Function at 0x14007b630
Capabilities:
Accept command line arguments
Create http request
Create process on windows
Get common file path
Parse pe header
Read data from internet
Read file on windows
Receive data
Resume thread

Disassembly:
push rbp
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x1530]
mov eax, 0x1630
call fcn.14010d1a0
sub rsp, rax
mov qword [rbp - 0x50], 0xfffffffffffffffe
mov qword [rsp + 0x1680], rbx
mov rax, qword [0x1402ba4e0]
xor rax, rsp
mov qword [rbp + 0x1520], rax
mov rbx, r8
mov r14, rdx
mov r13, rcx
call fcn.14007b2a0
mov r11, qword [0x1402b9cc8]
mov qword [rsp + 0x60], r11
lea rdx, [0x14024d112]
lea rcx, [rsp + 0x60]
call fcn.1400ca6a0
xor r8d, r8d
mov edx, 0xe00b
lea rcx, [rsp + 0x60]
call fcn.1400cc060
nop
xor r15d, r15d
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
xor edx, edx
mov rcx, qword [rsp + 0x60]
call qword [sym.imp.WININET.dll_InternetOpenA]
mov r12, rax
test rax, rax
jne 0x14007b6e6
lea rcx, [rsp + 0x60]
call fcn.1400ca400
lea eax, [r15 + 4]
jmp 0x14007bd4c
mov byte [rbp + 0x90], r15b
xor eax, eax
mov qword [rbp + 0x91], rax
mov qword [rbp + 0x99], rax
mov qword [rbp + 0xa1], rax
mov qword [rbp + 0xa9], rax
mov qword [rbp + 0xb1], rax
mov qword [rbp + 0xb9], rax
mov qword [rbp + 0xc1], rax
mov qword [rbp + 0xc9], rax
mov qword [rbp + 0xd1], rax
mov dword [rbp + 0xd9], eax
mov word [rbp + 0xdd], ax
mov byte [rbp + 0xdf], al
mov qword [rsp + 0x28], r15
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
lea rdx, [0x1402bf660]
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetOpenUrlA]
mov rsi, rax
mov ecx, r15d
mov dword [rsp + 0x70], ecx
nop dword [rax + rax]
mov r8d, 0x4f
sub r8d, ecx
lea rdx, [rbp + rcx + 0x90]
lea r9, [rsp + 0x70]
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetReadFile]
mov edi, eax
test eax, eax
je 0x14007b79d
mov ecx, dword [rsp + 0x70]
test ecx, ecx
jne 0x14007b770
mov rcx, rsi
call qword [sym.imp.WININET.dll_InternetCloseHandle]
mov rcx, r12
call qword [sym.imp.WININET.dll_InternetCloseHandle]
test edi, edi
jne 0x14007b7c5
lea rcx, [rsp + 0x60]
call fcn.1400ca400
lea eax, [rdi + 4]
jmp 0x14007bd4c
lea r9, [rsp + 0x58]
lea r8, [rsp + 0x68]
lea rdx, [rsp + 0x50]
lea rcx, [rbp + 0x90]
call fcn.14007b120
mov esi, dword [rsp + 0x58]
lea eax, [rsi - 0x2fbc]
mov edi, r15d
test eax, eax
jle 0x14007bd3b
call fcn.14007b3b0
mov dword [rsp + 0x58], eax
lea rax, [rbp + 0xe0]
mov qword [rbp - 0x80], rax
mov qword [rbp - 0x78], 0x104
movaps xmm0, xmmword [rbp - 0x80]
movdqa xmmword [rbp - 0x80], xmm0
mov edx, esi
lea rcx, [rbp - 0x80]
call fcn.14007b140
mov r11, qword [0x1402b9cc8]
mov qword [rsp + 0x68], r11
lea rdx, [0x14024d112]
lea rcx, [rsp + 0x68]
call fcn.1400ca6a0
xor r8d, r8d
mov edx, 0xe00c
lea rcx, [rsp + 0x68]
call fcn.1400cc060
nop
mov rax, qword [0x1402b9cc8]
mov qword [rsp + 0x50], rax
cmp dword [rsp + 0x58], 0
je 0x14007b8d1
lea rdx, [0x14024d112]
lea rcx, [rsp + 0x50]
call fcn.1400ca6a0
xor r8d, r8d
mov edx, 0x88
lea rcx, [rsp + 0x50]
call fcn.1400cc060
nop
mov eax, dword [rsp + 0x58]
pxor xmm1, xmm1
cvtsi2sd xmm1, rax
mulsd xmm1, qword [0x14021e768]
mulsd xmm1, qword [0x14021e768]
movsd qword [rsp + 0x28], xmm1
mov dword [rsp + 0x20], esi
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x50]
mov edx, 0x104
lea rcx, [rbp + 0x410]
call fcn.140110058
nop
jmp 0x14007b915
lea rdx, [0x14024d112]
lea rcx, [rsp + 0x50]
call fcn.1400ca6a0
xor r8d, r8d
mov edx, 0x89
lea rcx, [rsp + 0x50]
call fcn.1400cc060
nop
mov dword [rsp + 0x20], esi
mov r9, qword [rsp + 0x68]
mov r8, qword [rsp + 0x50]
mov edx, 0x104
lea rcx, [rbp + 0x410]
call fcn.140110058
nop
lea rcx, [rsp + 0x50]
call fcn.1400ca400
mov rax, qword [0x1402b9cc8]
mov qword [rsp + 0x78], rax
lea rdx, [0x14024d112]
lea rcx, [rsp + 0x78]
call fcn.1400ca6a0
xor r8d, r8d
mov edx, 0x8a
lea rcx, [rsp + 0x78]
call fcn.1400cc060
nop
call qword [sym.imp.USER32.dll_GetForegroundWindow]
mov r9, rax
mov r8, r13
lea rdx, [rbp + 0x410]
lea rcx, [rbp - 0x40]
call fcn.14007f980
nop
xor r8d, r8d
lea rdx, [0x1402c0528]
lea rcx, [rbp - 0x40]
call fcn.1400ce980
cmp eax, 2
jne 0x14007b9c9
lea rcx, [rbp + 0x10]
call fcn.1400ca400
nop
lea rcx, [rbp + 8]
call fcn.1400ca400
nop
lea rcx, [rbp - 0x40]
call fcn.1400ce4b0
nop
lea rcx, [rsp + 0x78]
call fcn.1400ca400
nop
lea rcx, [rsp + 0x68]
call fcn.1400ca400
nop
lea rcx, [rsp + 0x60]
call fcn.1400ca400
xor eax, eax
jmp 0x14007bd4c
lea rax, [rsp + 0x58]
cmp dword [rsp + 0x58], 0
cmove rax, r15
mov dword [rsp + 0x28], 1
mov qword [rsp + 0x20], rax
mov r9d, 1
mov r8d, r9d
lea rdx, [rbp + 0xe0]
lea rcx, [0x1402bf550]
call fcn.14000de90
mov esi, eax
test eax, eax
je 0x14007ba1a
mov edi, r15d
cmp eax, 0x4c7
setne dil
add edi, 2
jmp 0x14007baac
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], r15d
mov dword [rsp + 0x20], 3
xor r9d, r9d
xor r8d, r8d
mov edx, 0x80000000
lea rcx, [rbp + 0xe0]
call qword [sym.imp.KERNEL32.dll_CreateFileA]
mov r12, rax
cmp rax, 0xffffffffffffffff
je 0x14007bae4
mov qword [rsp + 0x20], r15
lea r9, [rsp + 0x50]
mov r8d, 0x1000
lea rdx, [rbp + 0x520]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_ReadFile]
mov r11d, 0x5a4d
cmp word [rbp + 0x520], r11w
jne 0x14007ba95
movsxd rax, dword [rbp + 0x55c]
cmp dword [rbp + rax + 0x520], 0x4550
je 0x14007ba9f
mov edi, 3
mov esi, 0x4c7
mov rcx, r12
call qword [sym.imp.KERNEL32.dll_CloseHandle]
test esi, esi
je 0x14007bae4
lea rcx, [rbp + 0x10]
call fcn.1400ca400
nop
lea rcx, [rbp + 8]
call fcn.1400ca400
nop
lea rcx, [rbp - 0x40]
call fcn.1400ce4b0
nop
lea rcx, [rsp + 0x78]
call fcn.1400ca400
nop
lea rcx, [rsp + 0x68]
call fcn.1400ca400
jmp 0x14007bd40
lea rdx, [rbp + 0x1f0]
mov ecx, 0x104
call qword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
call qword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov rsi, rax
cmp byte [rax], 0x22
jne 0x14007bb21
lea rcx, [rax + 1]
lea rdx, [0x1401eb504]
call fcn.14010d30c
mov rdi, rax
test rax, rax
je 0x14007bb38
inc rdi
jmp 0x14007bb33
lea rdx, [0x1401eb500]
mov rcx, rax
call fcn.14010d30c
mov rdi, rax
test rdi, rdi
jne 0x14007bb3b
mov rdi, rsi
cmp byte [rdi], 0x20
jne 0x14007bb43
inc rdi
test rbx, rbx
je 0x14007bb6f
cmp byte [rbx], 0
je 0x14007bb6f
lea rcx, [rbp + 0x300]
sub rcx, rbx
nop word [rax + rax]
movzx eax, byte [rbx]
mov byte [rcx + rbx], al
inc rbx
test al, al
jne 0x14007bb60
jmp 0x14007bb84
mov r8d, 0x104
lea rdx, [rbp + 0x300]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
mov edx, 0x5c
lea rcx, [rbp + 0x300]
call fcn.14010db4c
test rax, rax
je 0x14007bb9e
mov byte [rax + 1], 0
mov rax, qword [0x1402b9cc8]
mov qword [rsp + 0x50], rax
lea rdx, [rbp + 0xe0]
lea rcx, [rsp + 0x50]
call fcn.1400ca6a0
lea rdx, [0x14021e760]
lea rcx, [rsp + 0x50]
call fcn.1400ca830
lea rdx, [rbp + 0x300]
lea rcx, [rsp + 0x50]
call fcn.1400ca830
cmp byte [rdi], 0
je 0x14007bbfb
mov dl, 0x20
lea rcx, [rsp + 0x50]
call fcn.1400ca870
mov rdx, rdi
lea rcx, [rsp + 0x50]
call fcn.1400ca830
xor edx, edx
lea r8d, [rdx + 0x68]
lea rcx, [rbp + 0x20]
call fcn.14010da60
xor r11d, r11d
mov qword [rbp - 0x68], r11
mov qword [rbp - 0x60], r11
mov qword [rbp - 0x58], r11
lea rax, [rbp - 0x68]
mov qword [rsp + 0x48], rax
lea rax, [rbp + 0x20]
mov qword [rsp + 0x40], rax
lea rax, [rbp + 0x1f0]
mov qword [rsp + 0x38], rax
mov qword [rsp + 0x30], r15
mov dword [rsp + 0x28], 0x24
mov dword [rsp + 0x20], r15d
xor r9d, r9d
xor r8d, r8d
mov rdx, qword [rsp + 0x50]
xor ecx, ecx
call qword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x14007bd04
mov rax, qword [0x1402b9cc8]
mov qword [rbp - 0x80], rax
lea rdx, [0x14024d112]
lea rcx, [rbp - 0x80]
call fcn.1400ca6a0
xor r8d, r8d
mov edx, 0x8b
lea rcx, [rbp - 0x80]
call fcn.1400cc060
nop
lea r8, [rbp + 0xe0]
mov rdx, qword [rbp - 0x80]
lea rcx, [rbp + 0x1f0]
call fcn.14010d754
mov r11, qword [0x1402b9cc8]
mov qword [rbp - 0x70], r11
lea rdx, [0x14024d112]
lea rcx, [rbp - 0x70]
call fcn.1400ca6a0
xor r8d, r8d
mov edx, 0x8f
lea rcx, [rbp - 0x70]
call fcn.1400cc060
nop
mov r9d, 0x40
mov r8, qword [rbp - 0x70]
lea rdx, [rbp + 0x1f0]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxA]
nop
lea rcx, [rbp - 0x70]
call fcn.1400ca400
nop
lea rcx, [rbp - 0x80]
call fcn.1400ca400
jmp 0x14007bd30
mov rcx, qword [0x1402bfb28]
test rcx, rcx
je 0x14007bd1d
call qword [sym.imp.KERNEL32.dll_FreeLibrary]
mov qword [0x1402bfb28], r15
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rcx, qword [rbp - 0x60]
call qword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, 1
call fcn.140111cc8
nop
mov edi, 1
lea rcx, [rsp + 0x60]
call fcn.1400ca400
mov eax, edi
mov rcx, qword [rbp + 0x1520]
xor rcx, rsp
call fcn.14010d170
mov rbx, qword [rsp + 0x1680]
add rsp, 0x1630
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbp
ret