxd rax, r10d
sub rcx, rbx
cmp rax, rcx
jb 0x14002d268
cmp edx, r9d
jl 0x14002d268
mov edx, esi
mov r8, rsi
add edx, r12d
add r8, r12
cmp edx, edi
jb 0x14002d23c
mov edi, r13d
lea rsi, [rbp + 0x70]
mov r14d, reloc.WSOCK32.dll_recv
xor ecx, ecx
call fcn.140060dd4
xor edx, edx
lea rcx, [rbp + 0xa0]
mov r8d, 0x100
mov rbx, rax
call fcn.14003a5c0
mov r8, qword [rsi]
lea rdx, str.http:___s_tsts_d
mov r9d, ebx
lea rcx, [rbp + 0xa0]
call fcn.1400055a4
mov ebx, 0x200000
mov byte [rbp + 0x19f], r13b
mov r8d, ebx
mov dword [rbp + 0x1d0], r13d
xor edx, edx
mov rcx, r15
call fcn.14003a5c0
lea rax, [rbp + 0x1d0]
mov edx, 0x50
mov qword [rsp + 0x38], rax
lea r8, [0x14009e988]
mov dword [rsp + 0x30], ebx
lea rcx, [rbp + 0xa0]
mov qword [rsp + 0x28], r15
xor r9d, r9d
mov dword [rsp + 0x20], r13d
call fcn.14001687c
test eax, eax
je 0x14002d7bb
cmp byte [r15], 0x50
jne 0x14002d6db
cmp byte [r15 + 1], 0x4b
jne 0x14002d6db
mov rbx, qword [0x1400c5200]
mov qword [rsp + 0x58], reloc.WSOCK32.dll_ntohs
mov qword [rsp + 0x50], r13
mov byte [rsp + 0x40], r13b
cmp byte [rbx], r13b
jne 0x14002d34c
mov rax, r13
jmp 0x14002d354
mov rcx, rbx
call fcn.140045e50
mov r8, rax
lea rcx, [rsp + 0x40]
mov rdx, rbx
call fcn.140004d8c
lea r8, str.zlogkk14542243.txt
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x78]
call fcn.14000145c
cmp qword [rax + 0x18], r14
jb 0x14002d382
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rdx, qword [rbp - 0x60]
cmp rdx, r14
jb 0x14002d3a3
mov rcx, qword [rbp - 0x78]
inc rdx
mov r8, r12
call fcn.140004554
lea r8, str.get_ls_keyword.html
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x78]
call fcn.14000145c
cmp qword [rax + 0x18], r14
jb 0x14002d3c1
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rdx, qword [rbp - 0x60]
cmp rdx, r14
jb 0x14002d3e2
mov rcx, qword [rbp - 0x78]
inc rdx
mov r8, r12
call fcn.140004554
lea r8, str.zlogkk14542243.txt
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x78]
call fcn.14000145c
cmp qword [rax + 0x18], r14
jb 0x14002d400
mov rax, qword [rax]
mov r8d, dword [rbp + 0x1d0]
mov rdx, r15
mov rcx, rax
call fcn.140021154
mov rdx, qword [rbp - 0x60]
test eax, eax
sete bl
cmp rdx, r14
jb 0x14002d42f
mov rcx, qword [rbp - 0x78]
inc rdx
mov r8, r12
call fcn.140004554
test bl, bl
je 0x14002d46e
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.zccm_GetLsKeywordInfo:_fCreateFile_key_z_file_failed___error_d__r_n
mov ecx, r12d
mov r8d, eax
call fcn.1400191e0
mov rdx, qword [rsp + 0x58]
cmp rdx, r14
jb 0x14002d7bb
mov rcx, qword [rsp + 0x40]
inc rdx
mov r8, r12
call fcn.140004554
jmp 0x14002d7bb
or r9, 0xffffffffffffffff
mov qword [rbp - 0x40], reloc.WSOCK32.dll_ntohs
xor r8d, r8d
mov qword [rbp - 0x48], r13
lea rdx, [rsp + 0x40]
mov byte [rbp - 0x58], r13b
lea rcx, [rbp - 0x58]
call fcn.140004c64
lea r8, str.zlogkk14542243.txt
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14000145c
mov rbx, rax
cmp qword [rax + 0x18], r14
jb 0x14002d4b5
mov rbx, qword [rax]
mov qword [rbp - 0x60], reloc.WSOCK32.dll_ntohs
mov qword [rbp - 0x68], r13
mov byte [rbp - 0x78], r13b
cmp byte [rbx], r13b
jne 0x14002d4cf
mov rax, r13
jmp 0x14002d4d7
mov rcx, rbx
call fcn.140045e50
mov r8, rax
lea rcx, [rbp - 0x78]
mov rdx, rbx
call fcn.140004d8c
lea rdx, [rbp - 0x58]
lea rcx, [rbp - 0x78]
call fcn.14002060c
mov rdx, qword [rsp + 0x78]
test eax, eax
sete bl
cmp rdx, r14
jb 0x14002d512
mov rcx, qword [rsp + 0x60]
inc rdx
mov r8, r12
call fcn.140004554
test bl, bl
je 0x14002d5b6
lea rdx, str.zccm_GetLsKeywordInfo:_UnZip_failed__r_n
mov ecx, r12d
call fcn.1400191e0
lea r8, str.zlogkk14542243.txt
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14000145c
cmp qword [rax + 0x18], r14
jb 0x14002d548
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rdx, qword [rsp + 0x78]
cmp rdx, r14
jb 0x14002d56b
mov rcx, qword [rsp + 0x60]
mov r8, r12
inc rdx
call fcn.140004554
lea r8, str.get_ls_keyword.html
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14000145c
cmp qword [rax + 0x18], r14
jb 0x14002d58a
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rdx, qword [rsp + 0x78]
cmp rdx, r14
jb 0x14002d44b
mov rcx, qword [rsp + 0x60]
inc rdx
mov r8, r12
call fcn.140004554
jmp 0x14002d44b
mov ebx, 0x200000
xor edx, edx
mov r8d, ebx
mov rcx, r15
call fcn.14003a5c0
lea r8, str.get_ls_keyword.html
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14000145c
cmp qword [rax + 0x18], r14
jb 0x14002d5e7
mov rax, qword [rax]
xor r9d, r9d
mov dword [rsp + 0x20], r13d
mov r8d, ebx
mov rdx, r15
mov rcx, rax
call fcn.140021484
mov rdx, qword [rsp + 0x78]
test eax, eax
sete bl
cmp rdx, r14
jb 0x14002d61c
mov rcx, qword [rsp + 0x60]
inc rdx
mov r8, r12
call fcn.140004554
test bl, bl
je 0x14002d63d
call qword [sym.imp.KERNEL32.dll_GetLastError]
lea rdx, str.zccm_GetLsKeywordInfo:_fReadFile_Buf_key_u_z_f_failed___error_d__r_n
mov ecx, r12d
mov r8d, eax
call fcn.1400191e0
jmp 0x14002d529
lea r8, str.zlogkk14542243.txt
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14000145c
cmp qword [rax + 0x18], r14
jb 0x14002d65c
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rdx, qword [rsp + 0x78]
cmp rdx, r14
jb 0x14002d67f
mov rcx, qword [rsp + 0x60]
inc rdx
mov r8, r12
call fcn.140004554
lea r8, str.get_ls_keyword.html
lea rdx, [rsp + 0x40]
lea rcx, [rsp + 0x60]
call fcn.14000145c
cmp qword [rax + 0x18], r14
jb 0x14002d69e
mov rax, qword [rax]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
mov rdx, qword [rsp + 0x78]
cmp rdx, r14
jb 0x14002d6c1
mov rcx, qword [rsp + 0x60]
inc rdx
mov r8, r12
call fcn.140004554
mov rdx, qword [rsp + 0x58]
cmp rdx, r14
jb 0x14002d6db
mov rcx, qword [rsp + 0x40]
inc rdx
mov r8, r12
call fcn.140004554
mov ecx, 0x400008
mov byte [r15 + 0x1fffff], r13b
call fcn.140037e70
xor edx, edx
mov r8d, 0x400008
mov rcx, rax
mov rbx, rax
call fcn.14003a5c0
mov rdx, r15
mov rcx, rbx
call fcn.140060710
xor edx, edx
mov r8d, 0x200000
mov rcx, r15
call fcn.14003a5c0
mov rdx, r15
mov rcx, rbx
call fcn.140016534
mov rcx, rbx
call fcn.140045e50
shr rax, 1
movsxd rcx, eax
test eax, eax
jle 0x14002d745
mov rax, r15
xor byte [rax], 0x48
add rax, r12
sub rcx, r12
jne 0x14002d73a
mov rdx, r12
mov rcx, rbx
call fcn.140037e68
mov rcx, r15
call fcn.14002c4bc
mov rcx, r15
call fcn.14002ef20
lea rdx, [0x14009e98c]
mov rcx, r15
call fcn.14003a760
mov rbx, rax
test rax, rax
je 0x14002d7bb
lea rdx, [0x1400a4d84]
mov rcx, rax
call fcn.14003a760
test rax, rax
jne 0x14002d79f
lea rdx, [0x14009e990]
mov rcx, rbx
call fcn.14003a760
test rax, rax
je 0x14002d7a2
mov byte [rax], r13b
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call fcn.14000ea88
mov r14, rax
test rax, rax
jne 0x14002d7ee
lea r14d, [rax + 0x10]
add edi, r12d
add rsi, 8
cmp edi, 5
jb 0x14002d27f
xor eax, eax
lea r11, [rsp + 0x2a0]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
cmp dword [rax], r12d
jne 0x14002da0f
mov rcx, r14
mov r12d, r13d
call fcn.140010a80
test rax, rax
je 0x14002da09
mov rbx, r13
mov rdx, rbx
mov rcx, r14
call fcn.140010820
mov r15, rax
test rax, rax
je 0x14002d9f2
mov eax, reloc.WSOCK32.dll_ntohs
mov qword [rbp - 0x20], r13
mov rcx, r15
mov qword [rbp - 0x18], rax
mov qword [rbp + 8], rax
mov qword [rbp + 0x28], rax
mov qword [rbp + 0x48], rax
mov qword [rbp + 0x68], rax
mov byte [rbp - 0x30], r13b
mov qword [rbp], r13
mov byte [rbp - 0x10], r13b
mov qword [rbp + 0x20], r13
mov byte [rbp + 0x10], r13b
mov qword [rbp + 0x40], r13
mov byte [rbp + 0x30], r13b
mov qword [rbp + 0x60], r13
mov byte [rbp + 0x50], r13b
call fcn.140010f18
jmp 0x14002d9cd
mov rcx, rsi
call fcn.140010f4c
mov rcx, rsi
mov rdi, rax
call fcn.140010fac
mov rcx, rax
call fcn.140011554
lea rdx, [0x1400a4d88]
mov rcx, rdi
mov rbx, rax
call fcn.14007f078
test eax, eax
jne 0x14002d8bf
cmp byte [rbx], r13b
jne 0x14002d8ae
mov rax, r13
jmp 0x14002d8b6
mov rcx, rbx
call fcn.140045e50
lea rcx, [rbp - 0x30]
jmp 0x14002d9b7
lea rdx, str.keyword
mov rcx, rdi
call fcn.14007f078
test eax, eax
jne 0x14002d905
mov ecx, 0x1000
call fcn.140037e70
mov rdx, rax
mov rcx, rbx
mov rdi, rax
mov byte [rax], r13b
call fcn.1400187d0
cmp byte [rdi], r13b
jne 0x14002d8f7
mov rax, r13
jmp 0x14002d8ff
mov rcx, rdi
call fcn.140045e50
lea rcx, [rbp - 0x10]
jmp 0x14002d949
lea rdx, str.keyword_desc
mov rcx, rdi
call fcn.14007f078
test eax, eax
jne 0x14002d963
mov ecx, 0x1000
call fcn.140037e70
mov rdx, rax
mov rcx, rbx
mov rdi, rax
mov byte [rax], r13b
call fcn.1400187d0
cmp byte [rdi], r13b
jne 0x14002d93d
mov rax, r13
jmp 0x14002d945
mov rcx, rdi
call fcn.140045e50
lea rcx, [rbp + 0x10]
mov rdx, rdi
mov r8, rax
call fcn.140004d8c
mov edx, 1
mov rcx, rdi
call fcn.140037e68
jmp 0x14002d9c2
lea rdx, str.keyword_software_catalog
mov rcx, rdi
call fcn.14007f078
test eax, eax
jne 0x14002d98e
cmp byte [rbx], r13b
jne 0x14002d980
mov rax, r13
jmp 0x14002d988
mov rcx, rbx
call fcn.140045e50
lea rcx, [rbp + 0x30]
jmp 0x14002d9b7
lea rdx, str.type
mov rcx, rdi
call fcn.14007f078
test eax, eax
jne 0x14002d9c2
cmp byte [rbx], r13b
jne 0x14002d9ab
mov rax, r13
jmp 0x14002d9b3
mov rcx, rbx
call fcn.140045e50
lea rcx, [rbp + 0x50]
mov r8, rax
mov rdx, rbx
call fcn.140004d8c
mov rdx, rsi
mov rcx, r15
call fcn.140010f5c
mov rsi, rax
test rax, rax
jne 0x14002d873
mov rcx, qword [0x1400c52d8]
lea rdx, [rbp - 0x30]
call fcn.140032060
lea rcx, [rbp - 0x30]
call fcn.14002bcd4
inc r12d
mov rcx, r14
movsxd rbx, r12d
call fcn.140010a80
cmp rbx, rax
jb 0x14002d80e
mov r12d, 1
mov eax, r12d
jmp 0x14002d7cd