Function at 0x140050fa0
Capabilities:
Delete file
Send data

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r13
push r14
push r15
lea rbp, [rsp - 0x398]
sub rsp, 0x498
mov rax, qword [0x1402fa010]
xor rax, rsp
mov qword [rbp + 0x380], rax
mov rdi, r9
mov qword [rsp + 0x40], r9
mov r13, r8
mov r12, rdx
mov r14, rcx
mov qword [rsp + 0x50], rcx
mov qword [rsp + 0x60], rdx
mov qword [rsp + 0x68], r8
mov qword [rsp + 0x70], r9
mov r15, qword [rbp + 0x400]
mov qword [rsp + 0x48], r15
mov qword [rsp + 0x78], r15
mov rbx, qword [rbp + 0x408]
mov qword [rbp - 0x48], rbx
mov qword [rbp - 0x80], rbx
xor eax, eax
cmp dword [0x140306104], eax
je 0x1400510e2
mov rdx, qword [rdx]
sub rdx, 0x18
mov rsi, 0xffffffffffffffff
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x14005104b
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [r13]
sub rdx, 0x18
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140051070
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [rdi]
sub rdx, 0x18
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140051094
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [r15]
sub rdx, 0x18
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400510b8
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [rbx]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140051afb
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
jmp 0x140051afb
mov qword [rbp - 0x50], rax
lea rcx, [rbp - 0x50]
call fcn.140050eb0
nop
mov rbx, qword [rbp - 0x50]
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
movups xmmword [rbp - 0x30], xmm0
movups xmmword [rbp - 0x20], xmm0
movups xmmword [rbp - 0x10], xmm0
lea rax, vtable.XWriteStream.0
mov qword [rbp - 0x40], rax
lea rax, vtable.XFileWriteStream.0
mov qword [rbp - 0x40], rax
xor eax, eax
mov dword [rbp - 8], eax
mov rsi, 0xffffffffffffffff
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x28], rax
mov qword [rbp - 0x20], rax
mov dword [rbp - 0x18], eax
mov qword [rbp - 0x10], rax
mov ecx, 0x2000
call fcn.140203268
mov qword [rbp - 0x30], rax
mov rdx, rbx
lea rcx, [rbp - 0x40]
call fcn.14004ae20
test eax, eax
jne 0x1400511ea
lea rax, vtable.XFileWriteStream.0
mov qword [rbp - 0x40], rax
mov rdi, qword [rbp - 0x30]
mov rbx, qword [rbp - 0x38]
cmp rbx, rsi
je 0x14005118e
mov r8, qword [rbp - 0x28]
test r8, r8
je 0x14005118e
mov rdx, rdi
mov rcx, rbx
call fcn.14004b160
test eax, eax
je 0x140051197
xor r14d, r14d
mov qword [rbp - 0x28], r14
jmp 0x14005119a
xor r14d, r14d
cmp dword [rbp - 0x18], 0
je 0x1400511af
cmp rbx, 0xffffffffffffffff
je 0x1400511af
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x20], r14
mov dword [rbp - 0x18], r14d
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x1400511cd
call fcn.140203254
mov qword [rbp - 0x10], r14
mov rcx, rdi
call fcn.140203254
nop
lea rax, vtable.XWriteStream.0
mov qword [rbp - 0x40], rax
jmp 0x140051389
call qword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [rbp - 0x60], eax
mov qword [rbp - 0x5c], r14
xor r14d, r14d
mov dword [rbp - 0x54], r14d
call fcn.14004f070
mov r15, rax
mov dword [rbp], r14d
cmp byte [rax + 1], r14b
jne 0x140051299
lea rax, vtable.XFileWriteStream.0
mov qword [rbp - 0x40], rax
mov rdi, qword [rbp - 0x30]
mov rbx, qword [rbp - 0x38]
cmp rbx, 0xffffffffffffffff
je 0x140051245
mov r8, qword [rbp - 0x28]
test r8, r8
je 0x140051245
mov rdx, rdi
mov rcx, rbx
call fcn.14004b160
test eax, eax
je 0x140051249
mov qword [rbp - 0x28], r14
cmp dword [rbp - 0x18], 0
je 0x14005125e
cmp rbx, 0xffffffffffffffff
je 0x14005125e
mov rcx, rbx
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x38], rsi
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x20], r14
mov dword [rbp - 0x18], r14d
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x14005127c
call fcn.140203254
mov qword [rbp - 0x10], r14
mov rcx, rdi
call fcn.140203254
nop
lea rax, vtable.XWriteStream.0
mov qword [rbp - 0x40], rax
jmp 0x140051384
mov r14, qword [rbp - 0x38]
cmp qword [rax + 0x58], 0
je 0x1400512f6
lea rdi, [rbp - 0x60]
cmp qword [rsp + 0x50], 0
mov eax, 0
cmove rdi, rax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ebx, eax
call qword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov rcx, rax
xor eax, eax
mov qword [rsp + 0x30], rax
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], rdi
lea r9d, [rax + 0x55]
mov r8, r14
mov edx, ebx
mov rax, qword [r15 + 0x58]
call qword [case.0x140038716.0]
mov r15d, eax
mov rdi, qword [rsp + 0x40]
jmp 0x1400512fa
mov r15d, dword [rbp]
lea rax, vtable.XFileWriteStream.0
mov qword [rbp - 0x40], rax
mov rbx, qword [rbp - 0x30]
cmp r14, 0xffffffffffffffff
je 0x140051327
mov r8, qword [rbp - 0x28]
test r8, r8
je 0x140051327
mov rdx, rbx
mov rcx, r14
call fcn.14004b160
test eax, eax
je 0x14005132d
xor eax, eax
mov qword [rbp - 0x28], rax
cmp dword [rbp - 0x18], 0
je 0x140051342
cmp r14, 0xffffffffffffffff
je 0x140051342
mov rcx, r14
call qword [sym.imp.KERNEL32.dll_CloseHandle]
mov qword [rbp - 0x38], rsi
xor r14d, r14d
mov qword [rbp - 0x28], r14
mov qword [rbp - 0x20], r14
mov dword [rbp - 0x18], r14d
mov rcx, qword [rbp - 0x10]
test rcx, rcx
je 0x140051363
call fcn.140203254
mov qword [rbp - 0x10], r14
mov rcx, rbx
call fcn.140203254
nop
lea r14, vtable.XWriteStream.0
mov qword [rbp - 0x40], r14
test r15d, r15d
jne 0x140051471
mov r15, qword [rsp + 0x48]
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400513ae
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [r12]
sub rdx, 0x18
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400513d3
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [r13]
sub rdx, 0x18
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400513f8
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [rsp + 0x40]
mov rdx, qword [rdx]
sub rdx, 0x18
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140051421
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rdx, qword [r15]
sub rdx, 0x18
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140051445
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov r15, qword [rbp - 0x48]
mov rdx, qword [r15]
sub rdx, 0x18
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x14005146a
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
xor eax, eax
jmp 0x140051b00
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp - 0x78], xmm0
mov qword [rbp - 0x68], rax
xor ebx, ebx
mov qword [rbp - 0x78], rbx
mov qword [rbp - 0x68], rbx
mov qword [rbp - 0x70], rbx
lea rax, [rsp + 0x40]
mov qword [rsp + 0x50], rax
mov rcx, qword [rbp - 0x50]
add rcx, 0xffffffffffffffe8
call fcn.1400191a0
add rax, 0x18
mov qword [rsp + 0x40], rax
lea rdx, [rbp - 0x78]
lea rcx, [rsp + 0x40]
call fcn.14004ec90
test eax, eax
jne 0x1400514d2
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x1400514cd
call fcn.140203254
nop
jmp 0x1400515cc
mov rcx, qword [rbp - 0x50]
call qword [sym.imp.KERNEL32.dll_DeleteFileW]
xor edx, edx
mov r8d, 0xf8
lea rcx, [rbp + 0x280]
call fcn.1401f6840
lea rcx, [rbp + 0x280]
call fcn.14005c840
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 8], xmm0
movups xmmword [rbp + 0x18], xmm0
movups xmmword [rbp + 0x28], xmm0
mov qword [rbp + 0x38], rax
mov qword [rbp + 8], r14
lea r15, vtable.XMemoryWriteStream.0
mov qword [rbp + 8], r15
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rbx
mov dword [rbp + 0x30], ebx
mov qword [rbp + 0x38], 0x6400000
mov rdx, qword [r12]
lea rcx, [rbp + 0x280]
call fcn.14005ca60
test eax, eax
jne 0x140051625
mov qword [rbp + 8], r15
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rbx
mov dword [rbp + 0x30], ebx
mov qword [rbp + 8], r14
lea rcx, [rbp + 0x280]
call fcn.14005c970
nop
lea rax, [rbp + 0x360]
mov qword [rsp + 0x50], rax
mov rdx, qword [rbp + 0x360]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400515b0
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
lea rcx, [rbp + 0x310]
call fcn.14005b7f0
nop
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x1400515cc
call fcn.140203254
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x1400515ef
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rcx, r12
call fcn.1400192d0
nop
mov rcx, r13
call fcn.1400192d0
nop
mov rcx, rdi
call fcn.1400192d0
nop
mov rcx, qword [rsp + 0x48]
call fcn.1400192d0
nop
mov rcx, qword [rbp - 0x48]
call fcn.1400192d0
xor eax, eax
jmp 0x140051b00
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x1f0], xmm0
movups xmmword [rbp + 0x200], xmm0
movups xmmword [rbp + 0x210], xmm0
movups xmmword [rbp + 0x220], xmm0
movups xmmword [rbp + 0x230], xmm0
movups xmmword [rbp + 0x240], xmm0
movups xmmword [rbp + 0x250], xmm0
movups xmmword [rbp + 0x260], xmm0
mov qword [rbp + 0x270], rax
lea rax, [rbp + 0x1f8]
mov qword [rbp + 0x1f0], rax
mov r8d, 3
mov rdx, qword [rdi]
lea rcx, [rbp + 0x1f0]
call fcn.14002e0e0
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x160], xmm0
movups xmmword [rbp + 0x170], xmm0
movups xmmword [rbp + 0x180], xmm0
movups xmmword [rbp + 0x190], xmm0
movups xmmword [rbp + 0x1a0], xmm0
movups xmmword [rbp + 0x1b0], xmm0
movups xmmword [rbp + 0x1c0], xmm0
movups xmmword [rbp + 0x1d0], xmm0
mov qword [rbp + 0x1e0], rax
lea rax, [rbp + 0x168]
mov qword [rbp + 0x160], rax
mov r8d, 3
mov r14, qword [rsp + 0x48]
mov rdx, qword [r14]
lea rcx, [rbp + 0x160]
call fcn.14002e0e0
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0xd0], xmm0
movups xmmword [rbp + 0xe0], xmm0
movups xmmword [rbp + 0xf0], xmm0
movups xmmword [rbp + 0x100], xmm0
movups xmmword [rbp + 0x110], xmm0
movups xmmword [rbp + 0x120], xmm0
movups xmmword [rbp + 0x130], xmm0
movups xmmword [rbp + 0x140], xmm0
mov qword [rbp + 0x150], rax
lea rax, [rbp + 0xd8]
mov qword [rbp + 0xd0], rax
mov r8d, 3
mov r15, qword [rbp - 0x48]
mov rdx, qword [r15]
lea rcx, [rbp + 0xd0]
call fcn.14002e0e0
nop
xorps xmm0, xmm0
xor eax, eax
movups xmmword [rbp + 0x40], xmm0
movups xmmword [rbp + 0x50], xmm0
movups xmmword [rbp + 0x60], xmm0
movups xmmword [rbp + 0x70], xmm0
movups xmmword [rbp + 0x80], xmm0
movups xmmword [rbp + 0x90], xmm0
movups xmmword [rbp + 0xa0], xmm0
movups xmmword [rbp + 0xb0], xmm0
mov qword [rbp + 0xc0], rax
lea rax, [rbp + 0x48]
mov qword [rbp + 0x40], rax
mov r8d, 3
mov rdx, qword [r13]
lea rcx, [rbp + 0x40]
call fcn.14002e0e0
nop
mov r9, qword [rbp + 0x40]
mov rax, rsi
inc rax
cmp byte [r9 + rax], 0
jne 0x1400517c1
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
lea r8, str.name
lea rdx, [rbp + 8]
call fcn.14005d0e0
mov r9, qword [rbp + 0x1f0]
mov rax, rsi
nop
inc rax
cmp byte [r9 + rax], 0
jne 0x1400517f0
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
lea r8, str.version
lea rdx, [rbp + 8]
call fcn.14005d0e0
mov r9, qword [rbp + 0x160]
mov rax, rsi
nop dword [rax]
inc rax
cmp byte [r9 + rax], 0
jne 0x140051820
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
lea r8, str.buildDate
lea rdx, [rbp + 8]
call fcn.14005d0e0
mov r9, qword [rbp + 0xd0]
mov rax, rsi
nop dword [rax]
inc rax
cmp byte [r9 + rax], 0
jne 0x140051850
mov qword [rsp + 0x28], rbx
mov dword [rsp + 0x20], eax
lea r8, str.param
lea rdx, [rbp + 8]
call fcn.14005d0e0
lea rax, str.dump.dmp.gz
mov qword [rsp + 0x28], rax
mov eax, dword [rbp - 0x70]
mov dword [rsp + 0x20], eax
mov r9, qword [rbp - 0x78]
lea r8, str.user_file
lea rdx, [rbp + 8]
call fcn.14005d0e0
mov r8d, 2
lea rdx, [0x140294484]
lea rcx, [rbp + 8]
call fcn.14004b060
lea rcx, str.__XHTTP_BOUNDARY_2848588jklJKL
call qword [sym.imp.KERNEL32.dll_lstrlenA]
movsxd r8, eax
lea rdx, str.__XHTTP_BOUNDARY_2848588jklJKL
lea rcx, [rbp + 8]
call fcn.14004b060
mov r8d, 2
lea rdx, [0x140294484]
lea rcx, [rbp + 8]
call fcn.14004b060
mov edx, dword [rbp + 0x20]
lea rcx, [rbp + 0x280]
call fcn.14005d4d0
lea r9, [rbp]
mov r8d, dword [rbp + 0x20]
mov rdx, qword [rbp + 0x10]
mov rcx, qword [rbp + 0x298]
call qword [sym.imp.WININET.dll_InternetWriteFile]
xor ebx, ebx
test eax, eax
jne 0x140051925
mov qword [rbp + 0x280], rbx
mov dword [rbp + 0x280], 0xbad70024
xor r9d, r9d
xor edx, edx
lea r8d, [r9 + 8]
mov rcx, qword [rbp + 0x298]
call qword [sym.imp.WININET.dll_HttpEndRequestW]
test eax, eax
jne 0x140051954
mov qword [rbp + 0x280], 0
mov dword [rbp + 0x280], 0xbad70025
mov qword [rbp - 0x48], rbx
call fcn.1400195b0
mov rcx, rax
test rax, rax
je 0x140051b23
mov rax, qword [rax]
mov rax, qword [rax + 0x18]
call qword [case.0x140038716.0]
add rax, 0x18
mov qword [rbp - 0x48], rax
lea rdx, [rbp - 0x48]
lea rcx, [rbp + 0x280]
call fcn.14005d9c0
nop
mov rdx, qword [rbp - 0x48]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x1400519b4
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
lea rax, [rbp + 0x48]
mov rcx, qword [rbp + 0x40]
cmp rcx, rax
je 0x1400519c7
call fcn.140203254
nop
lea rax, [rbp + 0xd8]
mov rcx, qword [rbp + 0xd0]
cmp rcx, rax
je 0x1400519e0
call fcn.140203254
nop
lea rax, [rbp + 0x168]
mov rcx, qword [rbp + 0x160]
cmp rcx, rax
je 0x1400519f9
call fcn.140203254
nop
lea rax, [rbp + 0x1f8]
mov rcx, qword [rbp + 0x1f0]
cmp rcx, rax
je 0x140051a12
call fcn.140203254
nop
lea rax, vtable.XMemoryWriteStream.0
mov qword [rbp + 8], rax
mov rcx, qword [rbp + 0x10]
test rcx, rcx
je 0x140051a31
cmp dword [rbp + 0x30], 0
je 0x140051a31
call fcn.140203254
mov qword [rbp + 0x10], rbx
mov qword [rbp + 0x18], rbx
mov qword [rbp + 0x20], rbx
mov qword [rbp + 0x28], rbx
mov dword [rbp + 0x30], ebx
lea rax, vtable.XWriteStream.0
mov qword [rbp + 8], rax
lea rcx, [rbp + 0x280]
call fcn.14005c970
nop
lea rax, [rbp + 0x360]
mov qword [rsp + 0x50], rax
mov rdx, qword [rbp + 0x360]
add rdx, 0xffffffffffffffe8
mov eax, esi
lock xadd dword [rdx + 0x10], eax
sub eax, 1
jg 0x140051a90
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
lea rcx, [rbp + 0x310]
call fcn.14005b7f0
nop
mov rcx, qword [rbp - 0x78]
test rcx, rcx
je 0x140051aac
call fcn.140203254
nop
mov rdx, qword [rbp - 0x50]
add rdx, 0xffffffffffffffe8
lock xadd dword [rdx + 0x10], esi
sub esi, 1
jg 0x140051acf
mov rcx, qword [rdx]
mov rax, qword [rcx]
mov rax, qword [rax + 8]
call qword [case.0x140038716.0]
nop
mov rcx, r12
call fcn.1400192d0
nop
mov rcx, r13
call fcn.1400192d0
nop
mov rcx, rdi
call fcn.1400192d0
nop
mov rcx, r14
call fcn.1400192d0
nop
mov rcx, r15
call fcn.1400192d0
mov eax, 1
mov rcx, qword [rbp + 0x380]
xor rcx, rsp
call fcn.1401f3bf0
add rsp, 0x498
pop r15
pop r14
pop r13
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
mov ecx, 0x80004005
call fcn.140019320
int3