Function at 0x140138ec0
Capabilities:
Download url
Receive data

Disassembly:
mov dword [rsp + 0x10], edx
mov qword [rsp + 8], rcx
sub rsp, 0x218
mov rax, qword [0x14038a2b0]
xor rax, rsp
mov qword [rsp + 0x208], rax
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov ecx, ntohl
idiv ecx
mov eax, edx
add eax, 0xf
mov edx, eax
lea rcx, [rsp + 0x1e8]
call fcn.1401382a0
nop
mov r8, qword [rsp + 0x220]
lea rdx, str..ResFlags_
lea rcx, [rsp + 0x1a8]
call fcn.140061e80
nop
lea rax, [rsp + 0x148]
mov qword [rsp + 0x30], rax
lea rdx, [rsp + 0x1a8]
mov rcx, qword [rsp + 0x30]
call fcn.14000f3f0
mov qword [rsp + 0x38], rax
mov rcx, qword [rsp + 0x38]
call fcn.140135e60
cmp eax, dword [rsp + 0x228]
jne 0x140138f71
lea rcx, [rsp + 0x1a8]
call fcn.140135ee0
movzx eax, al
test eax, eax
jne 0x1401391b1
movzx eax, byte [0x14039b363]
test eax, eax
jne 0x14013904c
mov byte [0x14039b363], 1
lea rax, [rsp + 0x168]
mov qword [rsp + 0x40], rax
lea rdx, str.Downloading...
mov rcx, qword [rsp + 0x40]
call fcn.14000f350
mov qword [rsp + 0x48], rax
mov rax, qword [rsp + 0x48]
mov qword [rsp + 0x50], rax
mov rax, qword [rsp + 0x50]
mov qword [rsp + 0x68], rax
lea rax, [rsp + 0x188]
mov qword [rsp + 0x58], rax
lea rdx, [0x140347418]
mov rcx, qword [rsp + 0x58]
call fcn.14000f350
mov qword [rsp + 0x60], rax
mov rax, qword [rsp + 0x60]
mov qword [rsp + 0x70], rax
mov byte [rsp + 0x20], 1
mov r9d, 8
mov r8d, 0xa
mov rdx, qword [rsp + 0x68]
mov rcx, qword [rsp + 0x70]
call fcn.14012df00
lea rdx, [0x14012dd80]
lea rcx, [rsp + 0xd8]
call fcn.140145070
mov qword [rsp + 0x78], rax
mov rax, qword [rsp + 0x78]
mov qword [rsp + 0x80], rax
mov rcx, qword [rsp + 0x80]
call fcn.14012cda0
nop
lea rcx, [rsp + 0xd8]
call fcn.140063420
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
cdq
mov ecx, ntohl
idiv ecx
mov eax, edx
add eax, 0xf
mov edx, eax
lea rcx, [rsp + 0x128]
call fcn.1401382a0
mov qword [rsp + 0x88], rax
mov rax, qword [rsp + 0x88]
mov qword [rsp + 0x90], rax
mov rax, qword [rsp + 0x90]
mov qword [rsp + 0xb8], rax
mov r8, qword [rsp + 0x220]
lea rdx, str.https:__key_hax.net_PGM_Flags_
lea rcx, [rsp + 0x108]
call fcn.140061e80
mov qword [rsp + 0x98], rax
mov rax, qword [rsp + 0x98]
mov qword [rsp + 0xa0], rax
lea r8, [0x14033beac]
mov rdx, qword [rsp + 0xa0]
lea rcx, [rsp + 0xe8]
call fcn.1400119a0
mov qword [rsp + 0xa8], rax
mov rax, qword [rsp + 0xa8]
mov qword [rsp + 0xb0], rax
mov rax, qword [rsp + 0xb0]
mov qword [rsp + 0xc0], rax
mov r8, qword [rsp + 0xb8]
mov rdx, qword [rsp + 0xc0]
lea rcx, [rsp + 0x1c8]
call fcn.14005d720
nop
lea rcx, [rsp + 0xe8]
call fcn.14000f240
nop
lea rcx, [rsp + 0x108]
call fcn.14000f240
nop
lea rcx, [rsp + 0x128]
call fcn.14000f240
lea rcx, [rsp + 0x1a8]
call fcn.14000f130
mov qword [rsp + 0xc8], rax
lea rcx, [rsp + 0x1c8]
call fcn.14000f130
mov qword [rsp + 0xd0], rax
mov qword [rsp + 0x20], 0
xor r9d, r9d
mov r8, qword [rsp + 0xc8]
mov rdx, qword [rsp + 0xd0]
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
lea rcx, [rsp + 0x1c8]
call fcn.14000f240
nop
lea rcx, [rsp + 0x1a8]
call fcn.14000f240
nop
lea rcx, [rsp + 0x1e8]
call fcn.14000f240
nop
mov rcx, qword [rsp + 0x220]
call fcn.14000f240
mov rcx, qword [rsp + 0x208]
xor rcx, rsp
call fcn.140266db0
add rsp, 0x218
ret