Function at 0x140001e40
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
mov qword [rsp + 0x18], rbx
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1190]
mov eax, 0x1290
call fcn.140006400
sub rsp, rax
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rbp + 0x1180], rax
mov rdi, rdx
mov rbx, rcx
xor r15d, r15d
mov dword [rsp + 0x58], r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov edx, 1
lea rcx, str.Downloader
call qword [sym.imp.WININET.dll_InternetOpenW]
mov r14, rax
test rax, rax
jne 0x140001ee7
lea rdx, str._Error__InternetOpen_failed_with_error_code:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140004990
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140004b70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor al, al
jmp 0x1400025fb
mov rdx, rbx
cmp qword [rbx + 0x18], 7
jbe 0x140001ef4
mov rdx, qword [rbx]
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], 0x84000000
xor r9d, r9d
xor r8d, r8d
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetOpenUrlW]
mov rsi, rax
test rax, rax
jne 0x140001fe7
lea rdx, str._Error__InternetOpenUrl_failed_for_URL:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140004990
mov rdi, rax
cmp qword [rbx + 0x18], 7
jbe 0x140001f3c
mov rbx, qword [rbx]
mov rdx, rbx
lea rcx, [rsp + 0x30]
call fcn.1400012b0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x140001f58
mov rax, qword [rax]
mov rdx, rax
mov rcx, rdi
call fcn.140004f70
lea rdx, str._with_error_code:
mov rcx, rax
call fcn.140004990
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140004b70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x140001fd7
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001fd2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001fd2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400054f4
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
xor al, al
jmp 0x1400025fb
xor edx, edx
mov r8d, 0x108
lea rcx, [rsp + 0x60]
call sub.VCRUNTIME140.dll_memset
mov rbx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140002006
mov rbx, qword [rdi]
lea rax, [0x140000000]
lea rax, [rax + 0x8028]
mov qword [rsp + 0x60], rax
lea rcx, [rbp + 8]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x58], 1
xor r9d, r9d
xor r8d, r8d
lea rdx, [rsp + 0x68]
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea r12, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rsp + rcx + 0x60], r12
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x5c], edx
lea rcx, [rsp + 0x68]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
lea r13, vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov qword [rsp + 0x68], r13
mov byte [rbp - 0x1c], 0
mov byte [rbp - 0x27], 0
lea rcx, [rsp + 0x68]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp - 0x18], r15
mov rax, qword [0x14000ca08]
mov qword [rbp - 0x24], rax
mov qword [rbp - 0x30], r15
mov r8d, 0x22
mov rdx, rbx
lea rcx, [rsp + 0x68]
call fcn.140004820
test rax, rax
jne 0x1400020e0
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x60]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
mov qword [rsp + rcx + 0x60], r12
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rsp + rcx + 0x5c], edx
cmp qword [rbp - 0x18], 0
jne 0x1400021de
lea rdx, str._Error__Failed_to_open_file_for_writing:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140004990
mov rbx, rax
cmp qword [rdi + 0x18], 7
jbe 0x14000212c
mov rdi, qword [rdi]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1400012b0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x140002148
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.140004f70
lea rdx, str._with_error_code:
mov rcx, rax
call fcn.140004990
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140004b70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400021c7
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400021c2
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400021c2
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400054f4
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
jmp 0x1400025ec
mov dword [rsp + 0x5c], r15d
mov bl, 1
lea r9, [rsp + 0x5c]
mov r8d, 0x1000
lea rdx, [rbp + 0x180]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
je 0x140002240
mov eax, dword [rsp + 0x5c]
test eax, eax
je 0x140002240
mov r8d, eax
lea rdx, [rbp + 0x180]
lea rcx, [rsp + 0x60]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea r9, [rsp + 0x5c]
mov r8d, 0x1000
lea rdx, [rbp + 0x180]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
test eax, eax
jne 0x140002204
call qword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x140002283
lea rdx, str._Error__InternetReadFile_failed_with_error_code:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140004990
mov rbx, rax
call qword [sym.imp.KERNEL32.dll_GetLastError]
mov edx, eax
mov rcx, rbx
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___unsigned_long_int____ptr64]
lea rdx, [0x140004b70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor bl, bl
lea rcx, [rsp + 0x68]
call fcn.140004720
test rax, rax
jne 0x1400022b1
mov rax, qword [rsp + 0x60]
movsxd rcx, dword [rax + 4]
lea rax, [rsp + 0x60]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r14
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test bl, bl
je 0x1400025c9
xor edx, edx
mov r8d, 0x110
lea rcx, [rbp + 0x70]
call sub.VCRUNTIME140.dll_memset
mov rbx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x1400022e9
mov rbx, qword [rdi]
lea rax, [0x140000000]
lea rax, [rax + 0x8030]
mov qword [rbp + 0x70], rax
lea rcx, [rbp + 0x120]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::constructor_void____ptr64]
nop
mov dword [rsp + 0x58], 3
xor r9d, r9d
xor r8d, r8d
lea rdx, [rbp + 0x80]
lea rcx, [rbp + 0x70]
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_istream_char__struct_std::char_traits_char__::constructor_class_std::basic_streambuf_char__struct_std::char_traits_char______ptr64__bool____ptr64]
nop
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea rsi, vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x70], rsi
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x6c], edx
lea rcx, [rbp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::constructor_void____ptr64]
mov qword [rbp + 0x80], r13
mov byte [rbp + 0xfc], 0
mov byte [rbp + 0xf1], 0
lea rcx, [rbp + 0x80]
call qword [sym.imp.MSVCP140.dll_protected:_void___cdecl_std::basic_streambuf_char__struct_std::char_traits_char__::_Init_void____ptr64]
mov qword [rbp + 0x100], r15
mov rax, qword [0x14000ca08]
mov qword [rbp + 0xf4], rax
mov qword [rbp + 0xe8], r15
mov r8d, 0x25
mov rdx, rbx
lea rcx, [rbp + 0x80]
call fcn.140004820
test rax, rax
jne 0x1400023d2
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x70]
add rcx, rax
xor r8d, r8d
mov edx, 2
call qword [sym.imp.MSVCP140.dll_public:_void___cdecl_std::basic_ios_char__struct_std::char_traits_char__::setstate_int__bool____ptr64]
nop
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
mov qword [rbp + rcx + 0x70], rsi
mov rax, qword [rbp + 0x70]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xb0]
mov dword [rbp + rcx + 0x6c], edx
lea rdx, [rsp + 0x30]
lea rcx, [rbp + 0x70]
call qword [sym.imp.MSVCP140.dll_public:_class_std::fpos_struct__Mbstatet____cdecl_std::basic_istream_char__struct_std::char_traits_char__::tellg_void____ptr64]
mov rbx, qword [rax + 8]
add rbx, qword [rax]
cmp rbx, 0x2800
jge 0x140002453
lea rdx, str._Error__Downloaded_file_size_is_less_than_10KB:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140004990
mov rdx, rbx
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___long_long___int64_____ptr64]
mov rcx, rax
lea rdx, str._bytes._This_is_not_a_valid_executable.
call fcn.140004990
lea rdx, [0x140004b70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
jmp 0x1400025bc
mov rcx, rdi
cmp qword [rdi + 0x18], 7
jbe 0x140002460
mov rcx, qword [rdi]
lea rdx, [rsp + 0x58]
call qword [sym.imp.KERNEL32.dll_GetBinaryTypeW]
test eax, eax
je 0x140002524
mov eax, dword [rsp + 0x58]
cmp eax, 1
jbe 0x140002485
cmp eax, 6
jne 0x140002524
lea rdx, str._Info__File_downloaded_and_is_a_valid_executable:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140004990
mov rbx, rax
cmp qword [rdi + 0x18], 7
jbe 0x1400024a5
mov rdi, qword [rdi]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1400012b0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x1400024c1
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.140004f70
lea rdx, [0x140004b70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x14000251d
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140002518
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140002518
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400054f4
mov bl, 1
jmp 0x1400025be
lea rdx, str._Error__Downloaded_file_is_not_a_valid_executable:
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140004990
mov rbx, rax
cmp qword [rdi + 0x18], 7
jbe 0x140002544
mov rdi, qword [rdi]
mov rdx, rdi
lea rcx, [rsp + 0x30]
call fcn.1400012b0
nop
mov r8, qword [rax + 0x10]
cmp qword [rax + 0x18], 0xf
jbe 0x140002560
mov rax, qword [rax]
mov rdx, rax
mov rcx, rbx
call fcn.140004f70
lea rdx, [0x140004b70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
nop
mov rdx, qword [rsp + 0x48]
cmp rdx, 0xf
jbe 0x1400025bc
inc rdx
mov rcx, qword [rsp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400025b7
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400025b7
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400054f4
xor bl, bl
lea rcx, [rbp + 0x70]
call fcn.1400026f0
jmp 0x1400025ee
lea rdx, str._Error__Download_failed_during_file_transfer.
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140004990
lea rdx, [0x140004b70]
mov rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::operator___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64____cdecl___class_std::basic_ostream_char__struct_std::char_traits_char______ptr64_____ptr64]
xor bl, bl
lea rcx, [rsp + 0x60]
call fcn.140002630
movzx eax, bl
mov rcx, qword [rbp + 0x1180]
xor rcx, rsp
call fcn.1400053c0
mov rbx, qword [rsp + 0x12e0]
add rsp, 0x1290
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret