Function at 0x1400aef30
Capabilities:
Create process on windows
Self delete
Terminate process

Disassembly:
push rbp
push rbx
push rsi
push rdi
push r12
push r14
push r15
lea rbp, [rsp - 0xab0]
sub rsp, 0xbb0
xor r12d, r12d
movabs r14, 0x7fffffffffffffff
mov rax, r14
mov rcx, qword [reloc.WS2_32.dll_connect]
sub rax, rcx
cmp rax, 0x1a
jb 0x1400af983
lea rax, str.Miel
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rax, qword [str.Miel]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x1a
lea r9, str.http:__144.22.50.88_addys_
lea r8, str.Miel
movzx edx, byte [rbp + 0xaf0]
lea rcx, [rbp - 0x80]
call fcn.140055090
nop
mov r8d, 4
lea rdx, str..txt
lea rcx, [rbp - 0x80]
call fcn.14004d550
xorps xmm0, xmm0
movups xmmword [rsp + 0x60], xmm0
xorps xmm1, xmm1
movdqu xmmword [rsp + 0x70], xmm1
movups xmm0, xmmword [rax]
movups xmmword [rsp + 0x60], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rsp + 0x70], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], r12b
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.1400b2170
lea rax, vtable.cpr::Url.0
mov qword [rbp - 0x20], rax
lea rcx, [rbp + 0x7f0]
call fcn.140167af0
nop
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x7f0]
call fcn.1401688e0
lea rdx, [rbp + 0x2b0]
lea rcx, [rbp + 0x7f0]
call fcn.140168320
nop
lea rcx, [rbp + 0x7f0]
call fcn.1400b35e0
nop
lea rcx, [rbp - 0x18]
call fcn.14004d380
nop
lea r9, [fcn.14004d300]
mov edx, 0x20
mov r8d, 1
lea rcx, [rsp + 0x60]
call fcn.14016d354
nop
lea rcx, [rbp - 0x80]
call fcn.14004d380
xorps xmm0, xmm0
movups xmmword [rbp - 0x60], xmm0
mov qword [rbp - 0x50], r12
mov qword [rbp - 0x48], r12
mov rsi, qword [rbp + 0x2d8]
lea r15, [rbp + 0x2c8]
cmp qword [rbp + 0x2e0], 0xf
cmova r15, qword [rbp + 0x2c8]
cmp rsi, r14
ja 0x1400af989
cmp rsi, 0xf
ja 0x1400af0fe
mov qword [rbp - 0x50], rsi
mov ebx, reloc.WS2_32.dll_ntohs
mov qword [rbp - 0x48], rbx
movups xmm0, xmmword [r15]
movups xmmword [rbp - 0x60], xmm0
movq rdi, xmm0
jmp 0x1400af190
mov rbx, rsi
or rbx, 0xf
cmp rbx, r14
jbe 0x1400af13a
mov rbx, r14
movabs rax, 0x8000000000000000
add rax, 0x27
mov rcx, rax
call fcn.14016d318
test rax, rax
je 0x1400af949
lea rdi, [rax + 0x27]
and rdi, 0xffffffffffffffe0
mov qword [rdi - 8], rax
jmp 0x1400af174
mov eax, reloc.WS2_32.dll_shutdown
cmp rbx, rax
cmovb rbx, rax
lea rcx, [rbx + 1]
test rcx, rcx
jne 0x1400af154
mov rdi, r12
jmp 0x1400af174
cmp rcx, 0x1000
jb 0x1400af16c
lea rax, [rcx + 0x27]
cmp rax, rcx
jbe 0x1400af97d
jmp 0x1400af11b
call fcn.14016d318
mov rdi, rax
mov qword [rbp - 0x60], rdi
mov qword [rbp - 0x50], rsi
mov qword [rbp - 0x48], rbx
lea r8, [rsi + 1]
mov rdx, r15
mov rcx, rdi
call sub.VCRUNTIME140.dll_memcpy
nop
cmp dword [rbp + 0x2c0], 0xc8
je 0x1400af1dd
lea rdx, str.Failed_to_connect_to_the_server._Closing_application..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14009dc00
mov dword [rbp + 0xaf0], 3
lea rdx, [rbp + 0xaf0]
lea rcx, [rbp + 0xaf8]
call fcn.140064230
mov rcx, rax
call fcn.14006ebc0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
mov r15, qword [reloc.WS2_32.dll_closesocket]
lea rdx, [0x1402757b0]
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rdx, qword [0x1402757b0]
lea rcx, [rbp - 0x60]
cmp rbx, 0xf
cmova rcx, rdi
mov r8, rsi
cmp r15, rsi
cmovb r8, r15
call sub.VCRUNTIME140.dll_memcmp
test eax, eax
je 0x1400af282
jns 0x1400af28d
mov al, 0xff
test al, al
jle 0x1400af91e
lea rdx, str.Your_version_is_outdated__n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14009dc00
lea rcx, [rbp + 0xaf0]
call fcn.140063b30
mov rax, qword [rbp + 0xaf0]
mov qword [rbp + 0xaf0], rax
movabs rbx, 0x7ffffffff1194d7f
mov edi, 0xff
cmp rax, rbx
je 0x1400af291
mov ecx, 1
cmovl ecx, edi
test cl, cl
jns 0x1400af291
add rax, 0xee6b280
mov qword [rbp + 0xaf0], rax
jmp 0x1400af298
cmp rsi, r15
jb 0x1400af21c
jbe 0x1400af91e
mov al, 1
jmp 0x1400af21e
mov qword [rbp + 0xaf0], r14
lea rcx, [rbp + 0xaf0]
call fcn.140071de0
lea rdx, str.Checking_for_available_updates..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14009dc00
lea rcx, [rbp + 0xaf0]
call fcn.140063b30
mov rax, qword [rbp + 0xaf0]
cmp rax, rbx
je 0x1400af2ea
mov ecx, 1
cmovl ecx, edi
test cl, cl
jns 0x1400af2ea
add rax, 0xee6b280
mov qword [rbp + 0xaf0], rax
jmp 0x1400af2f1
mov qword [rbp + 0xaf0], r14
lea rcx, [rbp + 0xaf0]
call fcn.140071de0
mov rcx, qword [reloc.WS2_32.dll_connect]
sub r14, rcx
cmp r14, 0x22
jb 0x1400af977
lea rax, str.Miel
cmp qword [reloc.WS2_32.dll_ntohs], 0xf
cmova rax, qword [str.Miel]
mov qword [rsp + 0x30], rcx
mov qword [rsp + 0x28], rax
mov qword [rsp + 0x20], 0x22
lea r9, str.http:__144.22.50.88_addys_updates_
lea r8, str.Miel
movzx edx, byte [rbp + 0xaf0]
lea rcx, [rsp + 0x40]
call fcn.140055090
nop
mov r8d, ntohl
lea rdx, str._SToola.exe
lea rcx, [rsp + 0x40]
call fcn.14004d550
movups xmm0, xmmword [rax]
movups xmmword [rbp + 0x28], xmm0
movups xmm1, xmmword [rax + 0x10]
movups xmmword [rbp + 0x38], xmm1
mov qword [rax + 0x10], r12
mov qword [rax + 0x18], reloc.WS2_32.dll_ntohs
mov byte [rax], 0
lea rcx, [rsp + 0x40]
call fcn.14004d380
xorps xmm0, xmm0
movups xmmword [rbp - 0x40], xmm0
movdqa xmm1, xmmword [reloc.WS2_32.dll_ntohl]
movdqu xmmword [rbp - 0x30], xmm1
movsd xmm0, qword [str.SToola_new.exe]
movsd qword [rbp - 0x40], xmm0
mov eax, dword [0x1401ac3a8]
mov dword [rbp - 0x38], eax
movzx eax, word [0x1401ac3ac]
mov word [rbp - 0x34], ax
mov byte [rbp - 0x32], 0
mov qword [rbp + 0xaf0], 0xea60
lea rdx, [rbp + 0x28]
lea rcx, [rsp + 0x60]
call fcn.140053450
nop
lea rax, [rsp + 0x60]
mov qword [rsp + 0x40], rax
lea rax, [rbp - 0x80]
mov qword [rsp + 0x48], rax
movaps xmm0, xmmword [rsp + 0x40]
movdqa xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rbp - 0x20]
call fcn.1400b2170
lea rax, vtable.cpr::Url.0
mov qword [rbp - 0x20], rax
lea rcx, [rbp + 0x3f0]
call fcn.140167af0
nop
lea rdx, [rbp - 0x20]
lea rcx, [rbp + 0x3f0]
call fcn.1401688e0
lea rdx, [rbp + 0xaf0]
lea rcx, [rbp + 0x3f0]
call fcn.1401688b0
lea rdx, [rbp + 0x6b0]
lea rcx, [rbp + 0x3f0]
call fcn.140168320
nop
lea rcx, [rbp + 0x3f0]
call fcn.1400b35e0
nop
lea rcx, [rbp - 0x18]
call fcn.14004d380
nop
lea r9, [fcn.14004d300]
mov edx, 0x20
mov r8d, 1
lea rcx, [rsp + 0x60]
call fcn.14016d354
cmp dword [rbp + 0x6c0], 0xc8
je 0x1400af4e8
lea rdx, str.Failed_to_download_the_update._Closing_application..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14009dc00
mov dword [rbp + 0xaf0], 3
lea rdx, [rbp + 0xaf0]
lea rcx, [rbp + 0xaf8]
call fcn.140064230
mov rcx, rax
call fcn.14006ebc0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rdx, [rbp - 0x40]
cmp qword [rbp - 0x28], 0xf
cmova rdx, qword [rbp - 0x40]
mov r8d, 0x20
lea rcx, [rbp + 0x90]
call fcn.140098e10
mov rax, qword [rbp + 0x90]
movsxd rcx, dword [rax + 4]
lea rax, vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov qword [rbp + rcx + 0x90], rax
mov rax, qword [rbp + 0x90]
movsxd rcx, dword [rax + 4]
lea edx, [rcx - 0xa8]
mov dword [rbp + rcx + 0x8c], edx
mov rax, qword [rbp + 0x90]
movsxd rcx, dword [rax + 4]
lea rax, [rbp + 0x90]
add rcx, rax
call qword [sym.imp.MSVCP140.dll_public:_bool___cdecl_std::ios_base::operator__void_const___ptr64]
test al, al
je 0x1400af59a
lea rdx, str.Failed_to_create_temporary_file_for_update._Closing_application..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cerr]
call fcn.14009dc00
mov dword [rbp + 0xaf0], 3
lea rdx, [rbp + 0xaf0]
lea rcx, [rbp + 0xaf8]
call fcn.140064230
mov rcx, rax
call fcn.14006ebc0
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
int3
lea rcx, [rbp + 0x6c8]
call fcn.1400533b0
mov rbx, rax
lea rcx, [rbp + 0x6c8]
call fcn.14004d2f0
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x90]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x90]
call fcn.140098d70
lea rdx, str.Downloading_update.._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14009dc00
mov dword [rbp + 0xaf0], 3
lea rdx, [rbp + 0xaf0]
lea rcx, [rbp + 0xaf8]
call fcn.140064230
mov rcx, rax
call fcn.14006ebc0
lea rcx, [rbp + 8]
call fcn.1400b2c10
nop
lea rcx, [rbp + 0x48]
call fcn.1400b2c60
nop
lea rcx, [rbp + 8]
call fcn.1400aea30
test al, al
je 0x1400af63a
lea rdx, [rbp + 0x48]
lea rcx, [rbp + 8]
call fcn.1400aeb20
lea rdx, [rbp - 0x40]
lea rcx, [rbp - 0x80]
call fcn.1400b2cb0
nop
lea rdx, [rbp + 8]
lea rcx, [rbp - 0x80]
call fcn.1400aeb20
nop
lea rcx, [rbp - 0x80]
call fcn.1400ac8c0
lea r8, str.Miel
lea rdx, str.http:__144.22.50.88_addys_updates_
lea rcx, [rsp + 0x40]
call fcn.140053d00
nop
lea r8, str._changelog.txt
mov rdx, rax
lea rcx, [rbp - 0x20]
call fcn.140053c90
nop
lea rcx, [rsp + 0x40]
call fcn.14004d300
mov dword [rbp + 0xaf0], 0xea60
lea rdx, [rbp + 0xaf0]
lea rcx, [rbp + 0xaf8]
call fcn.140064230
mov rbx, rax
lea rdx, [rbp - 0x20]
lea rcx, [rbp - 0x80]
call fcn.140053450
nop
lea r8, [rbp - 0x60]
lea rdx, [rbp - 0x80]
lea rcx, [rsp + 0x60]
call fcn.1400ac8b0
movups xmm0, xmmword [rax]
movaps xmmword [rsp + 0x40], xmm0
lea rdx, [rsp + 0x40]
lea rcx, [rbp + 0x68]
call fcn.1400aebb0
nop
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x7f0]
call fcn.1400b2ba0
nop
lea rcx, [rbp + 0x68]
call fcn.1400aec20
nop
lea r9, [fcn.14004d300]
mov edx, 0x20
mov r8d, 1
lea rcx, [rbp - 0x80]
call fcn.14016d354
cmp dword [rbp + 0x800], 0xc8
jne 0x1400af7a2
mov r8d, 2
lea rdx, str.changelog.txt
lea rcx, [rbp + 0x3f0]
call fcn.140098e10
nop
lea rcx, [rbp + 0x3f0]
call fcn.140098db0
test al, al
je 0x1400af796
lea rcx, [rbp + 0x808]
call fcn.1400533b0
mov rbx, rax
lea rcx, [rbp + 0x808]
call fcn.14004d2f0
mov r8, rbx
mov rdx, rax
lea rcx, [rbp + 0x3f0]
call qword [sym.imp.MSVCP140.dll_public:_class_std::basic_ostream_char__struct_std::char_traits_char______ptr64___cdecl_std::basic_ostream_char__struct_std::char_traits_char__::write_char_const____ptr64__long_long___int64_____ptr64]
lea rcx, [rbp + 0x3f0]
call fcn.140098d70
nop
lea rcx, [rbp + 0x3f0]
call fcn.140097e90
lea rdx, str.Installing_the_update.._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14009dc00
mov dword [rbp + 0xaf0], 3
lea rdx, [rbp + 0xaf0]
lea rcx, [rbp + 0xb00]
call fcn.140064230
mov rcx, rax
call fcn.14006ebc0
lea rdx, str.Update_successfully_installed__Closing_application..._n
mov rcx, qword [sym.imp.MSVCP140.dll_class_std::basic_ostream_char__struct_std::char_traits_char___std::cout]
call fcn.14009dc00
mov dword [rbp + 0xaf0], 0x1f4
lea rdx, [rbp + 0xaf0]
lea rcx, [rbp + 0xb00]
call fcn.140064230
mov rcx, rax
call fcn.14006ea70
mov r8d, 2
lea rdx, str.cleanup.bat
lea rcx, [rbp + 0x1a0]
call fcn.140098e10
nop
lea rcx, [rbp + 0x1a0]
call fcn.140098db0
test al, al
je 0x1400af915
lea rdx, str._echo_off_n
lea rcx, [rbp + 0x1a0]
call fcn.14009dc00
lea rdx, str.timeout__t_3___nul_n
lea rcx, [rbp + 0x1a0]
call fcn.14009dc00
lea rdx, str.del__
lea rcx, [rbp + 0x1a0]
call fcn.14009dc00
mov rbx, rax
lea rdx, [rbp - 0x80]
lea rcx, [rbp + 0x48]
call fcn.1400ae310
nop
mov rdx, rax
mov rcx, rbx
call fcn.14006eca0
mov rcx, rax
lea rdx, [0x1401ac4cc]
call fcn.14009dc00
nop
lea rcx, [rbp - 0x80]
call fcn.14004d300
lea rdx, str.del__0
lea rcx, [rbp + 0x1a0]
call fcn.14009dc00
lea rcx, [rbp + 0x1a0]
call fcn.140098d70
mov dword [rsp + 0x28], r12d
mov qword [rsp + 0x20], r12
xor r9d, r9d
lea r8, str.cleanup.bat
lea rdx, str.open
xor ecx, ecx
call qword [sym.imp.SHELL32.dll_ShellExecuteA]
mov dword [rbp + 0xaf0], 0xfa
lea rdx, [rbp + 0xaf0]
lea rcx, [rbp + 0xaf8]
call fcn.140064230
mov rcx, rax
call fcn.14006ea70
xor ecx, ecx
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_exit]
nop
cmp rbx, 0xf
jbe 0x1400af959
lea rdx, [rbx + 1]
mov rax, rdi
cmp rdx, 0x1000
jb 0x1400af950
add rdx, 0x27
mov rdi, qword [rdi - 8]
sub rax, rdi
add rax, 0xfffffffffffffff8
cmp rax, 0x1f
jbe 0x1400af950
call qword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
mov rcx, rdi
call fcn.14016d66c
nop
lea rcx, [rbp + 0x2b0]
call fcn.1400af990
add rsp, 0xbb0
pop r15
pop r14
pop r12
pop rdi
pop rsi
pop rbx
pop rbp
ret
call fcn.140039ff0
nop
call fcn.140012e50
nop
call fcn.140039ff0
nop
call fcn.140039ff0
int3