Function at 0x140001650
Capabilities:
Create directory
Create process on windows
Download url
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x270]
sub rsp, 0x370
mov rax, qword [0x140064040]
xor rax, rsp
mov qword [rbp + 0x260], rax
xor r15d, r15d
lea rcx, [rbp + 0x30]
call fcn.1400011c0
nop
cmp qword [rbp + 0x40], r15
jne 0x1400016b3
lea rdx, str.Horizon_is_down__Please_wait_for_further_notice.._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002a40
jmp 0x140001bf8
mov r8d, 0x104
lea rdx, [rbp + 0x150]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
xorps xmm0, xmm0
movups xmmword [rbp - 0x10], xmm0
mov qword [rbp], r15
mov qword [rbp + 8], r15
lea rax, [rbp + 0x150]
mov r8, 0xffffffffffffffff
inc r8
cmp byte [rax + r8], 0
jne 0x1400016e5
lea rdx, [rbp + 0x150]
lea rcx, [rbp - 0x10]
call fcn.140002da0
nop
lea rbx, [rbp - 0x10]
mov rsi, qword [rbp - 0x10]
mov r14, qword [rbp + 8]
cmp r14, 0xf
cmova rbx, rsi
mov rdi, qword [rbp]
test rdi, rdi
je 0x140001788
xor edx, edx
mov r8d, 0x100
lea rcx, [rbp + 0x50]
call sub.VCRUNTIME140.dll_memset
lea rcx, [0x14004e864]
lea rdx, [0x14004e866]
nop dword [rax]
movzx eax, byte [rcx]
mov byte [rbp + rax + 0x50], 1
inc rcx
cmp rcx, rdx
jne 0x140001740
lea rax, [rdi - 1]
mov r8, 0xffffffffffffffff
cmp rax, r8
cmovb r8, rax
add r8, rbx
movzx eax, byte [r8]
cmp byte [rbp + rax + 0x50], 0
jne 0x140001783
cmp r8, rbx
je 0x140001788
dec r8
movzx eax, byte [r8]
cmp byte [rbp + rax + 0x50], 0
je 0x140001770
sub r8, rbx
jmp 0x14000178f
mov r8, 0xffffffffffffffff
xorps xmm0, xmm0
movups xmmword [rbp + 0x10], xmm0
mov qword [rbp + 0x20], r15
mov qword [rbp + 0x28], r15
cmp rdi, r8
cmovb r8, rdi
lea rdx, [rbp - 0x10]
cmp r14, 0xf
cmova rdx, rsi
lea rcx, [rbp + 0x10]
call fcn.140002da0
nop
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
mov r13, qword [rbp + 0x20]
sub rax, r13
cmp rax, 0xd
jb 0x140001c78
lea r15, [rbp + 0x10]
mov rsi, qword [rbp + 0x10]
mov r12, qword [rbp + 0x28]
cmp r12, 0xf
cmova r15, rsi
xorps xmm0, xmm0
movups xmmword [rbp - 0x50], xmm0
xor eax, eax
mov qword [rbp - 0x40], rax
mov qword [rbp - 0x38], rax
lea r14, [r13 + 0xd]
mov ebx, 0xf
lea rdi, [rbp - 0x50]
movabs rdx, 0x8000000000000000
lea r8d, [rax + 0x16]
cmp r14, rbx
jbe 0x140001884
mov rbx, r14
or rbx, 0xf
cmp rbx, rcx
jbe 0x140001850
mov rbx, rcx
lea rax, [rdx + 0x27]
mov rcx, rax
call fcn.14004bfb0
test rax, rax
je 0x140001b4a
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x140001880
cmp rbx, r8
cmovb rbx, r8
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x140001873
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001c6c
jmp 0x140001831
test rcx, rcx
je 0x14000187d
call fcn.14004bfb0
mov rdi, rax
mov qword [rbp - 0x50], rdi
mov qword [rbp - 0x40], r14
mov qword [rbp - 0x38], rbx
mov r8, r13
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str.dependencies]
movsd qword [rdi + r13], xmm0
mov eax, dword [0x14004e870]
mov dword [rdi + r13 + 8], eax
movzx eax, byte [0x14004e874]
mov byte [rdi + r13 + 0xc], al
mov byte [rdi + r14], 0
lea rcx, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova rcx, qword [rbp - 0x50]
xor edx, edx
call qword [sym.imp.KERNEL32.dll_CreateDirectoryA]
test eax, eax
jne 0x140001903
call qword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x140001903
lea rdx, str.Unable_to_create_folder_._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002a40
jmp 0x140001b18
mov r14, qword [rbp - 0x40]
movabs rcx, 0x7fffffffffffffff
mov rax, rcx
sub rax, r14
cmp rax, 0xa
jb 0x140001c66
lea r12, [rbp - 0x50]
cmp qword [rbp - 0x38], 0xf
cmova r12, qword [rbp - 0x50]
xorps xmm0, xmm0
movups xmmword [rbp - 0x30], xmm0
xorps xmm1, xmm1
movdqu xmmword [rbp - 0x20], xmm1
lea r15, [r14 + 0xa]
mov ebx, 0xf
lea rdi, [rbp - 0x30]
cmp r15, rbx
jbe 0x1400019ca
mov rbx, r15
or rbx, 0xf
cmp rbx, rcx
jbe 0x14000198c
mov rbx, rcx
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14004bfb0
test rax, rax
je 0x140001af7
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400019c6
cmp rbx, 0x16
mov eax, 0x16
cmovb rbx, rax
lea rcx, [rbx + 1]
cmp rcx, 0x1000
jb 0x1400019b5
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x140001c72
jmp 0x14000196d
test rcx, rcx
je 0x1400019c4
call fcn.14004bfb0
mov rdi, rax
jmp 0x1400019c6
xor edi, edi
mov qword [rbp - 0x30], rdi
mov qword [rbp - 0x20], r15
mov qword [rbp - 0x18], rbx
mov r8, r14
mov rdx, r12
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
movsd xmm0, qword [str.Cheat.exe]
movsd qword [rdi + r14], xmm0
movzx eax, word [0x14004e8a0]
mov word [rdi + r14 + 8], ax
mov byte [rdi + r15], 0
lea r8, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova r8, qword [rbp - 0x30]
lea rdx, [rbp + 0x30]
cmp qword [rbp + 0x48], 0xf
cmova rdx, qword [rbp + 0x30]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
js 0x140001ab1
lea rdx, str.Downloaded_successfully_.._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.140002a40
xorps xmm0, xmm0
movups xmmword [rsp + 0x40], xmm0
movups xmmword [rsp + 0x50], xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
movups xmmword [rbp - 0x80], xmm0
movups xmmword [rbp - 0x70], xmm0
movups xmmword [rbp - 0x60], xmm0
mov dword [rsp + 0x40], 0x70
lea rax, str.runas
mov qword [rsp + 0x50], rax
lea rax, [rbp - 0x30]
cmp qword [rbp - 0x18], 0xf
cmova rax, qword [rbp - 0x30]
mov qword [rsp + 0x58], rax
mov dword [rsp + 0x70], 1
lea rcx, [rsp + 0x40]
call qword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
jne 0x140001ac5
lea rdx, str.Failed_to_run_horizon._n
jmp 0x140001ab8
lea rdx, str.Failed_to_download_horizon._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.140002a40
nop
mov rdx, qword [rbp - 0x18]
cmp rdx, 0xf
jbe 0x140001b03
inc rdx
mov rcx, qword [rbp - 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001afe
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001afe
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004bff4
movdqa xmm0, xmmword [0x14005ba00]
movdqu xmmword [rbp - 0x20], xmm0
mov byte [rbp - 0x30], 0
mov r12, qword [rbp + 0x28]
mov rdx, qword [rbp - 0x38]
cmp rdx, 0xf
jbe 0x140001b56
inc rdx
mov rcx, qword [rbp - 0x50]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001b51
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001b51
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004bff4
mov qword [rbp - 0x40], 0
mov qword [rbp - 0x38], 0xf
mov byte [rbp - 0x50], 0
cmp r12, 0xf
jbe 0x140001ba6
lea rdx, [r12 + 1]
mov rax, rsi
cmp rdx, 0x1000
jb 0x140001b9d
add rdx, 0x27
mov rsi, qword [rsi - 8]
sub rax, rsi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001b9d
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rsi
call fcn.14004bff4
nop
mov rdx, qword [rbp + 8]
cmp rdx, 0xf
jbe 0x140001be4
inc rdx
mov rcx, qword [rbp - 0x10]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001bdf
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001bdf
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004bff4
mov qword [rbp], 0
mov qword [rbp + 8], 0xf
mov byte [rbp - 0x10], 0
mov rdx, qword [rbp + 0x48]
cmp rdx, 0xf
jbe 0x140001c36
inc rdx
mov rcx, qword [rbp + 0x30]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001c31
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001c31
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.14004bff4
mov rcx, qword [rbp + 0x260]
xor rcx, rsp
call fcn.14004bf90
lea r11, [rsp + 0x370]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret
call fcn.1400011a0
nop
call fcn.140001100
nop
call fcn.140001100
nop
call fcn.1400011a0
int3